Annotation of src/usr.bin/ssh/sshconnect2.c, Revision 1.27.2.4
1.1 markus 1: /*
2: * Copyright (c) 2000 Markus Friedl. All rights reserved.
3: *
4: * Redistribution and use in source and binary forms, with or without
5: * modification, are permitted provided that the following conditions
6: * are met:
7: * 1. Redistributions of source code must retain the above copyright
8: * notice, this list of conditions and the following disclaimer.
9: * 2. Redistributions in binary form must reproduce the above copyright
10: * notice, this list of conditions and the following disclaimer in the
11: * documentation and/or other materials provided with the distribution.
12: *
13: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16: * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19: * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20: * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21: * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22: * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
23: */
24:
25: #include "includes.h"
1.27.2.4! jason 26: RCSID("$OpenBSD: sshconnect2.c,v 1.72 2001/04/18 23:43:26 markus Exp $");
1.1 markus 27:
28: #include <openssl/bn.h>
29: #include <openssl/md5.h>
30: #include <openssl/dh.h>
31: #include <openssl/hmac.h>
32:
33: #include "ssh.h"
1.27.2.1 jason 34: #include "ssh2.h"
1.1 markus 35: #include "xmalloc.h"
36: #include "rsa.h"
37: #include "buffer.h"
38: #include "packet.h"
39: #include "uidswap.h"
40: #include "compat.h"
41: #include "bufaux.h"
1.27.2.1 jason 42: #include "cipher.h"
1.1 markus 43: #include "kex.h"
44: #include "myproposal.h"
45: #include "key.h"
46: #include "sshconnect.h"
47: #include "authfile.h"
1.23 markus 48: #include "cli.h"
1.27.2.4! jason 49: #include "dh.h"
1.17 markus 50: #include "authfd.h"
1.27.2.1 jason 51: #include "log.h"
52: #include "readconf.h"
53: #include "readpass.h"
1.27.2.3 jason 54: #include "match.h"
1.27.2.4! jason 55: #include "dispatch.h"
! 56: #include "canohost.h"
1.22 provos 57:
1.1 markus 58: /* import */
59: extern char *client_version_string;
60: extern char *server_version_string;
61: extern Options options;
62:
63: /*
64: * SSH2 key exchange
65: */
66:
1.27.2.1 jason 67: u_char *session_id2 = NULL;
1.1 markus 68: int session_id2_len = 0;
69:
1.27.2.4! jason 70: char *xxx_host;
! 71: struct sockaddr *xxx_hostaddr;
! 72:
! 73: Kex *xxx_kex = NULL;
! 74:
! 75: int
! 76: check_host_key_callback(Key *hostkey)
! 77: {
! 78: check_host_key(xxx_host, xxx_hostaddr, hostkey,
! 79: options.user_hostfile2, options.system_hostfile2);
! 80: return 0;
! 81: }
! 82:
1.1 markus 83: void
1.22 provos 84: ssh_kex2(char *host, struct sockaddr *hostaddr)
85: {
86: Kex *kex;
1.27.2.4! jason 87:
! 88: xxx_host = host;
! 89: xxx_hostaddr = hostaddr;
1.22 provos 90:
1.27.2.1 jason 91: if (options.ciphers == (char *)-1) {
92: log("No valid ciphers for protocol version 2 given, using defaults.");
93: options.ciphers = NULL;
1.24 markus 94: }
1.22 provos 95: if (options.ciphers != NULL) {
96: myproposal[PROPOSAL_ENC_ALGS_CTOS] =
97: myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
98: }
1.27.2.4! jason 99: myproposal[PROPOSAL_ENC_ALGS_CTOS] =
! 100: compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]);
! 101: myproposal[PROPOSAL_ENC_ALGS_STOC] =
! 102: compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_STOC]);
1.22 provos 103: if (options.compression) {
1.27.2.1 jason 104: myproposal[PROPOSAL_COMP_ALGS_CTOS] =
1.22 provos 105: myproposal[PROPOSAL_COMP_ALGS_STOC] = "zlib";
106: } else {
1.27.2.1 jason 107: myproposal[PROPOSAL_COMP_ALGS_CTOS] =
1.22 provos 108: myproposal[PROPOSAL_COMP_ALGS_STOC] = "none";
109: }
1.27.2.1 jason 110: if (options.macs != NULL) {
111: myproposal[PROPOSAL_MAC_ALGS_CTOS] =
112: myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
113: }
1.27.2.4! jason 114: if (options.hostkeyalgorithms != NULL)
! 115: myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
! 116: options.hostkeyalgorithms;
! 117:
! 118: /* start key exchange */
! 119: kex = kex_setup(myproposal);
! 120: kex->client_version_string=client_version_string;
! 121: kex->server_version_string=server_version_string;
! 122: kex->check_host_key=&check_host_key_callback;
1.22 provos 123:
1.27.2.4! jason 124: xxx_kex = kex;
1.22 provos 125:
1.27.2.4! jason 126: dispatch_run(DISPATCH_BLOCK, &kex->done, kex);
1.22 provos 127:
1.27.2.4! jason 128: session_id2 = kex->session_id;
! 129: session_id2_len = kex->session_id_len;
1.22 provos 130:
131: #ifdef DEBUG_KEXDH
132: /* send 1st encrypted/maced/compressed message */
133: packet_start(SSH2_MSG_IGNORE);
134: packet_put_cstring("markus");
135: packet_send();
136: packet_write_wait();
137: #endif
1.27.2.4! jason 138: debug("done: ssh_kex2.");
1.1 markus 139: }
1.11 markus 140:
1.1 markus 141: /*
142: * Authenticate user
143: */
1.20 markus 144:
145: typedef struct Authctxt Authctxt;
146: typedef struct Authmethod Authmethod;
147:
148: typedef int sign_cb_fn(
149: Authctxt *authctxt, Key *key,
1.27.2.1 jason 150: u_char **sigp, int *lenp, u_char *data, int datalen);
1.20 markus 151:
152: struct Authctxt {
153: const char *server_user;
1.27.2.4! jason 154: const char *local_user;
1.20 markus 155: const char *host;
156: const char *service;
1.23 markus 157: Authmethod *method;
1.20 markus 158: int success;
1.27.2.3 jason 159: char *authlist;
1.27.2.4! jason 160: /* pubkey */
1.27.2.3 jason 161: Key *last_key;
162: sign_cb_fn *last_key_sign;
163: int last_key_hint;
1.27.2.4! jason 164: AuthenticationConnection *agent;
! 165: /* hostbased */
! 166: Key **keys;
! 167: int nkeys;
1.20 markus 168: };
169: struct Authmethod {
170: char *name; /* string to compare against server's list */
171: int (*userauth)(Authctxt *authctxt);
172: int *enabled; /* flag in option struct that enables method */
173: int *batch_flag; /* flag in option struct that disables method */
174: };
175:
176: void input_userauth_success(int type, int plen, void *ctxt);
177: void input_userauth_failure(int type, int plen, void *ctxt);
1.27.2.1 jason 178: void input_userauth_banner(int type, int plen, void *ctxt);
1.20 markus 179: void input_userauth_error(int type, int plen, void *ctxt);
1.23 markus 180: void input_userauth_info_req(int type, int plen, void *ctxt);
1.27.2.3 jason 181: void input_userauth_pk_ok(int type, int plen, void *ctxt);
1.23 markus 182:
183: int userauth_none(Authctxt *authctxt);
1.20 markus 184: int userauth_pubkey(Authctxt *authctxt);
185: int userauth_passwd(Authctxt *authctxt);
1.23 markus 186: int userauth_kbdint(Authctxt *authctxt);
1.27.2.4! jason 187: int userauth_hostbased(Authctxt *authctxt);
1.20 markus 188:
1.27.2.3 jason 189: void userauth(Authctxt *authctxt, char *authlist);
190:
191: int
192: sign_and_send_pubkey(Authctxt *authctxt, Key *k,
193: sign_cb_fn *sign_callback);
194: void clear_auth_state(Authctxt *authctxt);
195:
1.23 markus 196: Authmethod *authmethod_get(char *authlist);
197: Authmethod *authmethod_lookup(const char *name);
1.27.2.3 jason 198: char *authmethods_get(void);
1.20 markus 199:
200: Authmethod authmethods[] = {
201: {"publickey",
202: userauth_pubkey,
1.27.2.1 jason 203: &options.pubkey_authentication,
1.20 markus 204: NULL},
205: {"password",
206: userauth_passwd,
207: &options.password_authentication,
208: &options.batch_mode},
1.23 markus 209: {"keyboard-interactive",
210: userauth_kbdint,
211: &options.kbd_interactive_authentication,
212: &options.batch_mode},
1.27.2.4! jason 213: {"hostbased",
! 214: userauth_hostbased,
! 215: &options.hostbased_authentication,
! 216: NULL},
1.23 markus 217: {"none",
218: userauth_none,
219: NULL,
220: NULL},
1.20 markus 221: {NULL, NULL, NULL, NULL}
222: };
223:
224: void
1.27.2.4! jason 225: ssh_userauth2(const char *local_user, const char *server_user, char *host,
! 226: Key **keys, int nkeys)
1.20 markus 227: {
228: Authctxt authctxt;
229: int type;
230: int plen;
231:
1.27.2.1 jason 232: if (options.challenge_reponse_authentication)
233: options.kbd_interactive_authentication = 1;
234:
1.20 markus 235: debug("send SSH2_MSG_SERVICE_REQUEST");
236: packet_start(SSH2_MSG_SERVICE_REQUEST);
237: packet_put_cstring("ssh-userauth");
238: packet_send();
239: packet_write_wait();
240: type = packet_read(&plen);
241: if (type != SSH2_MSG_SERVICE_ACCEPT) {
242: fatal("denied SSH2_MSG_SERVICE_ACCEPT: %d", type);
243: }
244: if (packet_remaining() > 0) {
245: char *reply = packet_get_string(&plen);
246: debug("service_accept: %s", reply);
247: xfree(reply);
248: } else {
249: debug("buggy server: service_accept w/o service");
250: }
251: packet_done();
252: debug("got SSH2_MSG_SERVICE_ACCEPT");
