crypto/openssh/sshconnect2.c

   1 /* $OpenBSD: sshconnect2.c,v 1.171 2009/03/05 07:18:19 djm Exp $ */
   2 /*
   3  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
   4  * Copyright (c) 2008 Damien Miller.  All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions
   8  * are met:
   9  * 1. Redistributions of source code must retain the above copyright
  10  *    notice, this list of conditions and the following disclaimer.
  11  * 2. Redistributions in binary form must reproduce the above copyright
  12  *    notice, this list of conditions and the following disclaimer in the
  13  *    documentation and/or other materials provided with the distribution.
  14  *
  15  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  16  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  17  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  18  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  19  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  20  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  21  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  22  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  23  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  24  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  25  */
  26
  27 #include "includes.h"
  28
  29 #include <sys/types.h>
  30 #include <sys/socket.h>
  31 #include <sys/wait.h>
  32 #include <sys/stat.h>
  33
  34 #include <errno.h>
  35 #include <netdb.h>
  36 #include <pwd.h>
  37 #include <signal.h>
  38 #include <stdarg.h>
  39 #include <stdio.h>
  40 #include <string.h>
  41 #include <unistd.h>
  42 #if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H)
  43 #include <vis.h>
  44 #endif
  45
  46 #include "openbsd-compat/sys-queue.h"
  47
  48 #include "xmalloc.h"
  49 #include "ssh.h"
  50 #include "ssh2.h"
  51 #include "buffer.h"
  52 #include "packet.h"
  53 #include "compat.h"
  54 #include "cipher.h"
  55 #include "key.h"
  56 #include "kex.h"
  57 #include "myproposal.h"
  58 #include "sshconnect.h"
  59 #include "authfile.h"
  60 #include "dh.h"
  61 #include "authfd.h"
  62 #include "log.h"
  63 #include "readconf.h"
  64 #include "misc.h"
  65 #include "match.h"
  66 #include "dispatch.h"
  67 #include "canohost.h"
  68 #include "msg.h"
  69 #include "pathnames.h"
  70 #include "uidswap.h"
  71 #include "schnorr.h"
  72 #include "jpake.h"
  73
  74 #ifdef GSSAPI
  75 #include "ssh-gss.h"
  76 #endif
  77
  78 /* import */
  79 extern char *client_version_string;
  80 extern char *server_version_string;
  81 extern Options options;
  82
  83 /*
  84  * SSH2 key exchange
  85  */
  86
  87 u_char *session_id2 = NULL;
  88 u_int session_id2_len = 0;
  89
  90 char *xxx_host;
  91 struct sockaddr *xxx_hostaddr;
  92
  93 Kex *xxx_kex = NULL;
  94
  95 static int
  96 verify_host_key_callback(Key *hostkey)
  97 {
  98         if (verify_host_key(xxx_host, xxx_hostaddr, hostkey) == -1)
  99                 fatal("Host key verification failed.");
 100         return 0;
 101 }
 102
 103 void
 104 ssh_kex2(char *host, struct sockaddr *hostaddr)
 105 {
 106         Kex *kex;
 107
 108         xxx_host = host;
 109         xxx_hostaddr = hostaddr;
 110
 111         if (options.ciphers == (char *)-1) {
 112                 logit("No valid ciphers for protocol version 2 given, using defaults.");
 113                 options.ciphers = NULL;
 114         }
 115         if (options.ciphers != NULL) {
 116                 myproposal[PROPOSAL_ENC_ALGS_CTOS] =
 117                 myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
 118         }
 119         myproposal[PROPOSAL_ENC_ALGS_CTOS] =
 120             compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]);
 121         myproposal[PROPOSAL_ENC_ALGS_STOC] =
 122             compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_STOC]);
 123         if (options.compression) {
 124                 myproposal[PROPOSAL_COMP_ALGS_CTOS] =
 125                 myproposal[PROPOSAL_COMP_ALGS_STOC] = "zlib@openssh.com,zlib,none";
 126         } else {
 127                 myproposal[PROPOSAL_COMP_ALGS_CTOS] =
 128                 myproposal[PROPOSAL_COMP_ALGS_STOC] = "none,zlib@openssh.com,zlib";
 129         }
 130         if (options.macs != NULL) {
 131                 myproposal[PROPOSAL_MAC_ALGS_CTOS] =
 132                 myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
 133         }
 134         if (options.hostkeyalgorithms != NULL)
 135                 myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
 136                     options.hostkeyalgorithms;
 137
 138         if (options.rekey_limit)
 139                 packet_set_rekey_limit((u_int32_t)options.rekey_limit);
 140
 141         /* start key exchange */
 142         kex = kex_setup(myproposal);
 143         kex->kex[KEX_DH_GRP1_SHA1] = kexdh_client;
 144         kex->kex[KEX_DH_GRP14_SHA1] = kexdh_client;
 145         kex->kex[KEX_DH_GEX_SHA1] = kexgex_client;
 146         kex->kex[KEX_DH_GEX_SHA256] = kexgex_client;
 147         kex->client_version_string=client_version_string;
 148         kex->server_version_string=server_version_string;
 149         kex->verify_host_key=&verify_host_key_callback;
 150
 151         xxx_kex = kex;
 152
 153         dispatch_run(DISPATCH_BLOCK, &kex->done, kex);
 154
 155         session_id2 = kex->session_id;
 156         session_id2_len = kex->session_id_len;
 157
 158 #ifdef DEBUG_KEXDH
 159         /* send 1st encrypted/maced/compressed message */
 160         packet_start(SSH2_MSG_IGNORE);
 161         packet_put_cstring("markus");
 162         packet_send();
 163         packet_write_wait();
 164 #endif
 165 }
 166
 167 /*
 168  * Authenticate user
 169  */
 170
 171 typedef struct Authctxt Authctxt;
 172 typedef struct Authmethod Authmethod;
 173 typedef struct identity Identity;
 174 typedef struct idlist Idlist;
 175
 176 struct identity {
 177         TAILQ_ENTRY(identity) next;
 178         AuthenticationConnection *ac;   /* set if agent supports key */
 179         Key     *key;                   /* public/private key */
 180         char    *filename;              /* comment for agent-only keys */
 181         int     tried;
 182         int     isprivate;              /* key points to the private key */
 183 };
 184 TAILQ_HEAD(idlist, identity);
 185
 186 struct Authctxt {
 187         const char *server_user;
 188         const char *local_user;
 189         const char *host;
 190         const char *service;
 191         Authmethod *method;
 192         int success;
 193         char *authlist;
 194         /* pubkey */
 195         Idlist keys;
 196         AuthenticationConnection *agent;
 197         /* hostbased */
 198         Sensitive *sensitive;
 199         /* kbd-interactive */
 200         int info_req_seen;
 201         /* generic */
 202         void *methoddata;
 203 };
 204 struct Authmethod {
 205         char    *name;          /* string to compare against server's list */
 206         int     (*userauth)(Authctxt *authctxt);
 207         void    (*cleanup)(Authctxt *authctxt);
 208         int     *enabled;       /* flag in option struct that enables method */
 209         int     *batch_flag;    /* flag in option struct that disables method */
 210 };
 211
 212 void    input_userauth_success(int, u_int32_t, void *);
 213 void    input_userauth_failure(int, u_int32_t, void *);
 214 void    input_userauth_banner(int, u_int32_t, void *);
 215 void    input_userauth_error(int, u_int32_t, void *);
 216 void    input_userauth_info_req(int, u_int32_t, void *);
 217 void    input_userauth_pk_ok(int, u_int32_t, void *);
 218 void    input_userauth_passwd_changereq(int, u_int32_t, void *);
 219 void    input_userauth_jpake_server_step1(int, u_int32_t, void *);
 220 void    input_userauth_jpake_server_step2(int, u_int32_t, void *);
 221 void    input_userauth_jpake_server_confirm(int, u_int32_t, void *);
 222
 223 int     userauth_none(Authctxt *);
 224 int     userauth_pubkey(Authctxt *);
 225 int     userauth_passwd(Authctxt *);
 226 int     userauth_kbdint(Authctxt *);
 227 int     userauth_hostbased(Authctxt *);
 228 int     userauth_jpake(Authctxt *);
 229
 230 void    userauth_jpake_cleanup(Authctxt *);
 231
 232 #ifdef GSSAPI
 233 int     userauth_gssapi(Authctxt *authctxt);
 234 void    input_gssapi_response(int type, u_int32_t, void *);
 235 void    input_gssapi_token(int type, u_int32_t, void *);
 236 void    input_gssapi_hash(int type, u_int32_t, void *);
 237 void    input_gssapi_error(int, u_int32_t, void *);
 238 void    input_gssapi_errtok(int, u_int32_t, void *);
 239 #endif
 240
 241 void    userauth(Authctxt *, char *);
 242
 243 static int sign_and_send_pubkey(Authctxt *, Identity *);
 244 static void pubkey_prepare(Authctxt *);
 245 static void pubkey_cleanup(Authctxt *);
 246 static Key *load_identity_file(char *);
 247
 248 static Authmethod *authmethod_get(char *authlist);
 249 static Authmethod *authmethod_lookup(const char *name);
 250 static char *authmethods_get(void);
 251
 252 Authmethod authmethods[] = {
 253 #ifdef GSSAPI
 254         {"gssapi-with-mic",
 255                 userauth_gssapi,
 256                 NULL,
 257                 &options.gss_authentication,
 258                 NULL},
 259 #endif
 260         {"hostbased",
 261                 userauth_hostbased,
 262                 NULL,
 263                 &options.hostbased_authentication,
 264                 NULL},
 265         {"publickey",
 266                 userauth_pubkey,
 267                 NULL,
 268                 &options.pubkey_authentication,
 269                 NULL},
 270 #ifdef JPAKE
 271         {"jpake-01@openssh.com",
 272                 userauth_jpake,
 273                 userauth_jpake_cleanup,
 274                 &options.zero_knowledge_password_authentication,
 275                 &options.batch_mode},
 276 #endif
 277         {"keyboard-interactive",
 278                 userauth_kbdint,
 279                 NULL,
 280                 &options.kbd_interactive_authentication,
 281                 &options.batch_mode},
 282         {"password",
 283                 userauth_passwd,
 284                 NULL,
 285                 &options.password_authentication,
 286                 &options.batch_mode},
 287         {"none",
 288                 userauth_none,
 289                 NULL,
 290                 NULL,
 291                 NULL},
 292         {NULL, NULL, NULL, NULL, NULL}
 293 };
 294
 295 void
 296 ssh_userauth2(const char *local_user, const char *server_user, char *host,
 297     Sensitive *sensitive)
 298 {
 299         Authctxt authctxt;
 300         int type;
 301
 302         if (options.challenge_response_authentication)
 303                 options.kbd_interactive_authentication = 1;
 304
 305         packet_start(SSH2_MSG_SERVICE_REQUEST);
 306         packet_put_cstring("ssh-userauth");
 307         packet_send();
 308         debug("SSH2_MSG_SERVICE_REQUEST sent");
 309         packet_write_wait();
 310         type = packet_read();
 311         if (type != SSH2_MSG_SERVICE_ACCEPT)
 312                 fatal("Server denied authentication request: %d", type);
 313         if (packet_remaining() > 0) {
 314                 char *reply = packet_get_string(NULL);
 315                 debug2("service_accept: %s", reply);
 316                 xfree(reply);
 317         } else {
 318                 debug2("buggy server: service_accept w/o service");
 319         }
 320         packet_check_eom();
 321         debug("SSH2_MSG_SERVICE_ACCEPT received");
 322
 323         if (options.preferred_authentications == NULL)
 324                 options.preferred_authentications = authmethods_get();
 325
 326         /* setup authentication context */
 327         memset(&authctxt, 0, sizeof(authctxt));
 328         pubkey_prepare(&authctxt);
 329         authctxt.server_user = server_user;
 330         authctxt.local_user = local_user;
 331         authctxt.host = host;
 332         authctxt.service = "ssh-connection";            /* service name */
 333         authctxt.success = 0;
 334         authctxt.method = authmethod_lookup("none");
 335         authctxt.authlist = NULL;
 336         authctxt.methoddata = NULL;
 337         authctxt.sensitive = sensitive;
 338         authctxt.info_req_seen = 0;
 339         if (authctxt.method == NULL)
 340                 fatal("ssh_userauth2: internal error: cannot send userauth none request");
 341
 342         /* initial userauth request */
 343         userauth_none(&authctxt);
 344
 345         dispatch_init(&input_userauth_error);
 346         dispatch_set(SSH2_MSG_USERAUTH_SUCCESS, &input_userauth_success);
 347         dispatch_set(SSH2_MSG_USERAUTH_FAILURE, &input_userauth_failure);
 348         dispatch_set(SSH2_MSG_USERAUTH_BANNER, &input_userauth_banner);
 349         dispatch_run(DISPATCH_BLOCK, &authctxt.success, &authctxt);     /* loop until success */
 350
 351         pubkey_cleanup(&authctxt);
 352         dispatch_range(SSH2_MSG_USERAUTH_MIN, SSH2_MSG_USERAUTH_MAX, NULL);
 353
 354         debug("Authentication succeeded (%s).", authctxt.method->name);
 355 }
 356
 357 void
 358 userauth(Authctxt *authctxt, char *authlist)
 359 {
 360         if (authctxt->method != NULL && authctxt->method->cleanup != NULL)
 361                 authctxt->method->cleanup(authctxt);
 362
 363         if (authctxt->methoddata) {
 364                 xfree(authctxt->methoddata);
 365                 authctxt->methoddata = NULL;
 366         }
 367         if (authlist == NULL) {
 368                 authlist = authctxt->authlist;
 369         } else {
 370                 if (authctxt->authlist)
 371                         xfree(authctxt->authlist);
 372                 authctxt->authlist = authlist;
 373         }
 374         for (;;) {
 375                 Authmethod *method = authmethod_get(authlist);
 376                 if (method == NULL)
 377                         fatal("Permission denied (%s).", authlist);
 378                 authctxt->method = method;
 379
 380                 /* reset the per method handler */
 381                 dispatch_range(SSH2_MSG_USERAUTH_PER_METHOD_MIN,
 382                     SSH2_MSG_USERAUTH_PER_METHOD_MAX, NULL);
 383
 384                 /* and try new method */
 385                 if (method->userauth(authctxt) != 0) {
 386                         debug2("we sent a %s packet, wait for reply", method->name);
 387                         break;
 388                 } else {
 389                         debug2("we did not send a packet, disable method");
 390                         method->enabled = NULL;
 391                 }
 392         }
 393 }
 394
 395 /* ARGSUSED */
 396 void
 397 input_userauth_error(int type, u_int32_t seq, void *ctxt)
 398 {
 399         fatal("input_userauth_error: bad message during authentication: "
 400             "type %d", type);
 401 }
 402
 403 /* ARGSUSED */
 404 void
 405 input_userauth_banner(int type, u_int32_t seq, void *ctxt)
 406 {
 407         char *msg, *raw, *lang;
 408         u_int len;
 409
 410         debug3("input_userauth_banner");
 411         raw = packet_get_string(&len);
 412         lang = packet_get_string(NULL);
 413         if (len > 0 && options.log_level >= SYSLOG_LEVEL_INFO) {
 414                 if (len > 65536)
 415                         len = 65536;
 416                 msg = xmalloc(len * 4 + 1); /* max expansion from strnvis() */
 417                 strnvis(msg, raw, len * 4 + 1, VIS_SAFE|VIS_OCTAL);
 418                 fprintf(stderr, "%s", msg);
 419                 xfree(msg);
 420         }
 421         xfree(raw);
 422         xfree(lang);
 423 }
 424
 425 /* ARGSUSED */
 426 void
 427 input_userauth_success(int type, u_int32_t seq, void *ctxt)
 428 {
 429         Authctxt *authctxt = ctxt;
 430         if (authctxt == NULL)
 431                 fatal("input_userauth_success: no authentication context");
 432         if (authctxt->authlist) {
 433                 xfree(authctxt->authlist);
 434                 authctxt->authlist = NULL;
 435         }
 436         if (authctxt->methoddata) {
 437                 xfree(authctxt->methoddata);
 438                 authctxt->methoddata = NULL;
 439         }
 440         authctxt->success = 1;                  /* break out */
 441 }
 442
 443 /* ARGSUSED */
 444 void
 445 input_userauth_failure(int type, u_int32_t seq, void *ctxt)
 446 {
 447         Authctxt *authctxt = ctxt;
 448         char *authlist = NULL;
 449         int partial;
 450
 451         if (authctxt == NULL)
 452                 fatal("input_userauth_failure: no authentication context");
 453
 454         authlist = packet_get_string(NULL);
 455         partial = packet_get_char();
 456         packet_check_eom();
 457
 458         if (partial != 0)
 459                 logit("Authenticated with partial success.");
 460         debug("Authentications that can continue: %s", authlist);
 461
 462         userauth(authctxt, authlist);
 463 }
 464
 465 /* ARGSUSED */
 466 void
 467 input_userauth_pk_ok(int type, u_int32_t seq, void *ctxt)
 468 {
 469         Authctxt *authctxt = ctxt;
 470         Key *key = NULL;
 471         Identity *id = NULL;
 472         Buffer b;
 473         int pktype, sent = 0;
 474         u_int alen, blen;
 475         char *pkalg, *fp;
 476         u_char *pkblob;
 477
 478         if (authctxt == NULL)
 479                 fatal("input_userauth_pk_ok: no authentication context");
 480         if (datafellows & SSH_BUG_PKOK) {
 481                 /* this is similar to SSH_BUG_PKAUTH */
 482                 debug2("input_userauth_pk_ok: SSH_BUG_PKOK");
 483                 pkblob = packet_get_string(&blen);
 484                 buffer_init(&b);
 485                 buffer_append(&b, pkblob, blen);
 486                 pkalg = buffer_get_string(&b, &alen);
 487                 buffer_free(&b);
 488         } else {
 489                 pkalg = packet_get_string(&alen);
 490                 pkblob = packet_get_string(&blen);
 491         }
 492         packet_check_eom();
 493
 494         debug("Server accepts key: pkalg %s blen %u", pkalg, blen);
 495
 496         if ((pktype = key_type_from_name(pkalg)) == KEY_UNSPEC) {
 497                 debug("unknown pkalg %s", pkalg);
 498                 goto done;
 499         }
 500         if ((key = key_from_blob(pkblob, blen)) == NULL) {
 501                 debug("no key from blob. pkalg %s", pkalg);
 502                 goto done;
 503         }
 504         if (key->type != pktype) {
 505                 error("input_userauth_pk_ok: type mismatch "
 506                     "for decoded key (received %d, expected %d)",
 507                     key->type, pktype);
 508                 goto done;
 509         }
 510         fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
 511         debug2("input_userauth_pk_ok: fp %s", fp);
 512         xfree(fp);
 513
 514         /*
 515          * search keys in the reverse order, because last candidate has been
 516          * moved to the end of the queue.  this also avoids confusion by
 517          * duplicate keys
 518          */
 519         TAILQ_FOREACH_REVERSE(id, &authctxt->keys, idlist, next) {
 520                 if (key_equal(key, id->key)) {
 521                         sent = sign_and_send_pubkey(authctxt, id);
 522                         break;
 523                 }
 524         }
 525 done:
 526         if (key != NULL)
 527                 key_free(key);
 528         xfree(pkalg);
 529         xfree(pkblob);
 530
 531         /* try another method if we did not send a packet */
 532         if (sent == 0)
 533                 userauth(authctxt, NULL);
 534 }
 535
 536 #ifdef GSSAPI
 537 int
 538 userauth_gssapi(Authctxt *authctxt)
 539 {
 540         Gssctxt *gssctxt = NULL;
 541         static gss_OID_set gss_supported = NULL;
 542         static u_int mech = 0;
 543         OM_uint32 min;
 544         int ok = 0;
 545
 546         /* Try one GSSAPI method at a time, rather than sending them all at
 547          * once. */
 548
 549         if (gss_supported == NULL)
 550                 gss_indicate_mechs(&min, &gss_supported);
 551
 552         /* Check to see if the mechanism is usable before we offer it */
 553         while (mech < gss_supported->count && !ok) {
 554                 /* My DER encoding requires length<128 */
 555                 if (gss_supported->elements[mech].length < 128 &&
 556                     ssh_gssapi_check_mechanism(&gssctxt,
 557                     &gss_supported->elements[mech], authctxt->host)) {
 558                         ok = 1; /* Mechanism works */
 559                 } else {
 560                         mech++;
 561                 }
 562         }
 563
 564         if (!ok)
 565                 return 0;
 566
 567         authctxt->methoddata=(void *)gssctxt;
 568
 569         packet_start(SSH2_MSG_USERAUTH_REQUEST);
 570         packet_put_cstring(authctxt->server_user);
 571         packet_put_cstring(authctxt->service);
 572         packet_put_cstring(authctxt->method->name);
 573
 574         packet_put_int(1);
 575
 576         packet_put_int((gss_supported->elements[mech].length) + 2);
 577         packet_put_char(SSH_GSS_OIDTYPE);
 578         packet_put_char(gss_supported->elements[mech].length);
 579         packet_put_raw(gss_supported->elements[mech].elements,
 580             gss_supported->elements[mech].length);
 581
 582         packet_send();
 583
 584         dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_RESPONSE, &input_gssapi_response);
 585         dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, &input_gssapi_token);
 586         dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERROR, &input_gssapi_error);
 587         dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, &input_gssapi_errtok);
 588
 589         mech++; /* Move along to next candidate */
 590
 591         return 1;
 592 }
 593
 594 static OM_uint32
 595 process_gssapi_token(void *ctxt, gss_buffer_t recv_tok)
 596 {
 597         Authctxt *authctxt = ctxt;
 598         Gssctxt *gssctxt = authctxt->methoddata;
 599         gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
 600         gss_buffer_desc mic = GSS_C_EMPTY_BUFFER;
 601         gss_buffer_desc gssbuf;
 602         OM_uint32 status, ms, flags;
 603         Buffer b;
 604
 605         status = ssh_gssapi_init_ctx(gssctxt, options.gss_deleg_creds,
 606             recv_tok, &send_tok, &flags);
 607
 608         if (send_tok.length > 0) {
 609                 if (GSS_ERROR(status))
 610                         packet_start(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK);
 611                 else
 612                         packet_start(SSH2_MSG_USERAUTH_GSSAPI_TOKEN);
 613
 614                 packet_put_string(send_tok.value, send_tok.length);
 615                 packet_send();
 616                 gss_release_buffer(&ms, &send_tok);
 617         }
 618
 619         if (status == GSS_S_COMPLETE) {
 620                 /* send either complete or MIC, depending on mechanism */
 621                 if (!(flags & GSS_C_INTEG_FLAG)) {
 622                         packet_start(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE);
 623                         packet_send();
 624                 } else {
 625                         ssh_gssapi_buildmic(&b, authctxt->server_user,
 626                             authctxt->service, "gssapi-with-mic");
 627
 628                         gssbuf.value = buffer_ptr(&b);
 629                         gssbuf.length = buffer_len(&b);
 630
 631                         status = ssh_gssapi_sign(gssctxt, &gssbuf, &mic);
 632
 633                         if (!GSS_ERROR(status)) {
 634                                 packet_start(SSH2_MSG_USERAUTH_GSSAPI_MIC);
 635                                 packet_put_string(mic.value, mic.length);
 636
 637                                 packet_send();
 638                         }
 639
 640                         buffer_free(&b);
 641                         gss_release_buffer(&ms, &mic);
 642                 }
 643         }
 644
 645         return status;
 646 }
 647
 648 /* ARGSUSED */
 649 void
 650 input_gssapi_response(int type, u_int32_t plen, void *ctxt)
 651 {
 652         Authctxt *authctxt = ctxt;
 653         Gssctxt *gssctxt;
 654         int oidlen;
 655         char *oidv;
 656
 657         if (authctxt == NULL)
 658                 fatal("input_gssapi_response: no authentication context");
 659         gssctxt = authctxt->methoddata;
 660
 661         /* Setup our OID */
 662         oidv = packet_get_string(&oidlen);
 663
 664         if (oidlen <= 2 ||
 665             oidv[0] != SSH_GSS_OIDTYPE ||
 666             oidv[1] != oidlen - 2) {
 667                 xfree(oidv);
 668                 debug("Badly encoded mechanism OID received");
 669                 userauth(authctxt, NULL);
 670                 return;
 671         }
 672
 673         if (!ssh_gssapi_check_oid(gssctxt, oidv + 2, oidlen - 2))
 674                 fatal("Server returned different OID than expected");
 675
 676         packet_check_eom();
 677
 678         xfree(oidv);
 679
 680         if (GSS_ERROR(process_gssapi_token(ctxt, GSS_C_NO_BUFFER))) {
 681                 /* Start again with next method on list */
 682                 debug("Trying to start again");
 683                 userauth(authctxt, NULL);
 684                 return;
 685         }
 686 }
 687
 688 /* ARGSUSED */
 689 void
 690 input_gssapi_token(int type, u_int32_t plen, void *ctxt)
 691 {
 692         Authctxt *authctxt = ctxt;
 693         gss_buffer_desc recv_tok;
 694         OM_uint32 status;
 695         u_int slen;
 696
 697         if (authctxt == NULL)
 698                 fatal("input_gssapi_response: no authentication context");
 699
 700         recv_tok.value = packet_get_string(&slen);
 701         recv_tok.length = slen; /* safe typecast */
 702
 703         packet_check_eom();
 704
 705         status = process_gssapi_token(ctxt, &recv_tok);
 706
 707         xfree(recv_tok.value);
 708
 709         if (GSS_ERROR(status)) {
 710                 /* Start again with the next method in the list */
 711                 userauth(authctxt, NULL);
 712                 return;
 713         }
 714 }
 715
 716 /* ARGSUSED */
 717 void
 718 input_gssapi_errtok(int type, u_int32_t plen, void *ctxt)
 719 {
 720         Authctxt *authctxt = ctxt;
 721         Gssctxt *gssctxt;
 722         gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
 723         gss_buffer_desc recv_tok;
 724         OM_uint32 status, ms;
 725         u_int len;
 726
 727         if (authctxt == NULL)
 728                 fatal("input_gssapi_response: no authentication context");
 729         gssctxt = authctxt->methoddata;
 730
 731         recv_tok.value = packet_get_string(&len);
 732         recv_tok.length = len;
 733
 734         packet_check_eom();
 735
 736         /* Stick it into GSSAPI and see what it says */
 737         status = ssh_gssapi_init_ctx(gssctxt, options.gss_deleg_creds,
 738             &recv_tok, &send_tok, NULL);
 739
 740         xfree(recv_tok.value);
 741         gss_release_buffer(&ms, &send_tok);
 742
 743         /* Server will be returning a failed packet after this one */
 744 }
 745
 746 /* ARGSUSED */
 747 void
 748 input_gssapi_error(int type, u_int32_t plen, void *ctxt)
 749 {
 750         OM_uint32 maj, min;
 751         char *msg;
 752         char *lang;
 753
 754         maj=packet_get_int();
 755         min=packet_get_int();
 756         msg=packet_get_string(NULL);
 757         lang=packet_get_string(NULL);
 758
 759         packet_check_eom();
 760
 761         debug("Server GSSAPI Error:\n%s", msg);
 762         xfree(msg);
 763         xfree(lang);
 764 }
 765 #endif /* GSSAPI */
 766
 767 int
 768 userauth_none(Authctxt *authctxt)
 769 {
 770         /* initial userauth request */
 771         packet_start(SSH2_MSG_USERAUTH_REQUEST);
 772         packet_put_cstring(authctxt->server_user);
 773         packet_put_cstring(authctxt->service);
 774         packet_put_cstring(authctxt->method->name);
 775         packet_send();
 776         return 1;
 777 }
 778
 779 int
 780 userauth_passwd(Authctxt *authctxt)
 781 {
 782         static int attempt = 0;
 783         char prompt[150];
 784         char *password;
 785
 786         if (attempt++ >= options.number_of_password_prompts)
 787                 return 0;
 788
 789         if (attempt != 1)
 790                 error("Permission denied, please try again.");
 791
 792         snprintf(prompt, sizeof(prompt), "%.30s@%.128s's password: ",
 793             authctxt->server_user, authctxt->host);
 794         password = read_passphrase(prompt, 0);
 795         packet_start(SSH2_MSG_USERAUTH_REQUEST);
 796         packet_put_cstring(authctxt->server_user);
 797         packet_put_cstring(authctxt->service);
 798         packet_put_cstring(authctxt->method->name);
 799         packet_put_char(0);
 800         packet_put_cstring(password);
 801         memset(password, 0, strlen(password));
 802         xfree(password);
 803         packet_add_padding(64);
 804         packet_send();
 805
 806         dispatch_set(SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ,
 807             &input_userauth_passwd_changereq);
 808
 809         return 1;
 810 }
 811
 812 /*
 813  * parse PASSWD_CHANGEREQ, prompt user and send SSH2_MSG_USERAUTH_REQUEST
 814  */
 815 /* ARGSUSED */
 816 void
 817 input_userauth_passwd_changereq(int type, u_int32_t seqnr, void *ctxt)
 818 {
 819         Authctxt *authctxt = ctxt;
 820         char *info, *lang, *password = NULL, *retype = NULL;
 821         char prompt[150];
 822
 823         debug2("input_userauth_passwd_changereq");
 824
 825         if (authctxt == NULL)
 826                 fatal("input_userauth_passwd_changereq: "
 827                     "no authentication context");
 828
 829         info = packet_get_string(NULL);
 830         lang = packet_get_string(NULL);
 831         if (strlen(info) > 0)
 832                 logit("%s", info);
 833         xfree(info);
 834         xfree(lang);
 835         packet_start(SSH2_MSG_USERAUTH_REQUEST);
 836         packet_put_cstring(authctxt->server_user);
 837         packet_put_cstring(authctxt->service);
 838         packet_put_cstring(authctxt->method->name);
 839         packet_put_char(1);                     /* additional info */
 840         snprintf(prompt, sizeof(prompt),
 841             "Enter %.30s@%.128s's old password: ",
 842             authctxt->server_user, authctxt->host);
 843         password = read_passphrase(prompt, 0);
 844         packet_put_cstring(password);
 845         memset(password, 0, strlen(password));
 846         xfree(password);
 847         password = NULL;
 848         while (password == NULL) {
 849                 snprintf(prompt, sizeof(prompt),
 850                     "Enter %.30s@%.128s's new password: ",
 851                     authctxt->server_user, authctxt->host);
 852                 password = read_passphrase(prompt, RP_ALLOW_EOF);
 853                 if (password == NULL) {
 854                         /* bail out */
 855                         return;
 856                 }
 857                 snprintf(prompt, sizeof(prompt),
 858                     "Retype %.30s@%.128s's new password: ",
 859                     authctxt->server_user, authctxt->host);
 860                 retype = read_passphrase(prompt, 0);
 861                 if (strcmp(password, retype) != 0) {
 862                         memset(password, 0, strlen(password));
 863                         xfree(password);
 864                         logit("Mismatch; try again, EOF to quit.");
 865                         password = NULL;
 866                 }
 867                 memset(retype, 0, strlen(retype));
 868                 xfree(retype);
 869         }
 870         packet_put_cstring(password);
 871         memset(password, 0, strlen(password));
 872         xfree(password);
 873         packet_add_padding(64);
 874         packet_send();
 875
 876         dispatch_set(SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ,
 877             &input_userauth_passwd_changereq);
 878 }
 879
 880 #ifdef JPAKE
 881 static char *
 882 pw_encrypt(const char *password, const char *crypt_scheme, const char *salt)
 883 {
 884         /* OpenBSD crypt(3) handles all of these */
 885         if (strcmp(crypt_scheme, "crypt") == 0 ||
 886             strcmp(crypt_scheme, "bcrypt") == 0 ||
 887             strcmp(crypt_scheme, "md5crypt") == 0 ||
 888             strcmp(crypt_scheme, "crypt-extended") == 0)
 889                 return xstrdup(crypt(password, salt));
 890         error("%s: unsupported password encryption scheme \"%.100s\"",
 891             __func__, crypt_scheme);
 892         return NULL;
 893 }
 894
 895 static BIGNUM *
 896 jpake_password_to_secret(Authctxt *authctxt, const char *crypt_scheme,
 897     const char *salt)
 898 {
 899         char prompt[256], *password, *crypted;
 900         u_char *secret;
 901         u_int secret_len;
 902         BIGNUM *ret;
 903
 904         snprintf(prompt, sizeof(prompt), "%.30s@%.128s's password (JPAKE): ",
 905             authctxt->server_user, authctxt->host);
 906         password = read_passphrase(prompt, 0);
 907
 908         if ((crypted = pw_encrypt(password, crypt_scheme, salt)) == NULL) {
 909                 logit("Disabling %s authentication", authctxt->method->name);
 910                 authctxt->method->enabled = NULL;
 911                 /* Continue with an empty password to fail gracefully */
 912                 crypted = xstrdup("");
 913         }
 914
 915 #ifdef JPAKE_DEBUG
 916         debug3("%s: salt = %s", __func__, salt);
 917         debug3("%s: scheme = %s", __func__, crypt_scheme);
 918         debug3("%s: crypted = %s", __func__, crypted);
 919 #endif
 920
 921         if (hash_buffer(crypted, strlen(crypted), EVP_sha256(),
 922             &secret, &secret_len) != 0)
 923                 fatal("%s: hash_buffer", __func__);
 924
 925         bzero(password, strlen(password));
 926         bzero(crypted, strlen(crypted));
 927         xfree(password);
 928         xfree(crypted);
 929
 930         if ((ret = BN_bin2bn(secret, secret_len, NULL)) == NULL)
 931                 fatal("%s: BN_bin2bn (secret)", __func__);
 932         bzero(secret, secret_len);
 933         xfree(secret);
 934
 935         return ret;
 936 }
 937
 938 /* ARGSUSED */
 939 void
 940 input_userauth_jpake_server_step1(int type, u_int32_t seq, void *ctxt)
 941 {
 942         Authctxt *authctxt = ctxt;
 943         struct jpake_ctx *pctx = authctxt->methoddata;
 944         u_char *x3_proof, *x4_proof, *x2_s_proof;
 945         u_int x3_proof_len, x4_proof_len, x2_s_proof_len;
 946         char *crypt_scheme, *salt;
 947
 948         /* Disable this message */
 949         dispatch_set(SSH2_MSG_USERAUTH_JPAKE_SERVER_STEP1, NULL);
 950
 951         if ((pctx->g_x3 = BN_new()) == NULL ||
 952             (pctx->g_x4 = BN_new()) == NULL)
 953                 fatal("%s: BN_new", __func__);
 954
 955         /* Fetch step 1 values */
 956         crypt_scheme = packet_get_string(NULL);
 957         salt = packet_get_string(NULL);
 958         pctx->server_id = packet_get_string(&pctx->server_id_len);
 959         packet_get_bignum2(pctx->g_x3);
 960         packet_get_bignum2(pctx->g_x4);
 961         x3_proof = packet_get_string(&x3_proof_len);
 962         x4_proof = packet_get_string(&x4_proof_len);
 963         packet_check_eom();
 964
 965         JPAKE_DEBUG_CTX((pctx, "step 1 received in %s", __func__));
 966
 967         /* Obtain password and derive secret */
 968         pctx->s = jpake_password_to_secret(authctxt, crypt_scheme, salt);
 969         bzero(crypt_scheme, strlen(crypt_scheme));
 970         bzero(salt, strlen(salt));
 971         xfree(crypt_scheme);
 972         xfree(salt);
 973         JPAKE_DEBUG_BN((pctx->s, "%s: s = ", __func__));
 974
 975         /* Calculate step 2 values */
 976         jpake_step2(pctx->grp, pctx->s, pctx->g_x1,
 977             pctx->g_x3, pctx->g_x4, pctx->x2,
 978             pctx->server_id, pctx->server_id_len,
 979             pctx->client_id, pctx->client_id_len,
 980             x3_proof, x3_proof_len,
 981             x4_proof, x4_proof_len,
 982             &pctx->a,
 983             &x2_s_proof, &x2_s_proof_len);
 984
 985         bzero(x3_proof, x3_proof_len);
 986         bzero(x4_proof, x4_proof_len);
 987         xfree(x3_proof);
 988         xfree(x4_proof);
 989
 990         JPAKE_DEBUG_CTX((pctx, "step 2 sending in %s", __func__));
 991
 992         /* Send values for step 2 */
 993         packet_start(SSH2_MSG_USERAUTH_JPAKE_CLIENT_STEP2);
 994         packet_put_bignum2(pctx->a);
 995         packet_put_string(x2_s_proof, x2_s_proof_len);
 996         packet_send();
 997
 998         bzero(x2_s_proof, x2_s_proof_len);
 999         xfree(x2_s_proof);
1000
1001         /* Expect step 2 packet from peer */
1002         dispatch_set(SSH2_MSG_USERAUTH_JPAKE_SERVER_STEP2,
1003             input_userauth_jpake_server_step2);
1004 }
1005
1006 /* ARGSUSED */
1007 void
1008 input_userauth_jpake_server_step2(int type, u_int32_t seq, void *ctxt)
1009 {
1010         Authctxt *authctxt = ctxt;
1011         struct jpake_ctx *pctx = authctxt->methoddata;
1012         u_char *x4_s_proof;
1013         u_int x4_s_proof_len;
1014
1015         /* Disable this message */
1016         dispatch_set(SSH2_MSG_USERAUTH_JPAKE_SERVER_STEP2, NULL);
1017
1018         if ((pctx->b = BN_new()) == NULL)
1019                 fatal("%s: BN_new", __func__);
1020
1021         /* Fetch step 2 values */
1022         packet_get_bignum2(pctx->b);
1023         x4_s_proof = packet_get_string(&x4_s_proof_len);
1024         packet_check_eom();
1025
1026         JPAKE_DEBUG_CTX((pctx, "step 2 received in %s", __func__));
1027
1028         /* Derive shared key and calculate confirmation hash */
1029         jpake_key_confirm(pctx->grp, pctx->s, pctx->b,
1030             pctx->x2, pctx->g_x1, pctx->g_x2, pctx->g_x3, pctx->g_x4,
1031             pctx->client_id, pctx->client_id_len,
1032             pctx->server_id, pctx->server_id_len,
1033             session_id2, session_id2_len,
1034             x4_s_proof, x4_s_proof_len,
1035             &pctx->k,
1036             &pctx->h_k_cid_sessid, &pctx->h_k_cid_sessid_len);
1037
1038         bzero(x4_s_proof, x4_s_proof_len);
1039         xfree(x4_s_proof);
1040
1041         JPAKE_DEBUG_CTX((pctx, "confirm sending in %s", __func__));
1042
1043         /* Send key confirmation proof */
1044         packet_start(SSH2_MSG_USERAUTH_JPAKE_CLIENT_CONFIRM);
1045         packet_put_string(pctx->h_k_cid_sessid, pctx->h_k_cid_sessid_len);
1046         packet_send();
1047
1048         /* Expect confirmation from peer */
1049         dispatch_set(SSH2_MSG_USERAUTH_JPAKE_SERVER_CONFIRM,
1050             input_userauth_jpake_server_confirm);
1051 }
1052
1053 /* ARGSUSED */
1054 void
1055 input_userauth_jpake_server_confirm(int type, u_int32_t seq, void *ctxt)
1056 {
1057         Authctxt *authctxt = ctxt;
1058         struct jpake_ctx *pctx = authctxt->methoddata;
1059
1060         /* Disable this message */
1061         dispatch_set(SSH2_MSG_USERAUTH_JPAKE_SERVER_CONFIRM, NULL);
1062
1063         pctx->h_k_sid_sessid = packet_get_string(&pctx->h_k_sid_sessid_len);
1064         packet_check_eom();
1065
1066         JPAKE_DEBUG_CTX((pctx, "confirm received in %s", __func__));
1067
1068         /* Verify expected confirmation hash */
1069         if (jpake_check_confirm(pctx->k,
1070             pctx->server_id, pctx->server_id_len,
1071             session_id2, session_id2_len,
1072             pctx->h_k_sid_sessid, pctx->h_k_sid_sessid_len) == 1)
1073                 debug("%s: %s success", __func__, authctxt->method->name);
1074         else {
1075                 debug("%s: confirmation mismatch", __func__);
1076                 /* XXX stash this so if auth succeeds then we can warn/kill */
1077         }
1078
1079         userauth_jpake_cleanup(authctxt);
1080 }
1081 #endif /* JPAKE */
1082
1083 static int
1084 identity_sign(Identity *id, u_char **sigp, u_int *lenp,
1085     u_char *data, u_int datalen)
1086 {
1087         Key *prv;
1088         int ret;
1089
1090         /* the agent supports this key */
1091         if (id->ac)
1092                 return (ssh_agent_sign(id->ac, id->key, sigp, lenp,
1093                     data, datalen));
1094         /*
1095          * we have already loaded the private key or
1096          * the private key is stored in external hardware
1097          */
1098         if (id->isprivate || (id->key->flags & KEY_FLAG_EXT))
1099                 return (key_sign(id->key, sigp, lenp, data, datalen));
1100         /* load the private key from the file */
1101         if ((prv = load_identity_file(id->filename)) == NULL)
1102                 return (-1);
1103         ret = key_sign(prv, sigp, lenp, data, datalen);
1104         key_free(prv);
1105         return (ret);
1106 }
1107
1108 static int
1109 sign_and_send_pubkey(Authctxt *authctxt, Identity *id)
1110 {
1111         Buffer b;
1112         u_char *blob, *signature;
1113         u_int bloblen, slen;
1114         u_int skip = 0;
1115         int ret = -1;
1116         int have_sig = 1;
1117
1118         debug3("sign_and_send_pubkey");
1119
1120         if (key_to_blob(id->key, &blob, &bloblen) == 0) {
1121                 /* we cannot handle this key */
1122                 debug3("sign_and_send_pubkey: cannot handle key");
1123                 return 0;
1124         }
1125         /* data to be signed */
1126         buffer_init(&b);
1127         if (datafellows & SSH_OLD_SESSIONID) {
1128                 buffer_append(&b, session_id2, session_id2_len);
1129                 skip = session_id2_len;
1130         } else {
1131                 buffer_put_string(&b, session_id2, session_id2_len);
1132                 skip = buffer_len(&b);
1133         }
1134         buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
1135         buffer_put_cstring(&b, authctxt->server_user);
1136         buffer_put_cstring(&b,
1137             datafellows & SSH_BUG_PKSERVICE ?
1138             "ssh-userauth" :
1139             authctxt->service);
1140         if (datafellows & SSH_BUG_PKAUTH) {
1141                 buffer_put_char(&b, have_sig);
1142         } else {
1143                 buffer_put_cstring(&b, authctxt->method->name);
1144                 buffer_put_char(&b, have_sig);
1145                 buffer_put_cstring(&b, key_ssh_name(id->key));
1146         }
1147         buffer_put_string(&b, blob, bloblen);
1148
1149         /* generate signature */
1150         ret = identity_sign(id, &signature, &slen,
1151             buffer_ptr(&b), buffer_len(&b));
1152         if (ret == -1) {
1153                 xfree(blob);
1154                 buffer_free(&b);
1155                 return 0;
1156         }
1157 #ifdef DEBUG_PK
1158         buffer_dump(&b);
1159 #endif
1160         if (datafellows & SSH_BUG_PKSERVICE) {
1161                 buffer_clear(&b);
1162                 buffer_append(&b, session_id2, session_id2_len);
1163                 skip = session_id2_len;
1164                 buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
1165                 buffer_put_cstring(&b, authctxt->server_user);
1166                 buffer_put_cstring(&b, authctxt->service);
1167                 buffer_put_cstring(&b, authctxt->method->name);
1168                 buffer_put_char(&b, have_sig);
1169                 if (!(datafellows & SSH_BUG_PKAUTH))
1170                         buffer_put_cstring(&b, key_ssh_name(id->key));
1171                 buffer_put_string(&b, blob, bloblen);
1172         }
1173         xfree(blob);
1174
1175         /* append signature */
1176         buffer_put_string(&b, signature, slen);
1177         xfree(signature);
1178
1179         /* skip session id and packet type */
1180         if (buffer_len(&b) < skip + 1)
1181                 fatal("userauth_pubkey: internal error");
1182         buffer_consume(&b, skip + 1);
1183
1184         /* put remaining data from buffer into packet */
1185         packet_start(SSH2_MSG_USERAUTH_REQUEST);
1186         packet_put_raw(buffer_ptr(&b), buffer_len(&b));
1187         buffer_free(&b);
1188         packet_send();
1189
1190         return 1;
1191 }
1192
1193 static int
1194 send_pubkey_test(Authctxt *authctxt, Identity *id)
1195 {
1196         u_char *blob;
1197         u_int bloblen, have_sig = 0;
1198
1199         debug3("send_pubkey_test");
1200
1201         if (key_to_blob(id->key, &blob, &bloblen) == 0) {
1202                 /* we cannot handle this key */
1203                 debug3("send_pubkey_test: cannot handle key");
1204                 return 0;
1205         }
1206         /* register callback for USERAUTH_PK_OK message */
1207         dispatch_set(SSH2_MSG_USERAUTH_PK_OK, &input_userauth_pk_ok);
1208
1209         packet_start(SSH2_MSG_USERAUTH_REQUEST);
1210         packet_put_cstring(authctxt->server_user);
1211         packet_put_cstring(authctxt->service);
1212         packet_put_cstring(authctxt->method->name);
1213         packet_put_char(have_sig);
1214         if (!(datafellows & SSH_BUG_PKAUTH))
1215                 packet_put_cstring(key_ssh_name(id->key));
1216         packet_put_string(blob, bloblen);
1217         xfree(blob);
1218         packet_send();
1219         return 1;
1220 }
1221
1222 static Key *
1223 load_identity_file(char *filename)
1224 {
1225         Key *private;
1226         char prompt[300], *passphrase;
1227         int perm_ok, quit, i;
1228         struct stat st;
1229
1230         if (stat(filename, &st) < 0) {
1231                 debug3("no such identity: %s", filename);
1232                 return NULL;
1233         }
1234         private = key_load_private_type(KEY_UNSPEC, filename, "", NULL, &perm_ok);
1235         if (!perm_ok)
1236                 return NULL;
1237         if (private == NULL) {
1238                 if (options.batch_mode)
1239                         return NULL;
1240                 snprintf(prompt, sizeof prompt,
1241                     "Enter passphrase for key '%.100s': ", filename);
1242                 for (i = 0; i < options.number_of_password_prompts; i++) {
1243                         passphrase = read_passphrase(prompt, 0);
1244                         if (strcmp(passphrase, "") != 0) {
1245                                 private = key_load_private_type(KEY_UNSPEC,
1246                                     filename, passphrase, NULL, NULL);
1247                                 quit = 0;
1248                         } else {
1249                                 debug2("no passphrase given, try next key");
1250                                 quit = 1;
1251                         }
1252                         memset(passphrase, 0, strlen(passphrase));
1253                         xfree(passphrase);
1254                         if (private != NULL || quit)
1255                                 break;
1256                         debug2("bad passphrase given, try again...");
1257                 }
1258         }
1259         return private;
1260 }
1261
1262 /*
1263  * try keys in the following order:
1264  *      1. agent keys that are found in the config file
1265  *      2. other agent keys
1266  *      3. keys that are only listed in the config file
1267  */
1268 static void
1269 pubkey_prepare(Authctxt *authctxt)
1270 {
1271         Identity *id;
1272         Idlist agent, files, *preferred;
1273         Key *key;
1274         AuthenticationConnection *ac;
1275         char *comment;
1276         int i, found;
1277
1278         TAILQ_INIT(&agent);     /* keys from the agent */
1279         TAILQ_INIT(&files);     /* keys from the config file */
1280         preferred = &authctxt->keys;
1281         TAILQ_INIT(preferred);  /* preferred order of keys */
1282
1283         /* list of keys stored in the filesystem */
1284         for (i = 0; i < options.num_identity_files; i++) {
1285                 key = options.identity_keys[i];
1286                 if (key && key->type == KEY_RSA1)
1287                         continue;
1288                 options.identity_keys[i] = NULL;
1289                 id = xcalloc(1, sizeof(*id));
1290                 id->key = key;
1291                 id->filename = xstrdup(options.identity_files[i]);
1292                 TAILQ_INSERT_TAIL(&files, id, next);
1293         }
1294         /* list of keys supported by the agent */
1295         if ((ac = ssh_get_authentication_connection())) {
1296                 for (key = ssh_get_first_identity(ac, &comment, 2);
1297                     key != NULL;
1298                     key = ssh_get_next_identity(ac, &comment, 2)) {
1299                         found = 0;
1300                         TAILQ_FOREACH(id, &files, next) {
1301                                 /* agent keys from the config file are preferred */
1302                                 if (key_equal(key, id->key)) {
1303                                         key_free(key);
1304                                         xfree(comment);
1305                                         TAILQ_REMOVE(&files, id, next);
1306                                         TAILQ_INSERT_TAIL(preferred, id, next);
1307                                         id->ac = ac;
1308                                         found = 1;
1309                                         break;
1310                                 }
1311                         }
1312                         if (!found && !options.identities_only) {
1313                                 id = xcalloc(1, sizeof(*id));
1314                                 id->key = key;
1315                                 id->filename = comment;
1316                                 id->ac = ac;
1317                                 TAILQ_INSERT_TAIL(&agent, id, next);
1318                         }
1319                 }
1320                 /* append remaining agent keys */
1321                 for (id = TAILQ_FIRST(&agent); id; id = TAILQ_FIRST(&agent)) {
1322                         TAILQ_REMOVE(&agent, id, next);
1323                         TAILQ_INSERT_TAIL(preferred, id, next);
1324                 }
1325                 authctxt->agent = ac;
1326         }
1327         /* append remaining keys from the config file */
1328         for (id = TAILQ_FIRST(&files); id; id = TAILQ_FIRST(&files)) {
1329                 TAILQ_REMOVE(&files, id, next);
1330                 TAILQ_INSERT_TAIL(preferred, id, next);
1331         }
1332         TAILQ_FOREACH(id, preferred, next) {
1333                 debug2("key: %s (%p)", id->filename, id->key);
1334         }
1335 }
1336
1337 static void
1338 pubkey_cleanup(Authctxt *authctxt)
1339 {
1340         Identity *id;
1341
1342         if (authctxt->agent != NULL)
1343                 ssh_close_authentication_connection(authctxt->agent);
1344         for (id = TAILQ_FIRST(&authctxt->keys); id;
1345             id = TAILQ_FIRST(&authctxt->keys)) {
1346                 TAILQ_REMOVE(&authctxt->keys, id, next);
1347                 if (id->key)
1348                         key_free(id->key);
1349                 if (id->filename)
1350                         xfree(id->filename);
1351                 xfree(id);
1352         }
1353 }
1354
1355 int
1356 userauth_pubkey(Authctxt *authctxt)
1357 {
1358         Identity *id;
1359         int sent = 0;
1360
1361         while ((id = TAILQ_FIRST(&authctxt->keys))) {
1362                 if (id->tried++)
1363                         return (0);
1364                 /* move key to the end of the queue */
1365                 TAILQ_REMOVE(&authctxt->keys, id, next);
1366                 TAILQ_INSERT_TAIL(&authctxt->keys, id, next);
1367                 /*
1368                  * send a test message if we have the public key. for
1369                  * encrypted keys we cannot do this and have to load the
1370                  * private key instead
1371                  */
1372                 if (id->key && id->key->type != KEY_RSA1) {
1373                         debug("Offering public key: %s", id->filename);
1374                         sent = send_pubkey_test(authctxt, id);
1375                 } else if (id->key == NULL) {
1376                         debug("Trying private key: %s", id->filename);
1377                         id->key = load_identity_file(id->filename);
1378                         if (id->key != NULL) {
1379                                 id->isprivate = 1;
1380                                 sent = sign_and_send_pubkey(authctxt, id);
1381                                 key_free(id->key);
1382                                 id->key = NULL;
1383                         }
1384                 }
1385                 if (sent)
1386                         return (sent);
1387         }
1388         return (0);
1389 }
1390
1391 /*
1392  * Send userauth request message specifying keyboard-interactive method.
1393  */
1394 int
1395 userauth_kbdint(Authctxt *authctxt)
1396 {
1397         static int attempt = 0;
1398
1399         if (attempt++ >= options.number_of_password_prompts)
1400                 return 0;
1401         /* disable if no SSH2_MSG_USERAUTH_INFO_REQUEST has been seen */
1402         if (attempt > 1 && !authctxt->info_req_seen) {
1403                 debug3("userauth_kbdint: disable: no info_req_seen");
1404                 dispatch_set(SSH2_MSG_USERAUTH_INFO_REQUEST, NULL);
1405                 return 0;
1406         }
1407
1408         debug2("userauth_kbdint");
1409         packet_start(SSH2_MSG_USERAUTH_REQUEST);
1410         packet_put_cstring(authctxt->server_user);
1411         packet_put_cstring(authctxt->service);
1412         packet_put_cstring(authctxt->method->name);
1413         packet_put_cstring("");                                 /* lang */
1414         packet_put_cstring(options.kbd_interactive_devices ?
1415             options.kbd_interactive_devices : "");
1416         packet_send();
1417
1418         dispatch_set(SSH2_MSG_USERAUTH_INFO_REQUEST, &input_userauth_info_req);
1419         return 1;
1420 }
1421
1422 /*
1423  * parse INFO_REQUEST, prompt user and send INFO_RESPONSE
1424  */
1425 void
1426 input_userauth_info_req(int type, u_int32_t seq, void *ctxt)
1427 {
1428         Authctxt *authctxt = ctxt;
1429         char *name, *inst, *lang, *prompt, *response;
1430         u_int num_prompts, i;
1431         int echo = 0;
1432
1433         debug2("input_userauth_info_req");
1434
1435         if (authctxt == NULL)
1436                 fatal("input_userauth_info_req: no authentication context");
1437
1438         authctxt->info_req_seen = 1;
1439
1440         name = packet_get_string(NULL);
1441         inst = packet_get_string(NULL);
1442         lang = packet_get_string(NULL);
1443         if (strlen(name) > 0)
1444                 logit("%s", name);
1445         if (strlen(inst) > 0)
1446                 logit("%s", inst);
1447         xfree(name);
1448         xfree(inst);
1449         xfree(lang);
1450
1451         num_prompts = packet_get_int();
1452         /*
1453          * Begin to build info response packet based on prompts requested.
1454          * We commit to providing the correct number of responses, so if
1455          * further on we run into a problem that prevents this, we have to
1456          * be sure and clean this up and send a correct error response.
1457          */
1458         packet_start(SSH2_MSG_USERAUTH_INFO_RESPONSE);
1459         packet_put_int(num_prompts);
1460
1461         debug2("input_userauth_info_req: num_prompts %d", num_prompts);
1462         for (i = 0; i < num_prompts; i++) {
1463                 prompt = packet_get_string(NULL);
1464                 echo = packet_get_char();
1465
1466                 response = read_passphrase(prompt, echo ? RP_ECHO : 0);
1467
1468                 packet_put_cstring(response);
1469                 memset(response, 0, strlen(response));
1470                 xfree(response);
1471                 xfree(prompt);
1472         }
1473         packet_check_eom(); /* done with parsing incoming message. */
1474
1475         packet_add_padding(64);
1476         packet_send();
1477 }
1478
1479 static int
1480 ssh_keysign(Key *key, u_char **sigp, u_int *lenp,
1481     u_char *data, u_int datalen)
1482 {
1483         Buffer b;
1484         struct stat st;
1485         pid_t pid;
1486         int to[2], from[2], status, version = 2;
1487
1488         debug2("ssh_keysign called");
1489
1490         if (stat(_PATH_SSH_KEY_SIGN, &st) < 0) {
1491                 error("ssh_keysign: no installed: %s", strerror(errno));
1492                 return -1;
1493         }
1494         if (fflush(stdout) != 0)
1495                 error("ssh_keysign: fflush: %s", strerror(errno));
1496         if (pipe(to) < 0) {
1497                 error("ssh_keysign: pipe: %s", strerror(errno));
1498                 return -1;
1499         }
1500         if (pipe(from) < 0) {
1501                 error("ssh_keysign: pipe: %s", strerror(errno));
1502                 return -1;
1503         }
1504         if ((pid = fork()) < 0) {
1505                 error("ssh_keysign: fork: %s", strerror(errno));
1506                 return -1;
1507         }
1508         if (pid == 0) {
1509                 permanently_drop_suid(getuid());
1510                 close(from[0]);
1511                 if (dup2(from[1], STDOUT_FILENO) < 0)
1512                         fatal("ssh_keysign: dup2: %s", strerror(errno));
1513                 close(to[1]);
1514                 if (dup2(to[0], STDIN_FILENO) < 0)
1515                         fatal("ssh_keysign: dup2: %s", strerror(errno));
1516                 close(from[1]);
1517                 close(to[0]);
1518                 execl(_PATH_SSH_KEY_SIGN, _PATH_SSH_KEY_SIGN, (char *) 0);
1519                 fatal("ssh_keysign: exec(%s): %s", _PATH_SSH_KEY_SIGN,
1520                     strerror(errno));
1521         }
1522         close(from[1]);
1523         close(to[0]);
1524
1525         buffer_init(&b);
1526         buffer_put_int(&b, packet_get_connection_in()); /* send # of socket */
1527         buffer_put_string(&b, data, datalen);
1528         if (ssh_msg_send(to[1], version, &b) == -1)
1529                 fatal("ssh_keysign: couldn't send request");
1530
1531         if (ssh_msg_recv(from[0], &b) < 0) {
1532                 error("ssh_keysign: no reply");
1533                 buffer_free(&b);
1534                 return -1;
1535         }
1536         close(from[0]);
1537         close(to[1]);
1538
1539         while (waitpid(pid, &status, 0) < 0)
1540                 if (errno != EINTR)
1541                         break;
1542
1543         if (buffer_get_char(&b) != version) {
1544                 error("ssh_keysign: bad version");
1545                 buffer_free(&b);
1546                 return -1;
1547         }
1548         *sigp = buffer_get_string(&b, lenp);
1549         buffer_free(&b);
1550
1551         return 0;
1552 }
1553
1554 int
1555 userauth_hostbased(Authctxt *authctxt)
1556 {
1557         Key *private = NULL;
1558         Sensitive *sensitive = authctxt->sensitive;
1559         Buffer b;
1560         u_char *signature, *blob;
1561         char *chost, *pkalg, *p, myname[NI_MAXHOST];
1562         const char *service;
1563         u_int blen, slen;
1564         int ok, i, len, found = 0;
1565
1566         /* check for a useful key */
1567         for (i = 0; i < sensitive->nkeys; i++) {
1568                 private = sensitive->keys[i];
1569                 if (private && private->type != KEY_RSA1) {
1570                         found = 1;
1571                         /* we take and free the key */
1572                         sensitive->keys[i] = NULL;
1573                         break;
1574                 }
1575         }
1576         if (!found) {
1577                 debug("No more client hostkeys for hostbased authentication.");
1578                 return 0;
1579         }
1580         if (key_to_blob(private, &blob, &blen) == 0) {
1581                 key_free(private);
1582                 return 0;
1583         }
1584         /* figure out a name for the client host */
1585         p = NULL;
1586         if (packet_connection_is_on_socket())
1587                 p = get_local_name(packet_get_connection_in());
1588         if (p == NULL) {
1589                 if (gethostname(myname, sizeof(myname)) == -1) {
1590                         verbose("userauth_hostbased: gethostname: %s",
1591                             strerror(errno));
1592                 } else
1593                         p = xstrdup(myname);
1594         }
1595         if (p == NULL) {
1596                 error("userauth_hostbased: cannot get local ipaddr/name");
1597                 key_free(private);
1598                 xfree(blob);
1599                 return 0;
1600         }
1601         len = strlen(p) + 2;
1602         xasprintf(&chost, "%s.", p);
1603         debug2("userauth_hostbased: chost %s", chost);
1604         xfree(p);
1605
1606         service = datafellows & SSH_BUG_HBSERVICE ? "ssh-userauth" :
1607             authctxt->service;
1608         pkalg = xstrdup(key_ssh_name(private));
1609         buffer_init(&b);
1610         /* construct data */
1611         buffer_put_string(&b, session_id2, session_id2_len);
1612         buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
1613         buffer_put_cstring(&b, authctxt->server_user);
1614         buffer_put_cstring(&b, service);
1615         buffer_put_cstring(&b, authctxt->method->name);
1616         buffer_put_cstring(&b, pkalg);
1617         buffer_put_string(&b, blob, blen);
1618         buffer_put_cstring(&b, chost);
1619         buffer_put_cstring(&b, authctxt->local_user);
1620 #ifdef DEBUG_PK
1621         buffer_dump(&b);
1622 #endif
1623         if (sensitive->external_keysign)
1624                 ok = ssh_keysign(private, &signature, &slen,
1625                     buffer_ptr(&b), buffer_len(&b));
1626         else
1627                 ok = key_sign(private, &signature, &slen,
1628                     buffer_ptr(&b), buffer_len(&b));
1629         key_free(private);
1630         buffer_free(&b);
1631         if (ok != 0) {
1632                 error("key_sign failed");
1633                 xfree(chost);
1634                 xfree(pkalg);
1635                 xfree(blob);
1636                 return 0;
1637         }
1638         packet_start(SSH2_MSG_USERAUTH_REQUEST);
1639         packet_put_cstring(authctxt->server_user);
1640         packet_put_cstring(authctxt->service);
1641         packet_put_cstring(authctxt->method->name);
1642         packet_put_cstring(pkalg);
1643         packet_put_string(blob, blen);
1644         packet_put_cstring(chost);
1645         packet_put_cstring(authctxt->local_user);
1646         packet_put_string(signature, slen);
1647         memset(signature, 's', slen);
1648         xfree(signature);
1649         xfree(chost);
1650         xfree(pkalg);
1651         xfree(blob);
1652
1653         packet_send();
1654         return 1;
1655 }
1656
1657 #ifdef JPAKE
1658 int
1659 userauth_jpake(Authctxt *authctxt)
1660 {
1661         struct jpake_ctx *pctx;
1662         u_char *x1_proof, *x2_proof;
1663         u_int x1_proof_len, x2_proof_len;
1664         static int attempt = 0; /* XXX share with userauth_password's? */
1665
1666         if (attempt++ >= options.number_of_password_prompts)
1667                 return 0;
1668         if (attempt != 1)
1669                 error("Permission denied, please try again.");
1670
1671         if (authctxt->methoddata != NULL)
1672                 fatal("%s: authctxt->methoddata already set (%p)",
1673                     __func__, authctxt->methoddata);
1674
1675         authctxt->methoddata = pctx = jpake_new();
1676
1677         /*
1678          * Send request immediately, to get the protocol going while
1679          * we do the initial computations.
1680          */
1681         packet_start(SSH2_MSG_USERAUTH_REQUEST);
1682         packet_put_cstring(authctxt->server_user);
1683         packet_put_cstring(authctxt->service);
1684         packet_put_cstring(authctxt->method->name);
1685         packet_send();
1686         packet_write_wait();
1687
1688         jpake_step1(pctx->grp,
1689             &pctx->client_id, &pctx->client_id_len,
1690             &pctx->x1, &pctx->x2, &pctx->g_x1, &pctx->g_x2,
1691             &x1_proof, &x1_proof_len,
1692             &x2_proof, &x2_proof_len);
1693
1694         JPAKE_DEBUG_CTX((pctx, "step 1 sending in %s", __func__));
1695
1696         packet_start(SSH2_MSG_USERAUTH_JPAKE_CLIENT_STEP1);
1697         packet_put_string(pctx->client_id, pctx->client_id_len);
1698         packet_put_bignum2(pctx->g_x1);
1699         packet_put_bignum2(pctx->g_x2);
1700         packet_put_string(x1_proof, x1_proof_len);
1701         packet_put_string(x2_proof, x2_proof_len);
1702         packet_send();
1703
1704         bzero(x1_proof, x1_proof_len);
1705         bzero(x2_proof, x2_proof_len);
1706         xfree(x1_proof);
1707         xfree(x2_proof);
1708
1709         /* Expect step 1 packet from peer */
1710         dispatch_set(SSH2_MSG_USERAUTH_JPAKE_SERVER_STEP1,
1711             input_userauth_jpake_server_step1);
1712
1713         return 1;
1714 }
1715
1716 void
1717 userauth_jpake_cleanup(Authctxt *authctxt)
1718 {
1719         debug3("%s: clean up", __func__);
1720         if (authctxt->methoddata != NULL) {
1721                 jpake_free(authctxt->methoddata);
1722                 authctxt->methoddata = NULL;
1723         }
1724 }
1725 #endif /* JPAKE */
1726
1727 /* find auth method */
1728
1729 /*
1730  * given auth method name, if configurable options permit this method fill
1731  * in auth_ident field and return true, otherwise return false.
1732  */
1733 static int
1734 authmethod_is_enabled(Authmethod *method)
1735 {
1736         if (method == NULL)
1737                 return 0;
1738         /* return false if options indicate this method is disabled */
1739         if  (method->enabled == NULL || *method->enabled == 0)
1740                 return 0;
1741         /* return false if batch mode is enabled but method needs interactive mode */
1742         if  (method->batch_flag != NULL && *method->batch_flag != 0)
1743                 return 0;
1744         return 1;
1745 }
1746
1747 static Authmethod *
1748 authmethod_lookup(const char *name)
1749 {
1750         Authmethod *method = NULL;
1751         if (name != NULL)
1752                 for (method = authmethods; method->name != NULL; method++)
1753                         if (strcmp(name, method->name) == 0)
1754                                 return method;
1755         debug2("Unrecognized authentication method name: %s", name ? name : "NULL");
1756         return NULL;
1757 }
1758
1759 /* XXX internal state */
1760 static Authmethod *current = NULL;
1761 static char *supported = NULL;
1762 static char *preferred = NULL;
1763
1764 /*
1765  * Given the authentication method list sent by the server, return the
1766  * next method we should try.  If the server initially sends a nil list,
1767  * use a built-in default list.
1768  */
1769 static Authmethod *
1770 authmethod_get(char *authlist)
1771 {
1772         char *name = NULL;
1773         u_int next;
1774
1775         /* Use a suitable default if we're passed a nil list.  */
1776         if (authlist == NULL || strlen(authlist) == 0)
1777                 authlist = options.preferred_authentications;
1778
1779         if (supported == NULL || strcmp(authlist, supported) != 0) {
1780                 debug3("start over, passed a different list %s", authlist);
1781                 if (supported != NULL)
1782                         xfree(supported);
1783                 supported = xstrdup(authlist);
1784                 preferred = options.preferred_authentications;
1785                 debug3("preferred %s", preferred);
1786                 current = NULL;
1787         } else if (current != NULL && authmethod_is_enabled(current))
1788                 return current;
1789
1790         for (;;) {
1791                 if ((name = match_list(preferred, supported, &next)) == NULL) {
1792                         debug("No more authentication methods to try.");
1793                         current = NULL;
1794                         return NULL;
1795                 }
1796                 preferred += next;
1797                 debug3("authmethod_lookup %s", name);
1798                 debug3("remaining preferred: %s", preferred);
1799                 if ((current = authmethod_lookup(name)) != NULL &&
1800                     authmethod_is_enabled(current)) {
1801                         debug3("authmethod_is_enabled %s", name);
1802                         debug("Next authentication method: %s", name);
1803                         return current;
1804                 }
1805         }
1806 }
1807
1808 static char *
1809 authmethods_get(void)
1810 {
1811         Authmethod *method = NULL;
1812         Buffer b;
1813         char *list;
1814
1815         buffer_init(&b);
1816         for (method = authmethods; method->name != NULL; method++) {
1817                 if (authmethod_is_enabled(method)) {
1818                         if (buffer_len(&b) > 0)
1819                                 buffer_append(&b, ",", 1);
1820                         buffer_append(&b, method->name, strlen(method->name));
1821                 }
1822         }
1823         buffer_append(&b, "\0", 1);
1824         list = xstrdup(buffer_ptr(&b));
1825         buffer_free(&b);
1826         return list;
1827 }
1828