Attachment 2478 Details for Bug 2081 – Reworked patch enabling optional %-expanded arguments

[patch] Reworked patch enabling optional %-expanded arguments

0001-Extend-AuthorizedKeysCommand-with-expanded-arguments.patch (text/plain), 9.37 KB, created by Sami Hartikainen on 2014-09-23 01:41:21 AEST

(hide)

Description:

Filename:

MIME Type:

Creator: Sami Hartikainen

Created: 2014-09-23 01:41:21 AEST

Size: 9.37 KB

patch

obsolete

>From 6a929c3ddf7926a136dcf3a666e97658329d05c6 Mon Sep 17 00:00:00 2001
>From: Sami Hartikainen <sami.hartikainen@teleste.com>
>Date: Fri, 19 Sep 2014 18:39:05 +0300
>Subject: [PATCH] Extend AuthorizedKeysCommand with %-expanded arguments
>
>Implements #2081 as per comment 13 [1] by enabling the use of
>%u, %t, %f and %k arguments; if none provided, works as before
>and passes the username to be authorized as the only argument to
>the AuthorizedKeysCommand program.
>
> [1] https://bugzilla.mindrot.org/show_bug.cgi?id=2081#c13
>
>As a side-effect any number of (non-expanded) parameters may
>be passed to the AuthorizedKeysCommand program.
>---
> auth2-pubkey.c | 83 +++++++++++++++++++++++++++++++++++++++++++++++++---------
> key.h          |  1 +
> sshd_config.5  |  7 ++++-
> sshkey.c       | 72 ++++++++++++++++++++++++++++++++++++++++++++++++++
> sshkey.h       |  2 ++
> 5 files changed, 152 insertions(+), 13 deletions(-)
>
>diff --git a/auth2-pubkey.c b/auth2-pubkey.c
>index f3ca965..37aca78 100644
>--- a/auth2-pubkey.c
>+++ b/auth2-pubkey.c
>@@ -496,6 +496,22 @@ user_key_allowed2(struct passwd *pw, Key *key, char *file)
> 	return found_key;
> }
> 
>+static const char *
>+argv_to_string(char *argv[])
>+{
>+	static char buf[4096];
>+	int i, rem = sizeof(buf);
>+
>+	buf[0] = '\0';
>+	for (i = 0; argv[i] != NULL && rem > 0; i++) {
>+		if (i > 0)
>+			strncat(buf, " ", --rem);
>+		strncat(buf, argv[i], rem - 1);
>+		rem -= strlen(argv[i]);
>+	}
>+	return buf;
>+}
>+
> /*
>  * Checks whether key is allowed in output of command.
>  * returns 1 if the key is allowed or 0 otherwise.
>@@ -507,9 +523,13 @@ user_key_command_allowed2(struct passwd *user_pw, Key *key)
> 	int ok, found_key = 0;
> 	struct passwd *pw;
> 	struct stat st;
>-	int status, devnull, p[2], i;
>+	int status, devnull, p[2], i, argc;
> 	pid_t pid;
> 	char *username, errmsg[512];
>+	char *command, *cp, **argv;
>+	char *key_fp = NULL, *keytext = NULL;
>+	char *authorized_keys_command_path;
>+	size_t keytextlen;
> 
> 	if (options.authorized_keys_command == NULL ||
> 	    options.authorized_keys_command[0] != '/')
>@@ -533,12 +553,48 @@ user_key_command_allowed2(struct passwd *user_pw, Key *key)
> 
> 	temporarily_use_uid(pw);
> 
>-	if (stat(options.authorized_keys_command, &st) < 0) {
>+	if (strstr(options.authorized_keys_command, "%f") != NULL) {
>+		key_fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
>+		if (key_fp == NULL) {
>+			error("AuthorizedKeysCommand %%f parameter expansion failed");
>+			return 0;
>+		}
>+	}
>+	if (strstr(options.authorized_keys_command, "%k") != NULL) {
>+		if (key_to_base64(key, &keytext, &keytextlen) != 0) {
>+			error("AuthorizedKeysCommand %%k parameter expansion failed");
>+			free(key_fp);
>+			return 0;
>+		}
>+	}
>+	command = cp = percent_expand(options.authorized_keys_command,
>+	    "u", user_pw->pw_name, "t", key_ssh_name(key),
>+	    "f", key_fp == NULL ? "" : key_fp,
>+	    "k", keytext == NULL ? "" : keytext, (char *)NULL);
>+	if (keytext != NULL)
>+		free(keytext);
>+	if (key_fp != NULL)
>+		free(key_fp);
