WolfSSL
/
wolfssh
mirror of https://github.com/wolfSSL/wolfssh.git
1
0
Fork 0
Code Issues Releases Wiki Activity

add more comments and always print out error messages

pull/435/head
JacobBarthelmeh 2022-08-03 15:04:34 -07:00
parent 7d58486a42
commit f51375802b
4 changed files with 71 additions and 140 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

129
apps/wolfsshd/auth.c
View File

@ -60,12 +60,16 @@ struct WOLFSSHD_AUTH {
const WOLFSSHD_CONFIG* conf;
int gid;
int uid;
int attempts;
void* heap;
};
#ifndef WOLFSSHD_MAX_PASSWORD_ATTEMPTS
#define WOLFSSHD_MAX_PASSWORD_ATTEMPTS 3
#endif
#if 0
static byte passwdRetry = 3;
/* this could potentially be useful in a deeply embeded future port */
/* Map user names to passwords */
/* Use arrays for username and p. The password or public key can
@ -107,105 +111,6 @@ USER_NODE* AddNewUser(USER_NODE* list, byte type, const byte* username,
return map;
}
int DefaultUserAuth(byte authType, WS_UserAuthData* authData, void* ctx)
{
USER_NODE* map;
byte authHash[WC_SHA256_DIGEST_SIZE];
int ret;
if (authType != WOLFSSH_USERAUTH_PASSWORD &&
#ifdef WOLFSSH_ALLOW_USERAUTH_NONE
authType != WOLFSSH_USERAUTH_NONE &&
#endif
authType != WOLFSSH_USERAUTH_PUBLICKEY) {
return WOLFSSH_USERAUTH_FAILURE;
}
map = (USER_NODE*)ctx;
/* check if password on system */
if (authData->type == WOLFSSH_USERAUTH_PASSWORD) {
if (CheckPassword(authData->username, authData->sf.password.password,
authData->sf.password.passwordSz) == WS_SUCCESS) {
wolfSSH_Log(WS_LOG_INFO, "[SSHD] Password and user on system");
return WOLFSSH_USERAUTH_SUCCESS;
}
}
if (authType == WOLFSSH_USERAUTH_PASSWORD) {
wc_Sha256Hash(authData->sf.password.password,
authData->sf.password.passwordSz,
authHash);
}
else if (authType == WOLFSSH_USERAUTH_PUBLICKEY) {
wc_Sha256Hash(authData->sf.publicKey.publicKey,
authData->sf.publicKey.publicKeySz,
authHash);
}
while (map != NULL) {
if (authData->usernameSz == map->usernameSz &&
WMEMCMP(authData->username, map->username, map->usernameSz) == 0 &&
authData->type == map->type) {
if (authData->type == WOLFSSH_USERAUTH_PUBLICKEY) {
if (WMEMCMP(map->fingerprint, authHash,
WC_SHA256_DIGEST_SIZE) == 0) {
return WOLFSSH_USERAUTH_SUCCESS;
}
else {
return WOLFSSH_USERAUTH_INVALID_PUBLICKEY;
}
}
else if (authData->type == WOLFSSH_USERAUTH_PASSWORD) {
if (WMEMCMP(map->fingerprint, authHash,
WC_SHA256_DIGEST_SIZE) == 0) {
return WOLFSSH_USERAUTH_SUCCESS;
}
else {
passwdRetry--;
return (passwdRetry > 0) ?
WOLFSSH_USERAUTH_INVALID_PASSWORD :
WOLFSSH_USERAUTH_REJECTED;
}
}
#ifdef WOLFSSH_ALLOW_USERAUTH_NONE
else if (authData->type == WOLFSSH_USERAUTH_NONE) {
return WOLFSSH_USERAUTH_SUCCESS;
}
#endif /* WOLFSSH_ALLOW_USERAUTH_NONE */
else {
return WOLFSSH_USERAUTH_INVALID_AUTHTYPE;
}
if (authData->type == map->type) {
if (WMEMCMP(map->fingerprint, authHash,
WC_SHA256_DIGEST_SIZE) == 0) {
return WOLFSSH_USERAUTH_SUCCESS;
}
else {
if (authType == WOLFSSH_USERAUTH_PASSWORD) {
passwdRetry--;
ret = (passwdRetry > 0) ?
WOLFSSH_USERAUTH_INVALID_PASSWORD :
WOLFSSH_USERAUTH_REJECTED;
}
else {
ret = WOLFSSH_USERAUTH_INVALID_PUBLICKEY;
}
return ret;
}
}
else {
return WOLFSSH_USERAUTH_INVALID_AUTHTYPE;
}
}
map = map->next;
}
return WOLFSSH_USERAUTH_INVALID_USER;
}
