Skip to content

Commit 66be47a

Browse files
ejohnstownejohnstown
authored
Merge pull request #453 from JacobBarthelmeh/sshd-certs
adding X509 authentication of host
2 parents c6df8f6 + af3658c commit 66be47a

File tree

10 files changed

+1609
-779
lines changed

10 files changed

+1609
-779
lines changed

‎apps/wolfsshd/auth.c‎

Lines changed: 251 additions & 130 deletions
Large diffs are not rendered by default.

‎apps/wolfsshd/auth.h‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@ USER_NODE* AddNewUser(USER_NODE* list, byte type, const byte* username,
3030

3131
void SetAuthKeysPattern(const char* pattern);
3232
int DefaultUserAuth(byte authType, WS_UserAuthData* authData, void* ctx);
33+
int DefaultUserAuthTypes(WOLFSSH* ssh, void* ctx);
3334

3435
typedef struct WOLFSSHD_AUTH WOLFSSHD_AUTH;
3536

@@ -51,8 +52,9 @@ typedef int (*CallbackCheckPassword)(const char* usr, const byte* psw,
5152
* Returns WSSHD_AUTH_SUCCESS if public key ok, WSSHD_AUTH_FAILURE if key not
5253
* ok, and negative values if an error occurs during checking.
5354
*/
54-
typedef int (*CallbackCheckPublicKey)(const char* usr, const byte* key,
55-
word32 keySz);
55+
typedef int (*CallbackCheckPublicKey)(const char* usr,
56+
const WS_UserAuthData_PublicKey* pubKey,
57+
const char* usrCaKeysFile);
5658

5759
WOLFSSHD_AUTH* wolfSSHD_AuthCreateUser(void* heap, const WOLFSSHD_CONFIG* conf);
5860
int wolfSSHD_AuthFreeUser(WOLFSSHD_AUTH* auth);

‎apps/wolfsshd/configuration.c‎

Lines changed: 106 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,8 @@ struct WOLFSSHD_CONFIG {
5757
char* chrootDir;
5858
char* ciphers;
5959
char* hostKeyFile;
60+
char* hostCertFile;
61+
char* userCAKeysFile;
6062
char* hostKeyAlgos;
6163
char* kekAlgos;
6264
char* listenAddress;
@@ -70,6 +72,7 @@ struct WOLFSSHD_CONFIG {
7072
byte pubKeyAuth:1;
7173
byte permitRootLogin:1;
7274
byte permitEmptyPasswords:1;
75+
byte authKeysFileSet:1; /* if not set then no explicit authorized keys */
7376
};
7477

7578
int CountWhitespace(const char* in, int inSz, byte inv);
@@ -290,6 +293,7 @@ void wolfSSHD_ConfigFree(WOLFSSHD_CONFIG* conf)
290293
FreeString(&current->listenAddress, heap);
291294
FreeString(&current->authKeysFile, heap);
292295
FreeString(&current->hostKeyFile, heap);
296+
FreeString(&current->hostCertFile, heap);
293297

294298
WFREE(current, heap, DYNTYPE_SSHD);
295299
current = next;
@@ -324,9 +328,11 @@ enum {
324328
OPT_CHROOT_DIR = 17,
325329
OPT_MATCH = 18,
326330
OPT_FORCE_CMD = 19,
331+
OPT_HOST_CERT = 20,
332+
OPT_TRUSTED_USER_CA_KEYS = 21,
327333
};
328334
enum {
329-
NUM_OPTIONS = 20
335+
NUM_OPTIONS = 22
330336
};
331337

332338
static const CONFIG_OPTION options[NUM_OPTIONS] = {
@@ -350,6 +356,8 @@ static const CONFIG_OPTION options[NUM_OPTIONS] = {
350356
{OPT_CHROOT_DIR, "ChrootDirectory"},
351357
{OPT_MATCH, "Match"},
352358
{OPT_FORCE_CMD, "ForceCommand"},
359+
{OPT_HOST_CERT, "HostCertificate"},
360+
{OPT_TRUSTED_USER_CA_KEYS, "TrustedUserCAKeys"},
353361
};
354362

355363
/* returns WS_SUCCESS on success */
@@ -471,6 +479,7 @@ static int HandlePwAuth(WOLFSSHD_CONFIG* conf, const char* value)
471479

