[openssh.git] / auth-rsa.c

/*
 * 
 * auth-rsa.c
 * 
 * Author: Tatu Ylonen <ylo@cs.hut.fi>
 * 
 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
 *                    All rights reserved
 * 
 * Created: Mon Mar 27 01:46:52 1995 ylo
 * 
 * RSA-based authentication.  This code determines whether to admit a login
 * based on RSA authentication.  This file also contains functions to check
 * validity of the host key.
 * 
 */

#include "includes.h"
RCSID("$Id$");

#include "rsa.h"
#include "packet.h"
#include "xmalloc.h"
#include "ssh.h"
#include "mpaux.h"
#include "uidswap.h"
#include "servconf.h"

#ifdef HAVE_OPENSSL
#include <openssl/rsa.h>
#include <openssl/md5.h>
#endif
#ifdef HAVE_SSL
#include <ssl/rsa.h>
#include <ssl/md5.h>
#endif

/* Flags that may be set in authorized_keys options. */
extern int no_port_forwarding_flag;
extern int no_agent_forwarding_flag;
extern int no_x11_forwarding_flag;
extern int no_pty_flag;
extern char *forced_command;
extern struct envstring *custom_environment;

/*
 * Session identifier that is used to bind key exchange and authentication
 * responses to a particular session.
 */
extern unsigned char session_id[16];

/*
 * The .ssh/authorized_keys file contains public keys, one per line, in the
 * following format:
 *   options bits e n comment
 * where bits, e and n are decimal numbers,
 * and comment is any string of characters up to newline.  The maximum
 * length of a line is 8000 characters.  See the documentation for a
 * description of the options.
 */

/*
 * Performs the RSA authentication challenge-response dialog with the client,
 * and returns true (non-zero) if the client gave the correct answer to
 * our challenge; returns zero if the client gives a wrong answer.
 */

int
auth_rsa_challenge_dialog(BIGNUM *e, BIGNUM *n)
{
	BIGNUM *challenge, *encrypted_challenge, *aux;
	RSA *pk;
	BN_CTX *ctx = BN_CTX_new();
	unsigned char buf[32], mdbuf[16], response[16];
	MD5_CTX md;
	unsigned int i;
	int plen, len;

	encrypted_challenge = BN_new();
	challenge = BN_new();
	aux = BN_new();

	/* Generate a random challenge. */
	BN_rand(challenge, 256, 0, 0);
	BN_mod(challenge, challenge, n, ctx);

	/* Create the public key data structure. */
	pk = RSA_new();
	pk->e = BN_new();
	BN_copy(pk->e, e);
	pk->n = BN_new();
	BN_copy(pk->n, n);

	/* Encrypt the challenge with the public key. */
	rsa_public_encrypt(encrypted_challenge, challenge, pk);
	RSA_free(pk);

	/* Send the encrypted challenge to the client. */
	packet_start(SSH_SMSG_AUTH_RSA_CHALLENGE);
	packet_put_bignum(encrypted_challenge);
	packet_send();
	packet_write_wait();

	/* The response is MD5 of decrypted challenge plus session id. */
	len = BN_num_bytes(challenge);
	if (len <= 0 || len > 32)
		fatal("auth_rsa_challenge_dialog: bad challenge length %d", len);
	memset(buf, 0, 32);
	BN_bn2bin(challenge, buf + 32 - len);
	MD5_Init(&md);
	MD5_Update(&md, buf, 32);
	MD5_Update(&md, session_id, 16);
	MD5_Final(mdbuf, &md);

	/* We will no longer need these. */
	BN_clear_free(encrypted_challenge);
	BN_clear_free(challenge);
	BN_clear_free(aux);
	BN_CTX_free(ctx);

	/* Wait for a response. */
	packet_read_expect(&plen, SSH_CMSG_AUTH_RSA_RESPONSE);
	packet_integrity_check(plen, 16, SSH_CMSG_AUTH_RSA_RESPONSE);
	for (i = 0; i < 16; i++)
		response[i] = packet_get_char();

	/* Verify that the response is the original challenge. */
	if (memcmp(response, mdbuf, 16) != 0) {
		/* Wrong answer. */
		return 0;
	}
	/* Correct answer. */
	return 1;
}

/*
 * Performs the RSA authentication dialog with the client.  This returns
 * 0 if the client could not be authenticated, and 1 if authentication was
 * successful.  This may exit if there is a serious protocol violation.
 */

int
auth_rsa(struct passwd *pw, BIGNUM *client_n)
{
	extern ServerOptions options;
	char line[8192], file[1024];
	int authenticated;
	unsigned int bits;
	FILE *f;
	unsigned long linenum = 0;
	struct stat st;
	BIGNUM *e, *n;

	/* Temporarily use the user's uid. */
	temporarily_use_uid(pw->pw_uid);

	/* The authorized keys. */
	snprintf(file, sizeof file, "%.500s/%.100s", pw->pw_dir,
		 SSH_USER_PERMITTED_KEYS);

	/* Fail quietly if file does not exist */
	if (stat(file, &st) < 0) {
		/* Restore the privileged uid. */
		restore_uid();
		return 0;
	}
	/* Open the file containing the authorized keys. */
	f = fopen(file, "r");
	if (!f) {
		/* Restore the privileged uid. */
		restore_uid();
		packet_send_debug("Could not open %.900s for reading.", file);
		packet_send_debug("If your home is on an NFS volume, it may need to be world-readable.");
		return 0;
	}
	if (options.strict_modes) {
		int fail = 0;
		char buf[1024];
		/* Check open file in order to avoid open/stat races */
		if (fstat(fileno(f), &st) < 0 ||
		    (st.st_uid != 0 && st.st_uid != pw->pw_uid) ||
		    (st.st_mode & 022) != 0) {
			snprintf(buf, sizeof buf, "RSA authentication refused for %.100s: "
				 "bad ownership or modes for '%s'.", pw->pw_name, file);
			fail = 1;
		} else {
			/* Check path to SSH_USER_PERMITTED_KEYS */
			int i;
			static const char *check[] = {
				"", SSH_USER_DIR, NULL
			};
			for (i = 0; check[i]; i++) {
				snprintf(line, sizeof line, "%.500s/%.100s", pw->pw_dir, check[i]);
				if (stat(line, &st) < 0 ||
				    (st.st_uid != 0 && st.st_uid != pw->pw_uid) ||
				    (st.st_mode & 022) != 0) {
					snprintf(buf, sizeof buf, "RSA authentication refused for %.100s: "
						 "bad ownership or modes for '%s'.", pw->pw_name, line);
					fail = 1;
					break;
				}
			}
		}
		if (fail) {
			log(buf);
			packet_send_debug(buf);
			restore_uid();
			return 0;
		}
	}
	/* Flag indicating whether authentication has succeeded. */
	authenticated = 0;

	e = BN_new();
	n = BN_new();

	/*
	 * Go though the accepted keys, looking for the current key.  If
	 * found, perform a challenge-response dialog to verify that the
	 * user really has the corresponding private key.
	 */
	while (fgets(line, sizeof(line), f)) {
		char *cp;
		char *options;

		linenum++;

		/* Skip leading whitespace, empty and comment lines. */
		for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
			;
		if (!*cp || *cp == '\n' || *cp == '#')
			continue;

		/*
		 * Check if there are options for this key, and if so,
		 * save their starting address and skip the option part
		 * for now.  If there are no options, set the starting
		 * address to NULL.
		 */
		if (*cp < '0' || *cp > '9') {
			int quoted = 0;
			options = cp;
			for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) {
				if (*cp == '\\' && cp[1] == '"')
					cp++;	/* Skip both */
				else if (*cp == '"')
					quoted = !quoted;
			}
		} else
			options = NULL;

		/* Parse the key from the line. */
		if (!auth_rsa_read_key(&cp, &bits, e, n)) {
			debug("%.100s, line %lu: bad key syntax",
			      SSH_USER_PERMITTED_KEYS, linenum);
			packet_send_debug("%.100s, line %lu: bad key syntax",
				          SSH_USER_PERMITTED_KEYS, linenum);
			continue;
		}
		/* cp now points to the comment part. */

		/* Check if the we have found the desired key (identified by its modulus). */
		if (BN_cmp(n, client_n) != 0)
			continue;

		/* check the real bits  */
		if (bits != BN_num_bits(n))
			log("Warning: %s, line %ld: keysize mismatch: "
			    "actual %d vs. announced %d.",
			    file, linenum, BN_num_bits(n), bits);

