Attachment #1942 for bug #1402

View | Details | Raw Unified | Return to bug 1402 | Differences between

and this patch

Lines 316-321 audit_session_close(struct logininfo *li Link Here

(-)openssh-5.6p1/audit-bsm.c.audit2 (+6 lines)
316	/* not implemented */	316	/* not implemented */
317	}	317	}
318		318
		319	int
		320	audit_keyusage(const char type, unsigned len, char fp, int rv)
		321	{
		322	/* not implemented */
		323	}
		324
319	void	325	void
320	audit_event(ssh_audit_event_t event)	326	audit_event(ssh_audit_event_t event)
321	{	327	{




	debug("audit run command euid %d user %s command '%.200s'", geteuid(),
	    audit_username(), command);
}

/*
 * This will be called when user is successfully autherized by the RSA1/RSA/DSA key.
 *
 * Type is the key type, len is the key length(byte) and fp is the fingerprint of the key.
 */
int
audit_keyusage(const char *type, unsigned len, char *fp, int rv)
{
	debug("audit key usage euid %d user %s key type %s key length %d fingerprint %s, result %d", geteuid(),
	    audit_username(), type, len, fp, rv);
}
# endif  /* !defined CUSTOM_SSH_AUDIT_EVENTS */
#endif /* SSH_AUDIT_EVENTS */

Lines 53-57 void audit_session_open(struct logininfo Link Here

(-)openssh-5.6p1/audit.h.audit2 (+1 lines)
53	void audit_session_close(struct logininfo *);	53	void audit_session_close(struct logininfo *);
54	void audit_run_command(const char *);	54	void audit_run_command(const char *);
55	ssh_audit_event_t audit_classify_auth(const char *);	55	ssh_audit_event_t audit_classify_auth(const char *);
		56	int audit_keyusage(const char , unsigned, char , int);
56		57
57	#endif /* _SSH_AUDIT_H */	58	#endif /* _SSH_AUDIT_H */

Lines 37-42 Link Here

(-)openssh-5.6p1/audit-linux.c.audit2 (+32 lines)
37	#include "audit.h"	37	#include "audit.h"
38	#include "canohost.h"	38	#include "canohost.h"
39		39
		40	#define AUDIT_LOG_SIZE 128
		41
40	const char* audit_username(void);	42	const char* audit_username(void);
41		43
42	int	44	int
Lines 62-67 linux_audit_record_event(int uid, const Link Here
62	return (rc >= 0);	64	return (rc >= 0);
63	}	65	}
64		66
		67	int
		68	audit_keyusage(const char type, unsigned len, char fp, int rv)
		69	{
		70	char buf[AUDIT_LOG_SIZE];
		71	int audit_fd, rc, saved_errno;
		72
		73	audit_fd = audit_open();
		74	if (audit_fd < 0) {
		75	if (errno == EINVAL \|\| errno == EPROTONOSUPPORT \|\|
		76	errno == EAFNOSUPPORT)
		77	return 1; /* No audit support in kernel */
		78	else
		79	return 0; /* Must prevent login */
		80	}
		81	snprintf(buf, sizeof(buf), "pubkey_auth rport=%d", get_remote_port());
		82	rc = audit_log_acct_message(audit_fd, AUDIT_USER_AUTH, NULL,
		83	buf, audit_username(), -1, NULL, get_remote_ipaddr(), NULL, rv);
		84	if (rc < 0)
		85	goto out;
		86	snprintf(buf, sizeof(buf), "pubkey_auth algo=%s size=%d fp=%s rport=%d",
		87	type, 8 * len, fp, get_remote_port());
		88	rc = audit_log_acct_message(audit_fd, AUDIT_USER_AUTH, NULL,
		89	buf, audit_username(), -1, NULL, get_remote_ipaddr(), NULL, rv);
		90	out:
		91	saved_errno = errno;
		92	audit_close(audit_fd);
		93	errno = saved_errno;
		94	return (rc >= 0);
		95	}
		96
65	/* Below is the sshd audit API code */	97	/* Below is the sshd audit API code */
66		98
67	void	99	void




	return authenticated;
}

int
pubkey_key_verify(const Key *key, const u_char *sig, u_int slen, const u_char *data, u_int datalen)
{
	int rv;
#ifdef SSH_AUDIT_EVENTS
	char *fp;
	unsigned size = 0;
	const char *crypto_name[] = {
		"ssh-rsa1",
		"ssh-rsa",
		"ssh-dsa",
		"unknown" };
#endif

	rv = key_verify(key, sig, slen, data, datalen);
#ifdef SSH_AUDIT_EVENTS
	fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
	switch(key->type) {
		case KEY_RSA1:
		case KEY_RSA:
			size = RSA_size(key->rsa);
			break;
		case KEY_DSA:
			size = DSA_size(key->dsa);
			break;
	}

	if (audit_keyusage(crypto_name[key->type], size, fp, rv) == 0)
		rv = 0;
	xfree(fp);
#endif
	return rv;
}

static int
match_principals_option(const char *principal_list, struct KeyCert *cert)
{