#endif
enum {
@ -631,6 +536,7 @@ static int CheckPublicKeyUnix(const char* name, const byte* key, word32 keySz)
#endif /* !_WIN32*/
/* return WOLFSSH_USERAUTH_SUCCESS on success */
static int DoCheckUser(const char* usr, WOLFSSHD_AUTH* auth)
{
int ret = WOLFSSH_USERAUTH_FAILURE;
@ -674,7 +580,7 @@ static int RequestAuthentication(const char* usr, int type, const byte* data,
ret = DoCheckUser(usr, auth);
/* temporarily elevate permissions */
if (ret == WOLFSSH_USERAUTH_SUCCESS &&
wolfSSHD_AuthRaisePermissions(auth) != 0) {
wolfSSHD_AuthRaisePermissions(auth) != WS_SUCCESS) {
wolfSSH_Log(WS_LOG_ERROR, "[SSHD] Failure to raise permissions for auth");
ret = WOLFSSH_USERAUTH_FAILURE;
}
@ -689,7 +595,8 @@ static int RequestAuthentication(const char* usr, int type, const byte* data,
}
/* Check if password is valid for this user. */
/* first handle empty password cases */
else if (dataSz == 0 && wolfSSHD_ConfigGetPermitEmptyPw(auth->conf) != 1) {
else if (dataSz == 0 && wolfSSHD_ConfigGetPermitEmptyPw(auth->conf)
!= 1) {
wolfSSH_Log(WS_LOG_ERROR, "[SSHD] Empty passwords not allowed by "
"configuration!");
ret = WOLFSSH_USERAUTH_FAILURE;
@ -702,6 +609,13 @@ static int RequestAuthentication(const char* usr, int type, const byte* data,
else if (rc == WSSHD_AUTH_FAILURE) {
wolfSSH_Log(WS_LOG_INFO, "[SSHD] Password incorrect.");
ret = WOLFSSH_USERAUTH_INVALID_PASSWORD;
auth->attempts--;
if (auth->attempts == 0) {
wolfSSH_Log(WS_LOG_ERROR,
"[SSHD] Too many bad password attempts!");
ret = WOLFSSH_USERAUTH_REJECTED;
}
}
else {
wolfSSH_Log(WS_LOG_ERROR, "[SSHD] Error checking password.");
@ -730,7 +644,7 @@ static int RequestAuthentication(const char* usr, int type, const byte* data,
}
if (wolfSSHD_AuthReducePermissions(auth) != 0) {
if (wolfSSHD_AuthReducePermissions(auth) != WS_SUCCESS) {
/* stop everything if not able to reduce permissions level */
exit(1);
}
@ -738,6 +652,7 @@ static int RequestAuthentication(const char* usr, int type, const byte* data,
}
/* return WOLFSSH_USERAUTH_SUCCESS on success */
int DefaultUserAuth(byte authType, WS_UserAuthData* authData, void* ctx)
{
int ret = WOLFSSH_USERAUTH_SUCCESS;
@ -856,6 +771,7 @@ WOLFSSHD_AUTH* wolfSSHD_AuthCreateUser(void* heap, const WOLFSSHD_CONFIG* conf)
auth->heap = heap;
auth->conf = conf;
auth->attempts = WOLFSSHD_MAX_PASSWORD_ATTEMPTS;
/* set the default user checking based on build */
ret = SetDefaultUserCheck(auth);
@ -917,7 +833,7 @@ int wolfSSHD_AuthFreeUser(WOLFSSHD_AUTH* auth)
}
/* return 0 on success */
/* return WS_SUCCESS on success */
int wolfSSHD_AuthRaisePermissions(WOLFSSHD_AUTH* auth)
{
int ret = 0;
@ -942,11 +858,11 @@ int wolfSSHD_AuthRaisePermissions(WOLFSSHD_AUTH* auth)
}
/* return 0 on success */
/* return WS_SUCCESS on success */
int wolfSSHD_AuthReducePermissions(WOLFSSHD_AUTH* auth)
{
byte flag = 0;
int ret = 0;
int ret = WS_SUCCESS;
flag = wolfSSHD_ConfigGetPrivilegeSeparation(auth->conf);
if (flag == WOLFSSHD_PRIV_SEPARAT || flag == WOLFSSHD_PRIV_SANDBOX) {
@ -969,6 +885,7 @@ int wolfSSHD_AuthReducePermissions(WOLFSSHD_AUTH* auth)
return ret;
}
/* return the time in seconds for grace timeout period */
long wolfSSHD_AuthGetGraceTime(const WOLFSSHD_AUTH* auth)
{
long ret = WS_BAD_ARGUMENT;

