ssh-agent.c

   1 /*      $OpenBSD: ssh-agent.c,v 1.28 2000/04/14 10:30:33 markus Exp $   */
   2
   3 /*
   4  * Author: Tatu Ylonen <ylo@cs.hut.fi>
   5  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
   6  *                    All rights reserved
   7  * Created: Wed Mar 29 03:46:59 1995 ylo
   8  * The authentication agent program.
   9  */
  10
  11 #include "includes.h"
  12 RCSID("$OpenBSD: ssh-agent.c,v 1.28 2000/04/14 10:30:33 markus Exp $");
  13
  14 #include "ssh.h"
  15 #include "rsa.h"
  16 #include "authfd.h"
  17 #include "buffer.h"
  18 #include "bufaux.h"
  19 #include "xmalloc.h"
  20 #include "packet.h"
  21 #include "getput.h"
  22 #include "mpaux.h"
  23
  24 #ifdef HAVE_OPENSSL
  25 #include <openssl/md5.h>
  26 #endif
  27 #ifdef HAVE_SSL
  28 #include <ssl/md5.h>
  29 #endif
  30
  31 typedef struct {
  32         int fd;
  33         enum {
  34                 AUTH_UNUSED, AUTH_SOCKET, AUTH_CONNECTION
  35         } type;
  36         Buffer input;
  37         Buffer output;
  38 } SocketEntry;
  39
  40 unsigned int sockets_alloc = 0;
  41 SocketEntry *sockets = NULL;
  42
  43 typedef struct {
  44         RSA *key;
  45         char *comment;
  46 } Identity;
  47
  48 unsigned int num_identities = 0;
  49 Identity *identities = NULL;
  50
  51 int max_fd = 0;
  52
  53 /* pid of shell == parent of agent */
  54 int parent_pid = -1;
  55
  56 /* pathname and directory for AUTH_SOCKET */
  57 char socket_name[1024];
  58 char socket_dir[1024];
  59
  60 #ifdef HAVE___PROGNAME
  61 extern char *__progname;
  62 #else /* HAVE___PROGNAME */
  63 const char *__progname = "ssh-agent";
  64 #endif /* HAVE___PROGNAME */
  65
  66 void
  67 process_request_identity(SocketEntry *e)
  68 {
  69         Buffer msg;
  70         int i;
  71
  72         buffer_init(&msg);
  73         buffer_put_char(&msg, SSH_AGENT_RSA_IDENTITIES_ANSWER);
  74         buffer_put_int(&msg, num_identities);
  75         for (i = 0; i < num_identities; i++) {
  76                 buffer_put_int(&msg, BN_num_bits(identities[i].key->n));
  77                 buffer_put_bignum(&msg, identities[i].key->e);
  78                 buffer_put_bignum(&msg, identities[i].key->n);
  79                 buffer_put_string(&msg, identities[i].comment,
  80                                   strlen(identities[i].comment));
  81         }
  82         buffer_put_int(&e->output, buffer_len(&msg));
  83         buffer_append(&e->output, buffer_ptr(&msg), buffer_len(&msg));
  84         buffer_free(&msg);
  85 }
  86
  87 void
  88 process_authentication_challenge(SocketEntry *e)
  89 {
  90         int i, pub_bits, len;
  91         BIGNUM *pub_e, *pub_n, *challenge;
  92         Buffer msg;
  93         MD5_CTX md;
  94         unsigned char buf[32], mdbuf[16], session_id[16];
  95         unsigned int response_type;
  96
  97         buffer_init(&msg);
  98         pub_e = BN_new();
  99         pub_n = BN_new();
 100         challenge = BN_new();
 101         pub_bits = buffer_get_int(&e->input);
 102         buffer_get_bignum(&e->input, pub_e);
 103         buffer_get_bignum(&e->input, pub_n);
 104         buffer_get_bignum(&e->input, challenge);
 105         if (buffer_len(&e->input) == 0) {
 106                 /* Compatibility code for old servers. */
 107                 memset(session_id, 0, 16);
 108                 response_type = 0;
 109         } else {
 110                 /* New code. */
 111                 buffer_get(&e->input, (char *) session_id, 16);
 112                 response_type = buffer_get_int(&e->input);
 113         }
 114         for (i = 0; i < num_identities; i++)
 115                 if (pub_bits == BN_num_bits(identities[i].key->n) &&
 116                     BN_cmp(pub_e, identities[i].key->e) == 0 &&
 117                     BN_cmp(pub_n, identities[i].key->n) == 0) {
 118                         /* Decrypt the challenge using the private key. */
 119                         rsa_private_decrypt(challenge, challenge, identities[i].key);
 120
 121                         /* Compute the desired response. */
 122                         switch (response_type) {
 123                         case 0:/* As of protocol 1.0 */
 124                                 /* This response type is no longer supported. */