>+
>+	argv = xcalloc(argc = 6, sizeof(char *));
>+	argv[0] = authorized_keys_command_path = strdelim(&cp);
>+	for (i = 1; cp != NULL; i++) {
>+		/* Ensure the last argv[] position remains unused for NULL */
>+		if (i + 1 == argc)
>+			argv = xrealloc(argv, argc += 10, sizeof(char *));
>+		argv[i] = strdelim(&cp);
>+	}
>+	if (i == 1)
>+		argv[i] = user_pw->pw_name;
>+	else
>+		argv[i] = NULL;
>+
>+	if (stat(authorized_keys_command_path, &st) < 0) {
> 		error("Could not stat AuthorizedKeysCommand \"%s\": %s",
>-		    options.authorized_keys_command, strerror(errno));
>+		    authorized_keys_command_path, strerror(errno));
> 		goto out;
> 	}
>-	if (auth_secure_path(options.authorized_keys_command, &st, NULL, 0,
>+	if (auth_secure_path(authorized_keys_command_path, &st, NULL, 0,
> 	    errmsg, sizeof(errmsg)) != 0) {
> 		error("Unsafe AuthorizedKeysCommand: %s", errmsg);
> 		goto out;
>@@ -549,8 +605,8 @@ user_key_command_allowed2(struct passwd *user_pw, Key *key)
> 		goto out;
> 	}
> 
>-	debug3("Running AuthorizedKeysCommand: \"%s %s\" as \"%s\"",
>-	    options.authorized_keys_command, user_pw->pw_name, pw->pw_name);
>+	debug3("Running AuthorizedKeysCommand: \"%s\" as \"%s\"",
>+	    argv_to_string(argv), pw->pw_name);
> 
> 	/*
> 	 * Don't want to call this in the child, where it can fatal() and
>@@ -563,6 +619,8 @@ user_key_command_allowed2(struct passwd *user_pw, Key *key)
> 		error("%s: fork: %s", __func__, strerror(errno));
> 		close(p[0]);
> 		close(p[1]);
>+		free(argv);
>+		free(command);
> 		return 0;
> 	case 0: /* child */
> 		for (i = 0; i < NSIG; i++)
>@@ -598,11 +656,10 @@ user_key_command_allowed2(struct passwd *user_pw, Key *key)
> 			_exit(1);
> 		}
> 
>-		execl(options.authorized_keys_command,
>-		    options.authorized_keys_command, user_pw->pw_name, NULL);
>+		execv(authorized_keys_command_path, argv);
> 
> 		error("AuthorizedKeysCommand %s exec failed: %s",
>-		    options.authorized_keys_command, strerror(errno));
>+		    authorized_keys_command_path, strerror(errno));
> 		_exit(127);
> 	default: /* parent */
> 		break;
>@@ -620,7 +677,7 @@ user_key_command_allowed2(struct passwd *user_pw, Key *key)
> 			;
> 		goto out;
> 	}
>-	ok = check_authkeys_file(f, options.authorized_keys_command, key, pw);
>+	ok = check_authkeys_file(f, authorized_keys_command_path, key, pw);
> 	fclose(f);
> 
> 	while (waitpid(pid, &status, 0) == -1) {
>@@ -631,15 +688,17 @@ user_key_command_allowed2(struct passwd *user_pw, Key *key)
> 	}
> 	if (WIFSIGNALED(status)) {
> 		error("AuthorizedKeysCommand %s exited on signal %d",
>-		    options.authorized_keys_command, WTERMSIG(status));
>+		    authorized_keys_command_path, WTERMSIG(status));
> 		goto out;
> 	} else if (WEXITSTATUS(status) != 0) {
> 		error("AuthorizedKeysCommand %s returned status %d",
>-		    options.authorized_keys_command, WEXITSTATUS(status));
>+		    authorized_keys_command_path, WEXITSTATUS(status));
> 		goto out;
> 	}
> 	found_key = ok;
>  out:
>+	free(argv);
>+	free(command);
> 	restore_uid();
> 	return found_key;
> }
>diff --git a/key.h b/key.h
>index c6401a5..051d9de 100644
>--- a/key.h
>+++ b/key.h
>@@ -61,6 +61,7 @@ typedef struct sshkey Key;
> #define key_dump_ec_point	sshkey_dump_ec_point
> #define key_dump_ec_key		sshkey_dump_ec_key
> #define key_fingerprint		sshkey_fingerprint
>+#define key_to_base64		sshkey_to_base64
> #endif
> 
> void	 key_add_private(Key *);
>diff --git a/sshd_config.5 b/sshd_config.5
>index 6766b57..530cdb8 100644
>--- a/sshd_config.5
