nasl_ssh.h File Reference

Protos and data structures for SSH functions used by NASL scripts. More...

#include "nasl_lex_ctxt.h"
#include <libssh/libssh.h>

Include dependency graph for nasl_ssh.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Functions
tree_cell *	nasl_ssh_connect (lex_ctxt *lexic)
	Connect to the target host via TCP and setup an ssh connection.
tree_cell *	nasl_ssh_disconnect (lex_ctxt *lexic)
	Disconnect an ssh connection.
tree_cell *	nasl_ssh_session_id_from_sock (lex_ctxt *lexic)
	Given a socket, return the corresponding session id.
tree_cell *	nasl_ssh_get_sock (lex_ctxt *lexic)
	Given a session id, return the corresponding socket.
tree_cell *	nasl_ssh_set_login (lex_ctxt *lexic)
	Set the login name for the authentication.
tree_cell *	nasl_ssh_userauth (lex_ctxt *lexic)
	Authenticate a user on an ssh connection.
tree_cell *	nasl_ssh_request_exec (lex_ctxt *lexic)
	Run a command via ssh.
tree_cell *	nasl_ssh_shell_open (lex_ctxt *lexic)
	Request an ssh shell.
tree_cell *	nasl_ssh_shell_read (lex_ctxt *lexic)
	Read the output of an ssh shell.
tree_cell *	nasl_ssh_shell_write (lex_ctxt *lexic)
	Write string to ssh shell.
tree_cell *	nasl_ssh_shell_close (lex_ctxt *lexic)
	Close an ssh shell.
tree_cell *	nasl_ssh_login_interactive (lex_ctxt *lexic)
	Authenticate a user on an ssh connection.
tree_cell *	nasl_ssh_login_interactive_pass (lex_ctxt *lexic)
	Authenticate a user on an ssh connection.
tree_cell *	nasl_ssh_exec (lex_ctxt *)
tree_cell *	nasl_ssh_get_issue_banner (lex_ctxt *lexic)
	Get the issue banner.
tree_cell *	nasl_ssh_get_server_banner (lex_ctxt *lexic)
	Get the server banner.
tree_cell *	nasl_ssh_get_auth_methods (lex_ctxt *lexic)
	Get the list of authmethods.
tree_cell *	nasl_ssh_get_host_key (lex_ctxt *lexic)
	Get the host key.
tree_cell *	nasl_sftp_enabled_check (lex_ctxt *)
	Check if the SFTP subsystem is enabled on the remote SSH server.
tree_cell *	nasl_ssh_execute_netconf_subsystem (lex_ctxt *)
	Excecute the NETCONF subsystem on the the ssh channel.

Detailed Description

Protos and data structures for SSH functions used by NASL scripts.

This file contains the protos for nasl_ssh.c

Definition in file nasl_ssh.h.

Function Documentation

nasl_sftp_enabled_check()

tree_cell * nasl_sftp_enabled_check

(

lex_ctxt *

lexic

)

Check if the SFTP subsystem is enabled on the remote SSH server.

NASL Function: sftp_enabled_check\n

NASL Unnamed Parameters:\n

• An SSH session id.

NASL Returns:\n An integer: 0 on success, -1 (SSH_ERROR) on Channel request

subsystem failure. Greater than 0 means an error during SFTP init. NULL indicates a failure during session id verification.

Parameters

[in]

lexic

Lexical context of NASL interpreter.

Definition at line 1993 of file nasl_ssh.c.

{
  int tbl_slot, session_id;
  tree_cell *retc;
  sftp_session sftp;
  ssh_session session;
  int rc, verbose = 0;
 
  session_id = get_int_var_by_num (lexic, 0, -1);
  if (!verify_session_id (session_id, "sftp_enabled_check", &tbl_slot, lexic))
    return NULL;
 
  session = session_table[tbl_slot].session;
  verbose = session_table[tbl_slot].verbose;
 
  sftp = sftp_new (session);
  if (sftp == NULL)
    {
      if (verbose)
        g_message (
          "Function %s (calling internal function %s) called from %s: %s",
          nasl_get_function_name () ? nasl_get_function_name ()
                                    : "script_main_function",
          __func__, nasl_get_plugin_filename (),
          ssh_get_error (session_table[tbl_slot].session));
      rc = SSH_ERROR;
      goto write_ret;
    }
 
  rc = sftp_init (sftp);
  if (rc != SSH_OK)
    {
      if (verbose)
        {
          g_message ("Function %s (calling internal function %s) called from "
                     "%s: %s. Code %d",
                     nasl_get_function_name () ? nasl_get_function_name ()
                                               : "script_main_function",
                     __func__, nasl_get_plugin_filename (),
                     ssh_get_error (session_table[tbl_slot].session),
                     sftp_get_error (sftp));
        }
    }
  sftp_free (sftp);
 
write_ret:
 
  retc = alloc_typed_cell (CONST_INT);
  retc->x.i_val = rc;
  return retc;
}

References alloc_typed_cell(), CONST_INT, get_int_var_by_num(), TC::i_val, nasl_get_function_name(), nasl_get_plugin_filename(), session_table_item_s::session, session_table_item_s::session_id, session_table, session_table_item_s::verbose, verify_session_id(), and TC::x.

Here is the call graph for this function:

nasl_ssh_connect()

tree_cell * nasl_ssh_connect

(

lex_ctxt *

lexic

)

Connect to the target host via TCP and setup an ssh connection.

NASL Function: ssh_connect\n

If the named argument "socket" is given, that socket will be used instead of a creating a new TCP connection. If socket is not given or 0, the port is looked up in the preferences and the KB unless overridden by the named parameter "port".

On success an ssh session to the host has been established; the caller may then run an authentication function. If the connection is no longer needed, ssh_disconnect may be used to disconnect and close the socket.

NASL Named Parameters:\n

• socket If given, this socket will be used instead of creating a new connection.
• port A non-standard port to connect to. This is only used if socket is not given or 0.
• keytype List of the preferred server host key types. Example: "ssh-rsa,ssh-dss"
• csciphers SSH client-to-server ciphers.
• scciphers SSH server-to-client ciphers.
• timeout Set a timeout for the connection in seconds. Defaults to 10 seconds (defined by libssh internally) if not given.

NASL Returns:\n An integer to identify the ssh session. Zero on error.

Parameters

[in]

lexic

Lexical context of NASL interpreter.

Returns

On success the function returns a tree-cell with a non-zero integer identifying that ssh session; zero is returned on a connection error. In case of an internal error NULL is returned.

Definition at line 225 of file nasl_ssh.c.

