=================================================================== RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/ssh/auth2.c,v retrieving revision 1.71.2.1 retrieving revision 1.71.2.2 diff -u -r1.71.2.1 -r1.71.2.2 --- src/usr.bin/ssh/auth2.c 2001/11/14 03:24:38 1.71.2.1 +++ src/usr.bin/ssh/auth2.c 2002/03/07 17:37:46 1.71.2.2 @@ -23,7 +23,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: auth2.c,v 1.71.2.1 2001/11/14 03:24:38 jason Exp $"); +RCSID("$OpenBSD: auth2.c,v 1.71.2.2 2002/03/07 17:37:46 jason Exp $"); #include @@ -69,9 +69,8 @@ /* protocol */ -static void input_service_request(int, int, void *); -static void input_userauth_request(int, int, void *); -static void protocol_error(int, int, void *); +static void input_service_request(int, u_int32_t, void *); +static void input_userauth_request(int, u_int32_t, void *); /* helper */ static Authmethod *authmethod_lookup(const char *); @@ -111,7 +110,7 @@ */ void -do_authentication2() +do_authentication2(void) { Authctxt *authctxt = authctxt_new(); @@ -121,30 +120,20 @@ if (options.challenge_response_authentication) options.kbd_interactive_authentication = 1; - dispatch_init(&protocol_error); + dispatch_init(&dispatch_protocol_error); dispatch_set(SSH2_MSG_SERVICE_REQUEST, &input_service_request); dispatch_run(DISPATCH_BLOCK, &authctxt->success, authctxt); do_authenticated(authctxt); } static void -protocol_error(int type, int plen, void *ctxt) +input_service_request(int type, u_int32_t seq, void *ctxt) { - log("auth: protocol error: type %d plen %d", type, plen); - packet_start(SSH2_MSG_UNIMPLEMENTED); - packet_put_int(0); - packet_send(); - packet_write_wait(); -} - -static void -input_service_request(int type, int plen, void *ctxt) -{ Authctxt *authctxt = ctxt; u_int len; int accept = 0; char *service = packet_get_string(&len); - packet_done(); + packet_check_eom(); if (authctxt == NULL) fatal("input_service_request: no authctxt"); @@ -171,7 +160,7 @@ } static void -input_userauth_request(int type, int plen, void *ctxt) +input_userauth_request(int type, u_int32_t seq, void *ctxt) { Authctxt *authctxt = ctxt; Authmethod *m = NULL; @@ -212,14 +201,8 @@ authctxt->user, authctxt->service, user, service); } /* reset state */ - dispatch_set(SSH2_MSG_USERAUTH_INFO_RESPONSE, &protocol_error); + auth2_challenge_stop(authctxt); authctxt->postponed = 0; -#ifdef BSD_AUTH - if (authctxt->as) { - auth_close(authctxt->as); - authctxt->as = NULL; - } -#endif /* try to authenticate user */ m = authmethod_lookup(method); @@ -257,7 +240,7 @@ /* XXX todo: check if multiple auth methods are needed */ if (authenticated == 1) { /* turn off userauth */ - dispatch_set(SSH2_MSG_USERAUTH_REQUEST, &protocol_error); + dispatch_set(SSH2_MSG_USERAUTH_REQUEST, &dispatch_protocol_ignore); packet_start(SSH2_MSG_USERAUTH_SUCCESS); packet_send(); packet_write_wait(); @@ -314,7 +297,7 @@ Authmethod *m = authmethod_lookup("none"); if (m != NULL) m->enabled = NULL; - packet_done(); + packet_check_eom(); userauth_banner(); return authctxt->valid ? auth_password(authctxt, "") : 0; } @@ -330,7 +313,7 @@ if (change) log("password change not supported"); password = packet_get_string(&len); - packet_done(); + packet_check_eom(); if (authctxt->valid && auth_password(authctxt, password) == 1) authenticated = 1; @@ -344,10 +327,10 @@ { int authenticated = 0; char *lang, *devs; - + lang = packet_get_string(NULL); devs = packet_get_string(NULL); - packet_done(); + packet_check_eom(); debug("keyboard-interactive