]> andersk Git - openssh.git/blame - ssh.c
- itojun@cvs.openbsd.org 2002/09/17 07:47:02
[openssh.git] / ssh.c
CommitLineData
8efc0c15 1/*
5260325f 2 * Author: Tatu Ylonen <ylo@cs.hut.fi>
3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4 * All rights reserved
5260325f 5 * Ssh client program. This program can be used to log into a remote machine.
6 * The software supports strong authentication, encryption, and forwarding
7 * of X11, TCP/IP, and authentication connections.
8 *
bcbf86ec 9 * As far as I am concerned, the code I have written for this software
10 * can be used freely for any purpose. Any derived versions of this
11 * software must be clearly marked as such, and if the derived work is
12 * incompatible with the protocol description in the RFC file, it must be
13 * called by a name other than "ssh" or "Secure Shell".
14 *
15 * Copyright (c) 1999 Niels Provos. All rights reserved.
5fb274c1 16 * Copyright (c) 2000, 2001, 2002 Markus Friedl. All rights reserved.
bcbf86ec 17 *
18 * Modified to work with SSL by Niels Provos <provos@citi.umich.edu>
19 * in Canada (German citizen).
20 *
21 * Redistribution and use in source and binary forms, with or without
22 * modification, are permitted provided that the following conditions
23 * are met:
24 * 1. Redistributions of source code must retain the above copyright
25 * notice, this list of conditions and the following disclaimer.
26 * 2. Redistributions in binary form must reproduce the above copyright
27 * notice, this list of conditions and the following disclaimer in the
28 * documentation and/or other materials provided with the distribution.
29 *
30 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
31 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
32 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
33 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
34 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
35 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
36 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
37 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
38 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
39 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
5260325f 40 */
8efc0c15 41
42#include "includes.h"
8b10e20e 43RCSID("$OpenBSD: ssh.c,v 1.185 2002/09/11 18:27:26 stevesk Exp $");
8efc0c15 44
a306f2dd 45#include <openssl/evp.h>
fa08c86b 46#include <openssl/err.h>
a306f2dd 47
8efc0c15 48#include "ssh.h"
42f11eb2 49#include "ssh1.h"
50#include "ssh2.h"
51#include "compat.h"
52#include "cipher.h"
53#include "xmalloc.h"
8efc0c15 54#include "packet.h"
55#include "buffer.h"
a5efa1bb 56#include "channels.h"
a306f2dd 57#include "key.h"
4c8722d9 58#include "authfd.h"
a306f2dd 59#include "authfile.h"
42f11eb2 60#include "pathnames.h"
b5c334cc 61#include "clientloop.h"
42f11eb2 62#include "log.h"
63#include "readconf.h"
64#include "sshconnect.h"
65#include "tildexpand.h"
1f3bf5aa 66#include "dispatch.h"
42f11eb2 67#include "misc.h"
b2552997 68#include "kex.h"
69#include "mac.h"
30dcc918 70#include "sshtty.h"
8efc0c15 71
383546c4 72#ifdef SMARTCARD
383546c4 73#include "scard.h"
dd2495cb 74#endif
383546c4 75
f601d847 76#ifdef HAVE___PROGNAME
77extern char *__progname;
260d427b 78#else
79char *__progname;
80#endif
f601d847 81
48e671d5 82/* Flag indicating whether IPv4 or IPv6. This can be set on the command line.
83 Default value is AF_UNSPEC means both IPv4 and IPv6. */
59e76f33 84#ifdef IPV4_DEFAULT
85int IPv4or6 = AF_INET;
86#else
48e671d5 87int IPv4or6 = AF_UNSPEC;
59e76f33 88#endif
48e671d5 89
5260325f 90/* Flag indicating whether debug mode is on. This can be set on the command line. */
8efc0c15 91int debug_flag = 0;
92
a8be9f80 93/* Flag indicating whether a tty should be allocated */
8efc0c15 94int tty_flag = 0;
8abcdba4 95int no_tty_flag = 0;
96int force_tty_flag = 0;
8efc0c15 97
8ce64345 98/* don't exec a shell */
99int no_shell_flag = 0;
8ce64345 100
aa3378df 101/*
102 * Flag indicating that nothing should be read from stdin. This can be set
103 * on the command line.
104 */
8efc0c15 105int stdin_null_flag = 0;
106
aa3378df 107/*
108 * Flag indicating that ssh should fork after authentication. This is useful
c242fc96 109 * so that the passphrase can be entered manually, and then ssh goes to the
aa3378df 110 * background.
111 */
8efc0c15 112int fork_after_authentication_flag = 0;
113
aa3378df 114/*
115 * General data structure for command line options and options configurable
116 * in configuration files. See readconf.h.
117 */
8efc0c15 118Options options;
119
e591b98a 120/* optional user configfile */
121char *config = NULL;
122
aa3378df 123/*
124 * Name of the host we are connecting to. This is the name given on the
125 * command line, or the HostName specified for the user-supplied name in a
126 * configuration file.
127 */
8efc0c15 128char *host;
129
130/* socket address the host resolves to */
48e671d5 131struct sockaddr_storage hostaddr;
8efc0c15 132
8002af61 133/* Private host keys. */
39c00dc2 134Sensitive sensitive_data;
8efc0c15 135
136/* Original real UID. */
137uid_t original_real_uid;
3fb156df 138uid_t original_effective_uid;
8efc0c15 139
8ce64345 140/* command to be executed */
141Buffer command;
142
ae810de7 143/* Should we execute a command or invoke a subsystem? */
144int subsystem_flag = 0;
145
e0ae8728 146/* # of replies received for global requests */
147static int client_global_request_id = 0;
148
8efc0c15 149/* Prints a help message to the user. This function never returns. */
150
396c147e 151static void
5ca51e19 152usage(void)
8efc0c15 153{
1fe6a48f 154 fprintf(stderr, "Usage: %s [options] host [command]\n", __progname);
5260325f 155 fprintf(stderr, "Options:\n");
156 fprintf(stderr, " -l user Log in using this user name.\n");
5ca51e19 157 fprintf(stderr, " -n Redirect input from " _PATH_DEVNULL ".\n");
e591b98a 158 fprintf(stderr, " -F config Config file (default: ~/%s).\n",
159 _PATH_SSH_USER_CONFFILE);
71276795 160 fprintf(stderr, " -A Enable authentication agent forwarding.\n");
63cd7dd0 161 fprintf(stderr, " -a Disable authentication agent forwarding (default).\n");
8efc0c15 162#ifdef AFS
5260325f 163 fprintf(stderr, " -k Disable Kerberos ticket and AFS token forwarding.\n");
164#endif /* AFS */
2b87da3b 165 fprintf(stderr, " -X Enable X11 connection forwarding.\n");
63cd7dd0 166 fprintf(stderr, " -x Disable X11 connection forwarding (default).\n");
a01a5f30 167 fprintf(stderr, " -i file Identity for public key authentication "
168 "(default: ~/.ssh/identity)\n");
315dfb04 169#ifdef SMARTCARD
170 fprintf(stderr, " -I reader Set smartcard reader.\n");
dd2495cb 171#endif
5260325f 172 fprintf(stderr, " -t Tty; allocate a tty even if command is given.\n");
8ce64345 173 fprintf(stderr, " -T Do not allocate a tty.\n");
5260325f 174 fprintf(stderr, " -v Verbose; display verbose debugging messages.\n");
bcbf86ec 175 fprintf(stderr, " Multiple -v increases verbosity.\n");
5260325f 176 fprintf(stderr, " -V Display version number only.\n");
5260325f 177 fprintf(stderr, " -q Quiet; don't display any warning messages.\n");
178 fprintf(stderr, " -f Fork into background after authentication.\n");
179 fprintf(stderr, " -e char Set escape character; ``none'' = disable (default: ~).\n");
180
63cd7dd0 181 fprintf(stderr, " -c cipher Select encryption algorithm\n");
38967add 182 fprintf(stderr, " -m macs Specify MAC algorithms for protocol version 2.\n");
5260325f 183 fprintf(stderr, " -p port Connect to this port. Server must be on the same port.\n");
184 fprintf(stderr, " -L listen-port:host:port Forward local port to remote address\n");
185 fprintf(stderr, " -R listen-port:host:port Forward remote port to local address\n");
1fe6a48f 186 fprintf(stderr, " These cause %s to listen for connections on a port, and\n", __progname);
5260325f 187 fprintf(stderr, " forward them to the other side by connecting to host:port.\n");
4c780c2a 188 fprintf(stderr, " -D port Enable dynamic application-level port forwarding.\n");
5260325f 189 fprintf(stderr, " -C Enable compression.\n");
8ce64345 190 fprintf(stderr, " -N Do not execute a shell or command.\n");
5260325f 191 fprintf(stderr, " -g Allow remote hosts to connect to forwarded ports.\n");
1f3bf5aa 192 fprintf(stderr, " -1 Force protocol version 1.\n");
193 fprintf(stderr, " -2 Force protocol version 2.\n");
48e671d5 194 fprintf(stderr, " -4 Use IPv4 only.\n");
195 fprintf(stderr, " -6 Use IPv6 only.\n");
5260325f 196 fprintf(stderr, " -o 'option' Process the option as if it was read from a configuration file.\n");
ae810de7 197 fprintf(stderr, " -s Invoke command (mandatory) as SSH2 subsystem.\n");
63cd7dd0 198 fprintf(stderr, " -b addr Local IP address.\n");
5260325f 199 exit(1);
8efc0c15 200}
201
396c147e 202static int ssh_session(void);
203static int ssh_session2(void);
204static void load_public_identity_files(void);
8ce64345 205
5260325f 206/*
207 * Main program for the ssh client.
208 */
8efc0c15 209int
210main(int ac, char **av)
211{
b34bec32 212 int i, opt, exit_status;
57112b5a 213 u_short fwd_port, fwd_host_port;
d2e3df16 214 char sfwd_port[6], sfwd_host_port[6];
f5a1a01a 215 char *p, *cp, buf[256];
5260325f 216 struct stat st;
3b1a83df 217 struct passwd *pw;
8ce64345 218 int dummy;
57dade33 219 extern int optind, optreset;
1812a662 220 extern char *optarg;
5260325f 221
260d427b 222 __progname = get_progname(av[0]);
264dce47 223 init_rng();
224
aa3378df 225 /*
226 * Save the original real uid. It will be needed later (uid-swapping
227 * may clobber the real uid).
228 */
5260325f 229 original_real_uid = getuid();
230 original_effective_uid = geteuid();
9f324470 231
232 /*
233 * Use uid-swapping to give up root privileges for the duration of
234 * option processing. We will re-instantiate the rights when we are
235 * ready to create the privileged port, and will permanently drop
236 * them when the port has been created (actually, when the connection
237 * has been made, as we may need to create the port several times).
238 */
239 PRIV_END;
5260325f 240
7322ef0e 241#ifdef HAVE_SETRLIMIT
5260325f 242 /* If we are installed setuid root be careful to not drop core. */
243 if (original_real_uid != original_effective_uid) {
244 struct rlimit rlim;
245 rlim.rlim_cur = rlim.rlim_max = 0;
246 if (setrlimit(RLIMIT_CORE, &rlim) < 0)
247 fatal("setrlimit failed: %.100s", strerror(errno));
8efc0c15 248 }
3c62e7eb 249#endif
63bd8c36 250 /* Get user data. */
251 pw = getpwuid(original_real_uid);
252 if (!pw) {
253 log("You don't exist, go away!");
254 exit(1);
255 }
256 /* Take a copy of the returned structure. */
257 pw = pwcopy(pw);
258
aa3378df 259 /*
260 * Set our umask to something reasonable, as some files are created
261 * with the default umask. This will make them world-readable but
262 * writable only by the owner, which is ok for all files for which we
263 * don't set the modes explicitly.
264 */
5260325f 265 umask(022);
266
5260325f 267 /* Initialize option structure to indicate that no values have been set. */
268 initialize_options(&options);
269
270 /* Parse command-line arguments. */
271 host = NULL;
272
f5a1a01a 273again:
274 while ((opt = getopt(ac, av,
e591b98a 275 "1246ab:c:e:fgi:kl:m:no:p:qstvxACD:F:I:L:NPR:TVX")) != -1) {
5260325f 276 switch (opt) {
1f3bf5aa 277 case '1':
278 options.protocol = SSH_PROTO_1;
279 break;
6ae2364d 280 case '2':
281 options.protocol = SSH_PROTO_2;
282 break;
48e671d5 283 case '4':
284 IPv4or6 = AF_INET;
285 break;
48e671d5 286 case '6':
287 IPv4or6 = AF_INET6;
288 break;
5260325f 289 case 'n':
290 stdin_null_flag = 1;
291 break;
5260325f 292 case 'f':
293 fork_after_authentication_flag = 1;
294 stdin_null_flag = 1;
295 break;
5260325f 296 case 'x':
297 options.forward_x11 = 0;
298 break;
5260325f 299 case 'X':
300 options.forward_x11 = 1;
301 break;
5260325f 302 case 'g':
303 options.gateway_ports = 1;
304 break;
e59404d1 305 case 'P': /* deprecated */
5260325f 306 options.use_privileged_port = 0;
307 break;
5260325f 308 case 'a':
309 options.forward_agent = 0;
310 break;
71276795 311 case 'A':
312 options.forward_agent = 1;
313 break;
5260325f 314#ifdef AFS
315 case 'k':
316 options.kerberos_tgt_passing = 0;
317 options.afs_token_passing = 0;
318 break;
319#endif
320 case 'i':
321 if (stat(optarg, &st) < 0) {
f5a1a01a 322 fprintf(stderr, "Warning: Identity file %s "
323 "does not exist.\n", optarg);
5260325f 324 break;
325 }
f5a1a01a 326 if (options.num_identity_files >=
327 SSH_MAX_IDENTITY_FILES)
328 fatal("Too many identity files specified "
329 "(max %d)", SSH_MAX_IDENTITY_FILES);
330 options.identity_files[options.num_identity_files++] =
331 xstrdup(optarg);
5260325f 332 break;
383546c4 333 case 'I':
334#ifdef SMARTCARD
9ff6f66f 335 options.smartcard_device = xstrdup(optarg);
dd2495cb 336#else
383546c4 337 fprintf(stderr, "no support for smartcards.\n");
dd2495cb 338#endif
383546c4 339 break;
5260325f 340 case 't':
8abcdba4 341 if (tty_flag)
342 force_tty_flag = 1;
5260325f 343 tty_flag = 1;
344 break;
5260325f 345 case 'v':
bcbf86ec 346 if (0 == debug_flag) {
347 debug_flag = 1;
348 options.log_level = SYSLOG_LEVEL_DEBUG1;
349 } else if (options.log_level < SYSLOG_LEVEL_DEBUG3) {
350 options.log_level++;
351 break;
f5a1a01a 352 } else
54b974dc 353 fatal("Too high debugging level.");
bcbf86ec 354 /* fallthrough */
5260325f 355 case 'V':
e68225b2 356 fprintf(stderr,
357 "%s, SSH protocols %d.%d/%d.%d, OpenSSL 0x%8.8lx\n",
a8be9f80 358 SSH_VERSION,
359 PROTOCOL_MAJOR_1, PROTOCOL_MINOR_1,
e68225b2 360 PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2,
361 SSLeay());
5260325f 362 if (opt == 'V')
363 exit(0);
5260325f 364 break;
5260325f 365 case 'q':
366 options.log_level = SYSLOG_LEVEL_QUIET;
367 break;
5260325f 368 case 'e':
369 if (optarg[0] == '^' && optarg[2] == 0 &&
f5a1a01a 370 (u_char) optarg[1] >= 64 &&
371 (u_char) optarg[1] < 128)
1e3b8b07 372 options.escape_char = (u_char) optarg[1] & 31;
5260325f 373 else if (strlen(optarg) == 1)
1e3b8b07 374 options.escape_char = (u_char) optarg[0];
5260325f 375 else if (strcmp(optarg, "none") == 0)
4bf9c10e 376 options.escape_char = SSH_ESCAPECHAR_NONE;
5260325f 377 else {
f5a1a01a 378 fprintf(stderr, "Bad escape character '%s'.\n",
379 optarg);
5260325f 380 exit(1);
381 }
382 break;
5260325f 383 case 'c':
a306f2dd 384 if (ciphers_valid(optarg)) {
385 /* SSH2 only */
386 options.ciphers = xstrdup(optarg);
d0c832f3 387 options.cipher = SSH_CIPHER_ILLEGAL;
a306f2dd 388 } else {
389 /* SSH1 only */
c523303b 390 options.cipher = cipher_number(optarg);
391 if (options.cipher == -1) {
f5a1a01a 392 fprintf(stderr,
393 "Unknown cipher type '%s'\n",
394 optarg);
a306f2dd 395 exit(1);
396 }
f5a1a01a 397 if (options.cipher == SSH_CIPHER_3DES)
c523303b 398 options.ciphers = "3des-cbc";
f5a1a01a 399 else if (options.cipher == SSH_CIPHER_BLOWFISH)
c523303b 400 options.ciphers = "blowfish-cbc";
f5a1a01a 401 else
c523303b 402 options.ciphers = (char *)-1;
5260325f 403 }
404 break;
b2552997 405 case 'm':
406 if (mac_valid(optarg))
407 options.macs = xstrdup(optarg);
408 else {
f5a1a01a 409 fprintf(stderr, "Unknown mac type '%s'\n",
410 optarg);
b2552997 411 exit(1);
412 }
413 break;
5260325f 414 case 'p':
2d2a2c65 415 options.port = a2port(optarg);
416 if (options.port == 0) {
6031af8d 417 fprintf(stderr, "Bad port '%s'\n", optarg);
418 exit(1);
419 }
5260325f 420 break;
5260325f 421 case 'l':
422 options.user = optarg;
423 break;
d2e3df16 424
425 case 'L':
5260325f 426 case 'R':
d2e3df16 427 if (sscanf(optarg, "%5[0-9]:%255[^:]:%5[0-9]",
428 sfwd_port, buf, sfwd_host_port) != 3 &&
429 sscanf(optarg, "%5[0-9]/%255[^/]/%5[0-9]",
430 sfwd_port, buf, sfwd_host_port) != 3) {
f5a1a01a 431 fprintf(stderr,
d2e3df16 432 "Bad forwarding specification '%s'\n",
f5a1a01a 433 optarg);
5260325f 434 usage();
435 /* NOTREACHED */
436 }
d2e3df16 437 if ((fwd_port = a2port(sfwd_port)) == 0 ||
762715ce 438 (fwd_host_port = a2port(sfwd_host_port)) == 0) {
f5a1a01a 439 fprintf(stderr,
d2e3df16 440 "Bad forwarding port(s) '%s'\n", optarg);
441 exit(1);
5260325f 442 }
d2e3df16 443 if (opt == 'L')
444 add_local_forward(&options, fwd_port, buf,
445 fwd_host_port);
446 else if (opt == 'R')
447 add_remote_forward(&options, fwd_port, buf,
184eed6a 448 fwd_host_port);
5260325f 449 break;
0490e609 450
451 case 'D':
2d2a2c65 452 fwd_port = a2port(optarg);
453 if (fwd_port == 0) {
f5a1a01a 454 fprintf(stderr, "Bad dynamic port '%s'\n",
455 optarg);
6031af8d 456 exit(1);
457 }
0490e609 458 add_local_forward(&options, fwd_port, "socks4", 0);
459 break;
460
5260325f 461 case 'C':
462 options.compression = 1;
463 break;
8ce64345 464 case 'N':
465 no_shell_flag = 1;
466 no_tty_flag = 1;
467 break;
8ce64345 468 case 'T':
469 no_tty_flag = 1;
470 break;
5260325f 471 case 'o':
472 dummy = 1;
f5a1a01a 473 if (process_config_line(&options, host ? host : "",
474 optarg, "command-line", 0, &dummy) != 0)
5260325f 475 exit(1);
476 break;
ae810de7 477 case 's':
478 subsystem_flag = 1;
479 break;
3435f5a6 480 case 'b':
481 options.bind_address = optarg;
482 break;
e591b98a 483 case 'F':
484 config = optarg;
485 break;
5260325f 486 default:
487 usage();
488 }
489 }
490
f5a1a01a 491 ac -= optind;
492 av += optind;
493
494 if (ac > 0 && !host && **av != '-') {
495 if (strchr(*av, '@')) {
496 p = xstrdup(*av);
497 cp = strchr(p, '@');
498 if (cp == NULL || cp == p)
499 usage();
500 options.user = p;
501 *cp = '\0';
502 host = ++cp;
503 } else
504 host = *av;
505 ac--, av++;
506 if (ac > 0) {
507 optind = 0;
508 optreset = 1;
509 goto again;
510 }
511 }
512
5260325f 513 /* Check that we got a host name. */
514 if (!host)
8efc0c15 515 usage();
5260325f 516
22d89d24 517 SSLeay_add_all_algorithms();
fa08c86b 518 ERR_load_crypto_strings();
5e4a7219 519 channel_set_af(IPv4or6);
22d89d24 520
5260325f 521 /* Initialize the command to execute on remote host. */
522 buffer_init(&command);
523
aa3378df 524 /*
525 * Save the command to execute on the remote host in a buffer. There
526 * is no limit on the length of the command, except by the maximum
527 * packet size. Also sets the tty flag if there is no command.
528 */
f5a1a01a 529 if (!ac) {
5260325f 530 /* No command specified - execute shell on a tty. */
531 tty_flag = 1;
ae810de7 532 if (subsystem_flag) {
f5a1a01a 533 fprintf(stderr,
534 "You must specify a subsystem to invoke.\n");
ae810de7 535 usage();
536 }
5260325f 537 } else {
f5a1a01a 538 /* A command has been specified. Store it into the buffer. */
539 for (i = 0; i < ac; i++) {
540 if (i)
5260325f 541 buffer_append(&command, " ", 1);
542 buffer_append(&command, av[i], strlen(av[i]));
543 }
8efc0c15 544 }
5260325f 545
546 /* Cannot fork to background if no command. */
14a9a859 547 if (fork_after_authentication_flag && buffer_len(&command) == 0 && !no_shell_flag)
5260325f 548 fatal("Cannot fork into background without a command to execute.");
549
550 /* Allocate a tty by default if no command specified. */
551 if (buffer_len(&command) == 0)
552 tty_flag = 1;
553
343288b8 554 /* Force no tty */
0b6fbf03 555 if (no_tty_flag)
556 tty_flag = 0;
5260325f 557 /* Do not allocate a tty if stdin is not a tty. */
8abcdba4 558 if (!isatty(fileno(stdin)) && !force_tty_flag) {
5260325f 559 if (tty_flag)
54b974dc 560 log("Pseudo-terminal will not be allocated because stdin is not a terminal.");
5260325f 561 tty_flag = 0;
562 }
8ce64345 563
20244695 564 /*
565 * Initialize "log" output. Since we are the client all output
566 * actually goes to stderr.
567 */
cc44f691 568 log_init(av[0], options.log_level == -1 ? SYSLOG_LEVEL_INFO : options.log_level,
569 SYSLOG_FACILITY_USER, 1);
5260325f 570
e591b98a 571 /*
572 * Read per-user configuration file. Ignore the system wide config
573 * file if the user specifies a config file on the command line.
574 */
575 if (config != NULL) {
93111dfa 576 if (!read_config_file(config, host, &options))
577 fatal("Can't open user config file %.100s: "
578 "%.100s", config, strerror(errno));
e591b98a 579 } else {
580 snprintf(buf, sizeof buf, "%.100s/%.100s", pw->pw_dir,
581 _PATH_SSH_USER_CONFFILE);
f67792f2 582 (void)read_config_file(buf, host, &options);
e591b98a 583
f67792f2 584 /* Read systemwide configuration file after use config. */
93111dfa 585 (void)read_config_file(_PATH_HOST_CONFIG_FILE, host, &options);
e591b98a 586 }
5260325f 587
588 /* Fill configuration defaults. */
589 fill_default_options(&options);
590
591 /* reinit */
20244695 592 log_init(av[0], options.log_level, SYSLOG_FACILITY_USER, 1);
5260325f 593
e339aa53 594 seed_rng();
595
5260325f 596 if (options.user == NULL)
597 options.user = xstrdup(pw->pw_name);
598
599 if (options.hostname != NULL)
600 host = options.hostname;
601
5260325f 602 /* Disable rhosts authentication if not running as root. */
3c62e7eb 603#ifdef HAVE_CYGWIN
604 /* Ignore uid if running under Windows */
605 if (!options.use_privileged_port) {
606#else
5260325f 607 if (original_effective_uid != 0 || !options.use_privileged_port) {
3c62e7eb 608#endif
6ffc9c88 609 debug("Rhosts Authentication disabled, "
610 "originating port will not be trusted.");
5260325f 611 options.rhosts_authentication = 0;
5260325f 612 }
6ffc9c88 613 /* Open a connection to the remote host. */
5260325f 614
b34bec32 615 if (ssh_connect(host, &hostaddr, options.port, IPv4or6,
6ffc9c88 616 options.connection_attempts,
d514c907 617#ifdef HAVE_CYGWIN
618 options.use_privileged_port,
619#else
3fb156df 620 original_effective_uid == 0 && options.use_privileged_port,
d514c907 621#endif
de60473e 622 options.proxy_command) != 0)
b34bec32 623 exit(1);
5260325f 624
aa3378df 625 /*
626 * If we successfully made the connection, load the host private key
627 * in case we will need it later for combined rsa-rhosts
628 * authentication. This must be done before releasing extra
629 * privileges, because the file is only readable by root.
78660ed4 630 * If we cannot access the private keys, load the public keys
631 * instead and try to execute the ssh-keysign helper instead.
aa3378df 632 */
8002af61 633 sensitive_data.nkeys = 0;
634 sensitive_data.keys = NULL;
39c00dc2 635 sensitive_data.external_keysign = 0;
b34bec32 636 if (options.rhosts_rsa_authentication ||
637 options.hostbased_authentication) {
8002af61 638 sensitive_data.nkeys = 3;
343288b8 639 sensitive_data.keys = xmalloc(sensitive_data.nkeys *
640 sizeof(Key));
3fb156df 641
642 PRIV_START;
8002af61 643 sensitive_data.keys[0] = key_load_private_type(KEY_RSA1,
aeaa3d9e 644 _PATH_HOST_KEY_FILE, "", NULL);
8002af61 645 sensitive_data.keys[1] = key_load_private_type(KEY_DSA,
646 _PATH_HOST_DSA_KEY_FILE, "", NULL);
647 sensitive_data.keys[2] = key_load_private_type(KEY_RSA,
648 _PATH_HOST_RSA_KEY_FILE, "", NULL);
3fb156df 649 PRIV_END;
39c00dc2 650
60cd0a97 651 if (options.hostbased_authentication == 1 &&
652 sensitive_data.keys[0] == NULL &&
39c00dc2 653 sensitive_data.keys[1] == NULL &&
654 sensitive_data.keys[2] == NULL) {
655 sensitive_data.keys[1] = key_load_public(
656 _PATH_HOST_DSA_KEY_FILE, NULL);
657 sensitive_data.keys[2] = key_load_public(
658 _PATH_HOST_RSA_KEY_FILE, NULL);
659 sensitive_data.external_keysign = 1;
660 }
5260325f 661 }
aa3378df 662 /*
663 * Get rid of any extra privileges that we may have. We will no
664 * longer need them. Also, extra privileges could make it very hard
665 * to read identity files and other non-world-readable files from the
666 * user's home directory if it happens to be on a NFS volume where
667 * root is mapped to nobody.
668 */
3fb156df 669 seteuid(original_real_uid);
670 setuid(original_real_uid);
5260325f 671
aa3378df 672 /*
673 * Now that we are back to our own permissions, create ~/.ssh
674 * directory if it doesn\'t already exist.
675 */
c3abff07 676 snprintf(buf, sizeof buf, "%.100s%s%.100s", pw->pw_dir, strcmp(pw->pw_dir, "/") ? "/" : "", _PATH_SSH_USER_DIR);
5260325f 677 if (stat(buf, &st) < 0)
704b1659 678 if (mkdir(buf, 0700) < 0)
5260325f 679 error("Could not create directory '%.200s'.", buf);
680
fee56204 681 /* load options.identity_files */
682 load_public_identity_files();
683
684 /* Expand ~ in known host file names. */
685 /* XXX mem-leaks: */
fa08c86b 686 options.system_hostfile =
687 tilde_expand_filename(options.system_hostfile, original_real_uid);
688 options.user_hostfile =
689 tilde_expand_filename(options.user_hostfile, original_real_uid);
690 options.system_hostfile2 =
691 tilde_expand_filename(options.system_hostfile2, original_real_uid);
692 options.user_hostfile2 =
693 tilde_expand_filename(options.user_hostfile2, original_real_uid);
5260325f 694
67b75437 695 signal(SIGPIPE, SIG_IGN); /* ignore SIGPIPE early */
696
5260325f 697 /* Log into the remote system. This never returns if the login fails. */
39c00dc2 698 ssh_login(&sensitive_data, host, (struct sockaddr *)&hostaddr, pw);
8002af61 699
700 /* We no longer need the private host keys. Clear them now. */
701 if (sensitive_data.nkeys != 0) {
702 for (i = 0; i < sensitive_data.nkeys; i++) {
703 if (sensitive_data.keys[i] != NULL) {
704 /* Destroys contents safely */
705 debug3("clear hostkey %d", i);
706 key_free(sensitive_data.keys[i]);
707 sensitive_data.keys[i] = NULL;
708 }
709 }
710 xfree(sensitive_data.keys);
711 }
05b7537a 712 for (i = 0; i < options.num_identity_files; i++) {
713 if (options.identity_files[i]) {
714 xfree(options.identity_files[i]);
715 options.identity_files[i] = NULL;
716 }
717 if (options.identity_keys[i]) {
718 key_free(options.identity_keys[i]);
719 options.identity_keys[i] = NULL;
720 }
721 }
5260325f 722
8ce64345 723 exit_status = compat20 ? ssh_session2() : ssh_session();
724 packet_close();
725 return exit_status;
726}
727
396c147e 728static void
b48eeb07 729x11_get_proto(char **_proto, char **_data)
0b242b12 730{
731 char line[512];
b48eeb07 732 static char proto[512], data[512];
0b242b12 733 FILE *f;
734 int got_data = 0, i;
75a624f0 735 char *display;
5d185586 736 struct stat st;
0b242b12 737
b48eeb07 738 *_proto = proto;
739 *_data = data;
740 proto[0] = data[0] = '\0';
5d185586 741 if (!options.xauth_location ||
742 (stat(options.xauth_location, &st) == -1)) {
743 debug("No xauth program.");
744 } else {
745 if ((display = getenv("DISPLAY")) == NULL) {
746 debug("x11_get_proto: DISPLAY not set");
747 return;
748 }
fa649821 749 /* Try to get Xauthority information for the display. */
75a624f0 750 if (strncmp(display, "localhost:", 10) == 0)
751 /*
752 * Handle FamilyLocal case where $DISPLAY does
753 * not match an authorization entry. For this we
754 * just try "xauth list unix:displaynum.screennum".
