lsh - msva integration through libmsv

Clint Adams <[email protected]> Sun, 10 Apr 2011 20:02:09 +0000
Newsgroups gmane.comp.security.monkeysphere,gmane.network.lsh.bugs
Message-ID <[email protected]>
The proof-of-concept patch below (and linking with libmsv)
allows one to run
lsh --sloppy-host-authentication $hostname
and get a yes or no answer as to Monkeysphere validity
through an MSVA[0] query using the remote host's SSH
public key.

I wonder several things.  Should MSVA accept ssh public
keys in a different format? Should libmsv provide a
function to prepend "ssh-rsa " to a base64 encoding of
a blob provided by the caller? Is this the wrong way
to do this?


[0] http://web.monkeysphere.info/validation-agent/protocol/

--- a/src/lsh.c	2011-04-10 15:29:33.000000000 -0400
+++ b/src/lsh.c	2011-04-10 15:29:20.618402336 -0400
@@ -77,6 +77,9 @@
 
 #include "lsh_argp.h"
 
+
+#include <msv/msv.h>
+
 /* Forward declarations */
 
 static struct request_service request_userauth_service =
@@ -120,6 +123,36 @@
        (start_gateway . int)))
 */
 
+/* Temp hack */
+#define BLOCKS 10
+#define LINE_LENGTH (BASE64_TEXT_BLOCK_SIZE * BLOCKS)
+#define BINARY_LENGTH (BASE64_BINARY_BLOCK_SIZE * BLOCKS)
+
+static struct lsh_string *
+encode_base64_line(const struct lsh_string *s)
+{
+  uint32_t input_length = lsh_string_length(s);
+  const uint8_t *data = lsh_string_data(s);
+
+  unsigned encoded_length = BASE64_ENCODE_RAW_LENGTH(input_length);
+  struct base64_encode_ctx ctx;
+  unsigned out;
+  
+  struct lsh_string *res = lsh_string_alloc(encoded_length + BASE64_ENCODE_FINAL_LENGTH);
+
+  base64_encode_init(&ctx);
+  out = lsh_string_base64_encode_update(res, 0,
+					&ctx,
+					input_length, data);
+  out += lsh_string_base64_encode_final(res, out, &ctx);
+
+  assert (out == encoded_length);
+  lsh_string_trunc(res, out);
+  
+  return res;
+}
+/* End temp hack */
+
 
 static struct lsh_options *
 make_options(struct exception_handler *handler,
@@ -509,6 +542,18 @@
 						0),
 				    1 
 				    );
+
+if (method == ATOM_SSH_RSA) {
+	struct lsh_string *b64key = encode_base64_line(key);
+
+	char *b = malloc(lsh_string_length(b64key) + 9);
+	sprintf(b, "ssh-rsa %s", (char *)lsh_string_data(b64key));
+	lsh_string_free(b64key);
+
+	int msv = msv_query_agent(NULL, "ssh", "server", self->host, "opensshpubkey", b);
+	free(b);
+  printf ("MSV query: %s\n", msv_strerror (msv));
+}
 	  
 	  if (!INTERACT_YES_OR_NO
 	      (self->tty,