 125                                 log("Compatibility with ssh protocol 1.0 no longer supported.");
 126                                 buffer_put_char(&msg, SSH_AGENT_FAILURE);
 127                                 goto send;
 128
 129                         case 1:/* As of protocol 1.1 */
 130                                 /* The response is MD5 of decrypted challenge plus session id. */
 131                                 len = BN_num_bytes(challenge);
 132
 133                                 if (len <= 0 || len > 32) {
 134                                         fatal("process_authentication_challenge: "
 135                                          "bad challenge length %d", len);
 136                                 }
 137                                 memset(buf, 0, 32);
 138                                 BN_bn2bin(challenge, buf + 32 - len);
 139                                 MD5_Init(&md);
 140                                 MD5_Update(&md, buf, 32);
 141                                 MD5_Update(&md, session_id, 16);
 142                                 MD5_Final(mdbuf, &md);
 143                                 break;
 144
 145                         default:
 146                                 fatal("process_authentication_challenge: bad response_type %d",
 147                                       response_type);
 148                                 break;
 149                         }
 150
 151                         /* Send the response. */
 152                         buffer_put_char(&msg, SSH_AGENT_RSA_RESPONSE);
 153                         for (i = 0; i < 16; i++)
 154                                 buffer_put_char(&msg, mdbuf[i]);
 155
 156                         goto send;
 157                 }
 158         /* Unknown identity.  Send failure. */
 159         buffer_put_char(&msg, SSH_AGENT_FAILURE);
 160 send:
 161         buffer_put_int(&e->output, buffer_len(&msg));
 162         buffer_append(&e->output, buffer_ptr(&msg),
 163                       buffer_len(&msg));
 164         buffer_free(&msg);
 165         BN_clear_free(pub_e);
 166         BN_clear_free(pub_n);
 167         BN_clear_free(challenge);
 168 }
 169
 170 void
 171 process_remove_identity(SocketEntry *e)
 172 {
 173         unsigned int bits;
 174         unsigned int i;
 175         BIGNUM *dummy, *n;
 176
 177         dummy = BN_new();
 178         n = BN_new();
 179
 180         /* Get the key from the packet. */
 181         bits = buffer_get_int(&e->input);
 182         buffer_get_bignum(&e->input, dummy);
 183         buffer_get_bignum(&e->input, n);
 184
 185         if (bits != BN_num_bits(n))
 186                 error("Warning: identity keysize mismatch: actual %d, announced %d",
 187                       BN_num_bits(n), bits);
 188
 189         /* Check if we have the key. */
 190         for (i = 0; i < num_identities; i++)
 191                 if (BN_cmp(identities[i].key->n, n) == 0) {
 192                         /*
 193                          * We have this key.  Free the old key.  Since we
 194                          * don\'t want to leave empty slots in the middle of
 195                          * the array, we actually free the key there and copy
 196                          * data from the last entry.
 197                          */
 198                         RSA_free(identities[i].key);
 199                         xfree(identities[i].comment);
 200                         if (i < num_identities - 1)
 201                                 identities[i] = identities[num_identities - 1];
 202                         num_identities--;
 203                         BN_clear_free(dummy);
 204                         BN_clear_free(n);
 205
 206                         /* Send success. */
 207                         buffer_put_int(&e->output, 1);
 208                         buffer_put_char(&e->output, SSH_AGENT_SUCCESS);
 209                         return;
 210                 }
 211         /* We did not have the key. */
 212         BN_clear(dummy);
 213         BN_clear(n);
 214
 215         /* Send failure. */
 216         buffer_put_int(&e->output, 1);
 217         buffer_put_char(&e->output, SSH_AGENT_FAILURE);
 218 }
 219
 220 /*
 221  * Removes all identities from the agent.
