Initial commit

1 files changed, 378 insertions, 0 deletions

diff --git a/ssh-agent-filter.C b/ssh-agent-filter.C
new file mode 100644
index 0000000..5aa086b
--- /dev/null
+++ b/ssh-agent-filter.C
@@ -0,0 +1,378 @@
+/*
+ * ssh-agent-filter.C -- filtering proxy for ssh-agent meant to be forwarded to untrusted servers
+ *
+ * Copyright (C) 2013 Timo Weingärtner <timo@tiwe.de>
+ *
+ * This file is part of ssh-agent-filter.
+ *
+ * ssh-agent-filter is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * ssh-agent-filter is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with ssh-agent-filter.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include <boost/program_options.hpp>
+namespace po = boost::program_options;
+
+#include <boost/filesystem.hpp>
+namespace fs = boost::filesystem;
+
+#include <string>
+#include <vector>
+#include <set>
+#include <iostream>
+#include <sstream>
+#include <stdexcept>
+#include <thread>
+#include <ext/stdio_filebuf.h>
+
+#include <csignal>
+#include <cstdlib>
+#include <fcntl.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+#include <sysexits.h>
+#include <nettle/md5.h>
+#include <nettle/base64.h>
+#include <nettle/base16.h>
+
+#include "rfc4251.h"
+#include "ssh-agent.h"
+#include "version.h"
+
+
+std::vector<std::string> allowed_b64;
+std::vector<std::string> allowed_md5;
+std::vector<std::string> allowed_comment;
+std::set<rfc4251string> allowed_pubkeys;
+bool debug{false};
+fs::path path;
+
+
+std::string md5_hex (std::string const & s) {
+	struct md5_ctx ctx;
+	md5_init(&ctx);
+	md5_update(&ctx, s.size(), reinterpret_cast<uint8_t const *>(s.data()));
+	uint8_t bin[MD5_DIGEST_SIZE];
+	md5_digest(&ctx, MD5_DIGEST_SIZE, bin);
+	uint8_t hex[BASE16_ENCODE_LENGTH(MD5_DIGEST_SIZE)];
+	base16_encode_update(hex, MD5_DIGEST_SIZE, bin);
+	return std::string(reinterpret_cast<char const *>(hex), sizeof(hex));
+}
+
+std::string base64_encode (std::string const & s) {
+	struct base64_encode_ctx ctx;
+	base64_encode_init(&ctx);
+	uint8_t b64[BASE64_ENCODE_LENGTH(s.size())];
+	auto len = base64_encode_update(&ctx, b64, s.size(), reinterpret_cast<uint8_t const *>(s.data()));
+	len += base64_encode_final(&ctx, b64 + len);
+	return std::string(reinterpret_cast<char const *>(b64), len);
+}
+
+int make_upstream_agent_conn () {
+	char const * path;
+	int sock;
+	struct sockaddr_un addr;
+
+	if (!(path = getenv("SSH_AUTH_SOCK"))) {
+		std::clog << "no $SSH_AUTH_SOCK" << std::endl;
+		exit(EX_UNAVAILABLE);
+	}
+
+	if ((sock = socket(AF_UNIX, SOCK_STREAM, 0)) == -1) {
+		perror("socket");
+		exit(EX_UNAVAILABLE);
+	}
+	
+	addr.sun_family = AF_UNIX;
+	
+	if (strlen(path) >= sizeof(addr.sun_path)) {
+		std::clog << "$SSH_AUTH_SOCK too long" << std::endl;
+		exit(EX_UNAVAILABLE);
+	}
+
+	strcpy(addr.sun_path, path);
+
+	if (connect(sock, reinterpret_cast<struct sockaddr const *>(&addr), sizeof(addr))) {
+		perror("connect");
+		exit(EX_UNAVAILABLE);
+	}
+
+	return sock;
+}
+
+int make_listen_sock () {
+	int sock;
+	struct sockaddr_un addr;
+	
+	if ((sock = socket(AF_UNIX, SOCK_STREAM, 0)) == -1) {
+		perror("socket");
+		exit(EX_UNAVAILABLE);
+	}
+
+	addr.sun_family = AF_UNIX;
+	
+	if (path.native().length() >= sizeof(addr.sun_path)) {
+		std::clog << "path for listen socket too long" << std::endl;
+		exit(EX_UNAVAILABLE);
+	}
+
+	strcpy(addr.sun_path, path.c_str());
+
+	if (bind(sock, reinterpret_cast<struct sockaddr const *>(&addr), sizeof(addr))) {
+		perror("bind");
+		exit(EX_UNAVAILABLE);
+	}
+	
+	if (listen(sock, 0)) {
+		perror("listen");
+		exit(EX_UNAVAILABLE);
+	}
+
+	return sock;
+}
+
+void parse_cmdline (int const argc, char const * const * const argv) {
+	po::options_description opts("OPTIONS");
+	opts.add_options()
