security-and-privacy/gnupg
security-and-privacy
/
gnupg
mirror of git://git.gnupg.org/gnupg.git
1
0
Fork 0
Code Activity

2005-04-03 Moritz Schulte <moritz@g10code.com> 

* command-ssh.c (ssh_request_spec): New member: secret_input.
	(REQUEST_SPEC_DEFINE): New argument: secret_input.
	(request_specs): Add secret_input flag.
	(request_spec_lookup): New function ...
	(ssh_request_process): ... use it here; depending on secret_input
	flag allocate secure or non-secure memory.
This commit is contained in:
Moritz Schulte 2005-04-09 16:41:28 +00:00
parent 9476729709
commit 6ece9a0de9
2 changed files with 106 additions and 60 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
agent/ChangeLog
View File

@ -1,3 +1,12 @@
2005-04-03 Moritz Schulte <moritz@g10code.com>
* command-ssh.c (ssh_request_spec): New member: secret_input.
(REQUEST_SPEC_DEFINE): New argument: secret_input.
(request_specs): Add secret_input flag.
(request_spec_lookup): New function ...
(ssh_request_process): ... use it here; depending on secret_input
flag allocate secure or non-secure memory.
2005-03-02 Moritz Schulte <moritz@g10code.com> 2005-03-02 Moritz Schulte <moritz@g10code.com>
* command-ssh.c (sexp_key_extract): Removed FIXME, since * command-ssh.c (sexp_key_extract): Removed FIXME, since

