/*
* This file is part of the SSH Library
*
* Copyright (c) 2019 by Red Hat, Inc.
*
* Author: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
*
* The SSH Library is free software; you can redistribute it and/or modify
* it under the terms of the GNU Lesser General Public License as published by
* the Free Software Foundation; either version 2.1 of the License, or (at your
* option) any later version.
*
* The SSH Library is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public
* License for more details.
*
* You should have received a copy of the GNU Lesser General Public License
* along with the SSH Library; see the file COPYING. If not, write to
* the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
* MA 02111-1307, USA.
*/
#include "config.h"
#define LIBSSH_STATIC
#include <sys/types.h>
#include <sys/stat.h>
#include <errno.h>
#include <pwd.h>
#include "torture.h"
#include "torture_key.h"
#include "libssh/libssh.h"
#include "libssh/priv.h"
#include "libssh/session.h"
#include <signal.h>
#include <sys/wait.h>
#include <sys/ioctl.h>
#include "test_server.h"
#include "default_cb.h"
#define TORTURE_KNOWN_HOSTS_FILE "libssh_torture_knownhosts"
enum {
SUCCESS,
MORE,
FAILED
};
struct test_server_st {
struct torture_state *state;
struct server_state_st *ss;
};
#ifdef WITH_PCAP
static void set_pcap(struct session_data_st *sdata,
ssh_session session,
char *pcap_file)
{
int rc = 0;
if (sdata == NULL) {
return;
}
if (pcap_file == NULL) {
return;
}
sdata->pcap = ssh_pcap_file_new();
if (sdata->pcap == NULL) {
return;
}
rc = ssh_pcap_file_open(sdata->pcap, pcap_file);
if (rc == SSH_ERROR) {
fprintf(stderr, "Error opening pcap file\n");
ssh_pcap_file_free(sdata->pcap);
sdata->pcap = NULL;
return;
}
ssh_set_pcap_file(session, sdata->pcap);
}
static void cleanup_pcap(struct session_data_st *sdata)
{
if (sdata == NULL) {
return;
}
if (sdata->pcap == NULL) {
return;
}
/* Do not free the pcap data context here since its ownership was
* transfered to the session object, which will take care of its cleanup.
* Morover it is still in use so we can very simply crash by freeing
* it here.
*/
sdata->pcap = NULL;
}
#endif
static int process_stdout(socket_t fd, int revents, void *userdata)
{
char buf[BUF_SIZE];
int n = -1;
ssh_channel channel = (ssh_channel) userdata;
if (channel != NULL && (revents & POLLIN) != 0) {
n = read(fd, buf, BUF_SIZE);
if (n > 0) {
ssh_channel_write(channel, buf, n);
}
}
return n;
}
static int process_stderr(socket_t fd, int revents, void *userdata)
{
char buf[BUF_SIZE];
int n = -1;
ssh_channel channel = (ssh_channel) userdata;
if (channel != NULL && (revents & POLLIN) != 0) {
n = read(fd, buf, BUF_SIZE);
if (n > 0) {
ssh_channel_write_stderr(channel, buf, n);
}
}
return n;
}
static int authenticate_kbdint(ssh_session session,
ssh_message message,
void *userdata)
{
int rc = 0;
int count;
int *step = NULL;
size_t expected_len;
const char instruction[] = "Type the requested data";
const char name[] = "Keyboard-Interactive Authentication\n";
char initial_echo[] = {1, 0};
char retype_echo[] = {0};
const char *initial_prompt[2];
const char *retype_prompt[1];
int cmp;
const char *answer;
struct session_data_st *sdata = (struct session_data_st *)userdata;