17
apps/wolfsshd/configuration.c
View File

@ -147,6 +147,8 @@ static void FreeString(char** in, void* heap)
(void)heap;
}
/* returns a new WOLFSSHD_CONFIG on success and NULL on failure */
WOLFSSHD_CONFIG* wolfSSHD_ConfigNew(void* heap)
{
WOLFSSHD_CONFIG* ret;
@ -229,6 +231,7 @@ static const CONFIG_OPTION options[NUM_OPTIONS] = {
{OPT_USE_DNS, "UseDNS"}
};
/* returns WS_SUCCESS on success */
static int HandlePrivSep(WOLFSSHD_CONFIG* conf, const char* value)
{
int ret = WS_SUCCESS;
@ -261,6 +264,7 @@ static int HandlePrivSep(WOLFSSHD_CONFIG* conf, const char* value)
return ret;
}
/* returns WS_SUCCESS on success */
static int HandleLoginGraceTime(WOLFSSHD_CONFIG* conf, const char* value)
{
int ret = WS_SUCCESS;
@ -287,6 +291,7 @@ static int HandleLoginGraceTime(WOLFSSHD_CONFIG* conf, const char* value)
return ret;
}
/* returns WS_SUCCESS on success */
static int HandlePermitEmptyPw(WOLFSSHD_CONFIG* conf, const char* value)
{
int ret = WS_SUCCESS;
@ -310,6 +315,7 @@ static int HandlePermitEmptyPw(WOLFSSHD_CONFIG* conf, const char* value)
return ret;
}
/* returns WS_SUCCESS on success */
static int HandlePermitRoot(WOLFSSHD_CONFIG* conf, const char* value)
{
int ret = WS_SUCCESS;
@ -333,6 +339,7 @@ static int HandlePermitRoot(WOLFSSHD_CONFIG* conf, const char* value)
return ret;
}
/* returns WS_SUCCESS on success */
static int HandlePwAuth(WOLFSSHD_CONFIG* conf, const char* value)
{
int ret = WS_SUCCESS;
@ -357,6 +364,8 @@ static int HandlePwAuth(WOLFSSHD_CONFIG* conf, const char* value)
}
#define WOLFSSH_PROTOCOL_VERSION 2
/* returns WS_SUCCESS on success */
static int HandleProtocol(WOLFSSHD_CONFIG* conf, const char* value)
{
int ret = WS_SUCCESS;
@ -385,6 +394,7 @@ static int HandleProtocol(WOLFSSHD_CONFIG* conf, const char* value)
return ret;
}
/* returns WS_SUCCESS on success */
static int HandlePort(WOLFSSHD_CONFIG* conf, const char* value)
{
int ret = WS_SUCCESS;
@ -416,6 +426,8 @@ static int HandlePort(WOLFSSHD_CONFIG* conf, const char* value)
return ret;
}
/* returns WS_SUCCESS on success */
static int HandleConfigOption(WOLFSSHD_CONFIG* conf, int opt, const char* value)
{
int ret = WS_BAD_ARGUMENT;
@ -485,6 +497,8 @@ static int HandleConfigOption(WOLFSSHD_CONFIG* conf, int opt, const char* value)
return ret;
}
/* helper function to count white spaces, returns the number of white spaces on
* success */
static int CountWhitespace(const char* in, int inSz, byte inv)
{
int i = 0;
@ -554,6 +568,9 @@ WOLFSSHD_STATIC int ParseConfigLine(WOLFSSHD_CONFIG* conf, const char* l,
}
/* parses and loads in the given configuration file 'filename'
* returns WS_SUCCESS on success
*/
int wolfSSHD_ConfigLoad(WOLFSSHD_CONFIG* conf, const char* filename)
{
XFILE f;

