lsh - msva integration through libmsv
Clint Adams <[email protected]> Sun, 10 Apr 2011 20:02:09 +0000
| Newsgroups | gmane.comp.security.monkeysphere,gmane.network.lsh.bugs |
|---|---|
| Message-ID | <[email protected]> |
The proof-of-concept patch below (and linking with libmsv)
allows one to run
lsh --sloppy-host-authentication $hostname
and get a yes or no answer as to Monkeysphere validity
through an MSVA[0] query using the remote host's SSH
public key.
I wonder several things. Should MSVA accept ssh public
keys in a different format? Should libmsv provide a
function to prepend "ssh-rsa " to a base64 encoding of
a blob provided by the caller? Is this the wrong way
to do this?
[0] http://web.monkeysphere.info/validation-agent/protocol/
--- a/src/lsh.c 2011-04-10 15:29:33.000000000 -0400
+++ b/src/lsh.c 2011-04-10 15:29:20.618402336 -0400
@@ -77,6 +77,9 @@
#include "lsh_argp.h"
+
+#include <msv/msv.h>
+
/* Forward declarations */
static struct request_service request_userauth_service =
@@ -120,6 +123,36 @@
(start_gateway . int)))
*/
+/* Temp hack */
+#define BLOCKS 10
+#define LINE_LENGTH (BASE64_TEXT_BLOCK_SIZE * BLOCKS)
+#define BINARY_LENGTH (BASE64_BINARY_BLOCK_SIZE * BLOCKS)
+
+static struct lsh_string *
+encode_base64_line(const struct lsh_string *s)
+{
+ uint32_t input_length = lsh_string_length(s);
+ const uint8_t *data = lsh_string_data(s);
+
+ unsigned encoded_length = BASE64_ENCODE_RAW_LENGTH(input_length);
+ struct base64_encode_ctx ctx;
+ unsigned out;
+
+ struct lsh_string *res = lsh_string_alloc(encoded_length + BASE64_ENCODE_FINAL_LENGTH);
+
+ base64_encode_init(&ctx);
+ out = lsh_string_base64_encode_update(res, 0,
+ &ctx,
+ input_length, data);
+ out += lsh_string_base64_encode_final(res, out, &ctx);
+
+ assert (out == encoded_length);
+ lsh_string_trunc(res, out);
+
+ return res;
+}
+/* End temp hack */
+
static struct lsh_options *
make_options(struct exception_handler *handler,
@@ -509,6 +542,18 @@
0),
1
);
+
+if (method == ATOM_SSH_RSA) {
+ struct lsh_string *b64key = encode_base64_line(key);
+
+ char *b = malloc(lsh_string_length(b64key) + 9);
+ sprintf(b, "ssh-rsa %s", (char *)lsh_string_data(b64key));
+ lsh_string_free(b64key);
+
+ int msv = msv_query_agent(NULL, "ssh", "server", self->host, "opensshpubkey", b);
+ free(b);
+ printf ("MSV query: %s\n", msv_strerror (msv));
+}
if (!INTERACT_YES_OR_NO
(self->tty,