Annotation of src/usr.bin/ssh/sshconnect2.c, Revision 1.83.2.5
1.1 markus 1: /*
2: * Copyright (c) 2000 Markus Friedl. All rights reserved.
3: *
4: * Redistribution and use in source and binary forms, with or without
5: * modification, are permitted provided that the following conditions
6: * are met:
7: * 1. Redistributions of source code must retain the above copyright
8: * notice, this list of conditions and the following disclaimer.
9: * 2. Redistributions in binary form must reproduce the above copyright
10: * notice, this list of conditions and the following disclaimer in the
11: * documentation and/or other materials provided with the distribution.
12: *
13: * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14: * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15: * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16: * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17: * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18: * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19: * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20: * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21: * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22: * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
23: */
24:
25: #include "includes.h"
1.83.2.5! miod 26: RCSID("$OpenBSD: sshconnect2.c,v 1.83.2.4 2002/06/22 07:23:18 miod Exp $");
1.1 markus 27:
28: #include "ssh.h"
1.37 markus 29: #include "ssh2.h"
1.1 markus 30: #include "xmalloc.h"
31: #include "buffer.h"
32: #include "packet.h"
33: #include "compat.h"
34: #include "bufaux.h"
1.37 markus 35: #include "cipher.h"
1.1 markus 36: #include "kex.h"
37: #include "myproposal.h"
38: #include "sshconnect.h"
39: #include "authfile.h"
1.57 provos 40: #include "dh.h"
1.17 markus 41: #include "authfd.h"
1.37 markus 42: #include "log.h"
43: #include "readconf.h"
44: #include "readpass.h"
1.53 markus 45: #include "match.h"
1.61 markus 46: #include "dispatch.h"
1.68 markus 47: #include "canohost.h"
1.83.2.4 miod 48: #include "msg.h"
49: #include "pathnames.h"
1.22 provos 50:
1.1 markus 51: /* import */
52: extern char *client_version_string;
53: extern char *server_version_string;
54: extern Options options;
55:
56: /*
57: * SSH2 key exchange
58: */
59:
1.32 markus 60: u_char *session_id2 = NULL;
1.1 markus 61: int session_id2_len = 0;
62:
1.61 markus 63: char *xxx_host;
64: struct sockaddr *xxx_hostaddr;
65:
1.63 markus 66: Kex *xxx_kex = NULL;
67:
1.76 itojun 68: static int
1.75 markus 69: verify_host_key_callback(Key *hostkey)
1.61 markus 70: {
1.75 markus 71: if (verify_host_key(xxx_host, xxx_hostaddr, hostkey) == -1)
1.83 markus 72: fatal("Host key verification failed.");
1.61 markus 73: return 0;
74: }
75:
1.1 markus 76: void
1.22 provos 77: ssh_kex2(char *host, struct sockaddr *hostaddr)
78: {
79: Kex *kex;
1.61 markus 80:
81: xxx_host = host;
82: xxx_hostaddr = hostaddr;
1.22 provos 83:
1.29 markus 84: if (options.ciphers == (char *)-1) {
85: log("No valid ciphers for protocol version 2 given, using defaults.");
86: options.ciphers = NULL;
1.24 markus 87: }
1.22 provos 88: if (options.ciphers != NULL) {
89: myproposal[PROPOSAL_ENC_ALGS_CTOS] =
90: myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
91: }
1.60 stevesk 92: myproposal[PROPOSAL_ENC_ALGS_CTOS] =
93: compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]);
94: myproposal[PROPOSAL_ENC_ALGS_STOC] =
95: compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_STOC]);
1.22 provos 96: if (options.compression) {
1.47 markus 97: myproposal[PROPOSAL_COMP_ALGS_CTOS] =
1.22 provos 98: myproposal[PROPOSAL_COMP_ALGS_STOC] = "zlib";
99: } else {
1.47 markus 100: myproposal[PROPOSAL_COMP_ALGS_CTOS] =
1.22 provos 101: myproposal[PROPOSAL_COMP_ALGS_STOC] = "none";
1.47 markus 102: }
103: if (options.macs != NULL) {
104: myproposal[PROPOSAL_MAC_ALGS_CTOS] =
105: myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
1.22 provos 106: }
1.70 markus 107: if (options.hostkeyalgorithms != NULL)
1.83.2.2 jason 108: myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
1.70 markus 109: options.hostkeyalgorithms;
1.22 provos 110:
1.65 markus 111: /* start key exchange */
1.64 markus 112: kex = kex_setup(myproposal);
1.61 markus 113: kex->client_version_string=client_version_string;
114: kex->server_version_string=server_version_string;
1.75 markus 115: kex->verify_host_key=&verify_host_key_callback;
1.63 markus 116:
117: xxx_kex = kex;
1.22 provos 118:
1.66 markus 119: dispatch_run(DISPATCH_BLOCK, &kex->done, kex);
1.62 markus 120:
121: session_id2 = kex->session_id;
122: session_id2_len = kex->session_id_len;
1.22 provos 123:
124: #ifdef DEBUG_KEXDH
125: /* send 1st encrypted/maced/compressed message */
126: packet_start(SSH2_MSG_IGNORE);
127: packet_put_cstring("markus");
128: packet_send();
129: packet_write_wait();
130: #endif
1.61 markus 131: debug("done: ssh_kex2.");
1.1 markus 132: }
1.11 markus 133:
1.1 markus 134: /*
135: * Authenticate user
136: */
1.20 markus 137:
138: typedef struct Authctxt Authctxt;
139: typedef struct Authmethod Authmethod;
140:
141: typedef int sign_cb_fn(
142: Authctxt *authctxt, Key *key,
1.83.2.2 jason 143: u_char **sigp, u_int *lenp, u_char *data, u_int datalen);
1.20 markus 144:
145: struct Authctxt {
146: const char *server_user;
1.68 markus 147: const char *local_user;
1.20 markus 148: const char *host;
149: const char *service;
1.23 markus 150: Authmethod *method;
1.20 markus 151: int success;
1.51 markus 152: char *authlist;
1.68 markus 153: /* pubkey */
1.51 markus 154: Key *last_key;
155: sign_cb_fn *last_key_sign;
156: int last_key_hint;
1.68 markus 157: AuthenticationConnection *agent;
158: /* hostbased */
1.83.2.4 miod 159: Sensitive *sensitive;
1.82 markus 160: /* kbd-interactive */
161: int info_req_seen;
1.20 markus 162: };
163: struct Authmethod {
164: char *name; /* string to compare against server's list */
165: int (*userauth)(Authctxt *authctxt);
166: int *enabled; /* flag in option struct that enables method */
167: int *batch_flag; /* flag in option struct that disables method */
168: };
169:
1.83.2.2 jason 170: void input_userauth_success(int, u_int32_t, void *);
171: void input_userauth_failure(int, u_int32_t, void *);
172: void input_userauth_banner(int, u_int32_t, void *);
173: void input_userauth_error(int, u_int32_t, void *);
174: void input_userauth_info_req(int, u_int32_t, void *);
175: void input_userauth_pk_ok(int, u_int32_t, void *);
1.83.2.3 miod 176: void input_userauth_passwd_changereq(int, u_int32_t, void *);
1.83.2.2 jason 177:
178: int userauth_none(Authctxt *);
179: int userauth_pubkey(Authctxt *);
180: int userauth_passwd(Authctxt *);
181: int userauth_kbdint(Authctxt *);
182: int userauth_hostbased(Authctxt *);
1.20 markus 183:
1.83.2.2 jason 184: void userauth(Authctxt *, char *);
1.51 markus 185:
1.76 itojun 186: static int sign_and_send_pubkey(Authctxt *, Key *, sign_cb_fn *);
187: static void clear_auth_state(Authctxt *);
188:
189: static Authmethod *authmethod_get(char *authlist);
190: static Authmethod *authmethod_lookup(const char *name);
191: static char *authmethods_get(void);
1.20 markus 192:
193: Authmethod authmethods[] = {
1.81 markus 194: {"hostbased",
195: userauth_hostbased,
196: &options.hostbased_authentication,
197: NULL},
1.20 markus 198: {"publickey",
199: userauth_pubkey,
1.28 markus 200: &options.pubkey_authentication,
1.20 markus 201: NULL},
1.81 markus 202: {"keyboard-interactive",
203: userauth_kbdint,
204: &options.kbd_interactive_authentication,
205: &options.batch_mode},
1.20 markus 206: {"password",
207: userauth_passwd,
208: &options.password_authentication,
1.23 markus 209: &options.batch_mode},
210: {"none",
211: userauth_none,
212: NULL,
213: NULL},
1.20 markus 214: {NULL, NULL, NULL, NULL}
215: };
216:
217: void
1.68 markus 218: ssh_userauth2(const char *local_user, const char *server_user, char *host,
1.83.2.4 miod 219: Sensitive *sensitive)
1.20 markus 220: {
221: Authctxt authctxt;
222: int type;
1.39 markus 223:
1.73 markus 224: if (options.challenge_response_authentication)
1.39 markus 225: options.kbd_interactive_authentication = 1;
1.20 markus 226:
227: debug("send SSH2_MSG_SERVICE_REQUEST");
228: packet_start(SSH2_MSG_SERVICE_REQUEST);
229: packet_put_cstring("ssh-userauth");
230: packet_send();
231: packet_write_wait();
1.83.2.2 jason 232: type = packet_read();
1.20 markus 233: if (type != SSH2_MSG_SERVICE_ACCEPT) {
234: fatal("denied SSH2_MSG_SERVICE_ACCEPT: %d", type);
235: }
236: if (packet_remaining() > 0) {
1.83.2.2 jason 237: char *reply = packet_get_string(NULL);
1.20 markus 238: debug("service_accept: %s", reply);
239: xfree(reply);
240: } else {
241: debug("buggy server: service_accept w/o service");
242: }
1.83.2.2 jason 243: packet_check_eom();
1.20 markus 244: debug("got SSH2_MSG_SERVICE_ACCEPT");
245:
1.53 markus 246: if (options.preferred_authentications == NULL)
247: options.preferred_authentications = authmethods_get();
248:
1.20 markus 249: /* setup authentication context */
1.82 markus 250: memset(&authctxt, 0, sizeof(authctxt));
1.20 markus 251: authctxt.agent = ssh_get_authentication_connection();
252: authctxt.server_user = server_user;
1.68 markus 253: authctxt.local_user = local_user;
1.20 markus 254: authctxt.host = host;
255: authctxt.service = "ssh-connection"; /* service name */
256: authctxt.success = 0;
1.23 markus 257: authctxt.method = authmethod_lookup("none");
1.51 markus 258: authctxt.authlist = NULL;
1.83.2.4 miod 259: authctxt.sensitive = sensitive;
1.82 markus 260: authctxt.info_req_seen = 0;
1.23 markus 261: if (authctxt.method == NULL)
262: fatal("ssh_userauth2: internal error: cannot send userauth none request");
1.20 markus 263:
264: /* initial userauth request */
1.23 markus 265: userauth_none(&authctxt);
1.20 markus 266:
1.65 markus 267: dispatch_init(&input_userauth_error);
1.20 markus 268: dispatch_set(SSH2_MSG_USERAUTH_SUCCESS, &input_userauth_success);
269: dispatch_set(SSH2_MSG_USERAUTH_FAILURE, &input_userauth_failure);
1.35 markus 270: dispatch_set(SSH2_MSG_USERAUTH_BANNER, &input_userauth_banner);
1.20 markus 271: dispatch_run(DISPATCH_BLOCK, &authctxt.success, &authctxt); /* loop until success */
272:
273: if (authctxt.agent != NULL)
274: ssh_close_authentication_connection(authctxt.agent);
275:
1.34 markus 276: debug("ssh-userauth2 successful: method %s", authctxt.method->name);
1.20 markus 277: }
278: void
1.51 markus 279: userauth(Authctxt *authctxt, char *authlist)
280: {
281: if (authlist == NULL) {
282: authlist = authctxt->authlist;
283: } else {
284: if (authctxt->authlist)
285: xfree(authctxt->authlist);
286: authctxt->authlist = authlist;
287: }
288: for (;;) {
289: Authmethod *method = authmethod_get(authlist);
290: if (method == NULL)
291: fatal("Permission denied (%s).", authlist);
292: authctxt->method = method;
293: if (method->userauth(authctxt) != 0) {
294: debug2("we sent a %s packet, wait for reply", method->name);
295: break;
296: } else {
297: debug2("we did not send a packet, disable method");
298: method->enabled = NULL;
299: }
300: }
301: }
1.83.2.5! miod 302:
1.51 markus 303: void
1.83.2.2 jason 304: input_userauth_error(int type, u_int32_t seq, void *ctxt)
1.20 markus 305: {
1.35 markus 306: fatal("input_userauth_error: bad message during authentication: "
307: "type %d", type);
308: }
1.83.2.5! miod 309:
1.35 markus 310: void
1.83.2.2 jason 311: input_userauth_banner(int type, u_int32_t seq, void *ctxt)
1.35 markus 312: {
313: char *msg, *lang;
314: debug3("input_userauth_banner");
315: msg = packet_get_string(NULL);
316: lang = packet_get_string(NULL);
317: fprintf(stderr, "%s", msg);
318: xfree(msg);
319: xfree(lang);
1.20 markus 320: }
1.83.2.5! miod 321:
1.20 markus 322: void
1.83.2.2 jason 323: input_userauth_success(int type, u_int32_t seq, void *ctxt)
1.20 markus 324: {
325: Authctxt *authctxt = ctxt;
326: if (authctxt == NULL)
327: fatal("input_userauth_success: no authentication context");
1.51 markus 328: if (authctxt->authlist)
329: xfree(authctxt->authlist);
330: clear_auth_state(authctxt);
1.20 markus 331: authctxt->success = 1; /* break out */
332: }
1.83.2.5! miod 333:
1.20 markus 334: void
1.83.2.2 jason 335: input_userauth_failure(int type, u_int32_t seq, void *ctxt)
1.20 markus 336: {
337: Authctxt *authctxt = ctxt;
338: char *authlist = NULL;
339: int partial;
340:
341: if (authctxt == NULL)
342: fatal("input_userauth_failure: no authentication context");
343:
1.23 markus 344: authlist = packet_get_string(NULL);
1.20 markus 345: partial = packet_get_char();
1.83.2.2 jason 346: packet_check_eom();
1.20 markus 347:
348: if (partial != 0)
1.45 markus 349: log("Authenticated with partial success.");
1.20 markus 350: debug("authentications that can continue: %s", authlist);
351:
1.51 markus 352: clear_auth_state(authctxt);
353: userauth(authctxt, authlist);
354: }
355: void
1.83.2.2 jason 356: input_userauth_pk_ok(int type, u_int32_t seq, void *ctxt)
1.51 markus 357: {
358: Authctxt *authctxt = ctxt;
359: Key *key = NULL;
360: Buffer b;
1.83.2.2 jason 361: int pktype, sent = 0;
362: u_int alen, blen;
363: char *pkalg, *fp;
364: u_char *pkblob;
1.51 markus 365:
366: if (authctxt == NULL)
367: fatal("input_userauth_pk_ok: no authentication context");
368: if (datafellows & SSH_BUG_PKOK) {
369: /* this is similar to SSH_BUG_PKAUTH */
370: debug2("input_userauth_pk_ok: SSH_BUG_PKOK");
371: pkblob = packet_get_string(&blen);
372: buffer_init(&b);
373: buffer_append(&b, pkblob, blen);
374: pkalg = buffer_get_string(&b, &alen);
375: buffer_free(&b);
376: } else {
377: pkalg = packet_get_string(&alen);
378: pkblob = packet_get_string(&blen);
379: }
1.83.2.2 jason 380: packet_check_eom();
1.51 markus 381:
1.83.2.5! miod 382: debug("input_userauth_pk_ok: pkalg %s blen %u lastkey %p hint %d",
1.51 markus 383: pkalg, blen, authctxt->last_key, authctxt->last_key_hint);
384:
385: do {
386: if (authctxt->last_key == NULL ||
387: authctxt->last_key_sign == NULL) {
388: debug("no last key or no sign cb");
389: break;
390: }
1.83.2.2 jason 391: if ((pktype = key_type_from_name(pkalg)) == KEY_UNSPEC) {
1.51 markus 392: debug("unknown pkalg %s", pkalg);
393: break;
394: }
395: if ((key = key_from_blob(pkblob, blen)) == NULL) {
396: debug("no key from blob. pkalg %s", pkalg);
397: break;
398: }
1.83.2.3 miod 399: if (key->type != pktype) {
1.83.2.2 jason 400: error("input_userauth_pk_ok: type mismatch "
401: "for decoded key (received %d, expected %d)",
1.83.2.4 miod 402: key->type, pktype);
1.83.2.2 jason 403: break;
404: }
1.54 markus 405: fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
406: debug2("input_userauth_pk_ok: fp %s", fp);
407: xfree(fp);
1.51 markus 408: if (!key_equal(key, authctxt->last_key)) {
409: debug("key != last_key");
1.20 markus 410: break;
411: }
1.51 markus 412: sent = sign_and_send_pubkey(authctxt, key,
413: authctxt->last_key_sign);
1.83.2.2 jason 414: } while (0);
1.51 markus 415:
416: if (key != NULL)
417: key_free(key);
418: xfree(pkalg);
419: xfree(pkblob);
420:
421: /* unregister */
422: clear_auth_state(authctxt);
423: dispatch_set(SSH2_MSG_USERAUTH_PK_OK, NULL);
424:
425: /* try another method if we did not send a packet*/
426: if (sent == 0)
427: userauth(authctxt, NULL);
428:
1.20 markus 429: }
430:
1.1 markus 431: int
1.23 markus 432: userauth_none(Authctxt *authctxt)
433: {
434: /* initial userauth request */
435: packet_start(SSH2_MSG_USERAUTH_REQUEST);
436: packet_put_cstring(authctxt->server_user);
437: packet_put_cstring(authctxt->service);
438: packet_put_cstring(authctxt->method->name);
439: packet_send();
440: return 1;
441: }
442:
443: int
1.20 markus 444: userauth_passwd(Authctxt *authctxt)
1.1 markus 445: {
1.6 markus 446: static int attempt = 0;
1.83.2.3 miod 447: char prompt[150];
1.1 markus 448: char *password;
1.6 markus 449:
1.13 todd 450: if (attempt++ >= options.number_of_password_prompts)
1.6 markus 451: return 0;
1.13 todd 452:
1.83.2.2 jason 453: if (attempt != 1)
1.13 todd 454: error("Permission denied, please try again.");
1.1 markus 455:
1.43 itojun 456: snprintf(prompt, sizeof(prompt), "%.30s@%.128s's password: ",
1.20 markus 457: authctxt->server_user, authctxt->host);
1.1 markus 458: password = read_passphrase(prompt, 0);
459: packet_start(SSH2_MSG_USERAUTH_REQUEST);
1.20 markus 460: packet_put_cstring(authctxt->server_user);
461: packet_put_cstring(authctxt->service);
1.23 markus 462: packet_put_cstring(authctxt->method->name);
1.1 markus 463: packet_put_char(0);
1.49 markus 464: packet_put_cstring(password);
1.1 markus 465: memset(password, 0, strlen(password));
466: xfree(password);
1.83.2.1 jason 467: packet_add_padding(64);
1.1 markus 468: packet_send();
1.83.2.3 miod 469:
1.83.2.4 miod 470: dispatch_set(SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ,
1.83.2.3 miod 471: &input_userauth_passwd_changereq);
472:
1.1 markus 473: return 1;
474: }
1.83.2.3 miod 475: /*
476: * parse PASSWD_CHANGEREQ, prompt user and send SSH2_MSG_USERAUTH_REQUEST
477: */
478: void
479: input_userauth_passwd_changereq(int type, uint32_t seqnr, void *ctxt)
480: {
481: Authctxt *authctxt = ctxt;
482: char *info, *lang, *password = NULL, *retype = NULL;
483: char prompt[150];
484:
485: debug2("input_userauth_passwd_changereq");
486:
487: if (authctxt == NULL)
488: fatal("input_userauth_passwd_changereq: "
489: "no authentication context");
490:
491: info = packet_get_string(NULL);
492: lang = packet_get_string(NULL);
493: if (strlen(info) > 0)
494: log("%s", info);
495: xfree(info);
496: xfree(lang);
497: packet_start(SSH2_MSG_USERAUTH_REQUEST);
498: packet_put_cstring(authctxt->server_user);
499: packet_put_cstring(authctxt->service);
500: packet_put_cstring(authctxt->method->name);
501: packet_put_char(1); /* additional info */
1.83.2.4 miod 502: snprintf(prompt, sizeof(prompt),
1.83.2.3 miod 503: "Enter %.30s@%.128s's old password: ",
504: authctxt->server_user, authctxt->host);
505: password = read_passphrase(prompt, 0);
506: packet_put_cstring(password);
507: memset(password, 0, strlen(password));
508: xfree(password);
509: password = NULL;
510: while (password == NULL) {
1.83.2.4 miod 511: snprintf(prompt, sizeof(prompt),
1.83.2.3 miod 512: "Enter %.30s@%.128s's new password: ",
513: authctxt->server_user, authctxt->host);
514: password = read_passphrase(prompt, RP_ALLOW_EOF);
515: if (password == NULL) {
516: /* bail out */
517: return;
518: }
1.83.2.4 miod 519: snprintf(prompt, sizeof(prompt),
1.83.2.3 miod 520: "Retype %.30s@%.128s's new password: ",
521: authctxt->server_user, authctxt->host);
522: retype = read_passphrase(prompt, 0);
523: if (strcmp(password, retype) != 0) {
524: memset(password, 0, strlen(password));
525: xfree(password);
526: log("Mismatch; try again, EOF to quit.");
527: password = NULL;
528: }
529: memset(retype, 0, strlen(retype));
530: xfree(retype);
531: }
532: packet_put_cstring(password);
533: memset(password, 0, strlen(password));
534: xfree(password);
535: packet_add_padding(64);
536: packet_send();
1.83.2.4 miod 537:
538: dispatch_set(SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ,
1.83.2.3 miod 539: &input_userauth_passwd_changereq);
540: }
1.1 markus 541:
1.79 stevesk 542: static void
1.51 markus 543: clear_auth_state(Authctxt *authctxt)
544: {
545: /* XXX clear authentication state */
1.83.2.3 miod 546: dispatch_set(SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ, NULL);
547:
1.51 markus 548: if (authctxt->last_key != NULL && authctxt->last_key_hint == -1) {
549: debug3("clear_auth_state: key_free %p", authctxt->last_key);
550: key_free(authctxt->last_key);
551: }
552: authctxt->last_key = NULL;
553: authctxt->last_key_hint = -2;
554: authctxt->last_key_sign = NULL;
555: }
556:
1.76 itojun 557: static int
1.20 markus 558: sign_and_send_pubkey(Authctxt *authctxt, Key *k, sign_cb_fn *sign_callback)
1.1 markus 559: {
560: Buffer b;
1.32 markus 561: u_char *blob, *signature;
1.83.2.2 jason 562: u_int bloblen, slen;
1.14 markus 563: int skip = 0;
1.17 markus 564: int ret = -1;
1.23 markus 565: int have_sig = 1;
1.1 markus 566:
1.30 markus 567: debug3("sign_and_send_pubkey");
1.51 markus 568:
1.28 markus 569: if (key_to_blob(k, &blob, &bloblen) == 0) {
570: /* we cannot handle this key */
1.30 markus 571: debug3("sign_and_send_pubkey: cannot handle key");
1.28 markus 572: return 0;
573: }
1.1 markus 574: /* data to be signed */
575: buffer_init(&b);
1.26 markus 576: if (datafellows & SSH_OLD_SESSIONID) {
577: buffer_append(&b, session_id2, session_id2_len);
1.41 stevesk 578: skip = session_id2_len;
1.26 markus 579: } else {
1.14 markus 580: buffer_put_string(&b, session_id2, session_id2_len);
581: skip = buffer_len(&b);
582: }
1.1 markus 583: buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
1.20 markus 584: buffer_put_cstring(&b, authctxt->server_user);
1.10 markus 585: buffer_put_cstring(&b,
1.30 markus 586: datafellows & SSH_BUG_PKSERVICE ?
1.10 markus 587: "ssh-userauth" :
1.20 markus 588: authctxt->service);
1.30 markus 589: if (datafellows & SSH_BUG_PKAUTH) {
590: buffer_put_char(&b, have_sig);
591: } else {
592: buffer_put_cstring(&b, authctxt->method->name);
593: buffer_put_char(&b, have_sig);
1.41 stevesk 594: buffer_put_cstring(&b, key_ssh_name(k));
1.30 markus 595: }
1.1 markus 596: buffer_put_string(&b, blob, bloblen);
597:
598: /* generate signature */
1.51 markus 599: ret = (*sign_callback)(authctxt, k, &signature, &slen,
600: buffer_ptr(&b), buffer_len(&b));
1.17 markus 601: if (ret == -1) {
602: xfree(blob);
603: buffer_free(&b);
604: return 0;
605: }
1.28 markus 606: #ifdef DEBUG_PK
1.1 markus 607: buffer_dump(&b);
608: #endif
1.30 markus 609: if (datafellows & SSH_BUG_PKSERVICE) {
1.10 markus 610: buffer_clear(&b);
611: buffer_append(&b, session_id2, session_id2_len);
1.51 markus 612: skip = session_id2_len;
1.10 markus 613: buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
1.20 markus 614: buffer_put_cstring(&b, authctxt->server_user);
615: buffer_put_cstring(&b, authctxt->service);
1.23 markus 616: buffer_put_cstring(&b, authctxt->method->name);
617: buffer_put_char(&b, have_sig);
1.30 markus 618: if (!(datafellows & SSH_BUG_PKAUTH))
1.41 stevesk 619: buffer_put_cstring(&b, key_ssh_name(k));
1.10 markus 620: buffer_put_string(&b, blob, bloblen);
621: }
622: xfree(blob);
1.51 markus 623:
1.1 markus 624: /* append signature */
625: buffer_put_string(&b, signature, slen);
626: xfree(signature);
627:
628: /* skip session id and packet type */
1.14 markus 629: if (buffer_len(&b) < skip + 1)
1.20 markus 630: fatal("userauth_pubkey: internal error");
1.14 markus 631: buffer_consume(&b, skip + 1);
1.1 markus 632:
633: /* put remaining data from buffer into packet */
634: packet_start(SSH2_MSG_USERAUTH_REQUEST);
635: packet_put_raw(buffer_ptr(&b), buffer_len(&b));
636: buffer_free(&b);
637: packet_send();
1.17 markus 638:
639: return 1;
1.16 markus 640: }
641:
1.76 itojun 642: static int
1.51 markus 643: send_pubkey_test(Authctxt *authctxt, Key *k, sign_cb_fn *sign_callback,
644: int hint)
1.20 markus 645: {
1.51 markus 646: u_char *blob;
1.83.2.2 jason 647: u_int bloblen, have_sig = 0;
1.20 markus 648:
1.51 markus 649: debug3("send_pubkey_test");
1.16 markus 650:
1.51 markus 651: if (key_to_blob(k, &blob, &bloblen) == 0) {
652: /* we cannot handle this key */
653: debug3("send_pubkey_test: cannot handle key");
1.16 markus 654: return 0;
655: }
1.51 markus 656: /* register callback for USERAUTH_PK_OK message */
657: authctxt->last_key_sign = sign_callback;
658: authctxt->last_key_hint = hint;
659: authctxt->last_key = k;
660: dispatch_set(SSH2_MSG_USERAUTH_PK_OK, &input_userauth_pk_ok);
661:
662: packet_start(SSH2_MSG_USERAUTH_REQUEST);
663: packet_put_cstring(authctxt->server_user);
664: packet_put_cstring(authctxt->service);
665: packet_put_cstring(authctxt->method->name);
666: packet_put_char(have_sig);
667: if (!(datafellows & SSH_BUG_PKAUTH))
668: packet_put_cstring(key_ssh_name(k));
669: packet_put_string(blob, bloblen);
670: xfree(blob);
671: packet_send();
672: return 1;
673: }
674:
1.76 itojun 675: static Key *
1.51 markus 676: load_identity_file(char *filename)
677: {
678: Key *private;
679: char prompt[300], *passphrase;
1.56 markus 680: int quit, i;
1.52 markus 681: struct stat st;
1.16 markus 682:
1.52 markus 683: if (stat(filename, &st) < 0) {
684: debug3("no such identity: %s", filename);
685: return NULL;
686: }
1.56 markus 687: private = key_load_private_type(KEY_UNSPEC, filename, "", NULL);
688: if (private == NULL) {
689: if (options.batch_mode)
1.51 markus 690: return NULL;
1.16 markus 691: snprintf(prompt, sizeof prompt,
1.83.2.2 jason 692: "Enter passphrase for key '%.100s': ", filename);
1.20 markus 693: for (i = 0; i < options.number_of_password_prompts; i++) {
694: passphrase = read_passphrase(prompt, 0);
695: if (strcmp(passphrase, "") != 0) {
1.56 markus 696: private = key_load_private_type(KEY_UNSPEC, filename,
697: passphrase, NULL);
1.51 markus 698: quit = 0;
1.20 markus 699: } else {
700: debug2("no passphrase given, try next key");
1.51 markus 701: quit = 1;
1.20 markus 702: }
703: memset(passphrase, 0, strlen(passphrase));
704: xfree(passphrase);
1.56 markus 705: if (private != NULL || quit)
1.20 markus 706: break;
707: debug2("bad passphrase given, try again...");
1.16 markus 708: }
709: }
1.51 markus 710: return private;
711: }
712:
1.76 itojun 713: static int
1.83.2.2 jason 714: identity_sign_cb(Authctxt *authctxt, Key *key, u_char **sigp, u_int *lenp,
715: u_char *data, u_int datalen)
1.51 markus 716: {
717: Key *private;
718: int idx, ret;
719:
720: idx = authctxt->last_key_hint;
721: if (idx < 0)
722: return -1;
1.80 markus 723:
724: /* private key is stored in external hardware */
1.83.2.2 jason 725: if (options.identity_keys[idx]->flags & KEY_FLAG_EXT)
1.80 markus 726: return key_sign(options.identity_keys[idx], sigp, lenp, data, datalen);
727:
1.51 markus 728: private = load_identity_file(options.identity_files[idx]);
729: if (private == NULL)
730: return -1;
731: ret = key_sign(private, sigp, lenp, data, datalen);
732: key_free(private);
1.17 markus 733: return ret;
734: }
735:
1.76 itojun 736: static int
1.83.2.2 jason 737: agent_sign_cb(Authctxt *authctxt, Key *key, u_char **sigp, u_int *lenp,
738: u_char *data, u_int datalen)
1.17 markus 739: {
1.20 markus 740: return ssh_agent_sign(authctxt->agent, key, sigp, lenp, data, datalen);
1.17 markus 741: }
742:
1.76 itojun 743: static int
1.83.2.2 jason 744: key_sign_cb(Authctxt *authctxt, Key *key, u_char **sigp, u_int *lenp,
745: u_char *data, u_int datalen)
1.51 markus 746: {
1.67 markus 747: return key_sign(key, sigp, lenp, data, datalen);
1.51 markus 748: }
749:
1.76 itojun 750: static int
1.20 markus 751: userauth_pubkey_agent(Authctxt *authctxt)
1.17 markus 752: {
753: static int called = 0;
1.28 markus 754: int ret = 0;
1.17 markus 755: char *comment;
756: Key *k;
757:
758: if (called == 0) {
1.28 markus 759: if (ssh_get_num_identities(authctxt->agent, 2) == 0)
760: debug2("userauth_pubkey_agent: no keys at all");
1.20 markus 761: called = 1;
1.17 markus 762: }
1.28 markus 763: k = ssh_get_next_identity(authctxt->agent, &comment, 2);
1.20 markus 764: if (k == NULL) {
1.28 markus 765: debug2("userauth_pubkey_agent: no more keys");
766: } else {
1.51 markus 767: debug("userauth_pubkey_agent: testing agent key %s", comment);
1.28 markus 768: xfree(comment);
1.51 markus 769: ret = send_pubkey_test(authctxt, k, agent_sign_cb, -1);
770: if (ret == 0)
771: key_free(k);
1.20 markus 772: }
1.28 markus 773: if (ret == 0)
774: debug2("userauth_pubkey_agent: no message sent");
1.17 markus 775: return ret;
1.1 markus 776: }
777:
1.20 markus 778: int
779: userauth_pubkey(Authctxt *authctxt)
780: {
781: static int idx = 0;
782: int sent = 0;
1.51 markus 783: Key *key;
784: char *filename;
1.20 markus 785:
1.28 markus 786: if (authctxt->agent != NULL) {
787: do {
788: sent = userauth_pubkey_agent(authctxt);
1.83.2.2 jason 789: } while (!sent && authctxt->agent->howmany > 0);
1.28 markus 790: }
791: while (!sent && idx < options.num_identity_files) {
1.51 markus 792: key = options.identity_keys[idx];
793: filename = options.identity_files[idx];
794: if (key == NULL) {
795: debug("try privkey: %s", filename);
796: key = load_identity_file(filename);
797: if (key != NULL) {
798: sent = sign_and_send_pubkey(authctxt, key,
799: key_sign_cb);
800: key_free(key);
801: }
802: } else if (key->type != KEY_RSA1) {
803: debug("try pubkey: %s", filename);
804: sent = send_pubkey_test(authctxt, key,
805: identity_sign_cb, idx);
806: }
1.28 markus 807: idx++;
808: }
1.20 markus 809: return sent;
810: }
811:
1.23 markus 812: /*
813: * Send userauth request message specifying keyboard-interactive method.
814: */
815: int
816: userauth_kbdint(Authctxt *authctxt)
817: {
818: static int attempt = 0;
819:
820: if (attempt++ >= options.number_of_password_prompts)
821: return 0;
1.82 markus 822: /* disable if no SSH2_MSG_USERAUTH_INFO_REQUEST has been seen */
823: if (attempt > 1 && !authctxt->info_req_seen) {
824: debug3("userauth_kbdint: disable: no info_req_seen");
825: dispatch_set(SSH2_MSG_USERAUTH_INFO_REQUEST, NULL);
826: return 0;
827: }
1.23 markus 828:
829: debug2("userauth_kbdint");
830: packet_start(SSH2_MSG_USERAUTH_REQUEST);
831: packet_put_cstring(authctxt->server_user);
832: packet_put_cstring(authctxt->service);
833: packet_put_cstring(authctxt->method->name);
834: packet_put_cstring(""); /* lang */
835: packet_put_cstring(options.kbd_interactive_devices ?
836: options.kbd_interactive_devices : "");
837: packet_send();
838:
839: dispatch_set(SSH2_MSG_USERAUTH_INFO_REQUEST, &input_userauth_info_req);
840: return 1;
841: }
842:
843: /*
1.46 markus 844: * parse INFO_REQUEST, prompt user and send INFO_RESPONSE
1.23 markus 845: */
846: void
1.83.2.2 jason 847: input_userauth_info_req(int type, u_int32_t seq, void *ctxt)
1.23 markus 848: {
849: Authctxt *authctxt = ctxt;
1.46 markus 850: char *name, *inst, *lang, *prompt, *response;
1.32 markus 851: u_int num_prompts, i;
1.23 markus 852: int echo = 0;
853:
854: debug2("input_userauth_info_req");
855:
856: if (authctxt == NULL)
857: fatal("input_userauth_info_req: no authentication context");
1.82 markus 858:
859: authctxt->info_req_seen = 1;
1.23 markus 860:
861: name = packet_get_string(NULL);
862: inst = packet_get_string(NULL);
863: lang = packet_get_string(NULL);
864: if (strlen(name) > 0)
1.78 markus 865: log("%s", name);
1.23 markus 866: if (strlen(inst) > 0)
1.78 markus 867: log("%s", inst);
1.46 markus 868: xfree(name);
1.23 markus 869: xfree(inst);
1.46 markus 870: xfree(lang);
1.23 markus 871:
872: num_prompts = packet_get_int();
873: /*
874: * Begin to build info response packet based on prompts requested.
875: * We commit to providing the correct number of responses, so if
876: * further on we run into a problem that prevents this, we have to
877: * be sure and clean this up and send a correct error response.
878: */
879: packet_start(SSH2_MSG_USERAUTH_INFO_RESPONSE);
880: packet_put_int(num_prompts);
881:
1.73 markus 882: debug2("input_userauth_info_req: num_prompts %d", num_prompts);
1.23 markus 883: for (i = 0; i < num_prompts; i++) {
884: prompt = packet_get_string(NULL);
885: echo = packet_get_char();
886:
1.77 markus 887: response = read_passphrase(prompt, echo ? RP_ECHO : 0);
1.23 markus 888:
1.49 markus 889: packet_put_cstring(response);
1.23 markus 890: memset(response, 0, strlen(response));
891: xfree(response);
892: xfree(prompt);
893: }
1.83.2.2 jason 894: packet_check_eom(); /* done with parsing incoming message. */
1.23 markus 895:
1.83.2.1 jason 896: packet_add_padding(64);
1.23 markus 897: packet_send();
1.68 markus 898: }
899:
1.83.2.4 miod 900: static int
1.83.2.5! miod 901: ssh_keysign(Key *key, u_char **sigp, u_int *lenp,
1.83.2.4 miod 902: u_char *data, u_int datalen)
903: {
904: Buffer b;
905: struct stat st;
906: pid_t pid;
907: int to[2], from[2], status, version = 2;
908:
909: debug("ssh_keysign called");
910:
911: if (stat(_PATH_SSH_KEY_SIGN, &st) < 0) {
912: error("ssh_keysign: no installed: %s", strerror(errno));
913: return -1;
914: }
915: if (fflush(stdout) != 0)
916: error("ssh_keysign: fflush: %s", strerror(errno));
917: if (pipe(to) < 0) {
918: error("ssh_keysign: pipe: %s", strerror(errno));
919: return -1;
920: }
921: if (pipe(from) < 0) {
922: error("ssh_keysign: pipe: %s", strerror(errno));
923: return -1;
924: }
925: if ((pid = fork()) < 0) {
926: error("ssh_keysign: fork: %s", strerror(errno));
927: return -1;
928: }
929: if (pid == 0) {
930: seteuid(getuid());
931: setuid(getuid());
932: close(from[0]);
933: if (dup2(from[1], STDOUT_FILENO) < 0)
934: fatal("ssh_keysign: dup2: %s", strerror(errno));
935: close(to[1]);
936: if (dup2(to[0], STDIN_FILENO) < 0)
937: fatal("ssh_keysign: dup2: %s", strerror(errno));
938: close(from[1]);
939: close(to[0]);
940: execl(_PATH_SSH_KEY_SIGN, _PATH_SSH_KEY_SIGN, (char *) 0);
941: fatal("ssh_keysign: exec(%s): %s", _PATH_SSH_KEY_SIGN,
942: strerror(errno));
943: }
944: close(from[1]);
945: close(to[0]);
946:
947: buffer_init(&b);
948: buffer_put_int(&b, packet_get_connection_in()); /* send # of socket */
949: buffer_put_string(&b, data, datalen);
950: msg_send(to[1], version, &b);
951:
952: if (msg_recv(from[0], &b) < 0) {
953: error("ssh_keysign: no reply");
954: buffer_clear(&b);
955: return -1;
956: }
957: close(from[0]);
958: close(to[1]);
959:
960: while (waitpid(pid, &status, 0) < 0)
961: if (errno != EINTR)
962: break;
963:
964: if (buffer_get_char(&b) != version) {
965: error("ssh_keysign: bad version");
966: buffer_clear(&b);
967: return -1;
968: }
969: *sigp = buffer_get_string(&b, lenp);
970: buffer_clear(&b);
971:
972: return 0;
973: }
974:
1.68 markus 975: int
976: userauth_hostbased(Authctxt *authctxt)
977: {
978: Key *private = NULL;
1.83.2.4 miod 979: Sensitive *sensitive = authctxt->sensitive;
1.68 markus 980: Buffer b;
981: u_char *signature, *blob;
982: char *chost, *pkalg, *p;
1.72 markus 983: const char *service;
1.68 markus 984: u_int blen, slen;
1.71 markus 985: int ok, i, len, found = 0;
1.68 markus 986:
987: /* check for a useful key */
1.83.2.4 miod 988: for (i = 0; i < sensitive->nkeys; i++) {
989: private = sensitive->keys[i];
1.68 markus 990: if (private && private->type != KEY_RSA1) {
991: found = 1;
992: /* we take and free the key */
1.83.2.4 miod 993: sensitive->keys[i] = NULL;
1.68 markus 994: break;
995: }
996: }
997: if (!found) {
1.83.2.1 jason 998: debug("userauth_hostbased: no more client hostkeys");
1.68 markus 999: return 0;
1000: }
1001: if (key_to_blob(private, &blob, &blen) == 0) {
1002: key_free(private);
1003: return 0;
1004: }
1.83.2.1 jason 1005: /* figure out a name for the client host */
1006: p = get_local_name(packet_get_connection_in());
1007: if (p == NULL) {
1008: error("userauth_hostbased: cannot get local ipaddr/name");
1009: key_free(private);
1010: return 0;
1011: }
1012: len = strlen(p) + 2;
1013: chost = xmalloc(len);
1014: strlcpy(chost, p, len);
1015: strlcat(chost, ".", len);
1016: debug2("userauth_hostbased: chost %s", chost);
1017:
1.72 markus 1018: service = datafellows & SSH_BUG_HBSERVICE ? "ssh-userauth" :
1019: authctxt->service;
1.68 markus 1020: pkalg = xstrdup(key_ssh_name(private));
1021: buffer_init(&b);
1022: /* construct data */
1.72 markus 1023: buffer_put_string(&b, session_id2, session_id2_len);
1.68 markus 1024: buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
1025: buffer_put_cstring(&b, authctxt->server_user);
1.72 markus 1026: buffer_put_cstring(&b, service);
1.68 markus 1027: buffer_put_cstring(&b, authctxt->method->name);
1028: buffer_put_cstring(&b, pkalg);
1029: buffer_put_string(&b, blob, blen);
1030: buffer_put_cstring(&b, chost);
1031: buffer_put_cstring(&b, authctxt->local_user);
1032: #ifdef DEBUG_PK
1033: buffer_dump(&b);
1034: #endif
1.83.2.4 miod 1035: if (sensitive->external_keysign)
1036: ok = ssh_keysign(private, &signature, &slen,
1037: buffer_ptr(&b), buffer_len(&b));
1038: else
1039: ok = key_sign(private, &signature, &slen,
1040: buffer_ptr(&b), buffer_len(&b));
1.68 markus 1041: key_free(private);
1042: buffer_free(&b);
1043: if (ok != 0) {
1044: error("key_sign failed");
1045: xfree(chost);
1046: xfree(pkalg);
1047: return 0;
1048: }
1049: packet_start(SSH2_MSG_USERAUTH_REQUEST);
1050: packet_put_cstring(authctxt->server_user);
1051: packet_put_cstring(authctxt->service);
1052: packet_put_cstring(authctxt->method->name);
1053: packet_put_cstring(pkalg);
1054: packet_put_string(blob, blen);
1055: packet_put_cstring(chost);
1056: packet_put_cstring(authctxt->local_user);
1057: packet_put_string(signature, slen);
1058: memset(signature, 's', slen);
1059: xfree(signature);
1060: xfree(chost);
1061: xfree(pkalg);
1062:
1063: packet_send();
1064: return 1;
1.23 markus 1065: }
1.20 markus 1066:
1067: /* find auth method */
1068:
1069: /*
1070: * given auth method name, if configurable options permit this method fill
1071: * in auth_ident field and return true, otherwise return false.
1072: */
1.76 itojun 1073: static int
1.20 markus 1074: authmethod_is_enabled(Authmethod *method)
1075: {
1076: if (method == NULL)
1077: return 0;
1078: /* return false if options indicate this method is disabled */
1079: if (method->enabled == NULL || *method->enabled == 0)
1080: return 0;
1081: /* return false if batch mode is enabled but method needs interactive mode */
1082: if (method->batch_flag != NULL && *method->batch_flag != 0)
1083: return 0;
1084: return 1;
1085: }
1086:
1.76 itojun 1087: static Authmethod *
1.20 markus 1088: authmethod_lookup(const char *name)
1.1 markus 1089: {
1.20 markus 1090: Authmethod *method = NULL;
1091: if (name != NULL)
1092: for (method = authmethods; method->name != NULL; method++)
1093: if (strcmp(name, method->name) == 0)
1094: return method;
1095: debug2("Unrecognized authentication method name: %s", name ? name : "NULL");
1096: return NULL;
1097: }
1.1 markus 1098:
1.53 markus 1099: /* XXX internal state */
1100: static Authmethod *current = NULL;
1101: static char *supported = NULL;
1102: static char *preferred = NULL;
1.83.2.5! miod 1103:
1.20 markus 1104: /*
1105: * Given the authentication method list sent by the server, return the
1106: * next method we should try. If the server initially sends a nil list,
1.67 markus 1107: * use a built-in default list.
1.41 stevesk 1108: */
1.76 itojun 1109: static Authmethod *
1.20 markus 1110: authmethod_get(char *authlist)
1111: {
1.53 markus 1112:
1113: char *name = NULL;
1.83.2.2 jason 1114: u_int next;
1.41 stevesk 1115:
1.20 markus 1116: /* Use a suitable default if we're passed a nil list. */
1117: if (authlist == NULL || strlen(authlist) == 0)
1.53 markus 1118: authlist = options.preferred_authentications;
1.20 markus 1119:
1.53 markus 1120: if (supported == NULL || strcmp(authlist, supported) != 0) {
1121: debug3("start over, passed a different list %s", authlist);
1122: if (supported != NULL)
1123: xfree(supported);
1124: supported = xstrdup(authlist);
1125: preferred = options.preferred_authentications;
1126: debug3("preferred %s", preferred);
1127: current = NULL;
1128: } else if (current != NULL && authmethod_is_enabled(current))
1129: return current;
1.20 markus 1130:
1.53 markus 1131: for (;;) {
1132: if ((name = match_list(preferred, supported, &next)) == NULL) {
1133: debug("no more auth methods to try");
1134: current = NULL;
1135: return NULL;
1136: }
1137: preferred += next;
1.23 markus 1138: debug3("authmethod_lookup %s", name);
1.53 markus 1139: debug3("remaining preferred: %s", preferred);
1140: if ((current = authmethod_lookup(name)) != NULL &&
1141: authmethod_is_enabled(current)) {
1.23 markus 1142: debug3("authmethod_is_enabled %s", name);
1.53 markus 1143: debug("next auth method to try is %s", name);
1144: return current;
1.23 markus 1145: }
1.1 markus 1146: }
1.53 markus 1147: }
1.1 markus 1148:
1.79 stevesk 1149: static char *
1.53 markus 1150: authmethods_get(void)
1151: {
1152: Authmethod *method = NULL;
1.83.2.2 jason 1153: Buffer b;
1154: char *list;
1.27 provos 1155:
1.83.2.2 jason 1156: buffer_init(&b);
1.53 markus 1157: for (method = authmethods; method->name != NULL; method++) {
1158: if (authmethod_is_enabled(method)) {
1.83.2.2 jason 1159: if (buffer_len(&b) > 0)
1160: buffer_append(&b, ",", 1);
1161: buffer_append(&b, method->name, strlen(method->name));
1.53 markus 1162: }
1163: }
1.83.2.2 jason 1164: buffer_append(&b, "\0", 1);
1165: list = xstrdup(buffer_ptr(&b));
1166: buffer_free(&b);
1167: return list;
1.1 markus 1168: }
![[BACK]](/icons/back.gif){kind=icon}
Return to sshconnect2.c CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / ssh