2 * Copyright (c) 2000 Markus Friedl. All rights reserved.
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26 RCSID("$OpenBSD: sshconnect2.c,v 1.69 2001/04/15 08:43:47 markus Exp $");
28 #include <openssl/bn.h>
29 #include <openssl/md5.h>
30 #include <openssl/dh.h>
31 #include <openssl/hmac.h>
44 #include "myproposal.h"
46 #include "sshconnect.h"
59 extern char *client_version_string;
60 extern char *server_version_string;
61 extern Options options;
67 u_char *session_id2 = NULL;
68 int session_id2_len = 0;
71 struct sockaddr *xxx_hostaddr;
76 check_host_key_callback(Key *hostkey)
78 check_host_key(xxx_host, xxx_hostaddr, hostkey,
79 options.user_hostfile2, options.system_hostfile2);
84 ssh_kex2(char *host, struct sockaddr *hostaddr)
89 xxx_hostaddr = hostaddr;
91 if (options.ciphers == (char *)-1) {
92 log("No valid ciphers for protocol version 2 given, using defaults.");
93 options.ciphers = NULL;
95 if (options.ciphers != NULL) {
96 myproposal[PROPOSAL_ENC_ALGS_CTOS] =
97 myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
99 myproposal[PROPOSAL_ENC_ALGS_CTOS] =
100 compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]);
101 myproposal[PROPOSAL_ENC_ALGS_STOC] =
102 compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_STOC]);
103 if (options.compression) {
104 myproposal[PROPOSAL_COMP_ALGS_CTOS] =
105 myproposal[PROPOSAL_COMP_ALGS_STOC] = "zlib";
107 myproposal[PROPOSAL_COMP_ALGS_CTOS] =
108 myproposal[PROPOSAL_COMP_ALGS_STOC] = "none";
110 if (options.macs != NULL) {
111 myproposal[PROPOSAL_MAC_ALGS_CTOS] =
112 myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
115 /* start key exchange */
116 kex = kex_setup(myproposal);
117 kex->client_version_string=client_version_string;
118 kex->server_version_string=server_version_string;
119 kex->check_host_key=&check_host_key_callback;
123 dispatch_run(DISPATCH_BLOCK, &kex->done, kex);
125 session_id2 = kex->session_id;
126 session_id2_len = kex->session_id_len;
129 /* send 1st encrypted/maced/compressed message */
130 packet_start(SSH2_MSG_IGNORE);
131 packet_put_cstring("markus");
135 debug("done: ssh_kex2.");
142 typedef struct Authctxt Authctxt;
143 typedef struct Authmethod Authmethod;
145 typedef int sign_cb_fn(
146 Authctxt *authctxt, Key *key,
147 u_char **sigp, int *lenp, u_char *data, int datalen);
150 const char *server_user;
151 const char *local_user;
159 sign_cb_fn *last_key_sign;
161 AuthenticationConnection *agent;
167 char *name; /* string to compare against server's list */
168 int (*userauth)(Authctxt *authctxt);
169 int *enabled; /* flag in option struct that enables method */
170 int *batch_flag; /* flag in option struct that disables method */
173 void input_userauth_success(int type, int plen, void *ctxt);
174 void input_userauth_failure(int type, int plen, void *ctxt);
175 void input_userauth_banner(int type, int plen, void *ctxt);
176 void input_userauth_error(int type, int plen, void *ctxt);
177 void input_userauth_info_req(int type, int plen, void *ctxt);
178 void input_userauth_pk_ok(int type, int plen, void *ctxt);
180 int userauth_none(Authctxt *authctxt);
181 int userauth_pubkey(Authctxt *authctxt);
182 int userauth_passwd(Authctxt *authctxt);
183 int userauth_kbdint(Authctxt *authctxt);
184 int userauth_hostbased(Authctxt *authctxt);
186 void userauth(Authctxt *authctxt, char *authlist);
189 sign_and_send_pubkey(Authctxt *authctxt, Key *k,
190 sign_cb_fn *sign_callback);
191 void clear_auth_state(Authctxt *authctxt);
193 Authmethod *authmethod_get(char *authlist);
194 Authmethod *authmethod_lookup(const char *name);