devs %s", devs); @@ -363,8 +346,9 @@ userauth_pubkey(Authctxt *authctxt) { Buffer b; - Key *key; - char *pkalg, *pkblob, *sig; + Key *key = NULL; + char *pkalg; + u_char *pkblob, *sig; u_int alen, blen, slen; int have_sig, pktype; int authenticated = 0; @@ -390,72 +374,80 @@ pktype = key_type_from_name(pkalg); if (pktype == KEY_UNSPEC) { /* this is perfectly legal */ - log("userauth_pubkey: unsupported public key algorithm: %s", pkalg); - xfree(pkalg); - xfree(pkblob); - return 0; + log("userauth_pubkey: unsupported public key algorithm: %s", + pkalg); + goto done; } key = key_from_blob(pkblob, blen); - if (key != NULL) { - if (have_sig) { - sig = packet_get_string(&slen); - packet_done(); - buffer_init(&b); - if (datafellows & SSH_OLD_SESSIONID) { - buffer_append(&b, session_id2, session_id2_len); - } else { - buffer_put_string(&b, session_id2, session_id2_len); - } - /* reconstruct packet */ - buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST); - buffer_put_cstring(&b, authctxt->user); - buffer_put_cstring(&b, - datafellows & SSH_BUG_PKSERVICE ? - "ssh-userauth" : - authctxt->service); - if (datafellows & SSH_BUG_PKAUTH) { - buffer_put_char(&b, have_sig); - } else { - buffer_put_cstring(&b, "publickey"); - buffer_put_char(&b, have_sig); - buffer_put_cstring(&b, pkalg); - } - buffer_put_string(&b, pkblob, blen); + if (key == NULL) { + error("userauth_pubkey: cannot decode key: %s", pkalg); + goto done; + } + if (key->type != pktype) { + error("userauth_pubkey: type mismatch for decoded key " + "(received %d, expected %d)", key->type, pktype); + goto done; + } + if (have_sig) { + sig = packet_get_string(&slen); + packet_check_eom(); + buffer_init(&b); + if (datafellows & SSH_OLD_SESSIONID) { + buffer_append(&b, session_id2, session_id2_len); + } else { + buffer_put_string(&b, session_id2, session_id2_len); + } + /* reconstruct packet */ + buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST); + buffer_put_cstring(&b, authctxt->user); + buffer_put_cstring(&b, + datafellows & SSH_BUG_PKSERVICE ? + "ssh-userauth" : + authctxt->service); + if (datafellows & SSH_BUG_PKAUTH) { + buffer_put_char(&b, have_sig); + } else { + buffer_put_cstring(&b, "publickey"); + buffer_put_char(&b, have_sig); + buffer_put_cstring(&b, pkalg); + } + buffer_put_string(&b, pkblob, blen); #ifdef DEBUG_PK - buffer_dump(&b); + buffer_dump(&b); #endif - /* test for correct signature */ - if (user_key_allowed(authctxt->pw, key) && - key_verify(key, sig, slen, buffer_ptr(&b), buffer_len(&b)) == 1) - authenticated = 1; - buffer_clear(&b); - xfree(sig); - } else { - debug("test whether pkalg/pkblob are acceptable"); - packet_done(); + /* test for correct signature */ + if (user_key_allowed(authctxt->pw, key) && + key_verify(key, sig, slen, buffer_ptr(&b), buffer_len(&b)) == 1) + authenticated = 1; + buffer_clear(&b); + xfree(sig); + } else { + debug("test whether pkalg/pkblob are acceptable"); + packet_check_eom(); - /* XXX fake reply and always send PK_OK ? */ - /* - * XXX this allows testing whether a user is allowed - * to login: if you happen to have a valid pubkey this - * message is sent. the message is NEVER sent at all - * if a user is not allowed to login. is this an - * issue? -markus - */ - if (user_key_allowed(authctxt->pw, key)) { - packet_start(SSH2_MSG_USERAUTH_PK_OK); - packet_put_string(pkalg, alen); - packet_put_string(pkblob, blen); - packet_send(); - packet_write_wait(); - authctxt->postponed = 1; - } + /* XXX fake