blob: a565f73cc4792985ba5245316441c595a4deadae [file] [log] [blame]
Damien Millereba71ba2000-04-29 23:57:08 +10001/*
2 * Copyright (c) 2000 Markus Friedl. All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
Damien Millereba71ba2000-04-29 23:57:08 +100012 *
13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
23 */
24
25#include "includes.h"
Damien Miller630d6f42002-01-22 23:17:30 +110026RCSID("$OpenBSD: sshconnect2.c,v 1.92 2001/12/28 15:06:00 markus Exp $");
Damien Millereba71ba2000-04-29 23:57:08 +100027
28#include <openssl/bn.h>
Damien Millereba71ba2000-04-29 23:57:08 +100029#include <openssl/md5.h>
30#include <openssl/dh.h>
31#include <openssl/hmac.h>
32
33#include "ssh.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000034#include "ssh2.h"
Damien Millereba71ba2000-04-29 23:57:08 +100035#include "xmalloc.h"
36#include "rsa.h"
37#include "buffer.h"
38#include "packet.h"
Damien Millereba71ba2000-04-29 23:57:08 +100039#include "uidswap.h"
40#include "compat.h"
Damien Millereba71ba2000-04-29 23:57:08 +100041#include "bufaux.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000042#include "cipher.h"
Damien Millereba71ba2000-04-29 23:57:08 +100043#include "kex.h"
44#include "myproposal.h"
45#include "key.h"
Damien Millereba71ba2000-04-29 23:57:08 +100046#include "sshconnect.h"
47#include "authfile.h"
Ben Lindstromdf221392001-03-29 00:36:16 +000048#include "dh.h"
Damien Millerad833b32000-08-23 10:46:23 +100049#include "authfd.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000050#include "log.h"
51#include "readconf.h"
52#include "readpass.h"
Ben Lindstromb9be60a2001-03-11 01:49:19 +000053#include "match.h"
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000054#include "dispatch.h"
Ben Lindstrom5eabda32001-04-12 23:34:34 +000055#include "canohost.h"
Damien Miller874d77b2000-10-14 16:23:11 +110056
Damien Millereba71ba2000-04-29 23:57:08 +100057/* import */
58extern char *client_version_string;
59extern char *server_version_string;
60extern Options options;
61
62/*
63 * SSH2 key exchange
64 */
65
Ben Lindstrom46c16222000-12-22 01:43:59 +000066u_char *session_id2 = NULL;
Damien Millereba71ba2000-04-29 23:57:08 +100067int session_id2_len = 0;
68
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000069char *xxx_host;
70struct sockaddr *xxx_hostaddr;
71
Ben Lindstromf28f6342001-04-04 02:03:04 +000072Kex *xxx_kex = NULL;
73
Ben Lindstrombba81212001-06-25 05:01:22 +000074static int
Ben Lindstromd6481ea2001-06-25 04:37:41 +000075verify_host_key_callback(Key *hostkey)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000076{
Ben Lindstromd6481ea2001-06-25 04:37:41 +000077 if (verify_host_key(xxx_host, xxx_hostaddr, hostkey) == -1)
Damien Miller59d9fb92001-10-10 15:03:11 +100078 fatal("Host key verification failed.");
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000079 return 0;
80}
81
Damien Millereba71ba2000-04-29 23:57:08 +100082void
Damien Miller874d77b2000-10-14 16:23:11 +110083ssh_kex2(char *host, struct sockaddr *hostaddr)
84{
Damien Miller874d77b2000-10-14 16:23:11 +110085 Kex *kex;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000086
87 xxx_host = host;
88 xxx_hostaddr = hostaddr;
Damien Miller874d77b2000-10-14 16:23:11 +110089
Damien Millere39cacc2000-11-29 12:18:44 +110090 if (options.ciphers == (char *)-1) {
91 log("No valid ciphers for protocol version 2 given, using defaults.");
92 options.ciphers = NULL;
Damien Miller874d77b2000-10-14 16:23:11 +110093 }
94 if (options.ciphers != NULL) {
95 myproposal[PROPOSAL_ENC_ALGS_CTOS] =
96 myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
97 }
Damien Millera0ff4662001-03-30 10:49:35 +100098 myproposal[PROPOSAL_ENC_ALGS_CTOS] =
99 compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]);
100 myproposal[PROPOSAL_ENC_ALGS_STOC] =
101 compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_STOC]);
Damien Miller874d77b2000-10-14 16:23:11 +1100102 if (options.compression) {
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000103 myproposal[PROPOSAL_COMP_ALGS_CTOS] =
Damien Miller874d77b2000-10-14 16:23:11 +1100104 myproposal[PROPOSAL_COMP_ALGS_STOC] = "zlib";
105 } else {
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000106 myproposal[PROPOSAL_COMP_ALGS_CTOS] =
Damien Miller874d77b2000-10-14 16:23:11 +1100107 myproposal[PROPOSAL_COMP_ALGS_STOC] = "none";
108 }
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000109 if (options.macs != NULL) {
110 myproposal[PROPOSAL_MAC_ALGS_CTOS] =
111 myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
112 }
Ben Lindstrom982dbbc2001-04-17 18:11:36 +0000113 if (options.hostkeyalgorithms != NULL)
Damien Miller9f0f5c62001-12-21 14:45:46 +1100114 myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
Ben Lindstrom982dbbc2001-04-17 18:11:36 +0000115 options.hostkeyalgorithms;
Damien Miller874d77b2000-10-14 16:23:11 +1100116
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000117 /* start key exchange */
Ben Lindstrom238abf62001-04-04 17:52:53 +0000118 kex = kex_setup(myproposal);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000119 kex->client_version_string=client_version_string;
120 kex->server_version_string=server_version_string;
Ben Lindstromd6481ea2001-06-25 04:37:41 +0000121 kex->verify_host_key=&verify_host_key_callback;
Damien Miller874d77b2000-10-14 16:23:11 +1100122
Ben Lindstromf28f6342001-04-04 02:03:04 +0000123 xxx_kex = kex;
124
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000125 dispatch_run(DISPATCH_BLOCK, &kex->done, kex);
Damien Miller874d77b2000-10-14 16:23:11 +1100126
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000127 session_id2 = kex->session_id;
128 session_id2_len = kex->session_id_len;
129
Damien Miller874d77b2000-10-14 16:23:11 +1100130#ifdef DEBUG_KEXDH
131 /* send 1st encrypted/maced/compressed message */
132 packet_start(SSH2_MSG_IGNORE);
133 packet_put_cstring("markus");
134 packet_send();
135 packet_write_wait();
