X-Git-Url: http://andersk.mit.edu/gitweb/gssapi-openssh.git/blobdiff_plain/77e22b9437027bc82e2f825721ef938ebd3da9b6..86a22a0a7eda4bbef1e9d7157145cf6b7f42f1a1:/openssh/monitor_wrap.c

diff --git a/openssh/monitor_wrap.c b/openssh/monitor_wrap.c
index 396ec32..6366075 100644
--- a/openssh/monitor_wrap.c
+++ b/openssh/monitor_wrap.c
@@ -1,3 +1,4 @@
+/* $OpenBSD: monitor_wrap.c,v 1.54 2006/08/12 20:46:46 miod Exp $ */
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -25,18 +26,31 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: monitor_wrap.c,v 1.35 2003/11/17 11:06:07 markus Exp $");
+
+#include <sys/types.h>
+#include <sys/uio.h>
+
+#include <errno.h>
+#include <pwd.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <stdio.h>
+#include <string.h>
+#include <unistd.h>
 
 #include <openssl/bn.h>
 #include <openssl/dh.h>
 
+#include "xmalloc.h"
 #include "ssh.h"
 #include "dh.h"
+#include "buffer.h"
+#include "key.h"
+#include "cipher.h"
 #include "kex.h"
+#include "hostfile.h"
 #include "auth.h"
 #include "auth-options.h"
-#include "buffer.h"
-#include "bufaux.h"
 #include "packet.h"
 #include "mac.h"
 #include "log.h"
@@ -48,21 +62,18 @@ RCSID("$OpenBSD: monitor_wrap.c,v 1.35 2003/11/17 11:06:07 markus Exp $");
 #include "zlib.h"
 #endif
 #include "monitor.h"
+#ifdef GSSAPI
+#include "ssh-gss.h"
+#endif
 #include "monitor_wrap.h"
-#include "xmalloc.h"
 #include "atomicio.h"
 #include "monitor_fdpass.h"
-#include "getput.h"
+#include "misc.h"
 #include "servconf.h"
 
-#include "auth.h"
 #include "channels.h"
 #include "session.h"
 
-#ifdef GSSAPI
-#include "ssh-gss.h"
-#endif
-
 /* Imports */
 extern int compat20;
 extern Newkeys *newkeys[];
@@ -70,6 +81,7 @@ extern z_stream incoming_stream;
 extern z_stream outgoing_stream;
 extern struct monitor *pmonitor;
 extern Buffer input, output;
+extern Buffer loginmsg;
 extern ServerOptions options;
 
 int
@@ -83,54 +95,51 @@ mm_is_monitor(void)
 }
 
 void
-mm_request_send(int socket, enum monitor_reqtype type, Buffer *m)
+mm_request_send(int sock, enum monitor_reqtype type, Buffer *m)
 {
 	u_int mlen = buffer_len(m);
 	u_char buf[5];
 
 	debug3("%s entering: type %d", __func__, type);
 
-	PUT_32BIT(buf, mlen + 1);
+	put_u32(buf, mlen + 1);
 	buf[4] = (u_char) type;		/* 1st byte of payload is mesg-type */
-	if (atomicio(vwrite, socket, buf, sizeof(buf)) != sizeof(buf))
-		fatal("%s: write", __func__);
-	if (atomicio(vwrite, socket, buffer_ptr(m), mlen) != mlen)
-		fatal("%s: write", __func__);
+	if (atomicio(vwrite, sock, buf, sizeof(buf)) != sizeof(buf))
+		fatal("%s: write: %s", __func__, strerror(errno));
+	if (atomicio(vwrite, sock, buffer_ptr(m), mlen) != mlen)
+		fatal("%s: write: %s", __func__, strerror(errno));
 }
 
 void
-mm_request_receive(int socket, Buffer *m)
+mm_request_receive(int sock, Buffer *m)
 {
 	u_char buf[4];
 	u_int msg_len;
-	ssize_t res;
 
 	debug3("%s entering", __func__);
 
-	res = atomicio(read, socket, buf, sizeof(buf));
-	if (res != sizeof(buf)) {
-		if (res == 0)
+	if (atomicio(read, sock, buf, sizeof(buf)) != sizeof(buf)) {
+		if (errno == EPIPE)
 			cleanup_exit(255);
-		fatal("%s: read: %ld", __func__, (long)res);
+		fatal("%s: read: %s", __func__, strerror(errno));
 	}
-	msg_len = GET_32BIT(buf);
+	msg_len = get_u32(buf);
 	if (msg_len > 256 * 1024)
 		fatal("%s: read: bad msg_len %d", __func__, msg_len);
 	buffer_clear(m);
 	buffer_append_space(m, msg_len);
-	res = atomicio(read, socket, buffer_ptr(m), msg_len);
-	if (res != msg_len)
-		fatal("%s: read: %ld != msg_len", __func__, (long)res);
+	if (atomicio(read, sock, buffer_ptr(m), msg_len) != msg_len)
+		fatal("%s: read: %s", __func__, strerror(errno));
 }
 
 void
-mm_request_receive_expect(int socket, enum monitor_reqtype type, Buffer *m)
+mm_request_receive_expect(int sock, enum monitor_reqtype type, Buffer *m)
 {
 	u_char rtype;
 
 	debug3("%s entering: type %d", __func__, type);
 