55
apps/wolfsshd/wolfsshd.c
View File

@ -102,13 +102,14 @@ typedef struct WOLFSSHD_CONNECTION {
WOLFSSH_CTX* ctx;
WOLFSSHD_AUTH* auth;
int fd;
char ip[INET_ADDRSTRLEN];
} WOLFSSHD_CONNECTION;
static void ShowUsage(void)
{
printf("wolfsshd %s\n", LIBWOLFSSH_VERSION_STRING);
printf(" -? display this help and exit\n");
printf(" -f <file name> Configuration file to use, default is /usr/local/etc/ssh/sshd_config\n");
printf(" -f <file name> Configuration file to use, default is /etc/ssh/sshd_config\n");
printf(" -p <int> Port number to listen on\n");
printf(" -d Turn on debug mode\n");
printf(" -D Run in foreground (do not detach)\n");
@ -116,6 +117,8 @@ static void ShowUsage(void)
printf(" -E <file name> append to log file\n");
}
/* catch if interupted */
static void interruptCatch(int in)
{
(void)in;
@ -124,15 +127,21 @@ static void interruptCatch(int in)
quit = 1;
}
/* redirect logging to a specific file and add the PID value */
static void wolfSSHDLoggingCb(enum wolfSSH_LogLevel lvl, const char *const str)
{
if (debugMode) {
/* always log errors and optionally log other info/debug level messages */
if (lvl == WS_LOG_ERROR) {
fprintf(logFile, "[PID %d]: %s\n", getpid(), str);
}
else if (debugMode) {
fprintf(logFile, "[PID %d]: %s\n", getpid(), str);
}
(void)lvl;
}
/* Frees up the WOLFSSH_CTX struct */
static void CleanupCTX(WOLFSSHD_CONFIG* conf, WOLFSSH_CTX** ctx)
{
if (ctx != NULL && *ctx != NULL) {
@ -143,6 +152,9 @@ static void CleanupCTX(WOLFSSHD_CONFIG* conf, WOLFSSH_CTX** ctx)
}
/* Initializes and sets up the WOLFSSH_CTX struct based on the configure options
* return WS_SUCCESS on success
*/
static int SetupCTX(WOLFSSHD_CONFIG* conf, WOLFSSH_CTX** ctx)
{
int ret = WS_SUCCESS;
@ -172,24 +184,6 @@ static int SetupCTX(WOLFSSHD_CONFIG* conf, WOLFSSH_CTX** ctx)
wolfSSH_CTX_SetBanner(*ctx, banner);
}
#ifdef WOLFSSH_AGENT
/* check if using an agent is enabled */
/* TODO: doesn't work
if (ret == WS_SUCCESS) {
wolfSSH_CTX_set_agent_cb(ctx, wolfSSH_AGENT_DefaultActions, NULL);
}
*/
#endif
#ifdef WOLFSSH_FWD
/* check if port forwarding is enabled */
/* TODO: doesn't work
if (ret == WS_SUCCESS) {
wolfSSH_CTX_SetFwdCb(ctx, wolfSSH_FwdDefaultActions, NULL);
}
*/
#endif
/* Load in host private key */
if (ret == WS_SUCCESS) {
@ -384,7 +378,7 @@ static int SHELL_Subsystem(WOLFSSHD_CONNECTION* conn, WOLFSSH* ssh)
userName = wolfSSH_GetUsername(ssh);
/* temporarily elevate permissions to get users information */
if (wolfSSHD_AuthRaisePermissions(conn->auth) != 0) {
if (wolfSSHD_AuthRaisePermissions(conn->auth) != WS_SUCCESS) {
wolfSSH_Log(WS_LOG_ERROR, "[SSHD] Failure to raise permissions for auth");
return WS_FATAL_ERROR;
}
@ -393,7 +387,7 @@ static int SHELL_Subsystem(WOLFSSHD_CONNECTION* conn, WOLFSSH* ssh)
if (p_passwd == NULL) {
/* Not actually a user on the system. */
wolfSSH_Log(WS_LOG_ERROR, "[SSHD] Invalid user name found");
if (wolfSSHD_AuthReducePermissions(conn->auth) != 0) {
if (wolfSSHD_AuthReducePermissions(conn->auth) != WS_SUCCESS) {
/* stop everything if not able to reduce permissions level */
exit(1);
}
@ -454,7 +448,7 @@ static int SHELL_Subsystem(WOLFSSHD_CONNECTION* conn, WOLFSSH* ssh)
exit(0); /* exit child process and close down SSH connection */
}
if (wolfSSHD_AuthReducePermissions(conn->auth) != 0) {
if (wolfSSHD_AuthReducePermissions(conn->auth) != WS_SUCCESS) {
/* stop everything if not able to reduce permissions level */
wolfSSH_Log(WS_LOG_ERROR, "[SSHD] Issue reducing permissions level,"
" exiting now");
@ -628,7 +622,8 @@ static void* HandleConnection(void* arg)
if (ret != WS_SUCCESS && ret != WS_SFTP_COMPLETE) {
wolfSSH_Log(WS_LOG_ERROR,
"[SSHD] Failed to accept WOLFSSH connection");
"[SSHD] Failed to accept WOLFSSH connection from %s",
conn->ip);
}
}
@ -769,15 +764,13 @@ int main(int argc, char** argv)
WOLFSSH_CTX* ctx = NULL;
byte isDaemon = 1;
const char* configFile = "/usr/local/etc/ssh/sshd_config";
const char* configFile = "/etc/ssh/sshd_config";
const char* hostKeyFile = NULL;
signal(SIGINT, interruptCatch);
wolfSSH_SetLoggingCb(wolfSSHDLoggingCb);
#ifdef DEBUG_WOLFSSH
wolfSSH_Debugging_ON();
#endif
#ifdef DEBUG_WOLFSSL
wolfSSL_Debugging_ON();
#endif
@ -885,7 +878,7 @@ int main(int argc, char** argv)
/* seperate privlage permisions */
if (ret == WS_SUCCESS) {
if (wolfSSHD_AuthReducePermissions(auth) != 0) {
if (wolfSSHD_AuthReducePermissions(auth) != WS_SUCCESS) {
wolfSSH_Log(WS_LOG_INFO, "[SSHD] Error lowering permissions level");
ret = WS_FATAL_ERROR;
}
@ -942,6 +935,10 @@ int main(int argc, char** argv)
#else
conn.fd = accept(listenFd, (struct sockaddr*)&clientAddr,
&clientAddrSz);
if (conn.fd >= 0) {
inet_ntop(AF_INET, &clientAddr.sin_addr, conn.ip,
INET_ADDRSTRLEN);
}
#endif
{

