2 * Author: Tatu Ylonen <ylo@cs.hut.fi>
3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5 * Created: Sat Mar 18 22:15:47 1995 ylo
6 * Code to connect to a remote host, and to perform the client side of the
7 * login (authentication) dialog.
9 * SSH2 support added by Markus Friedl.
13 RCSID("$OpenBSD: sshconnect.c,v 1.69 2000/04/19 07:05:50 deraadt Exp $");
15 #include <openssl/bn.h>
29 #include <openssl/rsa.h>
30 #include <openssl/dsa.h>
33 #include <openssl/md5.h>
34 #include <openssl/dh.h>
35 #include <openssl/hmac.h>
37 #include "myproposal.h"
42 /* Session id for the current session. */
43 unsigned char session_id[16];
45 /* authentications supported by server */
46 unsigned int supported_authentications;
48 static char *client_version_string = NULL;
49 static char *server_version_string = NULL;
51 extern Options options;
52 extern char *__progname;
55 * Connect to the given ssh server using a proxy command.
58 ssh_proxy_connect(const char *host, u_short port, uid_t original_real_uid,
59 const char *proxy_command)
66 char strport[NI_MAXSERV];
68 /* Convert the port number into a string. */
69 snprintf(strport, sizeof strport, "%hu", port);
71 /* Build the final command string in the buffer by making the
72 appropriate substitutions to the given proxy command. */
73 buffer_init(&command);
74 for (cp = proxy_command; *cp; cp++) {
75 if (cp[0] == '%' && cp[1] == '%') {
76 buffer_append(&command, "%", 1);
80 if (cp[0] == '%' && cp[1] == 'h') {
81 buffer_append(&command, host, strlen(host));
85 if (cp[0] == '%' && cp[1] == 'p') {
86 buffer_append(&command, strport, strlen(strport));
90 buffer_append(&command, cp, 1);
92 buffer_append(&command, "\0", 1);
94 /* Get the final command string. */
95 command_string = buffer_ptr(&command);
97 /* Create pipes for communicating with the proxy. */
98 if (pipe(pin) < 0 || pipe(pout) < 0)
99 fatal("Could not create pipes to communicate with the proxy: %.100s",
102 debug("Executing proxy command: %.500s", command_string);
104 /* Fork and execute the proxy command. */
105 if ((pid = fork()) == 0) {
108 /* Child. Permanently give up superuser privileges. */
109 permanently_set_uid(original_real_uid);
111 /* Redirect stdin and stdout. */
114 if (dup2(pin[0], 0) < 0)
115 perror("dup2 stdin");
119 if (dup2(pout[1], 1) < 0)
120 perror("dup2 stdout");
121 /* Cannot be 1 because pin allocated two descriptors. */
124 /* Stderr is left as it is so that error messages get
125 printed on the user's terminal. */
128 argv[2] = command_string;
131 /* Execute the proxy command. Note that we gave up any
132 extra privileges above. */
133 execv("/bin/sh", argv);
139 fatal("fork failed: %.100s", strerror(errno));
141 /* Close child side of the descriptors. */
145 /* Free the command name. */
146 buffer_free(&command);
148 /* Set the connection file descriptors. */
149 packet_set_connection(pout[0], pin[1]);
155 * Creates a (possibly privileged) socket for use as the ssh connection.
158 ssh_create_socket(uid_t original_real_uid, int privileged, int family)
163 * If we are running as root and want to connect to a privileged
164 * port, bind our own socket to a privileged port.
167 int p = IPPORT_RESERVED - 1;
168 sock = rresvport_af(&p, family);
170 error("rresvport: af=%d %.100s", family, strerror(errno));
172 debug("Allocated local port %d.", p);
175 * Just create an ordinary socket on arbitrary port. We use
176 * the user's uid to create the socket.
178 temporarily_use_uid(original_real_uid);
179 sock = socket(family, SOCK_STREAM, 0);
181 error("socket: %.100s", strerror(errno));
188 * Opens a TCP/IP connection to the remote server on the given host.
189 * The address of the remote host will be returned in hostaddr.
190 * If port is 0, the default port will be used. If anonymous is zero,
191 * a privileged port will be allocated to make the connection.
192 * This requires super-user privileges if anonymous is false.
193 * Connection_attempts specifies the maximum number of tries (one per
194 * second). If proxy_command is non-NULL, it specifies the command (with %h
195 * and %p substituted for host and port, respectively) to use to contact
199 ssh_connect(const char *host, struct sockaddr_storage * hostaddr,
200 u_short port, int connection_attempts,
201 int anonymous, uid_t original_real_uid,
202 const char *proxy_command)
204 int sock = -1, attempt;
206 struct addrinfo hints, *ai, *aitop;
207 char ntop[NI_MAXHOST], strport[NI_MAXSERV];
209 struct linger linger;
211 debug("ssh_connect: getuid %d geteuid %d anon %d",
212 (int) getuid(), (int) geteuid(), anonymous);
214 /* Get default port if port has not been set. */
216 sp = getservbyname(SSH_SERVICE_NAME, "tcp");
218 port = ntohs(sp->s_port);
220 port = SSH_DEFAULT_PORT;
222 /* If a proxy command is given, connect using it. */
223 if (proxy_command != NULL)
224 return ssh_proxy_connect(host, port, original_real_uid, proxy_command);
226 /* No proxy command. */
228 memset(&hints, 0, sizeof(hints));
229 hints.ai_family = IPv4or6;
230 hints.ai_socktype = SOCK_STREAM;
231 snprintf(strport, sizeof strport, "%d", port);
232 if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0)
233 fatal("%s: %.100s: %s", __progname, host,
234 gai_strerror(gaierr));
237 * Try to connect several times. On some machines, the first time
238 * will sometimes fail. In general socket code appears to behave
239 * quite magically on many machines.