195 char *authmethods_get(void);
197 Authmethod authmethods[] = {
200 &options.pubkey_authentication,
204 &options.password_authentication,
205 &options.batch_mode},
206 {"keyboard-interactive",
208 &options.kbd_interactive_authentication,
209 &options.batch_mode},
212 &options.hostbased_authentication,
218 {NULL, NULL, NULL, NULL}
222 ssh_userauth2(const char *local_user, const char *server_user, char *host,
223 Key **keys, int nkeys)
229 if (options.challenge_reponse_authentication)
230 options.kbd_interactive_authentication = 1;
232 debug("send SSH2_MSG_SERVICE_REQUEST");
233 packet_start(SSH2_MSG_SERVICE_REQUEST);
234 packet_put_cstring("ssh-userauth");
237 type = packet_read(&plen);
238 if (type != SSH2_MSG_SERVICE_ACCEPT) {
239 fatal("denied SSH2_MSG_SERVICE_ACCEPT: %d", type);
241 if (packet_remaining() > 0) {
242 char *reply = packet_get_string(&plen);
243 debug("service_accept: %s", reply);
246 debug("buggy server: service_accept w/o service");
249 debug("got SSH2_MSG_SERVICE_ACCEPT");
251 if (options.preferred_authentications == NULL)
252 options.preferred_authentications = authmethods_get();
254 /* setup authentication context */
255 authctxt.agent = ssh_get_authentication_connection();
256 authctxt.server_user = server_user;
257 authctxt.local_user = local_user;
258 authctxt.host = host;
259 authctxt.service = "ssh-connection"; /* service name */
260 authctxt.success = 0;
261 authctxt.method = authmethod_lookup("none");
262 authctxt.authlist = NULL;
263 authctxt.keys = keys;
264 authctxt.nkeys = nkeys;
265 if (authctxt.method == NULL)
266 fatal("ssh_userauth2: internal error: cannot send userauth none request");
268 /* initial userauth request */
269 userauth_none(&authctxt);
271 dispatch_init(&input_userauth_error);
272 dispatch_set(SSH2_MSG_USERAUTH_SUCCESS, &input_userauth_success);
273 dispatch_set(SSH2_MSG_USERAUTH_FAILURE, &input_userauth_failure);
274 dispatch_set(SSH2_MSG_USERAUTH_BANNER, &input_userauth_banner);
275 dispatch_run(DISPATCH_BLOCK, &authctxt.success, &authctxt); /* loop until success */
277 if (authctxt.agent != NULL)
278 ssh_close_authentication_connection(authctxt.agent);
280 debug("ssh-userauth2 successful: method %s", authctxt.method->name);
283 userauth(Authctxt *authctxt, char *authlist)
285 if (authlist == NULL) {
286 authlist = authctxt->authlist;
288 if (authctxt->authlist)
289 xfree(authctxt->authlist);
290 authctxt->authlist = authlist;
293 Authmethod *method = authmethod_get(authlist);
295 fatal("Permission denied (%s).", authlist);
296 authctxt->method = method;
297 if (method->userauth(authctxt) != 0) {
298 debug2("we sent a %s packet, wait for reply", method->name);
301 debug2("we did not send a packet, disable method");
302 method->enabled = NULL;
307 input_userauth_error(int type, int plen, void *ctxt)
309 fatal("input_userauth_error: bad message during authentication: "
313 input_userauth_banner(int type, int plen, void *ctxt)
316 debug3("input_userauth_banner");
317 msg = packet_get_string(NULL);
318 lang = packet_get_string(NULL);
319 fprintf(stderr, "%s", msg);
324 input_userauth_success(int type, int plen, void *ctxt)
326 Authctxt *authctxt = ctxt;
327 if (authctxt == NULL)
328 fatal("input_userauth_success: no authentication context");
329 if (authctxt->authlist)
330 xfree(authctxt->authlist);
331 clear_auth_state(authctxt);
332 authctxt->success = 1; /* break out */
335 input_userauth_failure(int type, int plen, void *ctxt)
337 Authctxt *authctxt = ctxt;
338 char *authlist = NULL;
341 if (authctxt == NULL)
342 fatal("input_userauth_failure: no authentication context");