initial_prompt[0] = "username: ";
initial_prompt[1] = "password: ";
/* Prompt for aditional prompts */
retype_prompt[0] = "retype password: ";
if ((session == NULL) || (message == NULL) || (sdata == NULL)) {
fprintf(stderr, "Null argument provided\n");
goto failed;
}
if (sdata->extra_data == NULL) {
goto failed;
}
step = (int *)sdata->extra_data;
switch (*step) {
case 0:
ssh_message_auth_interactive_request(message, name, instruction, 2,
initial_prompt, initial_echo);
rc = MORE;
goto end;
case 1:
count = ssh_userauth_kbdint_getnanswers(session);
if (count != 2) {
goto failed;
}
if ((sdata->username == NULL) || (sdata->password == NULL)) {
goto failed;
}
/* Get and compare username */
expected_len = strlen(sdata->username);
if (expected_len <= 0) {
goto failed;
}
answer = ssh_userauth_kbdint_getanswer(session, 0);
if (answer == NULL) {
goto failed;
}
cmp = strncmp(answer, sdata->username, expected_len);
if (cmp != 0) {
goto failed;
}
/* Get and compare password */
expected_len = strlen(sdata->password);
if (expected_len <= 0) {
goto failed;
}
answer = ssh_userauth_kbdint_getanswer(session, 1);
if (answer == NULL) {
goto failed;
}
cmp = strncmp(answer, sdata->password, expected_len);
if (cmp != 0) {
goto failed;
}
/* Username and password matched. Ask for a retype. */
ssh_message_auth_interactive_request(message,
name,
instruction,
1,
retype_prompt,
retype_echo);
rc = MORE;
goto end;
case 2:
/* Get and compare password */
expected_len = strlen(sdata->password);
if (expected_len <= 0) {
goto failed;
}
answer = ssh_userauth_kbdint_getanswer(session, 0);
if (answer == NULL) {
goto failed;
}
cmp = strncmp(answer, sdata->password, expected_len);
if (cmp != 0) {
goto failed;
}
/* Password was correct, authenticated */
rc = SUCCESS;
goto end;
default:
goto failed;
}
failed:
if (step != NULL) {
*step = 0;
}
return FAILED;
end:
if (step != NULL) {
(*step)++;
}
return rc;
}
static int authenticate_callback(ssh_session session,
ssh_message message,
void *userdata)
{
struct session_data_st *sdata = (struct session_data_st *)userdata;
int rc;
if (sdata == NULL) {
fprintf(stderr, "Null userdata\n");
goto denied;
}
if (sdata->extra_data == NULL) {
sdata->extra_data = (void *)calloc(1, sizeof(int));
}
switch (ssh_message_type(message)) {
case SSH_REQUEST_AUTH:
switch (ssh_message_subtype(message)) {
case SSH_AUTH_METHOD_INTERACTIVE:
rc = authenticate_kbdint(session, message, (void *)sdata);
if (rc == SUCCESS) {
goto accept;
}
else if (rc == MORE) {
goto more;
}
ssh_message_auth_set_methods(message, SSH_AUTH_METHOD_INTERACTIVE);
goto denied;
default:
ssh_message_auth_set_methods(message, SSH_AUTH_METHOD_INTERACTIVE);
goto denied;
}
default:
ssh_message_auth_set_methods(message, SSH_AUTH_METHOD_INTERACTIVE);
goto denied;
}
ssh_message_free(message);
accept:
if (sdata) {
if (sdata->extra_data) {
free(sdata->extra_data);
sdata->extra_data = NULL;
}
}
ssh_message_auth_reply_success (message, 0);
more:
return 0;
denied:
if (sdata) {
if (sdata->extra_data) {
free(sdata->extra_data);
sdata->extra_data = NULL;
}
}
return 1;
}
static void handle_kbdint_session_cb(ssh_event event,
ssh_session session,
struct server_state_st *state)
{
int n;
int rc = 0;
