/* ipssh_config.h - Configuration API of Wind River SSH */ /* ****************************************************************************** * HEADER FILE * * Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipssh_config.h,v $ $Revision: 1.61.10.8 $ * $Source: /home/interpeak/CVSRoot/ipssh/config/ipssh_config.h,v $ * $Author: yli12 $ $Date: 2018-06-28 05:43:20 $ * $State: Exp $ $Locker: $ * * INTERPEAK_COPYRIGHT_STRING * Design and implementation by Roger Boden ****************************************************************************** */ #ifndef IPSSH_CONFIG_H #define IPSSH_CONFIG_H /* **************************************************************************** * 1 DESCRIPTION **************************************************************************** */ /* DESCRIPTION This library contains the APIs used for configuration of Wind River SSH. */ /* **************************************************************************** * 2 CONFIGURATION **************************************************************************** */ /* **************************************************************************** * 3 INCLUDE FILES **************************************************************************** */ #include #include #include #include #ifdef __cplusplus extern "C" { #endif /* **************************************************************************** * 4 CONFIGURATION **************************************************************************** */ #ifdef IP_DEBUG #define IPSSH_DEBUG #endif #ifdef IP_ASSERT #define IPSSH_ASSERT #endif /* *=========================================================================== * syslog build-time configuration *=========================================================================== */ #ifdef IPSSH_DEBUG #define IPSSH_SYSLOG_PRIORITY IPCOM_LOG_DEBUG #else #define IPSSH_SYSLOG_PRIORITY IPCOM_LOG_ERR #endif /* *=========================================================================== * IPSSH_USE_STOP_SPAWN *=========================================================================== */ #ifndef IP_SIZE #define IPSSH_USE_STOP_SPAWN #endif /* *=========================================================================== * IPSSH_USE_SFTP *=========================================================================== */ #ifndef IP_SIZE #define IPSSH_USE_SFTP #endif /* *=========================================================================== * IPSSH_USE_SFTP_CLT *=========================================================================== */ #ifdef IPSSH_USE_SFTP #define IPSSH_USE_SFTP_CLT #endif /* *=========================================================================== * IPSSH_USE_SFTP_CLT_CMD *=========================================================================== */ #ifdef IPSSH_USE_SFTP_CLT #define IPSSH_USE_SFTP_CLT_CMD #endif /* *=========================================================================== * ENCRYPTION ALGORITHMS *=========================================================================== * Use the defines below to control what encryption algorithms that will be * supported by IPSSH. */ #ifndef OPENSSL_NO_DES #define IPSSH_USE_DES #endif #ifndef OPENSSL_NO_AES #define IPSSH_USE_AES #endif #ifndef OPENSSL_NO_CAST #define IPSSH_USE_CAST #endif #ifndef OPENSSL_NO_RC4 #define IPSSH_USE_ARCFOUR #endif #ifndef OPENSSL_NO_BF #define IPSSH_USE_BLOWFISH #endif /* *=========================================================================== * HASH ALGORITHMS *=========================================================================== * Use the defines below to control hash encryption algorithms that will be * supported by IPSSH. */ #ifndef OPENSSL_NO_SHA #ifndef OPENSSL_NO_SHA1 #define IPSSH_USE_SHA1 #endif #ifndef OPENSSL_NO_SHA256 #define IPSSH_USE_SHA256 #endif #ifndef OPENSSL_NO_SHA512 #define IPSSH_USE_SHA512 #endif #endif #ifndef OPENSSL_NO_MD5 #define IPSSH_USE_MD5 #endif /* *=========================================================================== * IPSSH_USE_RSA *=========================================================================== * This define controls whether RSA