+		("comment,c",		po::value(&allowed_comment),	"key specified by comment")
+		("debug,d",		po::bool_switch(&debug),	"show even more stuff")
+		("fingerprint,fp,f",	po::value(&allowed_md5),	"key specified by pubkey's hex-encoded md5 fingerprint")
+		("help,h",		"print this help message")
+		("key,k",		po::value(&allowed_b64),	"key specified by base64-encoded pubkey")
+		("version,V",		"print version information")
+		;
+	po::variables_map config;
+	po::store(po::parse_command_line(argc, argv, opts), config);
+	po::notify(config);
+	
+	if (config.count("help")) {
+		std::cout << "Invocation: ssh-agent-filter [ OPTIONS ] -- [ SSH ARGUMENTS ]" << std::endl;
+		std::cout << opts << std::endl;
+		exit(EX_OK);
+	}
+	
+	if (config.count("version")) {
+		std::cout << SSH_AGENT_FILTER_VERSION << std::endl;
+		exit(EX_OK);
+	}
+
+	// canonicalize hashes
+	for (auto & s : allowed_md5)
+		for (auto it = s.begin(); it != s.end(); )
+			if (isxdigit(*it)) {
+				*it = tolower(*it);
+				++it;
+			} else
+				it = s.erase(it);
+}
+
+void setup_filters () {
+	__gnu_cxx::stdio_filebuf<char> agent_filebuf(make_upstream_agent_conn(), std::ios::in | std::ios::out);
+	std::iostream agent(&agent_filebuf);
+	agent.exceptions(std::ios::badbit | std::ios::failbit);
+	
+	agent << rfc4251string(std::string(1, SSH2_AGENTC_REQUEST_IDENTITIES));
+	rfc4251string answer;
+	agent >> answer;
+	std::istringstream answer_iss(answer);
+	answer_iss.exceptions(std::ios::badbit | std::ios::failbit);
+	rfc4251byte resp_code;
+	answer_iss >> resp_code;
+	if (resp_code != SSH2_AGENT_IDENTITIES_ANSWER)
+		throw std::runtime_error("unexpected answer from ssh-agent");
+	rfc4251uint32 keycount;
+	answer_iss >> keycount;
+	for (uint32_t i = keycount; i; --i) {
+		rfc4251string key;
+		rfc4251string comment;
+		answer_iss >> key >> comment;
+		
+		auto b64 = base64_encode(key);
+		if (debug) std::clog << b64 << std::endl;
+		
+		auto md5 = md5_hex(key);
+		if (debug) std::clog << md5 << std::endl;
+		
+		std::string comm(comment);
+		if (debug) std::clog << comm << std::endl;
+		
+		if (std::count(allowed_b64.begin(), allowed_b64.end(), b64)) {
+			allowed_pubkeys.insert(key);
+			if (debug) std::clog << "key allowed by equal base64 representation" << std::endl;
+		}
+		if (std::count(allowed_md5.begin(), allowed_md5.end(), md5)) {
+			allowed_pubkeys.insert(key);
+			if (debug) std::clog << "key allowed by matching md5 fingerprint" << std::endl;
+		}
+		if (std::count(allowed_comment.begin(), allowed_comment.end(), comm)) {
+			allowed_pubkeys.insert(key);
+			if (debug) std::clog << "key allowed by matching comment" << std::endl;
+		}
+		
+		if (debug) std::clog << std::endl;
+	}
+}
+
+rfc4251string handle_request (rfc4251string const & r) {
+	std::istringstream request(r);
+	std::ostringstream answer;
+	request.exceptions(std::ios::badbit | std::ios::failbit);
+	answer.exceptions(std::ios::badbit | std::ios::failbit);
+	rfc4251byte request_code;
+	request >> request_code;
+	switch (request_code) {
+		case SSH2_AGENTC_REQUEST_IDENTITIES:
+			{
+				__gnu_cxx::stdio_filebuf<char> agent_filebuf(make_upstream_agent_conn(), std::ios::in | std::ios::out);
+				std::iostream agent(&agent_filebuf);
+				agent.exceptions(std::ios::badbit | std::ios::failbit);
+				rfc4251string agent_answer;
+				agent << rfc4251string(std::string(1, SSH2_AGENTC_REQUEST_IDENTITIES));
+				agent >> agent_answer;
+				// temp to test key filtering when signing
+				//return agent_answer;
+				std::istringstream agent_answer_iss(agent_answer);
+				rfc4251byte answer_code;
+				rfc4251uint32 keycount;
+				agent_answer_iss >> answer_code >> keycount;
+				if (answer_code != SSH2_AGENT_IDENTITIES_ANSWER)
+					throw std::runtime_error("unexpected answer from ssh-agent");
