808 lines
26 KiB
C
808 lines
26 KiB
C
/* ipssh_config.h - Configuration API of Wind River SSH */
|
|
|
|
/*
|
|
******************************************************************************
|
|
* HEADER FILE
|
|
*
|
|
* Document no: @(#) $Name: VXWORKS_ITER40_2019102207 $ $RCSfile: ipssh_config.h,v $ $Revision: 1.61.10.8 $
|
|
* $Source: /home/interpeak/CVSRoot/ipssh/config/ipssh_config.h,v $
|
|
* $Author: yli12 $ $Date: 2018-06-28 05:43:20 $
|
|
* $State: Exp $ $Locker: $
|
|
*
|
|
* INTERPEAK_COPYRIGHT_STRING
|
|
* Design and implementation by Roger Boden <roger@interpeak.se>
|
|
******************************************************************************
|
|
*/
|
|
#ifndef IPSSH_CONFIG_H
|
|
#define IPSSH_CONFIG_H
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 1 DESCRIPTION
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
DESCRIPTION
|
|
This library contains the APIs used for configuration of Wind River SSH.
|
|
*/
|
|
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 2 CONFIGURATION
|
|
****************************************************************************
|
|
*/
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 3 INCLUDE FILES
|
|
****************************************************************************
|
|
*/
|
|
|
|
#include <ipcom_type.h>
|
|
#include <ipcom_cstyle.h>
|
|
#include <ipcom_config.h>
|
|
#include <openssl/dsa.h>
|
|
|
|
#ifdef __cplusplus
|
|
extern "C" {
|
|
#endif
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 4 CONFIGURATION
|
|
****************************************************************************
|
|
*/
|
|
#ifdef IP_DEBUG
|
|
#define IPSSH_DEBUG
|
|
#endif
|
|
|
|
#ifdef IP_ASSERT
|
|
#define IPSSH_ASSERT
|
|
#endif
|
|
|
|
/*
|
|
*===========================================================================
|
|
* syslog build-time configuration
|
|
*===========================================================================
|
|
*/
|
|
#ifdef IPSSH_DEBUG
|
|
#define IPSSH_SYSLOG_PRIORITY IPCOM_LOG_DEBUG
|
|
#else
|
|
#define IPSSH_SYSLOG_PRIORITY IPCOM_LOG_ERR
|
|
#endif
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPSSH_USE_STOP_SPAWN
|
|
*===========================================================================
|
|
*/
|
|
#ifndef IP_SIZE
|
|
#define IPSSH_USE_STOP_SPAWN
|
|
#endif
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPSSH_USE_SFTP
|
|
*===========================================================================
|
|
*/
|
|
#ifndef IP_SIZE
|
|
#define IPSSH_USE_SFTP
|
|
#endif
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPSSH_USE_SFTP_CLT
|
|
*===========================================================================
|
|
*/
|
|
#ifdef IPSSH_USE_SFTP
|
|
#define IPSSH_USE_SFTP_CLT
|
|
#endif
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPSSH_USE_SFTP_CLT_CMD
|
|
*===========================================================================
|
|
*/
|
|
#ifdef IPSSH_USE_SFTP_CLT
|
|
#define IPSSH_USE_SFTP_CLT_CMD
|
|
#endif
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* ENCRYPTION ALGORITHMS
|
|
*===========================================================================
|
|
* Use the defines below to control what encryption algorithms that will be
|
|
* supported by IPSSH.
|
|
*/
|
|
#ifndef OPENSSL_NO_DES
|
|
#define IPSSH_USE_DES
|
|
#endif
|
|
#ifndef OPENSSL_NO_AES
|
|
#define IPSSH_USE_AES
|
|
#endif
|
|
#ifndef OPENSSL_NO_CAST
|
|
#define IPSSH_USE_CAST
|
|
#endif
|
|
#ifndef OPENSSL_NO_RC4
|
|
#define IPSSH_USE_ARCFOUR
|
|
#endif
|
|
#ifndef OPENSSL_NO_BF
|
|
#define IPSSH_USE_BLOWFISH
|
|
#endif
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* HASH ALGORITHMS
|
|
*===========================================================================
|
|
* Use the defines below to control hash encryption algorithms that will be
|
|
* supported by IPSSH.
