blob: c20613571e821e5c2917a2a86a292dd43b87eca0 [file] [log] [blame]
Damien Millereba71ba2000-04-29 23:57:08 +10001/*
2 * Author: Tatu Ylonen <ylo@cs.hut.fi>
3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4 * All rights reserved
Damien Millereba71ba2000-04-29 23:57:08 +10005 * Code to connect to a remote host, and to perform the client side of the
6 * login (authentication) dialog.
7 *
Damien Millere4340be2000-09-16 13:29:08 +11008 * As far as I am concerned, the code I have written for this software
9 * can be used freely for any purpose. Any derived versions of this
10 * software must be clearly marked as such, and if the derived work is
11 * incompatible with the protocol description in the RFC file, it must be
12 * called by a name other than "ssh" or "Secure Shell".
Damien Millereba71ba2000-04-29 23:57:08 +100013 */
14
15#include "includes.h"
Ben Lindstrom664408d2001-06-09 01:42:01 +000016RCSID("$OpenBSD: sshconnect1.c,v 1.33 2001/06/07 20:23:05 markus Exp $");
Damien Millereba71ba2000-04-29 23:57:08 +100017
18#include <openssl/bn.h>
Damien Millereba71ba2000-04-29 23:57:08 +100019#include <openssl/evp.h>
20
Ben Lindstrom226cfa02001-01-22 05:34:40 +000021#ifdef KRB4
22#include <krb.h>
Ben Lindstrom226cfa02001-01-22 05:34:40 +000023#endif
24#ifdef AFS
25#include <kafs.h>
Ben Lindstromb1985f72001-01-23 00:19:15 +000026#include "radix.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000027#endif
28
29#include "ssh.h"
30#include "ssh1.h"
Damien Millereba71ba2000-04-29 23:57:08 +100031#include "xmalloc.h"
32#include "rsa.h"
Damien Millereba71ba2000-04-29 23:57:08 +100033#include "buffer.h"
34#include "packet.h"
Damien Millereba71ba2000-04-29 23:57:08 +100035#include "mpaux.h"
36#include "uidswap.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000037#include "log.h"
Damien Millereba71ba2000-04-29 23:57:08 +100038#include "readconf.h"
39#include "key.h"
Damien Miller994cf142000-07-21 10:19:44 +100040#include "authfd.h"
Damien Millereba71ba2000-04-29 23:57:08 +100041#include "sshconnect.h"
42#include "authfile.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000043#include "readpass.h"
44#include "cipher.h"
45#include "canohost.h"
Damien Millereba71ba2000-04-29 23:57:08 +100046
47/* Session id for the current session. */
Ben Lindstrom46c16222000-12-22 01:43:59 +000048u_char session_id[16];
49u_int supported_authentications = 0;
Damien Millereba71ba2000-04-29 23:57:08 +100050
51extern Options options;
52extern char *__progname;
53
54/*
55 * Checks if the user has an authentication agent, and if so, tries to
56 * authenticate using the agent.
57 */
58int
Ben Lindstrom31ca54a2001-02-09 02:11:24 +000059try_agent_authentication(void)
Damien Millereba71ba2000-04-29 23:57:08 +100060{
Damien Millerad833b32000-08-23 10:46:23 +100061 int type;
Damien Millereba71ba2000-04-29 23:57:08 +100062 char *comment;
63 AuthenticationConnection *auth;
Ben Lindstrom46c16222000-12-22 01:43:59 +000064 u_char response[16];
65 u_int i;
Damien Millerad833b32000-08-23 10:46:23 +100066 int plen, clen;
67 Key *key;
68 BIGNUM *challenge;
Damien Millereba71ba2000-04-29 23:57:08 +100069
70 /* Get connection to the agent. */
71 auth = ssh_get_authentication_connection();
72 if (!auth)
73 return 0;
74
Damien Millereba71ba2000-04-29 23:57:08 +100075 challenge = BN_new();
76
77 /* Loop through identities served by the agent. */
Damien Millerad833b32000-08-23 10:46:23 +100078 for (key = ssh_get_first_identity(auth, &comment, 1);
79 key != NULL;
80 key = ssh_get_next_identity(auth, &comment, 1)) {
Damien Millereba71ba2000-04-29 23:57:08 +100081
82 /* Try this identity. */
83 debug("Trying RSA authentication via agent with '%.100s'", comment);
84 xfree(comment);
85
86 /* Tell the server that we are willing to authenticate using this key. */
87 packet_start(SSH_CMSG_AUTH_RSA);
Damien Millerad833b32000-08-23 10:46:23 +100088 packet_put_bignum(key->rsa->n);
Damien Millereba71ba2000-04-29 23:57:08 +100089 packet_send();
90 packet_write_wait();
91
92 /* Wait for server's response. */
93 type = packet_read(&plen);
94
95 /* The server sends failure if it doesn\'t like our key or
96 does not support RSA authentication. */
97 if (type == SSH_SMSG_FAILURE) {
98 debug("Server refused our key.");
Damien Millerad833b32000-08-23 10:46:23 +100099 key_free(key);
Damien Millereba71ba2000-04-29 23:57:08 +1000100 continue;
101 }
102 /* Otherwise it should have sent a challenge. */
103 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
104 packet_disconnect("Protocol error during RSA authentication: %d",
105 type);
106
107 packet_get_bignum(challenge, &clen);
108
109 packet_integrity_check(plen, clen, type);
110
111 debug("Received RSA challenge from server.");
112
113 /* Ask the agent to decrypt the challenge. */
Damien Millerad833b32000-08-23 10:46:23 +1000114 if (!ssh_decrypt_challenge(auth, key, challenge, session_id, 1, response)) {
115 /*
116 * The agent failed to authenticate this identifier
117 * although it advertised it supports this. Just
118 * return a wrong value.
