lshd.c 12.7 KB
Newer Older
Niels Möller's avatar
Niels Möller committed
1
2
3
/* lshd.c
 *
 * main server program.
4
5
 *
 * $Id$ */
Niels Möller's avatar
Niels Möller committed
6

7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
/* lsh, an implementation of the ssh protocol
 *
 * Copyright (C) 1998 Niels Mller
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License as
 * published by the Free Software Foundation; either version 2 of the
 * License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
Niels Möller's avatar
Niels Möller committed
23
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
24
 */
Niels Möller's avatar
Niels Möller committed
25

26
#include "algorithms.h"
27
28
#include "alist.h"
#include "atoms.h"
29
#include "channel.h"
30
#include "channel_commands.h"
31
#include "charset.h"
32
#include "compress.h"
33
#include "connection_commands.h"
34
35
#include "crypto.h"
#include "format.h"
Niels Möller's avatar
Niels Möller committed
36
#include "io.h"
37
#include "io_commands.h"
38
#include "lookup_verifier.h"
39
#include "randomness.h"
Niels Möller's avatar
Niels Möller committed
40
#include "reaper.h"
Niels Möller's avatar
Niels Möller committed
41
#include "server.h"
42
#include "server_authorization.h"
43
#include "server_keyexchange.h"
44
45
#include "server_pty.h"
#include "server_session.h"
46
#include "server_userauth.h"
47
#include "sexp.h"
Niels Möller's avatar
Niels Möller committed
48
#include "ssh.h"
49
50
#include "tcpforward.h"
#include "tcpforward_commands.h"
51
#include "tcpforward_commands.h"
Niels Möller's avatar
Niels Möller committed
52
#include "userauth.h"
53
54
55
#include "werror.h"
#include "xalloc.h"

56
#include "lsh_argp.h"
57
58
59
60
61
62
63
64
65
66
67
68
69

#include "lshd.c.x"

#include <assert.h>

#include <errno.h>
#include <locale.h>
#include <stdio.h>
#include <string.h>

#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
70
#if HAVE_UNISTD_H
71
#include <unistd.h>
72
#endif
73

74
/* Block size for stdout and stderr buffers */
Niels Möller's avatar
Niels Möller committed
75
76
#define BLOCK_SIZE 32768

77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98

/* Option parsing */

#define OPT_SSH1_FALLBACK 0x200
#define OPT_INTERFACE 0x201
#define OPT_TCPIP_FORWARD 0x202
#define OPT_NO_TCPIP_FORWARD 0x203

/* GABA:
   (class
     (name lshd_options)
     (super algorithms_options)
     (vars
       (style . sexp_argp_state)
       (interface . "char *")
       (port . "char *")
       (hostkey . "char *")
       (local object address_info)
       (with_tcpip_forward . int)
       (sshd1 object ssh1_fallback)))
*/

Niels Möller's avatar
Niels Möller committed
99
100
static struct lshd_options *
make_lshd_options(struct alist *algorithms)
101
{
Niels Möller's avatar
Niels Möller committed
102
  NEW(lshd_options, self);
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193

  init_algorithms_options(&self->super, algorithms);
  
  self->style = SEXP_TRANSPORT;
  self->interface = NULL;
  self->port = "ssh";
  /* FIXME: this should perhaps use sysconfdir */  
  self->hostkey = "/etc/lsh_host_key";
  self->local = NULL;

  self->with_tcpip_forward = 1;
  
  self->sshd1 = NULL;
  
  return self;
}

static const struct argp_option
main_options[] =
{
  /* Name, key, arg-name, flags, doc, group */
  { "interface", OPT_INTERFACE, "interface", 0,
    "Listen on this network interface", 0 }, 
  { "port", 'p', "Port", 0, "Listen on this port.", 0 },
  { "host-key", 'h', "Key file", 0, "Location of the server's private key.", 0},

#if WITH_SSH1_FALLBACK
  { "ssh1-fallback", OPT_SSH1_FALLBACK, "File name", OPTION_ARG_OPTIONAL,
    "Location of the sshd1 program, for falling back to version 1 of the Secure Shell protocol.", 0 },
#endif /* WITH_SSH1_FALLBACK */

#if WITH_TCP_FORWARD
  { "tcp-forward", OPT_TCPIP_FORWARD, NULL, 0, "Enable tcpip forwarding (default).", 0 },
  { "no-tcp-forward", OPT_NO_TCPIP_FORWARD, NULL, 0, "Disable tcpip forwarding.", 0 },
#endif /* WITH_TCP_FORWARD */