		/* We have found the desired key. */

		/* Perform the challenge-response dialog for this key. */
		if (!auth_rsa_challenge_dialog(e, n)) {
			/* Wrong response. */
			verbose("Wrong response to RSA authentication challenge.");
			packet_send_debug("Wrong response to RSA authentication challenge.");
			continue;
		}
		/*
		 * Correct response.  The client has been successfully
		 * authenticated. Note that we have not yet processed the
		 * options; this will be reset if the options cause the
		 * authentication to be rejected.
		 */
		authenticated = 1;

		/* RSA part of authentication was accepted.  Now process the options. */
		if (options) {
			while (*options && *options != ' ' && *options != '\t') {
				cp = "no-port-forwarding";
				if (strncmp(options, cp, strlen(cp)) == 0) {
					packet_send_debug("Port forwarding disabled.");
					no_port_forwarding_flag = 1;
					options += strlen(cp);
					goto next_option;
				}
				cp = "no-agent-forwarding";
				if (strncmp(options, cp, strlen(cp)) == 0) {
					packet_send_debug("Agent forwarding disabled.");
					no_agent_forwarding_flag = 1;
					options += strlen(cp);
					goto next_option;
				}
				cp = "no-X11-forwarding";
				if (strncmp(options, cp, strlen(cp)) == 0) {
					packet_send_debug("X11 forwarding disabled.");
					no_x11_forwarding_flag = 1;
					options += strlen(cp);
					goto next_option;
				}
				cp = "no-pty";
				if (strncmp(options, cp, strlen(cp)) == 0) {
					packet_send_debug("Pty allocation disabled.");
					no_pty_flag = 1;
					options += strlen(cp);
					goto next_option;
				}
				cp = "command=\"";
				if (strncmp(options, cp, strlen(cp)) == 0) {
					int i;
					options += strlen(cp);
					forced_command = xmalloc(strlen(options) + 1);
					i = 0;
					while (*options) {
						if (*options == '"')
							break;
						if (*options == '\\' && options[1] == '"') {
							options += 2;
							forced_command[i++] = '"';
							continue;
						}
						forced_command[i++] = *options++;
					}
					if (!*options) {
						debug("%.100s, line %lu: missing end quote",
						      SSH_USER_PERMITTED_KEYS, linenum);
						packet_send_debug("%.100s, line %lu: missing end quote",
								  SSH_USER_PERMITTED_KEYS, linenum);
						continue;
					}
					forced_command[i] = 0;
					packet_send_debug("Forced command: %.900s", forced_command);
					options++;
					goto next_option;
				}
				cp = "environment=\"";
				if (strncmp(options, cp, strlen(cp)) == 0) {
					int i;
					char *s;
					struct envstring *new_envstring;
					options += strlen(cp);
					s = xmalloc(strlen(options) + 1);
					i = 0;
					while (*options) {
						if (*options == '"')
							break;
						if (*options == '\\' && options[1] == '"') {
							options += 2;
							s[i++] = '"';
							continue;
						}
						s[i++] = *options++;
					}
					if (!*options) {
						debug("%.100s, line %lu: missing end quote",
						      SSH_USER_PERMITTED_KEYS, linenum);
						packet_send_debug("%.100s, line %lu: missing end quote",
								  SSH_USER_PERMITTED_KEYS, linenum);
						continue;
					}
					s[i] = 0;
					packet_send_debug("Adding to environment: %.900s", s);
					debug("Adding to environment: %.900s", s);
					options++;
					new_envstring = xmalloc(sizeof(struct envstring));
					new_envstring->s = s;
					new_envstring->next = custom_environment;
					custom_environment = new_envstring;
					goto next_option;
				}
				cp = "from=\"";
				if (strncmp(options, cp, strlen(cp)) == 0) {
					char *patterns = xmalloc(strlen(options) + 1);
					int i;
					options += strlen(cp);
					i = 0;
					while (*options) {
						if (*options == '"')
							break;
						if (*options == '\\' && options[1] == '"') {
							options += 2;
							patterns[i++] = '"';
							continue;
						}
						patterns[i++] = *options++;
					}
					if (!*options) {
						debug("%.100s, line %lu: missing end quote",
						      SSH_USER_PERMITTED_KEYS, linenum);
						packet_send_debug("%.100s, line %lu: missing end quote",
								  SSH_USER_PERMITTED_KEYS, linenum);
						continue;
					}
					patterns[i] = 0;
					options++;
					if (!match_hostname(get_canonical_hostname(), patterns,
						     strlen(patterns)) &&
					    !match_hostname(get_remote_ipaddr(), patterns,
						     strlen(patterns))) {
						log("RSA authentication tried for %.100s with correct key but not from a permitted host (host=%.200s, ip=%.200s).",
						    pw->pw_name, get_canonical_hostname(),
						    get_remote_ipaddr());
						packet_send_debug("Your host '%.200s' is not permitted to use this key for login.",
						get_canonical_hostname());
						xfree(patterns);
						/* key invalid for this host, reset flags */
						authenticated = 0;
						no_agent_forwarding_flag = 0;
						no_port_forwarding_flag = 0;
						no_pty_flag = 0;
						no_x11_forwarding_flag = 0;
						while (custom_environment) {
							struct envstring *ce = custom_environment;
							custom_environment = ce->next;
							xfree(ce->s);
							xfree(ce);
						}
						if (forced_command) {
							xfree(forced_command);
							forced_command = NULL;
						}
						break;
					}
					xfree(patterns);
					/* Host name matches. */
					goto next_option;
				}
		bad_option:
				log("Bad options in %.100s file, line %lu: %.50s",
				    SSH_USER_PERMITTED_KEYS, linenum, options);
				packet_send_debug("Bad options in %.100s file, line %lu: %.50s",
						  SSH_USER_PERMITTED_KEYS, linenum, options);
				authenticated = 0;
				break;

		next_option:
				/*
				 * Skip the comma, and move to the next option
				 * (or break out if there are no more).
				 */
				if (!*options)
					fatal("Bugs in auth-rsa.c option processing.");
				if (*options == ' ' || *options == '\t')
					break;		/* End of options. */
				if (*options != ',')
					goto bad_option;
				options++;
				/* Process the next option. */
				continue;
			}
		}
		/*
		 * Break out of the loop if authentication was successful;
		 * otherwise continue searching.
		 */
		if (authenticated)
			break;
	}

	/* Restore the privileged uid. */
	restore_uid();

	/* Close the file. */
	fclose(f);

	BN_clear_free(n);
	BN_clear_free(e);

	if (authenticated)
		packet_send_debug("RSA authentication accepted.");

	/* Return authentication result. */
	return authenticated;
}
Commit	Line	Data
8efc0c15	1	/*
5260325f	2	*
	3	* auth-rsa.c
	4	*
	5	* Author: Tatu Ylonen <ylo@cs.hut.fi>
	6	*
	7	* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
	8	* All rights reserved
	9	*
	10	* Created: Mon Mar 27 01:46:52 1995 ylo
	11	*
	12	* RSA-based authentication. This code determines whether to admit a login
	13	* based on RSA authentication. This file also contains functions to check
	14	* validity of the host key.
	15	*
	16	*/
8efc0c15	17
	18	#include "includes.h"
	19	RCSID("$Id$");
	20
	21	#include "rsa.h"
	22	#include "packet.h"
	23	#include "xmalloc.h"
	24	#include "ssh.h"
	25	#include "mpaux.h"
	26	#include "uidswap.h"
6fa724bc	27	#include "servconf.h"
8efc0c15	28
5881cd60	29	#ifdef HAVE_OPENSSL
8efc0c15	30	#include <openssl/rsa.h>
8efc0c15	31	#include <openssl/md5.h>
5881cd60	32	#endif
	33	#ifdef HAVE_SSL
	34	#include <ssl/rsa.h>
	35	#include <ssl/md5.h>
	36	#endif
8efc0c15	37
	38	/* Flags that may be set in authorized_keys options. */
	39	extern int no_port_forwarding_flag;
	40	extern int no_agent_forwarding_flag;
	41	extern int no_x11_forwarding_flag;
	42	extern int no_pty_flag;
	43	extern char *forced_command;
	44	extern struct envstring *custom_environment;
	45
aa3378df	46	/*
	47	* Session identifier that is used to bind key exchange and authentication
	48	* responses to a particular session.
	49	*/
8efc0c15	50	extern unsigned char session_id[16];
8efc0c15	51
aa3378df	52	/*
	53	* The .ssh/authorized_keys file contains public keys, one per line, in the
	54	* following format:
	55	* options bits e n comment
	56	* where bits, e and n are decimal numbers,
	57	* and comment is any string of characters up to newline. The maximum
	58	* length of a line is 8000 characters. See the documentation for a
	59	* description of the options.
	60	*/
8efc0c15	61
aa3378df	62	/*
	63	* Performs the RSA authentication challenge-response dialog with the client,
	64	* and returns true (non-zero) if the client gave the correct answer to
	65	* our challenge; returns zero if the client gives a wrong answer.
	66	*/
8efc0c15	67
8efc0c15	68	int
4d195447	69	auth_rsa_challenge_dialog(BIGNUM e, BIGNUM n)
8efc0c15	70	{
5260325f	71	BIGNUM challenge, encrypted_challenge, *aux;
	72	RSA *pk;
	73	BN_CTX *ctx = BN_CTX_new();
	74	unsigned char buf[32], mdbuf[16], response[16];
	75	MD5_CTX md;
	76	unsigned int i;
	77	int plen, len;
	78
	79	encrypted_challenge = BN_new();
	80	challenge = BN_new();
	81	aux = BN_new();
	82
	83	/* Generate a random challenge. */
	84	BN_rand(challenge, 256, 0, 0);
	85	BN_mod(challenge, challenge, n, ctx);
	86
	87	/* Create the public key data structure. */
	88	pk = RSA_new();
	89	pk->e = BN_new();
	90	BN_copy(pk->e, e);
	91	pk->n = BN_new();
	92	BN_copy(pk->n, n);
	93
	94	/* Encrypt the challenge with the public key. */
	95	rsa_public_encrypt(encrypted_challenge, challenge, pk);
	96	RSA_free(pk);
	97
	98	/* Send the encrypted challenge to the client. */
	99	packet_start(SSH_SMSG_AUTH_RSA_CHALLENGE);
	100	packet_put_bignum(encrypted_challenge);
	101	packet_send();
	102	packet_write_wait();
	103
	104	/* The response is MD5 of decrypted challenge plus session id. */
	105	len = BN_num_bytes(challenge);
	106	if (len <= 0 \|\| len > 32)
	107	fatal("auth_rsa_challenge_dialog: bad challenge length %d", len);
	108	memset(buf, 0, 32);
	109	BN_bn2bin(challenge, buf + 32 - len);
	110	MD5_Init(&md);
	111	MD5_Update(&md, buf, 32);
	112	MD5_Update(&md, session_id, 16);
	113	MD5_Final(mdbuf, &md);
	114
	115	/* We will no longer need these. */
	116	BN_clear_free(encrypted_challenge);
	117	BN_clear_free(challenge);
	118	BN_clear_free(aux);
	119	BN_CTX_free(ctx);
	120
	121	/* Wait for a response. */
	122	packet_read_expect(&plen, SSH_CMSG_AUTH_RSA_RESPONSE);
	123	packet_integrity_check(plen, 16, SSH_CMSG_AUTH_RSA_RESPONSE);
	124	for (i = 0; i < 16; i++)
	125	response[i] = packet_get_char();
	126
	127	/* Verify that the response is the original challenge. */
	128	if (memcmp(response, mdbuf, 16) != 0) {
	129	/* Wrong answer. */
	130	return 0;
	131	}
	132	/* Correct answer. */
	133	return 1;
8efc0c15	134	}
8efc0c15	135
aa3378df	136	/*
	137	* Performs the RSA authentication dialog with the client. This returns
	138	* 0 if the client could not be authenticated, and 1 if authentication was
	139	* successful. This may exit if there is a serious protocol violation.
	140	*/
8efc0c15	141
8efc0c15	142	int
6fa724bc	143	auth_rsa(struct passwd pw, BIGNUM client_n)
8efc0c15	144	{
5260325f	145	extern ServerOptions options;
	146	char line[8192], file[1024];
	147	int authenticated;
	148	unsigned int bits;
	149	FILE *f;
	150	unsigned long linenum = 0;
	151	struct stat st;
	152	BIGNUM e, n;
	153
	154	/* Temporarily use the user's uid. */
	155	temporarily_use_uid(pw->pw_uid);
	156
	157	/* The authorized keys. */
	158	snprintf(file, sizeof file, "%.500s/%.100s", pw->pw_dir,
	159	SSH_USER_PERMITTED_KEYS);
	160
	161	/* Fail quietly if file does not exist */
	162	if (stat(file, &st) < 0) {
	163	/* Restore the privileged uid. */
	164	restore_uid();
	165	return 0;
8efc0c15	166	}
5260325f	167	/* Open the file containing the authorized keys. */
	168	f = fopen(file, "r");
	169	if (!f) {
	170	/* Restore the privileged uid. */
	171	restore_uid();
	172	packet_send_debug("Could not open %.900s for reading.", file);
	173	packet_send_debug("If your home is on an NFS volume, it may need to be world-readable.");
	174	return 0;
8efc0c15	175	}
5260325f	176	if (options.strict_modes) {
	177	int fail = 0;
	178	char buf[1024];
	179	/* Check open file in order to avoid open/stat races */
	180	if (fstat(fileno(f), &st) < 0 \|\|
	181	(st.st_uid != 0 && st.st_uid != pw->pw_uid) \|\|
	182	(st.st_mode & 022) != 0) {
	183	snprintf(buf, sizeof buf, "RSA authentication refused for %.100s: "
	184	"bad ownership or modes for '%s'.", pw->pw_name, file);
	185	fail = 1;
	186	} else {
	187	/* Check path to SSH_USER_PERMITTED_KEYS */
	188	int i;
	189	static const char *check[] = {
	190	"", SSH_USER_DIR, NULL
	191	};
	192	for (i = 0; check[i]; i++) {
	193	snprintf(line, sizeof line, "%.500s/%.100s", pw->pw_dir, check[i]);
	194	if (stat(line, &st) < 0 \|\|
	195	(st.st_uid != 0 && st.st_uid != pw->pw_uid) \|\|
	196	(st.st_mode & 022) != 0) {
	197	snprintf(buf, sizeof buf, "RSA authentication refused for %.100s: "
	198	"bad ownership or modes for '%s'.", pw->pw_name, line);
	199	fail = 1;
	200	break;
	201	}
	202	}
8efc0c15	203	}
5260325f	204	if (fail) {
	205	log(buf);
	206	packet_send_debug(buf);
	207	restore_uid();
	208	return 0;
8efc0c15	209	}
5260325f	210	}
	211	/* Flag indicating whether authentication has succeeded. */
	212	authenticated = 0;
	213
5260325f	214	e = BN_new();
	215	n = BN_new();
	216
aa3378df	217	/*
	218	* Go though the accepted keys, looking for the current key. If
	219	* found, perform a challenge-response dialog to verify that the
	220	* user really has the corresponding private key.
	221	*/
5260325f	222	while (fgets(line, sizeof(line), f)) {
	223	char *cp;
	224	char *options;
	225
	226	linenum++;
	227
aa3378df	228	/* Skip leading whitespace, empty and comment lines. */
	229	for (cp = line; cp == ' ' \|\| cp == '\t'; cp++)
	230	;
5260325f	231	if (!cp \|\| cp == '\n' \|\| *cp == '#')
	232	continue;
	233
aa3378df	234	/*
	235	* Check if there are options for this key, and if so,
	236	* save their starting address and skip the option part
	237	* for now. If there are no options, set the starting
	238	* address to NULL.
	239	*/
5260325f	240	if (cp < '0' \|\| cp > '9') {
	241	int quoted = 0;
	242	options = cp;
	243	for (; cp && (quoted \|\| (cp != ' ' && *cp != '\t')); cp++) {
	244	if (*cp == '\\' && cp[1] == '"')
	245	cp++; /* Skip both */
	246	else if (*cp == '"')
	247	quoted = !quoted;
8efc0c15	248	}
5260325f	249	} else
	250	options = NULL;
	251
	252	/* Parse the key from the line. */
	253	if (!auth_rsa_read_key(&cp, &bits, e, n)) {
	254	debug("%.100s, line %lu: bad key syntax",
	255	SSH_USER_PERMITTED_KEYS, linenum);
	256	packet_send_debug("%.100s, line %lu: bad key syntax",
	257	SSH_USER_PERMITTED_KEYS, linenum);
	258	continue;
8efc0c15	259	}
5260325f	260	/* cp now points to the comment part. */
5260325f	261
5260325f	262	/* Check if the we have found the desired key (identified by its modulus). */
5260325f	263	if (BN_cmp(n, client_n) != 0)
aa3378df	264	continue;
5260325f	265
57112b5a	266	/* check the real bits */
	267	if (bits != BN_num_bits(n))
	268	log("Warning: %s, line %ld: keysize mismatch: "
	269	"actual %d vs. announced %d.",
	270	file, linenum, BN_num_bits(n), bits);
	271
5260325f	272	/* We have found the desired key. */
	273
	274	/* Perform the challenge-response dialog for this key. */
	275	if (!auth_rsa_challenge_dialog(e, n)) {
	276	/* Wrong response. */
	277	verbose("Wrong response to RSA authentication challenge.");
	278	packet_send_debug("Wrong response to RSA authentication challenge.");
	279	continue;
8efc0c15	280	}
aa3378df	281	/*
	282	* Correct response. The client has been successfully
	283	* authenticated. Note that we have not yet processed the
	284	* options; this will be reset if the options cause the
	285	* authentication to be rejected.
	286	*/
5260325f	287	authenticated = 1;
	288
	289	/* RSA part of authentication was accepted. Now process the options. */
	290	if (options) {
	291	while (options && options != ' ' && *options != '\t') {
	292	cp = "no-port-forwarding";
	293	if (strncmp(options, cp, strlen(cp)) == 0) {
	294	packet_send_debug("Port forwarding disabled.");
	295	no_port_forwarding_flag = 1;
	296	options += strlen(cp);
	297	goto next_option;
	298	}
	299	cp = "no-agent-forwarding";
	300	if (strncmp(options, cp, strlen(cp)) == 0) {
	301	packet_send_debug("Agent forwarding disabled.");
	302	no_agent_forwarding_flag = 1;
	303	options += strlen(cp);
	304	goto next_option;
	305	}
	306	cp = "no-X11-forwarding";
	307	if (strncmp(options, cp, strlen(cp)) == 0) {
	308	packet_send_debug("X11 forwarding disabled.");
	309	no_x11_forwarding_flag = 1;
	310	options += strlen(cp);
	311	goto next_option;
	312	}
	313	cp = "no-pty";
	314	if (strncmp(options, cp, strlen(cp)) == 0) {
	315	packet_send_debug("Pty allocation disabled.");
	316	no_pty_flag = 1;
	317	options += strlen(cp);
	318	goto next_option;
	319	}
	320	cp = "command=\"";
	321	if (strncmp(options, cp, strlen(cp)) == 0) {
	322	int i;
	323	options += strlen(cp);
	324	forced_command = xmalloc(strlen(options) + 1);
	325	i = 0;
	326	while (*options) {
	327	if (*options == '"')
	328	break;
	329	if (*options == '\\' && options[1] == '"') {
	330	options += 2;
	331	forced_command[i++] = '"';
	332	continue;
	333	}
	334	forced_command[i++] = *options++;
	335	}
	336	if (!*options) {
	337	debug("%.100s, line %lu: missing end quote",
	338	SSH_USER_PERMITTED_KEYS, linenum);
	339	packet_send_debug("%.100s, line %lu: missing end quote",
	340	SSH_USER_PERMITTED_KEYS, linenum);
	341	continue;
	342	}
	343	forced_command[i] = 0;
	344	packet_send_debug("Forced command: %.900s", forced_command);
	345	options++;
	346	goto next_option;
	347	}
	348	cp = "environment=\"";
	349	if (strncmp(options, cp, strlen(cp)) == 0) {
	350	int i;
351	char *s;
352	struct envstring *new_envstring;
353	options += strlen(cp);
354	s = xmalloc(strlen(options) + 1);
355	i = 0;
356	while (*options) {
357	if (*options == '"')
358	break;
359	if (*options == '\\' && options[1] == '"') {
360	options += 2;
361	s[i++] = '"';
362	continue;
363	}
364	s[i++] = *options++;
365	}
366	if (!*options) {
367	debug("%.100s, line %lu: missing end quote",
368	SSH_USER_PERMITTED_KEYS, linenum);
369	packet_send_debug("%.100s, line %lu: missing end quote",
370	SSH_USER_PERMITTED_KEYS, linenum);
371	continue;
372	}
373	s[i] = 0;
374	packet_send_debug("Adding to environment: %.900s", s);
375	debug("Adding to environment: %.900s", s);
376	options++;
377	new_envstring = xmalloc(sizeof(struct envstring));
378	new_envstring->s = s;
379	new_envstring->next = custom_environment;