136#endif
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000137 debug("done: ssh_kex2.");
Damien Millereba71ba2000-04-29 23:57:08 +1000138}
Damien Millerb1715dc2000-05-30 13:44:51 +1000139
Damien Millereba71ba2000-04-29 23:57:08 +1000140/*
141 * Authenticate user
142 */
Damien Miller62cee002000-09-23 17:15:56 +1100143
144typedef struct Authctxt Authctxt;
145typedef struct Authmethod Authmethod;
146
147typedef int sign_cb_fn(
148 Authctxt *authctxt, Key *key,
Ben Lindstrom46c16222000-12-22 01:43:59 +0000149 u_char **sigp, int *lenp, u_char *data, int datalen);
Damien Miller62cee002000-09-23 17:15:56 +1100150
151struct Authctxt {
152 const char *server_user;
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000153 const char *local_user;
Damien Miller62cee002000-09-23 17:15:56 +1100154 const char *host;
155 const char *service;
Damien Miller62cee002000-09-23 17:15:56 +1100156 Authmethod *method;
Damien Miller874d77b2000-10-14 16:23:11 +1100157 int success;
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000158 char *authlist;
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000159 /* pubkey */
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000160 Key *last_key;
161 sign_cb_fn *last_key_sign;
162 int last_key_hint;
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000163 AuthenticationConnection *agent;
164 /* hostbased */
165 Key **keys;
166 int nkeys;
Ben Lindstrom7d199962001-09-12 18:29:00 +0000167 /* kbd-interactive */
168 int info_req_seen;
Damien Miller62cee002000-09-23 17:15:56 +1100169};
170struct Authmethod {
171 char *name; /* string to compare against server's list */
172 int (*userauth)(Authctxt *authctxt);
173 int *enabled; /* flag in option struct that enables method */
174 int *batch_flag; /* flag in option struct that disables method */
175};
176
Damien Miller630d6f42002-01-22 23:17:30 +1100177void input_userauth_success(int, u_int32_t, void *);
178void input_userauth_failure(int, u_int32_t, void *);
179void input_userauth_banner(int, u_int32_t, void *);
180void input_userauth_error(int, u_int32_t, void *);
181void input_userauth_info_req(int, u_int32_t, void *);
182void input_userauth_pk_ok(int, u_int32_t, void *);
Damien Miller874d77b2000-10-14 16:23:11 +1100183
Ben Lindstrom3c36bb22001-12-06 17:55:26 +0000184int userauth_none(Authctxt *);
185int userauth_pubkey(Authctxt *);
186int userauth_passwd(Authctxt *);
187int userauth_kbdint(Authctxt *);
188int userauth_hostbased(Authctxt *);
Damien Miller62cee002000-09-23 17:15:56 +1100189
Ben Lindstrom3c36bb22001-12-06 17:55:26 +0000190void userauth(Authctxt *, char *);
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000191
Ben Lindstrombba81212001-06-25 05:01:22 +0000192static int sign_and_send_pubkey(Authctxt *, Key *, sign_cb_fn *);
193static void clear_auth_state(Authctxt *);
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000194
Ben Lindstrombba81212001-06-25 05:01:22 +0000195static Authmethod *authmethod_get(char *authlist);
196static Authmethod *authmethod_lookup(const char *name);
197static char *authmethods_get(void);
Damien Miller62cee002000-09-23 17:15:56 +1100198
199Authmethod authmethods[] = {
Ben Lindstrom1bfe2912001-06-05 19:37:25 +0000200 {"hostbased",
201 userauth_hostbased,
202 &options.hostbased_authentication,
203 NULL},
Ben Lindstrom45350e82001-08-06 20:57:11 +0000204 {"publickey",
205 userauth_pubkey,
206 &options.pubkey_authentication,
207 NULL},
Damien Miller874d77b2000-10-14 16:23:11 +1100208 {"keyboard-interactive",
209 userauth_kbdint,
210 &options.kbd_interactive_authentication,
211 &options.batch_mode},
Ben Lindstrom45350e82001-08-06 20:57:11 +0000212 {"password",
213 userauth_passwd,
214 &options.password_authentication,
215 &options.batch_mode},
Damien Miller874d77b2000-10-14 16:23:11 +1100216 {"none",
217 userauth_none,
218 NULL,
219 NULL},
Damien Miller62cee002000-09-23 17:15:56 +1100220 {NULL, NULL, NULL, NULL}
221};
222
223void
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000224ssh_userauth2(const char *local_user, const char *server_user, char *host,
225 Key **keys, int nkeys)
Damien Miller62cee002000-09-23 17:15:56 +1100226{
227 Authctxt authctxt;
228 int type;
Damien Miller62cee002000-09-23 17:15:56 +1100229
Ben Lindstrom551ea372001-06-05 18:56:16 +0000230 if (options.challenge_response_authentication)
Ben Lindstrom95fb2dd2001-01-23 03:12:10 +0000231 options.kbd_interactive_authentication = 1;
232
Damien Miller62cee002000-09-23 17:15:56 +1100233 debug("send SSH2_MSG_SERVICE_REQUEST");
234 packet_start(SSH2_MSG_SERVICE_REQUEST);
235 packet_put_cstring("ssh-userauth");
236 packet_send();
237 packet_write_wait();
Damien Millerdff50992002-01-22 23:16:32 +1100238 type = packet_read();
Damien Miller62cee002000-09-23 17:15:56 +1100239 if (type != SSH2_MSG_SERVICE_ACCEPT) {
240 fatal("denied SSH2_MSG_SERVICE_ACCEPT: %d", type);
241 }
242 if (packet_remaining() > 0) {
Damien Millerdff50992002-01-22 23:16:32 +1100243 char *reply = packet_get_string(NULL);
Damien Miller62cee002000-09-23 17:15:56 +1100244 debug("service_accept: %s", reply);
245 xfree(reply);
Damien Miller62cee002000-09-23 17:15:56 +1100246 } else {
247 debug("buggy server: service_accept w/o service");
248 }
Damien Miller48b03fc2002-01-22 23:11:40 +1100249 packet_check_eom();
Damien Miller62cee002000-09-23 17:15:56 +1100250 debug("got SSH2_MSG_SERVICE_ACCEPT");
251
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000252 if (options.preferred_authentications == NULL)
253 options.preferred_authentications = authmethods_get();
254
Damien Miller62cee002000-09-23 17:15:56 +1100255 /* setup authentication context */
Ben Lindstrom7d199962001-09-12 18:29:00 +0000256 memset(&authctxt, 0, sizeof(authctxt));
Damien Miller62cee002000-09-23 17:15:56 +1100257 authctxt.agent = ssh_get_authentication_connection();
258 authctxt.server_user = server_user;
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000259 authctxt.local_user = local_user;