 222  */
 223 void
 224 process_remove_all_identities(SocketEntry *e)
 225 {
 226         unsigned int i;
 227
 228         /* Loop over all identities and clear the keys. */
 229         for (i = 0; i < num_identities; i++) {
 230                 RSA_free(identities[i].key);
 231                 xfree(identities[i].comment);
 232         }
 233
 234         /* Mark that there are no identities. */
 235         num_identities = 0;
 236
 237         /* Send success. */
 238         buffer_put_int(&e->output, 1);
 239         buffer_put_char(&e->output, SSH_AGENT_SUCCESS);
 240         return;
 241 }
 242
 243 /*
 244  * Adds an identity to the agent.
 245  */
 246 void
 247 process_add_identity(SocketEntry *e)
 248 {
 249         RSA *k;
 250         int i;
 251         BIGNUM *aux;
 252         BN_CTX *ctx;
 253
 254         if (num_identities == 0)
 255                 identities = xmalloc(sizeof(Identity));
 256         else
 257                 identities = xrealloc(identities, (num_identities + 1) * sizeof(Identity));
 258
 259         identities[num_identities].key = RSA_new();
 260         k = identities[num_identities].key;
 261         buffer_get_int(&e->input);      /* bits */
 262         k->n = BN_new();
 263         buffer_get_bignum(&e->input, k->n);
 264         k->e = BN_new();
 265         buffer_get_bignum(&e->input, k->e);
 266         k->d = BN_new();
 267         buffer_get_bignum(&e->input, k->d);
 268         k->iqmp = BN_new();
 269         buffer_get_bignum(&e->input, k->iqmp);
 270         /* SSH and SSL have p and q swapped */
 271         k->q = BN_new();
 272         buffer_get_bignum(&e->input, k->q);     /* p */
 273         k->p = BN_new();
 274         buffer_get_bignum(&e->input, k->p);     /* q */
 275
 276         /* Generate additional parameters */
 277         aux = BN_new();
 278         ctx = BN_CTX_new();
 279
 280         BN_sub(aux, k->q, BN_value_one());
 281         k->dmq1 = BN_new();
 282         BN_mod(k->dmq1, k->d, aux, ctx);
 283
 284         BN_sub(aux, k->p, BN_value_one());
 285         k->dmp1 = BN_new();
 286         BN_mod(k->dmp1, k->d, aux, ctx);
 287
 288         BN_clear_free(aux);
 289         BN_CTX_free(ctx);
 290
 291         identities[num_identities].comment = buffer_get_string(&e->input, NULL);
 292
 293         /* Check if we already have the key. */
 294         for (i = 0; i < num_identities; i++)
 295                 if (BN_cmp(identities[i].key->n, k->n) == 0) {
 296                         /*
 297                          * We already have this key.  Clear and free the new
 298                          * data and return success.
 299                          */
 300                         RSA_free(k);
 301                         xfree(identities[num_identities].comment);
 302
 303                         /* Send success. */
 304                         buffer_put_int(&e->output, 1);
 305                         buffer_put_char(&e->output, SSH_AGENT_SUCCESS);
 306                         return;
 307                 }
 308         /* Increment the number of identities. */
 309         num_identities++;
 310
 311         /* Send a success message. */
 312         buffer_put_int(&e->output, 1);
 313         buffer_put_char(&e->output, SSH_AGENT_SUCCESS);
 314 }
 315
 316 void
 317 process_message(SocketEntry *e)
 318 {
 319         unsigned int msg_len;
 320         unsigned int type;
 321         unsigned char *cp;
 322         if (buffer_len(&e->input) < 5)
 323                 return;         /* Incomplete message. */
 324         cp = (unsigned char *) buffer_ptr(&e->input);
 325         msg_len = GET_32BIT(cp);
 326         if (msg_len > 256 * 1024) {
 327                 shutdown(e->fd, SHUT_RDWR);
 328                 close(e->fd);
 329                 e->type = AUTH_UNUSED;
 330                 return;
 331         }
 332         if (buffer_len(&e->input) < msg_len + 4)
 333                 return;
 334         buffer_consume(&e->input, 4);
 335         type = buffer_get_char(&e->input);
 336
 337         switch (type) {
 338         case SSH_AGENTC_REQUEST_RSA_IDENTITIES:
 339                 process_request_identity(e);
 340                 break;
 341         case SSH_AGENTC_RSA_CHALLENGE:
 342                 process_authentication_challenge(e);
 343                 break;
 344         case SSH_AGENTC_ADD_RSA_IDENTITY:
 345                 process_add_identity(e);
 346                 break;
 347         case SSH_AGENTC_REMOVE_RSA_IDENTITY:
 348                 process_remove_identity(e);
 349                 break;
 350         case SSH_AGENTC_REMOVE_ALL_RSA_IDENTITIES:
 351                 process_remove_all_identities(e);