>+++ b/sshd_config.5
>@@ -220,7 +220,12 @@ of a single authentication method is sufficient.
> Specifies a program to be used to look up the user's public keys.
> The program must be owned by root and not writable by group or others.
> It will be invoked with a single argument of the username
>-being authenticated, and should produce on standard output zero or
>+being authenticated, unless any of the following tokens, which are
>+expanded at runtime, are provided: %u is replaced by the username
>+being authenticated, %t is replaced with the key type offered for
>+authentication, %f is replaced with the fingerprint of the key, and
>+%k is replaced with the key being offered for authentication.
>+The program should produce on standard output zero or
> more lines of authorized_keys output (see AUTHORIZED_KEYS in
> .Xr sshd 8 ) .
> If a key supplied by AuthorizedKeysCommand does not successfully authenticate
>diff --git a/sshkey.c b/sshkey.c
>index fdd0c8a..010202f 100644
>--- a/sshkey.c
>+++ b/sshkey.c
>@@ -1427,6 +1427,78 @@ sshkey_write(const struct sshkey *key, FILE *f)
> 	return ret;
> }
> 
>+int
>+sshkey_to_base64(const struct sshkey *key, char **blobp, size_t *lenp)
>+{
>+	int ret = SSH_ERR_INTERNAL_ERROR;
>+	struct sshbuf *b = NULL, *bb = NULL;
>+	char *uu = NULL;
>+	size_t len;
>+
>+	if (lenp != NULL)
>+		*lenp = 0;
>+	if (blobp != NULL)
>+		*blobp = NULL;
>+
>+	if (sshkey_is_cert(key)) {
>+		if (key->cert == NULL)
>+			return SSH_ERR_EXPECTED_CERT;
>+		if (sshbuf_len(key->cert->certblob) == 0)
>+			return SSH_ERR_KEY_LACKS_CERTBLOB;
>+	}
>+	if ((b = sshbuf_new()) == NULL)
>+		return SSH_ERR_ALLOC_FAIL;
>+	switch (key->type) {
>+#ifdef WITH_OPENSSL
>+	case KEY_DSA:
>+	case KEY_DSA_CERT_V00:
>+	case KEY_DSA_CERT:
>+	case KEY_ECDSA:
>+	case KEY_ECDSA_CERT:
>+	case KEY_RSA:
>+	case KEY_RSA_CERT_V00:
>+	case KEY_RSA_CERT:
>+#endif /* WITH_OPENSSL */
>+	case KEY_ED25519:
>+	case KEY_ED25519_CERT:
>+		if ((bb = sshbuf_new()) == NULL) {
>+			ret = SSH_ERR_ALLOC_FAIL;
>+			goto out;
>+		}
>+		if ((ret = sshkey_to_blob_buf(key, bb)) != 0)
>+			goto out;
>+		if ((uu = sshbuf_dtob64(bb)) == NULL) {
>+			ret = SSH_ERR_ALLOC_FAIL;
>+			goto out;
>+		}
>+		if ((ret = sshbuf_put(b, uu, strlen(uu))) != 0)
>+			goto out;
>+		break;
>+	default:
>+		ret = SSH_ERR_KEY_TYPE_UNKNOWN;
>+		goto out;
>+	}
>+	len = sshbuf_len(b);
>+	if (lenp != NULL)
>+		*lenp = len;
>+	if (blobp != NULL) {
>+		if ((*blobp = malloc(len)) == NULL) {
>+			ret = SSH_ERR_ALLOC_FAIL;
>+			goto out;
>+		}
>+		memcpy(*blobp, sshbuf_ptr(b), len);
>+	}
>+	ret = 0;
>+ out:
>+	if (b != NULL)
>+		sshbuf_free(b);
>+	if (bb != NULL)
>+		sshbuf_free(bb);
>+	if (uu != NULL)
>+		free(uu);
>+	return ret;
>+}
>+
> const char *
> sshkey_cert_type(const struct sshkey *k)
> {
>diff --git a/sshkey.h b/sshkey.h
>index 450b30c..468c708 100644
>--- a/sshkey.h
>+++ b/sshkey.h
>@@ -167,6 +167,8 @@ int	 sshkey_to_blob(const struct sshkey *, u_char **, size_t *);
> int	 sshkey_plain_to_blob_buf(const struct sshkey *, struct sshbuf *);
> int	 sshkey_plain_to_blob(const struct sshkey *, u_char **, size_t *);
> 
>+int	 sshkey_to_base64(const struct sshkey *, char **, size_t *);
>+
> int	 sshkey_sign(const struct sshkey *, u_char **, size_t *,
>     const u_char *, size_t, u_int);
> int	 sshkey_verify(const struct sshkey *, const u_char *, size_t,
>-- 
>1.9.1
>

Actions: View | Diff

Attachments on bug 2081: 2412 | 2416 | 2417 | 2438 | 2477 | 2478 | 2479 | 2522 | 2544 | 2545 | 2546 | 2549 | 2556 | 2557