-	mm_request_receive(socket, m);
+	mm_request_receive(sock, m);
 	rtype = buffer_get_char(m);
 	if (rtype != type)
 		fatal("%s: read: rtype %d != type %d", __func__,
@@ -194,7 +203,7 @@ mm_key_sign(Key *key, u_char **sigp, u_int *lenp, u_char *data, u_int datalen)
 }
 
 struct passwd *
-mm_getpwnamallow(const char *login)
+mm_getpwnamallow(const char *username)
 {
 	Buffer m;
 	struct passwd *pw;
@@ -203,7 +212,7 @@ mm_getpwnamallow(const char *login)
 	debug3("%s entering", __func__);
 
 	buffer_init(&m);
-	buffer_put_cstring(&m, login);
+	buffer_put_cstring(&m, username);
 
 	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PWNAM, &m);
 
@@ -544,7 +553,7 @@ mm_send_kex(Buffer *m, Kex *kex)
 }
 
 void
-mm_send_keystate(struct monitor *pmonitor)
+mm_send_keystate(struct monitor *monitor)
 {
 	Buffer m;
 	u_char *blob, *p;
@@ -580,7 +589,7 @@ mm_send_keystate(struct monitor *pmonitor)
 		goto skip;
 	} else {
 		/* Kex for rekeying */
-		mm_send_kex(&m, *pmonitor->m_pkex);
+		mm_send_kex(&m, *monitor->m_pkex);
 	}
 
 	debug3("%s: Sending new keys: %p %p",
@@ -632,17 +641,17 @@ mm_send_keystate(struct monitor *pmonitor)
 	buffer_put_string(&m, buffer_ptr(&input), buffer_len(&input));
 	buffer_put_string(&m, buffer_ptr(&output), buffer_len(&output));
 
-	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_KEYEXPORT, &m);
+	mm_request_send(monitor->m_recvfd, MONITOR_REQ_KEYEXPORT, &m);
 	debug3("%s: Finished sending state", __func__);
 
 	buffer_free(&m);
 }
 
 int
-mm_pty_allocate(int *ptyfd, int *ttyfd, char *namebuf, int namebuflen)
+mm_pty_allocate(int *ptyfd, int *ttyfd, char *namebuf, size_t namebuflen)
 {
 	Buffer m;
-	char *p;
+	char *p, *msg;
 	int success = 0;
 
 	buffer_init(&m);
@@ -658,11 +667,15 @@ mm_pty_allocate(int *ptyfd, int *ttyfd, char *namebuf, int namebuflen)
 		return (0);
 	}
 	p = buffer_get_string(&m, NULL);
+	msg = buffer_get_string(&m, NULL);
 	buffer_free(&m);
 
 	strlcpy(namebuf, p, namebuflen); /* Possible truncation */
 	xfree(p);
 
+	buffer_append(&loginmsg, msg, strlen(msg));
+	xfree(msg);
+
 	*ptyfd = mm_receive_fd(pmonitor->m_recvfd);
 	*ttyfd = mm_receive_fd(pmonitor->m_recvfd);
 
@@ -711,6 +724,7 @@ mm_do_pam_account(void)
 {
 	Buffer m;
 	u_int ret;
+	char *msg;
 
 	debug3("%s entering", __func__);
 	if (!options.use_pam)
@@ -722,6 +736,9 @@ mm_do_pam_account(void)
 	mm_request_receive_expect(pmonitor->m_recvfd,
 	    MONITOR_ANS_PAM_ACCOUNT, &m);
 	ret = buffer_get_int(&m);
+	msg = buffer_get_string(&m, NULL);
+	buffer_append(&loginmsg, msg, strlen(msg));
+	xfree(msg);
 
 	buffer_free(&m);
 
@@ -757,7 +774,8 @@ mm_sshpam_query(void *ctx, char **name, char **info,
     u_int *num, char ***prompts, u_int **echo_on)
 {
 	Buffer m;
-	int i, ret;
+	u_int i;
+	int ret;
 
 	debug3("%s", __func__);
 	buffer_init(&m);
@@ -769,8 +787,11 @@ mm_sshpam_query(void *ctx, char **name, char **info,
 	*name = buffer_get_string(&m, NULL);
 	*info = buffer_get_string(&m, NULL);
 	*num = buffer_get_int(&m);
-	*prompts = xmalloc((*num + 1) * sizeof(char *));
-	*echo_on = xmalloc((*num + 1) * sizeof(u_int));
+	if (*num > PAM_MAX_NUM_MSG)
+		fatal("%s: recieved %u PAM messages, expected <= %u",
+		    __func__, *num, PAM_MAX_NUM_MSG);
+	*prompts = xcalloc((*num + 1), sizeof(char *));
+	*echo_on = xcalloc((*num + 1), sizeof(u_int));
 	for (i = 0; i < *num; ++i) {
 		(*prompts)[i] = buffer_get_string(&m, NULL);
 		(*echo_on)[i] = buffer_get_int(&m);
@@ -783,7 +804,8 @@ int
 mm_sshpam_respond(void *ctx, u_int num, char **resp)
 {
 	Buffer m;
-	int i, ret;
+	u_int i;
+	int ret;
 
