2 * Copyright (c) 2000 Markus Friedl. All rights reserved.
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 RCSID("$OpenBSD: sshconnect2.c,v 1.97 2002/02/25 16:33:27 markus Exp $");
37 #include "myproposal.h"
38 #include "sshconnect.h"
50 extern char *client_version_string;
51 extern char *server_version_string;
52 extern Options options;
58 u_char *session_id2 = NULL;
59 int session_id2_len = 0;
62 struct sockaddr *xxx_hostaddr;
67 verify_host_key_callback(Key *hostkey)
69 if (verify_host_key(xxx_host, xxx_hostaddr, hostkey) == -1)
70 fatal("Host key verification failed.");
75 ssh_kex2(char *host, struct sockaddr *hostaddr)
80 xxx_hostaddr = hostaddr;
82 if (options.ciphers == (char *)-1) {
83 log("No valid ciphers for protocol version 2 given, using defaults.");
84 options.ciphers = NULL;
86 if (options.ciphers != NULL) {
87 myproposal[PROPOSAL_ENC_ALGS_CTOS] =
88 myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
90 myproposal[PROPOSAL_ENC_ALGS_CTOS] =
91 compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]);
92 myproposal[PROPOSAL_ENC_ALGS_STOC] =
93 compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_STOC]);
94 if (options.compression) {
95 myproposal[PROPOSAL_COMP_ALGS_CTOS] =
96 myproposal[PROPOSAL_COMP_ALGS_STOC] = "zlib";
98 myproposal[PROPOSAL_COMP_ALGS_CTOS] =
99 myproposal[PROPOSAL_COMP_ALGS_STOC] = "none";
101 if (options.macs != NULL) {
102 myproposal[PROPOSAL_MAC_ALGS_CTOS] =
103 myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
105 if (options.hostkeyalgorithms != NULL)
106 myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
107 options.hostkeyalgorithms;
109 /* start key exchange */
110 kex = kex_setup(myproposal);
111 kex->client_version_string=client_version_string;
112 kex->server_version_string=server_version_string;
113 kex->verify_host_key=&verify_host_key_callback;
117 dispatch_run(DISPATCH_BLOCK, &kex->done, kex);
119 session_id2 = kex->session_id;
120 session_id2_len = kex->session_id_len;
123 /* send 1st encrypted/maced/compressed message */
124 packet_start(SSH2_MSG_IGNORE);
125 packet_put_cstring("markus");
129 debug("done: ssh_kex2.");
136 typedef struct Authctxt Authctxt;
137 typedef struct Authmethod Authmethod;
139 typedef int sign_cb_fn(
140 Authctxt *authctxt, Key *key,
141 u_char **sigp, u_int *lenp, u_char *data, u_int datalen);
144 const char *server_user;
145 const char *local_user;
153 sign_cb_fn *last_key_sign;
155 AuthenticationConnection *agent;
159 /* kbd-interactive */
163 char *name; /* string to compare against server's list */
164 int (*userauth)(Authctxt *authctxt);
165 int *enabled; /* flag in option struct that enables method */
166 int *batch_flag; /* flag in option struct that disables method */
169 void input_userauth_success(int, u_int32_t, void *);
170 void input_userauth_failure(int, u_int32_t, void *);
171 void input_userauth_banner(int, u_int32_t, void *);
172 void input_userauth_error(int, u_int32_t, void *);
173 void input_userauth_info_req(int, u_int32_t, void *);
174 void input_userauth_pk_ok(int, u_int32_t, void *);
176 int userauth_none(Authctxt *);
177 int userauth_pubkey(Authctxt *);
178 int userauth_passwd(Authctxt *);
179 int userauth_kbdint(Authctxt *);
180 int userauth_hostbased(Authctxt *);
182 void userauth(Authctxt *, char *);
184 static int sign_and_send_pubkey(Authctxt *, Key *, sign_cb_fn *);
185 static void clear_auth_state(Authctxt *);
187 static Authmethod *authmethod_get(char *authlist);
188 static Authmethod *authmethod_lookup(const char *name);
189 static char *authmethods_get(void);
191 Authmethod authmethods[] = {
194 &options.hostbased_authentication,