241 for (attempt = 0; attempt < connection_attempts; attempt++) {
243 debug("Trying again...");
245 /* Loop through addresses for this host, and try each one in
246 sequence until the connection succeeds. */
247 for (ai = aitop; ai; ai = ai->ai_next) {
248 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
250 if (getnameinfo(ai->ai_addr, ai->ai_addrlen,
251 ntop, sizeof(ntop), strport, sizeof(strport),
252 NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
253 error("ssh_connect: getnameinfo failed");
256 debug("Connecting to %.200s [%.100s] port %s.",
257 host, ntop, strport);
259 /* Create a socket for connecting. */
260 sock = ssh_create_socket(original_real_uid,
261 !anonymous && geteuid() == 0 && port < IPPORT_RESERVED,
266 /* Connect to the host. We use the user's uid in the
267 * hope that it will help with tcp_wrappers showing
268 * the remote uid as root.
270 temporarily_use_uid(original_real_uid);
271 if (connect(sock, ai->ai_addr, ai->ai_addrlen) >= 0) {
272 /* Successful connection. */
273 memcpy(hostaddr, ai->ai_addr, sizeof(*(ai->ai_addr)));
277 debug("connect: %.100s", strerror(errno));
280 * Close the failed socket; there appear to
281 * be some problems when reusing a socket for
282 * which connect() has already returned an
285 shutdown(sock, SHUT_RDWR);
290 break; /* Successful connection. */
292 /* Sleep a moment before retrying. */
298 /* Return failure if we didn't get a successful connection. */
299 if (attempt >= connection_attempts)
302 debug("Connection established.");
305 * Set socket options. We would like the socket to disappear as soon
306 * as it has been closed for whatever reason.
308 /* setsockopt(sock, SOL_SOCKET, SO_REUSEADDR, (void *)&on, sizeof(on)); */
311 setsockopt(sock, SOL_SOCKET, SO_LINGER, (void *) &linger, sizeof(linger));
313 /* Set the connection. */
314 packet_set_connection(sock, sock);
320 * Checks if the user has an authentication agent, and if so, tries to
321 * authenticate using the agent.
324 try_agent_authentication()
328 AuthenticationConnection *auth;
329 unsigned char response[16];
331 BIGNUM *e, *n, *challenge;
333 /* Get connection to the agent. */
334 auth = ssh_get_authentication_connection();
340 challenge = BN_new();
342 /* Loop through identities served by the agent. */
343 for (status = ssh_get_first_identity(auth, e, n, &comment);
345 status = ssh_get_next_identity(auth, e, n, &comment)) {
348 /* Try this identity. */
349 debug("Trying RSA authentication via agent with '%.100s'", comment);
352 /* Tell the server that we are willing to authenticate using this key. */
353 packet_start(SSH_CMSG_AUTH_RSA);
354 packet_put_bignum(n);
358 /* Wait for server's response. */
359 type = packet_read(&plen);
361 /* The server sends failure if it doesn\'t like our key or
362 does not support RSA authentication. */
363 if (type == SSH_SMSG_FAILURE) {
364 debug("Server refused our key.");
367 /* Otherwise it should have sent a challenge. */
368 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
369 packet_disconnect("Protocol error during RSA authentication: %d",
372 packet_get_bignum(challenge, &clen);
374 packet_integrity_check(plen, clen, type);
376 debug("Received RSA challenge from server.");
378 /* Ask the agent to decrypt the challenge. */
379 if (!ssh_decrypt_challenge(auth, e, n, challenge,
380 session_id, 1, response)) {
381 /* The agent failed to authenticate this identifier although it
382 advertised it supports this. Just return a wrong value. */
383 log("Authentication agent failed to decrypt challenge.");
384 memset(response, 0, sizeof(response));
386 debug("Sending response to RSA challenge.");
388 /* Send the decrypted challenge back to the server. */
389 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
390 for (i = 0; i < 16; i++)
391 packet_put_char(response[i]);
395 /* Wait for response from the server. */
396 type = packet_read(&plen);
398 /* The server returns success if it accepted the authentication. */
399 if (type == SSH_SMSG_SUCCESS) {
400 debug("RSA authentication accepted by server.");
403 BN_clear_free(challenge);
406 /* Otherwise it should return failure. */
407 if (type != SSH_SMSG_FAILURE)
408 packet_disconnect("Protocol error waiting RSA auth response: %d",
414 BN_clear_free(challenge);
416 debug("RSA authentication using agent refused.");
421 * Computes the proper response to a RSA challenge, and sends the response to
425 respond_to_rsa_challenge(BIGNUM * challenge, RSA * prv)
427 unsigned char buf[32], response[16];
431 /* Decrypt the challenge using the private key. */
432 rsa_private_decrypt(challenge, challenge, prv);
434 /* Compute the response. */
435 /* The response is MD5 of decrypted challenge plus session id. */
436 len = BN_num_bytes(challenge);
437 if (len <= 0 || len > sizeof(buf))
438 packet_disconnect("respond_to_rsa_challenge: bad challenge length %d",
441 memset(buf, 0, sizeof(buf));
442 BN_bn2bin(challenge, buf + sizeof(buf) - len);
444 MD5_Update(&md, buf, 32);
445 MD5_Update(&md, session_id, 16);
446 MD5_Final(response, &md);
448 debug("Sending response to host key RSA challenge.");
450 /* Send the response back to the server. */
451 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
452 for (i = 0; i < 16; i++)
453 packet_put_char(response[i]);
457 memset(buf, 0, sizeof(buf));
458 memset(response, 0, sizeof(response));
459 memset(&md, 0, sizeof(md));
463 * Checks if the user has authentication file, and if so, tries to authenticate
467 try_rsa_authentication(const char *authfile)
472 char *passphrase, *comment;
476 /* Try to load identification for the authentication key. */
477 public_key = RSA_new();
478 if (!load_public_key(authfile, public_key, &comment)) {
479 RSA_free(public_key);
480 /* Could not load it. Fail. */
483 debug("Trying RSA authentication with key '%.100s'", comment);
485 /* Tell the server that we are willing to authenticate using this key. */
486 packet_start(SSH_CMSG_AUTH_RSA);
487 packet_put_bignum(public_key->n);
491 /* We no longer need the public key. */
492 RSA_free(public_key);
494 /* Wait for server's response. */
495 type = packet_read(&plen);
498 * The server responds with failure if it doesn\'t like our key or
499 * doesn\'t support RSA authentication.