{
  ssh_session session;
  tree_cell *retc;
  const char *key_type, *csciphers, *scciphers, *s;
  char ip_str[INET6_ADDRSTRLEN];
  int port, sock;
  unsigned int tbl_slot;
  int verbose = 0;
  int forced_sock = -1;
  long timeout; // in seconds
 
  sock = get_int_var_by_name (lexic, "socket", 0);
  if (sock)
    port = 0; /* The port is ignored if "socket" is given.  */
  else
    {
      port = get_int_var_by_name (lexic, "port", 0);
      if (port <= 0)
        port = get_ssh_port (lexic);
    }
 
  addr6_to_str (plug_get_host_ip (lexic->script_infos), ip_str);
  session = ssh_new ();
  if (!session)
    {
      g_message ("Function %s (calling internal function %s) called from %s: "
                 "Failed to allocate a new SSH session",
                 nasl_get_function_name () ? nasl_get_function_name ()
                                           : "script_main_function",
                 __func__, nasl_get_plugin_filename ());
      return NULL;
    }
 
  timeout = get_int_var_by_name (lexic, "timeout", 0);
  if (timeout > 0)
    if (ssh_options_set (session, SSH_OPTIONS_TIMEOUT, &timeout))
      {
        g_message (
          "Function %s called from %s: "
          "Failed to set the SSH connection timeout to %ld seconds: %s",
          nasl_get_function_name (), nasl_get_plugin_filename (), timeout,
          ssh_get_error (session));
        ssh_free (session);
        return NULL;
      }
 
  if ((s = getenv ("OPENVAS_LIBSSH_DEBUG")))
    {
      verbose = 1;
      if (*s)
        {
          int intval = atoi (s);
 
          ssh_options_set (session, SSH_OPTIONS_LOG_VERBOSITY, &intval);
        }
    }
 
  if (ssh_options_set (session, SSH_OPTIONS_HOST, ip_str))
    {
      g_message ("Function %s (calling internal function %s) called from %s: "
                 "Failed to set SSH hostname '%s': %s",
                 nasl_get_function_name () ? nasl_get_function_name ()
                                           : "script_main_function",
                 __func__, nasl_get_plugin_filename (), ip_str,
                 ssh_get_error (session));
      ssh_free (session);
      return NULL;
    }
 
  if (ssh_options_set (session, SSH_OPTIONS_KNOWNHOSTS, "/dev/null"))
    {
      g_message ("Function %s (calling internal function %s) called from %s: "
                 "Failed to disable SSH known_hosts: %s",
                 nasl_get_function_name () ? nasl_get_function_name ()
                                           : "script_main_function",
                 __func__, nasl_get_plugin_filename (),
                 ssh_get_error (session));
      ssh_free (session);
      return NULL;
    }
 
  key_type = get_str_var_by_name (lexic, "keytype");
 
  if (key_type && ssh_options_set (session, SSH_OPTIONS_HOSTKEYS, key_type))
    {
      g_message ("Function %s (calling internal function %s) called from %s: "
                 "Failed to set SSH key type '%s': %s",
                 nasl_get_function_name () ? nasl_get_function_name ()
                                           : "script_main_function",
                 __func__, nasl_get_plugin_filename (), key_type,
                 ssh_get_error (session));
      ssh_free (session);
      return NULL;
    }
 
  csciphers = get_str_var_by_name (lexic, "csciphers");
  if (csciphers
      && ssh_options_set (session, SSH_OPTIONS_CIPHERS_C_S, csciphers))
    {
      g_message ("Function %s (calling internal function %s) called from %s: "
                 "Failed to set SSH client to server ciphers '%s': %s",
                 nasl_get_function_name () ? nasl_get_function_name ()
                                           : "script_main_function",
                 __func__, nasl_get_plugin_filename (), csciphers,
                 ssh_get_error (session));
      ssh_free (session);
      return NULL;
    }
  scciphers = get_str_var_by_name (lexic, "scciphers");
  if (scciphers
      && ssh_options_set (session, SSH_OPTIONS_CIPHERS_S_C, scciphers))
    {
      g_message ("Function %s (calling internal function %s) called from %s: "
                 "Failed to set SSH server to client ciphers '%s': %s",
                 nasl_get_function_name () ? nasl_get_function_name ()
                                           : "script_main_function",
                 __func__, nasl_get_plugin_filename (), scciphers,
                 ssh_get_error (session));
      ssh_free (session);
      return NULL;
    }
 
  if (port)
    {
      unsigned int my_port = port;
 
      if (ssh_options_set (session, SSH_OPTIONS_PORT, &my_port))
        {
          g_message (
            "Function %s (calling internal function %s) called from %s: "
            "Failed to set SSH port for '%s' to %d: %s",
            nasl_get_function_name () ? nasl_get_function_name ()
                                      : "script_main_function",
            __func__, nasl_get_plugin_filename (), ip_str, port,
            ssh_get_error (session));
          ssh_free (session);
          return NULL;
        }
    }
  if (sock)
    {
      socket_t my_fd = openvas_get_socket_from_connection (sock);
 
      if (verbose)
        g_message ("Setting SSH fd for '%s' to %d (NASL sock=%d)", ip_str,
                   my_fd, sock);
      if (ssh_options_set (session, SSH_OPTIONS_FD, &my_fd))
        {
          g_message (
            "Function %s (calling internal function %s) called from %s: "
            "Failed to set SSH fd for '%s' to %d (NASL sock=%d): %s",
            nasl_get_function_name () ? nasl_get_function_name ()
                                      : "script_main_function",
            __func__, nasl_get_plugin_filename (), ip_str, my_fd, sock,
            ssh_get_error (session));
          ssh_free (session);
          return NULL;
        }
      /* Remember the NASL socket.  */
      forced_sock = sock;
    }
 
  /* Find a place in the table to save the session.  */
  for (tbl_slot = 0; tbl_slot < DIM (session_table); tbl_slot++)
    if (!session_table[tbl_slot].session_id)
      break;
  if (!(tbl_slot < DIM (session_table)))
    {
      if (verbose)
        g_message ("No space left in SSH session table");
      ssh_free (session);
      return NULL;
    }
 
  /* Prepare the session table entry.  */
  session_table[tbl_slot].session = session;
  session_table[tbl_slot].authmethods_valid = 0;
  session_table[tbl_slot].user_set = 0;
  session_table[tbl_slot].verbose = verbose;
 
  /* Connect to the host.  */
  if (verbose)
    g_message ("Connecting to SSH server '%s' (port %d, sock %d)", ip_str, port,
               sock);
  if (ssh_connect (session))
    {
      if (verbose)
        g_message ("Failed to connect to SSH server '%s'"
                   " (port %d, sock %d, f=%d): %s",
                   ip_str, port, sock, forced_sock, ssh_get_error (session));
      if (forced_sock != -1)
        {
          /* If the caller passed us a socket we can't call ssh_free
             on it because we expect the caller to close that socket
             himself.  Instead we need to setup a table entry so that
             it will then be close it via nasl_ssh_internal_close.  */
          session_table[tbl_slot].session_id = next_session_id ();
          session_table[tbl_slot].sock = forced_sock;
        }
      else
        ssh_free (session);
 
      /* return 0 to indicate the error.  */
      /* FIXME: Set the last error string.  */
      retc = alloc_typed_cell (CONST_INT);
      retc->x.i_val = 0;
      return retc;
    }
 
  /* How that we are connected, save the session.  */
  session_table[tbl_slot].session_id = next_session_id ();
  session_table[tbl_slot].sock =
    forced_sock != -1 ? forced_sock : ssh_get_fd (session);
  if (lowest_socket == 0 && session_table[tbl_slot].sock > 0)
    lowest_socket = session_table[tbl_slot].sock;
 
  /* Return the session id.  */
  retc = alloc_typed_cell (CONST_INT);
  retc->x.i_val = session_table[tbl_slot].session_id;
  return retc;
}

References alloc_typed_cell(), CONST_INT, DIM, get_int_var_by_name(), get_ssh_port(), get_str_var_by_name(), TC::i_val, lowest_socket, nasl_get_function_name(), nasl_get_plugin_filename(), next_session_id(), openvas_get_socket_from_connection(), plug_get_host_ip(), struct_lex_ctxt::script_infos, session_table_item_s::session, session_table_item_s::session_id, session_table, session_table_item_s::sock, session_table_item_s::verbose, and TC::x.