198 &options.pubkey_authentication,
200 {"keyboard-interactive",
202 &options.kbd_interactive_authentication,
203 &options.batch_mode},
206 &options.password_authentication,
207 &options.batch_mode},
212 {NULL, NULL, NULL, NULL}
216 ssh_userauth2(const char *local_user, const char *server_user, char *host,
217 Key **keys, int nkeys)
222 if (options.challenge_response_authentication)
223 options.kbd_interactive_authentication = 1;
225 debug("send SSH2_MSG_SERVICE_REQUEST");
226 packet_start(SSH2_MSG_SERVICE_REQUEST);
227 packet_put_cstring("ssh-userauth");
230 type = packet_read();
231 if (type != SSH2_MSG_SERVICE_ACCEPT) {
232 fatal("denied SSH2_MSG_SERVICE_ACCEPT: %d", type);
234 if (packet_remaining() > 0) {
235 char *reply = packet_get_string(NULL);
236 debug("service_accept: %s", reply);
239 debug("buggy server: service_accept w/o service");
242 debug("got SSH2_MSG_SERVICE_ACCEPT");
244 if (options.preferred_authentications == NULL)
245 options.preferred_authentications = authmethods_get();
247 /* setup authentication context */
248 memset(&authctxt, 0, sizeof(authctxt));
249 authctxt.agent = ssh_get_authentication_connection();
250 authctxt.server_user = server_user;
251 authctxt.local_user = local_user;
252 authctxt.host = host;
253 authctxt.service = "ssh-connection"; /* service name */
254 authctxt.success = 0;
255 authctxt.method = authmethod_lookup("none");
256 authctxt.authlist = NULL;
257 authctxt.keys = keys;
258 authctxt.nkeys = nkeys;
259 authctxt.info_req_seen = 0;
260 if (authctxt.method == NULL)
261 fatal("ssh_userauth2: internal error: cannot send userauth none request");
263 /* initial userauth request */
264 userauth_none(&authctxt);
266 dispatch_init(&input_userauth_error);
267 dispatch_set(SSH2_MSG_USERAUTH_SUCCESS, &input_userauth_success);
268 dispatch_set(SSH2_MSG_USERAUTH_FAILURE, &input_userauth_failure);
269 dispatch_set(SSH2_MSG_USERAUTH_BANNER, &input_userauth_banner);
270 dispatch_run(DISPATCH_BLOCK, &authctxt.success, &authctxt); /* loop until success */
272 if (authctxt.agent != NULL)
273 ssh_close_authentication_connection(authctxt.agent);
275 debug("ssh-userauth2 successful: method %s", authctxt.method->name);
278 userauth(Authctxt *authctxt, char *authlist)
280 if (authlist == NULL) {
281 authlist = authctxt->authlist;
283 if (authctxt->authlist)
284 xfree(authctxt->authlist);
285 authctxt->authlist = authlist;
288 Authmethod *method = authmethod_get(authlist);
290 fatal("Permission denied (%s).", authlist);
291 authctxt->method = method;
292 if (method->userauth(authctxt) != 0) {
293 debug2("we sent a %s packet, wait for reply", method->name);
296 debug2("we did not send a packet, disable method");
297 method->enabled = NULL;
302 input_userauth_error(int type, u_int32_t seq, void *ctxt)
304 fatal("input_userauth_error: bad message during authentication: "
308 input_userauth_banner(int type, u_int32_t seq, void *ctxt)
311 debug3("input_userauth_banner");
312 msg = packet_get_string(NULL);
313 lang = packet_get_string(NULL);
314 fprintf(stderr, "%s", msg);
319 input_userauth_success(int type, u_int32_t seq, void *ctxt)
321 Authctxt *authctxt = ctxt;
322 if (authctxt == NULL)
323 fatal("input_userauth_success: no authentication context");
324 if (authctxt->authlist)
325 xfree(authctxt->authlist);
326 clear_auth_state(authctxt);
327 authctxt->success = 1; /* break out */
330 input_userauth_failure(int type, u_int32_t seq, void *ctxt)
332 Authctxt *authctxt = ctxt;
333 char *authlist = NULL;
336 if (authctxt == NULL)
337 fatal("input_userauth_failure: no authentication context");
339 authlist = packet_get_string(NULL);
340 partial = packet_get_char();