119 */
Damien Millereba71ba2000-04-29 23:57:08 +1000120 log("Authentication agent failed to decrypt challenge.");
121 memset(response, 0, sizeof(response));
122 }
Damien Millerad833b32000-08-23 10:46:23 +1000123 key_free(key);
Damien Millereba71ba2000-04-29 23:57:08 +1000124 debug("Sending response to RSA challenge.");
125
126 /* Send the decrypted challenge back to the server. */
127 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
128 for (i = 0; i < 16; i++)
129 packet_put_char(response[i]);
130 packet_send();
131 packet_write_wait();
132
133 /* Wait for response from the server. */
134 type = packet_read(&plen);
135
136 /* The server returns success if it accepted the authentication. */
137 if (type == SSH_SMSG_SUCCESS) {
Ben Lindstrom48bd7c12001-01-09 00:35:42 +0000138 ssh_close_authentication_connection(auth);
Damien Millereba71ba2000-04-29 23:57:08 +1000139 BN_clear_free(challenge);
Damien Millerad833b32000-08-23 10:46:23 +1000140 debug("RSA authentication accepted by server.");
Damien Millereba71ba2000-04-29 23:57:08 +1000141 return 1;
142 }
143 /* Otherwise it should return failure. */
144 if (type != SSH_SMSG_FAILURE)
145 packet_disconnect("Protocol error waiting RSA auth response: %d",
146 type);
147 }
Ben Lindstrom48bd7c12001-01-09 00:35:42 +0000148 ssh_close_authentication_connection(auth);
Damien Millereba71ba2000-04-29 23:57:08 +1000149 BN_clear_free(challenge);
Damien Millereba71ba2000-04-29 23:57:08 +1000150 debug("RSA authentication using agent refused.");
151 return 0;
152}
153
154/*
155 * Computes the proper response to a RSA challenge, and sends the response to
156 * the server.
157 */
158void
159respond_to_rsa_challenge(BIGNUM * challenge, RSA * prv)
160{
Ben Lindstrom46c16222000-12-22 01:43:59 +0000161 u_char buf[32], response[16];
Damien Millereba71ba2000-04-29 23:57:08 +1000162 MD5_CTX md;
163 int i, len;
164
165 /* Decrypt the challenge using the private key. */
Damien Miller7650bc62001-01-30 09:27:26 +1100166 /* XXX think about Bleichenbacher, too */
167 if (rsa_private_decrypt(challenge, challenge, prv) <= 0)
168 packet_disconnect(
169 "respond_to_rsa_challenge: rsa_private_decrypt failed");
Damien Millereba71ba2000-04-29 23:57:08 +1000170
171 /* Compute the response. */
172 /* The response is MD5 of decrypted challenge plus session id. */
173 len = BN_num_bytes(challenge);
174 if (len <= 0 || len > sizeof(buf))
Damien Miller7650bc62001-01-30 09:27:26 +1100175 packet_disconnect(
176 "respond_to_rsa_challenge: bad challenge length %d", len);
Damien Millereba71ba2000-04-29 23:57:08 +1000177
178 memset(buf, 0, sizeof(buf));
179 BN_bn2bin(challenge, buf + sizeof(buf) - len);
180 MD5_Init(&md);
181 MD5_Update(&md, buf, 32);
182 MD5_Update(&md, session_id, 16);
183 MD5_Final(response, &md);
184
185 debug("Sending response to host key RSA challenge.");
186
187 /* Send the response back to the server. */
188 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
189 for (i = 0; i < 16; i++)
190 packet_put_char(response[i]);
191 packet_send();
192 packet_write_wait();
193
194 memset(buf, 0, sizeof(buf));
195 memset(response, 0, sizeof(response));
196 memset(&md, 0, sizeof(md));
197}
198
199/*
200 * Checks if the user has authentication file, and if so, tries to authenticate
201 * the user using it.
202 */
203int
204try_rsa_authentication(const char *authfile)
205{
206 BIGNUM *challenge;
207 Key *public;
208 Key *private;
209 char *passphrase, *comment;
210 int type, i;
211 int plen, clen;
212
213 /* Try to load identification for the authentication key. */
Ben Lindstromd0fca422001-03-26 13:44:06 +0000214 /* XXKEYLOAD */
215 public = key_load_public_type(KEY_RSA1, authfile, &comment);
216 if (public == NULL) {
Damien Millereba71ba2000-04-29 23:57:08 +1000217 /* Could not load it. Fail. */
218 return 0;
219 }
220 debug("Trying RSA authentication with key '%.100s'", comment);
221
222 /* Tell the server that we are willing to authenticate using this key. */
223 packet_start(SSH_CMSG_AUTH_RSA);
224 packet_put_bignum(public->rsa->n);
225 packet_send();
226 packet_write_wait();
227
228 /* We no longer need the public key. */
229 key_free(public);
230
231 /* Wait for server's response. */
232 type = packet_read(&plen);
233
234 /*
235 * The server responds with failure if it doesn\'t like our key or
236 * doesn\'t support RSA authentication.
237 */
238 if (type == SSH_SMSG_FAILURE) {
239 debug("Server refused our key.");
240 xfree(comment);
241 return 0;
242 }
243 /* Otherwise, the server should respond with a challenge. */
244 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
245 packet_disconnect("Protocol error during RSA authentication: %d", type);
246
247 /* Get the challenge from the packet. */
248 challenge = BN_new();
249 packet_get_bignum(challenge, &clen);
250
251 packet_integrity_check(plen, clen, type);
252
253 debug("Received RSA challenge from server.");
254
Damien Millereba71ba2000-04-29 23:57:08 +1000255 /*
256 * Load the private key. Try first with empty passphrase; if it
257 * fails, ask for a passphrase.