 	debug3("%s", __func__);
 	buffer_init(&m);
@@ -852,8 +874,8 @@ mm_chall_setup(char **name, char **infotxt, u_int *numprompts,
 	*name = xstrdup("");
 	*infotxt = xstrdup("");
 	*numprompts = 1;
-	*prompts = xmalloc(*numprompts * sizeof(char *));
-	*echo_on = xmalloc(*numprompts * sizeof(u_int));
+	*prompts = xcalloc(*numprompts, sizeof(char *));
+	*echo_on = xcalloc(*numprompts, sizeof(u_int));
 	(*echo_on)[0] = 0;
 }
 
@@ -914,14 +936,14 @@ mm_bsdauth_respond(void *ctx, u_int numresponses, char **responses)
 	return ((authok == 0) ? -1 : 0);
 }
 
+#ifdef SKEY
 int
 mm_skey_query(void *ctx, char **name, char **infotxt,
    u_int *numprompts, char ***prompts, u_int **echo_on)
 {
 	Buffer m;
-	int len;
 	u_int success;
-	char *p, *challenge;
+	char *challenge;
 
 	debug3("%s: entering", __func__);
 
@@ -945,11 +967,7 @@ mm_skey_query(void *ctx, char **name, char **infotxt,
 
 	mm_chall_setup(name, infotxt, numprompts, prompts, echo_on);
 
-	len = strlen(challenge) + strlen(SKEY_PROMPT) + 1;
-	p = xmalloc(len);
-	strlcpy(p, challenge, len);
-	strlcat(p, SKEY_PROMPT, len);
-	(*prompts)[0] = p;
+	xasprintf(*prompts, "%s%s", challenge, SKEY_PROMPT);
 	xfree(challenge);
 
 	return (0);
@@ -977,6 +995,7 @@ mm_skey_respond(void *ctx, u_int numresponses, char **responses)
 
 	return ((authok == 0) ? -1 : 0);
 }
+#endif /* SKEY */
 
 void
 mm_ssh1_session_id(u_char session_id[16])
@@ -1091,9 +1110,39 @@ mm_auth_rsa_verify_response(Key *key, BIGNUM *p, u_char response[16])
 	return (success);
 }
 
+#ifdef SSH_AUDIT_EVENTS
+void
+mm_audit_event(ssh_audit_event_t event)
+{
+	Buffer m;
+
+	debug3("%s entering", __func__);
+
+	buffer_init(&m);
+	buffer_put_int(&m, event);
+
+	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_EVENT, &m);
+	buffer_free(&m);
+}
+
+void
+mm_audit_run_command(const char *command)
+{
+	Buffer m;
+
+	debug3("%s entering command %s", __func__, command);
+
+	buffer_init(&m);
+	buffer_put_cstring(&m, command);
+
+	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_COMMAND, &m);
+	buffer_free(&m);
+}
+#endif /* SSH_AUDIT_EVENTS */
+
 #ifdef GSSAPI
 OM_uint32
-mm_ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid)
+mm_ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID goid)
 {
 	Buffer m;
 	OM_uint32 major;
@@ -1102,7 +1151,7 @@ mm_ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid)
 	*ctx = NULL;
 
 	buffer_init(&m);
-	buffer_put_string(&m, oid->elements, oid->length);
+	buffer_put_string(&m, goid->elements, goid->length);
 
 	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSSETUP, &m);
 	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSSETUP, &m);
@@ -1177,24 +1226,25 @@ mm_ssh_gssapi_userok(char *user)
 }
 
 OM_uint32
-mm_ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_desc *data, gss_buffer_desc *hash) {
-        Buffer m;
-        OM_uint32 major;
+mm_ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_desc *data, gss_buffer_desc *hash)
+{
+	Buffer m;
+	OM_uint32 major;
 	u_int len;
 
-        buffer_init(&m);
-        buffer_put_string(&m, data->value, data->length);
+	buffer_init(&m);
+	buffer_put_string(&m, data->value, data->length);
 
-        mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSSIGN, &m);
-        mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSSIGN, &m);
+	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSSIGN, &m);
+	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSSIGN, &m);
 
-        major=buffer_get_int(&m);
-        hash->value = buffer_get_string(&m, &len);
+	major = buffer_get_int(&m);
+	hash->value = buffer_get_string(&m, &len);
 	hash->length = len;
 
 	buffer_free(&m);
-	
-        return(major);
+
+	return(major);
 }
 
 char *
@@ -1273,4 +1323,5 @@ mm_ssh_gssapi_localname(char **lname)
 	
         return(0);
 }	
+
 #endif /* GSSAPI */