344 log("Authenticated with partial success.");
345 debug("authentications that can continue: %s", authlist);
347 clear_auth_state(authctxt);
348 userauth(authctxt, authlist);
351 input_userauth_pk_ok(int type, u_int32_t seq, void *ctxt)
353 Authctxt *authctxt = ctxt;
356 int pktype, sent = 0;
361 if (authctxt == NULL)
362 fatal("input_userauth_pk_ok: no authentication context");
363 if (datafellows & SSH_BUG_PKOK) {
364 /* this is similar to SSH_BUG_PKAUTH */
365 debug2("input_userauth_pk_ok: SSH_BUG_PKOK");
366 pkblob = packet_get_string(&blen);
368 buffer_append(&b, pkblob, blen);
369 pkalg = buffer_get_string(&b, &alen);
372 pkalg = packet_get_string(&alen);
373 pkblob = packet_get_string(&blen);
377 debug("input_userauth_pk_ok: pkalg %s blen %d lastkey %p hint %d",
378 pkalg, blen, authctxt->last_key, authctxt->last_key_hint);
381 if (authctxt->last_key == NULL ||
382 authctxt->last_key_sign == NULL) {
383 debug("no last key or no sign cb");
386 if ((pktype = key_type_from_name(pkalg)) == KEY_UNSPEC) {
387 debug("unknown pkalg %s", pkalg);
390 if ((key = key_from_blob(pkblob, blen)) == NULL) {
391 debug("no key from blob. pkalg %s", pkalg);
394 if (key->type != pktype) {
395 error("input_userauth_pk_ok: type mismatch "
396 "for decoded key (received %d, expected %d)",
400 fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
401 debug2("input_userauth_pk_ok: fp %s", fp);
403 if (!key_equal(key, authctxt->last_key)) {
404 debug("key != last_key");
407 sent = sign_and_send_pubkey(authctxt, key,
408 authctxt->last_key_sign);
417 clear_auth_state(authctxt);
418 dispatch_set(SSH2_MSG_USERAUTH_PK_OK, NULL);
420 /* try another method if we did not send a packet*/
422 userauth(authctxt, NULL);
427 userauth_none(Authctxt *authctxt)
429 /* initial userauth request */
430 packet_start(SSH2_MSG_USERAUTH_REQUEST);
431 packet_put_cstring(authctxt->server_user);
432 packet_put_cstring(authctxt->service);
433 packet_put_cstring(authctxt->method->name);
439 userauth_passwd(Authctxt *authctxt)
441 static int attempt = 0;
445 if (attempt++ >= options.number_of_password_prompts)
449 error("Permission denied, please try again.");
451 snprintf(prompt, sizeof(prompt), "%.30s@%.128s's password: ",
452 authctxt->server_user, authctxt->host);
453 password = read_passphrase(prompt, 0);
454 packet_start(SSH2_MSG_USERAUTH_REQUEST);
455 packet_put_cstring(authctxt->server_user);
456 packet_put_cstring(authctxt->service);
457 packet_put_cstring(authctxt->method->name);
459 packet_put_cstring(password);
460 memset(password, 0, strlen(password));
462 packet_add_padding(64);
468 clear_auth_state(Authctxt *authctxt)
470 /* XXX clear authentication state */
471 if (authctxt->last_key != NULL && authctxt->last_key_hint == -1) {
472 debug3("clear_auth_state: key_free %p", authctxt->last_key);
473 key_free(authctxt->last_key);
475 authctxt->last_key = NULL;
476 authctxt->last_key_hint = -2;
477 authctxt->last_key_sign = NULL;
481 sign_and_send_pubkey(Authctxt *authctxt, Key *k, sign_cb_fn *sign_callback)
484 u_char *blob, *signature;
490 debug3("sign_and_send_pubkey");
492 if (key_to_blob(k, &blob, &bloblen) == 0) {
493 /* we cannot handle this key */
494 debug3("sign_and_send_pubkey: cannot handle key");
497 /* data to be signed */
499 if (datafellows & SSH_OLD_SESSIONID) {
500 buffer_append(&b, session_id2, session_id2_len);
501 skip = session_id2_len;
503 buffer_put_string(&b, session_id2, session_id2_len);
504 skip = buffer_len(&b);
506 buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
507 buffer_put_cstring(&b, authctxt->server_user);
508 buffer_put_cstring(&b,
509 datafellows & SSH_BUG_PKSERVICE ?