10
src/log.c
View File

@ -57,7 +57,7 @@
#endif /* WOLFSSH_NO_DEFAULT_LOGGING_CB */
#ifdef DEBUG_WOLFSSH
#if defined(DEBUG_WOLFSSH) || defined(WOLFSSH_SSHD)
static enum wolfSSH_LogLevel logLevel = WS_LOG_DEFAULT;
static int logEnable = 0;
#endif
@ -66,7 +66,7 @@
/* turn debugging on if supported */
void wolfSSH_Debugging_ON(void)
{
#ifdef DEBUG_WOLFSSH
#if defined(DEBUG_WOLFSSH) || defined(WOLFSSH_SSHD)
logEnable = 1;
#endif
}
@ -75,7 +75,7 @@ void wolfSSH_Debugging_ON(void)
/* turn debugging off */
void wolfSSH_Debugging_OFF(void)
{
#ifdef DEBUG_WOLFSSH
#if defined(DEBUG_WOLFSSH) || defined(WOLFSSH_SSHD)
logEnable = 0;
#endif
}
@ -91,7 +91,7 @@ void wolfSSH_SetLoggingCb(wolfSSH_LoggingCb logF)
int wolfSSH_LogEnabled(void)
{
#ifdef DEBUG_WOLFSSH
#if defined(DEBUG_WOLFSSH) || defined(WOLFSSH_SSHD)
return logEnable;
#else
return 0;
@ -99,7 +99,7 @@ int wolfSSH_LogEnabled(void)
}
#ifdef DEBUG_WOLFSSH
#if defined(DEBUG_WOLFSSH) || defined(WOLFSSH_SSHD)
#ifndef WOLFSSH_NO_DEFAULT_LOGGING_CB
/* log level string */
static const char* GetLogStr(enum wolfSSH_LogLevel level)