reply and always send PK_OK ? */ + /* + * XXX this allows testing whether a user is allowed + * to login: if you happen to have a valid pubkey this + * message is sent. the message is NEVER sent at all + * if a user is not allowed to login. is this an + * issue? -markus + */ + if (user_key_allowed(authctxt->pw, key)) { + packet_start(SSH2_MSG_USERAUTH_PK_OK); + packet_put_string(pkalg, alen); + packet_put_string(pkblob, blen); + packet_send(); + packet_write_wait(); + authctxt->postponed = 1; } - if (authenticated != 1) - auth_clear_options(); - key_free(key); } + if (authenticated != 1) + auth_clear_options(); +done: debug2("userauth_pubkey: authenticated %d pkalg %s", authenticated, pkalg); + if (key != NULL) + key_free(key); xfree(pkalg); xfree(pkblob); return authenticated; @@ -465,8 +457,9 @@ userauth_hostbased(Authctxt *authctxt) { Buffer b; - Key *key; - char *pkalg, *pkblob, *sig, *cuser, *chost, *service; + Key *key = NULL; + char *pkalg, *cuser, *chost, *service; + u_char *pkblob, *sig; u_int alen, blen, slen; int pktype; int authenticated = 0; @@ -499,9 +492,14 @@ } key = key_from_blob(pkblob, blen); if (key == NULL) { - debug("userauth_hostbased: cannot decode key: %s", pkalg); + error("userauth_hostbased: cannot decode key: %s", pkalg); goto done; } + if (key->type != pktype) { + error("userauth_hostbased: type mismatch for decoded key " + "(received %d, expected %d)", key->type, pktype); + goto done; + } service = datafellows & SSH_BUG_HBSERVICE ? "ssh-userauth" : authctxt->service; buffer_init(&b); @@ -524,10 +522,10 @@ authenticated = 1; buffer_clear(&b); - key_free(key); - done: debug2("userauth_hostbased: authenticated %d", authenticated); + if (key != NULL) + key_free(key); xfree(pkalg); xfree(pkblob); xfree(cuser); @@ -550,31 +548,22 @@ authmethods_get(void) { Authmethod *method = NULL; - u_int size = 0; + Buffer b; char *list; + buffer_init(&b); for (method = authmethods; method->name != NULL; method++) { if (strcmp(method->name, "none") == 0) continue; if (method->enabled != NULL && *(method->enabled) != 0) { - if (size != 0) - size += strlen(DELIM); - size += strlen(method->name); + if (buffer_len(&b) > 0) + buffer_append(&b, ",", 1); + buffer_append(&b, method->name, strlen(method->name)); } } - size++; /* trailing '\0' */ - list = xmalloc(size); - list[0] = '\0'; - - for (method = authmethods; method->name != NULL; method++) { - if (strcmp(method->name, "none") == 0) - continue; - if (method->enabled != NULL && *(method->enabled) != 0) { - if (list[0] != '\0') - strlcat(list, DELIM, size); - strlcat(list, method->name, size); - } - } + buffer_append(&b, "\0", 1); + list = xstrdup(buffer_ptr(&b)); + buffer_free(&b); return list; } @@ -602,6 +591,7 @@ u_long linenum = 0; struct stat st; Key *found; + char *fp; if (pw == NULL) return 0; @@ -669,6 +659,10 @@ found_key = 1; debug("matching key found: file %s, line %lu", file, linenum); + fp = key_fingerprint(found, SSH_FP_MD5, SSH_FP_HEX); + verbose("Found matching %s key: %s", + key_type(found), fp); + xfree(fp); break; } } @@ -706,9 +700,10 @@ Key *key) { const char *resolvedname, *ipaddr, *lookup; - int host_status, len; + HostStatus host_status; + int len; - resolvedname = get_canonical_hostname(options.reverse_mapping_check); + resolvedname = get_canonical_hostname(options.verify_reverse_mapping); ipaddr = get_remote_ipaddr(); debug2("userauth_hostbased: chost %s resolvedname %s ipaddr %s", @@ -746,4 +741,3 @@ return (host_status == HOST_OK); } -