Here is the call graph for this function:

nasl_ssh_disconnect()

tree_cell * nasl_ssh_disconnect

(

lex_ctxt *

lexic

)

Disconnect an ssh connection.

NASL Function: ssh_disconnect\n

This function takes the ssh session id (as returned by ssh_connect) as its only unnamed argument. Passing 0 as session id is explicitly allowed and does nothing. If there are any open channels they are closed as well and their ids will be marked as invalid.

NASL Unnamed Parameters:\n

• An SSH session id. A value of 0 is allowed and acts as a NOP.

NASL Returns:\n Nothing

Parameters

[in]

lexic

Lexical context of NASL interpreter.

Returns

Nothing.

Definition at line 513 of file nasl_ssh.c.

{
  int tbl_slot;
  int session_id;
 
  session_id = get_int_var_by_num (lexic, 0, -1);
  if (!verify_session_id (session_id, NULL, &tbl_slot, lexic))
    return FAKE_CELL;
  do_nasl_ssh_disconnect (tbl_slot);
  return FAKE_CELL;
}

References do_nasl_ssh_disconnect(), FAKE_CELL, get_int_var_by_num(), session_table_item_s::session_id, and verify_session_id().

Here is the call graph for this function:

nasl_ssh_exec()

tree_cell * nasl_ssh_exec

(

lex_ctxt *

)

nasl_ssh_execute_netconf_subsystem()

tree_cell * nasl_ssh_execute_netconf_subsystem

(

lex_ctxt *

lexic

)

Excecute the NETCONF subsystem on the the ssh channel.

NASL Function: ssh_execute_netconf_subsystem\n

NASL Unnamed Parameters:\n

• An SSH session id.

NASL Returns:\n An int on success or NULL on error.

Parameters

[in]

lexic

Lexical context of NASL interpreter.

Returns

Session ID on success, NULL on failure.

Definition at line 2060 of file nasl_ssh.c.

{
  int tbl_slot, session_id;
  ssh_channel channel;
  ssh_session session;
  tree_cell *retc;
 
  session_id = get_int_var_by_num (lexic, 0, -1);
 
  if (!verify_session_id (session_id, "ssh_execute_netconf_subsystem",
                          &tbl_slot, lexic))
    return NULL;
  session = session_table[tbl_slot].session;
  channel = ssh_channel_new (session);
  if (!channel)
    return NULL;
 
  if (ssh_channel_open_session (channel))
    {
      /* FIXME: Handle SSH_AGAIN.  */
      g_message ("ssh_channel_open_session failed: %s",
                 ssh_get_error (session));
      ssh_channel_free (channel);
      retc = alloc_typed_cell (CONST_INT);
      retc->x.i_val = SSH_ERROR;
      return retc;
    }
 
  int err;
  if ((err = ssh_channel_request_subsystem (channel, "netconf")) < 0)
    {
      g_message ("%s Could not execute netconf subsystem", __func__);
      retc = alloc_typed_cell (CONST_INT);
      retc->x.i_val = err;
      return retc;
    }
 
  if (session_table[tbl_slot].channel)
    ssh_channel_free (session_table[tbl_slot].channel);
  session_table[tbl_slot].channel = channel;
 
  retc = alloc_typed_cell (CONST_INT);
  retc->x.i_val = session_table[tbl_slot].session_id;
  return retc;
}

References alloc_typed_cell(), session_table_item_s::channel, CONST_INT, get_int_var_by_num(), TC::i_val, session_table_item_s::session, session_table_item_s::session_id, session_table, verify_session_id(), and TC::x.

Here is the call graph for this function:

nasl_ssh_get_auth_methods()

tree_cell * nasl_ssh_get_auth_methods

(

lex_ctxt *

lexic

)

Get the list of authmethods.

NASL Function: ssh_get_auth_methods\n

The function returns a string with comma separated authentication methods. This is basically the same as returned by SSH_MSG_USERAUTH_FAILURE protocol element; however, it has been screened and put into a definitive order.

NASL Unnamed Parameters:\n

• An SSH session id.

NASL Returns:\n A string on success or NULL on error.

Parameters

[in]

lexic

Lexical context of NASL interpreter.

Returns

A string is returned on success. NULL indicates that the connection has not yet been established.

Definition at line 1605 of file nasl_ssh.c.

{
  int tbl_slot, methods, session_id;
  GString *buffer;
  char *p;
  tree_cell *retc;
 
  session_id = get_int_var_by_num (lexic, 0, -1);
  if (!verify_session_id (session_id, "ssh_get_auth_methods", &tbl_slot, lexic))
    return NULL;
 
  if (!session_table[tbl_slot].user_set && !nasl_ssh_set_login (lexic))
    return NULL;
  if (!session_table[tbl_slot].authmethods_valid)
    get_authmethods (tbl_slot);
 
  methods = session_table[tbl_slot].authmethods;
 
  buffer = g_string_sized_new (128);
  if ((methods & SSH_AUTH_METHOD_NONE))
    g_string_comma_str (buffer, "none");
  if ((methods & SSH_AUTH_METHOD_PASSWORD))
    g_string_comma_str (buffer, "password");
  if ((methods & SSH_AUTH_METHOD_PUBLICKEY))
    g_string_comma_str (buffer, "publickey");
  if ((methods & SSH_AUTH_METHOD_HOSTBASED))
    g_string_comma_str (buffer, "hostbased");
  if ((methods & SSH_AUTH_METHOD_INTERACTIVE))
    g_string_comma_str (buffer, "keyboard-interactive");
  g_string_append_c (buffer, 0x00);
  p = g_string_free (buffer, FALSE);
  if (!p)
    return NULL;
 
  retc = alloc_typed_cell (CONST_DATA);
  retc->x.str_val = p;
  retc->size = strlen (p);
  return retc;
}

References alloc_typed_cell(), session_table_item_s::authmethods_valid, CONST_DATA, g_string_comma_str(), get_authmethods(), get_int_var_by_num(), nasl_ssh_set_login(), session_table_item_s::session_id, session_table, TC::size, TC::str_val, session_table_item_s::user_set, verify_session_id(), and TC::x.

Here is the call graph for this function:

nasl_ssh_get_host_key()

tree_cell * nasl_ssh_get_host_key

(

lex_ctxt *

lexic

)

Get the host key.

NASL Function: ssh_get_host_key\n

The function returns a string with the MD5 host key. *

NASL Unnamed Parameters:\n

• An SSH session id.

NASL Returns:\n A data block on success or NULL on error.

Parameters

[in]

lexic

Lexical context of NASL interpreter.

Returns

A string is returned on success. NULL indicates that the connection has not yet been established.

Definition at line 1561 of file nasl_ssh.c.

