release/src/router/dropbear/svr-agentfwd.c

   1 /*
   2  * Dropbear - a SSH2 server
   3  *
   4  * Copyright (c) 2002,2003 Matt Johnston
   5  * All rights reserved.
   6  *
   7  * Permission is hereby granted, free of charge, to any person obtaining a copy
   8  * of this software and associated documentation files (the "Software"), to deal
   9  * in the Software without restriction, including without limitation the rights
  10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  11  * copies of the Software, and to permit persons to whom the Software is
  12  * furnished to do so, subject to the following conditions:
  13  *
  14  * The above copyright notice and this permission notice shall be included in
  15  * all copies or substantial portions of the Software.
  16  *
  17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
  20  * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  23  * SOFTWARE. */
  24
  25 /* This file (agentfwd.c) handles authentication agent forwarding, for OpenSSH
  26  * style agents. */
  27
  28 #include "includes.h"
  29
  30 #ifdef ENABLE_SVR_AGENTFWD
  31
  32 #include "agentfwd.h"
  33 #include "session.h"
  34 #include "ssh.h"
  35 #include "dbutil.h"
  36 #include "chansession.h"
  37 #include "channel.h"
  38 #include "packet.h"
  39 #include "buffer.h"
  40 #include "random.h"
  41 #include "listener.h"
  42 #include "auth.h"
  43
  44 #define AGENTDIRPREFIX "/tmp/dropbear-"
  45
  46 static int send_msg_channel_open_agent(int fd);
  47 static int bindagent(int fd, struct ChanSess * chansess);
  48 static void agentaccept(struct Listener * listener, int sock);
  49
  50 /* Handles client requests to start agent forwarding, sets up listening socket.
  51  * Returns DROPBEAR_SUCCESS or DROPBEAR_FAILURE */
  52 int svr_agentreq(struct ChanSess * chansess) {
  53         int fd = -1;
  54
  55         if (!svr_pubkey_allows_agentfwd()) {
  56                 return DROPBEAR_FAILURE;
  57         }
  58
  59         if (chansess->agentlistener != NULL) {
  60                 return DROPBEAR_FAILURE;
  61         }
  62
  63         /* create listening socket */
  64         fd = socket(PF_UNIX, SOCK_STREAM, 0);
  65         if (fd < 0) {
  66                 goto fail;
  67         }
  68
  69         /* create the unix socket dir and file */
  70         if (bindagent(fd, chansess) == DROPBEAR_FAILURE) {
  71                 goto fail;
  72         }
  73
  74         /* listen */
  75         if (listen(fd, 20) < 0) {
  76                 goto fail;
  77         }
  78
  79         /* set non-blocking */
  80         setnonblocking(fd);
  81
  82         /* pass if off to listener */
  83         chansess->agentlistener = new_listener( &fd, 1, 0, chansess,
  84                                                                 agentaccept, NULL);
  85
  86         if (chansess->agentlistener == NULL) {
  87                 goto fail;
  88         }
  89
  90         return DROPBEAR_SUCCESS;
  91
  92 fail:
  93         m_close(fd);
  94         /* cleanup */
  95         svr_agentcleanup(chansess);
  96
  97         return DROPBEAR_FAILURE;
  98 }
  99
 100 /* accepts a connection on the forwarded socket and opens a new channel for it
 101  * back to the client */
 102 /* returns DROPBEAR_SUCCESS or DROPBEAR_FAILURE */
 103 static void agentaccept(struct Listener *UNUSED(listener), int sock) {
 104
 105         int fd;
 106
 107         fd = accept(sock, NULL, NULL);
 108         if (fd < 0) {
 109                 TRACE(("accept failed"))
 110                 return;
 111         }
 112
 113         if (send_msg_channel_open_agent(fd) != DROPBEAR_SUCCESS) {
 114                 close(fd);
 115         }
 116
 117 }
 118
 119 /* set up the environment variable pointing to the socket. This is called
 120  * just before command/shell execution, after dropping priveleges */
 121 void svr_agentset(struct ChanSess * chansess) {
 122
 123         char *path = NULL;
 124         int len;
 125
 126         if (chansess->agentlistener == NULL) {
 127                 return;
 128         }
 129
 130         /* 2 for "/" and "\0" */
 131         len = strlen(chansess->agentdir) + strlen(chansess->agentfile) + 2;
 132
 133         path = m_malloc(len);
 134         snprintf(path, len, "%s/%s", chansess->agentdir, chansess->agentfile);
 135         addnewvar("SSH_AUTH_SOCK", path);
 136         m_free(path);
 137 }
 138
 139 /* close the socket, remove the socket-file */
 140 void svr_agentcleanup(struct ChanSess * chansess) {
 141
 142         char *path = NULL;
