blob: a7beb3600eb28dc1fba8c26c1e8c02007a3b4261 [file] [log] [blame]
Damien Millereba71ba2000-04-29 23:57:08 +10001/*
2 * Copyright (c) 2000 Markus Friedl. All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
Damien Millereba71ba2000-04-29 23:57:08 +100012 *
13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
23 */
24
25#include "includes.h"
Ben Lindstrom7d199962001-09-12 18:29:00 +000026RCSID("$OpenBSD: sshconnect2.c,v 1.82 2001/08/31 11:46:39 markus Exp $");
Damien Millereba71ba2000-04-29 23:57:08 +100027
28#include <openssl/bn.h>
Damien Millereba71ba2000-04-29 23:57:08 +100029#include <openssl/md5.h>
30#include <openssl/dh.h>
31#include <openssl/hmac.h>
32
33#include "ssh.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000034#include "ssh2.h"
Damien Millereba71ba2000-04-29 23:57:08 +100035#include "xmalloc.h"
36#include "rsa.h"
37#include "buffer.h"
38#include "packet.h"
Damien Millereba71ba2000-04-29 23:57:08 +100039#include "uidswap.h"
40#include "compat.h"
Damien Millereba71ba2000-04-29 23:57:08 +100041#include "bufaux.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000042#include "cipher.h"
Damien Millereba71ba2000-04-29 23:57:08 +100043#include "kex.h"
44#include "myproposal.h"
45#include "key.h"
Damien Millereba71ba2000-04-29 23:57:08 +100046#include "sshconnect.h"
47#include "authfile.h"
Ben Lindstromdf221392001-03-29 00:36:16 +000048#include "dh.h"
Damien Millerad833b32000-08-23 10:46:23 +100049#include "authfd.h"
Ben Lindstrom226cfa02001-01-22 05:34:40 +000050#include "log.h"
51#include "readconf.h"
52#include "readpass.h"
Ben Lindstromb9be60a2001-03-11 01:49:19 +000053#include "match.h"
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000054#include "dispatch.h"
Ben Lindstrom5eabda32001-04-12 23:34:34 +000055#include "canohost.h"
Damien Miller874d77b2000-10-14 16:23:11 +110056
Damien Millereba71ba2000-04-29 23:57:08 +100057/* import */
58extern char *client_version_string;
59extern char *server_version_string;
60extern Options options;
61
62/*
63 * SSH2 key exchange
64 */
65
Ben Lindstrom46c16222000-12-22 01:43:59 +000066u_char *session_id2 = NULL;
Damien Millereba71ba2000-04-29 23:57:08 +100067int session_id2_len = 0;
68
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000069char *xxx_host;
70struct sockaddr *xxx_hostaddr;
71
Ben Lindstromf28f6342001-04-04 02:03:04 +000072Kex *xxx_kex = NULL;
73
Ben Lindstrombba81212001-06-25 05:01:22 +000074static int
Ben Lindstromd6481ea2001-06-25 04:37:41 +000075verify_host_key_callback(Key *hostkey)
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000076{
Ben Lindstromd6481ea2001-06-25 04:37:41 +000077 if (verify_host_key(xxx_host, xxx_hostaddr, hostkey) == -1)
78 fatal("verify_host_key failed");
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000079 return 0;
80}
81
Damien Millereba71ba2000-04-29 23:57:08 +100082void
Damien Miller874d77b2000-10-14 16:23:11 +110083ssh_kex2(char *host, struct sockaddr *hostaddr)
84{
Damien Miller874d77b2000-10-14 16:23:11 +110085 Kex *kex;
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +000086
87 xxx_host = host;
88 xxx_hostaddr = hostaddr;
Damien Miller874d77b2000-10-14 16:23:11 +110089
Damien Millere39cacc2000-11-29 12:18:44 +110090 if (options.ciphers == (char *)-1) {
91 log("No valid ciphers for protocol version 2 given, using defaults.");
92 options.ciphers = NULL;
Damien Miller874d77b2000-10-14 16:23:11 +110093 }
94 if (options.ciphers != NULL) {
95 myproposal[PROPOSAL_ENC_ALGS_CTOS] =
96 myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
97 }
Damien Millera0ff4662001-03-30 10:49:35 +100098 myproposal[PROPOSAL_ENC_ALGS_CTOS] =
99 compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]);
100 myproposal[PROPOSAL_ENC_ALGS_STOC] =
101 compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_STOC]);
Damien Miller874d77b2000-10-14 16:23:11 +1100102 if (options.compression) {
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000103 myproposal[PROPOSAL_COMP_ALGS_CTOS] =
Damien Miller874d77b2000-10-14 16:23:11 +1100104 myproposal[PROPOSAL_COMP_ALGS_STOC] = "zlib";
105 } else {
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000106 myproposal[PROPOSAL_COMP_ALGS_CTOS] =
Damien Miller874d77b2000-10-14 16:23:11 +1100107 myproposal[PROPOSAL_COMP_ALGS_STOC] = "none";
108 }
Ben Lindstrom06b33aa2001-02-15 03:01:59 +0000109 if (options.macs != NULL) {
110 myproposal[PROPOSAL_MAC_ALGS_CTOS] =
111 myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
112 }
Ben Lindstrom982dbbc2001-04-17 18:11:36 +0000113 if (options.hostkeyalgorithms != NULL)
114 myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
115 options.hostkeyalgorithms;
Damien Miller874d77b2000-10-14 16:23:11 +1100116
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000117 /* start key exchange */
Ben Lindstrom238abf62001-04-04 17:52:53 +0000118 kex = kex_setup(myproposal);
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000119 kex->client_version_string=client_version_string;
120 kex->server_version_string=server_version_string;
Ben Lindstromd6481ea2001-06-25 04:37:41 +0000121 kex->verify_host_key=&verify_host_key_callback;
Damien Miller874d77b2000-10-14 16:23:11 +1100122
Ben Lindstromf28f6342001-04-04 02:03:04 +0000123 xxx_kex = kex;
124
Ben Lindstrombe2cc432001-04-04 23:46:07 +0000125 dispatch_run(DISPATCH_BLOCK, &kex->done, kex);
Damien Miller874d77b2000-10-14 16:23:11 +1100126
Ben Lindstrom2d90e002001-04-04 02:00:54 +0000127 session_id2 = kex->session_id;
128 session_id2_len = kex->session_id_len;
129
Damien Miller874d77b2000-10-14 16:23:11 +1100130#ifdef DEBUG_KEXDH
131 /* send 1st encrypted/maced/compressed message */
132 packet_start(SSH2_MSG_IGNORE);
133 packet_put_cstring("markus");
134 packet_send();
135 packet_write_wait();
136#endif
Ben Lindstrom20d7c7b2001-04-04 01:56:17 +0000137 debug("done: ssh_kex2.");
Damien Millereba71ba2000-04-29 23:57:08 +1000138}
Damien Millerb1715dc2000-05-30 13:44:51 +1000139
Damien Millereba71ba2000-04-29 23:57:08 +1000140/*
141 * Authenticate user
142 */
Damien Miller62cee002000-09-23 17:15:56 +1100143
144typedef struct Authctxt Authctxt;
145typedef struct Authmethod Authmethod;
146
147typedef int sign_cb_fn(
148 Authctxt *authctxt, Key *key,
Ben Lindstrom46c16222000-12-22 01:43:59 +0000149 u_char **sigp, int *lenp, u_char *data, int datalen);
Damien Miller62cee002000-09-23 17:15:56 +1100150
151struct Authctxt {
152 const char *server_user;
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000153 const char *local_user;
Damien Miller62cee002000-09-23 17:15:56 +1100154 const char *host;
155 const char *service;
Damien Miller62cee002000-09-23 17:15:56 +1100156 Authmethod *method;
Damien Miller874d77b2000-10-14 16:23:11 +1100157 int success;
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000158 char *authlist;
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000159 /* pubkey */
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000160 Key *last_key;
161 sign_cb_fn *last_key_sign;
162 int last_key_hint;
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000163 AuthenticationConnection *agent;
164 /* hostbased */
165 Key **keys;
166 int nkeys;
Ben Lindstrom7d199962001-09-12 18:29:00 +0000167 /* kbd-interactive */
168 int info_req_seen;
Damien Miller62cee002000-09-23 17:15:56 +1100169};
170struct Authmethod {
171 char *name; /* string to compare against server's list */
172 int (*userauth)(Authctxt *authctxt);
173 int *enabled; /* flag in option struct that enables method */
174 int *batch_flag; /* flag in option struct that disables method */
175};
176
177void input_userauth_success(int type, int plen, void *ctxt);
178void input_userauth_failure(int type, int plen, void *ctxt);
Ben Lindstromd26dcf32001-01-06 15:18:16 +0000179void input_userauth_banner(int type, int plen, void *ctxt);
Damien Miller62cee002000-09-23 17:15:56 +1100180void input_userauth_error(int type, int plen, void *ctxt);
Damien Miller874d77b2000-10-14 16:23:11 +1100181void input_userauth_info_req(int type, int plen, void *ctxt);
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000182void input_userauth_pk_ok(int type, int plen, void *ctxt);
Damien Miller874d77b2000-10-14 16:23:11 +1100183
184int userauth_none(Authctxt *authctxt);
Damien Miller62cee002000-09-23 17:15:56 +1100185int userauth_pubkey(Authctxt *authctxt);
186int userauth_passwd(Authctxt *authctxt);
Damien Miller874d77b2000-10-14 16:23:11 +1100187int userauth_kbdint(Authctxt *authctxt);
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000188int userauth_hostbased(Authctxt *authctxt);
Damien Miller62cee002000-09-23 17:15:56 +1100189
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000190void userauth(Authctxt *authctxt, char *authlist);
191
Ben Lindstrombba81212001-06-25 05:01:22 +0000192static int sign_and_send_pubkey(Authctxt *, Key *, sign_cb_fn *);
193static void clear_auth_state(Authctxt *);
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000194
Ben Lindstrombba81212001-06-25 05:01:22 +0000195static Authmethod *authmethod_get(char *authlist);
196static Authmethod *authmethod_lookup(const char *name);
197static char *authmethods_get(void);
Damien Miller62cee002000-09-23 17:15:56 +1100198
199Authmethod authmethods[] = {
Ben Lindstrom1bfe2912001-06-05 19:37:25 +0000200 {"hostbased",
201 userauth_hostbased,
202 &options.hostbased_authentication,
203 NULL},
Ben Lindstrom45350e82001-08-06 20:57:11 +0000204 {"publickey",
205 userauth_pubkey,
206 &options.pubkey_authentication,
207 NULL},
Damien Miller874d77b2000-10-14 16:23:11 +1100208 {"keyboard-interactive",
209 userauth_kbdint,
210 &options.kbd_interactive_authentication,
211 &options.batch_mode},
Ben Lindstrom45350e82001-08-06 20:57:11 +0000212 {"password",
213 userauth_passwd,
214 &options.password_authentication,
215 &options.batch_mode},
Damien Miller874d77b2000-10-14 16:23:11 +1100216 {"none",
217 userauth_none,
218 NULL,
219 NULL},
Damien Miller62cee002000-09-23 17:15:56 +1100220 {NULL, NULL, NULL, NULL}
221};
222
223void
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000224ssh_userauth2(const char *local_user, const char *server_user, char *host,
225 Key **keys, int nkeys)
Damien Miller62cee002000-09-23 17:15:56 +1100226{
227 Authctxt authctxt;
228 int type;
229 int plen;
230
Ben Lindstrom551ea372001-06-05 18:56:16 +0000231 if (options.challenge_response_authentication)
Ben Lindstrom95fb2dd2001-01-23 03:12:10 +0000232 options.kbd_interactive_authentication = 1;
233
Damien Miller62cee002000-09-23 17:15:56 +1100234 debug("send SSH2_MSG_SERVICE_REQUEST");
235 packet_start(SSH2_MSG_SERVICE_REQUEST);
236 packet_put_cstring("ssh-userauth");
237 packet_send();
238 packet_write_wait();
239 type = packet_read(&plen);
240 if (type != SSH2_MSG_SERVICE_ACCEPT) {
241 fatal("denied SSH2_MSG_SERVICE_ACCEPT: %d", type);
242 }
243 if (packet_remaining() > 0) {
244 char *reply = packet_get_string(&plen);
245 debug("service_accept: %s", reply);
246 xfree(reply);
Damien Miller62cee002000-09-23 17:15:56 +1100247 } else {
248 debug("buggy server: service_accept w/o service");
249 }
250 packet_done();
251 debug("got SSH2_MSG_SERVICE_ACCEPT");
252
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000253 if (options.preferred_authentications == NULL)
254 options.preferred_authentications = authmethods_get();
255
Damien Miller62cee002000-09-23 17:15:56 +1100256 /* setup authentication context */
Ben Lindstrom7d199962001-09-12 18:29:00 +0000257 memset(&authctxt, 0, sizeof(authctxt));
Damien Miller62cee002000-09-23 17:15:56 +1100258 authctxt.agent = ssh_get_authentication_connection();
259 authctxt.server_user = server_user;
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000260 authctxt.local_user = local_user;
Damien Miller62cee002000-09-23 17:15:56 +1100261 authctxt.host = host;
262 authctxt.service = "ssh-connection"; /* service name */
263 authctxt.success = 0;
Damien Miller874d77b2000-10-14 16:23:11 +1100264 authctxt.method = authmethod_lookup("none");
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000265 authctxt.authlist = NULL;
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000266 authctxt.keys = keys;
267 authctxt.nkeys = nkeys;
Ben Lindstrom7d199962001-09-12 18:29:00 +0000268 authctxt.info_req_seen = 0;
Damien Miller874d77b2000-10-14 16:23:11 +1100269 if (authctxt.method == NULL)
270 fatal("ssh_userauth2: internal error: cannot send userauth none request");
Damien Miller62cee002000-09-23 17:15:56 +1100271
272 /* initial userauth request */
Damien Miller874d77b2000-10-14 16:23:11 +1100273 userauth_none(&authctxt);
Damien Miller62cee002000-09-23 17:15:56 +1100274
Ben Lindstrom8ac91062001-04-04 17:57:54 +0000275 dispatch_init(&input_userauth_error);
Damien Miller62cee002000-09-23 17:15:56 +1100276 dispatch_set(SSH2_MSG_USERAUTH_SUCCESS, &input_userauth_success);
277 dispatch_set(SSH2_MSG_USERAUTH_FAILURE, &input_userauth_failure);
Ben Lindstromd26dcf32001-01-06 15:18:16 +0000278 dispatch_set(SSH2_MSG_USERAUTH_BANNER, &input_userauth_banner);
Damien Miller62cee002000-09-23 17:15:56 +1100279 dispatch_run(DISPATCH_BLOCK, &authctxt.success, &authctxt); /* loop until success */
280
281 if (authctxt.agent != NULL)
282 ssh_close_authentication_connection(authctxt.agent);
283
Ben Lindstrom4dccfa52000-12-28 16:40:05 +0000284 debug("ssh-userauth2 successful: method %s", authctxt.method->name);
Damien Miller62cee002000-09-23 17:15:56 +1100285}
286void
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000287userauth(Authctxt *authctxt, char *authlist)
288{
289 if (authlist == NULL) {
290 authlist = authctxt->authlist;
291 } else {
292 if (authctxt->authlist)
293 xfree(authctxt->authlist);
294 authctxt->authlist = authlist;
295 }
296 for (;;) {
297 Authmethod *method = authmethod_get(authlist);
298 if (method == NULL)
299 fatal("Permission denied (%s).", authlist);
300 authctxt->method = method;
301 if (method->userauth(authctxt) != 0) {
302 debug2("we sent a %s packet, wait for reply", method->name);
303 break;
304 } else {
305 debug2("we did not send a packet, disable method");
306 method->enabled = NULL;
307 }
308 }
309}
310void
Damien Miller62cee002000-09-23 17:15:56 +1100311input_userauth_error(int type, int plen, void *ctxt)
312{
Ben Lindstromd26dcf32001-01-06 15:18:16 +0000313 fatal("input_userauth_error: bad message during authentication: "
314 "type %d", type);
315}
316void
317input_userauth_banner(int type, int plen, void *ctxt)
318{
319 char *msg, *lang;
320 debug3("input_userauth_banner");
321 msg = packet_get_string(NULL);
322 lang = packet_get_string(NULL);
323 fprintf(stderr, "%s", msg);
324 xfree(msg);
325 xfree(lang);
Damien Miller62cee002000-09-23 17:15:56 +1100326}
327void
328input_userauth_success(int type, int plen, void *ctxt)
329{
330 Authctxt *authctxt = ctxt;
331 if (authctxt == NULL)
332 fatal("input_userauth_success: no authentication context");
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000333 if (authctxt->authlist)
334 xfree(authctxt->authlist);
335 clear_auth_state(authctxt);
Damien Miller62cee002000-09-23 17:15:56 +1100336 authctxt->success = 1; /* break out */
337}
338void
339input_userauth_failure(int type, int plen, void *ctxt)
340{
Damien Miller62cee002000-09-23 17:15:56 +1100341 Authctxt *authctxt = ctxt;
342 char *authlist = NULL;
343 int partial;
Damien Miller62cee002000-09-23 17:15:56 +1100344
345 if (authctxt == NULL)
346 fatal("input_userauth_failure: no authentication context");
347
Damien Miller874d77b2000-10-14 16:23:11 +1100348 authlist = packet_get_string(NULL);
Damien Miller62cee002000-09-23 17:15:56 +1100349 partial = packet_get_char();
350 packet_done();
351
352 if (partial != 0)
Ben Lindstrom03df5bd2001-02-10 22:16:41 +0000353 log("Authenticated with partial success.");
Damien Miller62cee002000-09-23 17:15:56 +1100354 debug("authentications that can continue: %s", authlist);
355
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000356 clear_auth_state(authctxt);
357 userauth(authctxt, authlist);
358}
359void
360input_userauth_pk_ok(int type, int plen, void *ctxt)
361{
362 Authctxt *authctxt = ctxt;
363 Key *key = NULL;
364 Buffer b;
Ben Lindstrom206941f2001-04-15 14:27:16 +0000365 int alen, blen, sent = 0;
Ben Lindstromcfccef92001-03-13 04:57:58 +0000366 char *pkalg, *pkblob, *fp;
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000367
368 if (authctxt == NULL)
369 fatal("input_userauth_pk_ok: no authentication context");
370 if (datafellows & SSH_BUG_PKOK) {
371 /* this is similar to SSH_BUG_PKAUTH */
372 debug2("input_userauth_pk_ok: SSH_BUG_PKOK");
373 pkblob = packet_get_string(&blen);
374 buffer_init(&b);
375 buffer_append(&b, pkblob, blen);
376 pkalg = buffer_get_string(&b, &alen);
377 buffer_free(&b);
378 } else {
379 pkalg = packet_get_string(&alen);
380 pkblob = packet_get_string(&blen);
Kevin Stevesef4eea92001-02-05 12:42:17 +0000381 }
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000382 packet_done();
383
384 debug("input_userauth_pk_ok: pkalg %s blen %d lastkey %p hint %d",
385 pkalg, blen, authctxt->last_key, authctxt->last_key_hint);
386
387 do {
388 if (authctxt->last_key == NULL ||
389 authctxt->last_key_sign == NULL) {
390 debug("no last key or no sign cb");
391 break;
392 }
Ben Lindstrom206941f2001-04-15 14:27:16 +0000393 if (key_type_from_name(pkalg) == KEY_UNSPEC) {
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000394 debug("unknown pkalg %s", pkalg);
395 break;
396 }
397 if ((key = key_from_blob(pkblob, blen)) == NULL) {
398 debug("no key from blob. pkalg %s", pkalg);
399 break;
400 }
Ben Lindstromcfccef92001-03-13 04:57:58 +0000401 fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
402 debug2("input_userauth_pk_ok: fp %s", fp);
403 xfree(fp);
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000404 if (!key_equal(key, authctxt->last_key)) {
405 debug("key != last_key");
406 break;
407 }
408 sent = sign_and_send_pubkey(authctxt, key,
409 authctxt->last_key_sign);
410 } while(0);
411
412 if (key != NULL)
413 key_free(key);
414 xfree(pkalg);
415 xfree(pkblob);
416
417 /* unregister */
418 clear_auth_state(authctxt);
419 dispatch_set(SSH2_MSG_USERAUTH_PK_OK, NULL);
420
421 /* try another method if we did not send a packet*/
422 if (sent == 0)
423 userauth(authctxt, NULL);
424
Damien Miller62cee002000-09-23 17:15:56 +1100425}
426
Damien Millereba71ba2000-04-29 23:57:08 +1000427int
Damien Miller874d77b2000-10-14 16:23:11 +1100428userauth_none(Authctxt *authctxt)
429{
430 /* initial userauth request */
431 packet_start(SSH2_MSG_USERAUTH_REQUEST);
432 packet_put_cstring(authctxt->server_user);
433 packet_put_cstring(authctxt->service);
434 packet_put_cstring(authctxt->method->name);
435 packet_send();
Damien Miller874d77b2000-10-14 16:23:11 +1100436 return 1;
437}
438
439int
Damien Miller62cee002000-09-23 17:15:56 +1100440userauth_passwd(Authctxt *authctxt)
Damien Millereba71ba2000-04-29 23:57:08 +1000441{
Damien Millere247cc42000-05-07 12:03:14 +1000442 static int attempt = 0;
Damien Millereba71ba2000-04-29 23:57:08 +1000443 char prompt[80];
444 char *password;
445
Damien Millerd3a18572000-06-07 19:55:44 +1000446 if (attempt++ >= options.number_of_password_prompts)
Damien Millere247cc42000-05-07 12:03:14 +1000447 return 0;
448
Damien Millerd3a18572000-06-07 19:55:44 +1000449 if(attempt != 1)
450 error("Permission denied, please try again.");
451
Ben Lindstrom03df5bd2001-02-10 22:16:41 +0000452 snprintf(prompt, sizeof(prompt), "%.30s@%.128s's password: ",
Damien Miller62cee002000-09-23 17:15:56 +1100453 authctxt->server_user, authctxt->host);
Damien Millereba71ba2000-04-29 23:57:08 +1000454 password = read_passphrase(prompt, 0);
455 packet_start(SSH2_MSG_USERAUTH_REQUEST);
Damien Miller62cee002000-09-23 17:15:56 +1100456 packet_put_cstring(authctxt->server_user);
457 packet_put_cstring(authctxt->service);
Damien Miller874d77b2000-10-14 16:23:11 +1100458 packet_put_cstring(authctxt->method->name);
Damien Millereba71ba2000-04-29 23:57:08 +1000459 packet_put_char(0);
Ben Lindstrom5699c5f2001-03-05 06:17:49 +0000460 packet_put_cstring(password);
Damien Millereba71ba2000-04-29 23:57:08 +1000461 memset(password, 0, strlen(password));
462 xfree(password);
Ben Lindstrom5699c5f2001-03-05 06:17:49 +0000463 packet_inject_ignore(64);
Damien Millereba71ba2000-04-29 23:57:08 +1000464 packet_send();
Damien Millereba71ba2000-04-29 23:57:08 +1000465 return 1;
466}
467
Ben Lindstrom79073822001-07-04 03:42:30 +0000468static void
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000469clear_auth_state(Authctxt *authctxt)
470{
471 /* XXX clear authentication state */
472 if (authctxt->last_key != NULL && authctxt->last_key_hint == -1) {
473 debug3("clear_auth_state: key_free %p", authctxt->last_key);
474 key_free(authctxt->last_key);
475 }
476 authctxt->last_key = NULL;
477 authctxt->last_key_hint = -2;
478 authctxt->last_key_sign = NULL;
479}
480
Ben Lindstrombba81212001-06-25 05:01:22 +0000481static int
Damien Miller62cee002000-09-23 17:15:56 +1100482sign_and_send_pubkey(Authctxt *authctxt, Key *k, sign_cb_fn *sign_callback)
Damien Millereba71ba2000-04-29 23:57:08 +1000483{
484 Buffer b;
Ben Lindstrom46c16222000-12-22 01:43:59 +0000485 u_char *blob, *signature;
Damien Millereba71ba2000-04-29 23:57:08 +1000486 int bloblen, slen;
Damien Miller6536c7d2000-06-22 21:32:31 +1000487 int skip = 0;
Damien Millerad833b32000-08-23 10:46:23 +1000488 int ret = -1;
Damien Miller874d77b2000-10-14 16:23:11 +1100489 int have_sig = 1;
Damien Millereba71ba2000-04-29 23:57:08 +1000490
Ben Lindstromd121f612000-12-03 17:00:47 +0000491 debug3("sign_and_send_pubkey");
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000492
Damien Miller0bc1bd82000-11-13 22:57:25 +1100493 if (key_to_blob(k, &blob, &bloblen) == 0) {
494 /* we cannot handle this key */
Ben Lindstromd121f612000-12-03 17:00:47 +0000495 debug3("sign_and_send_pubkey: cannot handle key");
Damien Miller0bc1bd82000-11-13 22:57:25 +1100496 return 0;
497 }
Damien Millereba71ba2000-04-29 23:57:08 +1000498 /* data to be signed */
499 buffer_init(&b);
Damien Miller50a41ed2000-10-16 12:14:42 +1100500 if (datafellows & SSH_OLD_SESSIONID) {
Damien Miller6536c7d2000-06-22 21:32:31 +1000501 buffer_append(&b, session_id2, session_id2_len);
Kevin Stevesef4eea92001-02-05 12:42:17 +0000502 skip = session_id2_len;
Damien Miller50a41ed2000-10-16 12:14:42 +1100503 } else {
504 buffer_put_string(&b, session_id2, session_id2_len);
505 skip = buffer_len(&b);
Damien Miller6536c7d2000-06-22 21:32:31 +1000506 }
Damien Millereba71ba2000-04-29 23:57:08 +1000507 buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
Damien Miller62cee002000-09-23 17:15:56 +1100508 buffer_put_cstring(&b, authctxt->server_user);
Damien Miller30c3d422000-05-09 11:02:59 +1000509 buffer_put_cstring(&b,
Ben Lindstromd121f612000-12-03 17:00:47 +0000510 datafellows & SSH_BUG_PKSERVICE ?
Damien Miller30c3d422000-05-09 11:02:59 +1000511 "ssh-userauth" :
Damien Miller62cee002000-09-23 17:15:56 +1100512 authctxt->service);
Ben Lindstromd121f612000-12-03 17:00:47 +0000513 if (datafellows & SSH_BUG_PKAUTH) {
514 buffer_put_char(&b, have_sig);
515 } else {
516 buffer_put_cstring(&b, authctxt->method->name);
517 buffer_put_char(&b, have_sig);
Kevin Stevesef4eea92001-02-05 12:42:17 +0000518 buffer_put_cstring(&b, key_ssh_name(k));
Ben Lindstromd121f612000-12-03 17:00:47 +0000519 }
Damien Millereba71ba2000-04-29 23:57:08 +1000520 buffer_put_string(&b, blob, bloblen);
Damien Millereba71ba2000-04-29 23:57:08 +1000521
522 /* generate signature */
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000523 ret = (*sign_callback)(authctxt, k, &signature, &slen,
524 buffer_ptr(&b), buffer_len(&b));
Damien Millerad833b32000-08-23 10:46:23 +1000525 if (ret == -1) {
526 xfree(blob);
527 buffer_free(&b);
528 return 0;
529 }
Damien Miller0bc1bd82000-11-13 22:57:25 +1100530#ifdef DEBUG_PK
Damien Millereba71ba2000-04-29 23:57:08 +1000531 buffer_dump(&b);
532#endif
Ben Lindstromd121f612000-12-03 17:00:47 +0000533 if (datafellows & SSH_BUG_PKSERVICE) {
Damien Miller30c3d422000-05-09 11:02:59 +1000534 buffer_clear(&b);
535 buffer_append(&b, session_id2, session_id2_len);
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000536 skip = session_id2_len;
Damien Miller30c3d422000-05-09 11:02:59 +1000537 buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
Damien Miller62cee002000-09-23 17:15:56 +1100538 buffer_put_cstring(&b, authctxt->server_user);
539 buffer_put_cstring(&b, authctxt->service);
Damien Miller874d77b2000-10-14 16:23:11 +1100540 buffer_put_cstring(&b, authctxt->method->name);
541 buffer_put_char(&b, have_sig);
Ben Lindstromd121f612000-12-03 17:00:47 +0000542 if (!(datafellows & SSH_BUG_PKAUTH))
Kevin Stevesef4eea92001-02-05 12:42:17 +0000543 buffer_put_cstring(&b, key_ssh_name(k));
Damien Miller30c3d422000-05-09 11:02:59 +1000544 buffer_put_string(&b, blob, bloblen);
545 }
546 xfree(blob);
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000547
Damien Millereba71ba2000-04-29 23:57:08 +1000548 /* append signature */
549 buffer_put_string(&b, signature, slen);
550 xfree(signature);
551
552 /* skip session id and packet type */
Damien Miller6536c7d2000-06-22 21:32:31 +1000553 if (buffer_len(&b) < skip + 1)
Damien Miller62cee002000-09-23 17:15:56 +1100554 fatal("userauth_pubkey: internal error");
Damien Miller6536c7d2000-06-22 21:32:31 +1000555 buffer_consume(&b, skip + 1);
Damien Millereba71ba2000-04-29 23:57:08 +1000556
557 /* put remaining data from buffer into packet */
558 packet_start(SSH2_MSG_USERAUTH_REQUEST);
559 packet_put_raw(buffer_ptr(&b), buffer_len(&b));
560 buffer_free(&b);
Damien Millereba71ba2000-04-29 23:57:08 +1000561 packet_send();
Damien Millerad833b32000-08-23 10:46:23 +1000562
563 return 1;
Damien Miller994cf142000-07-21 10:19:44 +1000564}
565
Ben Lindstrombba81212001-06-25 05:01:22 +0000566static int
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000567send_pubkey_test(Authctxt *authctxt, Key *k, sign_cb_fn *sign_callback,
568 int hint)
Damien Miller994cf142000-07-21 10:19:44 +1000569{
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000570 u_char *blob;
571 int bloblen, have_sig = 0;
Damien Miller994cf142000-07-21 10:19:44 +1000572
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000573 debug3("send_pubkey_test");
574
575 if (key_to_blob(k, &blob, &bloblen) == 0) {
576 /* we cannot handle this key */
577 debug3("send_pubkey_test: cannot handle key");
Damien Miller994cf142000-07-21 10:19:44 +1000578 return 0;
579 }
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000580 /* register callback for USERAUTH_PK_OK message */
581 authctxt->last_key_sign = sign_callback;
582 authctxt->last_key_hint = hint;
583 authctxt->last_key = k;
584 dispatch_set(SSH2_MSG_USERAUTH_PK_OK, &input_userauth_pk_ok);
Damien Miller994cf142000-07-21 10:19:44 +1000585
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000586 packet_start(SSH2_MSG_USERAUTH_REQUEST);
587 packet_put_cstring(authctxt->server_user);
588 packet_put_cstring(authctxt->service);
589 packet_put_cstring(authctxt->method->name);
590 packet_put_char(have_sig);
591 if (!(datafellows & SSH_BUG_PKAUTH))
592 packet_put_cstring(key_ssh_name(k));
593 packet_put_string(blob, bloblen);
594 xfree(blob);
595 packet_send();
596 return 1;
597}
598
Ben Lindstrombba81212001-06-25 05:01:22 +0000599static Key *
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000600load_identity_file(char *filename)
601{
602 Key *private;
603 char prompt[300], *passphrase;
Ben Lindstromd0fca422001-03-26 13:44:06 +0000604 int quit, i;
Ben Lindstrom329782e2001-03-10 17:08:59 +0000605 struct stat st;
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000606
Ben Lindstrom329782e2001-03-10 17:08:59 +0000607 if (stat(filename, &st) < 0) {
608 debug3("no such identity: %s", filename);
609 return NULL;
610 }
Ben Lindstromd0fca422001-03-26 13:44:06 +0000611 private = key_load_private_type(KEY_UNSPEC, filename, "", NULL);
612 if (private == NULL) {
613 if (options.batch_mode)
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000614 return NULL;
Damien Miller994cf142000-07-21 10:19:44 +1000615 snprintf(prompt, sizeof prompt,
Damien Miller0bc1bd82000-11-13 22:57:25 +1100616 "Enter passphrase for key '%.100s': ", filename);
Damien Miller62cee002000-09-23 17:15:56 +1100617 for (i = 0; i < options.number_of_password_prompts; i++) {
618 passphrase = read_passphrase(prompt, 0);
619 if (strcmp(passphrase, "") != 0) {
Ben Lindstromd0fca422001-03-26 13:44:06 +0000620 private = key_load_private_type(KEY_UNSPEC, filename,
621 passphrase, NULL);
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000622 quit = 0;
Damien Miller62cee002000-09-23 17:15:56 +1100623 } else {
624 debug2("no passphrase given, try next key");
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000625 quit = 1;
Damien Miller62cee002000-09-23 17:15:56 +1100626 }
627 memset(passphrase, 0, strlen(passphrase));
628 xfree(passphrase);
Ben Lindstromd0fca422001-03-26 13:44:06 +0000629 if (private != NULL || quit)
Damien Miller62cee002000-09-23 17:15:56 +1100630 break;
631 debug2("bad passphrase given, try again...");
632 }
Damien Miller994cf142000-07-21 10:19:44 +1000633 }
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000634 return private;
635}
636
Ben Lindstrombba81212001-06-25 05:01:22 +0000637static int
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000638identity_sign_cb(Authctxt *authctxt, Key *key, u_char **sigp, int *lenp,
639 u_char *data, int datalen)
640{
641 Key *private;
642 int idx, ret;
643
644 idx = authctxt->last_key_hint;
645 if (idx < 0)
646 return -1;
Ben Lindstromc5b68002001-07-04 04:52:03 +0000647
648 /* private key is stored in external hardware */
649 if (options.identity_keys[idx]->flags & KEY_FLAG_EXT)
650 return key_sign(options.identity_keys[idx], sigp, lenp, data, datalen);
651
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000652 private = load_identity_file(options.identity_files[idx]);
653 if (private == NULL)
654 return -1;
655 ret = key_sign(private, sigp, lenp, data, datalen);
656 key_free(private);
Damien Millerad833b32000-08-23 10:46:23 +1000657 return ret;
658}
659
Ben Lindstrombba81212001-06-25 05:01:22 +0000660static int
661agent_sign_cb(Authctxt *authctxt, Key *key, u_char **sigp, int *lenp,
Ben Lindstrom46c16222000-12-22 01:43:59 +0000662 u_char *data, int datalen)
Damien Millerad833b32000-08-23 10:46:23 +1000663{
Damien Miller62cee002000-09-23 17:15:56 +1100664 return ssh_agent_sign(authctxt->agent, key, sigp, lenp, data, datalen);
Damien Millerad833b32000-08-23 10:46:23 +1000665}
666
Ben Lindstrombba81212001-06-25 05:01:22 +0000667static int
668key_sign_cb(Authctxt *authctxt, Key *key, u_char **sigp, int *lenp,
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000669 u_char *data, int datalen)
670{
Ben Lindstroma3700052001-04-05 23:26:32 +0000671 return key_sign(key, sigp, lenp, data, datalen);
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000672}
673
Ben Lindstrombba81212001-06-25 05:01:22 +0000674static int
Damien Miller62cee002000-09-23 17:15:56 +1100675userauth_pubkey_agent(Authctxt *authctxt)
Damien Millerad833b32000-08-23 10:46:23 +1000676{
677 static int called = 0;
Damien Miller0bc1bd82000-11-13 22:57:25 +1100678 int ret = 0;
Damien Millerad833b32000-08-23 10:46:23 +1000679 char *comment;
680 Key *k;
Damien Millerad833b32000-08-23 10:46:23 +1000681
682 if (called == 0) {
Damien Miller0bc1bd82000-11-13 22:57:25 +1100683 if (ssh_get_num_identities(authctxt->agent, 2) == 0)
684 debug2("userauth_pubkey_agent: no keys at all");
Damien Miller62cee002000-09-23 17:15:56 +1100685 called = 1;
Damien Millerad833b32000-08-23 10:46:23 +1000686 }
Damien Miller0bc1bd82000-11-13 22:57:25 +1100687 k = ssh_get_next_identity(authctxt->agent, &comment, 2);
Damien Miller62cee002000-09-23 17:15:56 +1100688 if (k == NULL) {
Damien Miller0bc1bd82000-11-13 22:57:25 +1100689 debug2("userauth_pubkey_agent: no more keys");
690 } else {
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000691 debug("userauth_pubkey_agent: testing agent key %s", comment);
Damien Miller0bc1bd82000-11-13 22:57:25 +1100692 xfree(comment);
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000693 ret = send_pubkey_test(authctxt, k, agent_sign_cb, -1);
694 if (ret == 0)
695 key_free(k);
Damien Miller62cee002000-09-23 17:15:56 +1100696 }
Damien Miller0bc1bd82000-11-13 22:57:25 +1100697 if (ret == 0)
698 debug2("userauth_pubkey_agent: no message sent");
Damien Millerad833b32000-08-23 10:46:23 +1000699 return ret;
Damien Millereba71ba2000-04-29 23:57:08 +1000700}
701
Damien Miller62cee002000-09-23 17:15:56 +1100702int
703userauth_pubkey(Authctxt *authctxt)
Damien Millereba71ba2000-04-29 23:57:08 +1000704{
Damien Miller62cee002000-09-23 17:15:56 +1100705 static int idx = 0;
706 int sent = 0;
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000707 Key *key;
708 char *filename;
Damien Millereba71ba2000-04-29 23:57:08 +1000709
Damien Miller0bc1bd82000-11-13 22:57:25 +1100710 if (authctxt->agent != NULL) {
711 do {
712 sent = userauth_pubkey_agent(authctxt);
713 } while(!sent && authctxt->agent->howmany > 0);
714 }
715 while (!sent && idx < options.num_identity_files) {
Ben Lindstrom266dfdf2001-03-09 00:12:22 +0000716 key = options.identity_keys[idx];
717 filename = options.identity_files[idx];
718 if (key == NULL) {
719 debug("try privkey: %s", filename);
720 key = load_identity_file(filename);
721 if (key != NULL) {
722 sent = sign_and_send_pubkey(authctxt, key,
723 key_sign_cb);
724 key_free(key);
725 }
726 } else if (key->type != KEY_RSA1) {
727 debug("try pubkey: %s", filename);
728 sent = send_pubkey_test(authctxt, key,
729 identity_sign_cb, idx);
730 }
Damien Miller0bc1bd82000-11-13 22:57:25 +1100731 idx++;
732 }
Damien Miller62cee002000-09-23 17:15:56 +1100733 return sent;
734}
Damien Millereba71ba2000-04-29 23:57:08 +1000735
Damien Miller874d77b2000-10-14 16:23:11 +1100736/*
737 * Send userauth request message specifying keyboard-interactive method.
738 */
739int
740userauth_kbdint(Authctxt *authctxt)
741{
742 static int attempt = 0;
743
744 if (attempt++ >= options.number_of_password_prompts)
745 return 0;
Ben Lindstrom7d199962001-09-12 18:29:00 +0000746 /* disable if no SSH2_MSG_USERAUTH_INFO_REQUEST has been seen */
747 if (attempt > 1 && !authctxt->info_req_seen) {
748 debug3("userauth_kbdint: disable: no info_req_seen");
749 dispatch_set(SSH2_MSG_USERAUTH_INFO_REQUEST, NULL);
750 return 0;
751 }
Damien Miller874d77b2000-10-14 16:23:11 +1100752
753 debug2("userauth_kbdint");
754 packet_start(SSH2_MSG_USERAUTH_REQUEST);
755 packet_put_cstring(authctxt->server_user);
756 packet_put_cstring(authctxt->service);
757 packet_put_cstring(authctxt->method->name);
758 packet_put_cstring(""); /* lang */
759 packet_put_cstring(options.kbd_interactive_devices ?
760 options.kbd_interactive_devices : "");
761 packet_send();
Damien Miller874d77b2000-10-14 16:23:11 +1100762
763 dispatch_set(SSH2_MSG_USERAUTH_INFO_REQUEST, &input_userauth_info_req);
764 return 1;
765}
766
767/*
Ben Lindstrom03df5bd2001-02-10 22:16:41 +0000768 * parse INFO_REQUEST, prompt user and send INFO_RESPONSE
Damien Miller874d77b2000-10-14 16:23:11 +1100769 */
770void
771input_userauth_info_req(int type, int plen, void *ctxt)
772{
773 Authctxt *authctxt = ctxt;
Ben Lindstrom03df5bd2001-02-10 22:16:41 +0000774 char *name, *inst, *lang, *prompt, *response;
Ben Lindstrom46c16222000-12-22 01:43:59 +0000775 u_int num_prompts, i;
Damien Miller874d77b2000-10-14 16:23:11 +1100776 int echo = 0;
777
778 debug2("input_userauth_info_req");
779
780 if (authctxt == NULL)
781 fatal("input_userauth_info_req: no authentication context");
782
Ben Lindstrom7d199962001-09-12 18:29:00 +0000783 authctxt->info_req_seen = 1;
784
Damien Miller874d77b2000-10-14 16:23:11 +1100785 name = packet_get_string(NULL);
786 inst = packet_get_string(NULL);
787 lang = packet_get_string(NULL);
Damien Miller874d77b2000-10-14 16:23:11 +1100788 if (strlen(name) > 0)
Ben Lindstrom126c56a2001-06-25 05:22:53 +0000789 log("%s", name);
Damien Miller874d77b2000-10-14 16:23:11 +1100790 if (strlen(inst) > 0)
Ben Lindstrom126c56a2001-06-25 05:22:53 +0000791 log("%s", inst);
Ben Lindstrom03df5bd2001-02-10 22:16:41 +0000792 xfree(name);
Damien Miller874d77b2000-10-14 16:23:11 +1100793 xfree(inst);
Ben Lindstrom03df5bd2001-02-10 22:16:41 +0000794 xfree(lang);
Damien Miller874d77b2000-10-14 16:23:11 +1100795
796 num_prompts = packet_get_int();
797 /*
798 * Begin to build info response packet based on prompts requested.
799 * We commit to providing the correct number of responses, so if
800 * further on we run into a problem that prevents this, we have to
801 * be sure and clean this up and send a correct error response.
802 */
803 packet_start(SSH2_MSG_USERAUTH_INFO_RESPONSE);
804 packet_put_int(num_prompts);
805
Ben Lindstrom551ea372001-06-05 18:56:16 +0000806 debug2("input_userauth_info_req: num_prompts %d", num_prompts);
Damien Miller874d77b2000-10-14 16:23:11 +1100807 for (i = 0; i < num_prompts; i++) {
808 prompt = packet_get_string(NULL);
809 echo = packet_get_char();
810
Ben Lindstrom949974b2001-06-25 05:20:31 +0000811 response = read_passphrase(prompt, echo ? RP_ECHO : 0);
Damien Miller874d77b2000-10-14 16:23:11 +1100812
Ben Lindstrom5699c5f2001-03-05 06:17:49 +0000813 packet_put_cstring(response);
Damien Miller874d77b2000-10-14 16:23:11 +1100814 memset(response, 0, strlen(response));
815 xfree(response);
816 xfree(prompt);
817 }
818 packet_done(); /* done with parsing incoming message. */
819
Ben Lindstrom5699c5f2001-03-05 06:17:49 +0000820 packet_inject_ignore(64);
Damien Miller874d77b2000-10-14 16:23:11 +1100821 packet_send();
Damien Miller874d77b2000-10-14 16:23:11 +1100822}
Damien Miller62cee002000-09-23 17:15:56 +1100823
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000824/*
825 * this will be move to an external program (ssh-keysign) ASAP. ssh-keysign
826 * will be setuid-root and the sbit can be removed from /usr/bin/ssh.
827 */
828int
829userauth_hostbased(Authctxt *authctxt)
830{
831 Key *private = NULL;
832 Buffer b;
833 u_char *signature, *blob;
834 char *chost, *pkalg, *p;
Ben Lindstrom671388f2001-04-19 20:40:45 +0000835 const char *service;
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000836 u_int blen, slen;
Ben Lindstrom2bffd6f2001-04-19 20:35:40 +0000837 int ok, i, len, found = 0;
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000838
839 p = get_local_name(packet_get_connection_in());
840 if (p == NULL) {
841 error("userauth_hostbased: cannot get local ipaddr/name");
842 return 0;
843 }
Ben Lindstrom2bffd6f2001-04-19 20:35:40 +0000844 len = strlen(p) + 2;
845 chost = xmalloc(len);
846 strlcpy(chost, p, len);
847 strlcat(chost, ".", len);
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000848 debug2("userauth_hostbased: chost %s", chost);
849 /* check for a useful key */
850 for (i = 0; i < authctxt->nkeys; i++) {
851 private = authctxt->keys[i];
852 if (private && private->type != KEY_RSA1) {
853 found = 1;
854 /* we take and free the key */
855 authctxt->keys[i] = NULL;
856 break;
857 }
858 }
859 if (!found) {
860 xfree(chost);
861 return 0;
862 }
863 if (key_to_blob(private, &blob, &blen) == 0) {
864 key_free(private);
865 xfree(chost);
866 return 0;
867 }
Ben Lindstrom671388f2001-04-19 20:40:45 +0000868 service = datafellows & SSH_BUG_HBSERVICE ? "ssh-userauth" :
869 authctxt->service;
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000870 pkalg = xstrdup(key_ssh_name(private));
871 buffer_init(&b);
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000872 /* construct data */
Ben Lindstrom671388f2001-04-19 20:40:45 +0000873 buffer_put_string(&b, session_id2, session_id2_len);
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000874 buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
875 buffer_put_cstring(&b, authctxt->server_user);
Ben Lindstrom671388f2001-04-19 20:40:45 +0000876 buffer_put_cstring(&b, service);
Ben Lindstrom5eabda32001-04-12 23:34:34 +0000877 buffer_put_cstring(&b, authctxt->method->name);
878 buffer_put_cstring(&b, pkalg);
879 buffer_put_string(&b, blob, blen);
880 buffer_put_cstring(&b, chost);
881 buffer_put_cstring(&b, authctxt->local_user);
882#ifdef DEBUG_PK
883 buffer_dump(&b);
884#endif
885 debug2("xxx: chost %s", chost);
886 ok = key_sign(private, &signature, &slen, buffer_ptr(&b), buffer_len(&b));
887 key_free(private);
888 buffer_free(&b);
889 if (ok != 0) {
890 error("key_sign failed");
891 xfree(chost);
892 xfree(pkalg);
893 return 0;
894 }
895 packet_start(SSH2_MSG_USERAUTH_REQUEST);
896 packet_put_cstring(authctxt->server_user);
897 packet_put_cstring(authctxt->service);
898 packet_put_cstring(authctxt->method->name);
899 packet_put_cstring(pkalg);
900 packet_put_string(blob, blen);
901 packet_put_cstring(chost);
902 packet_put_cstring(authctxt->local_user);
903 packet_put_string(signature, slen);
904 memset(signature, 's', slen);
905 xfree(signature);
906 xfree(chost);
907 xfree(pkalg);
908
909 packet_send();
910 return 1;
911}
912
Damien Miller62cee002000-09-23 17:15:56 +1100913/* find auth method */
914
Damien Miller62cee002000-09-23 17:15:56 +1100915/*
916 * given auth method name, if configurable options permit this method fill
917 * in auth_ident field and return true, otherwise return false.
918 */
Ben Lindstrombba81212001-06-25 05:01:22 +0000919static int
Damien Miller62cee002000-09-23 17:15:56 +1100920authmethod_is_enabled(Authmethod *method)
921{
922 if (method == NULL)
923 return 0;
924 /* return false if options indicate this method is disabled */
925 if (method->enabled == NULL || *method->enabled == 0)
926 return 0;
927 /* return false if batch mode is enabled but method needs interactive mode */
928 if (method->batch_flag != NULL && *method->batch_flag != 0)
929 return 0;
930 return 1;
931}
932
Ben Lindstrombba81212001-06-25 05:01:22 +0000933static Authmethod *
Damien Miller62cee002000-09-23 17:15:56 +1100934authmethod_lookup(const char *name)
935{
936 Authmethod *method = NULL;
937 if (name != NULL)
938 for (method = authmethods; method->name != NULL; method++)
939 if (strcmp(name, method->name) == 0)
940 return method;
941 debug2("Unrecognized authentication method name: %s", name ? name : "NULL");
942 return NULL;
943}
944
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000945/* XXX internal state */
946static Authmethod *current = NULL;
947static char *supported = NULL;
948static char *preferred = NULL;
Damien Miller62cee002000-09-23 17:15:56 +1100949/*
950 * Given the authentication method list sent by the server, return the
951 * next method we should try. If the server initially sends a nil list,
Ben Lindstroma3700052001-04-05 23:26:32 +0000952 * use a built-in default list.
Kevin Stevesef4eea92001-02-05 12:42:17 +0000953 */
Ben Lindstrombba81212001-06-25 05:01:22 +0000954static Authmethod *
Damien Miller62cee002000-09-23 17:15:56 +1100955authmethod_get(char *authlist)
956{
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000957
958 char *name = NULL;
959 int next;
Kevin Stevesef4eea92001-02-05 12:42:17 +0000960
Damien Miller62cee002000-09-23 17:15:56 +1100961 /* Use a suitable default if we're passed a nil list. */
962 if (authlist == NULL || strlen(authlist) == 0)
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000963 authlist = options.preferred_authentications;
Damien Miller62cee002000-09-23 17:15:56 +1100964
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000965 if (supported == NULL || strcmp(authlist, supported) != 0) {
966 debug3("start over, passed a different list %s", authlist);
967 if (supported != NULL)
968 xfree(supported);
969 supported = xstrdup(authlist);
970 preferred = options.preferred_authentications;
971 debug3("preferred %s", preferred);
972 current = NULL;
973 } else if (current != NULL && authmethod_is_enabled(current))
974 return current;
Damien Millereba71ba2000-04-29 23:57:08 +1000975
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000976 for (;;) {
977 if ((name = match_list(preferred, supported, &next)) == NULL) {
978 debug("no more auth methods to try");
979 current = NULL;
980 return NULL;
Damien Miller874d77b2000-10-14 16:23:11 +1100981 }
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000982 preferred += next;
983 debug3("authmethod_lookup %s", name);
984 debug3("remaining preferred: %s", preferred);
985 if ((current = authmethod_lookup(name)) != NULL &&
986 authmethod_is_enabled(current)) {
987 debug3("authmethod_is_enabled %s", name);
988 debug("next auth method to try is %s", name);
989 return current;
990 }
Damien Millereba71ba2000-04-29 23:57:08 +1000991 }
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000992}
Damien Miller62cee002000-09-23 17:15:56 +1100993
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000994
995#define DELIM ","
Ben Lindstrom79073822001-07-04 03:42:30 +0000996
997static char *
Ben Lindstromb9be60a2001-03-11 01:49:19 +0000998authmethods_get(void)
999{
1000 Authmethod *method = NULL;
1001 char buf[1024];
1002
1003 buf[0] = '\0';
1004 for (method = authmethods; method->name != NULL; method++) {
1005 if (authmethod_is_enabled(method)) {
1006 if (buf[0] != '\0')
1007 strlcat(buf, DELIM, sizeof buf);
1008 strlcat(buf, method->name, sizeof buf);
1009 }
Damien Miller62cee002000-09-23 17:15:56 +11001010 }
Ben Lindstromb9be60a2001-03-11 01:49:19 +00001011 return xstrdup(buf);
Damien Millereba71ba2000-04-29 23:57:08 +10001012}