157
agent/command-ssh.c
View File

@ -107,6 +107,7 @@ typedef struct ssh_request_spec
unsigned char type; unsigned char type;
ssh_request_handler_t handler; ssh_request_handler_t handler;
const char *identifier; const char *identifier;
unsigned int secret_input;
} ssh_request_spec_t; } ssh_request_spec_t;
/* Type for "key modifier functions", which are necessary since /* Type for "key modifier functions", which are necessary since
@ -160,26 +161,26 @@ typedef struct ssh_key_type_spec
/* Prototypes. */ /* Prototypes. */
static gpg_error_t ssh_handler_request_identities (ctrl_t ctrl, static gpg_error_t ssh_handler_request_identities (ctrl_t ctrl,
estream_t request, estream_t request,
estream_t response); estream_t response);
static gpg_error_t ssh_handler_sign_request (ctrl_t ctrl, static gpg_error_t ssh_handler_sign_request (ctrl_t ctrl,
estream_t request, estream_t request,
estream_t response); estream_t response);
static gpg_error_t ssh_handler_add_identity (ctrl_t ctrl, static gpg_error_t ssh_handler_add_identity (ctrl_t ctrl,
estream_t request, estream_t request,
estream_t response); estream_t response);
static gpg_error_t ssh_handler_remove_identity (ctrl_t ctrl, static gpg_error_t ssh_handler_remove_identity (ctrl_t ctrl,
estream_t request, estream_t request,
estream_t response); estream_t response);
static gpg_error_t ssh_handler_remove_all_identities (ctrl_t ctrl, static gpg_error_t ssh_handler_remove_all_identities (ctrl_t ctrl,
estream_t request, estream_t request,
estream_t response); estream_t response);
static gpg_error_t ssh_handler_lock (ctrl_t ctrl, static gpg_error_t ssh_handler_lock (ctrl_t ctrl,
estream_t request, estream_t request,
estream_t response); estream_t response);
static gpg_error_t ssh_handler_unlock (ctrl_t ctrl, static gpg_error_t ssh_handler_unlock (ctrl_t ctrl,
estream_t request, estream_t request,
estream_t response); estream_t response);
static gpg_error_t ssh_key_modifier_rsa (const char *elems, gcry_mpi_t *mpis); static gpg_error_t ssh_key_modifier_rsa (const char *elems, gcry_mpi_t *mpis);
static gpg_error_t ssh_signature_encoder_rsa (estream_t signature_blob, static gpg_error_t ssh_signature_encoder_rsa (estream_t signature_blob,
@ -195,19 +196,19 @@ static gpg_error_t ssh_signature_encoder_dsa (estream_t signature_blob,
/* Associating request types with the corresponding request /* Associating request types with the corresponding request
handlers. */ handlers. */
#define REQUEST_SPEC_DEFINE(id, name) \ #define REQUEST_SPEC_DEFINE(id, name, secret_input) \
{ SSH_REQUEST_##id, ssh_handler_##name, #name } { SSH_REQUEST_##id, ssh_handler_##name, #name, secret_input }
static ssh_request_spec_t request_specs[] = static ssh_request_spec_t request_specs[] =
{ {
REQUEST_SPEC_DEFINE (REQUEST_IDENTITIES, request_identities), REQUEST_SPEC_DEFINE (REQUEST_IDENTITIES, request_identities, 1),
REQUEST_SPEC_DEFINE (SIGN_REQUEST, sign_request), REQUEST_SPEC_DEFINE (SIGN_REQUEST, sign_request, 0),
REQUEST_SPEC_DEFINE (ADD_IDENTITY, add_identity), REQUEST_SPEC_DEFINE (ADD_IDENTITY, add_identity, 1),
REQUEST_SPEC_DEFINE (ADD_ID_CONSTRAINED, add_identity), REQUEST_SPEC_DEFINE (ADD_ID_CONSTRAINED, add_identity, 1),
REQUEST_SPEC_DEFINE (REMOVE_IDENTITY, remove_identity), REQUEST_SPEC_DEFINE (REMOVE_IDENTITY, remove_identity, 0),
REQUEST_SPEC_DEFINE (REMOVE_ALL_IDENTITIES, remove_all_identities), REQUEST_SPEC_DEFINE (REMOVE_ALL_IDENTITIES, remove_all_identities, 0),
REQUEST_SPEC_DEFINE (LOCK, lock), REQUEST_SPEC_DEFINE (LOCK, lock, 0),
REQUEST_SPEC_DEFINE (UNLOCK, unlock) REQUEST_SPEC_DEFINE (UNLOCK, unlock, 0)
}; };
#undef REQUEST_SPEC_DEFINE #undef REQUEST_SPEC_DEFINE
@ -1733,13 +1734,15 @@ ssh_handler_request_identities (ctrl_t ctrl,
gcry_sexp_t key_public; gcry_sexp_t key_public;
DIR *dir; DIR *dir;
gpg_error_t err; gpg_error_t err;
gpg_error_t ret_err;
int ret; int ret;
FILE *ctrl_fp = NULL; FILE *ctrl_fp = NULL;
char *cardsn; char *cardsn;
gpg_error_t ret_err;
/* Prepare buffer stream. */ /* Prepare buffer stream. */
sleep (5);
key_directory = NULL; key_directory = NULL;
key_secret = NULL; key_secret = NULL;
key_public = NULL; key_public = NULL;
@ -2460,8 +2463,10 @@ ssh_handler_add_identity (ctrl_t ctrl, estream_t request, estream_t response)
gcry_sexp_release (key); gcry_sexp_release (key);
ret_err = stream_write_byte (response, if (! err)
err ? SSH_RESPONSE_FAILURE : SSH_RESPONSE_SUCCESS); ret_err = stream_write_byte (response, SSH_RESPONSE_SUCCESS);
else
ret_err = stream_write_byte (response, SSH_RESPONSE_FAILURE);
return ret_err; return ret_err;
} }
@ -2496,8 +2501,10 @@ ssh_handler_remove_identity (ctrl_t ctrl, estream_t request,
xfree (key_blob); xfree (key_blob);
gcry_sexp_release (key); gcry_sexp_release (key);
ret_err = stream_write_byte (response, if (! err)