support shall be included. RSA is required * for SSH v1 connections and can be used for client authentication in SSH v2 * connections. */ #ifndef OPENSSL_NO_RSA #define IPSSH_USE_RSA #endif /* *=========================================================================== * IPSSH_USE_V1 *=========================================================================== */ #if !defined(IP_SIZE) && defined(IPSSH_USE_RSA) #define IPSSH_USE_V1 #endif /* *=========================================================================== * IPSSH_USE_KEY_FINGERPRINT *=========================================================================== * Controls whether functions for key fingerprint generation shall be compiled in. */ #ifndef IP_SIZE #define IPSSH_USE_KEY_FINGERPRINT #endif /* *=========================================================================== * IPSSH_USE_DH_GROUP_EX *=========================================================================== * Controls whether support for RFC 4432, SSH RSA Key Exchange, shall be * compiled in. */ #ifdef IPSSH_USE_RSA #define IPSSH_USE_KEYEX_RSA #endif /* *=========================================================================== * IPSSH_USE_DH_GROUP_EX *=========================================================================== * Controls whether support for RFC 4419, SSH DH Group Exchange, shall be * compiled in. */ #define IPSSH_USE_DH_GROUP_EX /* *=========================================================================== * IPSSH_USE_DH_GROUP_EX_EXAMPLE_MODULI_FILE *=========================================================================== * Controls whether an example DH group exchange moduli file shall be * automatically generated at boot. The example moduli file is a pre-generated * file that is simply compiled in as an ascii blob and written to the moduli * file */ #ifdef IPSSH_USE_DH_GROUP_EX #define IPSSH_USE_DH_GROUP_EX_EXAMPLE_MODULI_FILE #endif /* *=========================================================================== * IPSSH_SFTP_START_DIR *=========================================================================== * Start directory for sftp connections. */ #ifdef IPSSH_USE_SFTP #define IPSSH_SFTP_START_DIR IPCOM_FILE_ROOT #endif /* *=========================================================================== * IPSSH_SHELLCMD_PROC_PRIO *=========================================================================== * Process priority of IPSSH shell commands. */ #define IPSSH_SHELLCMD_PROC_PRIO IPCOM_PRIORITY_DEFAULT /* *=========================================================================== * IPSSH_DAEMON_PROC_PRIO *=========================================================================== * Process priority of IPSSH daemon process. */ #define IPSSH_DAEMON_PROC_PRIO IPCOM_PRIORITY_DEFAULT /* *=========================================================================== * IPSSH_SPAWN_PROC_PRIO *=========================================================================== * Process priority of spawned IPSSH processes. * The spawned IPSSH processes perform public key operations during the handshake. * These operations are CPU intensive and it is therefore a good idea to run the * spawned processes at a lower priority than all processes that require real time * characteristics. */ #define IPSSH_SPAWN_PROC_PRIO 2 /* *=========================================================================== * IPSSH_EXIT_PROC_PRIO *=========================================================================== * Process priority of IPSSH processes in exit status. * The current IPSSH process is in exit status. Increase its priority and make * it higher than IPSSH daemon task. It will prevent IPSSH daemon task creating * another IPSSH process with same name while it has not been deleted completely. */ #define IPSSH_EXIT_PROC_PRIO (IPCOM_PRIORITY_DEFAULT + 1) /* *=========================================================================== * IPSSH_ECHO_STDIN *=========================================================================== * Set this define if you want IPSSH to echo data received on stdin on terminal * connections. This is used for shells that do not echo data. #define IPSSH_ECHO_STDIN */ /* *=========================================================================== * IPSSH_CHOWN_SOCKET_CB *=========================================================================== * Set this define to the name of function that changes the socket ownership * from one task to another. The function shall have the following signature: * void IPSSH_CHOWN_SOCKET_CB(Ip_fd sock, Ip_pid_t pid); #define IPSSH_CHOWN_SOCKET_CB chown_socket */ /* *=========================================================================== * IPSSH_AUTH_BANNER_MAX_LEN *=========================================================================== * The maximum number of characters in the authentication banner. */ #define IPSSH_AUTH_BANNER_MAX_LEN 256 /* *=========================================================================== * IPSSH_HOSTBASED_AUTH_DNS_CHECK *=========================================================================== * Enable this when you want the ssh server to check client's IP address * and hostname. Be sure to enalbe this configuration when : * 1. Dns server has the ssh client's record * OR * 2. Ssh server has local host configuration for ssh client. #define IPSSH_HOSTBASED_AUTH_DNS_CHECK */ /* **************************************************************************** * 6 FUNCTIONS **************************************************************************** */ /* Forward declaration */ union Ip_sockaddr_union; struct Ipcom_shell_ctx_struct; /******************************************************************************* * * ipssh_load_dsa_key_cb - return the DSA server key to be used by the daemon * * This callback routine is called when the IPSSH daemon is started. The function must * return the DSA server key to be used by the daemon. A custom callback routine * can be configured using the IPSSH_LOAD_DSA_KEY_CB VIP parameter. The default * callback routine is ipssh_load_dsa_key_example_cb, found in * ipssh/config/ipssh_example.c. * * Parameters: * * None. * * RETURNS: An DSA key or 'IP_NULL' to indicate that no DSA key is available. * Returning 'IP_NULL' will prevent the daemon from starting. * * ERRNO: */ IP_PUBLIC DSA* ipssh_load_dsa_key_cb(void); #ifdef IPSSH_USE_RSA #include /******************************************************************************* * * ipssh_load_rsa_key_cb - return the RSA server key to be used by the daemon * * This callback routine is called when the IPSSH daemon is started. The function must * return the RSA server key to be used by the daemon. A custom callback routine * can be configured using the IPSSH_LOAD_RSA_KEY_CB VIP parameter. The default * callback routine is ipssh_load_rsa_key_example_cb, found in * ipssh/config/ipssh_example.c. * * Parameters: * * None. * * RETURNS: An RSA key or 'IP_NULL' to indicate that no RSA key is available. * Returning 'IP_NULL' will prevent the daemon from starting. * * ERRNO: */ IP_PUBLIC RSA* ipssh_load_rsa_key_cb ( void ); /******************************************************************************* * * ipssh_load_rsa_keyex_key_cb - return the RSA server key to be used by the daemon in RSA key exchanges * * This callback routine is called when the IPSSH daemon is started. The function must * return the RSA key to be used by the daemon in RSA key exchanges (RFC 4432). A custom callback routine * can be configured using the IPSSH_LOAD_RSA_KEYEX_KEY_CB VIP parameter. The default * callback routine is ipssh_load_rsa_keyex_key_example_cb, found in * ipssh/config/ipssh_example.c. * * Parameters: * * None. * * RETURNS: An RSA key or 'IP_NULL' to indicate that no RSA key is available. * Returning 'IP_NULL' will prevent the daemon from starting. * * ERRNO: */ IP_PUBLIC RSA* ipssh_load_rsa_keyex_key_cb ( void ); #endif #ifdef IPSSH_USE_SFTP struct Ipssh_sftp_func_cb_st; /* Forward declaration */ /******************************************************************************* * * ipssh_get_sftp_func_cb - get file operation function pointers * * This callback routine returns the function pointers for file