  { NULL, 0, NULL, 0, NULL, 0 }
};

static const struct argp_child
main_argp_children[] =
{
  { &sexp_input_argp, 0, "", 0 },
  { &algorithms_argp, 0, "", 0 },
  { &werror_argp, 0, "", 0 },
  { NULL, 0, NULL, 0}
};

static error_t
main_argp_parser(int key, char *arg, struct argp_state *state)
{
  CAST(lshd_options, self, state->input);
  
  switch(key)
    {
    default:
      return ARGP_ERR_UNKNOWN;
    case ARGP_KEY_INIT:
      state->child_inputs[0] = &self->style;
      state->child_inputs[1] = &self->super;
      state->child_inputs[1] = NULL;
      break;
    case ARGP_KEY_ARG:
      argp_error(state, "Spurious arguments.");
      break;
      
    case ARGP_KEY_END:
      self->local = make_address_info_c(self->interface, self->port);
      if (!self->local)
	argp_error(state, "Invalid interface, port or service, %s:%s'.",
		   self->interface ? self->interface : "ANY",
		   self->port);
      break;
      
    case 'p':
      self->port = arg;
      break;

    case 'h':
      self->hostkey = arg;
      break;

    case OPT_INTERFACE:
      self->interface = arg;
      break;
 
#if WITH_SSH1_FALLBACK
    case OPT_SSH1_FALLBACK:
      self->sshd1 = make_ssh1_fallback(arg ? arg : SSHD1);
      break;
#endif
Niels Möller's avatar
Niels Möller committed
194

195
196
197
198
199
200
201
202
203
204
    case OPT_TCPIP_FORWARD:
      self->with_tcpip_forward = 1;
      break;

    case OPT_NO_TCPIP_FORWARD:
      self->with_tcpip_forward = 0;
      break;
    }
  return 0;
}
Niels Möller's avatar
Niels Möller committed
205

Niels Möller's avatar
Niels Möller committed
206
207
208
209
210
211
static const struct argp
main_argp =
{ main_options, main_argp_parser, 
  NULL,
  "Server for the ssh-2 protocol.",
  main_argp_children,
212
  NULL, NULL
Niels Möller's avatar
Niels Möller committed
213
214
};

215
216
/* FIXME: We should have some more general functions for reading
 * private keys. */
217

218
/* GABA:
219
220
   (class
     (name read_key)
221
     (super command_continuation)
222
223
     (vars
       (random object randomness)
224
225
       ;; Maps hostkey algorithm to a keyinfo structure
       (keys object alist)))
226
227
*/

228
229
static void do_read_key(struct command_continuation *s,
			struct lsh_object *a)
230
{
231
232
233
  CAST(read_key, closure, s);
  CAST_SUBTYPE(sexp, private, a);
  
234
235
236
  struct sexp_iterator *i;
  struct sexp *e;
  mpz_t p, q, g, y, x;
Niels Möller's avatar
Niels Möller committed
237
  
238
239
240
  if (!sexp_check_type(private, "private-key", &i))
    {
      werror("lshd: Host key file does not contain a private key.");
241
      return;
242
243
244
    }

  e = SEXP_GET(i);
Niels Möller's avatar
Niels Möller committed
245
  if (! (e && sexp_check_type(e, "dsa", &i)))
246
    {
Niels Möller's avatar
Niels Möller committed
247
      werror("lshd: Unknown key type (only dsa is supported)\n");
248
      return;
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
    }

  mpz_init(p);
  mpz_init(q);
  mpz_init(g);
  mpz_init(y);
  mpz_init(x);

  if (sexp_get_un(i, "p", p)
      && sexp_get_un(i, "q", q)
      && sexp_get_un(i, "g", g)
      && sexp_get_un(i, "y", y)
      && sexp_get_un(i, "x", x)
      && !SEXP_GET(i))
    {
      /* Test key */
      mpz_t tmp;
      struct lsh_string *s;
      
      mpz_init_set(tmp, g);
      mpz_powm(tmp, tmp, x, p);
      if (mpz_cmp(tmp, y))
	{
	  werror("lshd: Host key doesn't work.\n");
	  mpz_clear(tmp);
	}
      else
	{
	  struct lsh_string *public
	    = ssh_format("%a%n%n%n%n", ATOM_SSH_DSS, p, q, g, y);
279
	  struct signer *private;
280
281
282
	  	  
	  s = ssh_format("%n", x);
	  
283
284
285
286
	  private = MAKE_SIGNER(make_dsa_algorithm(closure->random),
				public->length, public->data,
				s->length, s->data);
	  assert(private);
287
	  lsh_string_free(s);
288
289
290
291
	  
	  /* FIXME: Check if we already have a key for this algorithm,
	   * and warn about multiple keys. */
	  ALIST_SET(closure->keys, ATOM_SSH_DSS,
292
		    make_keypair(public, private));
293