253:
1.27.2.3 jason 254: if (options.preferred_authentications == NULL)
255: options.preferred_authentications = authmethods_get();
256:
1.20 markus 257: /* setup authentication context */
258: authctxt.agent = ssh_get_authentication_connection();
259: authctxt.server_user = server_user;
1.27.2.4! jason 260: authctxt.local_user = local_user;
1.20 markus 261: authctxt.host = host;
262: authctxt.service = "ssh-connection"; /* service name */
263: authctxt.success = 0;
1.23 markus 264: authctxt.method = authmethod_lookup("none");
1.27.2.3 jason 265: authctxt.authlist = NULL;
1.27.2.4! jason 266: authctxt.keys = keys;
! 267: authctxt.nkeys = nkeys;
1.23 markus 268: if (authctxt.method == NULL)
269: fatal("ssh_userauth2: internal error: cannot send userauth none request");
1.20 markus 270:
271: /* initial userauth request */
1.23 markus 272: userauth_none(&authctxt);
1.20 markus 273:
274: dispatch_init(&input_userauth_error);
275: dispatch_set(SSH2_MSG_USERAUTH_SUCCESS, &input_userauth_success);
276: dispatch_set(SSH2_MSG_USERAUTH_FAILURE, &input_userauth_failure);
1.27.2.1 jason 277: dispatch_set(SSH2_MSG_USERAUTH_BANNER, &input_userauth_banner);
1.20 markus 278: dispatch_run(DISPATCH_BLOCK, &authctxt.success, &authctxt); /* loop until success */
279:
280: if (authctxt.agent != NULL)
281: ssh_close_authentication_connection(authctxt.agent);
282:
1.27.2.1 jason 283: debug("ssh-userauth2 successful: method %s", authctxt.method->name);
1.20 markus 284: }
285: void
1.27.2.3 jason 286: userauth(Authctxt *authctxt, char *authlist)
287: {
288: if (authlist == NULL) {
289: authlist = authctxt->authlist;
290: } else {
291: if (authctxt->authlist)
292: xfree(authctxt->authlist);
293: authctxt->authlist = authlist;
294: }
295: for (;;) {
296: Authmethod *method = authmethod_get(authlist);
297: if (method == NULL)
298: fatal("Permission denied (%s).", authlist);
299: authctxt->method = method;
300: if (method->userauth(authctxt) != 0) {
301: debug2("we sent a %s packet, wait for reply", method->name);
302: break;
303: } else {
304: debug2("we did not send a packet, disable method");
305: method->enabled = NULL;
306: }
307: }
308: }
309: void
1.20 markus 310: input_userauth_error(int type, int plen, void *ctxt)
311: {
1.27.2.1 jason 312: fatal("input_userauth_error: bad message during authentication: "
313: "type %d", type);
314: }
315: void
316: input_userauth_banner(int type, int plen, void *ctxt)
317: {
318: char *msg, *lang;
319: debug3("input_userauth_banner");
320: msg = packet_get_string(NULL);
321: lang = packet_get_string(NULL);
322: fprintf(stderr, "%s", msg);
323: xfree(msg);
324: xfree(lang);
1.20 markus 325: }
326: void
327: input_userauth_success(int type, int plen, void *ctxt)
328: {
329: Authctxt *authctxt = ctxt;
330: if (authctxt == NULL)
331: fatal("input_userauth_success: no authentication context");
1.27.2.3 jason 332: if (authctxt->authlist)
333: xfree(authctxt->authlist);
334: clear_auth_state(authctxt);
1.20 markus 335: authctxt->success = 1; /* break out */
336: }
337: void
338: input_userauth_failure(int type, int plen, void *ctxt)
339: {
340: Authctxt *authctxt = ctxt;
341: char *authlist = NULL;
342: int partial;
343:
344: if (authctxt == NULL)
345: fatal("input_userauth_failure: no authentication context");
346:
1.23 markus 347: authlist = packet_get_string(NULL);
1.20 markus 348: partial = packet_get_char();
349: packet_done();
350:
351: if (partial != 0)
1.27.2.1 jason 352: log("Authenticated with partial success.");
1.20 markus 353: debug("authentications that can continue: %s", authlist);
354:
1.27.2.3 jason 355: clear_auth_state(authctxt);
356: userauth(authctxt, authlist);
357: }
358: void
359: input_userauth_pk_ok(int type, int plen, void *ctxt)
360: {
361: Authctxt *authctxt = ctxt;
362: Key *key = NULL;
363: Buffer b;
1.27.2.4! jason 364: int alen, blen, sent = 0;
1.27.2.3 jason 365: char *pkalg, *pkblob, *fp;
366:
367: if (authctxt == NULL)
368: fatal("input_userauth_pk_ok: no authentication context");
369: if (datafellows & SSH_BUG_PKOK) {
370: /* this is similar to SSH_BUG_PKAUTH */
371: debug2("input_userauth_pk_ok: SSH_BUG_PKOK");
372: pkblob = packet_get_string(&blen);
373: buffer_init(&b);
374: buffer_append(&b, pkblob, blen);
375: pkalg = buffer_get_string(&b, &alen);
376: buffer_free(&b);
377: } else {
378: pkalg = packet_get_string(&alen);
379: pkblob = packet_get_string(&blen);
380: }
381: packet_done();
382:
383: debug("input_userauth_pk_ok: pkalg %s blen %d lastkey %p hint %d",
384: pkalg, blen, authctxt->last_key, authctxt->last_key_hint);
385:
386: do {
387: if (authctxt->last_key == NULL ||
388: authctxt->last_key_sign == NULL) {
389: debug("no last key or no sign cb");
1.20 markus 390: break;
391: }
1.27.2.4! jason 392: if (key_type_from_name(pkalg) == KEY_UNSPEC) {
1.27.2.3 jason 393: debug("unknown pkalg %s", pkalg);
394: break;
395: }
396: if ((key = key_from_blob(pkblob, blen)) == NULL) {
397: debug("no key from blob. pkalg %s", pkalg);
398: break;
399: }
400: fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
401: debug2("input_userauth_pk_ok: fp %s", fp);
402: xfree(fp);
403: if (!key_equal(key, authctxt->last_key)) {
404: debug("key != last_key");
405: break;
406: }
407: sent = sign_and_send_pubkey(authctxt, key,
408: authctxt->last_key_sign);
409: } while(0);
410:
411: if (key != NULL)
412: key_free(key);
413: xfree(pkalg);
414: xfree(pkblob);
415:
416: /* unregister */
417: clear_auth_state(authctxt);
418: dispatch_set(SSH2_MSG_USERAUTH_PK_OK, NULL);
419:
420: /* try another method if we did not send a packet*/
421: if (sent == 0)
422: userauth(authctxt, NULL);
423:
1.20 markus 424: }
425:
1.1 markus 426: int
1.23 markus 427: userauth_none(Authctxt *authctxt)
428: {
429: /* initial userauth request */
430: packet_start(SSH2_MSG_USERAUTH_REQUEST);
431: packet_put_cstring(authctxt->server_user);
432: packet_put_cstring(authctxt->service);
433: packet_put_cstring(authctxt->method->name);
434: packet_send();
435: return 1;
436: }
437:
438: int
1.20 markus 439: userauth_passwd(Authctxt *authctxt)
1.1 markus 440: {
1.6 markus 441: static int attempt = 0;
1.1 markus 442: char prompt[80];
443: char *password;
1.6 markus 444:
1.13 todd 445: if (attempt++ >= options.number_of_password_prompts)
1.6 markus 446: return 0;
1.13 todd 447:
448: if(attempt != 1)
449: error("Permission denied, please try again.");
1.1 markus 450:
1.27.2.1 jason 451: snprintf(prompt, sizeof(prompt), "%.30s@%.128s's password: ",
1.20 markus 452: authctxt->server_user, authctxt->host);
1.1 markus 453: password = read_passphrase(prompt, 0);
454: packet_start(SSH2_MSG_USERAUTH_REQUEST);
1.20 markus 455: packet_put_cstring(authctxt->server_user);
456: packet_put_cstring(authctxt->service);
1.23 markus 457: packet_put_cstring(authctxt->method->name);
1.1 markus 458: packet_put_char(0);
1.27.2.3 jason 459: packet_put_cstring(password);
1.1 markus 460: memset(password, 0, strlen(password));
461: xfree(password);
1.27.2.3 jason 462: packet_inject_ignore(64);
1.1 markus 463: packet_send();
464: return 1;
465: }
466:
1.27.2.3 jason 467: void
468: clear_auth_state(Authctxt *authctxt)
469: {
470: /* XXX clear authentication state */
471: if (authctxt->last_key != NULL && authctxt->last_key_hint == -1) {
472: debug3("clear_auth_state: key_free %p", authctxt->last_key);
473: key_free(authctxt->last_key);
474: }
475: authctxt->last_key = NULL;
476: authctxt->last_key_hint = -2;
477: authctxt->last_key_sign = NULL;
478: }
479:
1.17 markus 480: int
1.20 markus 481: sign_and_send_pubkey(Authctxt *authctxt, Key *k, sign_cb_fn *sign_callback)
1.1 markus 482: {
483: Buffer b;
1.27.2.1 jason 484: u_char *blob, *signature;
1.1 markus 485: int bloblen, slen;
1.14 markus 486: int skip = 0;
1.17 markus 487: int ret = -1;
1.23 markus 488: int have_sig = 1;
1.1 markus 489:
1.27.2.1 jason 490: debug3("sign_and_send_pubkey");
1.27.2.3 jason 491:
1.27.2.1 jason 492: if (key_to_blob(k, &blob, &bloblen) == 0) {
493: /* we cannot handle this key */
494: debug3("sign_and_send_pubkey: cannot handle key");
495: return 0;
496: }
1.1 markus 497: /* data to be signed */
498: buffer_init(&b);
1.26 markus 499: if (datafellows & SSH_OLD_SESSIONID) {
500: buffer_append(&b, session_id2, session_id2_len);
1.27.2.1 jason 501: skip = session_id2_len;
1.26 markus 502: } else {
1.14 markus 503: buffer_put_string(&b, session_id2, session_id2_len);
504: skip = buffer_len(&b);
505: }
1.1 markus 506: buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
1.20 markus 507: buffer_put_cstring(&b, authctxt->server_user);
1.10 markus 508: buffer_put_cstring(&b,
1.27.2.1 jason 509: datafellows & SSH_BUG_PKSERVICE ?
1.10 markus 510: "ssh-userauth" :
1.20 markus 511: authctxt->service);
1.27.2.1 jason 512: if (datafellows & SSH_BUG_PKAUTH) {
513: buffer_put_char(&b, have_sig);
514: } else {
515: buffer_put_cstring(&b, authctxt->method->name);
516: buffer_put_char(&b, have_sig);
517: buffer_put_cstring(&b, key_ssh_name(k));
518: }
1.1 markus 519: buffer_put_string(&b, blob, bloblen);
520:
521: /* generate signature */
1.27.2.3 jason 522: ret = (*sign_callback)(authctxt, k, &signature, &slen,
523: buffer_ptr(&b), buffer_len(&b));
1.17 markus 524: if (ret == -1) {
525: xfree(blob);
526: buffer_free(&b);
527: return 0;
528: }
1.27.2.1 jason 529: #ifdef DEBUG_PK
1.1 markus 530: buffer_dump(&b);
531: #endif
1.27.2.1 jason 532: if (datafellows & SSH_BUG_PKSERVICE) {
1.10 markus 533: buffer_clear(&b);
534: buffer_append(&b, session_id2, session_id2_len);
1.27.2.3 jason 535: skip = session_id2_len;
1.10 markus 536: buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
1.20 markus 537: buffer_put_cstring(&b, authctxt->server_user);
538: buffer_put_cstring(&b, authctxt->service);
1.23 markus 539: buffer_put_cstring(&b, authctxt->method->name);
540: buffer_put_char(&b, have_sig);
1.27.2.1 jason 541: if (!(datafellows & SSH_BUG_PKAUTH))
542: buffer_put_cstring(&b, key_ssh_name(k));
1.10 markus 543: buffer_put_string(&b, blob, bloblen);
544: }
545: xfree(blob);
1.27.2.3 jason 546:
1.1 markus 547: /* append signature */
548: buffer_put_string(&b, signature, slen);
549: xfree(signature);
550:
551: /* skip session id and packet type */
1.14 markus 552: if (buffer_len(&b) < skip + 1)
1.20 markus 553: fatal("userauth_pubkey: internal error");
1.14 markus 554: buffer_consume(&b, skip + 1);
1.1 markus 555:
556: /* put remaining data from buffer into packet */
557: packet_start(SSH2_MSG_USERAUTH_REQUEST);
558: packet_put_raw(buffer_ptr(&b), buffer_len(&b));
559: buffer_free(&b);
560: packet_send();
1.17 markus 561:
562: return 1;
1.16 markus 563: }
564:
1.27.2.3 jason 565: int
566: send_pubkey_test(Authctxt *authctxt, Key *k, sign_cb_fn *sign_callback,
567: int hint)
1.20 markus 568: {
1.27.2.3 jason 569: u_char *blob;
570: int bloblen, have_sig = 0;
571:
572: debug3("send_pubkey_test");
573:
574: if (key_to_blob(k, &blob, &bloblen) == 0) {
575: /* we cannot handle this key */
576: debug3("send_pubkey_test: cannot handle key");
577: return 0;
578: }
579: /* register callback for USERAUTH_PK_OK message */
580: authctxt->last_key_sign = sign_callback;
581: authctxt->last_key_hint = hint;
582: authctxt->last_key = k;
583: dispatch_set(SSH2_MSG_USERAUTH_PK_OK, &input_userauth_pk_ok);
584:
585: packet_start(SSH2_MSG_USERAUTH_REQUEST);
586: packet_put_cstring(authctxt->server_user);
587: packet_put_cstring(authctxt->service);
588: packet_put_cstring(authctxt->method->name);
589: packet_put_char(have_sig);
590: if (!(datafellows & SSH_BUG_PKAUTH))
591: packet_put_cstring(key_ssh_name(k));
592: packet_put_string(blob, bloblen);
593: xfree(blob);
594: packet_send();
595: return 1;
1.20 markus 596: }
597:
1.27.2.3 jason 598: Key *
599: load_identity_file(char *filename)
1.16 markus 600: {
1.27.2.3 jason 601: Key *private;
602: char prompt[300], *passphrase;
1.27.2.4! jason 603: int quit, i;
1.16 markus 604: struct stat st;
605:
1.27.2.3 jason 606: if (stat(filename, &st) < 0) {
607: debug3("no such identity: %s", filename);
608: return NULL;
1.16 markus 609: }
1.27.2.4! jason 610: private = key_load_private_type(KEY_UNSPEC, filename, "", NULL);
! 611: if (private == NULL) {
! 612: if (options.batch_mode)
1.27.2.3 jason 613: return NULL;
1.16 markus 614: snprintf(prompt, sizeof prompt,
1.27.2.1 jason 615: "Enter passphrase for key '%.100s': ", filename);
