|
 |
9070b3 |
diff -up openssh/pam_ssh_agent_auth-0.10.3/identity.h.psaa-agent openssh/pam_ssh_agent_auth-0.10.3/identity.h
|
|
|
9070b3 |
--- openssh/pam_ssh_agent_auth-0.10.3/identity.h.psaa-agent 2016-11-13 04:24:32.000000000 +0100
|
|
|
9070b3 |
+++ openssh/pam_ssh_agent_auth-0.10.3/identity.h 2017-09-27 14:25:49.421739027 +0200
|
|
|
9070b3 |
@@ -38,6 +38,12 @@
|
|
|
9070b3 |
typedef struct identity Identity;
|
|
|
9070b3 |
typedef struct idlist Idlist;
|
|
|
9070b3 |
|
|
|
9070b3 |
+typedef struct {
|
|
|
9070b3 |
+ int fd;
|
|
|
9070b3 |
+ struct sshbuf *identities;
|
|
|
9070b3 |
+ int howmany;
|
|
|
9070b3 |
+} AuthenticationConnection;
|
|
|
9070b3 |
+
|
|
|
9070b3 |
struct identity {
|
|
|
9070b3 |
TAILQ_ENTRY(identity) next;
|
|
|
9070b3 |
AuthenticationConnection *ac; /* set if agent supports key */
|
|
|
9070b3 |
diff -up openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-agent openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c
|
|
|
9070b3 |
--- openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c.psaa-agent 2017-09-27 14:25:49.420739021 +0200
|
|
|
9070b3 |
+++ openssh/pam_ssh_agent_auth-0.10.3/iterate_ssh_agent_keys.c 2017-09-27 14:25:49.421739027 +0200
|
|
|
9070b3 |
@@ -39,6 +39,7 @@
|
|
|
9070b3 |
#include "sshbuf.h"
|
|
|
9070b3 |
#include "sshkey.h"
|
|
|
9070b3 |
#include "authfd.h"
|
|
|
9070b3 |
+#include "ssherr.h"
|
|
|
9070b3 |
#include <stdio.h>
|
|
|
9070b3 |
#include <openssl/evp.h>
|
|
|
9070b3 |
#include "ssh2.h"
|
|
|
9070b3 |
@@ -291,36 +292,43 @@ pamsshagentauth_find_authorized_keys(con
|
|
|
9070b3 |
{
|
|
|
9070b3 |
struct sshbuf *session_id2 = NULL;
|
|
|
9070b3 |
Identity *id;
|
|
|
9070b3 |
- struct sshkey *key;
|
|
|
9070b3 |
AuthenticationConnection *ac;
|
|
|
9070b3 |
- char *comment;
|
|
|
9070b3 |
uint8_t retval = 0;
|
|
|
9070b3 |
uid_t uid = getpwnam(ruser)->pw_uid;
|
|
|
9070b3 |
+ struct ssh_identitylist *idlist;
|
|
|
9070b3 |
+ int r;
|
|
|
9070b3 |
+ unsigned int i;
|
|
|
9070b3 |
|
|
|
9070b3 |
OpenSSL_add_all_digests();
|
|
|
9070b3 |
pamsshagentauth_session_id2_gen(&session_id2, user, ruser, servicename);
|
|
|
9070b3 |
|
|
|
9070b3 |
if ((ac = ssh_get_authentication_connection_for_uid(uid))) {
|
|
|
9070b3 |
verbose("Contacted ssh-agent of user %s (%u)", ruser, uid);
|
|
|
9070b3 |
- for (key = ssh_get_first_identity(ac, &comment, 2); key != NULL; key = ssh_get_next_identity(ac, &comment, 2))
|
|
|
9070b3 |
- {
|
|
|
9070b3 |
- if(key != NULL) {
|
|
|
9070b3 |
+ if ((r = ssh_fetch_identitylist(ac->fd, &idlist)) != 0) {
|
|
|
9070b3 |
+ if (r != SSH_ERR_AGENT_NO_IDENTITIES)
|
|
|
9070b3 |
+ fprintf(stderr, "error fetching identities for "
|
|
|
9070b3 |
+ "protocol %d: %s\n", 2, ssh_err(r));
|
|
|
9070b3 |
+ } else {
|
|
|
9070b3 |
+ for (i = 0; i < idlist->nkeys; i++)
|
|
|
9070b3 |
+ {
|
|
|
9070b3 |
+ if (idlist->keys[i] != NULL) {
|
|
|
9070b3 |
id = xcalloc(1, sizeof(*id));
|
|
|
9070b3 |
- id->key = key;
|
|
|
9070b3 |
- id->filename = comment;
|
|
|
9070b3 |
+ id->key = idlist->keys[i];
|
|
|
9070b3 |
+ id->filename = idlist->comments[i];
|
|
|
9070b3 |
id->ac = ac;
|
|
|
9070b3 |
if(userauth_pubkey_from_id(ruser, id, session_id2)) {
|
|
|
9070b3 |
retval = 1;
|
|
|
9070b3 |
}
|
|
|
9070b3 |
- free(id->filename);
|
|
|
9070b3 |
- key_free(id->key);
|
|
|
9070b3 |
free(id);
|
|
|
9070b3 |
if(retval == 1)
|
|
|
9070b3 |
break;
|
|
|
9070b3 |
- }
|
|
|
9070b3 |
- }
|
|
|
9070b3 |
+ }
|
|
|
9070b3 |
+ }
|
|
|
9070b3 |
- sshbuf_free(session_id2);
|
|
|
9070b3 |
- ssh_close_authentication_connection(ac);
|
|
|
9070b3 |
+ sshbuf_free(session_id2);
|
|
|
9070b3 |
+ ssh_free_identitylist(idlist);
|
|
|
9070b3 |
+ }
|
|
|
9070b3 |
+ ssh_close_authentication_socket(ac->fd);
|
|
|
9070b3 |
+ free(ac);
|
|
|
9070b3 |
}
|
|
|
9070b3 |
else {
|
|
|
9070b3 |
verbose("No ssh-agent could be contacted");
|
|
|
9070b3 |
diff -up openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c.psaa-agent openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c
|
|
|
9070b3 |
--- openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c.psaa-agent 2017-09-27 14:25:49.420739021 +0200
|
|
|
9070b3 |
+++ openssh/pam_ssh_agent_auth-0.10.3/userauth_pubkey_from_id.c 2017-09-27 14:25:49.422739032 +0200
|
|
|
9070b3 |
@@ -84,7 +85,7 @@ userauth_pubkey_from_id(const char *ruse
|
|
|
9070b3 |
(r = sshbuf_put_string(b, pkblob, blen)) != 0)
|
|
|
9070b3 |
fatal("%s: buffer error: %s", __func__, ssh_err(r));
|
|
|
9070b3 |
|
|
|
9070b3 |
- if (ssh_agent_sign(id->ac, id->key, &sig, &slen, sshbuf_ptr(b), sshbuf_len(b)) != 0)
|
|
|
9070b3 |
+ if (ssh_agent_sign(id->ac->fd, id->key, &sig, &slen, sshbuf_ptr(b), sshbuf_len(b), NULL, 0) != 0)
|
|
|
9070b3 |
goto user_auth_clean_exit;
|
|
|
9070b3 |
|
|
|
9070b3 |
/* test for correct signature */
|