 352                 break;
 353         default:
 354                 /* Unknown message.  Respond with failure. */
 355                 error("Unknown message %d", type);
 356                 buffer_clear(&e->input);
 357                 buffer_put_int(&e->output, 1);
 358                 buffer_put_char(&e->output, SSH_AGENT_FAILURE);
 359                 break;
 360         }
 361 }
 362
 363 void
 364 new_socket(int type, int fd)
 365 {
 366         unsigned int i, old_alloc;
 367         if (fcntl(fd, F_SETFL, O_NONBLOCK) < 0)
 368                 error("fcntl O_NONBLOCK: %s", strerror(errno));
 369
 370         if (fd > max_fd)
 371                 max_fd = fd;
 372
 373         for (i = 0; i < sockets_alloc; i++)
 374                 if (sockets[i].type == AUTH_UNUSED) {
 375                         sockets[i].fd = fd;
 376                         sockets[i].type = type;
 377                         buffer_init(&sockets[i].input);
 378                         buffer_init(&sockets[i].output);
 379                         return;
 380                 }
 381         old_alloc = sockets_alloc;
 382         sockets_alloc += 10;
 383         if (sockets)
 384                 sockets = xrealloc(sockets, sockets_alloc * sizeof(sockets[0]));
 385         else
 386                 sockets = xmalloc(sockets_alloc * sizeof(sockets[0]));
 387         for (i = old_alloc; i < sockets_alloc; i++)
 388                 sockets[i].type = AUTH_UNUSED;
 389         sockets[old_alloc].type = type;
 390         sockets[old_alloc].fd = fd;
 391         buffer_init(&sockets[old_alloc].input);
 392         buffer_init(&sockets[old_alloc].output);
 393 }
 394
 395 void
 396 prepare_select(fd_set *readset, fd_set *writeset)
 397 {
 398         unsigned int i;
 399         for (i = 0; i < sockets_alloc; i++)
 400                 switch (sockets[i].type) {
 401                 case AUTH_SOCKET:
 402                 case AUTH_CONNECTION:
 403                         FD_SET(sockets[i].fd, readset);
 404                         if (buffer_len(&sockets[i].output) > 0)
 405                                 FD_SET(sockets[i].fd, writeset);
 406                         break;
 407                 case AUTH_UNUSED:
 408                         break;
 409                 default:
 410                         fatal("Unknown socket type %d", sockets[i].type);
 411                         break;
 412                 }
 413 }
 414
 415 void
 416 after_select(fd_set *readset, fd_set *writeset)
 417 {
 418         unsigned int i;
 419         int len, sock;
 420         socklen_t slen;
 421         char buf[1024];
 422         struct sockaddr_un sunaddr;
 423
 424         for (i = 0; i < sockets_alloc; i++)
 425                 switch (sockets[i].type) {
 426                 case AUTH_UNUSED:
 427                         break;
 428                 case AUTH_SOCKET:
 429                         if (FD_ISSET(sockets[i].fd, readset)) {
 430                                 slen = sizeof(sunaddr);
 431                                 sock = accept(sockets[i].fd, (struct sockaddr *) & sunaddr, &slen);
 432                                 if (sock < 0) {
 433                                         perror("accept from AUTH_SOCKET");
 434                                         break;
 435                                 }
 436                                 new_socket(AUTH_CONNECTION, sock);
 437                         }
 438                         break;
 439                 case AUTH_CONNECTION:
 440                         if (buffer_len(&sockets[i].output) > 0 &&
 441                             FD_ISSET(sockets[i].fd, writeset)) {
 442                                 len = write(sockets[i].fd, buffer_ptr(&sockets[i].output),
 443                                          buffer_len(&sockets[i].output));
 444                                 if (len <= 0) {
 445                                         shutdown(sockets[i].fd, SHUT_RDWR);
 446                                         close(sockets[i].fd);
 447                                         sockets[i].type = AUTH_UNUSED;
 448                                         break;
 449                                 }
 450                                 buffer_consume(&sockets[i].output, len);
 451                         }
 452                         if (FD_ISSET(sockets[i].fd, readset)) {
 453                                 len = read(sockets[i].fd, buf, sizeof(buf));
 454                                 if (len <= 0) {
 455                                         shutdown(sockets[i].fd, SHUT_RDWR);
 456                                         close(sockets[i].fd);