1.20 markus 616: for (i = 0; i < options.number_of_password_prompts; i++) {
617: passphrase = read_passphrase(prompt, 0);
618: if (strcmp(passphrase, "") != 0) {
1.27.2.4! jason 619: private = key_load_private_type(KEY_UNSPEC, filename,
! 620: passphrase, NULL);
1.27.2.3 jason 621: quit = 0;
1.20 markus 622: } else {
623: debug2("no passphrase given, try next key");
1.27.2.3 jason 624: quit = 1;
1.20 markus 625: }
626: memset(passphrase, 0, strlen(passphrase));
627: xfree(passphrase);
1.27.2.4! jason 628: if (private != NULL || quit)
1.20 markus 629: break;
630: debug2("bad passphrase given, try again...");
631: }
1.16 markus 632: }
1.27.2.3 jason 633: return private;
634: }
635:
636: int
637: identity_sign_cb(Authctxt *authctxt, Key *key, u_char **sigp, int *lenp,
638: u_char *data, int datalen)
639: {
640: Key *private;
641: int idx, ret;
642:
643: idx = authctxt->last_key_hint;
644: if (idx < 0)
645: return -1;
646: private = load_identity_file(options.identity_files[idx]);
647: if (private == NULL)
648: return -1;
649: ret = key_sign(private, sigp, lenp, data, datalen);
650: key_free(private);
1.17 markus 651: return ret;
652: }
653:
1.27.2.1 jason 654: int agent_sign_cb(Authctxt *authctxt, Key *key, u_char **sigp, int *lenp,
655: u_char *data, int datalen)
1.17 markus 656: {
1.20 markus 657: return ssh_agent_sign(authctxt->agent, key, sigp, lenp, data, datalen);
1.17 markus 658: }
659:
1.27.2.3 jason 660: int key_sign_cb(Authctxt *authctxt, Key *key, u_char **sigp, int *lenp,
661: u_char *data, int datalen)
662: {
1.27.2.4! jason 663: return key_sign(key, sigp, lenp, data, datalen);
1.27.2.3 jason 664: }
665:
1.17 markus 666: int
1.20 markus 667: userauth_pubkey_agent(Authctxt *authctxt)
1.17 markus 668: {
669: static int called = 0;
1.27.2.1 jason 670: int ret = 0;
1.17 markus 671: char *comment;
672: Key *k;
673:
674: if (called == 0) {
1.27.2.1 jason 675: if (ssh_get_num_identities(authctxt->agent, 2) == 0)
676: debug2("userauth_pubkey_agent: no keys at all");
1.20 markus 677: called = 1;
1.17 markus 678: }
1.27.2.1 jason 679: k = ssh_get_next_identity(authctxt->agent, &comment, 2);
1.20 markus 680: if (k == NULL) {
1.27.2.1 jason 681: debug2("userauth_pubkey_agent: no more keys");
682: } else {
1.27.2.3 jason 683: debug("userauth_pubkey_agent: testing agent key %s", comment);
1.27.2.1 jason 684: xfree(comment);
1.27.2.3 jason 685: ret = send_pubkey_test(authctxt, k, agent_sign_cb, -1);
686: if (ret == 0)
687: key_free(k);
1.20 markus 688: }
1.27.2.1 jason 689: if (ret == 0)
690: debug2("userauth_pubkey_agent: no message sent");
1.17 markus 691: return ret;
1.1 markus 692: }
693:
1.20 markus 694: int
695: userauth_pubkey(Authctxt *authctxt)
696: {
697: static int idx = 0;
698: int sent = 0;
1.27.2.3 jason 699: Key *key;
700: char *filename;
1.20 markus 701:
1.27.2.1 jason 702: if (authctxt->agent != NULL) {
703: do {
704: sent = userauth_pubkey_agent(authctxt);
705: } while(!sent && authctxt->agent->howmany > 0);
706: }
707: while (!sent && idx < options.num_identity_files) {
1.27.2.3 jason 708: key = options.identity_keys[idx];
709: filename = options.identity_files[idx];
710: if (key == NULL) {
711: debug("try privkey: %s", filename);
712: key = load_identity_file(filename);
713: if (key != NULL) {
714: sent = sign_and_send_pubkey(authctxt, key,
715: key_sign_cb);
716: key_free(key);
717: }
718: } else if (key->type != KEY_RSA1) {
719: debug("try pubkey: %s", filename);
720: sent = send_pubkey_test(authctxt, key,
721: identity_sign_cb, idx);
722: }
1.27.2.1 jason 723: idx++;
724: }
1.20 markus 725: return sent;
726: }
727:
1.23 markus 728: /*
729: * Send userauth request message specifying keyboard-interactive method.