294
#if DATAFELLOWS_WORKAROUNDS
295
	  ALIST_SET(closure->keys, ATOM_SSH_DSS_KLUDGE,
296
		    make_keypair(public,
297
				      make_dsa_signer_kludge(private)));
298
#endif /* DATAFELLOWS_WORKAROUNDS */
299
	  
300
	  verbose("lshd: Using (public) hostkey:\n"
301
302
303
304
		  "  p=%xn\n"
		  "  q=%xn\n"
		  "  g=%xn\n"
		  "  y=%xn\n",
305
		  p, q, g, y);
306
307
308
309
310
311
312
313
314
315
316
317
	}
    }

  /* Cleanup */
  mpz_clear(p);
  mpz_clear(q);
  mpz_clear(g);
  mpz_clear(y);
  mpz_clear(x);
}

static int read_host_key(const char *name,
318
			 struct alist *keys,
319
320
321
322
323
			 struct randomness *r)
{
  int fd = open(name, O_RDONLY);
  if (fd < 0)
    {
324
      werror("lshd: Could not open %z (errno = %i): %z\n",
325
	     name, errno, STRERROR(errno));
326
327
328
329
330
331
332
      return 0;
    }
  else
    {
      int res;
      
      NEW(read_key, handler);
333
      handler->super.c = do_read_key;
Niels Möller's avatar
Niels Möller committed
334

335
      handler->random = r;
336
      handler->keys = keys;
337
      
338
339
340
      res = blocking_read(fd,
			  make_read_sexp(SEXP_TRANSPORT, 1,
					 &handler->super, &ignore_exception_handler));
341
342
343
344
345
346
347
      close(fd);

      KILL(handler);
      
      return 1;
    }
}
348

349
350
351
352
353
354
355
356
357
358
359
360
361
/* GABA:
   (expr
     (name lshd_listen)
     (globals
       (log "&io_log_peer_command.super.super"))
     (params
       (listen object command)
       (handshake object command)
       (services object command) )
     (expr (lambda (port)
             (services (handshake (log (listen port)))))))
*/

362
/* Invoked when the client requests the userauth service. */
363
364
/* GABA:
   (expr
365
366
     (name lshd_services)
     (params 
367
       (userauth object command))
368
369
370
371
372
     (expr
       (lambda (connection)
         ((userauth connection) connection))))
*/

373
/* Invoked when starting the ssh-connection service */
374
375
/* GABA:
   (expr
376
     (name lshd_connection_service)
377
     (globals
378
379
       (progn "&progn_command.super.super")
       (init "&connection_service.super"))
380
     (params
381
382
383
384
       (login object command)     
       (hooks object object_list))
     (expr
       (lambda (user connection)
385
386
387
388
         ((progn hooks) (login user
	                       ; We have to initialize the connection
			       ; before logging in.
	                       (init connection))))))
389
390
*/

Niels Möller's avatar
Niels Möller committed
391
392
int main(int argc, char **argv)
{
393
  struct lshd_options *options;
394
  
395
  struct alist *keys;
396
  
Niels Möller's avatar
Niels Möller committed
397
398
  struct reap *reaper;
  
399
400
401
402
  struct randomness *r;
  struct diffie_hellman_method *dh;
  struct keyexchange_algorithm *kex;
  struct alist *algorithms;
Niels Möller's avatar
Niels Möller committed
403
  struct make_kexinit *make_kexinit;
404
405
  struct alist *authorization_lookup;
  
406
  /* FIXME: Why not allocate backend statically? */
407
  NEW(io_backend, backend);
408
  init_backend(backend);
409

Niels Möller's avatar
Niels Möller committed
410
411
412
  /* For filtering messages. Could perhaps also be used when converting
   * strings to and from UTF8. */
  setlocale(LC_CTYPE, "");
413
414
  /* FIXME: Choose character set depending on the locale */
  set_local_charset(CHARSET_LATIN1);
415
416
417

  r = make_reasonably_random();
  dh = make_dh1(r);
Niels Möller's avatar
Niels Möller committed
418
  
419
  algorithms = many_algorithms(1,
Niels Möller's avatar
Niels Möller committed
420
			       ATOM_SSH_DSS, make_dsa_algorithm(r),
421
			       -1);
422
423
  options = make_lshd_options(algorithms);
  
Niels Möller's avatar
Niels Möller committed
424
  argp_parse(&main_argp, argc, argv, 0, NULL, options);
425

426
  /* Read the hostkey */
427
  keys = make_alist(0, -1);
428
  if (!read_host_key(options->hostkey, keys, r))
429
    {
Niels Möller's avatar
Niels Möller committed
430
      werror("lshd: Could not read hostkey.\n");
431
432
      return EXIT_FAILURE;
    }
433
434
435
  /* FIXME: We should check that we have at aleast one host key.
   * We should also extract the host-key algorithms for which we have keys,
   * instead of hardcoding ssh-dss below. */
436
  