 457                                         sockets[i].type = AUTH_UNUSED;
 458                                         break;
 459                                 }
 460                                 buffer_append(&sockets[i].input, buf, len);
 461                                 process_message(&sockets[i]);
 462                         }
 463                         break;
 464                 default:
 465                         fatal("Unknown type %d", sockets[i].type);
 466                 }
 467 }
 468
 469 void
 470 check_parent_exists(int sig)
 471 {
 472         if (kill(parent_pid, 0) < 0) {
 473                 /* printf("Parent has died - Authentication agent exiting.\n"); */
 474                 exit(1);
 475         }
 476         signal(SIGALRM, check_parent_exists);
 477         alarm(10);
 478 }
 479
 480 void
 481 cleanup_socket(void)
 482 {
 483         remove(socket_name);
 484         rmdir(socket_dir);
 485 }
 486
 487 void
 488 cleanup_exit(int i)
 489 {
 490         cleanup_socket();
 491         exit(i);
 492 }
 493
 494 void
 495 usage()
 496 {
 497         fprintf(stderr, "ssh-agent version %s\n", SSH_VERSION);
 498         fprintf(stderr, "Usage: %s [-c | -s] [-k] [command {args...]]\n",
 499                 __progname);
 500         exit(1);
 501 }
 502
 503 int
 504 main(int ac, char **av)
 505 {
 506         fd_set readset, writeset;
 507         int sock, c_flag = 0, k_flag = 0, s_flag = 0, ch;
 508         struct sockaddr_un sunaddr;
 509         pid_t pid;
 510         char *shell, *format, *pidstr, pidstrbuf[1 + 3 * sizeof pid];
 511
 512         /* check if RSA support exists */
 513         if (rsa_alive() == 0) {
 514                 fprintf(stderr,
 515                         "%s: no RSA support in libssl and libcrypto.  See ssl(8).\n",
 516                         __progname);
 517                 exit(1);
 518         }
 519         while ((ch = getopt(ac, av, "cks")) != -1) {
 520                 switch (ch) {
 521                 case 'c':
 522                         if (s_flag)
 523                                 usage();
 524                         c_flag++;
 525                         break;
 526                 case 'k':
 527                         k_flag++;
 528                         break;
 529                 case 's':
 530                         if (c_flag)
 531                                 usage();
 532                         s_flag++;
 533                         break;
 534                 default:
 535                         usage();
 536                 }
 537         }
 538         ac -= optind;
 539         av += optind;
 540
 541         if (ac > 0 && (c_flag || k_flag || s_flag))
 542                 usage();
 543
 544         if (ac == 0 && !c_flag && !k_flag && !s_flag) {
 545                 shell = getenv("SHELL");
 546                 if (shell != NULL && strncmp(shell + strlen(shell) - 3, "csh", 3) == 0)
 547                         c_flag = 1;
 548         }
 549         if (k_flag) {
 550                 pidstr = getenv(SSH_AGENTPID_ENV_NAME);
 551                 if (pidstr == NULL) {
 552                         fprintf(stderr, "%s not set, cannot kill agent\n",
 553                                 SSH_AGENTPID_ENV_NAME);
 554                         exit(1);
 555                 }
 556                 pid = atoi(pidstr);
 557                 if (pid < 1) {  /* XXX PID_MAX check too */
 558                         fprintf(stderr, "%s=\"%s\", which is not a good PID\n",
 559                                 SSH_AGENTPID_ENV_NAME, pidstr);
 560                         exit(1);
 561                 }
 562                 if (kill(pid, SIGTERM) == -1) {
 563                         perror("kill");
 564                         exit(1);
 565                 }
 566                 format = c_flag ? "unsetenv %s;\n" : "unset %s;\n";
 567                 printf(format, SSH_AUTHSOCKET_ENV_NAME);
 568                 printf(format, SSH_AGENTPID_ENV_NAME);
 569                 printf("echo Agent pid %d killed;\n", pid);
 570                 exit(0);
 571         }
 572         parent_pid = getpid();
 573
 574         /* Create private directory for agent socket */
 575         strlcpy(socket_dir, "/tmp/ssh-XXXXXXXX", sizeof socket_dir);
 576         if (mkdtemp(socket_dir) == NULL) {
 577                 perror("mkdtemp: private socket dir");
 578                 exit(1);
 579         }
 580         snprintf(socket_name, sizeof socket_name, "%s/agent.%d", socket_dir,
 581                  parent_pid);
 582
 583         /*
 584          * Create socket early so it will exist before command gets run from
 585          * the parent.