472480
if (ret == WS_SUCCESS) {
473481
if (WSTRCMP(value, "no") == 0) {
482+
wolfSSH_Log(WS_LOG_INFO, "[SSHD] password authentication disabled");
474483
conf->passwordAuth = 0;
475484
}
476485
else if (WSTRCMP(value, "yes") == 0) {
@@ -912,6 +921,7 @@ static int HandleConfigOption(WOLFSSHD_CONFIG** conf, int opt,
912921

913922
switch (opt) {
914923
case OPT_AUTH_KEYS_FILE:
924+
(*conf)->authKeysFileSet = 1;
915925
ret = wolfSSHD_ConfigSetAuthKeysFile(*conf, value);
916926
break;
917927
case OPT_PRIV_SEP:
@@ -955,6 +965,10 @@ static int HandleConfigOption(WOLFSSHD_CONFIG** conf, int opt,
955965
/* TODO: Add logic to check if file exists? */
956966
ret = wolfSSHD_ConfigSetHostKeyFile(*conf, value);
957967
break;
968+
case OPT_HOST_CERT:
969+
/* TODO: Add logic to check if file exists? */
970+
ret = wolfSSHD_ConfigSetHostCertFile(*conf, value);
971+
break;
958972
case OPT_PASSWORD_AUTH:
959973
ret = HandlePwAuth(*conf, value);
960974
break;
@@ -981,6 +995,10 @@ static int HandleConfigOption(WOLFSSHD_CONFIG** conf, int opt,
981995
case OPT_FORCE_CMD:
982996
ret = HandleForcedCommand(*conf, full, fullSz);
983997
break;
998+
case OPT_TRUSTED_USER_CA_KEYS:
999+
/* TODO: Add logic to check if file exists? */
1000+
ret = wolfSSHD_ConfigSetUserCAKeysFile(*conf, value);
1001+
break;
9841002
default:
9851003
break;
9861004
}
@@ -1178,6 +1196,19 @@ char* wolfSSHD_ConfigGetAuthKeysFile(const WOLFSSHD_CONFIG* conf)
11781196
return ret;
11791197
}
11801198

1199+
1200+
/* returns 1 if the authorized keys file was set and 0 if not */
1201+
int wolfSSHD_ConfigGetAuthKeysFileSet(const WOLFSSHD_CONFIG* conf)
1202+
{
1203+
int ret = 0;
1204+
1205+
if (conf != NULL) {
1206+
ret = conf->authKeysFileSet;
1207+
}
1208+
1209+
return ret;
1210+
}
1211+
11811212
int wolfSSHD_ConfigSetAuthKeysFile(WOLFSSHD_CONFIG* conf, const char* file)
11821213
{
11831214
int ret = WS_SUCCESS;
@@ -1234,29 +1265,95 @@ char* wolfSSHD_ConfigGetHostKeyFile(const WOLFSSHD_CONFIG* conf)
12341265
return ret;
12351266
}
12361267

1237-
int wolfSSHD_ConfigSetHostKeyFile(WOLFSSHD_CONFIG* conf, const char* file)
1268+
char* wolfSSHD_ConfigGetHostCertFile(const WOLFSSHD_CONFIG* conf)
1269+
{
1270+
char* ret = NULL;
1271+
1272+
if (conf != NULL) {
1273+
ret = conf->hostCertFile;
1274+
}
1275+
1276+
return ret;
1277+
}
1278+
1279+
char* wolfSSHD_ConfigGetUserCAKeysFile(const WOLFSSHD_CONFIG* conf)
1280+
{
1281+
char* ret = NULL;
1282+
1283+
if (conf != NULL) {
1284+
ret = conf->userCAKeysFile;
1285+
}
1286+
1287+
return ret;
1288+
}
1289+
1290+
static int SetFileString(char** dst, const char* src, void* heap)
12381291
{
12391292
int ret = WS_SUCCESS;
12401293

1241-
if (conf == NULL) {
1294+
if (dst == NULL) {
12421295
ret = WS_BAD_ARGUMENT;
12431296
}
12441297