{
  int tbl_slot, session_id;
  ssh_session session;
  ssh_string sstring;
  tree_cell *retc;
 
  session_id = get_int_var_by_num (lexic, 0, -1);
  if (!verify_session_id (session_id, "ssh_get_host_key", &tbl_slot, lexic))
    return NULL;
  session = session_table[tbl_slot].session;
 
  sstring = ssh_get_pubkey (session);
  if (!sstring)
    return NULL;
 
  retc = alloc_typed_cell (CONST_DATA);
  retc->x.str_val = ssh_string_to_char (sstring);
  retc->size = ssh_string_len (sstring);
  ssh_string_free (sstring);
  return retc;
}

References alloc_typed_cell(), CONST_DATA, get_int_var_by_num(), session_table_item_s::session, session_table_item_s::session_id, session_table, TC::size, TC::str_val, verify_session_id(), and TC::x.

Here is the call graph for this function:

nasl_ssh_get_issue_banner()

tree_cell * nasl_ssh_get_issue_banner

(

lex_ctxt *

lexic

)

Get the issue banner.

NASL Function: ssh_get_issue_banner\n

The function returns a string with the issue banner. This is usually displayed before authentication.

NASL Unnamed Parameters:\n

• An SSH session id.

NASL Returns:\n A data block on success or NULL on error.

Parameters

[in]

lexic

Lexical context of NASL interpreter.

Returns

A string is returned on success. NULL indicates that the server did not send a banner or that the connection has not yet been established.

Definition at line 1471 of file nasl_ssh.c.

{
  int tbl_slot, session_id;
  ssh_session session;
  char *banner;
  tree_cell *retc;
 
  session_id = get_int_var_by_num (lexic, 0, -1);
  if (!verify_session_id (session_id, "ssh_get_issue_banner", &tbl_slot, lexic))
    return NULL;
  session = session_table[tbl_slot].session;
 
  /* We need to make sure that we got the auth methods so that libssh
     has the banner.  */
  if (!session_table[tbl_slot].user_set && !nasl_ssh_set_login (lexic))
    return NULL;
  if (!session_table[tbl_slot].authmethods_valid)
    get_authmethods (tbl_slot);
 
  banner = ssh_get_issue_banner (session);
  if (!banner)
    return NULL;
 
  retc = alloc_typed_cell (CONST_DATA);
  retc->x.str_val = g_strdup (banner);
  retc->size = strlen (banner);
  ssh_string_free_char (banner);
  return retc;
}

References alloc_typed_cell(), session_table_item_s::authmethods_valid, CONST_DATA, get_authmethods(), get_int_var_by_num(), nasl_ssh_set_login(), session_table_item_s::session, session_table_item_s::session_id, session_table, TC::size, TC::str_val, session_table_item_s::user_set, verify_session_id(), and TC::x.

Here is the call graph for this function:

nasl_ssh_get_server_banner()

tree_cell * nasl_ssh_get_server_banner

(

lex_ctxt *

lexic

)

Get the server banner.

NASL Function: ssh_get_server_banner\n

The function returns a string with the server banner. This is usually the first data sent by the server.

NASL Unnamed Parameters:\n

• An SSH session id.

NASL Returns:\n A data block on success or NULL on error.

Parameters

[in]

lexic

Lexical context of NASL interpreter.

Returns

A string is returned on success. NULL indicates that the connection has not yet been established.

Definition at line 1520 of file nasl_ssh.c.

{
  int tbl_slot, session_id;
  ssh_session session;
  const char *banner;
  tree_cell *retc;
 
  session_id = get_int_var_by_num (lexic, 0, -1);
  if (!verify_session_id (session_id, "ssh_get_server_banner", &tbl_slot,
                          lexic))
    return NULL;
  session = session_table[tbl_slot].session;
 
  banner = ssh_get_serverbanner (session);
  if (!banner)
    return NULL;
 
  retc = alloc_typed_cell (CONST_DATA);
  retc->x.str_val = g_strdup (banner);
  retc->size = strlen (banner);
  return retc;
}

References alloc_typed_cell(), CONST_DATA, get_int_var_by_num(), session_table_item_s::session, session_table_item_s::session_id, session_table, TC::size, TC::str_val, verify_session_id(), and TC::x.

Here is the call graph for this function:

nasl_ssh_get_sock()

tree_cell * nasl_ssh_get_sock

(

lex_ctxt *

lexic

)

Given a session id, return the corresponding socket.

NASL Function: ssh_get_sock\n

The socket is either a native file descriptor or a NASL connection socket (if a open socket was passed to ssh_connect). The NASL network code handles both of them.

NASL Unnamed Parameters:\n

• An SSH session id.

NASL Returns:\n An integer representing the socket or -1 on error.

Parameters

[in]

lexic

Lexical context of NASL interpreter.

Returns

The socket or -1 on error.

Definition at line 621 of file nasl_ssh.c.

{
  int tbl_slot, sock, session_id;
  tree_cell *retc;
 
  session_id = get_int_var_by_num (lexic, 0, -1);
  if (!verify_session_id (session_id, "ssh_get_sock", &tbl_slot, lexic))
    sock = -1;
  else
    sock = session_table[tbl_slot].sock;
 
  retc = alloc_typed_cell (CONST_INT);
  retc->x.i_val = sock;
  return retc;
}

References alloc_typed_cell(), CONST_INT, get_int_var_by_num(), TC::i_val, session_table_item_s::session_id, session_table, session_table_item_s::sock, verify_session_id(), and TC::x.

Here is the call graph for this function:

nasl_ssh_login_interactive()

tree_cell * nasl_ssh_login_interactive

(

lex_ctxt *

lexic

)

Authenticate a user on an ssh connection.

NASL Function: ssh_login_intenteractive\n

The function starts the authentication process and pauses it when it finds the first non-echo prompt. The function expects the session id as its first unnamed argument. The first time this function is called for a session id, the named argument "login" is also expected.

NASL Unnamed Parameters:\n

• An SSH session id.

NASL Named Parameters:\n

• login A string with the login name.

NASL Returns:\n A data block on success or NULL on error.

Parameters

[in]

lexic

Lexical context of NASL interpreter.

Returns

A string containing the prompt is returned on success. NULL indicates that the error.

Definition at line 1016 of file nasl_ssh.c.