512 if (datafellows & SSH_BUG_PKAUTH) {
513 buffer_put_char(&b, have_sig);
515 buffer_put_cstring(&b, authctxt->method->name);
516 buffer_put_char(&b, have_sig);
517 buffer_put_cstring(&b, key_ssh_name(k));
519 buffer_put_string(&b, blob, bloblen);
521 /* generate signature */
522 ret = (*sign_callback)(authctxt, k, &signature, &slen,
523 buffer_ptr(&b), buffer_len(&b));
532 if (datafellows & SSH_BUG_PKSERVICE) {
534 buffer_append(&b, session_id2, session_id2_len);
535 skip = session_id2_len;
536 buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
537 buffer_put_cstring(&b, authctxt->server_user);
538 buffer_put_cstring(&b, authctxt->service);
539 buffer_put_cstring(&b, authctxt->method->name);
540 buffer_put_char(&b, have_sig);
541 if (!(datafellows & SSH_BUG_PKAUTH))
542 buffer_put_cstring(&b, key_ssh_name(k));
543 buffer_put_string(&b, blob, bloblen);
547 /* append signature */
548 buffer_put_string(&b, signature, slen);
551 /* skip session id and packet type */
552 if (buffer_len(&b) < skip + 1)
553 fatal("userauth_pubkey: internal error");
554 buffer_consume(&b, skip + 1);
556 /* put remaining data from buffer into packet */
557 packet_start(SSH2_MSG_USERAUTH_REQUEST);
558 packet_put_raw(buffer_ptr(&b), buffer_len(&b));
566 send_pubkey_test(Authctxt *authctxt, Key *k, sign_cb_fn *sign_callback,
570 u_int bloblen, have_sig = 0;
572 debug3("send_pubkey_test");
574 if (key_to_blob(k, &blob, &bloblen) == 0) {
575 /* we cannot handle this key */
576 debug3("send_pubkey_test: cannot handle key");
579 /* register callback for USERAUTH_PK_OK message */
580 authctxt->last_key_sign = sign_callback;
581 authctxt->last_key_hint = hint;
582 authctxt->last_key = k;
583 dispatch_set(SSH2_MSG_USERAUTH_PK_OK, &input_userauth_pk_ok);
585 packet_start(SSH2_MSG_USERAUTH_REQUEST);
586 packet_put_cstring(authctxt->server_user);
587 packet_put_cstring(authctxt->service);
588 packet_put_cstring(authctxt->method->name);
589 packet_put_char(have_sig);
590 if (!(datafellows & SSH_BUG_PKAUTH))
591 packet_put_cstring(key_ssh_name(k));
592 packet_put_string(blob, bloblen);
599 load_identity_file(char *filename)
602 char prompt[300], *passphrase;
606 if (stat(filename, &st) < 0) {
607 debug3("no such identity: %s", filename);
610 private = key_load_private_type(KEY_UNSPEC, filename, "", NULL);
611 if (private == NULL) {
612 if (options.batch_mode)
614 snprintf(prompt, sizeof prompt,
615 "Enter passphrase for key '%.100s': ", filename);
616 for (i = 0; i < options.number_of_password_prompts; i++) {
617 passphrase = read_passphrase(prompt, 0);
618 if (strcmp(passphrase, "") != 0) {
619 private = key_load_private_type(KEY_UNSPEC, filename,
623 debug2("no passphrase given, try next key");
626 memset(passphrase, 0, strlen(passphrase));
628 if (private != NULL || quit)
630 debug2("bad passphrase given, try again...");
637 identity_sign_cb(Authctxt *authctxt, Key *key, u_char **sigp, u_int *lenp,
638 u_char *data, u_int datalen)
643 idx = authctxt->last_key_hint;
647 /* private key is stored in external hardware */
648 if (options.identity_keys[idx]->flags & KEY_FLAG_EXT)
649 return key_sign(options.identity_keys[idx], sigp, lenp, data, datalen);
651 private = load_identity_file(options.identity_files[idx]);
654 ret = key_sign(private, sigp, lenp, data, datalen);
660 agent_sign_cb(Authctxt *authctxt, Key *key, u_char **sigp, u_int *lenp,
661 u_char *data, u_int datalen)
663 return ssh_agent_sign(authctxt->agent, key, sigp, lenp, data, datalen);
667 key_sign_cb(Authctxt *authctxt, Key *key, u_char **sigp, u_int *lenp,
668 u_char *data, u_int datalen)
670 return key_sign(key, sigp, lenp, data, datalen);
674 userauth_pubkey_agent(Authctxt *authctxt)
676 static int called = 0;
682 if (ssh_get_num_identities(authctxt->agent, 2) == 0)
683 debug2("userauth_pubkey_agent: no keys at all");
686 k = ssh_get_next_identity(authctxt->agent, &comment, 2);
688 debug2("userauth_pubkey_agent: no more keys");
690 debug("userauth_pubkey_agent: testing agent key %s", comment);
692 ret = send_pubkey_test(authctxt, k, agent_sign_cb, -1);
697 debug2("userauth_pubkey_agent: no message sent");
702 userauth_pubkey(Authctxt *authctxt)
709 if (authctxt->agent != NULL) {
711 sent = userauth_pubkey_agent(authctxt);
712 } while (!sent && authctxt->agent->howmany > 0);
714 while (!sent && idx < options.num_identity_files) {
715 key = options.identity_keys[idx];
716 filename = options.identity_files[idx];
718 debug("try privkey: %s", filename);
719 key = load_identity_file(filename);
721 sent = sign_and_send_pubkey(authctxt, key,
725 } else if (key->type != KEY_RSA1) {
726 debug("try pubkey: %s", filename);
727 sent = send_pubkey_test(authctxt, key,
728 identity_sign_cb, idx);
736 * Send userauth request message specifying keyboard-interactive method.
739 userauth_kbdint(Authctxt *authctxt)
741 static int attempt = 0;
743 if (attempt++ >= options.number_of_password_prompts)
745 /* disable if no SSH2_MSG_USERAUTH_INFO_REQUEST has been seen */
746 if (attempt > 1 && !authctxt->info_req_seen) {
747 debug3("userauth_kbdint: disable: no info_req_seen");
748 dispatch_set(SSH2_MSG_USERAUTH_INFO_REQUEST, NULL);
752 debug2("userauth_kbdint");
753 packet_start(SSH2_MSG_USERAUTH_REQUEST);
754 packet_put_cstring(authctxt->server_user);
755 packet_put_cstring(authctxt->service);
756 packet_put_cstring(authctxt->method->name);
757 packet_put_cstring(""); /* lang */
758 packet_put_cstring(options.kbd_interactive_devices ?
759 options.kbd_interactive_devices : "");
762 dispatch_set(SSH2_MSG_USERAUTH_INFO_REQUEST, &input_userauth_info_req);
767 * parse INFO_REQUEST, prompt user and send INFO_RESPONSE
770 input_userauth_info_req(int type, u_int32_t seq, void *ctxt)
772 Authctxt *authctxt = ctxt;
773 char *name, *inst, *lang, *prompt, *response;
774 u_int num_prompts, i;
777 debug2("input_userauth_info_req");
779 if (authctxt == NULL)
780 fatal("input_userauth_info_req: no authentication context");
782 authctxt->info_req_seen = 1;
784 name = packet_get_string(NULL);
785 inst = packet_get_string(NULL);
786 lang = packet_get_string(NULL);
787 if (strlen(name) > 0)
789 if (strlen(inst) > 0)
795 num_prompts = packet_get_int();
797 * Begin to build info response packet based on prompts requested.
798 * We commit to providing the correct number of responses, so if
799 * further on we run into a problem that prevents this, we have to
800 * be sure and clean this up and send a correct error response.
802 packet_start(SSH2_MSG_USERAUTH_INFO_RESPONSE);
803 packet_put_int(num_prompts);
805 debug2("input_userauth_info_req: num_prompts %d", num_prompts);
806 for (i = 0; i < num_prompts; i++) {
807 prompt = packet_get_string(NULL);
808 echo = packet_get_char();
810 response = read_passphrase(prompt, echo ? RP_ECHO : 0);
812 packet_put_cstring(response);
813 memset(response, 0, strlen(response));
817 packet_check_eom(); /* done with parsing incoming message. */
819 packet_add_padding(64);
824 * this will be move to an external program (ssh-keysign) ASAP. ssh-keysign
825 * will be setuid-root and the sbit can be removed from /usr/bin/ssh.