258 */
Ben Lindstromd0fca422001-03-26 13:44:06 +0000259 private = key_load_private_type(KEY_RSA1, authfile, "", NULL);
260 if (private == NULL) {
Damien Millereba71ba2000-04-29 23:57:08 +1000261 char buf[300];
262 snprintf(buf, sizeof buf, "Enter passphrase for RSA key '%.100s': ",
263 comment);
264 if (!options.batch_mode)
265 passphrase = read_passphrase(buf, 0);
266 else {
267 debug("Will not query passphrase for %.100s in batch mode.",
268 comment);
269 passphrase = xstrdup("");
270 }
271
272 /* Load the authentication file using the pasphrase. */
Ben Lindstromd0fca422001-03-26 13:44:06 +0000273 private = key_load_private_type(KEY_RSA1, authfile, passphrase, NULL);
274 if (private == NULL) {
Damien Millereba71ba2000-04-29 23:57:08 +1000275 memset(passphrase, 0, strlen(passphrase));
276 xfree(passphrase);
277 error("Bad passphrase.");
278
279 /* Send a dummy response packet to avoid protocol error. */
280 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
281 for (i = 0; i < 16; i++)
282 packet_put_char(0);
283 packet_send();
284 packet_write_wait();
285
286 /* Expect the server to reject it... */
287 packet_read_expect(&plen, SSH_SMSG_FAILURE);
288 xfree(comment);
Ben Lindstrom48bd7c12001-01-09 00:35:42 +0000289 BN_clear_free(challenge);
Damien Millereba71ba2000-04-29 23:57:08 +1000290 return 0;
291 }
292 /* Destroy the passphrase. */
293 memset(passphrase, 0, strlen(passphrase));
294 xfree(passphrase);
295 }
296 /* We no longer need the comment. */
297 xfree(comment);
298
299 /* Compute and send a response to the challenge. */
300 respond_to_rsa_challenge(challenge, private->rsa);
301
302 /* Destroy the private key. */
303 key_free(private);
304
305 /* We no longer need the challenge. */
306 BN_clear_free(challenge);
307
308 /* Wait for response from the server. */
309 type = packet_read(&plen);
310 if (type == SSH_SMSG_SUCCESS) {
311 debug("RSA authentication accepted by server.");
312 return 1;
313 }
314 if (type != SSH_SMSG_FAILURE)
315 packet_disconnect("Protocol error waiting RSA auth response: %d", type);
316 debug("RSA authentication refused.");
317 return 0;
318}
319
320/*
321 * Tries to authenticate the user using combined rhosts or /etc/hosts.equiv
322 * authentication and RSA host authentication.
323 */
324int
Ben Lindstromd0fca422001-03-26 13:44:06 +0000325try_rhosts_rsa_authentication(const char *local_user, Key * host_key)
Damien Millereba71ba2000-04-29 23:57:08 +1000326{
327 int type;
328 BIGNUM *challenge;
329 int plen, clen;
330
331 debug("Trying rhosts or /etc/hosts.equiv with RSA host authentication.");
332
333 /* Tell the server that we are willing to authenticate using this key. */
334 packet_start(SSH_CMSG_AUTH_RHOSTS_RSA);
Ben Lindstrom664408d2001-06-09 01:42:01 +0000335 packet_put_cstring(local_user);
Ben Lindstromd0fca422001-03-26 13:44:06 +0000336 packet_put_int(BN_num_bits(host_key->rsa->n));
337 packet_put_bignum(host_key->rsa->e);
338 packet_put_bignum(host_key->rsa->n);
Damien Millereba71ba2000-04-29 23:57:08 +1000339 packet_send();
340 packet_write_wait();
341
342 /* Wait for server's response. */
343 type = packet_read(&plen);
344
345 /* The server responds with failure if it doesn't admit our
346 .rhosts authentication or doesn't know our host key. */
347 if (type == SSH_SMSG_FAILURE) {
348 debug("Server refused our rhosts authentication or host key.");
349 return 0;
350 }
351 /* Otherwise, the server should respond with a challenge. */
352 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
353 packet_disconnect("Protocol error during RSA authentication: %d", type);
354
355 /* Get the challenge from the packet. */
356 challenge = BN_new();
357 packet_get_bignum(challenge, &clen);
358
359 packet_integrity_check(plen, clen, type);
360
361 debug("Received RSA challenge for host key from server.");
362
363 /* Compute a response to the challenge. */
Ben Lindstromd0fca422001-03-26 13:44:06 +0000364 respond_to_rsa_challenge(challenge, host_key->rsa);
Damien Millereba71ba2000-04-29 23:57:08 +1000365
366 /* We no longer need the challenge. */
367 BN_clear_free(challenge);
368
369 /* Wait for response from the server. */
370 type = packet_read(&plen);
371 if (type == SSH_SMSG_SUCCESS) {
372 debug("Rhosts or /etc/hosts.equiv with RSA host authentication accepted by server.");
373 return 1;
374 }
375 if (type != SSH_SMSG_FAILURE)
376 packet_disconnect("Protocol error waiting RSA auth response: %d", type);
377 debug("Rhosts or /etc/hosts.equiv with RSA host authentication refused.");
378 return 0;
379}
380
381#ifdef KRB4
382int
Ben Lindstrom31ca54a2001-02-09 02:11:24 +0000383try_kerberos_authentication(void)
Damien Millereba71ba2000-04-29 23:57:08 +1000384{
385 KTEXT_ST auth; /* Kerberos data */
386 char *reply;
387 char inst[INST_SZ];
388 char *realm;
389 CREDENTIALS cred;
390 int r, type, plen;
391 socklen_t slen;
392 Key_schedule schedule;
393 u_long checksum, cksum;
394 MSG_DAT msg_data;
395 struct sockaddr_in local, foreign;
396 struct stat st;
397
398 /* Don't do anything if we don't have any tickets. */
399 if (stat(tkt_string(), &st) < 0)
400 return 0;
401
Damien Miller33804262001-02-04 23:20:18 +1100402 strncpy(inst, (char *) krb_get_phost(get_canonical_hostname(1)), INST_SZ);