/* Structure for storing the pty size. */
struct winsize wsize = {
.ws_row = 0,
.ws_col = 0,
.ws_xpixel = 0,
.ws_ypixel = 0
};
/* Our struct holding information about the channel. */
struct channel_data_st cdata = {
.pid = 0,
.pty_master = -1,
.pty_slave = -1,
.child_stdin = -1,
.child_stdout = -1,
.child_stderr = -1,
.event = NULL,
.winsize = &wsize
};
/* Our struct holding information about the session. */
struct session_data_st sdata = {
.channel = NULL,
.auth_attempts = 0,
.authenticated = 0,
.username = TORTURE_SSH_USER_BOB,
.password = TORTURE_SSH_USER_BOB_PASSWORD
};
struct ssh_channel_callbacks_struct *channel_cb = NULL;
struct ssh_server_callbacks_struct *server_cb = NULL;
if (state == NULL) {
fprintf(stderr, "NULL server state provided\n");
goto end;
}
server_cb = get_default_server_cb();
if (server_cb == NULL) {
goto end;
}
server_cb->userdata = &sdata;
/* This is a macro, it does not return a value */
ssh_callbacks_init(server_cb);
rc = ssh_set_server_callbacks(session, server_cb);
if (rc) {
goto end;
}
#ifdef WITH_PCAP
set_pcap(&sdata, session, state->pcap_file);
#endif
rc = ssh_handle_key_exchange(session);
if (rc != SSH_OK) {
fprintf(stderr, "%s\n", ssh_get_error(session));
goto end;
}
/* Set the supported authentication methods */
ssh_set_auth_methods(session, SSH_AUTH_METHOD_INTERACTIVE);
ssh_set_message_callback(session, authenticate_callback, &sdata);
rc = ssh_event_add_session(event, session);
if (rc != 0) {
fprintf(stderr, "Error adding session to event\n");
goto end;
}
n = 0;
while (sdata.authenticated == 0 || sdata.channel == NULL) {
/* If the user has used up all attempts, or if he hasn't been able to
* authenticate in 10 seconds (n * 100ms), disconnect. */
if (sdata.auth_attempts >= state->max_tries || n >= 100) {
goto end;
}
if (ssh_event_dopoll(event, 100) == SSH_ERROR) {
fprintf(stderr, "do_poll error: %s\n", ssh_get_error(session));
goto end;
}
n++;
}
channel_cb = get_default_channel_cb();
if (channel_cb == NULL) {
goto end;
}
channel_cb->userdata = &cdata;
ssh_callbacks_init(channel_cb);
rc = ssh_set_channel_callbacks(sdata.channel, channel_cb);
if (rc != 0) {
goto end;
}
do {
/* Poll the main event which takes care of the session, the channel and
* even our child process's stdout/stderr (once it's started). */
rc = ssh_event_dopoll(event, -1);
if (rc == SSH_ERROR) {
ssh_channel_close(sdata.channel);
}
/* If child process's stdout/stderr has been registered with the event,
* or the child process hasn't started yet, continue. */
if (cdata.event != NULL || cdata.pid == 0) {
continue;
}
/* Executed only once, once the child process starts. */
cdata.event = event;
/* If stdout valid, add stdout to be monitored by the poll event. */
if (cdata.child_stdout != -1) {
if (ssh_event_add_fd(event, cdata.child_stdout, POLLIN, process_stdout,
sdata.channel) != SSH_OK) {
fprintf(stderr, "Failed to register stdout to poll context\n");
ssh_channel_close(sdata.channel);
}
}
/* If stderr valid, add stderr to be monitored by the poll event. */
if (cdata.child_stderr != -1){
if (ssh_event_add_fd(event, cdata.child_stderr, POLLIN, process_stderr,
sdata.channel) != SSH_OK) {
fprintf(stderr, "Failed to register stderr to poll context\n");
ssh_channel_close(sdata.channel);