|
|
*/
|
|
#ifndef OPENSSL_NO_SHA
|
|
#ifndef OPENSSL_NO_SHA1
|
|
#define IPSSH_USE_SHA1
|
|
#endif
|
|
#ifndef OPENSSL_NO_SHA256
|
|
#define IPSSH_USE_SHA256
|
|
#endif
|
|
#ifndef OPENSSL_NO_SHA512
|
|
#define IPSSH_USE_SHA512
|
|
#endif
|
|
#endif
|
|
|
|
#ifndef OPENSSL_NO_MD5
|
|
#define IPSSH_USE_MD5
|
|
#endif
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPSSH_USE_RSA
|
|
*===========================================================================
|
|
* This define controls whether RSA support shall be included. RSA is required
|
|
* for SSH v1 connections and can be used for client authentication in SSH v2
|
|
* connections.
|
|
*/
|
|
#ifndef OPENSSL_NO_RSA
|
|
#define IPSSH_USE_RSA
|
|
#endif
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPSSH_USE_V1
|
|
*===========================================================================
|
|
*/
|
|
#if !defined(IP_SIZE) && defined(IPSSH_USE_RSA)
|
|
#define IPSSH_USE_V1
|
|
#endif
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPSSH_USE_KEY_FINGERPRINT
|
|
*===========================================================================
|
|
* Controls whether functions for key fingerprint generation shall be compiled in.
|
|
*/
|
|
#ifndef IP_SIZE
|
|
#define IPSSH_USE_KEY_FINGERPRINT
|
|
#endif
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPSSH_USE_DH_GROUP_EX
|
|
*===========================================================================
|
|
* Controls whether support for RFC 4432, SSH RSA Key Exchange, shall be
|
|
* compiled in.
|
|
*/
|
|
#ifdef IPSSH_USE_RSA
|
|
#define IPSSH_USE_KEYEX_RSA
|
|
#endif
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPSSH_USE_DH_GROUP_EX
|
|
*===========================================================================
|
|
* Controls whether support for RFC 4419, SSH DH Group Exchange, shall be
|
|
* compiled in.
|
|
*/
|
|
#define IPSSH_USE_DH_GROUP_EX
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPSSH_USE_DH_GROUP_EX_EXAMPLE_MODULI_FILE
|
|
*===========================================================================
|
|
* Controls whether an example DH group exchange moduli file shall be
|
|
* automatically generated at boot. The example moduli file is a pre-generated
|
|
* file that is simply compiled in as an ascii blob and written to the moduli
|
|
* file
|
|
*/
|
|
#ifdef IPSSH_USE_DH_GROUP_EX
|
|
#define IPSSH_USE_DH_GROUP_EX_EXAMPLE_MODULI_FILE
|
|
#endif
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPSSH_SFTP_START_DIR
|
|
*===========================================================================
|
|
* Start directory for sftp connections.
|
|
*/
|
|
#ifdef IPSSH_USE_SFTP
|
|
#define IPSSH_SFTP_START_DIR IPCOM_FILE_ROOT
|
|
#endif
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPSSH_SHELLCMD_PROC_PRIO
|
|
*===========================================================================
|
|
* Process priority of IPSSH shell commands.
|
|
*/
|
|
#define IPSSH_SHELLCMD_PROC_PRIO IPCOM_PRIORITY_DEFAULT
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPSSH_DAEMON_PROC_PRIO
|
|
*===========================================================================
|
|
* Process priority of IPSSH daemon process.
|
|
*/
|
|
#define IPSSH_DAEMON_PROC_PRIO IPCOM_PRIORITY_DEFAULT
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPSSH_SPAWN_PROC_PRIO
|
|
*===========================================================================
|
|
* Process priority of spawned IPSSH processes.