operations * for a certain path. The callback is called for each file operation. This makes * it possible to map certain parts of the file tree to something else but the * file system, e.g. RAM or flash memory. A custom callback routine can be * configured using the IPSSH_GET_SFTP_FUNC_CB VIP parameter. The default * callback routine is ipssh_get_sftp_func_example_cb, an example implementation * found in ipssh/config/ipssh_example.c. * * Parameters: * \is * \i * The path for which file operation function pointers shall be returned * \ie * * RETURNS: A pointer to a Ipssh_sftp_func_cb structure, of NULL in case of * failure. * * ERRNO: */ IP_PUBLIC struct Ipssh_sftp_func_cb_st* ipssh_get_sftp_func_cb ( const char* path ); /******************************************************************************* * * ipssh_sftp_check_access_cb - check user\'s access to file system * * This callback routine checks whether the user is authorized to perform a file * operation. It is called whenever the user initiates a file operation. A * custom callback routine can be configured using the IPSSH_SFTP_CHECK_ACCESS_CB * VIP parameter. The default callback routine is ipssh_sftp_check_access_example_cb, * an example implementation found in ipssh/config/ipssh_example.c. * * Parameters: * \is * \i * ID of the user initiating the request. * \i * The file operation requested. The following operations are possible: * * \is * \i 'IPSSH_FXP_MKDIR' * Create a directory. * \i 'IPSSH_FXP_RMDIR' * Delete a directory. * \i 'IPSSH_FXP_REMOVE' * Delete a file. * \i 'IPSSH_FXP_OPEN' * Read a file or write to a file, as indicated by the parameter. * \ie * \i * The path to the file. * \i * One of the following flags for opening a file (used only with the * 'IPSSH_FXP_OPEN' file operation): * * \is * \i 'IPSSH_FXP_READ' * Open the file for reading. * \i 'IPSSH_FXP_WRITE' * Open the file for writing. * \ie * \ie * * RETURNS: Either 'IPCOM_SUCCESS' or an error code (see 'ipcom_err.h'). * * ERRNO: */ IP_PUBLIC Ip_err ipssh_sftp_check_access_cb ( const char* user, int action, const char* path, int flags); #endif /******************************************************************************* * * ipssh_shell_check_access_cb - check user\'s access to shell * * This callback routine checks whether the user is authorized to access the shell. * It is called whenever the user initiates a shell request. A * custom callback routine can be configured using the IPSSH_SHELL_CHECK_ACCESS_CB * VIP parameter. The default callback routine is ipssh_shell_check_access_example_cb, * an example implementation found in ipssh/config/ipssh_example.c. * * Parameters: * \is * \i * ID of the user initiating the request. * \i * reserved flags. * * \ie * * RETURNS: Either 'IPCOM_SUCCESS' for an authorized user, or an * error code (see 'ipcom_err.h'). An error causes SSH to reject the shell request. * * ERRNO: */ IP_PUBLIC Ip_err ipssh_shell_check_access_cb ( const char* user, int flags); /******************************************************************************* * * ipssh_configure - function to place any custom initialization code in. * * This function is called at boot, * before the IPSSH daemon is started. Any custom configuration should be * performed in this function. * * Parameters: * * None. * * RETURNS: 'IPCOM_SUCCESS' or IPCOM_ERR_FAILED * Returning anything but 'IPCOM_SUCCESS' will prevent the daemon from starting. * * ERRNO: */ IP_GLOBAL Ip_err ipssh_configure(void); IP_PUBLIC Ip_err ipssh_set_win_size(Ip_fd shell_fd, Ip_u32 cols, Ip_u32 rows); /* C API functions for integrating a shell. Requires that ipssh_start_shell_c_api * is registered as the shell start function. I.e. * ipcom_set_start_shell_ptr(ipssh_start_shell_c_api); * must be called. * These functions are deprecated and will be removed in the next major VxWorks release */ IP_PUBLIC void* ipssh_shell_start_cb(void* ssh_ctx, const char* user, struct Ipcom_shell_ctx_struct* sh_ctx); IP_PUBLIC Ip_err ipssh_shell_stdin_cb(void* ssh_ctx, void* shell_ctx, const char* data, int len); IP_PUBLIC Ip_err ipssh_shell_stop_cb(void* ssh_ctx, void* shell_ctx); IP_PUBLIC