}
}
} while(ssh_channel_is_open(sdata.channel) &&
(cdata.pid == 0 || waitpid(cdata.pid, &rc, WNOHANG) == 0));
close(cdata.pty_master);
close(cdata.child_stdin);
close(cdata.child_stdout);
close(cdata.child_stderr);
/* Remove the descriptors from the polling context, since they are now
* closed, they will always trigger during the poll calls. */
ssh_event_remove_fd(event, cdata.child_stdout);
ssh_event_remove_fd(event, cdata.child_stderr);
/* If the child process exited. */
if (kill(cdata.pid, 0) < 0 && WIFEXITED(rc)) {
rc = WEXITSTATUS(rc);
ssh_channel_request_send_exit_status(sdata.channel, rc);
/* If client terminated the channel or the process did not exit nicely,
* but only if something has been forked. */
} else if (cdata.pid > 0) {
kill(cdata.pid, SIGKILL);
}
ssh_channel_send_eof(sdata.channel);
ssh_channel_close(sdata.channel);
/* Wait up to 5 seconds for the client to terminate the session. */
for (n = 0; n < 50 && (ssh_get_status(session) & SESSION_END) == 0; n++) {
ssh_event_dopoll(event, 100);
}
end:
#ifdef WITH_PCAP
cleanup_pcap(&sdata);
#endif
if (channel_cb != NULL) {
free(channel_cb);
}
if (server_cb != NULL) {
free(server_cb);
}
return;
}
static int setup_kbdint_server(void **state)
{
struct torture_state *s;
struct server_state_st *ss;
struct test_server_st *tss;
char rsa_hostkey[1024] = {0};
char sshd_path[1024];
int rc;
char pid_str[1024];
pid_t pid;
assert_non_null(state);
tss = (struct test_server_st*)calloc(1, sizeof(struct test_server_st));
assert_non_null(tss);
torture_setup_socket_dir((void **)&s);
assert_non_null(s->socket_dir);
/* Set the default interface for the server */
setenv("SOCKET_WRAPPER_DEFAULT_IFACE", "10", 1);
setenv("PAM_WRAPPER", "1", 1);
snprintf(sshd_path,
sizeof(sshd_path),
"%s/sshd",
s->socket_dir);
rc = mkdir(sshd_path, 0755);
assert_return_code(rc, errno);
snprintf(rsa_hostkey,
sizeof(rsa_hostkey),
"%s/sshd/ssh_host_rsa_key",
s->socket_dir);
torture_write_file(rsa_hostkey,
torture_get_openssh_testkey(SSH_KEYTYPE_RSA, 0));
/* Create the server state */
ss = (struct server_state_st *)calloc(1, sizeof(struct server_state_st));
assert_non_null(ss);
ss->address = strdup("127.0.0.10");
assert_non_null(ss->address);
ss->port = 22;
ss->host_key = strdup(rsa_hostkey);
assert_non_null(rsa_hostkey);
ss->verbosity = torture_libssh_verbosity();
#ifdef WITH_PCAP
ss->with_pcap = 1;
ss->pcap_file = strdup(s->pcap_file);
assert_non_null(ss->pcap_file);
#endif
ss->max_tries = 3;
ss->error = 0;
/* Set the session handling function */
ss->handle_session = handle_kbdint_session_cb;
assert_non_null(ss->handle_session);
/* Start the server */
pid = fork_run_server(ss);
if (pid < 0) {
fail();
}
snprintf(pid_str, sizeof(pid_str), "%d", pid);
torture_write_file(s->srv_pidfile, (const char *)pid_str);
setenv("SOCKET_WRAPPER_DEFAULT_IFACE", "21", 1);
unsetenv("PAM_WRAPPER");
/* Wait 200ms */
usleep(200 * 1000);
tss->state = s;
tss->ss = ss;
*state = tss;
return 0;
}
static int teardown_kbdint_server(void **state)
{
struct torture_state *s;
struct server_state_st *ss;
struct test_server_st *tss;
tss = *state;
assert_non_null(tss);
s = tss->state;
assert_non_null(s);
ss = tss->ss;
assert_non_null(ss);
/* This function can be reused */