|
|
* The spawned IPSSH processes perform public key operations during the handshake.
|
|
* These operations are CPU intensive and it is therefore a good idea to run the
|
|
* spawned processes at a lower priority than all processes that require real time
|
|
* characteristics.
|
|
*/
|
|
#define IPSSH_SPAWN_PROC_PRIO 2
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPSSH_EXIT_PROC_PRIO
|
|
*===========================================================================
|
|
* Process priority of IPSSH processes in exit status.
|
|
* The current IPSSH process is in exit status. Increase its priority and make
|
|
* it higher than IPSSH daemon task. It will prevent IPSSH daemon task creating
|
|
* another IPSSH process with same name while it has not been deleted completely.
|
|
*/
|
|
#define IPSSH_EXIT_PROC_PRIO (IPCOM_PRIORITY_DEFAULT + 1)
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPSSH_ECHO_STDIN
|
|
*===========================================================================
|
|
* Set this define if you want IPSSH to echo data received on stdin on terminal
|
|
* connections. This is used for shells that do not echo data.
|
|
#define IPSSH_ECHO_STDIN
|
|
*/
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPSSH_CHOWN_SOCKET_CB
|
|
*===========================================================================
|
|
* Set this define to the name of function that changes the socket ownership
|
|
* from one task to another. The function shall have the following signature:
|
|
* void IPSSH_CHOWN_SOCKET_CB(Ip_fd sock, Ip_pid_t pid);
|
|
#define IPSSH_CHOWN_SOCKET_CB chown_socket
|
|
*/
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPSSH_AUTH_BANNER_MAX_LEN
|
|
*===========================================================================
|
|
* The maximum number of characters in the authentication banner.
|
|
*/
|
|
#define IPSSH_AUTH_BANNER_MAX_LEN 256
|
|
|
|
|
|
/*
|
|
*===========================================================================
|
|
* IPSSH_HOSTBASED_AUTH_DNS_CHECK
|
|
*===========================================================================
|
|
* Enable this when you want the ssh server to check client's IP address
|
|
* and hostname. Be sure to enalbe this configuration when :
|
|
* 1. Dns server has the ssh client's record
|
|
* OR
|
|
* 2. Ssh server has local host configuration for ssh client.
|
|
#define IPSSH_HOSTBASED_AUTH_DNS_CHECK
|
|
*/
|
|
|
|
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 6 FUNCTIONS
|
|
****************************************************************************
|
|
*/
|
|
/* Forward declaration */
|
|
union Ip_sockaddr_union;
|
|
struct Ipcom_shell_ctx_struct;
|
|
|
|
/*******************************************************************************
|
|
*
|
|
* ipssh_load_dsa_key_cb - return the DSA server key to be used by the daemon
|
|
*
|
|
* This callback routine is called when the IPSSH daemon is started. The function must
|
|
* return the DSA server key to be used by the daemon. A custom callback routine
|
|
* can be configured using the IPSSH_LOAD_DSA_KEY_CB VIP parameter. The default
|
|
* callback routine is ipssh_load_dsa_key_example_cb, found in
|
|
* ipssh/config/ipssh_example.c.
|
|
*
|
|
* Parameters:
|
|
*
|
|
* None.
|
|
*
|
|
* RETURNS: An DSA key or 'IP_NULL' to indicate that no DSA key is available.
|
|
* Returning 'IP_NULL' will prevent the daemon from starting.
|
|
*
|
|
* ERRNO:
|
|
*/
|
|
IP_PUBLIC DSA* ipssh_load_dsa_key_cb(void);
|
|
|
|
|
|
#ifdef IPSSH_USE_RSA
|
|
#include <openssl/rsa.h>
|
|
/*******************************************************************************
|
|
*
|
|
* ipssh_load_rsa_key_cb - return the RSA server key to be used by the daemon
|
|
*
|
|
* This callback routine is called when the IPSSH daemon is started. The function must
|
|
* return the RSA server key to be used by the daemon. A custom callback routine
|
|
* can be configured using the IPSSH_LOAD_RSA_KEY_CB VIP parameter. The default
|
|
* callback routine is ipssh_load_rsa_key_example_cb, found in
|
|
* ipssh/config/ipssh_example.c.