err ? SSH_RESPONSE_FAILURE : SSH_RESPONSE_SUCCESS); ret_err = stream_write_byte (response, SSH_RESPONSE_SUCCESS);
else
ret_err = stream_write_byte (response, SSH_RESPONSE_FAILURE);
return ret_err; return ret_err;
} }
@ -2523,8 +2530,11 @@ ssh_handler_remove_all_identities (ctrl_t ctrl, estream_t request,
gpg_error_t err; gpg_error_t err;
err = ssh_identities_remove_all (); err = ssh_identities_remove_all ();
ret_err = stream_write_byte (response,
err ? SSH_RESPONSE_FAILURE : SSH_RESPONSE_SUCCESS); if (! err)
ret_err = stream_write_byte (response, SSH_RESPONSE_SUCCESS);
else
ret_err = stream_write_byte (response, SSH_RESPONSE_FAILURE);
return ret_err; return ret_err;
} }
@ -2559,8 +2569,11 @@ ssh_handler_lock (ctrl_t ctrl, estream_t request, estream_t response)
gpg_error_t err; gpg_error_t err;
err = ssh_lock (); err = ssh_lock ();
ret_err = stream_write_byte (response,
err ? SSH_RESPONSE_FAILURE : SSH_RESPONSE_SUCCESS); if (! err)
ret_err = stream_write_byte (response, SSH_RESPONSE_SUCCESS);
else
ret_err = stream_write_byte (response, SSH_RESPONSE_FAILURE);
return ret_err; return ret_err;
} }
@ -2572,22 +2585,45 @@ ssh_handler_unlock (ctrl_t ctrl, estream_t request, estream_t response)
gpg_error_t err; gpg_error_t err;
err = ssh_unlock (); err = ssh_unlock ();
ret_err = stream_write_byte (response,
err ? SSH_RESPONSE_FAILURE : SSH_RESPONSE_SUCCESS); if (! err)
ret_err = stream_write_byte (response, SSH_RESPONSE_SUCCESS);
else
ret_err = stream_write_byte (response, SSH_RESPONSE_FAILURE);
return ret_err; return ret_err;
} }
static ssh_request_spec_t *
request_spec_lookup (int type)
{
ssh_request_spec_t *spec;
unsigned int i;
for (i = 0; i < DIM (request_specs); i++)
if (request_specs[i].type == type)
break;
if (i == DIM (request_specs))
{
log_info ("ssh request %u is not supported\n", type);
spec = NULL;
}
else
spec = request_specs + i;
return spec;
}
static int static int
ssh_request_process (ctrl_t ctrl, estream_t stream_sock) ssh_request_process (ctrl_t ctrl, estream_t stream_sock)
{ {
ssh_request_spec_t *spec;
estream_t response; estream_t response;
estream_t request; estream_t request;
unsigned char request_type; unsigned char request_type;
gpg_error_t err; gpg_error_t err;
unsigned int i;
int send_err; int send_err;
int ret; int ret;
unsigned char *request_data; unsigned char *request_data;
@ -2617,7 +2653,26 @@ ssh_request_process (ctrl_t ctrl, estream_t stream_sock)
log_info ("received ssh request of length %u\n", log_info ("received ssh request of length %u\n",
(unsigned int)request_data_size); (unsigned int)request_data_size);
request = es_mopen (NULL, 0, 0, 1, realloc_secure, gcry_free, "r+"); if (! request_data_size)
{
send_err = 1;
goto out;
/* Broken request; FIXME. */
}
request_type = request_data[0];
spec = request_spec_lookup (request_type);
if (! spec)
{
send_err = 1;
goto out;
/* Unknown request; FIXME. */
}
if (spec->secret_input)
request = es_mopen (NULL, 0, 0, 1, realloc_secure, gcry_free, "r+");
else
request = es_mopen (NULL, 0, 0, 1, gcry_realloc, gcry_free, "r+");
if (! request) if (! request)
{ {
err = gpg_error_from_errno (errno); err = gpg_error_from_errno (errno);
@ -2629,7 +2684,7 @@ ssh_request_process (ctrl_t ctrl, estream_t stream_sock)
err = gpg_error_from_errno (errno); err = gpg_error_from_errno (errno);
goto out; goto out;
} }
err = stream_write_data (request, request_data, request_data_size); err = stream_write_data (request, request_data + 1, request_data_size - 1);
if (err) if (err)
goto out; goto out;
es_rewind (request); es_rewind (request);
@ -2641,38 +2696,20 @@ ssh_request_process (ctrl_t ctrl, estream_t stream_sock)
goto out; goto out;
} }
err = stream_read_byte (request, &request_type);
if (err)
{
send_err = 1;
goto out;
}
for (i = 0; i < DIM (request_specs); i++)
if (request_specs[i].type == request_type)
break;
if (i == DIM (request_specs))
{
log_info ("ssh request %u is not supported\n", request_type);
send_err = 1;
goto out;
}
if (opt.verbose) if (opt.verbose)
log_info ("ssh request handler for %s (%u) started\n", log_info ("ssh request handler for %s (%u) started\n",
request_specs[i].identifier, request_specs[i].type); spec->identifier, spec->type);
err = (*request_specs[i].handler) (ctrl, request, response); err = (*spec->handler) (ctrl, request, response);
if (opt.verbose) if (opt.verbose)
{ {
if (err) if (err)
log_info ("ssh request handler for %s (%u) failed: %s\n", log_info ("ssh request handler for %s (%u) failed: %s\n",
request_specs[i].identifier, request_specs[i].type, spec->identifier, spec->type, gpg_strerror (err));
gpg_strerror (err));
else else
log_info ("ssh request handler for %s (%u) ready\n", log_info ("ssh request handler for %s (%u) ready\n",
request_specs[i].identifier, request_specs[i].type); spec->identifier, spec->type);
} }
if (err) if (err)