12451298
if (ret == WS_SUCCESS) {
1246-
if (conf->hostKeyFile != NULL) {
1247-
FreeString(&conf->hostKeyFile, conf->heap);
1248-
conf->hostKeyFile = NULL;
1299+
if (*dst != NULL) {
1300+
FreeString(dst, heap);
1301+
*dst = NULL;
12491302
}
12501303

1251-
if (file != NULL) {
1252-
ret = CreateString(&conf->hostKeyFile, file,
1253-
(int)WSTRLEN(file), conf->heap);
1304+
if (src != NULL) {
1305+
ret = CreateString(dst, src, (int)WSTRLEN(src), heap);
12541306
}
12551307
}
12561308

12571309
return ret;
12581310
}
12591311

1312+
int wolfSSHD_ConfigSetHostKeyFile(WOLFSSHD_CONFIG* conf, const char* file)
1313+
{
1314+
int ret = WS_SUCCESS;
1315+
1316+
if (conf == NULL) {
1317+
ret = WS_BAD_ARGUMENT;
1318+
}
1319+
1320+
if (ret == WS_SUCCESS) {
1321+
ret = SetFileString(&conf->hostKeyFile, file, conf->heap);
1322+
}
1323+
1324+
return ret;
1325+
}
1326+
1327+
int wolfSSHD_ConfigSetHostCertFile(WOLFSSHD_CONFIG* conf, const char* file)
1328+
{
1329+
int ret = WS_SUCCESS;
1330+
1331+
if (conf == NULL) {
1332+
ret = WS_BAD_ARGUMENT;
1333+
}
1334+
1335+
if (ret == WS_SUCCESS) {
1336+
ret = SetFileString(&conf->hostCertFile, file, conf->heap);
1337+
}
1338+
1339+
return ret;
1340+
}
1341+
1342+
int wolfSSHD_ConfigSetUserCAKeysFile(WOLFSSHD_CONFIG* conf, const char* file)
1343+
{
1344+
int ret = WS_SUCCESS;
1345+
1346+
if (conf == NULL) {
1347+
ret = WS_BAD_ARGUMENT;
1348+
}
1349+
1350+
if (ret == WS_SUCCESS) {
1351+
ret = SetFileString(&conf->userCAKeysFile, file, conf->heap);
1352+
}
1353+
1354+
return ret;
1355+
}
1356+
12601357
word16 wolfSSHD_ConfigGetPort(const WOLFSSHD_CONFIG* conf)
12611358
{
12621359
word16 ret = 0;

‎apps/wolfsshd/configuration.h‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,9 +38,14 @@ char* wolfSSHD_ConfigGetForcedCmd(const WOLFSSHD_CONFIG* conf);
3838
char* wolfSSHD_ConfigGetBanner(const WOLFSSHD_CONFIG* conf);
3939
char* wolfSSHD_ConfigGetChroot(const WOLFSSHD_CONFIG* conf);
4040
char* wolfSSHD_ConfigGetHostKeyFile(const WOLFSSHD_CONFIG* conf);
41+
char* wolfSSHD_ConfigGetHostCertFile(const WOLFSSHD_CONFIG* conf);
42+
char* wolfSSHD_ConfigGetUserCAKeysFile(const WOLFSSHD_CONFIG* conf);
4143
int wolfSSHD_ConfigSetHostKeyFile(WOLFSSHD_CONFIG* conf, const char* file);
44+
int wolfSSHD_ConfigSetHostCertFile(WOLFSSHD_CONFIG* conf, const char* file);
45+
int wolfSSHD_ConfigSetUserCAKeysFile(WOLFSSHD_CONFIG* conf, const char* file);
4246
word16 wolfSSHD_ConfigGetPort(const WOLFSSHD_CONFIG* conf);
4347
char* wolfSSHD_ConfigGetAuthKeysFile(const WOLFSSHD_CONFIG* conf);
48+
int wolfSSHD_ConfigGetAuthKeysFileSet(const WOLFSSHD_CONFIG* conf);
4449
int wolfSSHD_ConfigSetAuthKeysFile(WOLFSSHD_CONFIG* conf, const char* file);
4550
byte wolfSSHD_ConfigGetPermitEmptyPw(const WOLFSSHD_CONFIG* conf);
4651
byte wolfSSHD_ConfigGetPermitRoot(const WOLFSSHD_CONFIG* conf);

0 commit comments

Comments
 (0)