Attachment 2162 Details for Bug 1914 – updated patch for OpenSSH 6.0p1

[patch] updated patch for OpenSSH 6.0p1

openssh-6.0p1-sshadd-verify.patch (text/plain), 4.69 KB, created by Konrad Bucheli on 2012-06-02 14:36:32 AEST

(hide)

Description:

Filename:

MIME Type:

Creator: Konrad Bucheli

Created: 2012-06-02 14:36:32 AEST

Size: 4.69 KB

patch

obsolete

>diff -Naur openssh-6.0p1/regress/agent.sh openssh-6.0p1-patched/regress/agent.sh
>--- openssh-6.0p1/regress/agent.sh	2008-03-12 23:58:56.000000000 +1100
>+++ openssh-6.0p1-patched/regress/agent.sh	2012-06-02 14:21:20.952718909 +1000
>@@ -25,6 +25,9 @@
> 		rm -f $OBJ/$t-agent
> 		${SSHKEYGEN} -q -N '' -t $t -f $OBJ/$t-agent ||\
> 			 fail "ssh-keygen for $t-agent failed"
>+		# verify key is not loaded into agent
>+		${SSHADD} -v $OBJ/$t-agent.pub 2>/dev/null &&\
>+			fail "ssh-add -v verified unloaded key"
> 		# add to authorized keys
> 		cat $OBJ/$t-agent.pub >> $OBJ/authorized_keys_$USER
> 		# add privat key to agent
>@@ -32,6 +35,9 @@
> 		if [ $? -ne 0 ]; then
> 			fail "ssh-add did succeed exit code 0"
> 		fi
>+		# verify if key is loaded into agent
>+		${SSHADD} -v $OBJ/$t-agent.pub ||\
>+			fail "ssh-add -v did not verify loaded key"
> 	done
> 	${SSHADD} -l > /dev/null 2>&1
> 	if [ $? -ne 0 ]; then
>diff -Naur openssh-6.0p1/ssh-add.0 openssh-6.0p1-patched/ssh-add.0
>--- openssh-6.0p1/ssh-add.0	2012-04-20 15:03:38.000000000 +1000
>+++ openssh-6.0p1-patched/ssh-add.0	2012-06-02 14:21:20.952718909 +1000
>@@ -62,6 +62,9 @@
>              lifetime may be specified in seconds or in a time format
>              specified in sshd_config(5).
> 
>+     -v pubkey
>+             Verify if the agent has access to the matching private key.     
>+
>      -X      Unlock the agent.
> 
>      -x      Lock the agent with a password.
>diff -Naur openssh-6.0p1/ssh-add.c openssh-6.0p1-patched/ssh-add.c
>--- openssh-6.0p1/ssh-add.c	2011-11-04 10:51:51.000000000 +1100
>+++ openssh-6.0p1-patched/ssh-add.c	2012-06-02 14:22:55.695372797 +1000
>@@ -42,6 +42,7 @@
> #include <sys/param.h>
> 
> #include <openssl/evp.h>
>+#include <openssl/md5.h>
> #include "openbsd-compat/openssl-compat.h"
> 
> #include <fcntl.h>
>@@ -322,6 +323,94 @@
> 	return 0;
> }
> 
>+
>+static int
>+verify_key_ssh1 (AuthenticationConnection *ac, Key *key)
>+{
>+
>+	int ret = 0;
>+	BIGNUM *challenge, *encrypted_challenge;
>+	u_char session_id[16], response[16], token[32], mdbuf[16];
>+	MD5_CTX md;
>+
>+	/* generate random session_id and token */
>+	arc4random_buf(session_id, sizeof(session_id));
>+	arc4random_buf(token, sizeof(token));
>+	if ((challenge = BN_bin2bn(token, sizeof(token), NULL)) == NULL) {
>+		fprintf(stderr, "%s: BNbin2bn failed", __func__);
>+		return ret;
>+	}
>+
>+	/* Encrypt the challenge with the public key. */
>+	if ((encrypted_challenge = BN_new()) == NULL) {
>+		fprintf(stderr, "%s: BN_new failed", __func__);
>+		BN_clear_free(challenge);
>+		return ret;
>+	}
>+	rsa_public_encrypt(encrypted_challenge, challenge, key->rsa);
>+
>+	/* send challenge to agent and expect response */
>+	ssh_decrypt_challenge(ac, key, encrypted_challenge, session_id, 1, response);
>+
>+	MD5_Init(&md);
>+	MD5_Update(&md, token, sizeof(token));
>+	MD5_Update(&md, session_id, sizeof(session_id));
>+	MD5_Final(mdbuf, &md);
>+
>+	/* Verify that the response is the original challenge. */
>+	if (timingsafe_bcmp(response, mdbuf, sizeof(mdbuf)) == 0) {
>+		ret = 1;
>+	}
>+
>+	BN_clear_free(encrypted_challenge);
>+	BN_clear_free(challenge);
>+	
>+	return ret;
>+}
>+
>+static int
>+verify_key_ssh2 (AuthenticationConnection *ac, Key *key)
>+{
>+	int ret = 0;
>+	u_char *signature, token[512];
>+	u_int slen;
>+	
>+	arc4random_buf(token, sizeof(token));
>+	
>+	/* let the agent sign the token */
>+	if (ssh_agent_sign(ac, key, &signature, &slen, token, sizeof(token)) == 0 ) {
>+		/* verify signature */
>+		if (key_verify(key, signature, slen, token, sizeof(token))) {
>+			ret = 1;
>+		}
>+		xfree(signature);
>+	}
>+	return ret;
>+}
>+
>+static int
>+verify_key(AuthenticationConnection *ac, const char *filename)
>+{
>+	Key *public;
>+	int ret = -1;
>+
>+	/* load public key */
>+	public = key_load_public(filename, NULL);
>+	if (public == NULL) {
>+		fprintf(stderr, "Could not read public key: %s\n", filename);
>+		return ret;
>+	}
>+	
>+	if (public->type == KEY_RSA1 
>+		? verify_key_ssh1(ac, public)
>+		: verify_key_ssh2(ac, public))
>+		ret = 0;
>+	
>+	key_free(public);
>+	
>+	return ret;
>+}
>+
> static int
> lock_agent(AuthenticationConnection *ac, int lock)
> {
>@@ -379,6 +468,7 @@
> 	fprintf(stderr, "  -X          Unlock agent.\n");
> 	fprintf(stderr, "  -s pkcs11   Add keys from PKCS#11 provider.\n");
> 	fprintf(stderr, "  -e pkcs11   Remove keys provided by PKCS#11 provider.\n");
>+	fprintf(stderr, "  -v pubkey   Verify if agent can access matching private key.\n");
> }
> 
> int
>@@ -405,7 +495,7 @@
> 		    "Could not open a connection to your authentication agent.\n");
> 		exit(2);
> 	}
>-	while ((ch = getopt(argc, argv, "klLcdDxXe:s:t:")) != -1) {
>+	while ((ch = getopt(argc, argv, "klLcdDxXe:s:t:v:")) != -1) {
> 		switch (ch) {
> 		case 'k':
> 			key_only = 1;
>@@ -444,6 +534,10 @@
> 				goto done;
> 			}
> 			break;
>+		case 'v':
>+			if (verify_key(ac, optarg) == -1)
>+				ret = 1;
>+			goto done;
> 		default:
> 			usage();
> 			ret = 1;

Actions: View | Diff

Attachments on bug 1914: 2055 | 2056 | 2058 | 2162