+				std::vector<std::pair<rfc4251string, rfc4251string>> keys;
+				for (uint32_t i = keycount; i; --i) {
+					rfc4251string key;
+					rfc4251string comment;
+					agent_answer_iss >> key >> comment;
+					if (allowed_pubkeys.count(key))
+						keys.emplace_back(std::move(key), std::move(comment));
+				}
+				answer << answer_code << rfc4251uint32(keys.size());
+				for (auto const & k : keys)
+					answer << k.first << k.second;
+			}
+			break;
+		case SSH2_AGENTC_SIGN_REQUEST:
+			{
+				rfc4251string key;
+				request >> key;
+				if (allowed_pubkeys.count(key)) {
+					__gnu_cxx::stdio_filebuf<char> agent_filebuf(make_upstream_agent_conn(), std::ios::in | std::ios::out);
+					std::iostream agent(&agent_filebuf);
+					agent.exceptions(std::ios::badbit | std::ios::failbit);
+					rfc4251string agent_answer;
+					
+					agent << r;
+					agent >> agent_answer;
+					return agent_answer;
+				} else
+					answer << rfc4251byte(SSH_AGENT_FAILURE);
+			}
+			break;
+		case SSH_AGENTC_REQUEST_RSA_IDENTITIES:
+			answer << rfc4251byte(SSH_AGENT_RSA_IDENTITIES_ANSWER);
+			// we got no SSHv1 keys
+			answer << rfc4251uint32(0);
+			break;
+		case SSH_AGENTC_REMOVE_ALL_RSA_IDENTITIES:
+			answer << rfc4251byte(SSH_AGENT_SUCCESS);
+			break;
+		case SSH_AGENTC_RSA_CHALLENGE:
+		case SSH_AGENTC_ADD_RSA_IDENTITY:
+		case SSH_AGENTC_REMOVE_RSA_IDENTITY:
+		case SSH_AGENTC_ADD_RSA_ID_CONSTRAINED:
+		case SSH2_AGENTC_ADD_IDENTITY:
+		case SSH2_AGENTC_REMOVE_IDENTITY:
+		case SSH2_AGENTC_REMOVE_ALL_IDENTITIES:
+		case SSH2_AGENTC_ADD_ID_CONSTRAINED:
+		case SSH_AGENTC_ADD_SMARTCARD_KEY:
+		case SSH_AGENTC_REMOVE_SMARTCARD_KEY:
+		case SSH_AGENTC_LOCK:
+		case SSH_AGENTC_UNLOCK:
+		case SSH_AGENTC_ADD_SMARTCARD_KEY_CONSTRAINED:
+		default:
+			answer << rfc4251byte(SSH_AGENT_FAILURE);
+			break;
+	}
+
+	return rfc4251string(answer.str());
+}
+
+void handle_client (int const sock) {
+	// we could use only one streambuf and iostream but when
+	// switching from read to write an lseek call is made that
+	// fails with ESPIPE and causes an exception
+	__gnu_cxx::stdio_filebuf<char> client_filebuf_in(sock, std::ios::in);
+	__gnu_cxx::stdio_filebuf<char> client_filebuf_out(sock, std::ios::out);
+	std::istream client_in(&client_filebuf_in);
+	std::ostream client_out(&client_filebuf_out);
+	client_out.exceptions(std::ios::badbit | std::ios::failbit);
+	
+	rfc4251string request;
+	while (client_in >> request) try {
+		client_out << handle_request(request) << std::flush;
+	} catch (...) {
+		break;
+	}
+}
+
+void sighandler (int sig) {
+	switch (sig) {
+		case SIGINT:
+		case SIGPIPE:
+			break;
+		default:
+			remove(path);
+			std::abort();
+	}
+}
+
+int main (int const argc, char const * const * const argv) {
+	parse_cmdline(argc, argv);
+	
+	setup_filters();
+
+	path = fs::current_path() / ("agent." + std::to_string(getpid()));
+	int listen_sock = make_listen_sock();
+
+	if (not debug) {
+		pid_t pid = fork();
+		if (pid == -1) {
+			perror("fork");
+			exit(EX_OSERR);
+		}
+		if (pid > 0) {
+			std::cout << "SSH_AUTH_SOCK='" << path << "'; export SSH_AUTH_SOCK;" << std::endl;
+			std::cout << "SSH_AGENT_PID='" << pid << "'; export SSH_AGENT_PID;" << std::endl;
+			std::cout << "echo 'Agent pid " << pid << "';" << std::endl;
+			exit(EX_OK);
+		}
+	
+		setsid();
+		chdir("/");
+		int devnull = open("/dev/null", O_RDWR);
+		dup2(devnull, 0);
+		dup2(devnull, 1);
+		dup2(devnull, 2);
+		close(devnull);
+
+		signal(SIGINT, sighandler);
+		signal(SIGPIPE, sighandler);
+		signal(SIGHUP, sighandler);
+		signal(SIGTERM, sighandler);
+	}
+
+	int client_sock;
+	while ((client_sock = accept(listen_sock, nullptr, nullptr)) != -1) {
+		std::thread t(handle_client, client_sock);
+		t.detach();
+	}
+}