344 authlist = packet_get_string(NULL);
345 partial = packet_get_char();
349 log("Authenticated with partial success.");
350 debug("authentications that can continue: %s", authlist);
352 clear_auth_state(authctxt);
353 userauth(authctxt, authlist);
356 input_userauth_pk_ok(int type, int plen, void *ctxt)
358 Authctxt *authctxt = ctxt;
361 int alen, blen, sent = 0;
362 char *pkalg, *pkblob, *fp;
364 if (authctxt == NULL)
365 fatal("input_userauth_pk_ok: no authentication context");
366 if (datafellows & SSH_BUG_PKOK) {
367 /* this is similar to SSH_BUG_PKAUTH */
368 debug2("input_userauth_pk_ok: SSH_BUG_PKOK");
369 pkblob = packet_get_string(&blen);
371 buffer_append(&b, pkblob, blen);
372 pkalg = buffer_get_string(&b, &alen);
375 pkalg = packet_get_string(&alen);
376 pkblob = packet_get_string(&blen);
380 debug("input_userauth_pk_ok: pkalg %s blen %d lastkey %p hint %d",
381 pkalg, blen, authctxt->last_key, authctxt->last_key_hint);
384 if (authctxt->last_key == NULL ||
385 authctxt->last_key_sign == NULL) {
386 debug("no last key or no sign cb");
389 if (key_type_from_name(pkalg) == KEY_UNSPEC) {
390 debug("unknown pkalg %s", pkalg);
393 if ((key = key_from_blob(pkblob, blen)) == NULL) {
394 debug("no key from blob. pkalg %s", pkalg);
397 fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
398 debug2("input_userauth_pk_ok: fp %s", fp);
400 if (!key_equal(key, authctxt->last_key)) {
401 debug("key != last_key");
404 sent = sign_and_send_pubkey(authctxt, key,
405 authctxt->last_key_sign);
414 clear_auth_state(authctxt);
415 dispatch_set(SSH2_MSG_USERAUTH_PK_OK, NULL);
417 /* try another method if we did not send a packet*/
419 userauth(authctxt, NULL);
424 userauth_none(Authctxt *authctxt)
426 /* initial userauth request */
427 packet_start(SSH2_MSG_USERAUTH_REQUEST);
428 packet_put_cstring(authctxt->server_user);
429 packet_put_cstring(authctxt->service);
430 packet_put_cstring(authctxt->method->name);
436 userauth_passwd(Authctxt *authctxt)
438 static int attempt = 0;
442 if (attempt++ >= options.number_of_password_prompts)
446 error("Permission denied, please try again.");
448 snprintf(prompt, sizeof(prompt), "%.30s@%.128s's password: ",
449 authctxt->server_user, authctxt->host);
450 password = read_passphrase(prompt, 0);
451 packet_start(SSH2_MSG_USERAUTH_REQUEST);
452 packet_put_cstring(authctxt->server_user);
453 packet_put_cstring(authctxt->service);
454 packet_put_cstring(authctxt->method->name);
456 packet_put_cstring(password);
457 memset(password, 0, strlen(password));
459 packet_inject_ignore(64);
465 clear_auth_state(Authctxt *authctxt)
467 /* XXX clear authentication state */
468 if (authctxt->last_key != NULL && authctxt->last_key_hint == -1) {
469 debug3("clear_auth_state: key_free %p", authctxt->last_key);
470 key_free(authctxt->last_key);
472 authctxt->last_key = NULL;
473 authctxt->last_key_hint = -2;
474 authctxt->last_key_sign = NULL;
478 sign_and_send_pubkey(Authctxt *authctxt, Key *k, sign_cb_fn *sign_callback)
481 u_char *blob, *signature;
487 debug3("sign_and_send_pubkey");
489 if (key_to_blob(k, &blob, &bloblen) == 0) {
490 /* we cannot handle this key */
491 debug3("sign_and_send_pubkey: cannot handle key");
494 /* data to be signed */
496 if (datafellows & SSH_OLD_SESSIONID) {
497 buffer_append(&b, session_id2, session_id2_len);
498 skip = session_id2_len;
500 buffer_put_string(&b, session_id2, session_id2_len);
501 skip = buffer_len(&b);
503 buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
504 buffer_put_cstring(&b, authctxt->server_user);
505 buffer_put_cstring(&b,
506 datafellows & SSH_BUG_PKSERVICE ?