755 * XXX: "localhost" match to determine FamilyLocal
756 * is not perfect.
757 */
375e20e7 758 snprintf(line, sizeof line, "%s list unix:%s 2>"
75a624f0 759 _PATH_DEVNULL, options.xauth_location, display+10);
760 else
375e20e7 761 snprintf(line, sizeof line, "%s list %.200s 2>"
75a624f0 762 _PATH_DEVNULL, options.xauth_location, display);
5d185586 763 debug2("x11_get_proto: %s", line);
fa649821 764 f = popen(line, "r");
765 if (f && fgets(line, sizeof(line), f) &&
b48eeb07 766 sscanf(line, "%*s %511s %511s", proto, data) == 2)
fa649821 767 got_data = 1;
768 if (f)
769 pclose(f);
770 }
0b242b12 771 /*
772 * If we didn't get authentication data, just make up some
773 * data. The forwarding code will check the validity of the
774 * response anyway, and substitute this data. The X11
775 * server, however, will ignore this fake data and use
776 * whatever authentication mechanisms it was using otherwise
777 * for the local connection.
778 */
779 if (!got_data) {
780 u_int32_t rand = 0;
781
5d185586 782 log("Warning: No xauth data; using fake authentication data for X11 forwarding.");
b48eeb07 783 strlcpy(proto, "MIT-MAGIC-COOKIE-1", sizeof proto);
0b242b12 784 for (i = 0; i < 16; i++) {
785 if (i % 4 == 0)
786 rand = arc4random();
b48eeb07 787 snprintf(data + 2 * i, sizeof data - 2 * i, "%02x", rand & 0xff);
0b242b12 788 rand >>= 8;
789 }
790 }
791}
792
396c147e 793static void
fa08c86b 794ssh_init_forwarding(void)
795{
02a024dd 796 int success = 0;
fa08c86b 797 int i;
02a024dd 798
fa08c86b 799 /* Initiate local TCP/IP port forwardings. */
800 for (i = 0; i < options.num_local_forwards; i++) {
801 debug("Connections to local port %d forwarded to remote address %.200s:%d",
802 options.local_forwards[i].port,
803 options.local_forwards[i].host,
804 options.local_forwards[i].host_port);
5641aefa 805 success += channel_setup_local_fwd_listener(
fa08c86b 806 options.local_forwards[i].port,
807 options.local_forwards[i].host,
808 options.local_forwards[i].host_port,
809 options.gateway_ports);
810 }
02a024dd 811 if (i > 0 && success == 0)
812 error("Could not request local forwarding.");
fa08c86b 813
814 /* Initiate remote TCP/IP port forwardings. */
815 for (i = 0; i < options.num_remote_forwards; i++) {
816 debug("Connections to remote port %d forwarded to local address %.200s:%d",
817 options.remote_forwards[i].port,
818 options.remote_forwards[i].host,
819 options.remote_forwards[i].host_port);
820 channel_request_remote_forwarding(
821 options.remote_forwards[i].port,
822 options.remote_forwards[i].host,
823 options.remote_forwards[i].host_port);
824 }
825}
826
396c147e 827static void
fa08c86b 828check_agent_present(void)
829{
830 if (options.forward_agent) {
831 /* Clear agent forwarding if we don\'t have an agent. */
8b10e20e 832 if (!ssh_agent_present())
fa08c86b 833 options.forward_agent = 0;
fa08c86b 834 }
835}
836
396c147e 837static int
8ce64345 838ssh_session(void)
839{
840 int type;
8ce64345 841 int interactive = 0;
842 int have_tty = 0;
843 struct winsize ws;
8ce64345 844 char *cp;
845
5260325f 846 /* Enable compression if requested. */
847 if (options.compression) {
848 debug("Requesting compression at level %d.", options.compression_level);
849
850 if (options.compression_level < 1 || options.compression_level > 9)
851 fatal("Compression level must be from 1 (fast) to 9 (slow, best).");
852
853 /* Send the request. */
854 packet_start(SSH_CMSG_REQUEST_COMPRESSION);
855 packet_put_int(options.compression_level);
856 packet_send();
857 packet_write_wait();
54a5250f 858 type = packet_read();
5260325f 859 if (type == SSH_SMSG_SUCCESS)
860 packet_start_compression(options.compression_level);
861 else if (type == SSH_SMSG_FAILURE)
862 log("Warning: Remote host refused compression.");
863 else
864 packet_disconnect("Protocol error waiting for compression response.");
865 }
866 /* Allocate a pseudo tty if appropriate. */
867 if (tty_flag) {
868 debug("Requesting pty.");
869
870 /* Start the packet. */
871 packet_start(SSH_CMSG_REQUEST_PTY);
872
873 /* Store TERM in the packet. There is no limit on the
874 length of the string. */
875 cp = getenv("TERM");
876 if (!cp)
877 cp = "";
449c5ba5 878 packet_put_cstring(cp);
5260325f 879
880 /* Store window size in the packet. */
881 if (ioctl(fileno(stdin), TIOCGWINSZ, &ws) < 0)
882 memset(&ws, 0, sizeof(ws));
883 packet_put_int(ws.ws_row);
884 packet_put_int(ws.ws_col);
885 packet_put_int(ws.ws_xpixel);
886 packet_put_int(ws.ws_ypixel);
887
888 /* Store tty modes in the packet. */
30dcc918 889 tty_make_modes(fileno(stdin), NULL);
5260325f 890
891 /* Send the packet, and wait for it to leave. */
892 packet_send();
893 packet_write_wait();
894
895 /* Read response from the server. */
54a5250f 896 type = packet_read();
4fe2af09 897 if (type == SSH_SMSG_SUCCESS) {
5260325f 898 interactive = 1;
8ce64345 899 have_tty = 1;
4fe2af09 900 } else if (type == SSH_SMSG_FAILURE)
5260325f 901 log("Warning: Remote host failed or refused to allocate a pseudo tty.");
902 else
903 packet_disconnect("Protocol error waiting for pty request response.");
904 }
905 /* Request X11 forwarding if enabled and DISPLAY is set. */
906 if (options.forward_x11 && getenv("DISPLAY") != NULL) {
b48eeb07 907 char *proto, *data;
0b242b12 908 /* Get reasonable local authentication information. */
b48eeb07 909 x11_get_proto(&proto, &data);
0b242b12 910 /* Request forwarding with authentication spoofing. */
5260325f 911 debug("Requesting X11 forwarding with authentication spoofing.");
0b242b12 912 x11_request_forwarding_with_spoofing(0, proto, data);
5260325f 913
914 /* Read response from the server. */
54a5250f 915 type = packet_read();
5260325f 916 if (type == SSH_SMSG_SUCCESS) {
5260325f 917 interactive = 1;
0b242b12 918 } else if (type == SSH_SMSG_FAILURE) {
5260325f 919 log("Warning: Remote host denied X11 forwarding.");
0b242b12 920 } else {
5260325f 921 packet_disconnect("Protocol error waiting for X11 forwarding");
0b242b12 922 }
5260325f 923 }
924 /* Tell the packet module whether this is an interactive session. */
b5c334cc 925 packet_set_interactive(interactive);
5260325f 926
927 /* Request authentication agent forwarding if appropriate. */
fa08c86b 928 check_agent_present();
929
5260325f 930 if (options.forward_agent) {
931 debug("Requesting authentication agent forwarding.");
932 auth_request_forwarding();
933
934 /* Read response from the server. */
54a5250f 935 type = packet_read();
95500969 936 packet_check_eom();
5260325f 937 if (type != SSH_SMSG_SUCCESS)
938 log("Warning: Remote host denied authentication agent forwarding.");
939 }
8efc0c15 940
fa08c86b 941 /* Initiate port forwardings. */
942 ssh_init_forwarding();
5260325f 943
aa3378df 944 /* If requested, let ssh continue in the background. */
6ae2364d 945 if (fork_after_authentication_flag)
aa3378df 946 if (daemon(1, 1) < 0)
947 fatal("daemon() failed: %.200s", strerror(errno));
948
949 /*
950 * If a command was specified on the command line, execute the
951 * command now. Otherwise request the server to start a shell.