 143         uid_t uid;
 144         gid_t gid;
 145         int len;
 146
 147         if (chansess->agentlistener != NULL) {
 148                 remove_listener(chansess->agentlistener);
 149                 chansess->agentlistener = NULL;
 150         }
 151
 152         if (chansess->agentfile != NULL && chansess->agentdir != NULL) {
 153
 154                 /* Remove the dir as the user. That way they can't cause problems except
 155                  * for themselves */
 156                 uid = getuid();
 157                 gid = getgid();
 158                 if ((setegid(ses.authstate.pw_gid)) < 0 ||
 159                         (seteuid(ses.authstate.pw_uid)) < 0) {
 160                         dropbear_exit("Failed to set euid");
 161                 }
 162
 163                 /* 2 for "/" and "\0" */
 164                 len = strlen(chansess->agentdir) + strlen(chansess->agentfile) + 2;
 165
 166                 path = m_malloc(len);
 167                 snprintf(path, len, "%s/%s", chansess->agentdir, chansess->agentfile);
 168                 unlink(path);
 169                 m_free(path);
 170
 171                 rmdir(chansess->agentdir);
 172
 173                 if ((seteuid(uid)) < 0 ||
 174                         (setegid(gid)) < 0) {
 175                         dropbear_exit("Failed to revert euid");
 176                 }
 177
 178                 m_free(chansess->agentfile);
 179                 m_free(chansess->agentdir);
 180         }
 181
 182 }
 183
 184 static const struct ChanType chan_svr_agent = {
 185         0, /* sepfds */
 186         "auth-agent@openssh.com",
 187         NULL,
 188         NULL,
 189         NULL,
 190         NULL
 191 };
 192
 193
 194 /* helper for accepting an agent request */
 195 static int send_msg_channel_open_agent(int fd) {
 196
 197         if (send_msg_channel_open_init(fd, &chan_svr_agent) == DROPBEAR_SUCCESS) {
 198                 encrypt_packet();
 199                 return DROPBEAR_SUCCESS;
 200         } else {
 201                 return DROPBEAR_FAILURE;
 202         }
 203 }
 204
 205 /* helper for creating the agent socket-file
 206    returns DROPBEAR_SUCCESS or DROPBEAR_FAILURE */
 207 static int bindagent(int fd, struct ChanSess * chansess) {
 208
 209         struct sockaddr_un addr;
 210         unsigned int prefix;
 211         char path[sizeof(addr.sun_path)], sockfile[sizeof(addr.sun_path)];
 212         mode_t mode;
 213         int i;
 214         uid_t uid;
 215         gid_t gid;
 216         int ret = DROPBEAR_FAILURE;
 217
 218         /* drop to user privs to make the dir/file */
 219         uid = getuid();
 220         gid = getgid();
 221         if ((setegid(ses.authstate.pw_gid)) < 0 ||
 222                 (seteuid(ses.authstate.pw_uid)) < 0) {
 223                 dropbear_exit("Failed to set euid");
 224         }
 225
 226         memset((void*)&addr, 0x0, sizeof(addr));
 227         addr.sun_family = AF_UNIX;
 228
 229         mode = S_IRWXU;
 230
 231         for (i = 0; i < 20; i++) {
 232                 genrandom((unsigned char*)&prefix, sizeof(prefix));
 233                 /* we want 32 bits (8 hex digits) - "/tmp/dropbear-f19c62c0" */
 234                 snprintf(path, sizeof(path), AGENTDIRPREFIX "%.8x", prefix);
 235
 236                 if (mkdir(path, mode) == 0) {
 237                         goto bindsocket;
 238                 }
 239                 if (errno != EEXIST) {
 240                         break;
 241                 }
 242         }
 243         /* couldn't make a dir */
 244         goto out;
 245
 246 bindsocket:
 247         /* Format is "/tmp/dropbear-0246dead/auth-d00f7654-23".
 248          * The "23" is the file desc, the random data is to avoid collisions
 249          * between subsequent user processes reusing socket fds (odds are now
 250          * 1/(2^64) */
 251         genrandom((unsigned char*)&prefix, sizeof(prefix));
 252         snprintf(sockfile, sizeof(sockfile), "auth-%.8x-%d", prefix, fd);
 253
 254         snprintf(addr.sun_path, sizeof(addr.sun_path), "%s/%s", path, sockfile);
 255
 256         if (bind(fd, (struct sockaddr*)&addr, sizeof(addr)) == 0) {
 257                 chansess->agentdir = m_strdup(path);
 258                 chansess->agentfile = m_strdup(sockfile);
 259                 ret = DROPBEAR_SUCCESS;
 260         }
 261
 262
 263 out:
 264         if ((seteuid(uid)) < 0 ||
 265                 (setegid(gid)) < 0) {
 266                 dropbear_exit("Failed to revert euid");
 267         }
 268         return ret;
 269 }
 270
 271 #endif