Damien Millereba71ba2000-04-29 23:57:08 +1000403
Damien Miller33804262001-02-04 23:20:18 +1100404 realm = (char *) krb_realmofhost(get_canonical_hostname(1));
Damien Millereba71ba2000-04-29 23:57:08 +1000405 if (!realm) {
Damien Miller33804262001-02-04 23:20:18 +1100406 debug("Kerberos V4: no realm for %s", get_canonical_hostname(1));
Damien Millereba71ba2000-04-29 23:57:08 +1000407 return 0;
408 }
409 /* This can really be anything. */
410 checksum = (u_long) getpid();
411
412 r = krb_mk_req(&auth, KRB4_SERVICE_NAME, inst, realm, checksum);
413 if (r != KSUCCESS) {
414 debug("Kerberos V4 krb_mk_req failed: %s", krb_err_txt[r]);
415 return 0;
416 }
417 /* Get session key to decrypt the server's reply with. */
418 r = krb_get_cred(KRB4_SERVICE_NAME, inst, realm, &cred);
419 if (r != KSUCCESS) {
420 debug("get_cred failed: %s", krb_err_txt[r]);
421 return 0;
422 }
423 des_key_sched((des_cblock *) cred.session, schedule);
424
425 /* Send authentication info to server. */
426 packet_start(SSH_CMSG_AUTH_KERBEROS);
427 packet_put_string((char *) auth.dat, auth.length);
428 packet_send();
429 packet_write_wait();
430
431 /* Zero the buffer. */
432 (void) memset(auth.dat, 0, MAX_KTXT_LEN);
433
434 slen = sizeof(local);
435 memset(&local, 0, sizeof(local));
436 if (getsockname(packet_get_connection_in(),
437 (struct sockaddr *) & local, &slen) < 0)
438 debug("getsockname failed: %s", strerror(errno));
439
440 slen = sizeof(foreign);
441 memset(&foreign, 0, sizeof(foreign));
442 if (getpeername(packet_get_connection_in(),
443 (struct sockaddr *) & foreign, &slen) < 0) {
444 debug("getpeername failed: %s", strerror(errno));
445 fatal_cleanup();
446 }
447 /* Get server reply. */
448 type = packet_read(&plen);
449 switch (type) {
450 case SSH_SMSG_FAILURE:
451 /* Should really be SSH_SMSG_AUTH_KERBEROS_FAILURE */
452 debug("Kerberos V4 authentication failed.");
453 return 0;
454 break;
455
456 case SSH_SMSG_AUTH_KERBEROS_RESPONSE:
457 /* SSH_SMSG_AUTH_KERBEROS_SUCCESS */
458 debug("Kerberos V4 authentication accepted.");
459
460 /* Get server's response. */
Ben Lindstrom46c16222000-12-22 01:43:59 +0000461 reply = packet_get_string((u_int *) &auth.length);
Damien Millereba71ba2000-04-29 23:57:08 +1000462 memcpy(auth.dat, reply, auth.length);
463 xfree(reply);
464
465 packet_integrity_check(plen, 4 + auth.length, type);
466
467 /*
468 * If his response isn't properly encrypted with the session
469 * key, and the decrypted checksum fails to match, he's
470 * bogus. Bail out.
471 */
472 r = krb_rd_priv(auth.dat, auth.length, schedule, &cred.session,
473 &foreign, &local, &msg_data);
474 if (r != KSUCCESS) {
475 debug("Kerberos V4 krb_rd_priv failed: %s", krb_err_txt[r]);
476 packet_disconnect("Kerberos V4 challenge failed!");
477 }
478 /* Fetch the (incremented) checksum that we supplied in the request. */
479 (void) memcpy((char *) &cksum, (char *) msg_data.app_data, sizeof(cksum));
480 cksum = ntohl(cksum);
481
482 /* If it matches, we're golden. */
483 if (cksum == checksum + 1) {
484 debug("Kerberos V4 challenge successful.");
485 return 1;
486 } else
487 packet_disconnect("Kerberos V4 challenge failed!");
488 break;
489
490 default:
491 packet_disconnect("Protocol error on Kerberos V4 response: %d", type);
492 }
493 return 0;
494}
495
496#endif /* KRB4 */
497
498#ifdef AFS
499int
Ben Lindstrom31ca54a2001-02-09 02:11:24 +0000500send_kerberos_tgt(void)
Damien Millereba71ba2000-04-29 23:57:08 +1000501{
502 CREDENTIALS *creds;
503 char pname[ANAME_SZ], pinst[INST_SZ], prealm[REALM_SZ];
504 int r, type, plen;
505 char buffer[8192];
506 struct stat st;
507
508 /* Don't do anything if we don't have any tickets. */
509 if (stat(tkt_string(), &st) < 0)
510 return 0;
511
512 creds = xmalloc(sizeof(*creds));
513
514 if ((r = krb_get_tf_fullname(TKT_FILE, pname, pinst, prealm)) != KSUCCESS) {
515 debug("Kerberos V4 tf_fullname failed: %s", krb_err_txt[r]);
516 return 0;
517 }
518 if ((r = krb_get_cred("krbtgt", prealm, prealm, creds)) != GC_OK) {
519 debug("Kerberos V4 get_cred failed: %s", krb_err_txt[r]);
520 return 0;
521 }
522 if (time(0) > krb_life_to_time(creds->issue_date, creds->lifetime)) {
523 debug("Kerberos V4 ticket expired: %s", TKT_FILE);
524 return 0;
525 }
Ben Lindstrom46c16222000-12-22 01:43:59 +0000526 creds_to_radix(creds, (u_char *)buffer, sizeof buffer);
Damien Millereba71ba2000-04-29 23:57:08 +1000527 xfree(creds);
528
529 packet_start(SSH_CMSG_HAVE_KERBEROS_TGT);
Ben Lindstrom664408d2001-06-09 01:42:01 +0000530 packet_put_cstring(buffer);
Damien Millereba71ba2000-04-29 23:57:08 +1000531 packet_send();
532 packet_write_wait();
533
534 type = packet_read(&plen);
535
536 if (type == SSH_SMSG_FAILURE)
537 debug("Kerberos TGT for realm %s rejected.", prealm);
538 else if (type != SSH_SMSG_SUCCESS)
539 packet_disconnect("Protocol error on Kerberos TGT response: %d", type);
540
541 return 1;
542}
543
544void
545send_afs_tokens(void)
546{
547 CREDENTIALS creds;
548 struct ViceIoctl parms;
549 struct ClearToken ct;
550 int i, type, len, plen;
551 char buf[2048], *p, *server_cell;
552 char buffer[8192];
553
554 /* Move over ktc_GetToken, here's something leaner. */
555 for (i = 0; i < 100; i++) { /* just in case */
556 parms.in = (char *) &i;
557 parms.in_size = sizeof(i);
558 parms.out = buf;
559 parms.out_size = sizeof(buf);
560 if (k_pioctl(0, VIOCGETTOK, &parms, 0) != 0)
561 break;
562 p = buf;
563
564 /* Get secret token. */
Ben Lindstrom46c16222000-12-22 01:43:59 +0000565 memcpy(&creds.ticket_st.length, p, sizeof(u_int));
Damien Millereba71ba2000-04-29 23:57:08 +1000566 if (creds.ticket_st.length > MAX_KTXT_LEN)
567 break;
Ben Lindstrom46c16222000-12-22 01:43:59 +0000568 p += sizeof(u_int);
Damien Millereba71ba2000-04-29 23:57:08 +1000569 memcpy(creds.ticket_st.dat, p, creds.ticket_st.length);
570 p += creds.ticket_st.length;
571
572 /* Get clear token. */
573 memcpy(&len, p, sizeof(len));
574 if (len != sizeof(struct ClearToken))
575 break;
576 p += sizeof(len);
577 memcpy(&ct, p, len);
578 p += len;
579 p += sizeof(len); /* primary flag */
580 server_cell = p;
581
582 /* Flesh out our credentials. */
583 strlcpy(creds.service, "afs", sizeof creds.service);
584 creds.instance[0] = '\0';
585 strlcpy(creds.realm, server_cell, REALM_SZ);
586 memcpy(creds.session, ct.HandShakeKey, DES_KEY_SZ);
587 creds.issue_date = ct.BeginTimestamp;
588 creds.lifetime = krb_time_to_life(creds.issue_date, ct.EndTimestamp);
589 creds.kvno = ct.AuthHandle;
590 snprintf(creds.pname, sizeof(creds.pname), "AFS ID %d", ct.ViceId);
591 creds.pinst[0] = '\0';
592
593 /* Encode token, ship it off. */
Ben Lindstrombf555ba2001-01-18 02:04:35 +0000594 if (creds_to_radix(&creds, (u_char *) buffer, sizeof buffer) <= 0)
Damien Millereba71ba2000-04-29 23:57:08 +1000595 break;
596 packet_start(SSH_CMSG_HAVE_AFS_TOKEN);
Ben Lindstrom664408d2001-06-09 01:42:01 +0000597 packet_put_cstring(buffer);
Damien Millereba71ba2000-04-29 23:57:08 +1000598 packet_send();
599 packet_write_wait();
600
601 /* Roger, Roger. Clearance, Clarence. What's your vector,
602 Victor? */
603 type = packet_read(&plen);
604
605 if (type == SSH_SMSG_FAILURE)
606 debug("AFS token for cell %s rejected.", server_cell);
607 else if (type != SSH_SMSG_SUCCESS)
608 packet_disconnect("Protocol error on AFS token response: %d", type);
609 }
610}
611
612#endif /* AFS */
613
614/*
615 * Tries to authenticate with any string-based challenge/response system.
616 * Note that the client code is not tied to s/key or TIS.
617 */
618int
Ben Lindstrom551ea372001-06-05 18:56:16 +0000619try_challenge_response_authentication(void)
Damien Millereba71ba2000-04-29 23:57:08 +1000620{
621 int type, i;
622 int payload_len;
Ben Lindstrom46c16222000-12-22 01:43:59 +0000623 u_int clen;
Ben Lindstroma65c78a2000-12-10 22:57:30 +0000624 char prompt[1024];
Damien Millereba71ba2000-04-29 23:57:08 +1000625 char *challenge, *response;
626
Ben Lindstrom95fb2dd2001-01-23 03:12:10 +0000627 debug("Doing challenge reponse authentication.");
Damien Millereba71ba2000-04-29 23:57:08 +1000628
Damien Millereba71ba2000-04-29 23:57:08 +1000629 for (i = 0; i < options.number_of_password_prompts; i++) {
Ben Lindstroma65c78a2000-12-10 22:57:30 +0000630 /* request a challenge */
631 packet_start(SSH_CMSG_AUTH_TIS);
632 packet_send();
633 packet_write_wait();
634
635 type = packet_read(&payload_len);
636 if (type != SSH_SMSG_FAILURE &&
637 type != SSH_SMSG_AUTH_TIS_CHALLENGE) {
638 packet_disconnect("Protocol error: got %d in response "
Ben Lindstrom95fb2dd2001-01-23 03:12:10 +0000639 "to SSH_CMSG_AUTH_TIS", type);
Ben Lindstroma65c78a2000-12-10 22:57:30 +0000640 }
641 if (type != SSH_SMSG_AUTH_TIS_CHALLENGE) {
Ben Lindstrom95fb2dd2001-01-23 03:12:10 +0000642 debug("No challenge.");
Ben Lindstroma65c78a2000-12-10 22:57:30 +0000643 return 0;
644 }
645 challenge = packet_get_string(&clen);
646 packet_integrity_check(payload_len, (4 + clen), type);
Ben Lindstromdb65e8f2001-01-19 04:26:52 +0000647 snprintf(prompt, sizeof prompt, "%s%s", challenge,
648 strchr(challenge, '\n') ? "" : "\nResponse: ");
Ben Lindstroma65c78a2000-12-10 22:57:30 +0000649 xfree(challenge);
Damien Millereba71ba2000-04-29 23:57:08 +1000650 if (i != 0)
651 error("Permission denied, please try again.");
Ben Lindstroma65c78a2000-12-10 22:57:30 +0000652 if (options.cipher == SSH_CIPHER_NONE)
653 log("WARNING: Encryption is disabled! "
654 "Reponse will be transmitted in clear text.");
655 response = read_passphrase(prompt, 0);
656 if (strcmp(response, "") == 0) {
657 xfree(response);
658 break;
659 }
Damien Millereba71ba2000-04-29 23:57:08 +1000660 packet_start(SSH_CMSG_AUTH_TIS_RESPONSE);
Damien Miller79438cc2001-02-16 12:34:57 +1100661 ssh_put_password(response);
Damien Millereba71ba2000-04-29 23:57:08 +1000662 memset(response, 0, strlen(response));
663 xfree(response);
664 packet_send();
665 packet_write_wait();
666 type = packet_read(&payload_len);
667 if (type == SSH_SMSG_SUCCESS)
668 return 1;
669 if (type != SSH_SMSG_FAILURE)
670 packet_disconnect("Protocol error: got %d in response "
Ben Lindstrom95fb2dd2001-01-23 03:12:10 +0000671 "to SSH_CMSG_AUTH_TIS_RESPONSE", type);
Damien Millereba71ba2000-04-29 23:57:08 +1000672 }
673 /* failure */
674 return 0;
675}
676
677/*
678 * Tries to authenticate with plain passwd authentication.
679 */
680int
681try_password_authentication(char *prompt)
682{
683 int type, i, payload_len;
684 char *password;
685
686 debug("Doing password authentication.");
687 if (options.cipher == SSH_CIPHER_NONE)
688 log("WARNING: Encryption is disabled! Password will be transmitted in clear text.");
689 for (i = 0; i < options.number_of_password_prompts; i++) {
690 if (i != 0)
691 error("Permission denied, please try again.");
692 password = read_passphrase(prompt, 0);
693 packet_start(SSH_CMSG_AUTH_PASSWORD);
Damien Miller79438cc2001-02-16 12:34:57 +1100694 ssh_put_password(password);
Damien Millereba71ba2000-04-29 23:57:08 +1000695 memset(password, 0, strlen(password));
696 xfree(password);
697 packet_send();
698 packet_write_wait();
699
700 type = packet_read(&payload_len);
701 if (type == SSH_SMSG_SUCCESS)
702 return 1;
703 if (type != SSH_SMSG_FAILURE)
704 packet_disconnect("Protocol error: got %d in response to passwd auth", type);
705 }
706 /* failure */
707 return 0;
708}
709
710/*
711 * SSH1 key exchange
712 */
713void
714ssh_kex(char *host, struct sockaddr *hostaddr)
715{
716 int i;
717 BIGNUM *key;
718 RSA *host_key;
719 RSA *public_key;
720 Key k;
721 int bits, rbits;
722 int ssh_cipher_default = SSH_CIPHER_3DES;
Ben Lindstrom46c16222000-12-22 01:43:59 +0000723 u_char session_key[SSH_SESSION_KEY_LENGTH];
724 u_char cookie[8];
725 u_int supported_ciphers;
726 u_int server_flags, client_flags;
Damien Millereba71ba2000-04-29 23:57:08 +1000727 int payload_len, clen, sum_len = 0;
728 u_int32_t rand = 0;
729
730 debug("Waiting for server public key.");
731
732 /* Wait for a public key packet from the server. */
733 packet_read_expect(&payload_len, SSH_SMSG_PUBLIC_KEY);
734
735 /* Get cookie from the packet. */
736 for (i = 0; i < 8; i++)
737 cookie[i] = packet_get_char();
738
739 /* Get the public key. */
740 public_key = RSA_new();
741 bits = packet_get_int();/* bits */
742 public_key->e = BN_new();
743 packet_get_bignum(public_key->e, &clen);
744 sum_len += clen;
745 public_key->n = BN_new();
746 packet_get_bignum(public_key->n, &clen);
747 sum_len += clen;
748
749 rbits = BN_num_bits(public_key->n);
750 if (bits != rbits) {
751 log("Warning: Server lies about size of server public key: "
752 "actual size is %d bits vs. announced %d.", rbits, bits);
753 log("Warning: This may be due to an old implementation of ssh.");
754 }
755 /* Get the host key. */
756 host_key = RSA_new();
757 bits = packet_get_int();/* bits */
758 host_key->e = BN_new();
759 packet_get_bignum(host_key->e, &clen);
760 sum_len += clen;
761 host_key->n = BN_new();
762 packet_get_bignum(host_key->n, &clen);
763 sum_len += clen;
764
765 rbits = BN_num_bits(host_key->n);
766 if (bits != rbits) {
767 log("Warning: Server lies about size of server host key: "
768 "actual size is %d bits vs. announced %d.", rbits, bits);
769 log("Warning: This may be due to an old implementation of ssh.");
770 }
771
772 /* Get protocol flags. */
773 server_flags = packet_get_int();
774 packet_set_protocol_flags(server_flags);
775
776 supported_ciphers = packet_get_int();
777 supported_authentications = packet_get_int();
778
779 debug("Received server public key (%d bits) and host key (%d bits).",
780 BN_num_bits(public_key->n), BN_num_bits(host_key->n));
781
782 packet_integrity_check(payload_len,
783 8 + 4 + sum_len + 0 + 4 + 0 + 0 + 4 + 4 + 4,
784 SSH_SMSG_PUBLIC_KEY);
Damien Miller0bc1bd82000-11-13 22:57:25 +1100785 k.type = KEY_RSA1;
Damien Millereba71ba2000-04-29 23:57:08 +1000786 k.rsa = host_key;
787 check_host_key(host, hostaddr, &k,
788 options.user_hostfile, options.system_hostfile);
789
790 client_flags = SSH_PROTOFLAG_SCREEN_NUMBER | SSH_PROTOFLAG_HOST_IN_FWD_OPEN;
791
792 compute_session_id(session_id, cookie, host_key->n, public_key->n);
793
794 /* Generate a session key. */
795 arc4random_stir();
796
797 /*
798 * Generate an encryption key for the session. The key is a 256 bit
799 * random number, interpreted as a 32-byte key, with the least
800 * significant 8 bits being the first byte of the key.
801 */
802 for (i = 0; i < 32; i++) {
803 if (i % 4 == 0)
804 rand = arc4random();
805 session_key[i] = rand & 0xff;
806 rand >>= 8;
807 }
808
809 /*
810 * According to the protocol spec, the first byte of the session key
811 * is the highest byte of the integer. The session key is xored with
812 * the first 16 bytes of the session id.
813 */
814 key = BN_new();
815 BN_set_word(key, 0);
816 for (i = 0; i < SSH_SESSION_KEY_LENGTH; i++) {
817 BN_lshift(key, key, 8);
818 if (i < 16)
819 BN_add_word(key, session_key[i] ^ session_id[i]);
820 else
821 BN_add_word(key, session_key[i]);
822 }
823
824 /*
825 * Encrypt the integer using the public key and host key of the
826 * server (key with smaller modulus first).
827 */
828 if (BN_cmp(public_key->n, host_key->n) < 0) {
829 /* Public key has smaller modulus. */
830 if (BN_num_bits(host_key->n) <
831 BN_num_bits(public_key->n) + SSH_KEY_BITS_RESERVED) {
832 fatal("respond_to_rsa_challenge: host_key %d < public_key %d + "
833 "SSH_KEY_BITS_RESERVED %d",
834 BN_num_bits(host_key->n),
835 BN_num_bits(public_key->n),
836 SSH_KEY_BITS_RESERVED);
837 }
838 rsa_public_encrypt(key, key, public_key);
839 rsa_public_encrypt(key, key, host_key);
840 } else {
841 /* Host key has smaller modulus (or they are equal). */
842 if (BN_num_bits(public_key->n) <
843 BN_num_bits(host_key->n) + SSH_KEY_BITS_RESERVED) {
844 fatal("respond_to_rsa_challenge: public_key %d < host_key %d + "
845 "SSH_KEY_BITS_RESERVED %d",
846 BN_num_bits(public_key->n),
847 BN_num_bits(host_key->n),
848 SSH_KEY_BITS_RESERVED);
849 }
850 rsa_public_encrypt(key, key, host_key);
851 rsa_public_encrypt(key, key, public_key);
852 }
853
854 /* Destroy the public keys since we no longer need them. */
855 RSA_free(public_key);
856 RSA_free(host_key);
857
Damien Millere39cacc2000-11-29 12:18:44 +1100858 if (options.cipher == SSH_CIPHER_NOT_SET) {
859 if (cipher_mask_ssh1(1) & supported_ciphers & (1 << ssh_cipher_default))
860 options.cipher = ssh_cipher_default;
861 } else if (options.cipher == SSH_CIPHER_ILLEGAL ||
862 !(cipher_mask_ssh1(1) & (1 << options.cipher))) {
Damien Miller30c3d422000-05-09 11:02:59 +1000863 log("No valid SSH1 cipher, using %.100s instead.",
Damien Miller874d77b2000-10-14 16:23:11 +1100864 cipher_name(ssh_cipher_default));
865 options.cipher = ssh_cipher_default;
Damien Millereba71ba2000-04-29 23:57:08 +1000866 }
867 /* Check that the selected cipher is supported. */
868 if (!(supported_ciphers & (1 << options.cipher)))
869 fatal("Selected cipher type %.100s not supported by server.",
870 cipher_name(options.cipher));
871
872 debug("Encryption type: %.100s", cipher_name(options.cipher));
873
874 /* Send the encrypted session key to the server. */
875 packet_start(SSH_CMSG_SESSION_KEY);
876 packet_put_char(options.cipher);
877
878 /* Send the cookie back to the server. */
879 for (i = 0; i < 8; i++)
880 packet_put_char(cookie[i]);
881
882 /* Send and destroy the encrypted encryption key integer. */
883 packet_put_bignum(key);
884 BN_clear_free(key);
885
886 /* Send protocol flags. */
887 packet_put_int(client_flags);
888
889 /* Send the packet now. */
890 packet_send();
891 packet_write_wait();
892
893 debug("Sent encrypted session key.");
894
895 /* Set the encryption key. */
896 packet_set_encryption_key(session_key, SSH_SESSION_KEY_LENGTH, options.cipher);
897
898 /* We will no longer need the session key here. Destroy any extra copies. */
899 memset(session_key, 0, sizeof(session_key));
900
901 /*
902 * Expect a success message from the server. Note that this message
903 * will be received in encrypted form.
904 */
905 packet_read_expect(&payload_len, SSH_SMSG_SUCCESS);
906
907 debug("Received encrypted confirmation.");
908}
909
910/*
911 * Authenticate user
912 */
913void
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000914ssh_userauth1(const char *local_user, const char *server_user, char *host,
915 Key **keys, int nkeys)
Damien Millereba71ba2000-04-29 23:57:08 +1000916{
917 int i, type;
918 int payload_len;
919
920 if (supported_authentications == 0)
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000921 fatal("ssh_userauth1: server supports no auth methods");
Damien Millereba71ba2000-04-29 23:57:08 +1000922
923 /* Send the name of the user to log in as on the server. */
924 packet_start(SSH_CMSG_USER);
Ben Lindstrom664408d2001-06-09 01:42:01 +0000925 packet_put_cstring(server_user);
Damien Millereba71ba2000-04-29 23:57:08 +1000926 packet_send();
927 packet_write_wait();
928
929 /*
930 * The server should respond with success if no authentication is
931 * needed (the user has no password). Otherwise the server responds
932 * with failure.
933 */
934 type = packet_read(&payload_len);
935
936 /* check whether the connection was accepted without authentication. */
937 if (type == SSH_SMSG_SUCCESS)
938 return;
939 if (type != SSH_SMSG_FAILURE)
940 packet_disconnect("Protocol error: got %d in response to SSH_CMSG_USER",
941 type);
942
943#ifdef AFS
944 /* Try Kerberos tgt passing if the server supports it. */
945 if ((supported_authentications & (1 << SSH_PASS_KERBEROS_TGT)) &&
946 options.kerberos_tgt_passing) {
947 if (options.cipher == SSH_CIPHER_NONE)
948 log("WARNING: Encryption is disabled! Ticket will be transmitted in the clear!");
949 (void) send_kerberos_tgt();
950 }
951 /* Try AFS token passing if the server supports it. */
952 if ((supported_authentications & (1 << SSH_PASS_AFS_TOKEN)) &&
953 options.afs_token_passing && k_hasafs()) {
954 if (options.cipher == SSH_CIPHER_NONE)
955 log("WARNING: Encryption is disabled! Token will be transmitted in the clear!");
956 send_afs_tokens();
957 }
958#endif /* AFS */
959
960#ifdef KRB4
961 if ((supported_authentications & (1 << SSH_AUTH_KERBEROS)) &&
962 options.kerberos_authentication) {
963 debug("Trying Kerberos authentication.");
964 if (try_kerberos_authentication()) {
965 /* The server should respond with success or failure. */
966 type = packet_read(&payload_len);
967 if (type == SSH_SMSG_SUCCESS)
968 return;
969 if (type != SSH_SMSG_FAILURE)
970 packet_disconnect("Protocol error: got %d in response to Kerberos auth", type);
971 }
972 }
973#endif /* KRB4 */
974
975 /*
976 * Use rhosts authentication if running in privileged socket and we
977 * do not wish to remain anonymous.
978 */
979 if ((supported_authentications & (1 << SSH_AUTH_RHOSTS)) &&
980 options.rhosts_authentication) {
981 debug("Trying rhosts authentication.");
982 packet_start(SSH_CMSG_AUTH_RHOSTS);
Ben Lindstrom664408d2001-06-09 01:42:01 +0000983 packet_put_cstring(local_user);
Damien Millereba71ba2000-04-29 23:57:08 +1000984 packet_send();
985 packet_write_wait();
986
987 /* The server should respond with success or failure. */
988 type = packet_read(&payload_len);
989 if (type == SSH_SMSG_SUCCESS)
990 return;
991 if (type != SSH_SMSG_FAILURE)
992 packet_disconnect("Protocol error: got %d in response to rhosts auth",
993 type);
994 }
995 /*
996 * Try .rhosts or /etc/hosts.equiv authentication with RSA host
997 * authentication.
998 */
999 if ((supported_authentications & (1 << SSH_AUTH_RHOSTS_RSA)) &&
Ben Lindstrom5eabda32001-04-12 23:34:34 +00001000 options.rhosts_rsa_authentication) {
1001 for (i = 0; i < nkeys; i++) {
Ben Lindstrom9cb59af2001-04-17 18:08:15 +00001002 if (keys[i] != NULL && keys[i]->type == KEY_RSA1 &&
Ben Lindstrom5eabda32001-04-12 23:34:34 +00001003 try_rhosts_rsa_authentication(local_user, keys[i]))
1004 return;
1005 }
Damien Millereba71ba2000-04-29 23:57:08 +10001006 }
1007 /* Try RSA authentication if the server supports it. */
1008 if ((supported_authentications & (1 << SSH_AUTH_RSA)) &&
1009 options.rsa_authentication) {
1010 /*
1011 * Try RSA authentication using the authentication agent. The
1012 * agent is tried first because no passphrase is needed for
1013 * it, whereas identity files may require passphrases.
1014 */
1015 if (try_agent_authentication())
1016 return;
1017
1018 /* Try RSA authentication for each identity. */
1019 for (i = 0; i < options.num_identity_files; i++)
Ben Lindstrom266dfdf2001-03-09 00:12:22 +00001020 if (options.identity_keys[i] != NULL &&
1021 options.identity_keys[i]->type == KEY_RSA1 &&
Damien Miller0bc1bd82000-11-13 22:57:25 +11001022 try_rsa_authentication(options.identity_files[i]))
Damien Millereba71ba2000-04-29 23:57:08 +10001023 return;
1024 }
Ben Lindstrom95fb2dd2001-01-23 03:12:10 +00001025 /* Try challenge response authentication if the server supports it. */
Damien Millereba71ba2000-04-29 23:57:08 +10001026 if ((supported_authentications & (1 << SSH_AUTH_TIS)) &&
Ben Lindstrom551ea372001-06-05 18:56:16 +00001027 options.challenge_response_authentication && !options.batch_mode) {
1028 if (try_challenge_response_authentication())
Damien Millereba71ba2000-04-29 23:57:08 +10001029 return;
1030 }
1031 /* Try password authentication if the server supports it. */
1032 if ((supported_authentications & (1 << SSH_AUTH_PASSWORD)) &&
1033 options.password_authentication && !options.batch_mode) {
1034 char prompt[80];
1035
Ben Lindstrome0557162001-02-11 00:00:24 +00001036 snprintf(prompt, sizeof(prompt), "%.30s@%.128s's password: ",
Damien Millereba71ba2000-04-29 23:57:08 +10001037 server_user, host);
1038 if (try_password_authentication(prompt))
1039 return;
1040 }
1041 /* All authentication methods have failed. Exit with an error message. */
1042 fatal("Permission denied.");
1043 /* NOTREACHED */
1044}