int ipssh_send_shell_stdout_data(void* ssh_ctx, void* shell_ctx, const char* data, Ip_ssize_t len); IP_PUBLIC Ip_err ipssh_shell_exit(void* ssh_ctx, void* shell_ctx); IP_PUBLIC Ip_err ipssh_shell_welcome_msg_cb(void *ssh_ctx, void *shell_ctx); IP_PUBLIC Ip_err ipssh_start_shell_c_api(Ip_fd *stdio_sock, const struct Ipcom_shell_ctx_struct* sh_ctx); IP_PUBLIC Ip_fd ipssh_get_clt_fd(void* ssh_ctx); /******************************************************************************* * * ipssh_validate_userid_pw_cb - validate user\'s login ID and password * * This callback routine validates a user\'s login ID and password. A * customer callback routine can be configured using the IPSSH_VALIDATE_USERID_PW_CB * VIP parameter. The default callback routine is ipssh_validate_userid_pw_example_cb, * an example implementation using the ipcom_auth user database found in * ipssh/config/ipssh_example.c * * Parameters: * \is * \i * The user ID provided by the client. * \i * The password provided by the client. * \i * Pointer to a cookie for use by ipssh_shell_start_cb(). * \ie * * RETURNS: 'IPCOM_SUCCESS' for a valid user ID and password. All other return * values cause SSH to reject the login attempt. * * ERRNO: */ IP_PUBLIC Ip_err ipssh_validate_userid_pw_cb ( const char* user, const char* pw, struct Ipcom_shell_ctx_struct* sh_ctx ); /******************************************************************************* * * ipssh_validate_pubkey_cb - validate client\'s public key in SSH v2 * * This callback routine validates public keys used for client authentication in * SSH v2 connections. A custom callback routine can be configured using the * IPSSH_VALIDATE_PUBKEY_CB VIP parameter. The default callback routine is * ipssh_validate_pubkey_example_cb, a sample implementation found in * ipssh/config/ipssh_example.c. * * Parameters: * \is * \i * The user ID sent by the client. * \i * The public key used by the client for authentication. * \i * A pointer to this sessions shell context * \ie * * RETURNS: Either 'IPCOM_SUCCESS', for a valid user ID and public key, or an * error code (see 'ipcom_err.h'). An error causes SSH to reject the login * attempt. * * ERRNO: */ IP_PUBLIC Ip_err ipssh_validate_pubkey_cb ( const char* user, EVP_PKEY* pub_key, struct Ipcom_shell_ctx_struct* sh_ctx ); /******************************************************************************* * * ipssh_validate_hostbased_cb - validate client\'s hostbased authentication information in SSH v2 * * This callback routine validates hostbased information used for * client authentication in SSH v2 connections. A customer callback routine * can be configured using the IPSSH_VALIDATE_HOSTBASED_CB VIP parameter. * The default callback routine is ipssh_validate_hostbased_example_cb, * a sample implementation found in ipssh/config/ipssh_example.c. * * Parameters: * \is * \i * The user name sent by the client. * \i * The hostname sent by the client. * \i * The public key used by the client for authentication. * \i * A pointer to this sessions shell context * \ie * * RETURNS: Either 'IPCOM_SUCCESS', for a valid hostname and public key, or an * error code (see 'ipcom_err.h'). An error causes SSH to reject the login * attempt. * * ERRNO: */ IP_PUBLIC Ip_err ipssh_validate_hostbased_cb ( const char* user, char* host, EVP_PKEY* pub_key, struct Ipcom_shell_ctx_struct* sh_ctx ); #ifdef IPSSH_USE_V1 /******************************************************************************* * * ipssh_validate_rsa_pubkey_v1_cb - validate client public key in SSH v1 * * This callback routine validates public RSA keys used for client authentication * in SSH v1 connections. A custom callback routine can be configured using the * IPSSH_VALIDATE_RSA_PUBKEY_V1_CB VIP parameter. The default callback routine * is ipssh_validate_rsa_pubkey_v1_example_cb, a sample implementation found in * ipssh/config/ipssh_example.c * * Parameters: * \is * \i * The user ID sent by the client. * \i * The modulus of the key used by the client for authentication. * \i * A pointer to the location of a cookie for use by ipssh_shell_start_cb(). * \ie * * RETURNS: An RSA key structure containing the client\'s complete public * key, both modulus (n) and public exponent (e). A return value of 'IP_NULL' * means that the public modulus does not match an authorized public key, in * which case SSH rejects the login attempt. * * ERRNO: */ IP_PUBLIC RSA* ipssh_validate_rsa_pubkey_v1_cb ( const char* user, BIGNUM* modulus, struct Ipcom_shell_ctx_struct* sh_ctx ); #endif /******************************************************************************* * * ipssh_auth_complete_cb - successful authentication of client completed * * This callback routine is called when a client authentication has been * successfully completed. The client can be authenticated using password or public * key. If the configuration allows none authentication, then this callback will * be called without any authentication having taken place. This callback is * typically used to add data to the shell context. A custom callback routine * can be configured using the IPSSH_AUTH_COMPLETE_CB VIP parameter. The default * callback routine is ipssh_auth_complete_example_cb, a sample implementation * found in ipssh/config/ipssh_example.c. * * Parameters: * \is * \i * The user ID sent by the client. * \i * The shell context of this session * \ie * * RETURNS: IPCOM_SUCCESS for success. Any other return value will terminate the * session and disconnect the client. * * ERRNO: */ IP_PUBLIC Ip_err ipssh_auth_complete_cb ( const char* user, struct Ipcom_shell_ctx_struct* sh_ctx ); /******************************************************************************* * * ipssh_validate_srv_public_key_cb - validate the server's public key * * This callback routine is called during the handshake phase when a connection * shall be established with a server. The callback routine is called in order to * validate the servers public key. A custom callback routine can be configured * using the IPSSH_VALIDATE_SRV_PUBLIC_KEY_CB VIP parameter. The default callback * routine is ipssh_validate_srv_public_key_example_cb, a sample implementation * found in ipssh/config/ipssh_example.c. The sample implementation is a dummy * implementation makes no checks. A real-world implementation would maintain * a small database of server ip addresses and their public keys, and check * that the key used by the server we are connecting to is indeed the expected * key. * * Parameters: * \is * \i * The key used by the server * \i * The server's IP address * \ie * * RETURNS: IPCOM_SUCCESS for success. Any other return value will terminate the * session and disconnect the client. * * ERRNO: */ IP_PUBLIC Ip_err ipssh_validate_srv_public_key_cb ( EVP_PKEY* srv_key, const union Ip_sockaddr_union* srv_addr ); typedef Ip_err (*Ipssh_terminal_resize_cb)(Ip_fd shell_fd, Ip_u32 cols, Ip_u32 rows); /******************************************************************************* * * ipssh_set_terminal_resize_cb - set terminal resize callback function * * When the end-user resizes the ssh terminal window, a resize message is sent * to the ssh server. When ipssh receives such a message, it calls a terminal * resize callback. This function makes it possible to register a new callback * * Parameters: * \is * \i * The new terminal resize_cb * \ie */ void ipssh_set_terminal_resize_cb ( Ipssh_terminal_resize_cb terminal_resize_cb ); IP_GLOBAL void ipssh_create_dh_gex_moduli_example_file(void); /* **************************************************************************** * 7 SANITY CHECKS **************************************************************************** */ #if defined(IPSSH_USE_V1) && !defined(IPSSH_USE_RSA) #error RSA_REQUIRED_FOR_SSH_V1 #endif #if !defined(IPSSH_USE_DES) && !defined(IPSSH_USE_CAST) && !defined(IPSSH_USE_ARCFOUR) && !defined(IPSSH_USE_BLOWFISH) && !defined(IPSSH_USE_AES) #error AT_LEAST_ONE_ENCRYPTION_ALGORITHM_MUST_BE_DEFINED #endif #ifdef __cplusplus } #endif #endif /* **************************************************************************** * END OF FILE **************************************************************************** */