509 if (datafellows & SSH_BUG_PKAUTH) {
510 buffer_put_char(&b, have_sig);
512 buffer_put_cstring(&b, authctxt->method->name);
513 buffer_put_char(&b, have_sig);
514 buffer_put_cstring(&b, key_ssh_name(k));
516 buffer_put_string(&b, blob, bloblen);
518 /* generate signature */
519 ret = (*sign_callback)(authctxt, k, &signature, &slen,
520 buffer_ptr(&b), buffer_len(&b));
529 if (datafellows & SSH_BUG_PKSERVICE) {
531 buffer_append(&b, session_id2, session_id2_len);
532 skip = session_id2_len;
533 buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
534 buffer_put_cstring(&b, authctxt->server_user);
535 buffer_put_cstring(&b, authctxt->service);
536 buffer_put_cstring(&b, authctxt->method->name);
537 buffer_put_char(&b, have_sig);
538 if (!(datafellows & SSH_BUG_PKAUTH))
539 buffer_put_cstring(&b, key_ssh_name(k));
540 buffer_put_string(&b, blob, bloblen);
544 /* append signature */
545 buffer_put_string(&b, signature, slen);
548 /* skip session id and packet type */
549 if (buffer_len(&b) < skip + 1)
550 fatal("userauth_pubkey: internal error");
551 buffer_consume(&b, skip + 1);
553 /* put remaining data from buffer into packet */
554 packet_start(SSH2_MSG_USERAUTH_REQUEST);
555 packet_put_raw(buffer_ptr(&b), buffer_len(&b));
563 send_pubkey_test(Authctxt *authctxt, Key *k, sign_cb_fn *sign_callback,
567 int bloblen, have_sig = 0;
569 debug3("send_pubkey_test");
571 if (key_to_blob(k, &blob, &bloblen) == 0) {
572 /* we cannot handle this key */
573 debug3("send_pubkey_test: cannot handle key");
576 /* register callback for USERAUTH_PK_OK message */
577 authctxt->last_key_sign = sign_callback;
578 authctxt->last_key_hint = hint;
579 authctxt->last_key = k;
580 dispatch_set(SSH2_MSG_USERAUTH_PK_OK, &input_userauth_pk_ok);
582 packet_start(SSH2_MSG_USERAUTH_REQUEST);
583 packet_put_cstring(authctxt->server_user);
584 packet_put_cstring(authctxt->service);
585 packet_put_cstring(authctxt->method->name);
586 packet_put_char(have_sig);
587 if (!(datafellows & SSH_BUG_PKAUTH))
588 packet_put_cstring(key_ssh_name(k));
589 packet_put_string(blob, bloblen);
596 load_identity_file(char *filename)
599 char prompt[300], *passphrase;
603 if (stat(filename, &st) < 0) {
604 debug3("no such identity: %s", filename);
607 private = key_load_private_type(KEY_UNSPEC, filename, "", NULL);
608 if (private == NULL) {
609 if (options.batch_mode)
611 snprintf(prompt, sizeof prompt,
612 "Enter passphrase for key '%.100s': ", filename);
613 for (i = 0; i < options.number_of_password_prompts; i++) {
614 passphrase = read_passphrase(prompt, 0);
615 if (strcmp(passphrase, "") != 0) {
616 private = key_load_private_type(KEY_UNSPEC, filename,
620 debug2("no passphrase given, try next key");
623 memset(passphrase, 0, strlen(passphrase));
625 if (private != NULL || quit)
627 debug2("bad passphrase given, try again...");
634 identity_sign_cb(Authctxt *authctxt, Key *key, u_char **sigp, int *lenp,
635 u_char *data, int datalen)
640 idx = authctxt->last_key_hint;
643 private = load_identity_file(options.identity_files[idx]);
646 ret = key_sign(private, sigp, lenp, data, datalen);
651 int agent_sign_cb(Authctxt *authctxt, Key *key, u_char **sigp, int *lenp,
652 u_char *data, int datalen)
654 return ssh_agent_sign(authctxt->agent, key, sigp, lenp, data, datalen);