730: */
731: int
732: userauth_kbdint(Authctxt *authctxt)
733: {
734: static int attempt = 0;
735:
736: if (attempt++ >= options.number_of_password_prompts)
737: return 0;
738:
739: debug2("userauth_kbdint");
740: packet_start(SSH2_MSG_USERAUTH_REQUEST);
741: packet_put_cstring(authctxt->server_user);
742: packet_put_cstring(authctxt->service);
743: packet_put_cstring(authctxt->method->name);
744: packet_put_cstring(""); /* lang */
745: packet_put_cstring(options.kbd_interactive_devices ?
746: options.kbd_interactive_devices : "");
747: packet_send();
748:
749: dispatch_set(SSH2_MSG_USERAUTH_INFO_REQUEST, &input_userauth_info_req);
750: return 1;
751: }
752:
753: /*
1.27.2.1 jason 754: * parse INFO_REQUEST, prompt user and send INFO_RESPONSE
1.23 markus 755: */
756: void
757: input_userauth_info_req(int type, int plen, void *ctxt)
758: {
759: Authctxt *authctxt = ctxt;
1.27.2.1 jason 760: char *name, *inst, *lang, *prompt, *response;
761: u_int num_prompts, i;
1.23 markus 762: int echo = 0;
763:
764: debug2("input_userauth_info_req");
765:
766: if (authctxt == NULL)
767: fatal("input_userauth_info_req: no authentication context");
768:
769: name = packet_get_string(NULL);
770: inst = packet_get_string(NULL);
771: lang = packet_get_string(NULL);
772: if (strlen(name) > 0)
773: cli_mesg(name);
774: if (strlen(inst) > 0)
775: cli_mesg(inst);
1.27.2.1 jason 776: xfree(name);
1.23 markus 777: xfree(inst);
1.27.2.1 jason 778: xfree(lang);
1.23 markus 779:
780: num_prompts = packet_get_int();
781: /*
782: * Begin to build info response packet based on prompts requested.
783: * We commit to providing the correct number of responses, so if
784: * further on we run into a problem that prevents this, we have to
785: * be sure and clean this up and send a correct error response.
786: */
787: packet_start(SSH2_MSG_USERAUTH_INFO_RESPONSE);
788: packet_put_int(num_prompts);
789:
790: for (i = 0; i < num_prompts; i++) {
791: prompt = packet_get_string(NULL);
792: echo = packet_get_char();
793:
794: response = cli_prompt(prompt, echo);
795:
1.27.2.3 jason 796: packet_put_cstring(response);
1.23 markus 797: memset(response, 0, strlen(response));
798: xfree(response);
799: xfree(prompt);
800: }
801: packet_done(); /* done with parsing incoming message. */
802:
1.27.2.3 jason 803: packet_inject_ignore(64);
1.23 markus 804: packet_send();
805: }
1.20 markus 806:
1.27.2.4! jason 807: /*
! 808: * this will be move to an external program (ssh-keysign) ASAP. ssh-keysign
! 809: * will be setuid-root and the sbit can be removed from /usr/bin/ssh.
! 810: */
! 811: int
! 812: userauth_hostbased(Authctxt *authctxt)
! 813: {
! 814: Key *private = NULL;
! 815: Buffer b;
! 816: u_char *signature, *blob;
! 817: char *chost, *pkalg, *p;
! 818: const char *service;
! 819: u_int blen, slen;
! 820: int ok, i, len, found = 0;
! 821:
! 822: p = get_local_name(packet_get_connection_in());
! 823: if (p == NULL) {
! 824: error("userauth_hostbased: cannot get local ipaddr/name");
! 825: return 0;
! 826: }
! 827: len = strlen(p) + 2;
! 828: chost = xmalloc(len);
! 829: strlcpy(chost, p, len);
! 830: strlcat(chost, ".", len);
! 831: debug2("userauth_hostbased: chost %s", chost);
! 832: /* check for a useful key */
! 833: for (i = 0; i < authctxt->nkeys; i++) {
! 834: private = authctxt->keys[i];
! 835: if (private && private->type != KEY_RSA1) {
! 836: found = 1;
! 837: /* we take and free the key */
! 838: authctxt->keys[i] = NULL;
! 839: break;
! 840: }
! 841: }
! 842: if (!found) {
! 843: xfree(chost);
! 844: return 0;
! 845: }
! 846: if (key_to_blob(private, &blob, &blen) == 0) {
! 847: key_free(private);
! 848: xfree(chost);
! 849: return 0;
! 850: }
! 851: service = datafellows & SSH_BUG_HBSERVICE ? "ssh-userauth" :
! 852: authctxt->service;
! 853: pkalg = xstrdup(key_ssh_name(private));
! 854: buffer_init(&b);
! 855: /* construct data */
! 856: buffer_put_string(&b, session_id2, session_id2_len);
! 857: buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
! 858: buffer_put_cstring(&b, authctxt->server_user);
! 859: buffer_put_cstring(&b, service);
! 860: buffer_put_cstring(&b, authctxt->method->name);
! 861: buffer_put_cstring(&b, pkalg);
! 862: buffer_put_string(&b, blob, blen);
! 863: buffer_put_cstring(&b, chost);
! 864: buffer_put_cstring(&b, authctxt->local_user);
! 865: #ifdef DEBUG_PK
! 866: buffer_dump(&b);
! 867: #endif
! 868: debug2("xxx: chost %s", chost);
! 869: ok = key_sign(private, &signature, &slen, buffer_ptr(&b), buffer_len(&b));
! 870: key_free(private);
! 871: buffer_free(&b);
! 872: if (ok != 0) {
! 873: error("key_sign failed");
! 874: xfree(chost);
! 875: xfree(pkalg);
! 876: return 0;
! 877: }
! 878: packet_start(SSH2_MSG_USERAUTH_REQUEST);
! 879: packet_put_cstring(authctxt->server_user);
! 880: packet_put_cstring(authctxt->service);
! 881: packet_put_cstring(authctxt->method->name);
! 882: packet_put_cstring(pkalg);
! 883: packet_put_string(blob, blen);
! 884: packet_put_cstring(chost);
! 885: packet_put_cstring(authctxt->local_user);
! 886: packet_put_string(signature, slen);
! 887: memset(signature, 's', slen);
! 888: xfree(signature);
! 889: xfree(chost);
! 890: xfree(pkalg);
! 891:
! 892: packet_send();
! 893: return 1;
! 894: }
! 895:
1.20 markus 896: /* find auth method */
897:
898: /*
899: * given auth method name, if configurable options permit this method fill
900: * in auth_ident field and return true, otherwise return false.