{
  int tbl_slot;
  int session_id;
  ssh_session session;
  const char *s = NULL;
  int methods;
  int verbose;
 
  session_id = get_int_var_by_num (lexic, 0, -1);
  if (!verify_session_id (session_id, "ssh_login_interactive", &tbl_slot,
                          lexic))
    return NULL; /* Ooops.  */
  session = session_table[tbl_slot].session;
  verbose = session_table[tbl_slot].verbose;
 
  /* Check if we need to set the user.  This is done only once per
     session.  */
  if (!session_table[tbl_slot].user_set && !nasl_ssh_set_login (lexic))
    return NULL;
 
  /* Get the authentication methods only once per session.  */
  if (!session_table[tbl_slot].authmethods_valid)
    {
      if (!get_authmethods (tbl_slot))
        {
          s = g_strdup ("");
          goto leave;
        }
    }
  methods = session_table[tbl_slot].authmethods;
 
  if (methods & SSH_AUTH_METHOD_INTERACTIVE)
    {
      /* Our strategy for kbint is to send the password to the first
         prompt marked as non-echo.  */
 
      while (ssh_userauth_kbdint (session, NULL, NULL) == SSH_AUTH_INFO)
        {
          int n, nprompt;
          char echoflag;
          int found_prompt = 0;
 
          if (verbose)
            {
              s = ssh_userauth_kbdint_getname (session);
              if (s && *s)
                g_message ("SSH kbdint name='%s'", s);
              s = ssh_userauth_kbdint_getinstruction (session);
              if (s && *s)
                g_message ("SSH kbdint instruction='%s'", s);
            }
 
          nprompt = ssh_userauth_kbdint_getnprompts (session);
          for (n = 0; n < nprompt; n++)
            {
              s = ssh_userauth_kbdint_getprompt (session, n, &echoflag);
              if (s && *s && verbose)
                g_message ("SSH kbdint prompt='%s'%s", s,
                           echoflag ? "" : " [hide input]");
              if (s && *s && !echoflag && !found_prompt)
                goto leave;
            }
        }
      if (verbose)
        g_message (
          "SSH keyboard-interactive authentication failed for session %d"
          ": %s",
          session_id, ssh_get_error (session));
    }
 
  if (!s)
    return NULL;
 
leave:
  {
    tree_cell *retc;
 
    retc = alloc_typed_cell (CONST_DATA);
    retc->x.str_val = g_strdup (s);
    retc->size = strlen (s);
    return retc;
  }
}

References alloc_typed_cell(), session_table_item_s::authmethods_valid, CONST_DATA, get_authmethods(), get_int_var_by_num(), nasl_ssh_set_login(), session_table_item_s::session, session_table_item_s::session_id, session_table, TC::size, TC::str_val, session_table_item_s::user_set, session_table_item_s::verbose, verify_session_id(), and TC::x.

Here is the call graph for this function:

nasl_ssh_login_interactive_pass()

tree_cell * nasl_ssh_login_interactive_pass

(

lex_ctxt *

lexic

)

Authenticate a user on an ssh connection.

NASL Function: ssh_login_intenteractive_pass\n

The function finishes the authentication process started by ssh_login_interactive. The function expects the session id as its first unnamed argument.

To finish the password, the named argument "password" must contain a password.

NASL Unnamed Parameters:\n

• An SSH session id.

NASL Named Parameters:\n

• password A string with the password.

NASL Returns:\n An integer as status value; 0 indicates success.

Parameters

[in]

lexic

Lexical context of NASL interpreter.

Returns

An integer is returned on success. -1 indicates an error.

Definition at line 1128 of file nasl_ssh.c.

{
  int tbl_slot;
  int session_id;
  ssh_session session;
  const char *password = NULL;
  int rc;
  int retc_val = -1;
  int verbose;
 
  session_id = get_int_var_by_num (lexic, 0, -1);
  if (!verify_session_id (session_id, "ssh_login_interactive_pass", &tbl_slot,
                          lexic))
    return NULL; /* Ooops.  */
  session = session_table[tbl_slot].session;
  verbose = session_table[tbl_slot].verbose;
 
  /* A prompt is waiting for the password. */
  if ((password = get_str_var_by_name (lexic, "password")) == NULL)
    return NULL;
 
  rc = ssh_userauth_kbdint_setanswer (session, 0, password);
 
  if (rc < 0)
    {
      if (verbose)
        g_message ("SSH keyboard-interactive authentication "
                   "failed at prompt %d for session %d: %s",
                   0, session_id, ssh_get_error (session));
      retc_val = -1;
      goto leave;
    }
 
  if (rc == 0)
    {
      /* I need to do that to finish the auth process. */
      while ((rc = ssh_userauth_kbdint (session, NULL, NULL)) == SSH_AUTH_INFO)
        {
          ssh_userauth_kbdint_getnprompts (session);
        }
      if (rc == SSH_AUTH_SUCCESS)
        {
          retc_val = 0;
          goto leave;
        }
      if (rc != SSH_AUTH_SUCCESS)
        {
          retc_val = -1;
          goto leave;
        }
    }
 
leave:
  {
    tree_cell *retc;
 
    retc = alloc_typed_cell (CONST_INT);
    retc->x.i_val = retc_val;
    return retc;
  }
}

References alloc_typed_cell(), CONST_INT, get_int_var_by_num(), get_str_var_by_name(), TC::i_val, session_table_item_s::session, session_table_item_s::session_id, session_table, session_table_item_s::verbose, verify_session_id(), and TC::x.

Here is the call graph for this function:

nasl_ssh_request_exec()

tree_cell * nasl_ssh_request_exec

(

lex_ctxt *

lexic

)

Run a command via ssh.

NASL Function: ssh_request_exec\n

The function opens a channel to the remote end and ask it to execute a command. The output of the command is then returned as a data block. The first unnamed argument is the session id. The command itself is expected as string in the named argument "cmd".

Regarding the handling of the stderr and stdout stream, this function may be used in different modes.

If either the named arguments stdout or stderr are given and that one is set to 1, only the output of the specified stream is returned.

If stdout and stderr are both given and set to 1, the output of both is returned interleaved. NOTE: The following feature has not yet been implemented: The output is guaranteed not to switch between stderr and stdout within a line.

If stdout and stderr are both given but set to 0, a special backward compatibility mode is used: First all output to stderr is collected up until any output to stdout is received. Then all output to stdout is returned while ignoring all further stderr output; at EOF the initial collected data from stderr is returned.

If the named parameters stdout and stderr are not given, the function acts exactly as if only stdout has been set to 1.

NASL Unnamed Parameters:\n

• An SSH session id.

NASL Named Parameters:\n

• cmd A string with the command to execute.
• stdout An integer with value 0 or 1; see above for a full description.
• stderr An integer with value 0 or 1; see above for a full description.

NASL Returns:\n A data block on success or NULL on error.

Parameters

[in]

lexic

Lexical context of NASL interpreter.

Returns

A data/string is returned on success. NULL indicates an error.

Definition at line 1345 of file nasl_ssh.c.

{
  int tbl_slot;
  int session_id;
  ssh_session session;
  int verbose;
  char *cmd;
  int rc;
  GString *response;
  GString *compat_buf = NULL;
  size_t len = 0;
  tree_cell *retc;
  char *p;
  int to_stdout, to_stderr, compat_mode, compat_buf_inuse;
 
  session_id = get_int_var_by_num (lexic, 0, -1);
  if (!verify_session_id (session_id, "ssh_request_exec", &tbl_slot, lexic))
    return NULL;
  session = session_table[tbl_slot].session;
 
  verbose = session_table[tbl_slot].verbose;
 
  cmd = get_str_var_by_name (lexic, "cmd");
  if (!cmd || !*cmd)
    {
      g_message ("Function %s (calling internal function %s) called from %s: "
                 "No command passed",
                 nasl_get_function_name () ? nasl_get_function_name ()
                                           : "script_main_function",
                 __func__, nasl_get_plugin_filename ());
      return NULL;
    }
 
  to_stdout = get_int_var_by_name (lexic, "stdout", -1);
  to_stderr = get_int_var_by_name (lexic, "stderr", -1);
  compat_mode = 0;
  if (to_stdout == -1 && to_stderr == -1)
    {
      /* None of the two named args are given.  */
      to_stdout = 1;
    }
  else if (to_stdout == 0 && to_stderr == 0)
    {
      /* Compatibility mode.  */
      to_stdout = 1;
      compat_mode = 1;
    }
 
  if (to_stdout < 0)
    to_stdout = 0;
  if (to_stderr < 0)
    to_stderr = 0;
 