 586          */
 587         sock = socket(AF_UNIX, SOCK_STREAM, 0);
 588         if (sock < 0) {
 589                 perror("socket");
 590                 cleanup_exit(1);
 591         }
 592         memset(&sunaddr, 0, sizeof(sunaddr));
 593         sunaddr.sun_family = AF_UNIX;
 594         strlcpy(sunaddr.sun_path, socket_name, sizeof(sunaddr.sun_path));
 595         if (bind(sock, (struct sockaddr *) & sunaddr, sizeof(sunaddr)) < 0) {
 596                 perror("bind");
 597                 cleanup_exit(1);
 598         }
 599         if (listen(sock, 5) < 0) {
 600                 perror("listen");
 601                 cleanup_exit(1);
 602         }
 603         /*
 604          * Fork, and have the parent execute the command, if any, or present
 605          * the socket data.  The child continues as the authentication agent.
 606          */
 607         pid = fork();
 608         if (pid == -1) {
 609                 perror("fork");
 610                 exit(1);
 611         }
 612         if (pid != 0) {         /* Parent - execute the given command. */
 613                 close(sock);
 614                 snprintf(pidstrbuf, sizeof pidstrbuf, "%d", pid);
 615                 if (ac == 0) {
 616                         format = c_flag ? "setenv %s %s;\n" : "%s=%s; export %s;\n";
 617                         printf(format, SSH_AUTHSOCKET_ENV_NAME, socket_name,
 618                                SSH_AUTHSOCKET_ENV_NAME);
 619                         printf(format, SSH_AGENTPID_ENV_NAME, pidstrbuf,
 620                                SSH_AGENTPID_ENV_NAME);
 621                         printf("echo Agent pid %d;\n", pid);
 622                         exit(0);
 623                 }
 624                 setenv(SSH_AUTHSOCKET_ENV_NAME, socket_name, 1);
 625                 setenv(SSH_AGENTPID_ENV_NAME, pidstrbuf, 1);
 626                 execvp(av[0], av);
 627                 perror(av[0]);
 628                 exit(1);
 629         }
 630         close(0);
 631         close(1);
 632         close(2);
 633
 634         if (setsid() == -1) {
 635                 perror("setsid");
 636                 cleanup_exit(1);
 637         }
 638         if (atexit(cleanup_socket) < 0) {
 639                 perror("atexit");
 640                 cleanup_exit(1);
 641         }
 642         new_socket(AUTH_SOCKET, sock);
 643         if (ac > 0) {
 644                 signal(SIGALRM, check_parent_exists);
 645                 alarm(10);
 646         }
 647         signal(SIGINT, SIG_IGN);
 648         signal(SIGPIPE, SIG_IGN);
 649         signal(SIGHUP, cleanup_exit);
 650         signal(SIGTERM, cleanup_exit);
 651         while (1) {
 652                 FD_ZERO(&readset);
 653                 FD_ZERO(&writeset);
 654                 prepare_select(&readset, &writeset);
 655                 if (select(max_fd + 1, &readset, &writeset, NULL, NULL) < 0) {
 656                         if (errno == EINTR)
 657                                 continue;
 658                         exit(1);
 659                 }
 660                 after_select(&readset, &writeset);
 661         }
 662         /* NOTREACHED */
 663 }