|
|
*
|
|
* Parameters:
|
|
*
|
|
* None.
|
|
*
|
|
* RETURNS: An RSA key or 'IP_NULL' to indicate that no RSA key is available.
|
|
* Returning 'IP_NULL' will prevent the daemon from starting.
|
|
*
|
|
* ERRNO:
|
|
*/
|
|
IP_PUBLIC RSA* ipssh_load_rsa_key_cb
|
|
(
|
|
void
|
|
);
|
|
|
|
/*******************************************************************************
|
|
*
|
|
* ipssh_load_rsa_keyex_key_cb - return the RSA server key to be used by the daemon in RSA key exchanges
|
|
*
|
|
* This callback routine is called when the IPSSH daemon is started. The function must
|
|
* return the RSA key to be used by the daemon in RSA key exchanges (RFC 4432). A custom callback routine
|
|
* can be configured using the IPSSH_LOAD_RSA_KEYEX_KEY_CB VIP parameter. The default
|
|
* callback routine is ipssh_load_rsa_keyex_key_example_cb, found in
|
|
* ipssh/config/ipssh_example.c.
|
|
*
|
|
* Parameters:
|
|
*
|
|
* None.
|
|
*
|
|
* RETURNS: An RSA key or 'IP_NULL' to indicate that no RSA key is available.
|
|
* Returning 'IP_NULL' will prevent the daemon from starting.
|
|
*
|
|
* ERRNO:
|
|
*/
|
|
IP_PUBLIC RSA* ipssh_load_rsa_keyex_key_cb
|
|
(
|
|
void
|
|
);
|
|
|
|
#endif
|
|
|
|
#ifdef IPSSH_USE_SFTP
|
|
struct Ipssh_sftp_func_cb_st; /* Forward declaration */
|
|
|
|
/*******************************************************************************
|
|
*
|
|
* ipssh_get_sftp_func_cb - get file operation function pointers
|
|
*
|
|
* This callback routine returns the function pointers for file operations
|
|
* for a certain path. The callback is called for each file operation. This makes
|
|
* it possible to map certain parts of the file tree to something else but the
|
|
* file system, e.g. RAM or flash memory. A custom callback routine can be
|
|
* configured using the IPSSH_GET_SFTP_FUNC_CB VIP parameter. The default
|
|
* callback routine is ipssh_get_sftp_func_example_cb, an example implementation
|
|
* found in ipssh/config/ipssh_example.c.
|
|
*
|
|
* Parameters:
|
|
* \is
|
|
* \i <path>
|
|
* The path for which file operation function pointers shall be returned
|
|
* \ie
|
|
*
|
|
* RETURNS: A pointer to a Ipssh_sftp_func_cb structure, of NULL in case of
|
|
* failure.
|
|
*
|
|
* ERRNO:
|
|
*/
|
|
IP_PUBLIC struct Ipssh_sftp_func_cb_st* ipssh_get_sftp_func_cb
|
|
(
|
|
const char* path
|
|
);
|
|
|
|
/*******************************************************************************
|
|
*
|
|
* ipssh_sftp_check_access_cb - check user\'s access to file system
|
|
*
|
|
* This callback routine checks whether the user is authorized to perform a file
|
|
* operation. It is called whenever the user initiates a file operation. A
|
|
* custom callback routine can be configured using the IPSSH_SFTP_CHECK_ACCESS_CB
|
|
* VIP parameter. The default callback routine is ipssh_sftp_check_access_example_cb,
|
|
* an example implementation found in ipssh/config/ipssh_example.c.
|
|
*
|
|
* Parameters:
|
|
* \is
|
|
* \i <user>
|
|
* ID of the user initiating the request.
|
|
* \i <action>
|
|
* The file operation requested. The following operations are possible:
|
|
*
|
|
* \is
|
|
* \i 'IPSSH_FXP_MKDIR'
|
|
* Create a directory.
|
|
* \i 'IPSSH_FXP_RMDIR'
|
|
* Delete a directory.
|
|
* \i 'IPSSH_FXP_REMOVE'
|
|
* Delete a file.
|
|
* \i 'IPSSH_FXP_OPEN'
|
|
* Read a file or write to a file, as indicated by the <flag> parameter.
|
|
* \ie
|
|
* \i <path>
|
|
* The path to the file.
|
|
* \i <flags>
|
|
* One of the following flags for opening a file (used only with the
|
|
* 'IPSSH_FXP_OPEN' file operation):
|
|
*
|
|
* \is
|
|
* \i 'IPSSH_FXP_READ'
|
|
* Open the file for reading.
|
|
* \i 'IPSSH_FXP_WRITE'
|
|
* Open the file for writing.
|
|
* \ie
|
|
* \ie
|
|
*
|
|
* RETURNS: Either 'IPCOM_SUCCESS' or an error code (see 'ipcom_err.h').
|
|
*
|
|
* ERRNO:
|
|
*/
|
|
IP_PUBLIC Ip_err ipssh_sftp_check_access_cb
|
|
(
|
|
const char* user,
|
|
int action,
|
|
const char* path,
|
|
int flags);
|
|
#endif
|
|
|
|
/*******************************************************************************
|
|
*
|
|
* ipssh_shell_check_access_cb - check user\'s access to shell
|
|
*
|
|
* This callback routine checks whether the user is authorized to access the shell.
|
|
* It is called whenever the user initiates a shell request. A
|
|
* custom callback routine can be configured using the IPSSH_SHELL_CHECK_ACCESS_CB
|
|
* VIP parameter. The default callback routine is ipssh_shell_check_access_example_cb,
|
|
* an example implementation found in ipssh/config/ipssh_example.c.
|
|
*
|
|
* Parameters:
|
|
* \is
|
|
* \i <user>
|
|
* ID of the user initiating the request.
|
|
* \i <flags>
|
|
* reserved flags.
|
|
*
|
|
* \ie
|
|
*
|
|
* RETURNS: Either 'IPCOM_SUCCESS' for an authorized user, or an
|
|
* error code (see 'ipcom_err.h'). An error causes SSH to reject the shell request.
|
|
*
|
|
* ERRNO:
|
|
*/
|
|
IP_PUBLIC Ip_err ipssh_shell_check_access_cb
|
|
(
|
|
const char* user,
|
|
int flags);
|
|
|
|
/*******************************************************************************
|
|
*
|
|
* ipssh_configure - function to place any custom initialization code in.
|
|
*
|
|
* This function is called at boot,
|
|
* before the IPSSH daemon is started. Any custom configuration should be
|
|
* performed in this function.
|
|
*
|
|
* Parameters:
|
|
*
|
|
* None.
|
|
*
|
|
* RETURNS: 'IPCOM_SUCCESS' or IPCOM_ERR_FAILED
|
|
* Returning anything but 'IPCOM_SUCCESS' will prevent the daemon from starting.
|
|
*
|
|
* ERRNO:
|
|
*/
|
|
IP_GLOBAL Ip_err ipssh_configure(void);
|
|
|
|
|
|
IP_PUBLIC Ip_err ipssh_set_win_size(Ip_fd shell_fd, Ip_u32 cols, Ip_u32 rows);
|
|
|
|
|
|
/* C API functions for integrating a shell. Requires that ipssh_start_shell_c_api
|
|
* is registered as the shell start function. I.e.
|
|
* ipcom_set_start_shell_ptr(ipssh_start_shell_c_api);
|
|
* must be called.