901: */
902: int
903: authmethod_is_enabled(Authmethod *method)
904: {
905: if (method == NULL)
906: return 0;
907: /* return false if options indicate this method is disabled */
908: if (method->enabled == NULL || *method->enabled == 0)
909: return 0;
910: /* return false if batch mode is enabled but method needs interactive mode */
911: if (method->batch_flag != NULL && *method->batch_flag != 0)
912: return 0;
913: return 1;
914: }
915:
916: Authmethod *
917: authmethod_lookup(const char *name)
1.1 markus 918: {
1.20 markus 919: Authmethod *method = NULL;
920: if (name != NULL)
921: for (method = authmethods; method->name != NULL; method++)
922: if (strcmp(name, method->name) == 0)
923: return method;
924: debug2("Unrecognized authentication method name: %s", name ? name : "NULL");
925: return NULL;
926: }
1.1 markus 927:
1.27.2.3 jason 928: /* XXX internal state */
929: static Authmethod *current = NULL;
930: static char *supported = NULL;
931: static char *preferred = NULL;
1.20 markus 932: /*
933: * Given the authentication method list sent by the server, return the
934: * next method we should try. If the server initially sends a nil list,
1.27.2.4! jason 935: * use a built-in default list.
1.27.2.1 jason 936: */
1.20 markus 937: Authmethod *
938: authmethod_get(char *authlist)
939: {
1.27.2.3 jason 940:
941: char *name = NULL;
942: int next;
1.27.2.1 jason 943:
1.20 markus 944: /* Use a suitable default if we're passed a nil list. */
945: if (authlist == NULL || strlen(authlist) == 0)
1.27.2.3 jason 946: authlist = options.preferred_authentications;
1.20 markus 947:
1.27.2.3 jason 948: if (supported == NULL || strcmp(authlist, supported) != 0) {
949: debug3("start over, passed a different list %s", authlist);
950: if (supported != NULL)
951: xfree(supported);
952: supported = xstrdup(authlist);
953: preferred = options.preferred_authentications;
954: debug3("preferred %s", preferred);
955: current = NULL;
956: } else if (current != NULL && authmethod_is_enabled(current))
957: return current;
1.20 markus 958:
1.27.2.3 jason 959: for (;;) {
960: if ((name = match_list(preferred, supported, &next)) == NULL) {
961: debug("no more auth methods to try");
962: current = NULL;
963: return NULL;
964: }
965: preferred += next;
1.23 markus 966: debug3("authmethod_lookup %s", name);
1.27.2.3 jason 967: debug3("remaining preferred: %s", preferred);
968: if ((current = authmethod_lookup(name)) != NULL &&
969: authmethod_is_enabled(current)) {
1.23 markus 970: debug3("authmethod_is_enabled %s", name);
1.27.2.3 jason 971: debug("next auth method to try is %s", name);
972: return current;
1.23 markus 973: }
1.1 markus 974: }
1.27.2.3 jason 975: }
1.1 markus 976:
1.27 provos 977:
1.27.2.3 jason 978: #define DELIM ","
979: char *
980: authmethods_get(void)
981: {
982: Authmethod *method = NULL;
983: char buf[1024];
1.27 provos 984:
1.27.2.3 jason 985: buf[0] = '\0';
986: for (method = authmethods; method->name != NULL; method++) {
987: if (authmethod_is_enabled(method)) {
988: if (buf[0] != '\0')
989: strlcat(buf, DELIM, sizeof buf);
990: strlcat(buf, method->name, sizeof buf);
991: }
992: }
993: return xstrdup(buf);
1.1 markus 994: }
![[BACK]](/icons/back.gif){kind=icon}
Return to sshconnect2.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh