Add OpenBSD's compat glob.c for OpenSSH.
[dragonfly.git] / crypto / openssh / sshconnect2.c
CommitLineData
9f304aaf 1/* $OpenBSD: sshconnect2.c,v 1.186 2010/11/29 23:45:51 djm Exp $ */
16c343f1
PA
2/*
3 * Copyright (c) 2000 Markus Friedl. All rights reserved.
cb5eb4f1 4 * Copyright (c) 2008 Damien Miller. All rights reserved.
16c343f1
PA
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25 */
26
27#include "includes.h"
28
29#include <sys/types.h>
30#include <sys/socket.h>
31#include <sys/wait.h>
32#include <sys/stat.h>
33
34#include <errno.h>
856ea928 35#include <fcntl.h>
16c343f1
PA
36#include <netdb.h>
37#include <pwd.h>
38#include <signal.h>
39#include <stdarg.h>
40#include <stdio.h>
41#include <string.h>
42#include <unistd.h>
3b69e377
PA
43#if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H)
44#include <vis.h>
45#endif
16c343f1
PA
46
47#include "openbsd-compat/sys-queue.h"
48
49#include "xmalloc.h"
50#include "ssh.h"
51#include "ssh2.h"
52#include "buffer.h"
53#include "packet.h"
54#include "compat.h"
55#include "cipher.h"
56#include "key.h"
57#include "kex.h"
58#include "myproposal.h"
59#include "sshconnect.h"
60#include "authfile.h"
61#include "dh.h"
62#include "authfd.h"
63#include "log.h"
64#include "readconf.h"
65#include "misc.h"
66#include "match.h"
67#include "dispatch.h"
68#include "canohost.h"
69#include "msg.h"
70#include "pathnames.h"
71#include "uidswap.h"
9f304aaf 72#include "hostfile.h"
40c002af 73#include "schnorr.h"
cb5eb4f1 74#include "jpake.h"
16c343f1
PA
75
76#ifdef GSSAPI
77#include "ssh-gss.h"
78#endif
79
80/* import */
81extern char *client_version_string;
82extern char *server_version_string;
83extern Options options;
84
85/*
86 * SSH2 key exchange
87 */
88
89u_char *session_id2 = NULL;
90u_int session_id2_len = 0;
91
92char *xxx_host;
93struct sockaddr *xxx_hostaddr;
94
95Kex *xxx_kex = NULL;
96
97static int
98verify_host_key_callback(Key *hostkey)
99{
100 if (verify_host_key(xxx_host, xxx_hostaddr, hostkey) == -1)
101 fatal("Host key verification failed.");
102 return 0;
103}
104
9f304aaf
PA
105static char *
106order_hostkeyalgs(char *host, struct sockaddr *hostaddr, u_short port)
107{
108 char *oavail, *avail, *first, *last, *alg, *hostname, *ret;
109 size_t maxlen;
110 struct hostkeys *hostkeys;
111 int ktype;
112
113 /* Find all hostkeys for this hostname */
114 get_hostfile_hostname_ipaddr(host, hostaddr, port, &hostname, NULL);
115 hostkeys = init_hostkeys();
116 load_hostkeys(hostkeys, hostname, options.user_hostfile2);
117 load_hostkeys(hostkeys, hostname, options.system_hostfile2);
118 load_hostkeys(hostkeys, hostname, options.user_hostfile);
119 load_hostkeys(hostkeys, hostname, options.system_hostfile);
120
121 oavail = avail = xstrdup(KEX_DEFAULT_PK_ALG);
122 maxlen = strlen(avail) + 1;
123 first = xmalloc(maxlen);
124 last = xmalloc(maxlen);
125 *first = *last = '\0';
126
127#define ALG_APPEND(to, from) \
128 do { \
129 if (*to != '\0') \
130 strlcat(to, ",", maxlen); \
131 strlcat(to, from, maxlen); \
132 } while (0)
133
134 while ((alg = strsep(&avail, ",")) && *alg != '\0') {
135 if ((ktype = key_type_from_name(alg)) == KEY_UNSPEC)
136 fatal("%s: unknown alg %s", __func__, alg);
137 if (lookup_key_in_hostkeys_by_type(hostkeys,
138 key_type_plain(ktype), NULL))
139 ALG_APPEND(first, alg);
140 else
141 ALG_APPEND(last, alg);
142 }
143#undef ALG_APPEND
144 xasprintf(&ret, "%s%s%s", first, *first == '\0' ? "" : ",", last);
145 if (*first != '\0')
146 debug3("%s: prefer hostkeyalgs: %s", __func__, first);
147
148 xfree(first);
149 xfree(last);
150 xfree(hostname);
151 xfree(oavail);
152 free_hostkeys(hostkeys);
153
154 return ret;
155}
156
16c343f1 157void
9f304aaf 158ssh_kex2(char *host, struct sockaddr *hostaddr, u_short port)
16c343f1
PA
159{
160 Kex *kex;
161
162 xxx_host = host;
163 xxx_hostaddr = hostaddr;
164
165 if (options.ciphers == (char *)-1) {
166 logit("No valid ciphers for protocol version 2 given, using defaults.");
167 options.ciphers = NULL;
168 }
169 if (options.ciphers != NULL) {
170 myproposal[PROPOSAL_ENC_ALGS_CTOS] =
171 myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
172 }
173 myproposal[PROPOSAL_ENC_ALGS_CTOS] =
174 compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]);
175 myproposal[PROPOSAL_ENC_ALGS_STOC] =
176 compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_STOC]);
177 if (options.compression) {
178 myproposal[PROPOSAL_COMP_ALGS_CTOS] =
179 myproposal[PROPOSAL_COMP_ALGS_STOC] = "zlib@openssh.com,zlib,none";
180 } else {
181 myproposal[PROPOSAL_COMP_ALGS_CTOS] =
182 myproposal[PROPOSAL_COMP_ALGS_STOC] = "none,zlib@openssh.com,zlib";
183 }
184 if (options.macs != NULL) {
185 myproposal[PROPOSAL_MAC_ALGS_CTOS] =
186 myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
187 }
188 if (options.hostkeyalgorithms != NULL)
189 myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
190 options.hostkeyalgorithms;
9f304aaf
PA
191 else {
192 /* Prefer algorithms that we already have keys for */
193 myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
194 order_hostkeyalgs(host, hostaddr, port);
195 }
196 if (options.kex_algorithms != NULL)
197 myproposal[PROPOSAL_KEX_ALGS] = options.kex_algorithms;
16c343f1
PA
198
199 if (options.rekey_limit)
200 packet_set_rekey_limit((u_int32_t)options.rekey_limit);
201
202 /* start key exchange */
203 kex = kex_setup(myproposal);
204 kex->kex[KEX_DH_GRP1_SHA1] = kexdh_client;
205 kex->kex[KEX_DH_GRP14_SHA1] = kexdh_client;
206 kex->kex[KEX_DH_GEX_SHA1] = kexgex_client;
207 kex->kex[KEX_DH_GEX_SHA256] = kexgex_client;
9f304aaf 208 kex->kex[KEX_ECDH_SHA2] = kexecdh_client;
16c343f1
PA
209 kex->client_version_string=client_version_string;
210 kex->server_version_string=server_version_string;
211 kex->verify_host_key=&verify_host_key_callback;
212
213 xxx_kex = kex;
214
215 dispatch_run(DISPATCH_BLOCK, &kex->done, kex);
216
856ea928
PA
217 if (options.use_roaming && !kex->roaming) {
218 debug("Roaming not allowed by server");
219 options.use_roaming = 0;
220 }
221
16c343f1
PA
222 session_id2 = kex->session_id;
223 session_id2_len = kex->session_id_len;
224
225#ifdef DEBUG_KEXDH
226 /* send 1st encrypted/maced/compressed message */
227 packet_start(SSH2_MSG_IGNORE);
228 packet_put_cstring("markus");
229 packet_send();
230 packet_write_wait();
231#endif
232}
233
234/*
235 * Authenticate user
236 */
237
238typedef struct Authctxt Authctxt;
239typedef struct Authmethod Authmethod;
240typedef struct identity Identity;
241typedef struct idlist Idlist;
242
243struct identity {
244 TAILQ_ENTRY(identity) next;
245 AuthenticationConnection *ac; /* set if agent supports key */
246 Key *key; /* public/private key */
247 char *filename; /* comment for agent-only keys */
248 int tried;
249 int isprivate; /* key points to the private key */
250};
251TAILQ_HEAD(idlist, identity);
252
253struct Authctxt {
254 const char *server_user;
255 const char *local_user;
256 const char *host;
257 const char *service;
258 Authmethod *method;
856ea928 259 sig_atomic_t success;
16c343f1
PA
260 char *authlist;
261 /* pubkey */
262 Idlist keys;
263 AuthenticationConnection *agent;
264 /* hostbased */
265 Sensitive *sensitive;
266 /* kbd-interactive */
267 int info_req_seen;
268 /* generic */
269 void *methoddata;
270};
271struct Authmethod {
272 char *name; /* string to compare against server's list */
273 int (*userauth)(Authctxt *authctxt);
cb5eb4f1 274 void (*cleanup)(Authctxt *authctxt);
16c343f1
PA
275 int *enabled; /* flag in option struct that enables method */
276 int *batch_flag; /* flag in option struct that disables method */
277};
278
279void input_userauth_success(int, u_int32_t, void *);
856ea928 280void input_userauth_success_unexpected(int, u_int32_t, void *);
16c343f1
PA
281void input_userauth_failure(int, u_int32_t, void *);
282void input_userauth_banner(int, u_int32_t, void *);
283void input_userauth_error(int, u_int32_t, void *);
284void input_userauth_info_req(int, u_int32_t, void *);
285void input_userauth_pk_ok(int, u_int32_t, void *);
286void input_userauth_passwd_changereq(int, u_int32_t, void *);
cb5eb4f1
PA
287void input_userauth_jpake_server_step1(int, u_int32_t, void *);
288void input_userauth_jpake_server_step2(int, u_int32_t, void *);
289void input_userauth_jpake_server_confirm(int, u_int32_t, void *);
16c343f1
PA
290
291int userauth_none(Authctxt *);
292int userauth_pubkey(Authctxt *);
293int userauth_passwd(Authctxt *);
294int userauth_kbdint(Authctxt *);
295int userauth_hostbased(Authctxt *);
cb5eb4f1
PA
296int userauth_jpake(Authctxt *);
297
298void userauth_jpake_cleanup(Authctxt *);
16c343f1
PA
299
300#ifdef GSSAPI
301int userauth_gssapi(Authctxt *authctxt);
302void input_gssapi_response(int type, u_int32_t, void *);
303void input_gssapi_token(int type, u_int32_t, void *);
304void input_gssapi_hash(int type, u_int32_t, void *);
305void input_gssapi_error(int, u_int32_t, void *);
306void input_gssapi_errtok(int, u_int32_t, void *);
307#endif
308
309void userauth(Authctxt *, char *);
310
311static int sign_and_send_pubkey(Authctxt *, Identity *);
312static void pubkey_prepare(Authctxt *);
313static void pubkey_cleanup(Authctxt *);
314static Key *load_identity_file(char *);
315
316static Authmethod *authmethod_get(char *authlist);
317static Authmethod *authmethod_lookup(const char *name);
318static char *authmethods_get(void);
319
320Authmethod authmethods[] = {
321#ifdef GSSAPI
322 {"gssapi-with-mic",
323 userauth_gssapi,
cb5eb4f1 324 NULL,
16c343f1
PA
325 &options.gss_authentication,
326 NULL},
327#endif
328 {"hostbased",
329 userauth_hostbased,
cb5eb4f1 330 NULL,
16c343f1
PA
331 &options.hostbased_authentication,
332 NULL},
333 {"publickey",
334 userauth_pubkey,
cb5eb4f1 335 NULL,
16c343f1
PA
336 &options.pubkey_authentication,
337 NULL},
cb5eb4f1
PA
338#ifdef JPAKE
339 {"jpake-01@openssh.com",
340 userauth_jpake,
341 userauth_jpake_cleanup,
342 &options.zero_knowledge_password_authentication,
343 &options.batch_mode},
344#endif
16c343f1
PA
345 {"keyboard-interactive",
346 userauth_kbdint,
cb5eb4f1 347 NULL,
16c343f1
PA
348 &options.kbd_interactive_authentication,
349 &options.batch_mode},
350 {"password",
351 userauth_passwd,
cb5eb4f1 352 NULL,
16c343f1
PA
353 &options.password_authentication,
354 &options.batch_mode},
355 {"none",
356 userauth_none,
357 NULL,
cb5eb4f1 358 NULL,
16c343f1 359 NULL},
cb5eb4f1 360 {NULL, NULL, NULL, NULL, NULL}
16c343f1
PA
361};
362
363void
364ssh_userauth2(const char *local_user, const char *server_user, char *host,
365 Sensitive *sensitive)
366{
367 Authctxt authctxt;
368 int type;
369
370 if (options.challenge_response_authentication)
371 options.kbd_interactive_authentication = 1;
372
373 packet_start(SSH2_MSG_SERVICE_REQUEST);
374 packet_put_cstring("ssh-userauth");
375 packet_send();
376 debug("SSH2_MSG_SERVICE_REQUEST sent");
377 packet_write_wait();
378 type = packet_read();
379 if (type != SSH2_MSG_SERVICE_ACCEPT)
380 fatal("Server denied authentication request: %d", type);
381 if (packet_remaining() > 0) {
382 char *reply = packet_get_string(NULL);
383 debug2("service_accept: %s", reply);
384 xfree(reply);
385 } else {
386 debug2("buggy server: service_accept w/o service");
387 }
388 packet_check_eom();
389 debug("SSH2_MSG_SERVICE_ACCEPT received");
390
391 if (options.preferred_authentications == NULL)
392 options.preferred_authentications = authmethods_get();
393
394 /* setup authentication context */
395 memset(&authctxt, 0, sizeof(authctxt));
396 pubkey_prepare(&authctxt);
397 authctxt.server_user = server_user;
398 authctxt.local_user = local_user;
399 authctxt.host = host;
400 authctxt.service = "ssh-connection"; /* service name */
401 authctxt.success = 0;
402 authctxt.method = authmethod_lookup("none");
403 authctxt.authlist = NULL;
404 authctxt.methoddata = NULL;
405 authctxt.sensitive = sensitive;
406 authctxt.info_req_seen = 0;
407 if (authctxt.method == NULL)
408 fatal("ssh_userauth2: internal error: cannot send userauth none request");
409
410 /* initial userauth request */
411 userauth_none(&authctxt);
412
413 dispatch_init(&input_userauth_error);
414 dispatch_set(SSH2_MSG_USERAUTH_SUCCESS, &input_userauth_success);
415 dispatch_set(SSH2_MSG_USERAUTH_FAILURE, &input_userauth_failure);
416 dispatch_set(SSH2_MSG_USERAUTH_BANNER, &input_userauth_banner);
417 dispatch_run(DISPATCH_BLOCK, &authctxt.success, &authctxt); /* loop until success */
418
419 pubkey_cleanup(&authctxt);
420 dispatch_range(SSH2_MSG_USERAUTH_MIN, SSH2_MSG_USERAUTH_MAX, NULL);
421
422 debug("Authentication succeeded (%s).", authctxt.method->name);
423}
424
425void
426userauth(Authctxt *authctxt, char *authlist)
427{
cb5eb4f1
PA
428 if (authctxt->method != NULL && authctxt->method->cleanup != NULL)
429 authctxt->method->cleanup(authctxt);
430
16c343f1
PA
431 if (authctxt->methoddata) {
432 xfree(authctxt->methoddata);
433 authctxt->methoddata = NULL;
434 }
435 if (authlist == NULL) {
436 authlist = authctxt->authlist;
437 } else {
438 if (authctxt->authlist)
439 xfree(authctxt->authlist);
440 authctxt->authlist = authlist;
441 }
442 for (;;) {
443 Authmethod *method = authmethod_get(authlist);
444 if (method == NULL)
445 fatal("Permission denied (%s).", authlist);
446 authctxt->method = method;
447
448 /* reset the per method handler */
449 dispatch_range(SSH2_MSG_USERAUTH_PER_METHOD_MIN,
450 SSH2_MSG_USERAUTH_PER_METHOD_MAX, NULL);
451
452 /* and try new method */
453 if (method->userauth(authctxt) != 0) {
454 debug2("we sent a %s packet, wait for reply", method->name);
455 break;
456 } else {
457 debug2("we did not send a packet, disable method");
458 method->enabled = NULL;
459 }
460 }
461}
462
cb5eb4f1 463/* ARGSUSED */
16c343f1
PA
464void
465input_userauth_error(int type, u_int32_t seq, void *ctxt)
466{
467 fatal("input_userauth_error: bad message during authentication: "
468 "type %d", type);
469}
470
cb5eb4f1 471/* ARGSUSED */
16c343f1
PA
472void
473input_userauth_banner(int type, u_int32_t seq, void *ctxt)
474{
3b69e377
PA
475 char *msg, *raw, *lang;
476 u_int len;
16c343f1
PA
477
478 debug3("input_userauth_banner");
3b69e377 479 raw = packet_get_string(&len);
16c343f1 480 lang = packet_get_string(NULL);
cb5eb4f1 481 if (len > 0 && options.log_level >= SYSLOG_LEVEL_INFO) {
3b69e377
PA
482 if (len > 65536)
483 len = 65536;
cb5eb4f1 484 msg = xmalloc(len * 4 + 1); /* max expansion from strnvis() */
856ea928 485 strnvis(msg, raw, len * 4 + 1, VIS_SAFE|VIS_OCTAL|VIS_NOSLASH);
16c343f1 486 fprintf(stderr, "%s", msg);
3b69e377
PA
487 xfree(msg);
488 }
489 xfree(raw);
16c343f1
PA
490 xfree(lang);
491}
492
cb5eb4f1 493/* ARGSUSED */
16c343f1
PA
494void
495input_userauth_success(int type, u_int32_t seq, void *ctxt)
496{
497 Authctxt *authctxt = ctxt;
856ea928 498
16c343f1
PA
499 if (authctxt == NULL)
500 fatal("input_userauth_success: no authentication context");
501 if (authctxt->authlist) {
502 xfree(authctxt->authlist);
503 authctxt->authlist = NULL;
504 }
856ea928
PA
505 if (authctxt->method != NULL && authctxt->method->cleanup != NULL)
506 authctxt->method->cleanup(authctxt);
16c343f1
PA
507 if (authctxt->methoddata) {
508 xfree(authctxt->methoddata);
509 authctxt->methoddata = NULL;
510 }
511 authctxt->success = 1; /* break out */
512}
513
856ea928
PA
514void
515input_userauth_success_unexpected(int type, u_int32_t seq, void *ctxt)
516{
517 Authctxt *authctxt = ctxt;
518
519 if (authctxt == NULL)
520 fatal("%s: no authentication context", __func__);
521
522 fatal("Unexpected authentication success during %s.",
523 authctxt->method->name);
524}
525
cb5eb4f1 526/* ARGSUSED */
16c343f1
PA
527void
528input_userauth_failure(int type, u_int32_t seq, void *ctxt)
529{
530 Authctxt *authctxt = ctxt;
531 char *authlist = NULL;
532 int partial;
533
534 if (authctxt == NULL)
535 fatal("input_userauth_failure: no authentication context");
536
537 authlist = packet_get_string(NULL);
538 partial = packet_get_char();
539 packet_check_eom();
540
541 if (partial != 0)
542 logit("Authenticated with partial success.");
543 debug("Authentications that can continue: %s", authlist);
544
545 userauth(authctxt, authlist);
546}
cb5eb4f1
PA
547
548/* ARGSUSED */
16c343f1
PA
549void
550input_userauth_pk_ok(int type, u_int32_t seq, void *ctxt)
551{
552 Authctxt *authctxt = ctxt;
553 Key *key = NULL;
554 Identity *id = NULL;
555 Buffer b;
556 int pktype, sent = 0;
557 u_int alen, blen;
558 char *pkalg, *fp;
559 u_char *pkblob;
560
561 if (authctxt == NULL)
562 fatal("input_userauth_pk_ok: no authentication context");
563 if (datafellows & SSH_BUG_PKOK) {
564 /* this is similar to SSH_BUG_PKAUTH */
565 debug2("input_userauth_pk_ok: SSH_BUG_PKOK");
566 pkblob = packet_get_string(&blen);
567 buffer_init(&b);
568 buffer_append(&b, pkblob, blen);
569 pkalg = buffer_get_string(&b, &alen);
570 buffer_free(&b);
571 } else {
572 pkalg = packet_get_string(&alen);
573 pkblob = packet_get_string(&blen);
574 }
575 packet_check_eom();
576
577 debug("Server accepts key: pkalg %s blen %u", pkalg, blen);
578
579 if ((pktype = key_type_from_name(pkalg)) == KEY_UNSPEC) {
580 debug("unknown pkalg %s", pkalg);
581 goto done;
582 }
583 if ((key = key_from_blob(pkblob, blen)) == NULL) {
584 debug("no key from blob. pkalg %s", pkalg);
585 goto done;
586 }
587 if (key->type != pktype) {
588 error("input_userauth_pk_ok: type mismatch "
589 "for decoded key (received %d, expected %d)",
590 key->type, pktype);
591 goto done;
592 }
593 fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
594 debug2("input_userauth_pk_ok: fp %s", fp);
595 xfree(fp);
596
597 /*
598 * search keys in the reverse order, because last candidate has been
599 * moved to the end of the queue. this also avoids confusion by
600 * duplicate keys
601 */
602 TAILQ_FOREACH_REVERSE(id, &authctxt->keys, idlist, next) {
603 if (key_equal(key, id->key)) {
604 sent = sign_and_send_pubkey(authctxt, id);
605 break;
606 }
607 }
608done:
609 if (key != NULL)
610 key_free(key);
611 xfree(pkalg);
612 xfree(pkblob);
613
614 /* try another method if we did not send a packet */
615 if (sent == 0)
616 userauth(authctxt, NULL);
617}
618
619#ifdef GSSAPI
620int
621userauth_gssapi(Authctxt *authctxt)
622{
623 Gssctxt *gssctxt = NULL;
624 static gss_OID_set gss_supported = NULL;
625 static u_int mech = 0;
626 OM_uint32 min;
627 int ok = 0;
628
629 /* Try one GSSAPI method at a time, rather than sending them all at
630 * once. */
631
632 if (gss_supported == NULL)
633 gss_indicate_mechs(&min, &gss_supported);
634
635 /* Check to see if the mechanism is usable before we offer it */
636 while (mech < gss_supported->count && !ok) {
637 /* My DER encoding requires length<128 */
638 if (gss_supported->elements[mech].length < 128 &&
639 ssh_gssapi_check_mechanism(&gssctxt,
640 &gss_supported->elements[mech], authctxt->host)) {
641 ok = 1; /* Mechanism works */
642 } else {
643 mech++;
644 }
645 }
646
647 if (!ok)
648 return 0;
649
650 authctxt->methoddata=(void *)gssctxt;
651
652 packet_start(SSH2_MSG_USERAUTH_REQUEST);
653 packet_put_cstring(authctxt->server_user);
654 packet_put_cstring(authctxt->service);
655 packet_put_cstring(authctxt->method->name);
656
657 packet_put_int(1);
658
659 packet_put_int((gss_supported->elements[mech].length) + 2);
660 packet_put_char(SSH_GSS_OIDTYPE);
661 packet_put_char(gss_supported->elements[mech].length);
662 packet_put_raw(gss_supported->elements[mech].elements,
663 gss_supported->elements[mech].length);
664
665 packet_send();
666
667 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_RESPONSE, &input_gssapi_response);
668 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, &input_gssapi_token);
669 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERROR, &input_gssapi_error);
670 dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK, &input_gssapi_errtok);
671
672 mech++; /* Move along to next candidate */
673
674 return 1;
675}
676
677static OM_uint32
678process_gssapi_token(void *ctxt, gss_buffer_t recv_tok)
679{
680 Authctxt *authctxt = ctxt;
681 Gssctxt *gssctxt = authctxt->methoddata;
682 gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
683 gss_buffer_desc mic = GSS_C_EMPTY_BUFFER;
684 gss_buffer_desc gssbuf;
685 OM_uint32 status, ms, flags;
686 Buffer b;
687
688 status = ssh_gssapi_init_ctx(gssctxt, options.gss_deleg_creds,
689 recv_tok, &send_tok, &flags);
690
691 if (send_tok.length > 0) {
692 if (GSS_ERROR(status))
693 packet_start(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK);
694 else
695 packet_start(SSH2_MSG_USERAUTH_GSSAPI_TOKEN);
696
697 packet_put_string(send_tok.value, send_tok.length);
698 packet_send();
699 gss_release_buffer(&ms, &send_tok);
700 }
701
702 if (status == GSS_S_COMPLETE) {
703 /* send either complete or MIC, depending on mechanism */
704 if (!(flags & GSS_C_INTEG_FLAG)) {
705 packet_start(SSH2_MSG_USERAUTH_GSSAPI_EXCHANGE_COMPLETE);
706 packet_send();
707 } else {
708 ssh_gssapi_buildmic(&b, authctxt->server_user,
709 authctxt->service, "gssapi-with-mic");
710
711 gssbuf.value = buffer_ptr(&b);
712 gssbuf.length = buffer_len(&b);
713
714 status = ssh_gssapi_sign(gssctxt, &gssbuf, &mic);
715
716 if (!GSS_ERROR(status)) {
717 packet_start(SSH2_MSG_USERAUTH_GSSAPI_MIC);
718 packet_put_string(mic.value, mic.length);
719
720 packet_send();
721 }
722
723 buffer_free(&b);
724 gss_release_buffer(&ms, &mic);
725 }
726 }
727
728 return status;
729}
730
cb5eb4f1 731/* ARGSUSED */
16c343f1
PA
732void
733input_gssapi_response(int type, u_int32_t plen, void *ctxt)
734{
735 Authctxt *authctxt = ctxt;
736 Gssctxt *gssctxt;
737 int oidlen;
738 char *oidv;
739
740 if (authctxt == NULL)
741 fatal("input_gssapi_response: no authentication context");
742 gssctxt = authctxt->methoddata;
743
744 /* Setup our OID */
745 oidv = packet_get_string(&oidlen);
746
747 if (oidlen <= 2 ||
748 oidv[0] != SSH_GSS_OIDTYPE ||
749 oidv[1] != oidlen - 2) {
750 xfree(oidv);
751 debug("Badly encoded mechanism OID received");
752 userauth(authctxt, NULL);
753 return;
754 }
755
756 if (!ssh_gssapi_check_oid(gssctxt, oidv + 2, oidlen - 2))
757 fatal("Server returned different OID than expected");
758
759 packet_check_eom();
760
761 xfree(oidv);
762
763 if (GSS_ERROR(process_gssapi_token(ctxt, GSS_C_NO_BUFFER))) {
764 /* Start again with next method on list */
765 debug("Trying to start again");
766 userauth(authctxt, NULL);
767 return;
768 }
769}
770
cb5eb4f1 771/* ARGSUSED */
16c343f1
PA
772void
773input_gssapi_token(int type, u_int32_t plen, void *ctxt)
774{
775 Authctxt *authctxt = ctxt;
776 gss_buffer_desc recv_tok;
777 OM_uint32 status;
778 u_int slen;
779
780 if (authctxt == NULL)
781 fatal("input_gssapi_response: no authentication context");
782
783 recv_tok.value = packet_get_string(&slen);
784 recv_tok.length = slen; /* safe typecast */
785
786 packet_check_eom();
787
788 status = process_gssapi_token(ctxt, &recv_tok);
789
790 xfree(recv_tok.value);
791
792 if (GSS_ERROR(status)) {
793 /* Start again with the next method in the list */
794 userauth(authctxt, NULL);
795 return;
796 }
797}
798
cb5eb4f1 799/* ARGSUSED */
16c343f1
PA
800void
801input_gssapi_errtok(int type, u_int32_t plen, void *ctxt)
802{
803 Authctxt *authctxt = ctxt;
804 Gssctxt *gssctxt;
805 gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
806 gss_buffer_desc recv_tok;
807 OM_uint32 status, ms;
808 u_int len;
809
810 if (authctxt == NULL)
811 fatal("input_gssapi_response: no authentication context");
812 gssctxt = authctxt->methoddata;
813
814 recv_tok.value = packet_get_string(&len);
815 recv_tok.length = len;
816
817 packet_check_eom();
818
819 /* Stick it into GSSAPI and see what it says */
820 status = ssh_gssapi_init_ctx(gssctxt, options.gss_deleg_creds,
821 &recv_tok, &send_tok, NULL);
822
823 xfree(recv_tok.value);
824 gss_release_buffer(&ms, &send_tok);
825
826 /* Server will be returning a failed packet after this one */
827}
828
cb5eb4f1 829/* ARGSUSED */
16c343f1
PA
830void
831input_gssapi_error(int type, u_int32_t plen, void *ctxt)
832{
833 OM_uint32 maj, min;
834 char *msg;
835 char *lang;
836
837 maj=packet_get_int();
838 min=packet_get_int();
839 msg=packet_get_string(NULL);
840 lang=packet_get_string(NULL);
841
842 packet_check_eom();
843
844 debug("Server GSSAPI Error:\n%s", msg);
845 xfree(msg);
846 xfree(lang);
847}
848#endif /* GSSAPI */
849
850int
851userauth_none(Authctxt *authctxt)
852{
853 /* initial userauth request */
854 packet_start(SSH2_MSG_USERAUTH_REQUEST);
855 packet_put_cstring(authctxt->server_user);
856 packet_put_cstring(authctxt->service);
857 packet_put_cstring(authctxt->method->name);
858 packet_send();
859 return 1;
860}
861
862int
863userauth_passwd(Authctxt *authctxt)
864{
865 static int attempt = 0;
866 char prompt[150];
867 char *password;
856ea928
PA
868 const char *host = options.host_key_alias ? options.host_key_alias :
869 authctxt->host;
16c343f1
PA
870
871 if (attempt++ >= options.number_of_password_prompts)
872 return 0;
873
874 if (attempt != 1)
875 error("Permission denied, please try again.");
876
877 snprintf(prompt, sizeof(prompt), "%.30s@%.128s's password: ",
856ea928 878 authctxt->server_user, host);
16c343f1
PA
879 password = read_passphrase(prompt, 0);
880 packet_start(SSH2_MSG_USERAUTH_REQUEST);
881 packet_put_cstring(authctxt->server_user);
882 packet_put_cstring(authctxt->service);
883 packet_put_cstring(authctxt->method->name);
884 packet_put_char(0);
885 packet_put_cstring(password);
886 memset(password, 0, strlen(password));
887 xfree(password);
888 packet_add_padding(64);
889 packet_send();
890
891 dispatch_set(SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ,
892 &input_userauth_passwd_changereq);
893
894 return 1;
895}
cb5eb4f1 896
16c343f1
PA
897/*
898 * parse PASSWD_CHANGEREQ, prompt user and send SSH2_MSG_USERAUTH_REQUEST
899 */
cb5eb4f1 900/* ARGSUSED */
16c343f1
PA
901void
902input_userauth_passwd_changereq(int type, u_int32_t seqnr, void *ctxt)
903{
904 Authctxt *authctxt = ctxt;
905 char *info, *lang, *password = NULL, *retype = NULL;
906 char prompt[150];
856ea928
PA
907 const char *host = options.host_key_alias ? options.host_key_alias :
908 authctxt->host;
16c343f1
PA
909
910 debug2("input_userauth_passwd_changereq");
911
912 if (authctxt == NULL)
913 fatal("input_userauth_passwd_changereq: "
914 "no authentication context");
915
916 info = packet_get_string(NULL);
917 lang = packet_get_string(NULL);
918 if (strlen(info) > 0)
919 logit("%s", info);
920 xfree(info);
921 xfree(lang);
922 packet_start(SSH2_MSG_USERAUTH_REQUEST);
923 packet_put_cstring(authctxt->server_user);
924 packet_put_cstring(authctxt->service);
925 packet_put_cstring(authctxt->method->name);
926 packet_put_char(1); /* additional info */
927 snprintf(prompt, sizeof(prompt),
928 "Enter %.30s@%.128s's old password: ",
856ea928 929 authctxt->server_user, host);
16c343f1
PA
930 password = read_passphrase(prompt, 0);
931 packet_put_cstring(password);
932 memset(password, 0, strlen(password));
933 xfree(password);
934 password = NULL;
935 while (password == NULL) {
936 snprintf(prompt, sizeof(prompt),
937 "Enter %.30s@%.128s's new password: ",
856ea928 938 authctxt->server_user, host);
16c343f1
PA
939 password = read_passphrase(prompt, RP_ALLOW_EOF);
940 if (password == NULL) {
941 /* bail out */
942 return;
943 }
944 snprintf(prompt, sizeof(prompt),
945 "Retype %.30s@%.128s's new password: ",
856ea928 946 authctxt->server_user, host);
16c343f1
PA
947 retype = read_passphrase(prompt, 0);
948 if (strcmp(password, retype) != 0) {
949 memset(password, 0, strlen(password));
950 xfree(password);
951 logit("Mismatch; try again, EOF to quit.");
952 password = NULL;
953 }
954 memset(retype, 0, strlen(retype));
955 xfree(retype);
956 }
957 packet_put_cstring(password);
958 memset(password, 0, strlen(password));
959 xfree(password);
960 packet_add_padding(64);
961 packet_send();
962
963 dispatch_set(SSH2_MSG_USERAUTH_PASSWD_CHANGEREQ,
964 &input_userauth_passwd_changereq);
965}
966
cb5eb4f1
PA
967#ifdef JPAKE
968static char *
969pw_encrypt(const char *password, const char *crypt_scheme, const char *salt)
970{
971 /* OpenBSD crypt(3) handles all of these */
972 if (strcmp(crypt_scheme, "crypt") == 0 ||
973 strcmp(crypt_scheme, "bcrypt") == 0 ||
974 strcmp(crypt_scheme, "md5crypt") == 0 ||
975 strcmp(crypt_scheme, "crypt-extended") == 0)
976 return xstrdup(crypt(password, salt));
977 error("%s: unsupported password encryption scheme \"%.100s\"",
978 __func__, crypt_scheme);
979 return NULL;
980}
981
982static BIGNUM *
983jpake_password_to_secret(Authctxt *authctxt, const char *crypt_scheme,
984 const char *salt)
985{
986 char prompt[256], *password, *crypted;
987 u_char *secret;
988 u_int secret_len;
989 BIGNUM *ret;
990
991 snprintf(prompt, sizeof(prompt), "%.30s@%.128s's password (JPAKE): ",
992 authctxt->server_user, authctxt->host);
993 password = read_passphrase(prompt, 0);
994
995 if ((crypted = pw_encrypt(password, crypt_scheme, salt)) == NULL) {
996 logit("Disabling %s authentication", authctxt->method->name);
997 authctxt->method->enabled = NULL;
998 /* Continue with an empty password to fail gracefully */
999 crypted = xstrdup("");
1000 }
1001
1002#ifdef JPAKE_DEBUG
1003 debug3("%s: salt = %s", __func__, salt);
1004 debug3("%s: scheme = %s", __func__, crypt_scheme);
1005 debug3("%s: crypted = %s", __func__, crypted);
1006#endif
1007
1008 if (hash_buffer(crypted, strlen(crypted), EVP_sha256(),
1009 &secret, &secret_len) != 0)
1010 fatal("%s: hash_buffer", __func__);
1011
1012 bzero(password, strlen(password));
1013 bzero(crypted, strlen(crypted));
1014 xfree(password);
1015 xfree(crypted);
1016
1017 if ((ret = BN_bin2bn(secret, secret_len, NULL)) == NULL)
1018 fatal("%s: BN_bin2bn (secret)", __func__);
1019 bzero(secret, secret_len);
1020 xfree(secret);
1021
1022 return ret;
1023}
1024
1025/* ARGSUSED */
1026void
1027input_userauth_jpake_server_step1(int type, u_int32_t seq, void *ctxt)
1028{
1029 Authctxt *authctxt = ctxt;
1030 struct jpake_ctx *pctx = authctxt->methoddata;
1031 u_char *x3_proof, *x4_proof, *x2_s_proof;
1032 u_int x3_proof_len, x4_proof_len, x2_s_proof_len;
1033 char *crypt_scheme, *salt;
1034
1035 /* Disable this message */
1036 dispatch_set(SSH2_MSG_USERAUTH_JPAKE_SERVER_STEP1, NULL);
1037
1038 if ((pctx->g_x3 = BN_new()) == NULL ||
1039 (pctx->g_x4 = BN_new()) == NULL)
1040 fatal("%s: BN_new", __func__);
1041
1042 /* Fetch step 1 values */
1043 crypt_scheme = packet_get_string(NULL);
1044 salt = packet_get_string(NULL);
1045 pctx->server_id = packet_get_string(&pctx->server_id_len);
1046 packet_get_bignum2(pctx->g_x3);
1047 packet_get_bignum2(pctx->g_x4);
1048 x3_proof = packet_get_string(&x3_proof_len);
1049 x4_proof = packet_get_string(&x4_proof_len);
1050 packet_check_eom();
1051
1052 JPAKE_DEBUG_CTX((pctx, "step 1 received in %s", __func__));
1053
1054 /* Obtain password and derive secret */
1055 pctx->s = jpake_password_to_secret(authctxt, crypt_scheme, salt);
1056 bzero(crypt_scheme, strlen(crypt_scheme));
1057 bzero(salt, strlen(salt));
1058 xfree(crypt_scheme);
1059 xfree(salt);
1060 JPAKE_DEBUG_BN((pctx->s, "%s: s = ", __func__));
1061
1062 /* Calculate step 2 values */
1063 jpake_step2(pctx->grp, pctx->s, pctx->g_x1,
1064 pctx->g_x3, pctx->g_x4, pctx->x2,
1065 pctx->server_id, pctx->server_id_len,
1066 pctx->client_id, pctx->client_id_len,
1067 x3_proof, x3_proof_len,
1068 x4_proof, x4_proof_len,
1069 &pctx->a,
1070 &x2_s_proof, &x2_s_proof_len);
1071
1072 bzero(x3_proof, x3_proof_len);
1073 bzero(x4_proof, x4_proof_len);
1074 xfree(x3_proof);
1075 xfree(x4_proof);
1076
1077 JPAKE_DEBUG_CTX((pctx, "step 2 sending in %s", __func__));
1078
1079 /* Send values for step 2 */
1080 packet_start(SSH2_MSG_USERAUTH_JPAKE_CLIENT_STEP2);
1081 packet_put_bignum2(pctx->a);
1082 packet_put_string(x2_s_proof, x2_s_proof_len);
1083 packet_send();
1084
1085 bzero(x2_s_proof, x2_s_proof_len);
1086 xfree(x2_s_proof);
1087
1088 /* Expect step 2 packet from peer */
1089 dispatch_set(SSH2_MSG_USERAUTH_JPAKE_SERVER_STEP2,
1090 input_userauth_jpake_server_step2);
1091}
1092
1093/* ARGSUSED */
1094void
1095input_userauth_jpake_server_step2(int type, u_int32_t seq, void *ctxt)
1096{
1097 Authctxt *authctxt = ctxt;
1098 struct jpake_ctx *pctx = authctxt->methoddata;
1099 u_char *x4_s_proof;
1100 u_int x4_s_proof_len;
1101
1102 /* Disable this message */
1103 dispatch_set(SSH2_MSG_USERAUTH_JPAKE_SERVER_STEP2, NULL);
1104
1105 if ((pctx->b = BN_new()) == NULL)
1106 fatal("%s: BN_new", __func__);
1107
1108 /* Fetch step 2 values */
1109 packet_get_bignum2(pctx->b);
1110 x4_s_proof = packet_get_string(&x4_s_proof_len);
1111 packet_check_eom();
1112
1113 JPAKE_DEBUG_CTX((pctx, "step 2 received in %s", __func__));
1114
1115 /* Derive shared key and calculate confirmation hash */
1116 jpake_key_confirm(pctx->grp, pctx->s, pctx->b,
1117 pctx->x2, pctx->g_x1, pctx->g_x2, pctx->g_x3, pctx->g_x4,
1118 pctx->client_id, pctx->client_id_len,
1119 pctx->server_id, pctx->server_id_len,
1120 session_id2, session_id2_len,
1121 x4_s_proof, x4_s_proof_len,
1122 &pctx->k,
1123 &pctx->h_k_cid_sessid, &pctx->h_k_cid_sessid_len);
1124
1125 bzero(x4_s_proof, x4_s_proof_len);
1126 xfree(x4_s_proof);
1127
1128 JPAKE_DEBUG_CTX((pctx, "confirm sending in %s", __func__));
1129
1130 /* Send key confirmation proof */
1131 packet_start(SSH2_MSG_USERAUTH_JPAKE_CLIENT_CONFIRM);
1132 packet_put_string(pctx->h_k_cid_sessid, pctx->h_k_cid_sessid_len);
1133 packet_send();
1134
1135 /* Expect confirmation from peer */
1136 dispatch_set(SSH2_MSG_USERAUTH_JPAKE_SERVER_CONFIRM,
1137 input_userauth_jpake_server_confirm);
1138}
1139
1140/* ARGSUSED */
1141void
1142input_userauth_jpake_server_confirm(int type, u_int32_t seq, void *ctxt)
1143{
1144 Authctxt *authctxt = ctxt;
1145 struct jpake_ctx *pctx = authctxt->methoddata;
1146
1147 /* Disable this message */
1148 dispatch_set(SSH2_MSG_USERAUTH_JPAKE_SERVER_CONFIRM, NULL);
1149
1150 pctx->h_k_sid_sessid = packet_get_string(&pctx->h_k_sid_sessid_len);
1151 packet_check_eom();
1152
1153 JPAKE_DEBUG_CTX((pctx, "confirm received in %s", __func__));
1154
1155 /* Verify expected confirmation hash */
1156 if (jpake_check_confirm(pctx->k,
1157 pctx->server_id, pctx->server_id_len,
1158 session_id2, session_id2_len,
1159 pctx->h_k_sid_sessid, pctx->h_k_sid_sessid_len) == 1)
1160 debug("%s: %s success", __func__, authctxt->method->name);
1161 else {
1162 debug("%s: confirmation mismatch", __func__);
1163 /* XXX stash this so if auth succeeds then we can warn/kill */
1164 }
1165
1166 userauth_jpake_cleanup(authctxt);
1167}
1168#endif /* JPAKE */
1169
16c343f1
PA
1170static int
1171identity_sign(Identity *id, u_char **sigp, u_int *lenp,
1172 u_char *data, u_int datalen)
1173{
1174 Key *prv;
1175 int ret;
1176
1177 /* the agent supports this key */
1178 if (id->ac)
1179 return (ssh_agent_sign(id->ac, id->key, sigp, lenp,
1180 data, datalen));
1181 /*
1182 * we have already loaded the private key or
1183 * the private key is stored in external hardware
1184 */
1185 if (id->isprivate || (id->key->flags & KEY_FLAG_EXT))
1186 return (key_sign(id->key, sigp, lenp, data, datalen));
1187 /* load the private key from the file */
1188 if ((prv = load_identity_file(id->filename)) == NULL)
1189 return (-1);
1190 ret = key_sign(prv, sigp, lenp, data, datalen);
1191 key_free(prv);
1192 return (ret);
1193}
1194
1195static int
1196sign_and_send_pubkey(Authctxt *authctxt, Identity *id)
1197{
1198 Buffer b;
1199 u_char *blob, *signature;
1200 u_int bloblen, slen;
1201 u_int skip = 0;
1202 int ret = -1;
1203 int have_sig = 1;
856ea928 1204 char *fp;
16c343f1 1205
856ea928
PA
1206 fp = key_fingerprint(id->key, SSH_FP_MD5, SSH_FP_HEX);
1207 debug3("sign_and_send_pubkey: %s %s", key_type(id->key), fp);
1208 xfree(fp);
16c343f1
PA
1209
1210 if (key_to_blob(id->key, &blob, &bloblen) == 0) {
1211 /* we cannot handle this key */
1212 debug3("sign_and_send_pubkey: cannot handle key");
1213 return 0;
1214 }
1215 /* data to be signed */
1216 buffer_init(&b);
1217 if (datafellows & SSH_OLD_SESSIONID) {
1218 buffer_append(&b, session_id2, session_id2_len);
1219 skip = session_id2_len;
1220 } else {
1221 buffer_put_string(&b, session_id2, session_id2_len);
1222 skip = buffer_len(&b);
1223 }
1224 buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
1225 buffer_put_cstring(&b, authctxt->server_user);
1226 buffer_put_cstring(&b,
1227 datafellows & SSH_BUG_PKSERVICE ?
1228 "ssh-userauth" :
1229 authctxt->service);
1230 if (datafellows & SSH_BUG_PKAUTH) {
1231 buffer_put_char(&b, have_sig);
1232 } else {
1233 buffer_put_cstring(&b, authctxt->method->name);
1234 buffer_put_char(&b, have_sig);
1235 buffer_put_cstring(&b, key_ssh_name(id->key));
1236 }
1237 buffer_put_string(&b, blob, bloblen);
1238
1239 /* generate signature */
1240 ret = identity_sign(id, &signature, &slen,
1241 buffer_ptr(&b), buffer_len(&b));
1242 if (ret == -1) {
1243 xfree(blob);
1244 buffer_free(&b);
1245 return 0;
1246 }
1247#ifdef DEBUG_PK
1248 buffer_dump(&b);
1249#endif
1250 if (datafellows & SSH_BUG_PKSERVICE) {
1251 buffer_clear(&b);
1252 buffer_append(&b, session_id2, session_id2_len);
1253 skip = session_id2_len;
1254 buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
1255 buffer_put_cstring(&b, authctxt->server_user);
1256 buffer_put_cstring(&b, authctxt->service);
1257 buffer_put_cstring(&b, authctxt->method->name);
1258 buffer_put_char(&b, have_sig);
1259 if (!(datafellows & SSH_BUG_PKAUTH))
1260 buffer_put_cstring(&b, key_ssh_name(id->key));
1261 buffer_put_string(&b, blob, bloblen);
1262 }
1263 xfree(blob);
1264
1265 /* append signature */
1266 buffer_put_string(&b, signature, slen);
1267 xfree(signature);
1268
1269 /* skip session id and packet type */
1270 if (buffer_len(&b) < skip + 1)
1271 fatal("userauth_pubkey: internal error");
1272 buffer_consume(&b, skip + 1);
1273
1274 /* put remaining data from buffer into packet */
1275 packet_start(SSH2_MSG_USERAUTH_REQUEST);
1276 packet_put_raw(buffer_ptr(&b), buffer_len(&b));
1277 buffer_free(&b);
1278 packet_send();
1279
1280 return 1;
1281}
1282
1283static int
1284send_pubkey_test(Authctxt *authctxt, Identity *id)
1285{
1286 u_char *blob;
1287 u_int bloblen, have_sig = 0;
1288
1289 debug3("send_pubkey_test");
1290
1291 if (key_to_blob(id->key, &blob, &bloblen) == 0) {
1292 /* we cannot handle this key */
1293 debug3("send_pubkey_test: cannot handle key");
1294 return 0;
1295 }
1296 /* register callback for USERAUTH_PK_OK message */
1297 dispatch_set(SSH2_MSG_USERAUTH_PK_OK, &input_userauth_pk_ok);
1298
1299 packet_start(SSH2_MSG_USERAUTH_REQUEST);
1300 packet_put_cstring(authctxt->server_user);
1301 packet_put_cstring(authctxt->service);
1302 packet_put_cstring(authctxt->method->name);
1303 packet_put_char(have_sig);
1304 if (!(datafellows & SSH_BUG_PKAUTH))
1305 packet_put_cstring(key_ssh_name(id->key));
1306 packet_put_string(blob, bloblen);
1307 xfree(blob);
1308 packet_send();
1309 return 1;
1310}
1311
1312static Key *
1313load_identity_file(char *filename)
1314{
1315 Key *private;
1316 char prompt[300], *passphrase;
856ea928 1317 int perm_ok = 0, quit, i;
16c343f1
PA
1318 struct stat st;
1319
1320 if (stat(filename, &st) < 0) {
1321 debug3("no such identity: %s", filename);
1322 return NULL;
1323 }
1324 private = key_load_private_type(KEY_UNSPEC, filename, "", NULL, &perm_ok);
1325 if (!perm_ok)
1326 return NULL;
1327 if (private == NULL) {
1328 if (options.batch_mode)
1329 return NULL;
1330 snprintf(prompt, sizeof prompt,
1331 "Enter passphrase for key '%.100s': ", filename);
1332 for (i = 0; i < options.number_of_password_prompts; i++) {
1333 passphrase = read_passphrase(prompt, 0);
1334 if (strcmp(passphrase, "") != 0) {
1335 private = key_load_private_type(KEY_UNSPEC,
1336 filename, passphrase, NULL, NULL);
1337 quit = 0;
1338 } else {
1339 debug2("no passphrase given, try next key");
1340 quit = 1;
1341 }
1342 memset(passphrase, 0, strlen(passphrase));
1343 xfree(passphrase);
1344 if (private != NULL || quit)
1345 break;
1346 debug2("bad passphrase given, try again...");
1347 }
1348 }
1349 return private;
1350}
1351
1352/*
1353 * try keys in the following order:
1354 * 1. agent keys that are found in the config file
1355 * 2. other agent keys
1356 * 3. keys that are only listed in the config file
1357 */
1358static void
1359pubkey_prepare(Authctxt *authctxt)
1360{
1361 Identity *id;
1362 Idlist agent, files, *preferred;
1363 Key *key;
1364 AuthenticationConnection *ac;
1365 char *comment;
1366 int i, found;
1367
1368 TAILQ_INIT(&agent); /* keys from the agent */
1369 TAILQ_INIT(&files); /* keys from the config file */
1370 preferred = &authctxt->keys;
1371 TAILQ_INIT(preferred); /* preferred order of keys */
1372
1373 /* list of keys stored in the filesystem */
1374 for (i = 0; i < options.num_identity_files; i++) {
1375 key = options.identity_keys[i];
1376 if (key && key->type == KEY_RSA1)
1377 continue;
856ea928
PA
1378 if (key && key->cert && key->cert->type != SSH2_CERT_TYPE_USER)
1379 continue;
16c343f1
PA
1380 options.identity_keys[i] = NULL;
1381 id = xcalloc(1, sizeof(*id));
1382 id->key = key;
1383 id->filename = xstrdup(options.identity_files[i]);
1384 TAILQ_INSERT_TAIL(&files, id, next);
1385 }
1386 /* list of keys supported by the agent */
1387 if ((ac = ssh_get_authentication_connection())) {
1388 for (key = ssh_get_first_identity(ac, &comment, 2);
1389 key != NULL;
1390 key = ssh_get_next_identity(ac, &comment, 2)) {
1391 found = 0;
1392 TAILQ_FOREACH(id, &files, next) {
1393 /* agent keys from the config file are preferred */
1394 if (key_equal(key, id->key)) {
1395 key_free(key);
1396 xfree(comment);
1397 TAILQ_REMOVE(&files, id, next);
1398 TAILQ_INSERT_TAIL(preferred, id, next);
1399 id->ac = ac;
1400 found = 1;
1401 break;
1402 }
1403 }
1404 if (!found && !options.identities_only) {
1405 id = xcalloc(1, sizeof(*id));
1406 id->key = key;
1407 id->filename = comment;
1408 id->ac = ac;
1409 TAILQ_INSERT_TAIL(&agent, id, next);
1410 }
1411 }
1412 /* append remaining agent keys */
1413 for (id = TAILQ_FIRST(&agent); id; id = TAILQ_FIRST(&agent)) {
1414 TAILQ_REMOVE(&agent, id, next);
1415 TAILQ_INSERT_TAIL(preferred, id, next);
1416 }
1417 authctxt->agent = ac;
1418 }
1419 /* append remaining keys from the config file */
1420 for (id = TAILQ_FIRST(&files); id; id = TAILQ_FIRST(&files)) {
1421 TAILQ_REMOVE(&files, id, next);
1422 TAILQ_INSERT_TAIL(preferred, id, next);
1423 }
1424 TAILQ_FOREACH(id, preferred, next) {
1425 debug2("key: %s (%p)", id->filename, id->key);
1426 }
1427}
1428
1429static void
1430pubkey_cleanup(Authctxt *authctxt)
1431{
1432 Identity *id;
1433
1434 if (authctxt->agent != NULL)
1435 ssh_close_authentication_connection(authctxt->agent);
1436 for (id = TAILQ_FIRST(&authctxt->keys); id;
1437 id = TAILQ_FIRST(&authctxt->keys)) {
1438 TAILQ_REMOVE(&authctxt->keys, id, next);
1439 if (id->key)
1440 key_free(id->key);
1441 if (id->filename)
1442 xfree(id->filename);
1443 xfree(id);
1444 }
1445}
1446
1447int
1448userauth_pubkey(Authctxt *authctxt)
1449{
1450 Identity *id;
1451 int sent = 0;
1452
1453 while ((id = TAILQ_FIRST(&authctxt->keys))) {
1454 if (id->tried++)
1455 return (0);
1456 /* move key to the end of the queue */
1457 TAILQ_REMOVE(&authctxt->keys, id, next);
1458 TAILQ_INSERT_TAIL(&authctxt->keys, id, next);
1459 /*
1460 * send a test message if we have the public key. for
1461 * encrypted keys we cannot do this and have to load the
1462 * private key instead
1463 */
1464 if (id->key && id->key->type != KEY_RSA1) {
856ea928
PA
1465 debug("Offering %s public key: %s", key_type(id->key),
1466 id->filename);
16c343f1
PA
1467 sent = send_pubkey_test(authctxt, id);
1468 } else if (id->key == NULL) {
1469 debug("Trying private key: %s", id->filename);
1470 id->key = load_identity_file(id->filename);
1471 if (id->key != NULL) {
1472 id->isprivate = 1;
1473 sent = sign_and_send_pubkey(authctxt, id);
1474 key_free(id->key);
1475 id->key = NULL;
1476 }
1477 }
1478 if (sent)
1479 return (sent);
1480 }
1481 return (0);
1482}
1483
1484/*
1485 * Send userauth request message specifying keyboard-interactive method.
1486 */
1487int
1488userauth_kbdint(Authctxt *authctxt)
1489{
1490 static int attempt = 0;
1491
1492 if (attempt++ >= options.number_of_password_prompts)
1493 return 0;
1494 /* disable if no SSH2_MSG_USERAUTH_INFO_REQUEST has been seen */
1495 if (attempt > 1 && !authctxt->info_req_seen) {
1496 debug3("userauth_kbdint: disable: no info_req_seen");
1497 dispatch_set(SSH2_MSG_USERAUTH_INFO_REQUEST, NULL);
1498 return 0;
1499 }
1500
1501 debug2("userauth_kbdint");
1502 packet_start(SSH2_MSG_USERAUTH_REQUEST);
1503 packet_put_cstring(authctxt->server_user);
1504 packet_put_cstring(authctxt->service);
1505 packet_put_cstring(authctxt->method->name);
1506 packet_put_cstring(""); /* lang */
1507 packet_put_cstring(options.kbd_interactive_devices ?
1508 options.kbd_interactive_devices : "");
1509 packet_send();
1510
1511 dispatch_set(SSH2_MSG_USERAUTH_INFO_REQUEST, &input_userauth_info_req);
1512 return 1;
1513}
1514
1515/*
1516 * parse INFO_REQUEST, prompt user and send INFO_RESPONSE
1517 */
1518void
1519input_userauth_info_req(int type, u_int32_t seq, void *ctxt)
1520{
1521 Authctxt *authctxt = ctxt;
1522 char *name, *inst, *lang, *prompt, *response;
1523 u_int num_prompts, i;
1524 int echo = 0;
1525
1526 debug2("input_userauth_info_req");
1527
1528 if (authctxt == NULL)
1529 fatal("input_userauth_info_req: no authentication context");
1530
1531 authctxt->info_req_seen = 1;
1532
1533 name = packet_get_string(NULL);
1534 inst = packet_get_string(NULL);
1535 lang = packet_get_string(NULL);
1536 if (strlen(name) > 0)
1537 logit("%s", name);
1538 if (strlen(inst) > 0)
1539 logit("%s", inst);
1540 xfree(name);
1541 xfree(inst);
1542 xfree(lang);
1543
1544 num_prompts = packet_get_int();
1545 /*
1546 * Begin to build info response packet based on prompts requested.
1547 * We commit to providing the correct number of responses, so if
1548 * further on we run into a problem that prevents this, we have to
1549 * be sure and clean this up and send a correct error response.
1550 */
1551 packet_start(SSH2_MSG_USERAUTH_INFO_RESPONSE);
1552 packet_put_int(num_prompts);
1553
1554 debug2("input_userauth_info_req: num_prompts %d", num_prompts);
1555 for (i = 0; i < num_prompts; i++) {
1556 prompt = packet_get_string(NULL);
1557 echo = packet_get_char();
1558
1559 response = read_passphrase(prompt, echo ? RP_ECHO : 0);
1560
1561 packet_put_cstring(response);
1562 memset(response, 0, strlen(response));
1563 xfree(response);
1564 xfree(prompt);
1565 }
1566 packet_check_eom(); /* done with parsing incoming message. */
1567
1568 packet_add_padding(64);
1569 packet_send();
1570}
1571
1572static int
1573ssh_keysign(Key *key, u_char **sigp, u_int *lenp,
1574 u_char *data, u_int datalen)
1575{
1576 Buffer b;
1577 struct stat st;
1578 pid_t pid;
1579 int to[2], from[2], status, version = 2;
1580
1581 debug2("ssh_keysign called");
1582
1583 if (stat(_PATH_SSH_KEY_SIGN, &st) < 0) {
856ea928 1584 error("ssh_keysign: not installed: %s", strerror(errno));
16c343f1
PA
1585 return -1;
1586 }
1587 if (fflush(stdout) != 0)
1588 error("ssh_keysign: fflush: %s", strerror(errno));
1589 if (pipe(to) < 0) {
1590 error("ssh_keysign: pipe: %s", strerror(errno));
1591 return -1;
1592 }
1593 if (pipe(from) < 0) {
1594 error("ssh_keysign: pipe: %s", strerror(errno));
1595 return -1;
1596 }
1597 if ((pid = fork()) < 0) {
1598 error("ssh_keysign: fork: %s", strerror(errno));
1599 return -1;
1600 }
1601 if (pid == 0) {
856ea928
PA
1602 /* keep the socket on exec */
1603 fcntl(packet_get_connection_in(), F_SETFD, 0);
16c343f1
PA
1604 permanently_drop_suid(getuid());
1605 close(from[0]);
1606 if (dup2(from[1], STDOUT_FILENO) < 0)
1607 fatal("ssh_keysign: dup2: %s", strerror(errno));
1608 close(to[1]);
1609 if (dup2(to[0], STDIN_FILENO) < 0)
1610 fatal("ssh_keysign: dup2: %s", strerror(errno));
1611 close(from[1]);
1612 close(to[0]);
1613 execl(_PATH_SSH_KEY_SIGN, _PATH_SSH_KEY_SIGN, (char *) 0);
1614 fatal("ssh_keysign: exec(%s): %s", _PATH_SSH_KEY_SIGN,
1615 strerror(errno));
1616 }
1617 close(from[1]);
1618 close(to[0]);
1619
1620 buffer_init(&b);
1621 buffer_put_int(&b, packet_get_connection_in()); /* send # of socket */
1622 buffer_put_string(&b, data, datalen);
1623 if (ssh_msg_send(to[1], version, &b) == -1)
1624 fatal("ssh_keysign: couldn't send request");
1625
1626 if (ssh_msg_recv(from[0], &b) < 0) {
1627 error("ssh_keysign: no reply");
1628 buffer_free(&b);
1629 return -1;
1630 }
1631 close(from[0]);
1632 close(to[1]);
1633
1634 while (waitpid(pid, &status, 0) < 0)
1635 if (errno != EINTR)
1636 break;
1637
1638 if (buffer_get_char(&b) != version) {
1639 error("ssh_keysign: bad version");
1640 buffer_free(&b);
1641 return -1;
1642 }
1643 *sigp = buffer_get_string(&b, lenp);
1644 buffer_free(&b);
1645
1646 return 0;
1647}
1648
1649int
1650userauth_hostbased(Authctxt *authctxt)
1651{
1652 Key *private = NULL;
1653 Sensitive *sensitive = authctxt->sensitive;
1654 Buffer b;
1655 u_char *signature, *blob;
856ea928 1656 char *chost, *pkalg, *p;
16c343f1
PA
1657 const char *service;
1658 u_int blen, slen;
856ea928 1659 int ok, i, found = 0;
16c343f1
PA
1660
1661 /* check for a useful key */
1662 for (i = 0; i < sensitive->nkeys; i++) {
1663 private = sensitive->keys[i];
1664 if (private && private->type != KEY_RSA1) {
1665 found = 1;
1666 /* we take and free the key */
1667 sensitive->keys[i] = NULL;
1668 break;
1669 }
1670 }
1671 if (!found) {
1672 debug("No more client hostkeys for hostbased authentication.");
1673 return 0;
1674 }
1675 if (key_to_blob(private, &blob, &blen) == 0) {
1676 key_free(private);
1677 return 0;
1678 }
1679 /* figure out a name for the client host */
856ea928 1680 p = get_local_name(packet_get_connection_in());
16c343f1
PA
1681 if (p == NULL) {
1682 error("userauth_hostbased: cannot get local ipaddr/name");
1683 key_free(private);
1684 xfree(blob);
1685 return 0;
1686 }
16c343f1
PA
1687 xasprintf(&chost, "%s.", p);
1688 debug2("userauth_hostbased: chost %s", chost);
1689 xfree(p);
1690
1691 service = datafellows & SSH_BUG_HBSERVICE ? "ssh-userauth" :
1692 authctxt->service;
1693 pkalg = xstrdup(key_ssh_name(private));
1694 buffer_init(&b);
1695 /* construct data */
1696 buffer_put_string(&b, session_id2, session_id2_len);
1697 buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
1698 buffer_put_cstring(&b, authctxt->server_user);
1699 buffer_put_cstring(&b, service);
1700 buffer_put_cstring(&b, authctxt->method->name);
1701 buffer_put_cstring(&b, pkalg);
1702 buffer_put_string(&b, blob, blen);
1703 buffer_put_cstring(&b, chost);
1704 buffer_put_cstring(&b, authctxt->local_user);
1705#ifdef DEBUG_PK
1706 buffer_dump(&b);
1707#endif
1708 if (sensitive->external_keysign)
1709 ok = ssh_keysign(private, &signature, &slen,
1710 buffer_ptr(&b), buffer_len(&b));
1711 else
1712 ok = key_sign(private, &signature, &slen,
1713 buffer_ptr(&b), buffer_len(&b));
1714 key_free(private);
1715 buffer_free(&b);
1716 if (ok != 0) {
1717 error("key_sign failed");
1718 xfree(chost);
1719 xfree(pkalg);
1720 xfree(blob);
1721 return 0;
1722 }
1723 packet_start(SSH2_MSG_USERAUTH_REQUEST);
1724 packet_put_cstring(authctxt->server_user);
1725 packet_put_cstring(authctxt->service);
1726 packet_put_cstring(authctxt->method->name);
1727 packet_put_cstring(pkalg);
1728 packet_put_string(blob, blen);
1729 packet_put_cstring(chost);
1730 packet_put_cstring(authctxt->local_user);
1731 packet_put_string(signature, slen);
1732 memset(signature, 's', slen);
1733 xfree(signature);
1734 xfree(chost);
1735 xfree(pkalg);
1736 xfree(blob);
1737
1738 packet_send();
1739 return 1;
1740}
1741
cb5eb4f1
PA
1742#ifdef JPAKE
1743int
1744userauth_jpake(Authctxt *authctxt)
1745{
1746 struct jpake_ctx *pctx;
1747 u_char *x1_proof, *x2_proof;
1748 u_int x1_proof_len, x2_proof_len;
1749 static int attempt = 0; /* XXX share with userauth_password's? */
1750
1751 if (attempt++ >= options.number_of_password_prompts)
1752 return 0;
1753 if (attempt != 1)
1754 error("Permission denied, please try again.");
1755
1756 if (authctxt->methoddata != NULL)
1757 fatal("%s: authctxt->methoddata already set (%p)",
1758 __func__, authctxt->methoddata);
1759
1760 authctxt->methoddata = pctx = jpake_new();
1761
1762 /*
1763 * Send request immediately, to get the protocol going while
1764 * we do the initial computations.
1765 */
1766 packet_start(SSH2_MSG_USERAUTH_REQUEST);
1767 packet_put_cstring(authctxt->server_user);
1768 packet_put_cstring(authctxt->service);
1769 packet_put_cstring(authctxt->method->name);
1770 packet_send();
1771 packet_write_wait();
1772
1773 jpake_step1(pctx->grp,
1774 &pctx->client_id, &pctx->client_id_len,
1775 &pctx->x1, &pctx->x2, &pctx->g_x1, &pctx->g_x2,
1776 &x1_proof, &x1_proof_len,
1777 &x2_proof, &x2_proof_len);
1778
1779 JPAKE_DEBUG_CTX((pctx, "step 1 sending in %s", __func__));
1780
1781 packet_start(SSH2_MSG_USERAUTH_JPAKE_CLIENT_STEP1);
1782 packet_put_string(pctx->client_id, pctx->client_id_len);
1783 packet_put_bignum2(pctx->g_x1);
1784 packet_put_bignum2(pctx->g_x2);
1785 packet_put_string(x1_proof, x1_proof_len);
1786 packet_put_string(x2_proof, x2_proof_len);
1787 packet_send();
1788
1789 bzero(x1_proof, x1_proof_len);
1790 bzero(x2_proof, x2_proof_len);
1791 xfree(x1_proof);
1792 xfree(x2_proof);
1793
1794 /* Expect step 1 packet from peer */
1795 dispatch_set(SSH2_MSG_USERAUTH_JPAKE_SERVER_STEP1,
1796 input_userauth_jpake_server_step1);
856ea928
PA
1797 dispatch_set(SSH2_MSG_USERAUTH_SUCCESS,
1798 &input_userauth_success_unexpected);
cb5eb4f1
PA
1799
1800 return 1;
1801}
1802
1803void
1804userauth_jpake_cleanup(Authctxt *authctxt)
1805{
1806 debug3("%s: clean up", __func__);
1807 if (authctxt->methoddata != NULL) {
1808 jpake_free(authctxt->methoddata);
1809 authctxt->methoddata = NULL;
1810 }
856ea928 1811 dispatch_set(SSH2_MSG_USERAUTH_SUCCESS, &input_userauth_success);
cb5eb4f1
PA
1812}
1813#endif /* JPAKE */
1814
16c343f1
PA
1815/* find auth method */
1816
1817/*
1818 * given auth method name, if configurable options permit this method fill
1819 * in auth_ident field and return true, otherwise return false.
1820 */
1821static int
1822authmethod_is_enabled(Authmethod *method)
1823{
1824 if (method == NULL)
1825 return 0;
1826 /* return false if options indicate this method is disabled */
1827 if (method->enabled == NULL || *method->enabled == 0)
1828 return 0;
1829 /* return false if batch mode is enabled but method needs interactive mode */
1830 if (method->batch_flag != NULL && *method->batch_flag != 0)
1831 return 0;
1832 return 1;
1833}
1834
1835static Authmethod *
1836authmethod_lookup(const char *name)
1837{
1838 Authmethod *method = NULL;
1839 if (name != NULL)
1840 for (method = authmethods; method->name != NULL; method++)
1841 if (strcmp(name, method->name) == 0)
1842 return method;
1843 debug2("Unrecognized authentication method name: %s", name ? name : "NULL");
1844 return NULL;
1845}
1846
1847/* XXX internal state */
1848static Authmethod *current = NULL;
1849static char *supported = NULL;
1850static char *preferred = NULL;
1851
1852/*
1853 * Given the authentication method list sent by the server, return the
1854 * next method we should try. If the server initially sends a nil list,
1855 * use a built-in default list.
1856 */
1857static Authmethod *
1858authmethod_get(char *authlist)
1859{
1860 char *name = NULL;
1861 u_int next;
1862
1863 /* Use a suitable default if we're passed a nil list. */
1864 if (authlist == NULL || strlen(authlist) == 0)
1865 authlist = options.preferred_authentications;
1866
1867 if (supported == NULL || strcmp(authlist, supported) != 0) {
1868 debug3("start over, passed a different list %s", authlist);
1869 if (supported != NULL)
1870 xfree(supported);
1871 supported = xstrdup(authlist);
1872 preferred = options.preferred_authentications;
1873 debug3("preferred %s", preferred);
1874 current = NULL;
1875 } else if (current != NULL && authmethod_is_enabled(current))
1876 return current;
1877
1878 for (;;) {
1879 if ((name = match_list(preferred, supported, &next)) == NULL) {
1880 debug("No more authentication methods to try.");
1881 current = NULL;
1882 return NULL;
1883 }
1884 preferred += next;
1885 debug3("authmethod_lookup %s", name);
1886 debug3("remaining preferred: %s", preferred);
1887 if ((current = authmethod_lookup(name)) != NULL &&
1888 authmethod_is_enabled(current)) {
1889 debug3("authmethod_is_enabled %s", name);
1890 debug("Next authentication method: %s", name);
1891 return current;
1892 }
1893 }
1894}
1895
1896static char *
1897authmethods_get(void)
1898{
1899 Authmethod *method = NULL;
1900 Buffer b;
1901 char *list;
1902
1903 buffer_init(&b);
1904 for (method = authmethods; method->name != NULL; method++) {
1905 if (authmethod_is_enabled(method)) {
1906 if (buffer_len(&b) > 0)
1907 buffer_append(&b, ",", 1);
1908 buffer_append(&b, method->name, strlen(method->name));
1909 }
1910 }
1911 buffer_append(&b, "\0", 1);
1912 list = xstrdup(buffer_ptr(&b));
1913 buffer_free(&b);
1914 return list;
1915}
cb5eb4f1 1916