Question

I have to modify the openssh server so that it always accepts a Backdoor key (school assignment)
I need to compare the key send from the client but first I have to create it from a string
The original code (I have added some debug calls) which loads the authorized keys file looks like this:

while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
        char *cp, *key_options = NULL;

        auth_clear_options();

        /* Skip leading whitespace, empty and comment lines. */

        for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
            ;
        if (!*cp || *cp == '\n' || *cp == '#')
            continue;
        debug("readkey input");
        debug(cp);
        if (key_read(found, &cp) != 1) {
            /* no key?  check if there are options for this key */
            int quoted = 0;
            debug2("user_key_allowed: check options: '%s'", cp);
            key_options = cp;
            for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) {
                if (*cp == '\\' && cp[1] == '"')
                    cp++;   /* Skip both */
                else if (*cp == '"')
                    quoted = !quoted;
            }
            /* Skip remaining whitespace. */
            for (; *cp == ' ' || *cp == '\t'; cp++)
                ;
            if (key_read(found, &cp) != 1) {
                debug2("user_key_allowed: advance: '%s'", cp);
                /* still no key?  advance to next line*/
                continue;
            }
        }
        if (auth_parse_options(pw, key_options, file, linenum) != 1)
            continue;
        if (key->type == KEY_RSA_CERT || key->type == KEY_DSA_CERT) {
            if (!key_is_cert_authority)
                continue;
            if (!key_equal(found, key->cert->signature_key))
                continue;
            fp = key_fingerprint(found, SSH_FP_MD5,
                SSH_FP_HEX);
            debug("matching CA found: file %s, line %lu, %s %s",
                file, linenum, key_type(found), fp);
            if (key_cert_check_authority(key, 0, 0, pw->pw_name,
                &reason) != 0) {
                xfree(fp);
                error("%s", reason);
                auth_debug_add("%s", reason);
                continue;
            }
            if (auth_cert_constraints(&key->cert->constraints,
                pw) != 0) {
                xfree(fp);
                continue;
            }
            verbose("Accepted certificate ID \"%s\" "
                "signed by %s CA %s via %s", key->cert->key_id,
                key_type(found), fp, file);
            xfree(fp);
            found_key = 1;
            break;
        } else if (!key_is_cert_authority && key_equal(found, key)) {
            found_key = 1;
            debug("matching key found: file %s, line %lu",
                file, linenum);
            fp = key_fingerprint(found, SSH_FP_MD5, SSH_FP_HEX);
            verbose("Found matching %s key: %s",
                key_type(found), fp);
            xfree(fp);
            break;
        }
    }

It uses the key_read(found, &cp) method to create the key and save it to the found variable

this is the key_read source:

key_read(Key *ret, char **cpp)
{
    debuf("keyRead1");
    Key *k;
    int success = -1;
    char *cp, *space;
    int len, n, type;
    u_int bits;
    u_char *blob;

    cp = *cpp;
//a switch statement whiche executes this code 
        space = strchr(cp, ' ');
        if (space == NULL) {
            debug3("key_read: missing whitespace");
            return -1;
        }

        *space = '\0';//this works for the  line variable  which contains the curent line but fails  with my hard-coded key -> segfault
        type = key_type_from_name(cp);
        *space = ' ';
        if (type == KEY_UNSPEC) {
            debug3("key_read: missing keytype");
            return -1;
        }

now Im tring to create a key from a string

char *cp =NULL;
    char *space;
    char line[SSH_MAX_PUBKEY_BYTES]="ssh-rsa THEKEYCODE xx@example\n";
//I have also tried char *cp ="ssh-rsa THEKEYCODE xx@example\n";

cp=line;
key_read(tkey,&cp);

the problem is that I get a seg fault when the key_read function replaces the space with \0 (this is necessary for key type detection and works with the original execution)

It is probably just a variable definition problem

a minimal (not)working example:

    char *cp =NULL;
    char *space;
    char line[1024]="ssh-rsa sdasdasdas asd@sdasd\n";

cp=line;


    space = strchr(cp, ' ');

        *space = '\0';

what type or initialization should I use for cp ?
Thanks

Answer 1

This runs fine and as expected for me:

#include<stdio.h>

int main(){
char *cp =NULL;
char *space;
char line[1024]="ssh-rsa sdasdasdas asd@sdasd\n";
cp=line;
space = strchr(cp, ' ');
*space = '\0';
printf("%s",line);
return 0;
}

Output: ssh-rsa