828 userauth_hostbased(Authctxt *authctxt)
832 u_char *signature, *blob;
833 char *chost, *pkalg, *p;
836 int ok, i, len, found = 0;
838 /* check for a useful key */
839 for (i = 0; i < authctxt->nkeys; i++) {
840 private = authctxt->keys[i];
841 if (private && private->type != KEY_RSA1) {
843 /* we take and free the key */
844 authctxt->keys[i] = NULL;
849 debug("userauth_hostbased: no more client hostkeys");
852 if (key_to_blob(private, &blob, &blen) == 0) {
856 /* figure out a name for the client host */
857 p = get_local_name(packet_get_connection_in());
859 error("userauth_hostbased: cannot get local ipaddr/name");
864 chost = xmalloc(len);
865 strlcpy(chost, p, len);
866 strlcat(chost, ".", len);
867 debug2("userauth_hostbased: chost %s", chost);
869 service = datafellows & SSH_BUG_HBSERVICE ? "ssh-userauth" :
871 pkalg = xstrdup(key_ssh_name(private));
874 buffer_put_string(&b, session_id2, session_id2_len);
875 buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
876 buffer_put_cstring(&b, authctxt->server_user);
877 buffer_put_cstring(&b, service);
878 buffer_put_cstring(&b, authctxt->method->name);
879 buffer_put_cstring(&b, pkalg);
880 buffer_put_string(&b, blob, blen);
881 buffer_put_cstring(&b, chost);
882 buffer_put_cstring(&b, authctxt->local_user);
886 ok = key_sign(private, &signature, &slen, buffer_ptr(&b), buffer_len(&b));
890 error("key_sign failed");
895 packet_start(SSH2_MSG_USERAUTH_REQUEST);
896 packet_put_cstring(authctxt->server_user);
897 packet_put_cstring(authctxt->service);
898 packet_put_cstring(authctxt->method->name);
899 packet_put_cstring(pkalg);
900 packet_put_string(blob, blen);
901 packet_put_cstring(chost);
902 packet_put_cstring(authctxt->local_user);
903 packet_put_string(signature, slen);
904 memset(signature, 's', slen);
913 /* find auth method */
916 * given auth method name, if configurable options permit this method fill
917 * in auth_ident field and return true, otherwise return false.
920 authmethod_is_enabled(Authmethod *method)
924 /* return false if options indicate this method is disabled */
925 if (method->enabled == NULL || *method->enabled == 0)
927 /* return false if batch mode is enabled but method needs interactive mode */
928 if (method->batch_flag != NULL && *method->batch_flag != 0)
934 authmethod_lookup(const char *name)
936 Authmethod *method = NULL;
938 for (method = authmethods; method->name != NULL; method++)
939 if (strcmp(name, method->name) == 0)
941 debug2("Unrecognized authentication method name: %s", name ? name : "NULL");
945 /* XXX internal state */
946 static Authmethod *current = NULL;
947 static char *supported = NULL;
948 static char *preferred = NULL;
950 * Given the authentication method list sent by the server, return the
951 * next method we should try. If the server initially sends a nil list,
952 * use a built-in default list.
955 authmethod_get(char *authlist)
961 /* Use a suitable default if we're passed a nil list. */
962 if (authlist == NULL || strlen(authlist) == 0)
963 authlist = options.preferred_authentications;
965 if (supported == NULL || strcmp(authlist, supported) != 0) {
966 debug3("start over, passed a different list %s", authlist);
967 if (supported != NULL)
969 supported = xstrdup(authlist);
970 preferred = options.preferred_authentications;
971 debug3("preferred %s", preferred);
973 } else if (current != NULL && authmethod_is_enabled(current))
977 if ((name = match_list(preferred, supported, &next)) == NULL) {
978 debug("no more auth methods to try");
983 debug3("authmethod_lookup %s", name);
984 debug3("remaining preferred: %s", preferred);
985 if ((current = authmethod_lookup(name)) != NULL &&
986 authmethod_is_enabled(current)) {
987 debug3("authmethod_is_enabled %s", name);
988 debug("next auth method to try is %s", name);
995 authmethods_get(void)
997 Authmethod *method = NULL;
1002 for (method = authmethods; method->name != NULL; method++) {
1003 if (authmethod_is_enabled(method)) {
1004 if (buffer_len(&b) > 0)
1005 buffer_append(&b, ",", 1);
1006 buffer_append(&b, method->name, strlen(method->name));
1009 buffer_append(&b, "\0", 1);
1010 list = xstrdup(buffer_ptr(&b));