657 int key_sign_cb(Authctxt *authctxt, Key *key, u_char **sigp, int *lenp,
658 u_char *data, int datalen)
660 return key_sign(key, sigp, lenp, data, datalen);
664 userauth_pubkey_agent(Authctxt *authctxt)
666 static int called = 0;
672 if (ssh_get_num_identities(authctxt->agent, 2) == 0)
673 debug2("userauth_pubkey_agent: no keys at all");
676 k = ssh_get_next_identity(authctxt->agent, &comment, 2);
678 debug2("userauth_pubkey_agent: no more keys");
680 debug("userauth_pubkey_agent: testing agent key %s", comment);
682 ret = send_pubkey_test(authctxt, k, agent_sign_cb, -1);
687 debug2("userauth_pubkey_agent: no message sent");
692 userauth_pubkey(Authctxt *authctxt)
699 if (authctxt->agent != NULL) {
701 sent = userauth_pubkey_agent(authctxt);
702 } while(!sent && authctxt->agent->howmany > 0);
704 while (!sent && idx < options.num_identity_files) {
705 key = options.identity_keys[idx];
706 filename = options.identity_files[idx];
708 debug("try privkey: %s", filename);
709 key = load_identity_file(filename);
711 sent = sign_and_send_pubkey(authctxt, key,
715 } else if (key->type != KEY_RSA1) {
716 debug("try pubkey: %s", filename);
717 sent = send_pubkey_test(authctxt, key,
718 identity_sign_cb, idx);
726 * Send userauth request message specifying keyboard-interactive method.
729 userauth_kbdint(Authctxt *authctxt)
731 static int attempt = 0;
733 if (attempt++ >= options.number_of_password_prompts)
736 debug2("userauth_kbdint");
737 packet_start(SSH2_MSG_USERAUTH_REQUEST);
738 packet_put_cstring(authctxt->server_user);
739 packet_put_cstring(authctxt->service);
740 packet_put_cstring(authctxt->method->name);
741 packet_put_cstring(""); /* lang */
742 packet_put_cstring(options.kbd_interactive_devices ?
743 options.kbd_interactive_devices : "");
746 dispatch_set(SSH2_MSG_USERAUTH_INFO_REQUEST, &input_userauth_info_req);
751 * parse INFO_REQUEST, prompt user and send INFO_RESPONSE
754 input_userauth_info_req(int type, int plen, void *ctxt)
756 Authctxt *authctxt = ctxt;
757 char *name, *inst, *lang, *prompt, *response;
758 u_int num_prompts, i;
761 debug2("input_userauth_info_req");
763 if (authctxt == NULL)
764 fatal("input_userauth_info_req: no authentication context");
766 name = packet_get_string(NULL);
767 inst = packet_get_string(NULL);
768 lang = packet_get_string(NULL);
769 if (strlen(name) > 0)
771 if (strlen(inst) > 0)
777 num_prompts = packet_get_int();
779 * Begin to build info response packet based on prompts requested.
780 * We commit to providing the correct number of responses, so if
781 * further on we run into a problem that prevents this, we have to
782 * be sure and clean this up and send a correct error response.
784 packet_start(SSH2_MSG_USERAUTH_INFO_RESPONSE);
785 packet_put_int(num_prompts);
787 for (i = 0; i < num_prompts; i++) {
788 prompt = packet_get_string(NULL);
789 echo = packet_get_char();
791 response = cli_prompt(prompt, echo);
793 packet_put_cstring(response);
794 memset(response, 0, strlen(response));
798 packet_done(); /* done with parsing incoming message. */
800 packet_inject_ignore(64);
805 * this will be move to an external program (ssh-keysign) ASAP. ssh-keysign
806 * will be setuid-root and the sbit can be removed from /usr/bin/ssh.
809 userauth_hostbased(Authctxt *authctxt)
813 u_char *signature, *blob;
814 char *chost, *pkalg, *p;
816 int ok, i, found = 0;
818 p = get_local_name(packet_get_connection_in());
820 error("userauth_hostbased: cannot get local ipaddr/name");
824 debug2("userauth_hostbased: chost %s", chost);
825 /* check for a useful key */
826 for (i = 0; i < authctxt->nkeys; i++) {
827 private = authctxt->keys[i];
828 if (private && private->type != KEY_RSA1) {
830 /* we take and free the key */
831 authctxt->keys[i] = NULL;
839 if (key_to_blob(private, &blob, &blen) == 0) {
844 pkalg = xstrdup(key_ssh_name(private));
846 if (datafellows & SSH_OLD_SESSIONID) {
847 buffer_append(&b, session_id2, session_id2_len);
849 buffer_put_string(&b, session_id2, session_id2_len);
852 buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
853 buffer_put_cstring(&b, authctxt->server_user);
854 buffer_put_cstring(&b,
855 datafellows & SSH_BUG_HBSERVICE ?
858 buffer_put_cstring(&b, authctxt->method->name);
859 buffer_put_cstring(&b, pkalg);
860 buffer_put_string(&b, blob, blen);
861 buffer_put_cstring(&b, chost);
862 buffer_put_cstring(&b, authctxt->local_user);
866 debug2("xxx: chost %s", chost);
867 ok = key_sign(private, &signature, &slen, buffer_ptr(&b), buffer_len(&b));
871 error("key_sign failed");
876 packet_start(SSH2_MSG_USERAUTH_REQUEST);
877 packet_put_cstring(authctxt->server_user);
878 packet_put_cstring(authctxt->service);
879 packet_put_cstring(authctxt->method->name);
880 packet_put_cstring(pkalg);
881 packet_put_string(blob, blen);
882 packet_put_cstring(chost);
883 packet_put_cstring(authctxt->local_user);
884 packet_put_string(signature, slen);
885 memset(signature, 's', slen);
894 /* find auth method */
897 * given auth method name, if configurable options permit this method fill
898 * in auth_ident field and return true, otherwise return false.
901 authmethod_is_enabled(Authmethod *method)
905 /* return false if options indicate this method is disabled */
906 if (method->enabled == NULL || *method->enabled == 0)
908 /* return false if batch mode is enabled but method needs interactive mode */
909 if (method->batch_flag != NULL && *method->batch_flag != 0)
915 authmethod_lookup(const char *name)
917 Authmethod *method = NULL;
919 for (method = authmethods; method->name != NULL; method++)
920 if (strcmp(name, method->name) == 0)
922 debug2("Unrecognized authentication method name: %s", name ? name : "NULL");
926 /* XXX internal state */
927 static Authmethod *current = NULL;
928 static char *supported = NULL;
929 static char *preferred = NULL;
931 * Given the authentication method list sent by the server, return the
932 * next method we should try. If the server initially sends a nil list,
933 * use a built-in default list.
936 authmethod_get(char *authlist)
942 /* Use a suitable default if we're passed a nil list. */
943 if (authlist == NULL || strlen(authlist) == 0)
944 authlist = options.preferred_authentications;
946 if (supported == NULL || strcmp(authlist, supported) != 0) {
947 debug3("start over, passed a different list %s", authlist);
948 if (supported != NULL)
950 supported = xstrdup(authlist);
951 preferred = options.preferred_authentications;
952 debug3("preferred %s", preferred);
954 } else if (current != NULL && authmethod_is_enabled(current))
958 if ((name = match_list(preferred, supported, &next)) == NULL) {
959 debug("no more auth methods to try");
964 debug3("authmethod_lookup %s", name);
965 debug3("remaining preferred: %s", preferred);
966 if ((current = authmethod_lookup(name)) != NULL &&
967 authmethod_is_enabled(current)) {
968 debug3("authmethod_is_enabled %s", name);
969 debug("next auth method to try is %s", name);
978 authmethods_get(void)
980 Authmethod *method = NULL;
984 for (method = authmethods; method->name != NULL; method++) {
985 if (authmethod_is_enabled(method)) {
987 strlcat(buf, DELIM, sizeof buf);
988 strlcat(buf, method->name, sizeof buf);