380	custom_environment = new_envstring;
381	goto next_option;
382	}
383	cp = "from=\"";
384	if (strncmp(options, cp, strlen(cp)) == 0) {
385	char *patterns = xmalloc(strlen(options) + 1);
386	int i;
387	options += strlen(cp);
388	i = 0;
389	while (*options) {
390	if (*options == '"')
391	break;
392	if (*options == '\\' && options[1] == '"') {
393	options += 2;
394	patterns[i++] = '"';
395	continue;
396	}
397	patterns[i++] = *options++;
398	}
399	if (!*options) {
400	debug("%.100s, line %lu: missing end quote",
401	SSH_USER_PERMITTED_KEYS, linenum);
402	packet_send_debug("%.100s, line %lu: missing end quote",
403	SSH_USER_PERMITTED_KEYS, linenum);
404	continue;
405	}
406	patterns[i] = 0;
407	options++;
408	if (!match_hostname(get_canonical_hostname(), patterns,
409	strlen(patterns)) &&
410	!match_hostname(get_remote_ipaddr(), patterns,
411	strlen(patterns))) {
412	log("RSA authentication tried for %.100s with correct key but not from a permitted host (host=%.200s, ip=%.200s).",
413	pw->pw_name, get_canonical_hostname(),
414	get_remote_ipaddr());
415	packet_send_debug("Your host '%.200s' is not permitted to use this key for login.",
416	get_canonical_hostname());
417	xfree(patterns);
7b2ea3a1	418	/* key invalid for this host, reset flags */
5260325f	419	authenticated = 0;
7b2ea3a1	420	no_agent_forwarding_flag = 0;
	421	no_port_forwarding_flag = 0;
	422	no_pty_flag = 0;
	423	no_x11_forwarding_flag = 0;
	424	while (custom_environment) {
	425	struct envstring *ce = custom_environment;
	426	custom_environment = ce->next;
	427	xfree(ce->s);
	428	xfree(ce);
	429	}
	430	if (forced_command) {
	431	xfree(forced_command);
	432	forced_command = NULL;
	433	}
5260325f	434	break;
	435	}
	436	xfree(patterns);
	437	/* Host name matches. */
	438	goto next_option;
	439	}
	440	bad_option:
5260325f	441	log("Bad options in %.100s file, line %lu: %.50s",
	442	SSH_USER_PERMITTED_KEYS, linenum, options);
	443	packet_send_debug("Bad options in %.100s file, line %lu: %.50s",
	444	SSH_USER_PERMITTED_KEYS, linenum, options);
	445	authenticated = 0;
	446	break;
	447
	448	next_option:
aa3378df	449	/*
	450	* Skip the comma, and move to the next option
	451	* (or break out if there are no more).
	452	*/
5260325f	453	if (!*options)
	454	fatal("Bugs in auth-rsa.c option processing.");
	455	if (options == ' ' \|\| options == '\t')
aa3378df	456	break; /* End of options. */
5260325f	457	if (*options != ',')
	458	goto bad_option;
	459	options++;
	460	/* Process the next option. */
	461	continue;
8efc0c15	462	}
8efc0c15	463	}
aa3378df	464	/*
	465	* Break out of the loop if authentication was successful;
	466	* otherwise continue searching.
	467	*/
5260325f	468	if (authenticated)
5260325f	469	break;
8efc0c15	470	}
8efc0c15	471
5260325f	472	/* Restore the privileged uid. */
5260325f	473	restore_uid();
8efc0c15	474
5260325f	475	/* Close the file. */
5260325f	476	fclose(f);
8efc0c15	477
5260325f	478	BN_clear_free(n);
5260325f	479	BN_clear_free(e);
8efc0c15	480
5260325f	481	if (authenticated)
5260325f	482	packet_send_debug("RSA authentication accepted.");
8efc0c15	483
5260325f	484	/* Return authentication result. */
5260325f	485	return authenticated;
8efc0c15	486	}