501 if (type == SSH_SMSG_FAILURE) {
502 debug("Server refused our key.");
506 /* Otherwise, the server should respond with a challenge. */
507 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
508 packet_disconnect("Protocol error during RSA authentication: %d", type);
510 /* Get the challenge from the packet. */
511 challenge = BN_new();
512 packet_get_bignum(challenge, &clen);
514 packet_integrity_check(plen, clen, type);
516 debug("Received RSA challenge from server.");
518 private_key = RSA_new();
520 * Load the private key. Try first with empty passphrase; if it
521 * fails, ask for a passphrase.
523 if (!load_private_key(authfile, "", private_key, NULL)) {
525 snprintf(buf, sizeof buf, "Enter passphrase for RSA key '%.100s': ",
527 if (!options.batch_mode)
528 passphrase = read_passphrase(buf, 0);
530 debug("Will not query passphrase for %.100s in batch mode.",
532 passphrase = xstrdup("");
535 /* Load the authentication file using the pasphrase. */
536 if (!load_private_key(authfile, passphrase, private_key, NULL)) {
537 memset(passphrase, 0, strlen(passphrase));
539 error("Bad passphrase.");
541 /* Send a dummy response packet to avoid protocol error. */
542 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
543 for (i = 0; i < 16; i++)
548 /* Expect the server to reject it... */
549 packet_read_expect(&plen, SSH_SMSG_FAILURE);
553 /* Destroy the passphrase. */
554 memset(passphrase, 0, strlen(passphrase));
557 /* We no longer need the comment. */
560 /* Compute and send a response to the challenge. */
561 respond_to_rsa_challenge(challenge, private_key);
563 /* Destroy the private key. */
564 RSA_free(private_key);
566 /* We no longer need the challenge. */
567 BN_clear_free(challenge);
569 /* Wait for response from the server. */
570 type = packet_read(&plen);
571 if (type == SSH_SMSG_SUCCESS) {
572 debug("RSA authentication accepted by server.");
575 if (type != SSH_SMSG_FAILURE)
576 packet_disconnect("Protocol error waiting RSA auth response: %d", type);
577 debug("RSA authentication refused.");
582 * Tries to authenticate the user using combined rhosts or /etc/hosts.equiv
583 * authentication and RSA host authentication.
586 try_rhosts_rsa_authentication(const char *local_user, RSA * host_key)
592 debug("Trying rhosts or /etc/hosts.equiv with RSA host authentication.");
594 /* Tell the server that we are willing to authenticate using this key. */
595 packet_start(SSH_CMSG_AUTH_RHOSTS_RSA);
596 packet_put_string(local_user, strlen(local_user));
597 packet_put_int(BN_num_bits(host_key->n));
598 packet_put_bignum(host_key->e);
599 packet_put_bignum(host_key->n);
603 /* Wait for server's response. */
604 type = packet_read(&plen);
606 /* The server responds with failure if it doesn't admit our
607 .rhosts authentication or doesn't know our host key. */
608 if (type == SSH_SMSG_FAILURE) {
609 debug("Server refused our rhosts authentication or host key.");
612 /* Otherwise, the server should respond with a challenge. */
613 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
614 packet_disconnect("Protocol error during RSA authentication: %d", type);
616 /* Get the challenge from the packet. */
617 challenge = BN_new();
618 packet_get_bignum(challenge, &clen);
620 packet_integrity_check(plen, clen, type);
622 debug("Received RSA challenge for host key from server.");
624 /* Compute a response to the challenge. */
625 respond_to_rsa_challenge(challenge, host_key);
627 /* We no longer need the challenge. */
628 BN_clear_free(challenge);
630 /* Wait for response from the server. */
631 type = packet_read(&plen);
632 if (type == SSH_SMSG_SUCCESS) {
633 debug("Rhosts or /etc/hosts.equiv with RSA host authentication accepted by server.");
636 if (type != SSH_SMSG_FAILURE)
637 packet_disconnect("Protocol error waiting RSA auth response: %d", type);
638 debug("Rhosts or /etc/hosts.equiv with RSA host authentication refused.");
644 try_kerberos_authentication()
646 KTEXT_ST auth; /* Kerberos data */
653 Key_schedule schedule;
654 u_long checksum, cksum;
656 struct sockaddr_in local, foreign;
659 /* Don't do anything if we don't have any tickets. */
660 if (stat(tkt_string(), &st) < 0)
663 strncpy(inst, (char *) krb_get_phost(get_canonical_hostname()), INST_SZ);
665 realm = (char *) krb_realmofhost(get_canonical_hostname());
667 debug("Kerberos V4: no realm for %s", get_canonical_hostname());
670 /* This can really be anything. */
671 checksum = (u_long) getpid();
673 r = krb_mk_req(&auth, KRB4_SERVICE_NAME, inst, realm, checksum);
675 debug("Kerberos V4 krb_mk_req failed: %s", krb_err_txt[r]);
678 /* Get session key to decrypt the server's reply with. */
679 r = krb_get_cred(KRB4_SERVICE_NAME, inst, realm, &cred);
681 debug("get_cred failed: %s", krb_err_txt[r]);
684 des_key_sched((des_cblock *) cred.session, schedule);