Lines 92-98 auth_rsa_verify_response(Key *key, BIGNU Link Here

(-)openssh-5.6p1/auth-rsa.c.audit2 (-6 / +15 lines)
92	{	92	{
93	u_char buf[32], mdbuf[16];	93	u_char buf[32], mdbuf[16];
94	MD5_CTX md;	94	MD5_CTX md;
95	int len;	95	int len, rv;
		96	#ifdef SSH_AUDIT_EVENTS
		97	char *fp;
		98	#endif
96		99
97	if (auth_key_is_revoked(key))	100	if (auth_key_is_revoked(key))
98	return 0;	101	return 0;
Lines 116-127 auth_rsa_verify_response(Key *key, BIGNU Link Here
116	MD5_Final(mdbuf, &md);	119	MD5_Final(mdbuf, &md);
117		120
118	/* Verify that the response is the original challenge. */	121	/* Verify that the response is the original challenge. */
119	if (timingsafe_bcmp(response, mdbuf, 16) != 0) {	122	rv = timingsafe_bcmp(response, mdbuf, 16) == 0;
120	/* Wrong answer. */	123
121	return (0);	124	#ifdef SSH_AUDIT_EVENTS
		125	fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
		126	if (audit_keyusage("ssh-rsa1", RSA_size(key->rsa), fp, rv) == 0) {
		127	debug("unsuccessful audit");
		128	rv = 0;
122	}	129	}
123	/* Correct answer. */	130	xfree(fp);
124	return (1);	131	#endif
		132
		133	return rv;
125	}	134	}
126		135
127	/*	136	/*




	if (!valid_data)
		fatal("%s: bad signature data blob", __func__);

	switch (key_blobtype) {
	case MM_USERKEY:
		verified = pubkey_key_verify(key, signature, signaturelen, data, datalen);
		break;
	case MM_HOSTKEY:
		verified = key_verify(key, signature, signaturelen, data, datalen);
		valid_data = monitor_valid_hostbasedblob(data, datalen,
		    hostbased_cuser, hostbased_chost);
		break;
	default:
		verified = 0;
		break;
	}
	debug3("%s: key %p signature %s",
	    __func__, key, (verified == 1) ? "verified" : "unverified");


Return to bug 1402

Lines 182-186 audit_run_command(const char *command) Link Here

(-)openssh-5.6p1/audit.c.audit2 (+12 lines)
182	debug("audit run command euid %d user %s command '%.200s'", geteuid(),	182	debug("audit run command euid %d user %s command '%.200s'", geteuid(),
183	audit_username(), command);	183	audit_username(), command);
184	}	184	}
		185
		186	/*
		187	* This will be called when user is successfully autherized by the RSA1/RSA/DSA key.
		188	*
		189	* Type is the key type, len is the key length(byte) and fp is the fingerprint of the key.
		190	*/
		191	int
		192	audit_keyusage(const char type, unsigned len, char fp, int rv)
		193	{
		194	debug("audit key usage euid %d user %s key type %s key length %d fingerprint %s, result %d", geteuid(),
		195	audit_username(), type, len, fp, rv);
		196	}
185	# endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */	197	# endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */
186	#endif /* SSH_AUDIT_EVENTS */	198	#endif /* SSH_AUDIT_EVENTS */

Lines 177-182 done: Link Here

(-)openssh-5.6p1/auth2-pubkey.c.audit2 (+34 lines)
177	return authenticated;	177	return authenticated;
178	}	178	}
179		179
		180	int
		181	pubkey_key_verify(const Key key, const u_char sig, u_int slen, const u_char *data, u_int datalen)
		182	{
		183	int rv;
		184	#ifdef SSH_AUDIT_EVENTS
		185	char *fp;
		186	unsigned size = 0;
		187	const char *crypto_name[] = {
		188	"ssh-rsa1",
		189	"ssh-rsa",
		190	"ssh-dsa",
		191	"unknown" };
		192	#endif
		193
		194	rv = key_verify(key, sig, slen, data, datalen);
		195	#ifdef SSH_AUDIT_EVENTS
		196	fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
		197	switch(key->type) {
		198	case KEY_RSA1:
		199	case KEY_RSA:
		200	size = RSA_size(key->rsa);
		201	break;
		202	case KEY_DSA:
		203	size = DSA_size(key->dsa);
		204	break;
		205	}
		206
		207	if (audit_keyusage(crypto_name[key->type], size, fp, rv) == 0)
		208	rv = 0;
		209	xfree(fp);
		210	#endif
		211	return rv;
		212	}
		213
180	static int	214	static int
181	match_principals_option(const char principal_list, struct KeyCert cert)	215	match_principals_option(const char principal_list, struct KeyCert cert)
182	{	216	{

Lines 1235-1241 mm_answer_keyverify(int sock, Buffer *m) Link Here

(-)openssh-5.6p1/monitor.c.audit2 (-1 / +13 lines)
1235	if (!valid_data)	1235	if (!valid_data)
1236	fatal("%s: bad signature data blob", __func__);	1236	fatal("%s: bad signature data blob", __func__);
1237		1237
1238	verified = key_verify(key, signature, signaturelen, data, datalen);	1238	switch (key_blobtype) {
		1239	case MM_USERKEY:
		1240	verified = pubkey_key_verify(key, signature, signaturelen, data, datalen);
		1241	break;
		1242	case MM_HOSTKEY:
		1243	verified = key_verify(key, signature, signaturelen, data, datalen);
		1244	valid_data = monitor_valid_hostbasedblob(data, datalen,
		1245	hostbased_cuser, hostbased_chost);
		1246	break;
		1247	default:
		1248	verified = 0;
		1249	break;
		1250	}
1239	debug3("%s: key %p signature %s",	1251	debug3("%s: key %p signature %s",
1240	__func__, key, (verified == 1) ? "verified" : "unverified");	1252	__func__, key, (verified == 1) ? "verified" : "unverified");
1241		1253