952 */
5260325f 953 if (buffer_len(&command) > 0) {
954 int len = buffer_len(&command);
955 if (len > 900)
956 len = 900;
6c0fa2b1 957 debug("Sending command: %.*s", len, (u_char *)buffer_ptr(&command));
5260325f 958 packet_start(SSH_CMSG_EXEC_CMD);
959 packet_put_string(buffer_ptr(&command), buffer_len(&command));
960 packet_send();
961 packet_write_wait();
962 } else {
963 debug("Requesting shell.");
964 packet_start(SSH_CMSG_EXEC_SHELL);
965 packet_send();
966 packet_write_wait();
967 }
968
969 /* Enter the interactive session. */
4bf9c10e 970 return client_loop(have_tty, tty_flag ?
971 options.escape_char : SSH_ESCAPECHAR_NONE, 0);
8ce64345 972}
5260325f 973
396c147e 974static void
7819b5c3 975client_subsystem_reply(int type, u_int32_t seq, void *ctxt)
1f3bf5aa 976{
977 int id, len;
978
979 id = packet_get_int();
980 len = buffer_len(&command);
ce91d6f8 981 if (len > 900)
982 len = 900;
95500969 983 packet_check_eom();
1f3bf5aa 984 if (type == SSH2_MSG_CHANNEL_FAILURE)
985 fatal("Request for subsystem '%.*s' failed on channel %d",
6c0fa2b1 986 len, (u_char *)buffer_ptr(&command), id);
1f3bf5aa 987}
988
e0ae8728 989void
990client_global_request_reply(int type, u_int32_t seq, void *ctxt)
991{
992 int i;
993
994 i = client_global_request_id++;
995 if (i >= options.num_remote_forwards) {
996 debug("client_global_request_reply: too many replies %d > %d",
997 i, options.num_remote_forwards);
998 return;
999 }
1000 debug("remote forward %s for: listen %d, connect %s:%d",
1001 type == SSH2_MSG_REQUEST_SUCCESS ? "success" : "failure",
1002 options.remote_forwards[i].port,
1003 options.remote_forwards[i].host,
1004 options.remote_forwards[i].host_port);
1005 if (type == SSH2_MSG_REQUEST_FAILURE)
1006 log("Warning: remote port forwarding failed for listen port %d",
1007 options.remote_forwards[i].port);
1008}
1009
bcdb96c2 1010/* request pty/x11/agent/tcpfwd/shell for channel */
396c147e 1011static void
bcdb96c2 1012ssh_session2_setup(int id, void *arg)
8ce64345 1013{
1014 int len;
b5c334cc 1015 int interactive = 0;
30dcc918 1016 struct termios tio;
b5c334cc 1017
bcdb96c2 1018 debug("ssh_session2_setup: id %d", id);
8ce64345 1019
8ce64345 1020 if (tty_flag) {
1021 struct winsize ws;
1022 char *cp;
1023 cp = getenv("TERM");
1024 if (!cp)
1025 cp = "";
1026 /* Store window size in the packet. */
1027 if (ioctl(fileno(stdin), TIOCGWINSZ, &ws) < 0)
1028 memset(&ws, 0, sizeof(ws));
1029
1030 channel_request_start(id, "pty-req", 0);
1031 packet_put_cstring(cp);
1032 packet_put_int(ws.ws_col);
1033 packet_put_int(ws.ws_row);
1034 packet_put_int(ws.ws_xpixel);
1035 packet_put_int(ws.ws_ypixel);
30dcc918 1036 tio = get_saved_tio();
1037 tty_make_modes(/*ignored*/ 0, &tio);
8ce64345 1038 packet_send();
b5c334cc 1039 interactive = 1;
8ce64345 1040 /* XXX wait for reply */
1041 }
0b242b12 1042 if (options.forward_x11 &&
1043 getenv("DISPLAY") != NULL) {
b48eeb07 1044 char *proto, *data;
0b242b12 1045 /* Get reasonable local authentication information. */
b48eeb07 1046 x11_get_proto(&proto, &data);
0b242b12 1047 /* Request forwarding with authentication spoofing. */
1048 debug("Requesting X11 forwarding with authentication spoofing.");
1049 x11_request_forwarding_with_spoofing(id, proto, data);
b5c334cc 1050 interactive = 1;
0b242b12 1051 /* XXX wait for reply */
1052 }
1053
fa08c86b 1054 check_agent_present();
1055 if (options.forward_agent) {
1056 debug("Requesting authentication agent forwarding.");
1057 channel_request_start(id, "auth-agent-req@openssh.com", 0);
1058 packet_send();
1059 }
1060
8ce64345 1061 len = buffer_len(&command);
1062 if (len > 0) {
1063 if (len > 900)
1064 len = 900;
ae810de7 1065 if (subsystem_flag) {
6c0fa2b1 1066 debug("Sending subsystem: %.*s", len, (u_char *)buffer_ptr(&command));
1f3bf5aa 1067 channel_request_start(id, "subsystem", /*want reply*/ 1);
1068 /* register callback for reply */
c242fc96 1069 /* XXX we assume that client_loop has already been called */
1f3bf5aa 1070 dispatch_set(SSH2_MSG_CHANNEL_FAILURE, &client_subsystem_reply);
1071 dispatch_set(SSH2_MSG_CHANNEL_SUCCESS, &client_subsystem_reply);
ae810de7 1072 } else {
6c0fa2b1 1073 debug("Sending command: %.*s", len, (u_char *)buffer_ptr(&command));
ae810de7 1074 channel_request_start(id, "exec", 0);
1075 }
ce91d6f8 1076 packet_put_string(buffer_ptr(&command), buffer_len(&command));
8ce64345 1077 packet_send();
1078 } else {
06ee33fb 1079 channel_request_start(id, "shell", 0);
1080 packet_send();
8ce64345 1081 }
1f3bf5aa 1082
b5c334cc 1083 packet_set_interactive(interactive);
8ce64345 1084}
1085
bcdb96c2 1086/* open new channel for a session */
396c147e 1087static int
bcdb96c2 1088ssh_session2_open(void)
8ce64345 1089{
719fc62f 1090 Channel *c;
1091 int window, packetmax, in, out, err;
2e73a022 1092
14a9a859 1093 if (stdin_null_flag) {
5ca51e19 1094 in = open(_PATH_DEVNULL, O_RDONLY);
14a9a859 1095 } else {
1096 in = dup(STDIN_FILENO);
1097 }
2e73a022 1098 out = dup(STDOUT_FILENO);
1099 err = dup(STDERR_FILENO);
8ce64345 1100
1101 if (in < 0 || out < 0 || err < 0)
14a9a859 1102 fatal("dup() in/out/err failed");
8ce64345 1103
a22aff1f 1104 /* enable nonblocking unless tty */
1105 if (!isatty(in))
1106 set_nonblock(in);
1107 if (!isatty(out))
1108 set_nonblock(out);
1109 if (!isatty(err))
1110 set_nonblock(err);
1111
bcbf86ec 1112 window = CHAN_SES_WINDOW_DEFAULT;
1113 packetmax = CHAN_SES_PACKET_DEFAULT;
ea9700ba 1114 if (tty_flag) {
1115 window >>= 1;
1116 packetmax >>= 1;
8ce64345 1117 }
719fc62f 1118 c = channel_new(
8ce64345 1119 "session", SSH_CHANNEL_OPENING, in, out, err,
bcbf86ec 1120 window, packetmax, CHAN_EXTENDED_WRITE,
a22aff1f 1121 xstrdup("client-session"), /*nonblock*/0);
8ce64345 1122
bcdb96c2 1123 debug3("ssh_session2_open: channel_new: %d", c->self);
eb0dd41f 1124
36e1f6a1 1125 channel_send_open(c->self);
bcdb96c2 1126 if (!no_shell_flag)
05ca0898 1127 channel_register_confirm(c->self, ssh_session2_setup);
5260325f 1128
719fc62f 1129 return c->self;
eb0dd41f 1130}
1131
396c147e 1132static int
eb0dd41f 1133ssh_session2(void)
1134{
bcdb96c2 1135 int id = -1;
eb0dd41f 1136
1137 /* XXX should be pre-session */
1138 ssh_init_forwarding();
1139
bcdb96c2 1140 if (!no_shell_flag || (datafellows & SSH_BUG_DUMMYCHAN))
1141 id = ssh_session2_open();
eb0dd41f 1142
1143 /* If requested, let ssh continue in the background. */
1144 if (fork_after_authentication_flag)
1145 if (daemon(1, 1) < 0)
1146 fatal("daemon() failed: %.200s", strerror(errno));
1147
4bf9c10e 1148 return client_loop(tty_flag, tty_flag ?
1149 options.escape_char : SSH_ESCAPECHAR_NONE, id);
8efc0c15 1150}
fa08c86b 1151
396c147e 1152static void
fee56204 1153load_public_identity_files(void)
1154{
1155 char *filename;
2e23cde0 1156 int i = 0;
0659cace 1157 Key *public;
383546c4 1158#ifdef SMARTCARD
0659cace 1159 Key **keys;
1160
9ff6f66f 1161 if (options.smartcard_device != NULL &&
0659cace 1162 options.num_identity_files < SSH_MAX_IDENTITY_FILES &&
1163 (keys = sc_get_keys(options.smartcard_device, NULL)) != NULL ) {
1164 int count = 0;
1165 for (i = 0; keys[i] != NULL; i++) {
1166 count++;
0659cace 1167 memmove(&options.identity_files[1], &options.identity_files[0],
1168 sizeof(char *) * (SSH_MAX_IDENTITY_FILES - 1));
1169 memmove(&options.identity_keys[1], &options.identity_keys[0],
1170 sizeof(Key *) * (SSH_MAX_IDENTITY_FILES - 1));
1171 options.num_identity_files++;
1172 options.identity_keys[0] = keys[i];
1173 options.identity_files[0] = xstrdup("smartcard key");;
1174 }
1c2deed1 1175 if (options.num_identity_files > SSH_MAX_IDENTITY_FILES)
1176 options.num_identity_files = SSH_MAX_IDENTITY_FILES;
0659cace 1177 i = count;
1178 xfree(keys);
383546c4 1179 }
3e984472 1180#endif /* SMARTCARD */
2e23cde0 1181 for (; i < options.num_identity_files; i++) {
1182 filename = tilde_expand_filename(options.identity_files[i],
1183 original_real_uid);
1184 public = key_load_public(filename, NULL);
1185 debug("identity file %s type %d", filename,
1186 public ? public->type : -1);
1187 xfree(options.identity_files[i]);
1188 options.identity_files[i] = filename;
1189 options.identity_keys[i] = public;
1190 }
fee56204 1191}
This page took 0.654588 seconds and 5 git commands to generate.