686 /* Send authentication info to server. */
687 packet_start(SSH_CMSG_AUTH_KERBEROS);
688 packet_put_string((char *) auth.dat, auth.length);
692 /* Zero the buffer. */
693 (void) memset(auth.dat, 0, MAX_KTXT_LEN);
695 slen = sizeof(local);
696 memset(&local, 0, sizeof(local));
697 if (getsockname(packet_get_connection_in(),
698 (struct sockaddr *) & local, &slen) < 0)
699 debug("getsockname failed: %s", strerror(errno));
701 slen = sizeof(foreign);
702 memset(&foreign, 0, sizeof(foreign));
703 if (getpeername(packet_get_connection_in(),
704 (struct sockaddr *) & foreign, &slen) < 0) {
705 debug("getpeername failed: %s", strerror(errno));
708 /* Get server reply. */
709 type = packet_read(&plen);
711 case SSH_SMSG_FAILURE:
712 /* Should really be SSH_SMSG_AUTH_KERBEROS_FAILURE */
713 debug("Kerberos V4 authentication failed.");
717 case SSH_SMSG_AUTH_KERBEROS_RESPONSE:
718 /* SSH_SMSG_AUTH_KERBEROS_SUCCESS */
719 debug("Kerberos V4 authentication accepted.");
721 /* Get server's response. */
722 reply = packet_get_string((unsigned int *) &auth.length);
723 memcpy(auth.dat, reply, auth.length);
726 packet_integrity_check(plen, 4 + auth.length, type);
729 * If his response isn't properly encrypted with the session
730 * key, and the decrypted checksum fails to match, he's
733 r = krb_rd_priv(auth.dat, auth.length, schedule, &cred.session,
734 &foreign, &local, &msg_data);
736 debug("Kerberos V4 krb_rd_priv failed: %s", krb_err_txt[r]);
737 packet_disconnect("Kerberos V4 challenge failed!");
739 /* Fetch the (incremented) checksum that we supplied in the request. */
740 (void) memcpy((char *) &cksum, (char *) msg_data.app_data, sizeof(cksum));
741 cksum = ntohl(cksum);
743 /* If it matches, we're golden. */
744 if (cksum == checksum + 1) {
745 debug("Kerberos V4 challenge successful.");
748 packet_disconnect("Kerberos V4 challenge failed!");
752 packet_disconnect("Protocol error on Kerberos V4 response: %d", type);
764 char pname[ANAME_SZ], pinst[INST_SZ], prealm[REALM_SZ];
769 /* Don't do anything if we don't have any tickets. */
770 if (stat(tkt_string(), &st) < 0)
773 creds = xmalloc(sizeof(*creds));
775 if ((r = krb_get_tf_fullname(TKT_FILE, pname, pinst, prealm)) != KSUCCESS) {
776 debug("Kerberos V4 tf_fullname failed: %s", krb_err_txt[r]);
779 if ((r = krb_get_cred("krbtgt", prealm, prealm, creds)) != GC_OK) {
780 debug("Kerberos V4 get_cred failed: %s", krb_err_txt[r]);
783 if (time(0) > krb_life_to_time(creds->issue_date, creds->lifetime)) {
784 debug("Kerberos V4 ticket expired: %s", TKT_FILE);
787 creds_to_radix(creds, (unsigned char *)buffer);
790 packet_start(SSH_CMSG_HAVE_KERBEROS_TGT);
791 packet_put_string(buffer, strlen(buffer));
795 type = packet_read(&plen);
797 if (type == SSH_SMSG_FAILURE)
798 debug("Kerberos TGT for realm %s rejected.", prealm);
799 else if (type != SSH_SMSG_SUCCESS)
800 packet_disconnect("Protocol error on Kerberos TGT response: %d", type);
806 send_afs_tokens(void)
809 struct ViceIoctl parms;
810 struct ClearToken ct;
811 int i, type, len, plen;
812 char buf[2048], *p, *server_cell;
815 /* Move over ktc_GetToken, here's something leaner. */
816 for (i = 0; i < 100; i++) { /* just in case */
817 parms.in = (char *) &i;
818 parms.in_size = sizeof(i);
820 parms.out_size = sizeof(buf);
821 if (k_pioctl(0, VIOCGETTOK, &parms, 0) != 0)
825 /* Get secret token. */
826 memcpy(&creds.ticket_st.length, p, sizeof(unsigned int));
827 if (creds.ticket_st.length > MAX_KTXT_LEN)
829 p += sizeof(unsigned int);
830 memcpy(creds.ticket_st.dat, p, creds.ticket_st.length);
831 p += creds.ticket_st.length;
833 /* Get clear token. */
834 memcpy(&len, p, sizeof(len));
835 if (len != sizeof(struct ClearToken))
840 p += sizeof(len); /* primary flag */
843 /* Flesh out our credentials. */
844 strlcpy(creds.service, "afs", sizeof creds.service);
845 creds.instance[0] = '\0';
846 strlcpy(creds.realm, server_cell, REALM_SZ);
847 memcpy(creds.session, ct.HandShakeKey, DES_KEY_SZ);
848 creds.issue_date = ct.BeginTimestamp;
849 creds.lifetime = krb_time_to_life(creds.issue_date, ct.EndTimestamp);
850 creds.kvno = ct.AuthHandle;
851 snprintf(creds.pname, sizeof(creds.pname), "AFS ID %d", ct.ViceId);
852 creds.pinst[0] = '\0';
854 /* Encode token, ship it off. */
855 if (!creds_to_radix(&creds, (unsigned char*) buffer))
857 packet_start(SSH_CMSG_HAVE_AFS_TOKEN);
858 packet_put_string(buffer, strlen(buffer));
862 /* Roger, Roger. Clearance, Clarence. What's your vector,
864 type = packet_read(&plen);
866 if (type == SSH_SMSG_FAILURE)
867 debug("AFS token for cell %s rejected.", server_cell);
868 else if (type != SSH_SMSG_SUCCESS)
869 packet_disconnect("Protocol error on AFS token response: %d", type);
876 * Tries to authenticate with any string-based challenge/response system.
877 * Note that the client code is not tied to s/key or TIS.
880 try_skey_authentication()
885 char *challenge, *response;
887 debug("Doing skey authentication.");
889 /* request a challenge */
890 packet_start(SSH_CMSG_AUTH_TIS);
894 type = packet_read(&payload_len);
895 if (type != SSH_SMSG_FAILURE &&
896 type != SSH_SMSG_AUTH_TIS_CHALLENGE) {
897 packet_disconnect("Protocol error: got %d in response "
898 "to skey-auth", type);
900 if (type != SSH_SMSG_AUTH_TIS_CHALLENGE) {
901 debug("No challenge for skey authentication.");
904 challenge = packet_get_string(&clen);
905 packet_integrity_check(payload_len, (4 + clen), type);
906 if (options.cipher == SSH_CIPHER_NONE)
907 log("WARNING: Encryption is disabled! "
908 "Reponse will be transmitted in clear text.");
909 fprintf(stderr, "%s\n", challenge);
912 for (i = 0; i < options.number_of_password_prompts; i++) {
914 error("Permission denied, please try again.");
915 response = read_passphrase("Response: ", 0);
916 packet_start(SSH_CMSG_AUTH_TIS_RESPONSE);
917 packet_put_string(response, strlen(response));
918 memset(response, 0, strlen(response));
922 type = packet_read(&payload_len);
923 if (type == SSH_SMSG_SUCCESS)
925 if (type != SSH_SMSG_FAILURE)
926 packet_disconnect("Protocol error: got %d in response "
927 "to skey-auth-reponse", type);
934 * Tries to authenticate with plain passwd authentication.
937 try_password_authentication(char *prompt)
939 int type, i, payload_len;
942 debug("Doing password authentication.");
943 if (options.cipher == SSH_CIPHER_NONE)
944 log("WARNING: Encryption is disabled! Password will be transmitted in clear text.");
945 for (i = 0; i < options.number_of_password_prompts; i++) {
947 error("Permission denied, please try again.");
948 password = read_passphrase(prompt, 0);
949 packet_start(SSH_CMSG_AUTH_PASSWORD);
950 packet_put_string(password, strlen(password));
951 memset(password, 0, strlen(password));
956 type = packet_read(&payload_len);
957 if (type == SSH_SMSG_SUCCESS)
959 if (type != SSH_SMSG_FAILURE)
960 packet_disconnect("Protocol error: got %d in response to passwd auth", type);
971 if(*t == '\n' || *t == '\r') {
982 * Waits for the server identification string, and sends our own
983 * identification string.
986 ssh_exchange_identification()
988 char buf[256], remote_version[256]; /* must be same size! */
989 int remote_major, remote_minor, i, mismatch;
990 int connection_in = packet_get_connection_in();
991 int connection_out = packet_get_connection_out();
993 /* Read other side\'s version identification. */
994 for (i = 0; i < sizeof(buf) - 1; i++) {
995 int len = read(connection_in, &buf[i], 1);
997 fatal("ssh_exchange_identification: read: %.100s", strerror(errno));
999 fatal("ssh_exchange_identification: Connection closed by remote host");
1000 if (buf[i] == '\r') {
1003 continue; /**XXX wait for \n */
1005 if (buf[i] == '\n') {
1010 buf[sizeof(buf) - 1] = 0;
1011 server_version_string = xstrdup(buf);
1014 * Check that the versions match. In future this might accept
1015 * several versions and set appropriate flags to handle them.
1017 if (sscanf(server_version_string, "SSH-%d.%d-%[^\n]\n",
1018 &remote_major, &remote_minor, remote_version) != 3)
1019 fatal("Bad remote protocol version identification: '%.100s'", buf);
1020 debug("Remote protocol version %d.%d, remote software version %.100s",
1021 remote_major, remote_minor, remote_version);
1023 compat_datafellows(remote_version);
1026 switch(remote_major) {
1028 if (remote_minor == 99 &&
1029 (options.protocol & SSH_PROTO_2) &&
1030 !(options.protocol & SSH_PROTO_1_PREFERRED)) {
1034 if (!(options.protocol & SSH_PROTO_1)) {
1038 if (remote_minor < 3) {
1039 fatal("Remote machine has too old SSH software version.");
1040 } else if (remote_minor == 3) {
1041 /* We speak 1.3, too. */
1043 if (options.forward_agent) {
1044 log("Agent forwarding disabled for protocol 1.3");
1045 options.forward_agent = 0;
1050 if (options.protocol & SSH_PROTO_2) {
1060 fatal("Protocol major versions differ: %d vs. %d",
1061 (options.protocol & SSH_PROTO_2) ? PROTOCOL_MAJOR_2 : PROTOCOL_MAJOR_1,
1064 /* Send our own protocol version identification. */
1065 snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s\n",
1066 compat20 ? PROTOCOL_MAJOR_2 : PROTOCOL_MAJOR_1,
1067 compat20 ? PROTOCOL_MINOR_2 : PROTOCOL_MINOR_1,
1069 if (atomicio(write, connection_out, buf, strlen(buf)) != strlen(buf))
1070 fatal("write: %.100s", strerror(errno));
1071 client_version_string = xstrdup(buf);
1072 chop(client_version_string);
1073 chop(server_version_string);
1074 debug("Local version string %.100s", client_version_string);
1078 read_yes_or_no(const char *prompt, int defval)
1087 f = fopen("/dev/tty", "rw");
1095 fprintf(stderr, "%s", prompt);
1096 if (fgets(buf, sizeof(buf), f) == NULL) {
1097 /* Print a newline (the prompt probably didn\'t have one). */
1098 fprintf(stderr, "\n");
1099 strlcpy(buf, "no", sizeof buf);
1101 /* Remove newline from response. */
1102 if (strchr(buf, '\n'))
1103 *strchr(buf, '\n') = 0;
1107 if (strcmp(buf, "yes") == 0)
1109 if (strcmp(buf, "no") == 0)
1121 * check whether the supplied host key is valid, return only if ok.