Damien Miller62cee002000-09-23 17:15:56 +1100260 authctxt.host = host;
261 authctxt.service = "ssh-connection"; /* service name */
262 authctxt.success = 0;
Damien Miller874d77b2000-10-14 16:23:11 +1100263 authctxt.method = authmethod_lookup("none");
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000264 authctxt.authlist = NULL;
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000265 authctxt.keys = keys;
266 authctxt.nkeys = nkeys;
Ben Lindstrom7d199962001-09-12 18:29:00 +0000267 authctxt.info_req_seen = 0;
Damien Miller874d77b2000-10-14 16:23:11 +1100268 if (authctxt.method == NULL)
269 fatal("ssh_userauth2: internal error: cannot send userauth none request");
Damien Miller62cee002000-09-23 17:15:56 +1100270
271 /* initial userauth request */
Damien Miller874d77b2000-10-14 16:23:11 +1100272 userauth_none(&authctxt);
Damien Miller62cee002000-09-23 17:15:56 +1100273
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000274 dispatch_init(&input_userauth_error);
Damien Miller62cee002000-09-23 17:15:56 +1100275 dispatch_set(SSH2_MSG_USERAUTH_SUCCESS, &input_userauth_success);
276 dispatch_set(SSH2_MSG_USERAUTH_FAILURE, &input_userauth_failure);
Ben Lindstromd26dcf32001-01-06 15:18:16 +0000277 dispatch_set(SSH2_MSG_USERAUTH_BANNER, &input_userauth_banner);
Damien Miller62cee002000-09-23 17:15:56 +1100278 dispatch_run(DISPATCH_BLOCK, &authctxt.success, &authctxt); /* loop until success */
279
280 if (authctxt.agent != NULL)
281 ssh_close_authentication_connection(authctxt.agent);
282
Ben Lindstrom4dccfa52000-12-28 16:40:05 +0000283 debug("ssh-userauth2 successful: method %s", authctxt.method->name);
Damien Miller62cee002000-09-23 17:15:56 +1100284}
285void
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000286userauth(Authctxt *authctxt, char *authlist)
287{
288 if (authlist == NULL) {
289 authlist = authctxt->authlist;
290 } else {
291 if (authctxt->authlist)
292 xfree(authctxt->authlist);
293 authctxt->authlist = authlist;
294 }
295 for (;;) {
296 Authmethod *method = authmethod_get(authlist);
297 if (method == NULL)
298 fatal("Permission denied (%s).", authlist);
299 authctxt->method = method;
300 if (method->userauth(authctxt) != 0) {
301 debug2("we sent a %s packet, wait for reply", method->name);
302 break;
303 } else {
304 debug2("we did not send a packet, disable method");
305 method->enabled = NULL;
306 }
307 }
308}
309void
Damien Miller630d6f42002-01-22 23:17:30 +1100310input_userauth_error(int type, u_int32_t seq, void *ctxt)
Damien Miller62cee002000-09-23 17:15:56 +1100311{
Ben Lindstromd26dcf32001-01-06 15:18:16 +0000312 fatal("input_userauth_error: bad message during authentication: "
313 "type %d", type);
314}
315void
Damien Miller630d6f42002-01-22 23:17:30 +1100316input_userauth_banner(int type, u_int32_t seq, void *ctxt)
Ben Lindstromd26dcf32001-01-06 15:18:16 +0000317{
318 char *msg, *lang;
319 debug3("input_userauth_banner");
320 msg = packet_get_string(NULL);
321 lang = packet_get_string(NULL);
322 fprintf(stderr, "%s", msg);
323 xfree(msg);
324 xfree(lang);
Damien Miller62cee002000-09-23 17:15:56 +1100325}
326void
Damien Miller630d6f42002-01-22 23:17:30 +1100327input_userauth_success(int type, u_int32_t seq, void *ctxt)
Damien Miller62cee002000-09-23 17:15:56 +1100328{
329 Authctxt *authctxt = ctxt;
330 if (authctxt == NULL)
331 fatal("input_userauth_success: no authentication context");
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000332 if (authctxt->authlist)
333 xfree(authctxt->authlist);
334 clear_auth_state(authctxt);
Damien Miller62cee002000-09-23 17:15:56 +1100335 authctxt->success = 1; /* break out */
336}
337void
Damien Miller630d6f42002-01-22 23:17:30 +1100338input_userauth_failure(int type, u_int32_t seq, void *ctxt)
Damien Miller62cee002000-09-23 17:15:56 +1100339{
Damien Miller62cee002000-09-23 17:15:56 +1100340 Authctxt *authctxt = ctxt;
341 char *authlist = NULL;
342 int partial;
Damien Miller62cee002000-09-23 17:15:56 +1100343
344 if (authctxt == NULL)
345 fatal("input_userauth_failure: no authentication context");
346
Damien Miller874d77b2000-10-14 16:23:11 +1100347 authlist = packet_get_string(NULL);
Damien Miller62cee002000-09-23 17:15:56 +1100348 partial = packet_get_char();
Damien Miller48b03fc2002-01-22 23:11:40 +1100349 packet_check_eom();
Damien Miller62cee002000-09-23 17:15:56 +1100350
351 if (partial != 0)
Ben Lindstrom03df5bd2001-02-10 22:16:41 +0000352 log("Authenticated with partial success.");
Damien Miller62cee002000-09-23 17:15:56 +1100353 debug("authentications that can continue: %s", authlist);
354
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000355 clear_auth_state(authctxt);
356 userauth(authctxt, authlist);
357}
358void
Damien Miller630d6f42002-01-22 23:17:30 +1100359input_userauth_pk_ok(int type, u_int32_t seq, void *ctxt)
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000360{
361 Authctxt *authctxt = ctxt;
362 Key *key = NULL;
363 Buffer b;
Ben Lindstrom206941f2001-04-15 14:27:16 +0000364 int alen, blen, sent = 0;
Ben Lindstromcfccef92001-03-13 04:57:58 +0000365 char *pkalg, *pkblob, *fp;
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000366
367 if (authctxt == NULL)
368 fatal("input_userauth_pk_ok: no authentication context");
369 if (datafellows & SSH_BUG_PKOK) {
370 /* this is similar to SSH_BUG_PKAUTH */
371 debug2("input_userauth_pk_ok: SSH_BUG_PKOK");
372 pkblob = packet_get_string(&blen);
373 buffer_init(&b);
374 buffer_append(&b, pkblob, blen);
375 pkalg = buffer_get_string(&b, &alen);
376 buffer_free(&b);
377 } else {
378 pkalg = packet_get_string(&alen);
379 pkblob = packet_get_string(&blen);
Kevin Stevesef4eea92001-02-05 12:42:17 +0000380 }
Damien Miller48b03fc2002-01-22 23:11:40 +1100381 packet_check_eom();
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000382
383 debug("input_userauth_pk_ok: pkalg %s blen %d lastkey %p hint %d",
384 pkalg, blen, authctxt->last_key, authctxt->last_key_hint);
385
386 do {
387 if (authctxt->last_key == NULL ||
388 authctxt->last_key_sign == NULL) {
389 debug("no last key or no sign cb");
390 break;
391 }
Ben Lindstrom206941f2001-04-15 14:27:16 +0000392 if (key_type_from_name(pkalg) == KEY_UNSPEC) {
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000393 debug("unknown pkalg %s", pkalg);
394 break;
395 }
396 if ((key = key_from_blob(pkblob, blen)) == NULL) {
397 debug("no key from blob. pkalg %s", pkalg);
398 break;
399 }
Ben Lindstromcfccef92001-03-13 04:57:58 +0000400 fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
401 debug2("input_userauth_pk_ok: fp %s", fp);
402 xfree(fp);
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000403 if (!key_equal(key, authctxt->last_key)) {
404 debug("key != last_key");
405 break;
406 }
407 sent = sign_and_send_pubkey(authctxt, key,
408 authctxt->last_key_sign);
Ben Lindstrom1c37c6a2001-12-06 18:00:18 +0000409 } while (0);
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000410
411 if (key != NULL)
412 key_free(key);
413 xfree(pkalg);
414 xfree(pkblob);
415
416 /* unregister */
417 clear_auth_state(authctxt);
418 dispatch_set(SSH2_MSG_USERAUTH_PK_OK, NULL);
419
420 /* try another method if we did not send a packet*/
421 if (sent == 0)
422 userauth(authctxt, NULL);
423
Damien Miller62cee002000-09-23 17:15:56 +1100424}
425
Damien Millereba71ba2000-04-29 23:57:08 +1000426int
Damien Miller874d77b2000-10-14 16:23:11 +1100427userauth_none(Authctxt *authctxt)
428{
429 /* initial userauth request */
430 packet_start(SSH2_MSG_USERAUTH_REQUEST);
431 packet_put_cstring(authctxt->server_user);
432 packet_put_cstring(authctxt->service);
433 packet_put_cstring(authctxt->method->name);
434 packet_send();
Damien Miller874d77b2000-10-14 16:23:11 +1100435 return 1;
436}
437
438int
Damien Miller62cee002000-09-23 17:15:56 +1100439userauth_passwd(Authctxt *authctxt)
Damien Millereba71ba2000-04-29 23:57:08 +1000440{
Damien Millere247cc42000-05-07 12:03:14 +1000441 static int attempt = 0;
Damien Millereba71ba2000-04-29 23:57:08 +1000442 char prompt[80];
443 char *password;
444
Damien Millerd3a18572000-06-07 19:55:44 +1000445 if (attempt++ >= options.number_of_password_prompts)
Damien Millere247cc42000-05-07 12:03:14 +1000446 return 0;
447
Ben Lindstrom1c37c6a2001-12-06 18:00:18 +0000448 if (attempt != 1)
Damien Millerd3a18572000-06-07 19:55:44 +1000449 error("Permission denied, please try again.");
450
Ben Lindstrom03df5bd2001-02-10 22:16:41 +0000451 snprintf(prompt, sizeof(prompt), "%.30s@%.128s's password: ",
Damien Miller62cee002000-09-23 17:15:56 +1100452 authctxt->server_user, authctxt->host);
Damien Millereba71ba2000-04-29 23:57:08 +1000453 password = read_passphrase(prompt, 0);
454 packet_start(SSH2_MSG_USERAUTH_REQUEST);
Damien Miller62cee002000-09-23 17:15:56 +1100455 packet_put_cstring(authctxt->server_user);
456 packet_put_cstring(authctxt->service);
Damien Miller874d77b2000-10-14 16:23:11 +1100457 packet_put_cstring(authctxt->method->name);
Damien Millereba71ba2000-04-29 23:57:08 +1000458 packet_put_char(0);
Ben Lindstrom5699c5f2001-03-05 06:17:49 +0000459 packet_put_cstring(password);
Damien Millereba71ba2000-04-29 23:57:08 +1000460 memset(password, 0, strlen(password));
461 xfree(password);
Damien Miller9f643902001-11-12 11:02:52 +1100462 packet_add_padding(64);
Damien Millereba71ba2000-04-29 23:57:08 +1000463 packet_send();
Damien Millereba71ba2000-04-29 23:57:08 +1000464 return 1;
465}
466
Ben Lindstrom79073822001-07-04 03:42:30 +0000467static void
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000468clear_auth_state(Authctxt *authctxt)
469{
470 /* XXX clear authentication state */
471 if (authctxt->last_key != NULL && authctxt->last_key_hint == -1) {
472 debug3("clear_auth_state: key_free %p", authctxt->last_key);
473 key_free(authctxt->last_key);
474 }
475 authctxt->last_key = NULL;
476 authctxt->last_key_hint = -2;
477 authctxt->last_key_sign = NULL;
478}
479
Ben Lindstrombba81212001-06-25 05:01:22 +0000480static int
Damien Miller62cee002000-09-23 17:15:56 +1100481sign_and_send_pubkey(Authctxt *authctxt, Key *k, sign_cb_fn *sign_callback)
Damien Millereba71ba2000-04-29 23:57:08 +1000482{
483 Buffer b;
Ben Lindstrom46c16222000-12-22 01:43:59 +0000484 u_char *blob, *signature;
Damien Millereba71ba2000-04-29 23:57:08 +1000485 int bloblen, slen;
Damien Miller6536c7d2000-06-22 21:32:31 +1000486 int skip = 0;
Damien Millerad833b32000-08-23 10:46:23 +1000487 int ret = -1;
Damien Miller874d77b2000-10-14 16:23:11 +1100488 int have_sig = 1;
Damien Millereba71ba2000-04-29 23:57:08 +1000489
Ben Lindstromd121f612000-12-03 17:00:47 +0000490 debug3("sign_and_send_pubkey");
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000491
Damien Miller0bc1bd82000-11-13 22:57:25 +1100492 if (key_to_blob(k, &blob, &bloblen) == 0) {
493 /* we cannot handle this key */
Ben Lindstromd121f612000-12-03 17:00:47 +0000494 debug3("sign_and_send_pubkey: cannot handle key");
Damien Miller0bc1bd82000-11-13 22:57:25 +1100495 return 0;
496 }
Damien Millereba71ba2000-04-29 23:57:08 +1000497 /* data to be signed */
498 buffer_init(&b);
Damien Miller50a41ed2000-10-16 12:14:42 +1100499 if (datafellows & SSH_OLD_SESSIONID) {
Damien Miller6536c7d2000-06-22 21:32:31 +1000500 buffer_append(&b, session_id2, session_id2_len);
Kevin Stevesef4eea92001-02-05 12:42:17 +0000501 skip = session_id2_len;
Damien Miller50a41ed2000-10-16 12:14:42 +1100502 } else {
503 buffer_put_string(&b, session_id2, session_id2_len);
504 skip = buffer_len(&b);
Damien Miller6536c7d2000-06-22 21:32:31 +1000505 }
Damien Millereba71ba2000-04-29 23:57:08 +1000506 buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
Damien Miller62cee002000-09-23 17:15:56 +1100507 buffer_put_cstring(&b, authctxt->server_user);
Damien Miller30c3d422000-05-09 11:02:59 +1000508 buffer_put_cstring(&b,
Ben Lindstromd121f612000-12-03 17:00:47 +0000509 datafellows & SSH_BUG_PKSERVICE ?
Damien Miller30c3d422000-05-09 11:02:59 +1000510 "ssh-userauth" :
Damien Miller62cee002000-09-23 17:15:56 +1100511 authctxt->service);
Ben Lindstromd121f612000-12-03 17:00:47 +0000512 if (datafellows & SSH_BUG_PKAUTH) {
513 buffer_put_char(&b, have_sig);
514 } else {
515 buffer_put_cstring(&b, authctxt->method->name);
516 buffer_put_char(&b, have_sig);
Kevin Stevesef4eea92001-02-05 12:42:17 +0000517 buffer_put_cstring(&b, key_ssh_name(k));
Ben Lindstromd121f612000-12-03 17:00:47 +0000518 }
Damien Millereba71ba2000-04-29 23:57:08 +1000519 buffer_put_string(&b, blob, bloblen);
Damien Millereba71ba2000-04-29 23:57:08 +1000520
521 /* generate signature */
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000522 ret = (*sign_callback)(authctxt, k, &signature, &slen,
523 buffer_ptr(&b), buffer_len(&b));
Damien Millerad833b32000-08-23 10:46:23 +1000524 if (ret == -1) {
525 xfree(blob);
526 buffer_free(&b);
527 return 0;
528 }
Damien Miller0bc1bd82000-11-13 22:57:25 +1100529#ifdef DEBUG_PK
Damien Millereba71ba2000-04-29 23:57:08 +1000530 buffer_dump(&b);
531#endif
Ben Lindstromd121f612000-12-03 17:00:47 +0000532 if (datafellows & SSH_BUG_PKSERVICE) {
Damien Miller30c3d422000-05-09 11:02:59 +1000533 buffer_clear(&b);
534 buffer_append(&b, session_id2, session_id2_len);
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000535 skip = session_id2_len;
Damien Miller30c3d422000-05-09 11:02:59 +1000536 buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
Damien Miller62cee002000-09-23 17:15:56 +1100537 buffer_put_cstring(&b, authctxt->server_user);
538 buffer_put_cstring(&b, authctxt->service);
Damien Miller874d77b2000-10-14 16:23:11 +1100539 buffer_put_cstring(&b, authctxt->method->name);
540 buffer_put_char(&b, have_sig);
Ben Lindstromd121f612000-12-03 17:00:47 +0000541 if (!(datafellows & SSH_BUG_PKAUTH))
Kevin Stevesef4eea92001-02-05 12:42:17 +0000542 buffer_put_cstring(&b, key_ssh_name(k));
Damien Miller30c3d422000-05-09 11:02:59 +1000543 buffer_put_string(&b, blob, bloblen);
544 }
545 xfree(blob);
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000546
Damien Millereba71ba2000-04-29 23:57:08 +1000547 /* append signature */
548 buffer_put_string(&b, signature, slen);
549 xfree(signature);
550
551 /* skip session id and packet type */
Damien Miller6536c7d2000-06-22 21:32:31 +1000552 if (buffer_len(&b) < skip + 1)
Damien Miller62cee002000-09-23 17:15:56 +1100553 fatal("userauth_pubkey: internal error");
Damien Miller6536c7d2000-06-22 21:32:31 +1000554 buffer_consume(&b, skip + 1);
Damien Millereba71ba2000-04-29 23:57:08 +1000555
556 /* put remaining data from buffer into packet */
557 packet_start(SSH2_MSG_USERAUTH_REQUEST);
558 packet_put_raw(buffer_ptr(&b), buffer_len(&b));
559 buffer_free(&b);
Damien Millereba71ba2000-04-29 23:57:08 +1000560 packet_send();
Damien Millerad833b32000-08-23 10:46:23 +1000561
562 return 1;
Damien Miller994cf142000-07-21 10:19:44 +1000563}
564
Ben Lindstrombba81212001-06-25 05:01:22 +0000565static int
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000566send_pubkey_test(Authctxt *authctxt, Key *k, sign_cb_fn *sign_callback,
567 int hint)
Damien Miller994cf142000-07-21 10:19:44 +1000568{
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000569 u_char *blob;
570 int bloblen, have_sig = 0;
Damien Miller994cf142000-07-21 10:19:44 +1000571
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000572 debug3("send_pubkey_test");
573
574 if (key_to_blob(k, &blob, &bloblen) == 0) {
575 /* we cannot handle this key */
576 debug3("send_pubkey_test: cannot handle key");
Damien Miller994cf142000-07-21 10:19:44 +1000577 return 0;
578 }
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000579 /* register callback for USERAUTH_PK_OK message */
580 authctxt->last_key_sign = sign_callback;
581 authctxt->last_key_hint = hint;
582 authctxt->last_key = k;
583 dispatch_set(SSH2_MSG_USERAUTH_PK_OK, &input_userauth_pk_ok);
Damien Miller994cf142000-07-21 10:19:44 +1000584
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000585 packet_start(SSH2_MSG_USERAUTH_REQUEST);
586 packet_put_cstring(authctxt->server_user);
587 packet_put_cstring(authctxt->service);
588 packet_put_cstring(authctxt->method->name);
589 packet_put_char(have_sig);
590 if (!(datafellows & SSH_BUG_PKAUTH))
591 packet_put_cstring(key_ssh_name(k));
592 packet_put_string(blob, bloblen);
593 xfree(blob);
594 packet_send();
595 return 1;
596}
597
Ben Lindstrombba81212001-06-25 05:01:22 +0000598static Key *
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000599load_identity_file(char *filename)
600{
601 Key *private;
602 char prompt[300], *passphrase;
Ben Lindstromd0fca422001-03-26 13:44:06 +0000603 int quit, i;
Ben Lindstrom329782e2001-03-10 17:08:59 +0000604 struct stat st;
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000605
Ben Lindstrom329782e2001-03-10 17:08:59 +0000606 if (stat(filename, &st) < 0) {
607 debug3("no such identity: %s", filename);
608 return NULL;
609 }
Ben Lindstromd0fca422001-03-26 13:44:06 +0000610 private = key_load_private_type(KEY_UNSPEC, filename, "", NULL);
611 if (private == NULL) {
612 if (options.batch_mode)
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000613 return NULL;
Damien Miller994cf142000-07-21 10:19:44 +1000614 snprintf(prompt, sizeof prompt,
Damien Miller9f0f5c62001-12-21 14:45:46 +1100615 "Enter passphrase for key '%.100s': ", filename);
Damien Miller62cee002000-09-23 17:15:56 +1100616 for (i = 0; i < options.number_of_password_prompts; i++) {
617 passphrase = read_passphrase(prompt, 0);
618 if (strcmp(passphrase, "") != 0) {
Ben Lindstromd0fca422001-03-26 13:44:06 +0000619 private = key_load_private_type(KEY_UNSPEC, filename,
620 passphrase, NULL);
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000621 quit = 0;
Damien Miller62cee002000-09-23 17:15:56 +1100622 } else {
623 debug2("no passphrase given, try next key");
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000624 quit = 1;
Damien Miller62cee002000-09-23 17:15:56 +1100625 }
626 memset(passphrase, 0, strlen(passphrase));
627 xfree(passphrase);
Ben Lindstromd0fca422001-03-26 13:44:06 +0000628 if (private != NULL || quit)
Damien Miller62cee002000-09-23 17:15:56 +1100629 break;
630 debug2("bad passphrase given, try again...");
631 }
Damien Miller994cf142000-07-21 10:19:44 +1000632 }
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000633 return private;
634}
635
Ben Lindstrombba81212001-06-25 05:01:22 +0000636static int
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000637identity_sign_cb(Authctxt *authctxt, Key *key, u_char **sigp, int *lenp,
638 u_char *data, int datalen)
639{
640 Key *private;
641 int idx, ret;
642
643 idx = authctxt->last_key_hint;
644 if (idx < 0)
645 return -1;
Ben Lindstromc5b68002001-07-04 04:52:03 +0000646
647 /* private key is stored in external hardware */
Damien Miller9f0f5c62001-12-21 14:45:46 +1100648 if (options.identity_keys[idx]->flags & KEY_FLAG_EXT)
Ben Lindstromc5b68002001-07-04 04:52:03 +0000649 return key_sign(options.identity_keys[idx], sigp, lenp, data, datalen);
650
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000651 private = load_identity_file(options.identity_files[idx]);
652 if (private == NULL)
653 return -1;
654 ret = key_sign(private, sigp, lenp, data, datalen);
655 key_free(private);
Damien Millerad833b32000-08-23 10:46:23 +1000656 return ret;
657}
658
Ben Lindstrombba81212001-06-25 05:01:22 +0000659static int
660agent_sign_cb(Authctxt *authctxt, Key *key, u_char **sigp, int *lenp,
Ben Lindstrom46c16222000-12-22 01:43:59 +0000661 u_char *data, int datalen)
Damien Millerad833b32000-08-23 10:46:23 +1000662{
Damien Miller62cee002000-09-23 17:15:56 +1100663 return ssh_agent_sign(authctxt->agent, key, sigp, lenp, data, datalen);
Damien Millerad833b32000-08-23 10:46:23 +1000664}
665
Ben Lindstrombba81212001-06-25 05:01:22 +0000666static int
667key_sign_cb(Authctxt *authctxt, Key *key, u_char **sigp, int *lenp,
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000668 u_char *data, int datalen)
669{
Ben Lindstroma3700052001-04-05 23:26:32 +0000670 return key_sign(key, sigp, lenp, data, datalen);
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000671}
672
Ben Lindstrombba81212001-06-25 05:01:22 +0000673static int
Damien Miller62cee002000-09-23 17:15:56 +1100674userauth_pubkey_agent(Authctxt *authctxt)
Damien Millerad833b32000-08-23 10:46:23 +1000675{
676 static int called = 0;
Damien Miller0bc1bd82000-11-13 22:57:25 +1100677 int ret = 0;
Damien Millerad833b32000-08-23 10:46:23 +1000678 char *comment;
679 Key *k;
Damien Millerad833b32000-08-23 10:46:23 +1000680
681 if (called == 0) {
Damien Miller0bc1bd82000-11-13 22:57:25 +1100682 if (ssh_get_num_identities(authctxt->agent, 2) == 0)
683 debug2("userauth_pubkey_agent: no keys at all");
Damien Miller62cee002000-09-23 17:15:56 +1100684 called = 1;
Damien Millerad833b32000-08-23 10:46:23 +1000685 }
Damien Miller0bc1bd82000-11-13 22:57:25 +1100686 k = ssh_get_next_identity(authctxt->agent, &comment, 2);
Damien Miller62cee002000-09-23 17:15:56 +1100687 if (k == NULL) {
Damien Miller0bc1bd82000-11-13 22:57:25 +1100688 debug2("userauth_pubkey_agent: no more keys");
689 } else {
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000690 debug("userauth_pubkey_agent: testing agent key %s", comment);
Damien Miller0bc1bd82000-11-13 22:57:25 +1100691 xfree(comment);
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000692 ret = send_pubkey_test(authctxt, k, agent_sign_cb, -1);
693 if (ret == 0)
694 key_free(k);
Damien Miller62cee002000-09-23 17:15:56 +1100695 }
Damien Miller0bc1bd82000-11-13 22:57:25 +1100696 if (ret == 0)
697 debug2("userauth_pubkey_agent: no message sent");
Damien Millerad833b32000-08-23 10:46:23 +1000698 return ret;
Damien Millereba71ba2000-04-29 23:57:08 +1000699}
700
Damien Miller62cee002000-09-23 17:15:56 +1100701int
702userauth_pubkey(Authctxt *authctxt)
Damien Millereba71ba2000-04-29 23:57:08 +1000703{
Damien Miller62cee002000-09-23 17:15:56 +1100704 static int idx = 0;
705 int sent = 0;
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000706 Key *key;
707 char *filename;
Damien Millereba71ba2000-04-29 23:57:08 +1000708
Damien Miller0bc1bd82000-11-13 22:57:25 +1100709 if (authctxt->agent != NULL) {
710 do {
711 sent = userauth_pubkey_agent(authctxt);
Ben Lindstrom1c37c6a2001-12-06 18:00:18 +0000712 } while (!sent && authctxt->agent->howmany > 0);
Damien Miller0bc1bd82000-11-13 22:57:25 +1100713 }
714 while (!sent && idx < options.num_identity_files) {
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000715 key = options.identity_keys[idx];
716 filename = options.identity_files[idx];
717 if (key == NULL) {
718 debug("try privkey: %s", filename);
719 key = load_identity_file(filename);
720 if (key != NULL) {
721 sent = sign_and_send_pubkey(authctxt, key,
722 key_sign_cb);
723 key_free(key);
724 }
725 } else if (key->type != KEY_RSA1) {
726 debug("try pubkey: %s", filename);
727 sent = send_pubkey_test(authctxt, key,
728 identity_sign_cb, idx);
729 }
Damien Miller0bc1bd82000-11-13 22:57:25 +1100730 idx++;
731 }
Damien Miller62cee002000-09-23 17:15:56 +1100732 return sent;
733}
Damien Millereba71ba2000-04-29 23:57:08 +1000734
Damien Miller874d77b2000-10-14 16:23:11 +1100735/*
736 * Send userauth request message specifying keyboard-interactive method.
737 */
738int
739userauth_kbdint(Authctxt *authctxt)
740{
741 static int attempt = 0;
742
743 if (attempt++ >= options.number_of_password_prompts)
744 return 0;
Ben Lindstrom7d199962001-09-12 18:29:00 +0000745 /* disable if no SSH2_MSG_USERAUTH_INFO_REQUEST has been seen */
746 if (attempt > 1 && !authctxt->info_req_seen) {
747 debug3("userauth_kbdint: disable: no info_req_seen");
748 dispatch_set(SSH2_MSG_USERAUTH_INFO_REQUEST, NULL);
749 return 0;
750 }
Damien Miller874d77b2000-10-14 16:23:11 +1100751
752 debug2("userauth_kbdint");
753 packet_start(SSH2_MSG_USERAUTH_REQUEST);
754 packet_put_cstring(authctxt->server_user);
755 packet_put_cstring(authctxt->service);
756 packet_put_cstring(authctxt->method->name);
757 packet_put_cstring(""); /* lang */
758 packet_put_cstring(options.kbd_interactive_devices ?
759 options.kbd_interactive_devices : "");
760 packet_send();
Damien Miller874d77b2000-10-14 16:23:11 +1100761
762 dispatch_set(SSH2_MSG_USERAUTH_INFO_REQUEST, &input_userauth_info_req);
763 return 1;
764}
765
766/*
Ben Lindstrom03df5bd2001-02-10 22:16:41 +0000767 * parse INFO_REQUEST, prompt user and send INFO_RESPONSE
Damien Miller874d77b2000-10-14 16:23:11 +1100768 */
769void
Damien Miller630d6f42002-01-22 23:17:30 +1100770input_userauth_info_req(int type, u_int32_t seq, void *ctxt)
Damien Miller874d77b2000-10-14 16:23:11 +1100771{
772 Authctxt *authctxt = ctxt;
Ben Lindstrom03df5bd2001-02-10 22:16:41 +0000773 char *name, *inst, *lang, *prompt, *response;
Ben Lindstrom46c16222000-12-22 01:43:59 +0000774 u_int num_prompts, i;
Damien Miller874d77b2000-10-14 16:23:11 +1100775 int echo = 0;
776
777 debug2("input_userauth_info_req");
778
779 if (authctxt == NULL)
780 fatal("input_userauth_info_req: no authentication context");
781
Ben Lindstrom7d199962001-09-12 18:29:00 +0000782 authctxt->info_req_seen = 1;
783
Damien Miller874d77b2000-10-14 16:23:11 +1100784 name = packet_get_string(NULL);
785 inst = packet_get_string(NULL);
786 lang = packet_get_string(NULL);
Damien Miller874d77b2000-10-14 16:23:11 +1100787 if (strlen(name) > 0)
Ben Lindstrom126c56a2001-06-25 05:22:53 +0000788 log("%s", name);
Damien Miller874d77b2000-10-14 16:23:11 +1100789 if (strlen(inst) > 0)
Ben Lindstrom126c56a2001-06-25 05:22:53 +0000790 log("%s", inst);
Ben Lindstrom03df5bd2001-02-10 22:16:41 +0000791 xfree(name);
Damien Miller874d77b2000-10-14 16:23:11 +1100792 xfree(inst);
Ben Lindstrom03df5bd2001-02-10 22:16:41 +0000793 xfree(lang);
Damien Miller874d77b2000-10-14 16:23:11 +1100794
795 num_prompts = packet_get_int();
796 /*
797 * Begin to build info response packet based on prompts requested.
798 * We commit to providing the correct number of responses, so if
799 * further on we run into a problem that prevents this, we have to
800 * be sure and clean this up and send a correct error response.
801 */
802 packet_start(SSH2_MSG_USERAUTH_INFO_RESPONSE);
803 packet_put_int(num_prompts);
804
Ben Lindstrom551ea372001-06-05 18:56:16 +0000805 debug2("input_userauth_info_req: num_prompts %d", num_prompts);
Damien Miller874d77b2000-10-14 16:23:11 +1100806 for (i = 0; i < num_prompts; i++) {
807 prompt = packet_get_string(NULL);
808 echo = packet_get_char();
809
Ben Lindstrom949974b2001-06-25 05:20:31 +0000810 response = read_passphrase(prompt, echo ? RP_ECHO : 0);
Damien Miller874d77b2000-10-14 16:23:11 +1100811
Ben Lindstrom5699c5f2001-03-05 06:17:49 +0000812 packet_put_cstring(response);
Damien Miller874d77b2000-10-14 16:23:11 +1100813 memset(response, 0, strlen(response));
814 xfree(response);
815 xfree(prompt);
816 }
Damien Miller48b03fc2002-01-22 23:11:40 +1100817 packet_check_eom(); /* done with parsing incoming message. */
Damien Miller874d77b2000-10-14 16:23:11 +1100818
Damien Miller9f643902001-11-12 11:02:52 +1100819 packet_add_padding(64);
Damien Miller874d77b2000-10-14 16:23:11 +1100820 packet_send();
Damien Miller874d77b2000-10-14 16:23:11 +1100821}
Damien Miller62cee002000-09-23 17:15:56 +1100822
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000823/*
824 * this will be move to an external program (ssh-keysign) ASAP. ssh-keysign
825 * will be setuid-root and the sbit can be removed from /usr/bin/ssh.
826 */
827int
828userauth_hostbased(Authctxt *authctxt)
829{
830 Key *private = NULL;
831 Buffer b;
832 u_char *signature, *blob;
833 char *chost, *pkalg, *p;
Ben Lindstrom671388f2001-04-19 20:40:45 +0000834 const char *service;
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000835 u_int blen, slen;
Ben Lindstrom2bffd6f2001-04-19 20:35:40 +0000836 int ok, i, len, found = 0;
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000837
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000838 /* check for a useful key */
839 for (i = 0; i < authctxt->nkeys; i++) {
840 private = authctxt->keys[i];
841 if (private && private->type != KEY_RSA1) {
842 found = 1;
843 /* we take and free the key */
844 authctxt->keys[i] = NULL;
845 break;
846 }
847 }
848 if (!found) {
Damien Miller91c18472001-11-12 11:02:03 +1100849 debug("userauth_hostbased: no more client hostkeys");
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000850 return 0;
851 }
852 if (key_to_blob(private, &blob, &blen) == 0) {
853 key_free(private);
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000854 return 0;
855 }
Damien Miller91c18472001-11-12 11:02:03 +1100856 /* figure out a name for the client host */
857 p = get_local_name(packet_get_connection_in());
858 if (p == NULL) {
859 error("userauth_hostbased: cannot get local ipaddr/name");
860 key_free(private);
861 return 0;
862 }
863 len = strlen(p) + 2;
864 chost = xmalloc(len);
865 strlcpy(chost, p, len);
866 strlcat(chost, ".", len);
867 debug2("userauth_hostbased: chost %s", chost);
868
Ben Lindstrom671388f2001-04-19 20:40:45 +0000869 service = datafellows & SSH_BUG_HBSERVICE ? "ssh-userauth" :
870 authctxt->service;
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000871 pkalg = xstrdup(key_ssh_name(private));
872 buffer_init(&b);
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000873 /* construct data */
Ben Lindstrom671388f2001-04-19 20:40:45 +0000874 buffer_put_string(&b, session_id2, session_id2_len);
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000875 buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
876 buffer_put_cstring(&b, authctxt->server_user);
Ben Lindstrom671388f2001-04-19 20:40:45 +0000877 buffer_put_cstring(&b, service);
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000878 buffer_put_cstring(&b, authctxt->method->name);
879 buffer_put_cstring(&b, pkalg);
880 buffer_put_string(&b, blob, blen);
881 buffer_put_cstring(&b, chost);
882 buffer_put_cstring(&b, authctxt->local_user);
883#ifdef DEBUG_PK
884 buffer_dump(&b);
885#endif
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000886 ok = key_sign(private, &signature, &slen, buffer_ptr(&b), buffer_len(&b));
887 key_free(private);
888 buffer_free(&b);
889 if (ok != 0) {
890 error("key_sign failed");
891 xfree(chost);
892 xfree(pkalg);
893 return 0;
894 }
895 packet_start(SSH2_MSG_USERAUTH_REQUEST);
896 packet_put_cstring(authctxt->server_user);
897 packet_put_cstring(authctxt->service);
898 packet_put_cstring(authctxt->method->name);
899 packet_put_cstring(pkalg);
900 packet_put_string(blob, blen);
901 packet_put_cstring(chost);
902 packet_put_cstring(authctxt->local_user);
903 packet_put_string(signature, slen);
904 memset(signature, 's', slen);
905 xfree(signature);
906 xfree(chost);
907 xfree(pkalg);
908
909 packet_send();
910 return 1;
911}
912
Damien Miller62cee002000-09-23 17:15:56 +1100913/* find auth method */
914
Damien Miller62cee002000-09-23 17:15:56 +1100915/*
916 * given auth method name, if configurable options permit this method fill
917 * in auth_ident field and return true, otherwise return false.
918 */
Ben Lindstrombba81212001-06-25 05:01:22 +0000919static int
Damien Miller62cee002000-09-23 17:15:56 +1100920authmethod_is_enabled(Authmethod *method)
921{
922 if (method == NULL)
923 return 0;
924 /* return false if options indicate this method is disabled */
925 if (method->enabled == NULL || *method->enabled == 0)
926 return 0;
927 /* return false if batch mode is enabled but method needs interactive mode */
928 if (method->batch_flag != NULL && *method->batch_flag != 0)
929 return 0;
930 return 1;
931}
932
Ben Lindstrombba81212001-06-25 05:01:22 +0000933static Authmethod *
Damien Miller62cee002000-09-23 17:15:56 +1100934authmethod_lookup(const char *name)
935{
936 Authmethod *method = NULL;
937 if (name != NULL)
938 for (method = authmethods; method->name != NULL; method++)
939 if (strcmp(name, method->name) == 0)
940 return method;
941 debug2("Unrecognized authentication method name: %s", name ? name : "NULL");
942 return NULL;
943}
944
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000945/* XXX internal state */
946static Authmethod *current = NULL;
947static char *supported = NULL;
948static char *preferred = NULL;
Damien Miller62cee002000-09-23 17:15:56 +1100949/*
950 * Given the authentication method list sent by the server, return the
951 * next method we should try. If the server initially sends a nil list,
Ben Lindstroma3700052001-04-05 23:26:32 +0000952 * use a built-in default list.
Kevin Stevesef4eea92001-02-05 12:42:17 +0000953 */
Ben Lindstrombba81212001-06-25 05:01:22 +0000954static Authmethod *
Damien Miller62cee002000-09-23 17:15:56 +1100955authmethod_get(char *authlist)
956{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000957
958 char *name = NULL;
959 int next;
Kevin Stevesef4eea92001-02-05 12:42:17 +0000960
Damien Miller62cee002000-09-23 17:15:56 +1100961 /* Use a suitable default if we're passed a nil list. */
962 if (authlist == NULL || strlen(authlist) == 0)
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000963 authlist = options.preferred_authentications;
Damien Miller62cee002000-09-23 17:15:56 +1100964
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000965 if (supported == NULL || strcmp(authlist, supported) != 0) {
966 debug3("start over, passed a different list %s", authlist);
967 if (supported != NULL)
968 xfree(supported);
969 supported = xstrdup(authlist);
970 preferred = options.preferred_authentications;
971 debug3("preferred %s", preferred);
972 current = NULL;
973 } else if (current != NULL && authmethod_is_enabled(current))
974 return current;
Damien Millereba71ba2000-04-29 23:57:08 +1000975
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000976 for (;;) {
977 if ((name = match_list(preferred, supported, &next)) == NULL) {
978 debug("no more auth methods to try");
979 current = NULL;
980 return NULL;
Damien Miller874d77b2000-10-14 16:23:11 +1100981 }
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000982 preferred += next;
983 debug3("authmethod_lookup %s", name);
984 debug3("remaining preferred: %s", preferred);
985 if ((current = authmethod_lookup(name)) != NULL &&
986 authmethod_is_enabled(current)) {
987 debug3("authmethod_is_enabled %s", name);
988 debug("next auth method to try is %s", name);
989 return current;
990 }
Damien Millereba71ba2000-04-29 23:57:08 +1000991 }
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000992}
Damien Miller62cee002000-09-23 17:15:56 +1100993
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000994
995#define DELIM ","
Ben Lindstrom79073822001-07-04 03:42:30 +0000996
997static char *
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000998authmethods_get(void)
999{
1000 Authmethod *method = NULL;
1001 char buf[1024];
1002
1003 buf[0] = '\0';
1004 for (method = authmethods; method->name != NULL; method++) {
1005 if (authmethod_is_enabled(method)) {
1006 if (buf[0] != '\0')
1007 strlcat(buf, DELIM, sizeof buf);
1008 strlcat(buf, method->name, sizeof buf);
1009 }
Damien Miller62cee002000-09-23 17:15:56 +11001010 }
Ben Lindstromb9be60a2001-03-11 01:49:19 +00001011 return xstrdup(buf);
Damien Millereba71ba2000-04-29 23:57:08 +10001012}