|
|
* These functions are deprecated and will be removed in the next major VxWorks release */
|
|
IP_PUBLIC void* ipssh_shell_start_cb(void* ssh_ctx, const char* user, struct Ipcom_shell_ctx_struct* sh_ctx);
|
|
IP_PUBLIC Ip_err ipssh_shell_stdin_cb(void* ssh_ctx, void* shell_ctx, const char* data, int len);
|
|
IP_PUBLIC Ip_err ipssh_shell_stop_cb(void* ssh_ctx, void* shell_ctx);
|
|
IP_PUBLIC int ipssh_send_shell_stdout_data(void* ssh_ctx, void* shell_ctx, const char* data, Ip_ssize_t len);
|
|
IP_PUBLIC Ip_err ipssh_shell_exit(void* ssh_ctx, void* shell_ctx);
|
|
IP_PUBLIC Ip_err ipssh_shell_welcome_msg_cb(void *ssh_ctx, void *shell_ctx);
|
|
IP_PUBLIC Ip_err ipssh_start_shell_c_api(Ip_fd *stdio_sock, const struct Ipcom_shell_ctx_struct* sh_ctx);
|
|
IP_PUBLIC Ip_fd ipssh_get_clt_fd(void* ssh_ctx);
|
|
|
|
|
|
/*******************************************************************************
|
|
*
|
|
* ipssh_validate_userid_pw_cb - validate user\'s login ID and password
|
|
*
|
|
* This callback routine validates a user\'s login ID and password. A
|
|
* customer callback routine can be configured using the IPSSH_VALIDATE_USERID_PW_CB
|
|
* VIP parameter. The default callback routine is ipssh_validate_userid_pw_example_cb,
|
|
* an example implementation using the ipcom_auth user database found in
|
|
* ipssh/config/ipssh_example.c
|
|
*
|
|
* Parameters:
|
|
* \is
|
|
* \i <user>
|
|
* The user ID provided by the client.
|
|
* \i <pw>
|
|
* The password provided by the client.
|
|
* \i <cookie>
|
|
* Pointer to a cookie for use by ipssh_shell_start_cb().
|
|
* \ie
|
|
*
|
|
* RETURNS: 'IPCOM_SUCCESS' for a valid user ID and password. All other return
|
|
* values cause SSH to reject the login attempt.
|
|
*
|
|
* ERRNO:
|
|
*/
|
|
IP_PUBLIC Ip_err ipssh_validate_userid_pw_cb
|
|
(
|
|
const char* user,
|
|
const char* pw,
|
|
struct Ipcom_shell_ctx_struct* sh_ctx
|
|
);
|
|
|
|
/*******************************************************************************
|
|
*
|
|
* ipssh_validate_pubkey_cb - validate client\'s public key in SSH v2
|
|
*
|
|
* This callback routine validates public keys used for client authentication in
|
|
* SSH v2 connections. A custom callback routine can be configured using the
|
|
* IPSSH_VALIDATE_PUBKEY_CB VIP parameter. The default callback routine is
|
|
* ipssh_validate_pubkey_example_cb, a sample implementation found in
|
|
* ipssh/config/ipssh_example.c.
|
|
*
|
|
* Parameters:
|
|
* \is
|
|
* \i <userid>
|
|
* The user ID sent by the client.
|
|
* \i <pub_key>
|
|
* The public key used by the client for authentication.
|
|
* \i <sh_ctx>
|
|
* A pointer to this sessions shell context
|
|
* \ie
|
|
*
|
|
* RETURNS: Either 'IPCOM_SUCCESS', for a valid user ID and public key, or an
|
|
* error code (see 'ipcom_err.h'). An error causes SSH to reject the login
|
|
* attempt.
|
|
*
|
|
* ERRNO:
|
|
*/
|
|
IP_PUBLIC Ip_err ipssh_validate_pubkey_cb
|
|
(
|
|
const char* user,
|
|
EVP_PKEY* pub_key,
|
|
struct Ipcom_shell_ctx_struct* sh_ctx
|
|
);
|
|
|
|
|
|
/*******************************************************************************
|
|
*
|
|
* ipssh_validate_hostbased_cb - validate client\'s hostbased authentication information in SSH v2
|
|
*
|
|
* This callback routine validates hostbased information used for
|
|
* client authentication in SSH v2 connections. A customer callback routine
|
|
* can be configured using the IPSSH_VALIDATE_HOSTBASED_CB VIP parameter.
|
|
* The default callback routine is ipssh_validate_hostbased_example_cb,
|
|
* a sample implementation found in ipssh/config/ipssh_example.c.
|
|
*
|
|
* Parameters:
|
|
* \is
|
|
* \i <user>
|
|
* The user name sent by the client.
|
|
* \i <host>
|
|
* The hostname sent by the client.
|
|
* \i <pub_key>
|
|
* The public key used by the client for authentication.
|
|
* \i <sh_ctx>
|
|
* A pointer to this sessions shell context
|
|
* \ie
|
|
*
|
|
* RETURNS: Either 'IPCOM_SUCCESS', for a valid hostname and public key, or an
|
|
* error code (see 'ipcom_err.h'). An error causes SSH to reject the login
|
|
* attempt.
|
|
*
|
|
* ERRNO:
|
|
*/
|
|
IP_PUBLIC Ip_err ipssh_validate_hostbased_cb
|
|
(
|
|
const char* user,
|
|
char* host,
|
|
EVP_PKEY* pub_key,
|
|
struct Ipcom_shell_ctx_struct* sh_ctx
|
|
);
|
|
|
|
|
|
#ifdef IPSSH_USE_V1
|
|
/*******************************************************************************
|
|
*
|
|
* ipssh_validate_rsa_pubkey_v1_cb - validate client public key in SSH v1
|
|
*
|
|
* This callback routine validates public RSA keys used for client authentication
|
|
* in SSH v1 connections. A custom callback routine can be configured using the
|
|
* IPSSH_VALIDATE_RSA_PUBKEY_V1_CB VIP parameter. The default callback routine
|
|
* is ipssh_validate_rsa_pubkey_v1_example_cb, a sample implementation found in
|
|
* ipssh/config/ipssh_example.c
|
|
*
|
|
* Parameters:
|
|
* \is
|
|
* \i <userid>
|
|
* The user ID sent by the client.
|
|
* \i <modulus>
|
|
* The modulus of the key used by the client for authentication.
|
|
* \i <cookie>
|
|
* A pointer to the location of a cookie for use by ipssh_shell_start_cb().
|
|
* \ie
|
|
*
|
|
* RETURNS: An RSA key structure containing the client\'s complete public
|
|
* key, both modulus (n) and public exponent (e). A return value of 'IP_NULL'
|
|
* means that the public modulus does not match an authorized public key, in
|
|
* which case SSH rejects the login attempt.
|
|
*
|
|
* ERRNO:
|
|
*/
|
|
IP_PUBLIC RSA* ipssh_validate_rsa_pubkey_v1_cb
|
|
(
|
|
const char* user,
|
|
BIGNUM* modulus,
|
|
struct Ipcom_shell_ctx_struct* sh_ctx
|
|
);
|
|
#endif
|
|
|
|
/*******************************************************************************
|
|
*
|
|
* ipssh_auth_complete_cb - successful authentication of client completed
|
|
*
|
|
* This callback routine is called when a client authentication has been
|
|
* successfully completed. The client can be authenticated using password or public
|
|
* key. If the configuration allows none authentication, then this callback will
|
|
* be called without any authentication having taken place. This callback is
|
|
* typically used to add data to the shell context. A custom callback routine
|
|
* can be configured using the IPSSH_AUTH_COMPLETE_CB VIP parameter. The default
|
|
* callback routine is ipssh_auth_complete_example_cb, a sample implementation
|
|
* found in ipssh/config/ipssh_example.c.
|
|
*
|
|
* Parameters:
|
|
* \is
|
|
* \i <userid>
|
|
* The user ID sent by the client.
|
|
* \i <sh_ctx>
|
|
* The shell context of this session
|
|
* \ie
|
|
*
|
|
* RETURNS: IPCOM_SUCCESS for success. Any other return value will terminate the
|
|
* session and disconnect the client.
|
|
*
|
|
* ERRNO:
|
|
*/
|
|
IP_PUBLIC Ip_err ipssh_auth_complete_cb
|
|
(
|
|
const char* user,
|
|
struct Ipcom_shell_ctx_struct* sh_ctx
|
|
);
|
|
|
|
/*******************************************************************************
|
|
*
|
|
* ipssh_validate_srv_public_key_cb - validate the server's public key
|
|
*
|
|
* This callback routine is called during the handshake phase when a connection
|
|
* shall be established with a server. The callback routine is called in order to
|
|
* validate the servers public key. A custom callback routine can be configured
|
|
* using the IPSSH_VALIDATE_SRV_PUBLIC_KEY_CB VIP parameter. The default callback
|
|
* routine is ipssh_validate_srv_public_key_example_cb, a sample implementation
|
|
* found in ipssh/config/ipssh_example.c. The sample implementation is a dummy
|
|
* implementation makes no checks. A real-world implementation would maintain
|
|
* a small database of server ip addresses and their public keys, and check
|
|
* that the key used by the server we are connecting to is indeed the expected
|
|
* key.
|
|
*
|
|
* Parameters:
|
|
* \is
|
|
* \i <srv_key>
|
|
* The key used by the server
|
|
* \i <srv_addr>
|
|
* The server's IP address
|
|
* \ie
|
|
*
|
|
* RETURNS: IPCOM_SUCCESS for success. Any other return value will terminate the
|
|
* session and disconnect the client.
|
|
*
|
|
* ERRNO:
|
|
*/
|
|
IP_PUBLIC Ip_err ipssh_validate_srv_public_key_cb
|
|
(
|
|
EVP_PKEY* srv_key,
|
|
const union Ip_sockaddr_union* srv_addr
|
|
);
|
|
|
|
typedef Ip_err (*Ipssh_terminal_resize_cb)(Ip_fd shell_fd, Ip_u32 cols, Ip_u32 rows);
|
|
|
|
/*******************************************************************************
|
|
*
|
|
* ipssh_set_terminal_resize_cb - set terminal resize callback function
|
|
*
|
|
* When the end-user resizes the ssh terminal window, a resize message is sent
|
|
* to the ssh server. When ipssh receives such a message, it calls a terminal
|
|
* resize callback. This function makes it possible to register a new callback
|
|
*
|
|
* Parameters:
|
|
* \is
|
|
* \i <terminal_resize_cb>
|
|
* The new terminal resize_cb
|
|
* \ie
|
|
*/
|
|
void ipssh_set_terminal_resize_cb
|
|
(
|
|
Ipssh_terminal_resize_cb terminal_resize_cb
|
|
);
|
|
|
|
|
|
IP_GLOBAL void ipssh_create_dh_gex_moduli_example_file(void);
|
|
|
|
/*
|
|
****************************************************************************
|
|
* 7 SANITY CHECKS
|
|
****************************************************************************
|
|
*/
|
|
#if defined(IPSSH_USE_V1) && !defined(IPSSH_USE_RSA)
|
|
#error RSA_REQUIRED_FOR_SSH_V1
|
|
#endif
|
|
|
|
#if !defined(IPSSH_USE_DES) && !defined(IPSSH_USE_CAST) && !defined(IPSSH_USE_ARCFOUR) && !defined(IPSSH_USE_BLOWFISH) && !defined(IPSSH_USE_AES)
|
|
#error AT_LEAST_ONE_ENCRYPTION_ALGORITHM_MUST_BE_DEFINED
|
|
#endif
|
|
|
|
#ifdef __cplusplus
|
|
}
|
|
#endif
|
|
|
|
#endif
|
|
|
|
|
|
/*
|
|
****************************************************************************
|
|
* END OF FILE
|
|
****************************************************************************
|
|
*/
|