Niels Möller's avatar
Niels Möller committed
437
#if 0
438
#if HAVE_SYSLOG
Niels Möller's avatar
Niels Möller committed
439
440
441
442
443
444
445
446
447
448
449
450
  {
    int option = LOG_PID | LOG_CONS;
    if (foreground_flag)
      {
	option |= LOG_PERROR;
      }
    openlog("lshd", option, LOG_DAEMON);
    syslog_flag = 1;
  }
#endif /* HAVE_SYSLOG */
#endif
 
Niels Möller's avatar
Niels Möller committed
451
  reaper = make_reaper();
Niels Möller's avatar
Niels Möller committed
452

453
  kex = make_dh_server(dh, keys);
Niels Möller's avatar
Niels Möller committed
454

455
456
457
458
459
460
461
462
463
464
465
466
467
468
  authorization_lookup
    = make_alist(1
#if DATAFELLOWS_WORKAROUNDS
		 +1,
		 ATOM_SSH_DSS_KLUDGE, make_authorization_db(make_dsa_kludge_algorithm(NULL),
							    &md5_algorithm)
#endif
				    
		 ,ATOM_SSH_DSS, make_authorization_db(make_dsa_algorithm(NULL),
						      &md5_algorithm),
		 
		 -1);

  
469
470
471
472
  ALIST_SET(algorithms, ATOM_DIFFIE_HELLMAN_GROUP1_SHA1, kex);

  make_kexinit
    = make_simple_kexinit(r,
473
474
			  make_int_list(1, ATOM_DIFFIE_HELLMAN_GROUP1_SHA1,
					-1),
475
			  make_int_list(1, ATOM_SSH_DSS, -1),
Niels Möller's avatar
Niels Möller committed
476
477
478
			  options->super.crypto_algorithms,
			  options->super.mac_algorithms,
			  options->super.compression_algorithms,
479
			  make_int_list(0, -1));
480
481
  
  {
482
483
    /* Commands to be invoked on the connection */
    struct object_list *connection_hooks;
484
485

#if WITH_TCP_FORWARD
486
    if (options->with_tcpip_forward)
487
488
      connection_hooks = make_object_list
	(3,
Niels Möller's avatar
Niels Möller committed
489
	 make_tcpip_forward_hook(backend),
490
491
492
493
	 make_install_fix_global_request_handler
	 (ATOM_CANCEL_TCPIP_FORWARD, &tcpip_cancel_forward),
	 make_direct_tcpip_hook(backend),
	 -1);
494
495
    else
#endif
496
      connection_hooks = make_object_list(0, -1);
497
498
499
500
501
502
503
504
505
    {
      struct lsh_object *o = lshd_listen
	(make_simple_listen(backend, NULL),
	 make_handshake_command(CONNECTION_SERVER,
				"lsh - a free ssh",
				SSH_MAX_PACKET,
				r,
				algorithms,
				make_kexinit,
506
				options->sshd1),
507
508
509
510
	 make_offer_service
	 (make_alist
	  (1, ATOM_SSH_USERAUTH,
	   lshd_services(make_userauth_service
511
512
513
514
515
516
517
			 (make_int_list(2,
					ATOM_PASSWORD,
					ATOM_PUBLICKEY, -1),
			  make_alist(2,
				     ATOM_PASSWORD, &unix_userauth.super,
				     ATOM_PUBLICKEY, make_userauth_publickey(authorization_lookup),
				     -1),
518
			  make_alist(1, ATOM_SSH_CONNECTION,
519
520
521
522
				     lshd_connection_service
				     (make_server_connection_service
				      (make_alist
				       (1
523
#if WITH_PTY_SUPPORT
524
					+1, ATOM_PTY_REQ, make_pty_handler()
525
#endif /* WITH_PTY_SUPPORT */
526
527
528
529
530
531
					, ATOM_SHELL,
					make_shell_handler(backend,
							   reaper),
					-1),
				       backend),
				      connection_hooks),
532
533
				     -1))),
	   -1)));
534
    
535
      CAST_SUBTYPE(command, server_listen, o);
536
    
Niels Möller's avatar
Niels Möller committed
537
      COMMAND_CALL(server_listen, options->local,
Niels Möller's avatar
Niels Möller committed
538
		   &discard_continuation, &default_exception_handler);
539
    }
540
  }
Niels Möller's avatar
Niels Möller committed
541
  
542
  reaper_run(reaper, backend);
Niels Möller's avatar
Niels Möller committed
543
544
545

  return 0;
}