  /* Allocate some space in advance.  Most commands won't output too
     much and thus 512 bytes (6 standard terminal lines) should often
     be sufficient.  */
  response = g_string_sized_new (512);
  if (compat_mode)
    {
      compat_buf = g_string_sized_new (512);
      compat_buf_inuse = 1;
    }
  else
    compat_buf_inuse = 0;
 
  rc = exec_ssh_cmd (session, cmd, verbose, compat_mode, to_stdout, to_stderr,
                     response, compat_buf);
  if (rc == SSH_ERROR)
    {
      if (compat_buf_inuse)
        g_string_free (compat_buf, TRUE);
      g_string_free (response, TRUE);
      return NULL;
    }
 
  /* Append the compatibility buffer to the output.  */
  if (compat_buf_inuse)
    {
      len = compat_buf->len;
      p = g_string_free (compat_buf, FALSE);
      if (p)
        {
          g_string_append_len (response, p, len);
          g_free (p);
        }
    }
 
  /* Return the the output.  */
  len = response->len;
  p = g_string_free (response, FALSE);
  if (!p)
    {
      g_message ("Function %s (calling internal function %s) called from %s: "
                 "memory problem: %s",
                 nasl_get_function_name () ? nasl_get_function_name ()
                                           : "script_main_function",
                 __func__, nasl_get_plugin_filename (), strerror (-1));
      return NULL;
    }
 
  retc = alloc_typed_cell (CONST_DATA);
  retc->size = len;
  retc->x.str_val = p;
  return retc;
}

References alloc_typed_cell(), CONST_DATA, exec_ssh_cmd(), get_int_var_by_name(), get_int_var_by_num(), get_str_var_by_name(), len, nasl_get_function_name(), nasl_get_plugin_filename(), session_table_item_s::session, session_table_item_s::session_id, session_table, TC::size, TC::str_val, session_table_item_s::verbose, verify_session_id(), and TC::x.

Here is the call graph for this function:

nasl_ssh_session_id_from_sock()

tree_cell * nasl_ssh_session_id_from_sock

(

lex_ctxt *

lexic

)

Given a socket, return the corresponding session id.

NASL Function: ssh_session_id_from_sock\n

NASL Unnamed Parameters:\n

• A NASL socket value

NASL Returns:\n An integer with the corresponding ssh session id or 0 if

no session id is known for the given socket.

Parameters

[in]

lexic

Lexical context of NASL interpreter.

Returns

The session id on success or 0 if not found.

Definition at line 578 of file nasl_ssh.c.

{
  int sock, session_id;
  unsigned int tbl_slot;
  tree_cell *retc;
 
  session_id = 0;
  sock = get_int_var_by_num (lexic, 0, -1);
  if (sock != -1)
    {
      for (tbl_slot = 0; tbl_slot < DIM (session_table); tbl_slot++)
        if (session_table[tbl_slot].sock == sock
            && session_table[tbl_slot].session_id)
          {
            session_id = session_table[tbl_slot].session_id;
            break;
          }
    }
 
  retc = alloc_typed_cell (CONST_INT);
  retc->x.i_val = session_id;
  return retc;
}

References alloc_typed_cell(), CONST_INT, DIM, get_int_var_by_num(), TC::i_val, session_table_item_s::session_id, session_table, session_table_item_s::sock, and TC::x.

Here is the call graph for this function:

nasl_ssh_set_login()

tree_cell * nasl_ssh_set_login

(

lex_ctxt *

lexic

)

Set the login name for the authentication.

NASL Function: ssh_set_login\n

This is an optional function and usuallay not required. However, if you want to get the banner before starting the authentication, you need to tell libssh the user because it is often not possible to change the user after the first call to an authentication methods - getting the banner uses an authentication function.

The named argument "login" is used for the login name; it defaults the KB entry "Secret/SSH/login". It should contain the user name to login. Given that many servers don't allow changing the login for an established connection, the "login" parameter is silently ignored on all further calls.

NASL Unnamed Parameters:\n

• An SSH session id.

NASL Named Parameters:\n

• login A string with the login name (optional).

NASL Returns:\n None

Parameters

[in]

lexic

Lexical context of NASL interpreter.

Returns

none.

Definition at line 728 of file nasl_ssh.c.

{
  int tbl_slot, session_id;
 
  session_id = get_int_var_by_num (lexic, 0, -1);
  if (!verify_session_id (session_id, "ssh_set_login", &tbl_slot, lexic))
    return NULL; /* Ooops.  */
  if (!session_table[tbl_slot].user_set)
    {
      ssh_session session = session_table[tbl_slot].session;
      kb_t kb;
      char *username;
 
      username = g_strdup (get_str_var_by_name (lexic, "login"));
      if (!username)
        {
          kb = plug_get_kb (lexic->script_infos);
          username = kb_item_get_str (kb, "Secret/SSH/login");
        }
      if (username && *username
          && ssh_options_set (session, SSH_OPTIONS_USER, username))
        {
          g_message (
            "Function %s (calling internal function %s) called from %s: "
            "Failed to set SSH username '%s': %s",
            nasl_get_function_name () ? nasl_get_function_name ()
                                      : "script_main_function",
            __func__, nasl_get_plugin_filename (), username,
            ssh_get_error (session));
          g_free (username);
          return NULL; /* Ooops.  */
        }
      /* In any case mark the user has set.  */
      session_table[tbl_slot].user_set = 1;
      g_free (username);
    }
  return FAKE_CELL;
}

References FAKE_CELL, get_int_var_by_num(), get_str_var_by_name(), nasl_get_function_name(), nasl_get_plugin_filename(), plug_get_kb(), struct_lex_ctxt::script_infos, session_table_item_s::session, session_table_item_s::session_id, session_table, session_table_item_s::user_set, and verify_session_id().

Referenced by nasl_ssh_get_auth_methods(), nasl_ssh_get_issue_banner(), nasl_ssh_login_interactive(), and nasl_ssh_userauth().

Here is the call graph for this function:

Here is the caller graph for this function:

nasl_ssh_shell_close()

tree_cell * nasl_ssh_shell_close

(

lex_ctxt *

lexic

)

Close an ssh shell.

NASL Function: ssh_shell_close\n

NASL Unnamed Parameters:\n

• An SSH session id.

Parameters

[in]

lexic

Lexical context of NASL interpreter.

Definition at line 1958 of file nasl_ssh.c.

{
  int tbl_slot, session_id;
 
  session_id = get_int_var_by_num (lexic, 0, -1);
  if (!verify_session_id (session_id, "ssh_shell_close", &tbl_slot, lexic))
    return NULL;
  if (session_table[tbl_slot].channel)
    {
      ssh_channel_free (session_table[tbl_slot].channel);
      session_table[tbl_slot].channel = NULL;
    }
 
  return NULL;
}

References session_table_item_s::channel, get_int_var_by_num(), session_table_item_s::session_id, session_table, and verify_session_id().

Here is the call graph for this function:

nasl_ssh_shell_open()

tree_cell * nasl_ssh_shell_open

(

lex_ctxt *

lexic

)

Request an ssh shell.

NASL Function: ssh_shell_open\n

NASL Unnamed Parameters:\n

• An SSH session id.

NASL Named Parameters:\n

• pty To enable/disable the interactive shell. Default is 1 (interactive).

NASL Returns:\n An int on success or NULL on error.

Parameters

[in]

lexic

Lexical context of NASL interpreter.

Returns

Session ID on success, NULL on failure.

Definition at line 1705 of file nasl_ssh.c.

{
  int tbl_slot, session_id, pty;
  ssh_channel channel;
  ssh_session session;
  tree_cell *retc;
 
  session_id = get_int_var_by_num (lexic, 0, -1);
  pty = get_int_var_by_name (lexic, "pty", 1);
 
  if (!verify_session_id (session_id, "ssh_shell_open", &tbl_slot, lexic))
    return NULL;
  session = session_table[tbl_slot].session;
  channel = ssh_channel_new (session);
  if (!channel)
    return NULL;
  if (ssh_channel_open_session (channel))
    {
      g_message ("Function %s (calling internal function %s) called from %s: "
                 "ssh_channel_open_session: %s",
                 nasl_get_function_name () ? nasl_get_function_name ()
                                           : "script_main_function",
                 __func__, nasl_get_plugin_filename (),
                 ssh_get_error (session));
      ssh_channel_free (channel);
      return NULL;
    }
 
  if (request_ssh_shell (channel, pty))
    {
      g_message ("Function %s (calling internal function %s) called from %s: "
                 "request_ssh_shell: %s",
                 nasl_get_function_name () ? nasl_get_function_name ()
                                           : "script_main_function",
                 __func__, nasl_get_plugin_filename (),
                 ssh_get_error (session));
      ssh_channel_free (channel);
      return NULL;
    }
  if (session_table[tbl_slot].channel)
    ssh_channel_free (session_table[tbl_slot].channel);
  session_table[tbl_slot].channel = channel;
 
  retc = alloc_typed_cell (CONST_INT);
  retc->x.i_val = session_table[tbl_slot].session_id;
  return retc;
}

References alloc_typed_cell(), session_table_item_s::channel, CONST_INT, get_int_var_by_name(), get_int_var_by_num(), TC::i_val, nasl_get_function_name(), nasl_get_plugin_filename(), request_ssh_shell(), session_table_item_s::session, session_table_item_s::session_id, session_table, verify_session_id(), and TC::x.

Here is the call graph for this function:

nasl_ssh_shell_read()

tree_cell * nasl_ssh_shell_read

(

lex_ctxt *

lexic

)

Read the output of an ssh shell.

NASL Function: ssh_shell_read\n

NASL Unnamed Parameters:\n

• An SSH session id.

@naslparam timeout

• Enable the blocking ssh read until it gives the timeout or there is no bytes left to read.

NASL Returns:\n A string on success or NULL on error.

Parameters

[in]

lexic

Lexical context of NASL interpreter.

Returns

Data read from shell on success, NULL on failure.

Definition at line 1850 of file nasl_ssh.c.

{
  int tbl_slot, session_id;
  ssh_channel channel;
  tree_cell *retc;
  GString *response;
  int timeout;
 
  session_id = get_int_var_by_num (lexic, 0, -1);
  if (!verify_session_id (session_id, "ssh_shell_read", &tbl_slot, lexic))
    return NULL;
  channel = session_table[tbl_slot].channel;
 
  response = g_string_new (NULL);
 
  timeout = get_int_var_by_name (lexic, "timeout", 0);
 
  if (timeout > 0)
    {
      if (read_ssh_blocking (channel, response, timeout))
        return NULL;
    }
  else
    {
      if (read_ssh_nonblocking (channel, response))
        return NULL;
    }
  retc = alloc_typed_cell (CONST_DATA);
  retc->size = response->len;
  retc->x.str_val = g_string_free (response, FALSE);
  return retc;
}

References alloc_typed_cell(), session_table_item_s::channel, CONST_DATA, get_int_var_by_name(), get_int_var_by_num(), read_ssh_blocking(), read_ssh_nonblocking(), session_table_item_s::session_id, session_table, TC::size, TC::str_val, verify_session_id(), and TC::x.

Here is the call graph for this function:

nasl_ssh_shell_write()

tree_cell * nasl_ssh_shell_write

(

lex_ctxt *

lexic

)

Write string to ssh shell.

NASL Function: ssh_shell_write\n

NASL Unnamed Parameters:\n

• An SSH session id.

NASL Named Parameters:\n

• cmd A string to write to shell.

NASL Returns:\n An integer: 0 on success, -1 on failure.

Parameters

[in]

lexic

Lexical context of NASL interpreter.

Returns

0 on success, -1 on failure.

Definition at line 1902 of file nasl_ssh.c.

{
  int tbl_slot, rc = -1, len, session_id;
  ssh_channel channel;
  tree_cell *retc;
  char *cmd;
 
  session_id = get_int_var_by_num (lexic, 0, -1);
  if (!verify_session_id (session_id, "ssh_shell_write", &tbl_slot, lexic))
    goto write_ret;
  if (!(channel = session_table[tbl_slot].channel))
    {
      g_message ("ssh_shell_write: No shell channel found");
      goto write_ret;
    }
 
  cmd = get_str_var_by_name (lexic, "cmd");
  if (!cmd || !*cmd)
    {
      g_message ("Function %s (calling internal function %s) called from %s: "
                 "No command passed",
                 nasl_get_function_name () ? nasl_get_function_name ()
                                           : "script_main_function",
                 __func__, nasl_get_plugin_filename ());
      goto write_ret;
    }
  len = strlen (cmd);
  if (ssh_channel_write (channel, cmd, len) != len)
    {
      g_message (
        "Function %s (calling internal function %s) called from %s: %s",
        nasl_get_function_name () ? nasl_get_function_name ()
                                  : "script_main_function",
        __func__, nasl_get_plugin_filename (),
        ssh_get_error (session_table[tbl_slot].session));
      goto write_ret;
    }
  rc = 0;
 
write_ret:
  retc = alloc_typed_cell (CONST_INT);
  retc->x.i_val = rc;
  return retc;
}

References alloc_typed_cell(), session_table_item_s::channel, CONST_INT, get_int_var_by_num(), get_str_var_by_name(), TC::i_val, len, nasl_get_function_name(), nasl_get_plugin_filename(), session_table_item_s::session, session_table_item_s::session_id, session_table, verify_session_id(), and TC::x.

Here is the call graph for this function:

nasl_ssh_userauth()

tree_cell * nasl_ssh_userauth

(

lex_ctxt *

lexic

)

Authenticate a user on an ssh connection.

NASL Function: ssh_userauth\n

The function expects the session id as its first unnamed argument. The first time this function is called for a session id, the named argument "login" is also expected; it defaults the KB entry "Secret/SSH/login". It should contain the user name to login. Given that many servers don't allow changing the login for an established connection, the "login" parameter is silently ignored on all further calls.

To perform a password based authentication, the named argument "password" must contain a password.

To perform a public key based authentication, the named argument "privatekey" must contain a base64 encoded private key in ssh native or in PKCS#8 format.

If both, "password" and "privatekey" are given as named arguments only "password" is used. If neither are given the values are taken from the KB ("Secret/SSH/password" and "Secret/SSH/privatekey") and tried in the order {password, privatekey}. Note well, that if one of the named arguments are given, only those are used and the KB is not consulted.

If the private key is protected, its passphrase is taken from the named argument "passphrase" or, if not given, taken from the KB ("Secret/SSH/passphrase").

Note that the named argument "publickey" and the KB item ("Secret/SSH/publickey") are ignored - they are not longer required because they can be derived from the private key.

NASL Unnamed Parameters:\n

• An SSH session id.

NASL Named Parameters:\n

• login A string with the login name.
• password A string with the password.
• privatekey A base64 encoded private key in ssh native or in pkcs#8 format. This parameter is ignored if password is given.
• passphrase A string with the passphrase used to unprotect privatekey.

NASL Returns:\n An integer as status value; 0 indicates success.

Parameters

[in]

lexic

Lexical context of NASL interpreter.

Returns

0 is returned on success. Any other value indicates an error.

Definition at line 825 of file nasl_ssh.c.

{
  int rc, retc_val = -1, methods, verbose, tbl_slot, session_id;
  ssh_session session;
  char *password = NULL;
  char *privkeystr = NULL;
  char *privkeypass = NULL;
  kb_t kb;
  tree_cell *retc;
 
  session_id = get_int_var_by_num (lexic, 0, -1);
  if (!verify_session_id (session_id, "ssh_userauth", &tbl_slot, lexic))
    return NULL; /* Ooops.  */
  session = session_table[tbl_slot].session;
  verbose = session_table[tbl_slot].verbose;
 
  /* Check if we need to set the user.  This is done only once per
     session.  */
  if (!session_table[tbl_slot].user_set && !nasl_ssh_set_login (lexic))
    return NULL;
 
  kb = plug_get_kb (lexic->script_infos);
  password = g_strdup (get_str_var_by_name (lexic, "password"));
  privkeystr = g_strdup (get_str_var_by_name (lexic, "privatekey"));
  privkeypass = g_strdup (get_str_var_by_name (lexic, "passphrase"));
  if (!password && !privkeystr && !privkeypass)
    {
      password = kb_item_get_str (kb, "Secret/SSH/password");
      privkeystr = kb_item_get_str (kb, "Secret/SSH/privatekey");
      privkeypass = kb_item_get_str (kb, "Secret/SSH/passphrase");
    }
 
  /* Get the authentication methods only once per session.  */
  if (!session_table[tbl_slot].authmethods_valid)
    {
      if (!get_authmethods (tbl_slot))
        {
          retc_val = 0;
          goto leave;
        }
    }
  methods = session_table[tbl_slot].authmethods;
 
  /* Check whether a password has been given.  If so, try to
     authenticate using that password.  Note that the OpenSSH client
     uses a different order it first tries the public key and then the
     password.  However, the old NASL SSH protocol implementation tries
     the password before the public key authentication.  Because we
     want to be compatible, we do it in that order. */
  if (password && (methods & SSH_AUTH_METHOD_PASSWORD))
    {
      rc = ssh_userauth_password (session, NULL, password);
      if (rc == SSH_AUTH_SUCCESS)
        {
          retc_val = 0;
          goto leave;
        }
 
      if (verbose)
        g_message ("SSH password authentication failed for session"
                   " %d: %s",
                   session_id, ssh_get_error (session));
      /* Keep on trying.  */
    }
 
  if (password && (methods & SSH_AUTH_METHOD_INTERACTIVE))
    {
      /* Our strategy for kbint is to send the password to the first
         prompt marked as non-echo.  */
      while ((rc = ssh_userauth_kbdint (session, NULL, NULL)) == SSH_AUTH_INFO)
        {
          const char *s;
          int n, nprompt;
          char echoflag;
          int found_prompt = 0;
 
          if (verbose)
            {
              s = ssh_userauth_kbdint_getname (session);
              if (s && *s)
                g_message ("SSH kbdint name='%s'", s);
              s = ssh_userauth_kbdint_getinstruction (session);
              if (s && *s)
                g_message ("SSH kbdint instruction='%s'", s);
            }
          nprompt = ssh_userauth_kbdint_getnprompts (session);
          for (n = 0; n < nprompt; n++)
            {
              s = ssh_userauth_kbdint_getprompt (session, n, &echoflag);
              if (s && *s && verbose)
                g_message ("SSH kbdint prompt='%s'%s", s,
                           echoflag ? "" : " [hide input]");
              if (s && *s && !echoflag && !found_prompt)
                {
                  found_prompt = 1;
                  rc = ssh_userauth_kbdint_setanswer (session, n, password);
                  if (rc != SSH_AUTH_SUCCESS)
                    {
                      if (verbose)
                        g_message ("SSH keyboard-interactive authentication "
                                   "failed at prompt %d for session %d: %s",
                                   n, session_id, ssh_get_error (session));
                    }
                }
            }
        }
 
      if (rc == SSH_AUTH_SUCCESS)
        {
          retc_val = 0;
          goto leave;
        }
 
      if (verbose)
        g_message (
          "SSH keyboard-interactive authentication failed for session %d"
          ": %s",
          session_id, ssh_get_error (session));
      /* Keep on trying.  */
    }
 
  /* If we have a private key, try public key authentication.  */
  if (privkeystr && *privkeystr && (methods & SSH_AUTH_METHOD_PUBLICKEY))
    {
      ssh_key key = NULL;
 
      if (ssh_pki_import_privkey_base64 (privkeystr, privkeypass, NULL, NULL,
                                         &key))
        {
          if (verbose)
            g_message ("SSH public key authentication failed for "
                       "session %d: %s",
                       session_id, "Error converting provided key");
        }
      else if (ssh_userauth_try_publickey (session, NULL, key)
               != SSH_AUTH_SUCCESS)
        {
          if (verbose)
            g_message ("SSH public key authentication failed for "
                       "session %d: %s",
                       session_id, "Server does not want our key");
        }
      else if (ssh_userauth_publickey (session, NULL, key) == SSH_AUTH_SUCCESS)
        {
          retc_val = 0;
          ssh_key_free (key);
          goto leave;
        }
      ssh_key_free (key);
      /* Keep on trying.  */
    }
 
  if (verbose)
    g_message ("SSH authentication failed for session %d: %s", session_id,
               "No more authentication methods to try");
 
leave:
  g_free (password);
  g_free (privkeystr);
  g_free (privkeypass);
  retc = alloc_typed_cell (CONST_INT);
  retc->x.i_val = retc_val;
  return retc;
}

References alloc_typed_cell(), session_table_item_s::authmethods_valid, CONST_INT, get_authmethods(), get_int_var_by_num(), get_str_var_by_name(), TC::i_val, nasl_ssh_set_login(), plug_get_kb(), struct_lex_ctxt::script_infos, session_table_item_s::session, session_table_item_s::session_id, session_table, session_table_item_s::user_set, session_table_item_s::verbose, verify_session_id(), and TC::x.

Here is the call graph for this function: