Skip to content

Commit 7580216

Browse files
bingbing8bingbing8
committed
Source snapshot from Powershell/openssh-portable:latestw_all
1 parent 944505e commit 7580216

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

49 files changed

+1514
-1308
lines changed

‎appveyor.yml

Lines changed: 10 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,39 @@
1-
version: 0.0.16.0.{build}
1+
version: 0.0.17.0.{build}
22
image: Visual Studio 2015
33

44
branches:
55
only:
66
- latestw_all
7-
- latestw_all_openssl
87

98
init:
109
- ps: iex ((new-object net.webclient).DownloadString('https://raw.githubusercontent.com/appveyor/ci/master/scripts/enable-rdp.ps1'))
1110

1211
build_script:
1312
- ps: |
14-
Import-Module $env:APPVEYOR_BUILD_FOLDER\contrib\win32\openssh\AppveyorHelper.psm1 -DisableNameChecking
13+
Import-Module $env:APPVEYOR_BUILD_FOLDER\contrib\win32\openssh\AppveyorHelper.psm1
1514
Invoke-AppVeyorBuild
1615
1716
after_build:
1817
- ps: |
19-
Import-Module $env:APPVEYOR_BUILD_FOLDER\contrib\win32\openssh\AppveyorHelper.psm1 -DisableNameChecking
18+
Import-Module $env:APPVEYOR_BUILD_FOLDER\contrib\win32\openssh\AppveyorHelper.psm1
2019
Install-OpenSSH
2120
2221
before_test:
2322
- ps: |
24-
Import-Module $env:APPVEYOR_BUILD_FOLDER\contrib\win32\openssh\AppveyorHelper.psm1 -DisableNameChecking
25-
Setup-OpenSSHTestEnvironment -Quiet
23+
Import-Module $env:APPVEYOR_BUILD_FOLDER\contrib\win32\openssh\AppveyorHelper.psm1
24+
Set-OpenSSHTestEnvironment -Confirm:$false
2625
2726
test_script:
2827
- ps: |
29-
Import-Module $env:APPVEYOR_BUILD_FOLDER\contrib\win32\openssh\AppveyorHelper.psm1 -DisableNameChecking
30-
Run-OpenSSHTests
28+
Import-Module $env:APPVEYOR_BUILD_FOLDER\contrib\win32\openssh\AppveyorHelper.psm1
29+
Invoke-OpenSSHTests
3130
3231
after_test:
3332
- ps: |
34-
Import-Module $env:APPVEYOR_BUILD_FOLDER\contrib\win32\openssh\AppveyorHelper.psm1 -DisableNameChecking
35-
Upload-OpenSSHTestResults
33+
Import-Module $env:APPVEYOR_BUILD_FOLDER\contrib\win32\openssh\AppveyorHelper.psm1
34+
Publish-OpenSSHTestResults
3635
3736
on_finish:
3837
- ps: |
39-
Import-Module $env:APPVEYOR_BUILD_FOLDER\contrib\win32\openssh\AppveyorHelper.psm1 -DisableNameChecking
38+
Import-Module $env:APPVEYOR_BUILD_FOLDER\contrib\win32\openssh\AppveyorHelper.psm1
4039
Publish-Artifact

‎auth-passwd.c

Lines changed: 29 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -226,38 +226,45 @@ sys_auth_passwd(Authctxt *authctxt, const char *password)
226226

227227
#elif defined(WINDOWS)
228228
/*
229-
* Authenticate on Windows - Pass credentials to ssh-agent and retrieve token
230-
* upon successful authentication
231-
* TODO - password is sent in plain text over IPC. Consider implications.
229+
* Authenticate on Windows - Call LogonUser and retrieve user token
232230
*/
233231
int sys_auth_passwd(Authctxt *authctxt, const char *password)
234232
{
235-
struct sshbuf *msg = NULL;
236-
size_t blen = 0;
237-
DWORD token = 0;
238-
extern int auth_sock;
233+
wchar_t *user_utf16 = NULL, *udom_utf16 = NULL, *pwd_utf16 = NULL, *tmp;
234+
HANDLE token = NULL;
239235
int r = 0;
240-
int ssh_request_reply(int, struct sshbuf *, struct sshbuf *);
241236

242-
msg = sshbuf_new();
243-
if (!msg)
244-
fatal("%s: out of memory", __func__);
237+
if ((user_utf16 = utf8_to_utf16(authctxt->pw->pw_name)) == NULL ||
238+
(pwd_utf16 = utf8_to_utf16(password)) == NULL) {
239+
fatal("out of memory");
240+
goto done;
241+
}
245242

246-
if (sshbuf_put_u8(msg, SSH_AGENT_AUTHENTICATE) != 0 ||
247-
sshbuf_put_cstring(msg, PASSWD_AUTH_REQUEST) != 0 ||
248-
sshbuf_put_cstring(msg, authctxt->pw->pw_name) != 0 ||
249-
sshbuf_put_cstring(msg, password) != 0 ||
250-
ssh_request_reply(auth_sock, msg, msg) != 0 ||
251-
sshbuf_get_u32(msg, &token) != 0) {
252-
debug("auth agent did not authorize client %s", authctxt->user);
253-
r = 0;
243+
if ((tmp = wcschr(user_utf16, L'@')) != NULL) {
244+
udom_utf16 = tmp + 1;
245+
*tmp = L'\0';
246+
}
247+
248+
if (LogonUserW(user_utf16, udom_utf16, pwd_utf16, LOGON32_LOGON_NETWORK_CLEARTEXT,
249+
LOGON32_PROVIDER_DEFAULT, &token) == FALSE) {
250+
if (GetLastError() == ERROR_PASSWORD_MUST_CHANGE)
251+
/*
252+
* TODO - need to add support to force password change
253+
* by sending back SSH_MSG_USERAUTH_PASSWD_CHANGEREQ
254+
*/
255+
error("password for user %s has expired", authctxt->pw->pw_name);
256+
else
257+
debug("failed to logon user: %ls domain: %ls error:%d", user_utf16, udom_utf16, GetLastError());
254258
goto done;
255259
}
256-
authctxt->methoddata = (void*)(INT_PTR)token;
260+
261+
authctxt->auth_token = (void*)(INT_PTR)token;
257262
r = 1;
258263
done:
259-
if (msg)
260-
sshbuf_free(msg);
264+
if (user_utf16)
265+
free(user_utf16);
266+
if (pwd_utf16)
267+
SecureZeroMemory(pwd_utf16, sizeof(wchar_t) * wcslen(pwd_utf16));
261268
return r;
262269
}
263270
#endif /* WINDOWS */

‎auth.c

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -405,6 +405,13 @@ expand_authorized_keys(const char *filename, struct passwd *pw)
405405
file = percent_expand(filename, "h", pw->pw_dir,
406406
"u", pw->pw_name, (char *)NULL);
407407

408+
#ifdef WINDOWS
409+
/* Return if the path is absolute. If not, prepend the '%h\\' */
410+
if ((strlen(file) > 1) && (file[1] == ':'))
411+
return (file);
412+
413+
i = snprintf(ret, sizeof(ret), "%s\\%s", pw->pw_dir, file);
414+
#else
408415
/*
409416
* Ensure that filename starts anchored. If not, be backward
410417
* compatible and prepend the '%h/'
@@ -413,6 +420,8 @@ expand_authorized_keys(const char *filename, struct passwd *pw)
413420
return (file);
414421

415422
i = snprintf(ret, sizeof(ret), "%s/%s", pw->pw_dir, file);
423+
#endif // WINDOWS
424+
416425
if (i < 0 || (size_t)i >= sizeof(ret))
417426
fatal("expand_authorized_keys: path too long");
418427
free(file);

‎auth.h

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,9 @@ struct Authctxt {
7878
#endif
7979
Buffer *loginmsg;
8080
void *methoddata;
81-
81+
#ifdef WINDOWS
82+
void *auth_token;
83+
#endif
8284
struct sshkey **prev_userkeys;
8385
u_int nprev_userkeys;
8486
};

‎auth2-pubkey.c

Lines changed: 5 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -200,62 +200,21 @@ userauth_pubkey(struct ssh *ssh)
200200
/* test for correct signature */
201201
authenticated = 0;
202202

203-
#ifdef WINDOWS
204-
/* Pass key challenge material to ssh-agent to retrieve token upon successful authentication */
205-
{
206-
struct sshbuf *msg = NULL;
207-
u_char *blob = NULL;
208-
size_t blen = 0;
209-
DWORD token = 0;
210-
extern int auth_sock;
211-
int r = 0;
212-
int ssh_request_reply(int , struct sshbuf *, struct sshbuf *);
213-
214-
while (1) {
215-
msg = sshbuf_new();
216-
if (!msg)
217-
fatal("%s: out of memory", __func__);
218-
if ((r = sshbuf_put_u8(msg, SSH_AGENT_AUTHENTICATE)) != 0 ||
219-
(r = sshbuf_put_cstring(msg, PUBKEY_AUTH_REQUEST)) != 0 ||
220-
(r = sshkey_to_blob(key, &blob, &blen)) != 0 ||
221-
(r = sshbuf_put_string(msg, blob, blen)) != 0 ||
222-
(r = sshbuf_put_cstring(msg, authctxt->pw->pw_name)) != 0 ||
223-
(r = sshbuf_put_string(msg, sig, slen)) != 0 ||
224-
(r = sshbuf_put_string(msg, sshbuf_ptr(b), sshbuf_len(b))) != 0 ||
225-
(r = ssh_request_reply(auth_sock, msg, msg)) != 0 ||
226-
(r = sshbuf_get_u32(msg, &token)) != 0) {
227-
debug("auth agent did not authorize client %s", authctxt->user);
228-
break;
229-
}
230-
231-
debug3("auth agent authenticated %s", authctxt->user);
232-
break;
233-
234-
}
235-
if (blob)
236-
free(blob);
237-
if (msg)
238-
sshbuf_free(msg);
239-
240-
if (token) {
241-
authenticated = 1;
242-
authctxt->methoddata = (void*)(INT_PTR)token;
243-
}
244-
245-
}
246-
247-
#else /* !WINDOWS */
248203
if (PRIVSEP(user_key_allowed(authctxt->pw, key, 1)) &&
204+
#ifdef WINDOWS
205+
(authctxt->auth_token = mm_auth_pubkey(authctxt->pw->pw_name,
206+
key, sig, slen, b)) != NULL) {
207+
#else
249208
PRIVSEP(sshkey_verify(key, sig, slen, sshbuf_ptr(b),
250209
sshbuf_len(b), ssh->compat)) == 0) {
210+
#endif
251211
authenticated = 1;
252212
/* Record the successful key to prevent reuse */
253213
auth2_record_userkey(authctxt, key);
254214
key = NULL; /* Don't free below */
255215
}
256216
sshbuf_free(b);
257217
free(sig);
258-
#endif /* !WINDOWS */
259218

260219
} else {
261220
debug("%s: test whether pkalg/pkblob are acceptable for %s %s",

‎authfd.h

Lines changed: 1 addition & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,7 @@ int ssh_agent_sign(int sock, struct sshkey *key,
4343
const u_char *data, size_t datalen, const char *alg, u_int compat);
4444

4545
/* Messages for the authentication agent connection. */
46+
/* Message Id 0 is reserved */
4647
#define SSH_AGENTC_REQUEST_RSA_IDENTITIES 1
4748
#define SSH_AGENT_RSA_IDENTITIES_ANSWER 2
4849
#define SSH_AGENTC_RSA_CHALLENGE 3
@@ -88,12 +89,4 @@ int ssh_agent_sign(int sock, struct sshkey *key,
8889
#define SSH_AGENT_RSA_SHA2_256 0x02
8990
#define SSH_AGENT_RSA_SHA2_512 0x04
9091

91-
/*
92-
* Following are used in Windows implementation
93-
* ssh-agent in Windows also serves user authentication
94-
*/
95-
#define SSH_AGENT_AUTHENTICATE 200
96-
#define PUBKEY_AUTH_REQUEST "pubkey"
97-
#define PASSWD_AUTH_REQUEST "password"
98-
9992
#endif /* AUTHFD_H */

0 commit comments

Comments
 (0)