torture_teardown_sshd_server((void **)&s);
free_server_state(tss->ss);
SAFE_FREE(tss->ss);
SAFE_FREE(tss);
return 0;
}
static int session_setup(void **state)
{
struct test_server_st *tss = *state;
struct torture_state *s;
int verbosity = torture_libssh_verbosity();
struct passwd *pwd;
bool b = false;
int rc;
assert_non_null(tss);
s = tss->state;
assert_non_null(s);
pwd = getpwnam("bob");
assert_non_null(pwd);
rc = setuid(pwd->pw_uid);
assert_return_code(rc, errno);
s->ssh.session = ssh_new();
assert_non_null(s->ssh.session);
rc = ssh_options_set(s->ssh.session, SSH_OPTIONS_LOG_VERBOSITY, &verbosity);
assert_ssh_return_code(s->ssh.session, rc);
rc = ssh_options_set(s->ssh.session, SSH_OPTIONS_HOST, TORTURE_SSH_SERVER);
assert_ssh_return_code(s->ssh.session, rc);
/* Make sure no other configuration options from system will get used */
rc = ssh_options_set(s->ssh.session, SSH_OPTIONS_PROCESS_CONFIG, &b);
assert_ssh_return_code(s->ssh.session, rc);
return 0;
}
static int session_teardown(void **state)
{
struct test_server_st *tss = *state;
struct torture_state *s;
assert_non_null(tss);
s = tss->state;
assert_non_null(s);
ssh_disconnect(s->ssh.session);
ssh_free(s->ssh.session);
return 0;
}
static void torture_server_auth_kbdint(void **state)
{
struct test_server_st *tss = *state;
struct torture_state *s;
ssh_session session;
int rc;
assert_non_null(tss);
s = tss->state;
assert_non_null(s);
session = s->ssh.session;
assert_non_null(session);
rc = ssh_options_set(session, SSH_OPTIONS_USER, TORTURE_SSH_USER_BOB);
assert_ssh_return_code(session, rc);
rc = ssh_connect(session);
assert_ssh_return_code(session, rc);
rc = ssh_userauth_none(session,NULL);
/* This request should return a SSH_REQUEST_DENIED error */
if (rc == SSH_ERROR) {
assert_int_equal(ssh_get_error_code(session), SSH_REQUEST_DENIED);
}
rc = ssh_userauth_list(session, NULL);
assert_true(rc & SSH_AUTH_METHOD_INTERACTIVE);
rc = ssh_userauth_kbdint(session, NULL, NULL);
assert_int_equal(rc, SSH_AUTH_INFO);
assert_int_equal(ssh_userauth_kbdint_getnprompts(session), 2);
/* Reply the first 2 prompts using the username and password */
rc = ssh_userauth_kbdint_setanswer(session, 0,
TORTURE_SSH_USER_BOB);
assert_false(rc < 0);
rc = ssh_userauth_kbdint_setanswer(session, 1,
TORTURE_SSH_USER_BOB_PASSWORD);
assert_false(rc < 0);
/* Resend the password */
rc = ssh_userauth_kbdint(session, NULL, NULL);
assert_int_equal(rc, SSH_AUTH_INFO);
assert_int_equal(ssh_userauth_kbdint_getnprompts(session), 1);
rc = ssh_userauth_kbdint_setanswer(session, 0,
TORTURE_SSH_USER_BOB_PASSWORD);
assert_false(rc < 0);
rc = ssh_userauth_kbdint(session, NULL, NULL);
/* Sometimes, SSH server send an empty query at the end of exchange */
if(rc == SSH_AUTH_INFO) {
assert_int_equal(ssh_userauth_kbdint_getnprompts(session), 0);
rc = ssh_userauth_kbdint(session, NULL, NULL);
}
assert_int_equal(rc, SSH_AUTH_SUCCESS);
}
int torture_run_tests(void)
{
int rc;
struct CMUnitTest tests[] = {
cmocka_unit_test_setup_teardown(torture_server_auth_kbdint,
session_setup,
session_teardown),
};
ssh_init();
torture_filter_tests(tests);
rc = cmocka_run_group_tests(tests,
setup_kbdint_server,
teardown_kbdint_server);
ssh_finalize();
return rc;
}