1125 check_host_key(char *host, struct sockaddr *hostaddr, Key *host_key)
1129 char hostline[1000], *hostp;
1130 HostStatus host_status;
1131 HostStatus ip_status;
1132 int local = 0, host_ip_differ = 0;
1134 char ntop[NI_MAXHOST];
1137 * Force accepting of the host key for loopback/localhost. The
1138 * problem is that if the home directory is NFS-mounted to multiple
1139 * machines, localhost will refer to a different machine in each of
1140 * them, and the user will get bogus HOST_CHANGED warnings. This
1141 * essentially disables host authentication for localhost; however,
1142 * this is probably not a real problem.
1144 switch (hostaddr->sa_family) {
1146 local = (ntohl(((struct sockaddr_in *)hostaddr)->sin_addr.s_addr) >> 24) == IN_LOOPBACKNET;
1147 salen = sizeof(struct sockaddr_in);
1150 local = IN6_IS_ADDR_LOOPBACK(&(((struct sockaddr_in6 *)hostaddr)->sin6_addr));
1151 salen = sizeof(struct sockaddr_in6);
1155 salen = sizeof(struct sockaddr_storage);
1159 debug("Forcing accepting of host key for loopback/localhost.");
1164 * Turn off check_host_ip for proxy connects, since
1165 * we don't have the remote ip-address
1167 if (options.proxy_command != NULL && options.check_host_ip)
1168 options.check_host_ip = 0;
1170 if (options.check_host_ip) {
1171 if (getnameinfo(hostaddr, salen, ntop, sizeof(ntop),
1172 NULL, 0, NI_NUMERICHOST) != 0)
1173 fatal("check_host_key: getnameinfo failed");
1178 * Store the host key from the known host file in here so that we can
1179 * compare it with the key for the IP address.
1181 file_key = key_new(host_key->type);
1184 * Check if the host key is present in the user\'s list of known
1185 * hosts or in the systemwide list.
1187 host_status = check_host_in_hostfile(options.user_hostfile, host, host_key, file_key);
1188 if (host_status == HOST_NEW)
1189 host_status = check_host_in_hostfile(options.system_hostfile, host, host_key, file_key);
1191 * Also perform check for the ip address, skip the check if we are
1192 * localhost or the hostname was an ip address to begin with
1194 if (options.check_host_ip && !local && strcmp(host, ip)) {
1195 Key *ip_key = key_new(host_key->type);
1196 ip_status = check_host_in_hostfile(options.user_hostfile, ip, host_key, ip_key);
1198 if (ip_status == HOST_NEW)
1199 ip_status = check_host_in_hostfile(options.system_hostfile, ip, host_key, ip_key);
1200 if (host_status == HOST_CHANGED &&
1201 (ip_status != HOST_CHANGED || !key_equal(ip_key, file_key)))
1206 ip_status = host_status;
1210 switch (host_status) {
1212 /* The host is known and the key matches. */
1213 debug("Host '%.200s' is known and matches the host key.", host);
1214 if (options.check_host_ip) {
1215 if (ip_status == HOST_NEW) {
1216 if (!add_host_to_hostfile(options.user_hostfile, ip, host_key))
1217 log("Failed to add the host key for IP address '%.30s' to the list of known hosts (%.30s).",
1218 ip, options.user_hostfile);
1220 log("Warning: Permanently added host key for IP address '%.30s' to the list of known hosts.",
1222 } else if (ip_status != HOST_OK)
1223 log("Warning: the host key for '%.200s' differs from the key for the IP address '%.30s'",
1228 /* The host is new. */
1229 if (options.strict_host_key_checking == 1) {
1230 /* User has requested strict host key checking. We will not add the host key
1231 automatically. The only alternative left is to abort. */
1232 fatal("No host key is known for %.200s and you have requested strict checking.", host);
1233 } else if (options.strict_host_key_checking == 2) {
1236 char *fp = key_fingerprint(host_key);
1237 snprintf(prompt, sizeof(prompt),
1238 "The authenticity of host '%.200s' can't be established.\n"
1239 "Key fingerprint is %s.\n"
1240 "Are you sure you want to continue connecting (yes/no)? ",
1242 if (!read_yes_or_no(prompt, -1))
1243 fatal("Aborted by user!\n");
1245 if (options.check_host_ip && ip_status == HOST_NEW && strcmp(host, ip)) {
1246 snprintf(hostline, sizeof(hostline), "%s,%s", host, ip);
1251 /* If not in strict mode, add the key automatically to the local known_hosts file. */
1252 if (!add_host_to_hostfile(options.user_hostfile, hostp, host_key))
1253 log("Failed to add the host to the list of known hosts (%.500s).",
1254 options.user_hostfile);
1256 log("Warning: Permanently added '%.200s' to the list of known hosts.",
1260 if (options.check_host_ip && host_ip_differ) {
1262 if (ip_status == HOST_NEW)
1264 else if (ip_status == HOST_OK)
1265 msg = "is unchanged";
1267 msg = "has a different value";
1268 error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
1269 error("@ WARNING: POSSIBLE DNS SPOOFING DETECTED! @");
1270 error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
1271 error("The host key for %s has changed,", host);
1272 error("and the key for the according IP address %s", ip);
1273 error("%s. This could either mean that", msg);
1274 error("DNS SPOOFING is happening or the IP address for the host");
1275 error("and its host key have changed at the same time");
1277 /* The host key has changed. */
1278 error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
1279 error("@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @");
1280 error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
1281 error("IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!");
1282 error("Someone could be eavesdropping on you right now (man-in-the-middle attack)!");
1283 error("It is also possible that the host key has just been changed.");
1284 error("Please contact your system administrator.");
1285 error("Add correct host key in %.100s to get rid of this message.",
1286 options.user_hostfile);
1289 * If strict host key checking is in use, the user will have
1290 * to edit the key manually and we can only abort.
1292 if (options.strict_host_key_checking)
1293 fatal("Host key for %.200s has changed and you have requested strict checking.", host);
1296 * If strict host key checking has not been requested, allow
1297 * the connection but without password authentication or
1300 if (options.password_authentication) {
1301 error("Password authentication is disabled to avoid trojan horses.");
1302 options.password_authentication = 0;
1304 if (options.forward_agent) {
1305 error("Agent forwarding is disabled to avoid trojan horses.");
1306 options.forward_agent = 0;
1309 * XXX Should permit the user to change to use the new id.
1310 * This could be done by converting the host key to an
1311 * identifying sentence, tell that the host identifies itself
1312 * by that sentence, and ask the user if he/she whishes to
1313 * accept the authentication.
1317 if (options.check_host_ip)
1321 check_rsa_host_key(char *host, struct sockaddr *hostaddr, RSA *host_key)
1326 check_host_key(host, hostaddr, &k);
1333 ssh_kex2(char *host, struct sockaddr *hostaddr)
1336 char *cprop[PROPOSAL_MAX];
1337 char *sprop[PROPOSAL_MAX];
1338 Buffer *client_kexinit;
1339 Buffer *server_kexinit;
1340 int payload_len, dlen;
1341 unsigned int klen, kout;
1343 char *signature = NULL;
1345 char *server_host_key_blob = NULL;
1346 Key *server_host_key;
1347 unsigned int sbloblen;
1349 BIGNUM *dh_server_pub = 0;
1350 BIGNUM *shared_secret = 0;
1352 unsigned char *kbuf;
1353 unsigned char *hash;
1357 debug("Sending KEX init.");
1358 if (options.ciphers != NULL) {
1359 myproposal[PROPOSAL_ENC_ALGS_CTOS] =
1360 myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
1362 options.cipher == SSH_CIPHER_ARCFOUR ||
1363 options.cipher == SSH_CIPHER_3DES_CBC ||
1364 options.cipher == SSH_CIPHER_CAST128_CBC ||
1365 options.cipher == SSH_CIPHER_BLOWFISH_CBC) {
1366 myproposal[PROPOSAL_ENC_ALGS_CTOS] =
1367 myproposal[PROPOSAL_ENC_ALGS_STOC] = cipher_name(options.cipher);
1369 if (options.compression) {
1370 myproposal[PROPOSAL_COMP_ALGS_CTOS] = "zlib";
1371 myproposal[PROPOSAL_COMP_ALGS_STOC] = "zlib";
1373 myproposal[PROPOSAL_COMP_ALGS_CTOS] = "none";
1374 myproposal[PROPOSAL_COMP_ALGS_STOC] = "none";
1376 for (i = 0; i < PROPOSAL_MAX; i++)
1377 cprop[i] = xstrdup(myproposal[i]);
1379 client_kexinit = kex_init(cprop);
1380 packet_start(SSH2_MSG_KEXINIT);
1381 packet_put_raw(buffer_ptr(client_kexinit), buffer_len(client_kexinit));
1383 packet_write_wait();
1387 packet_read_expect(&payload_len, SSH2_MSG_KEXINIT);
1389 /* save payload for session_id */
1390 server_kexinit = xmalloc(sizeof(*server_kexinit));
1391 buffer_init(server_kexinit);
1392 ptr = packet_get_raw(&payload_len);
1393 buffer_append(server_kexinit, ptr, payload_len);
1396 for (i = 0; i < 16; i++)
1397 (void) packet_get_char();
1398 /* kex init proposal strings */
1399 for (i = 0; i < PROPOSAL_MAX; i++) {
1400 sprop[i] = packet_get_string(NULL);
1401 debug("got kexinit string: %s", sprop[i]);
1403 i = (int) packet_get_char();
1404 debug("first kex follow == %d", i);
1405 i = packet_get_int();
1406 debug("reserved == %d", i);
1409 debug("done read kexinit");
1410 kex = kex_choose_conf(cprop, sprop, 0);
1414 debug("Sending SSH2_MSG_KEXDH_INIT.");
1416 /* generate and send 'e', client DH public key */
1417 dh = dh_new_group1();
1418 packet_start(SSH2_MSG_KEXDH_INIT);
1419 packet_put_bignum2(dh->pub_key);
1421 packet_write_wait();
1424 fprintf(stderr, "\np= ");
1425 bignum_print(dh->p);
1426 fprintf(stderr, "\ng= ");
1427 bignum_print(dh->g);
1428 fprintf(stderr, "\npub= ");
1429 bignum_print(dh->pub_key);
1430 fprintf(stderr, "\n");
1431 DHparams_print_fp(stderr, dh);
1434 debug("Wait SSH2_MSG_KEXDH_REPLY.");
1436 packet_read_expect(&payload_len, SSH2_MSG_KEXDH_REPLY);
1438 debug("Got SSH2_MSG_KEXDH_REPLY.");
1441 server_host_key_blob = packet_get_string(&sbloblen);
1442 server_host_key = dsa_serverkey_from_blob(server_host_key_blob, sbloblen);
1443 if (server_host_key == NULL)
1444 fatal("cannot decode server_host_key_blob");
1446 check_host_key(host, hostaddr, server_host_key);
1448 /* DH paramter f, server public DH key */
1449 dh_server_pub = BN_new();
1450 if (dh_server_pub == NULL)
1451 fatal("dh_server_pub == NULL");
1452 packet_get_bignum2(dh_server_pub, &dlen);
1455 fprintf(stderr, "\ndh_server_pub= ");
1456 bignum_print(dh_server_pub);
1457 fprintf(stderr, "\n");
1458 debug("bits %d", BN_num_bits(dh_server_pub));
1462 signature = packet_get_string(&slen);
1465 if (!dh_pub_is_valid(dh, dh_server_pub))
1466 packet_disconnect("bad server public DH value");
1469 kbuf = xmalloc(klen);
1470 kout = DH_compute_key(kbuf, dh_server_pub, dh);
1472 debug("shared secret: len %d/%d", klen, kout);
1473 fprintf(stderr, "shared secret == ");
1474 for (i = 0; i< kout; i++)
1475 fprintf(stderr, "%02x", (kbuf[i])&0xff);
1476 fprintf(stderr, "\n");
1478 shared_secret = BN_new();
1480 BN_bin2bn(kbuf, kout, shared_secret);
1481 memset(kbuf, 0, klen);
1484 /* calc and verify H */
1486 client_version_string,
1487 server_version_string,
1488 buffer_ptr(client_kexinit), buffer_len(client_kexinit),
1489 buffer_ptr(server_kexinit), buffer_len(server_kexinit),
1490 server_host_key_blob, sbloblen,
1495 buffer_free(client_kexinit);
1496 buffer_free(server_kexinit);
1497 xfree(client_kexinit);
1498 xfree(server_kexinit);
1500 fprintf(stderr, "hash == ");
1501 for (i = 0; i< 20; i++)
1502 fprintf(stderr, "%02x", (hash[i])&0xff);
1503 fprintf(stderr, "\n");
1505 dsa_verify(server_host_key, (unsigned char *)signature, slen, hash, 20);
1506 key_free(server_host_key);
1508 kex_derive_keys(kex, hash, shared_secret);
1509 packet_set_kex(kex);
1511 /* have keys, free DH */
1514 debug("Wait SSH2_MSG_NEWKEYS.");
1515 packet_read_expect(&payload_len, SSH2_MSG_NEWKEYS);
1517 debug("GOT SSH2_MSG_NEWKEYS.");
1519 debug("send SSH2_MSG_NEWKEYS.");
1520 packet_start(SSH2_MSG_NEWKEYS);
1522 packet_write_wait();
1523 debug("done: send SSH2_MSG_NEWKEYS.");
1526 /* send 1st encrypted/maced/compressed message */
1527 packet_start(SSH2_MSG_IGNORE);
1528 packet_put_cstring("markus");
1530 packet_write_wait();
1532 debug("done: KEX2.");
1538 ssh_userauth2(int host_key_valid, RSA *own_host_key,
1539 uid_t original_real_uid, char *host)
1547 char *server_user, *local_user;
1550 char *service = "ssh-connection"; /* service name */
1552 debug("send SSH2_MSG_SERVICE_REQUEST");
1553 packet_start(SSH2_MSG_SERVICE_REQUEST);
1554 packet_put_cstring("ssh-userauth");
1556 packet_write_wait();
1558 type = packet_read(&plen);
1559 if (type != SSH2_MSG_SERVICE_ACCEPT) {
1560 fatal("denied SSH2_MSG_SERVICE_ACCEPT: %d", type);
1562 if (packet_remaining() > 0) {
1563 char *reply = packet_get_string(&plen);
1564 debug("service_accept: %s", reply);
1567 /* payload empty for ssh-2.0.13 ?? */
1568 log("buggy server: service_accept w/o service");
1571 debug("got SSH2_MSG_SERVICE_ACCEPT");
1574 /* Get local user name. Use it as server user if no user name was given. */
1575 pw = getpwuid(original_real_uid);
1577 fatal("User id %d not found from user database.", original_real_uid);
1578 local_user = xstrdup(pw->pw_name);
1579 server_user = options.user ? options.user : local_user;
1581 /* INITIAL request for auth */
1582 packet_start(SSH2_MSG_USERAUTH_REQUEST);
1583 packet_put_cstring(server_user);
1584 packet_put_cstring(service);
1585 packet_put_cstring("none");
1587 packet_write_wait();
1590 type = packet_read(&plen);
1591 if (type == SSH2_MSG_USERAUTH_SUCCESS)
1593 if (type != SSH2_MSG_USERAUTH_FAILURE)
1594 fatal("access denied: %d", type);
1595 /* SSH2_MSG_USERAUTH_FAILURE means: try again */
1596 auths = packet_get_string(&dlen);
1597 debug("authentications that can continue: %s", auths);
1598 partial = packet_get_char();
1601 debug("partial success");
1602 if (strstr(auths, "password") == NULL)
1603 fatal("passwd auth not supported: %s", auths);
1606 snprintf(prompt, sizeof(prompt), "%.30s@%.40s's password: ",
1608 password = read_passphrase(prompt, 0);
1609 packet_start(SSH2_MSG_USERAUTH_REQUEST);
1610 packet_put_cstring(server_user);
1611 packet_put_cstring(service);
1612 packet_put_cstring("password");
1614 packet_put_cstring(password);
1615 memset(password, 0, strlen(password));
1618 packet_write_wait();
1621 debug("ssh-userauth2 successfull");
1628 ssh_kex(char *host, struct sockaddr *hostaddr)
1635 int ssh_cipher_default = SSH_CIPHER_3DES;
1636 unsigned char session_key[SSH_SESSION_KEY_LENGTH];
1637 unsigned char cookie[8];
1638 unsigned int supported_ciphers;
1639 unsigned int server_flags, client_flags;
1640 int payload_len, clen, sum_len = 0;
1643 debug("Waiting for server public key.");
1645 /* Wait for a public key packet from the server. */
1646 packet_read_expect(&payload_len, SSH_SMSG_PUBLIC_KEY);
1648 /* Get cookie from the packet. */
1649 for (i = 0; i < 8; i++)
1650 cookie[i] = packet_get_char();
1652 /* Get the public key. */
1653 public_key = RSA_new();
1654 bits = packet_get_int();/* bits */
1655 public_key->e = BN_new();
1656 packet_get_bignum(public_key->e, &clen);
1658 public_key->n = BN_new();
1659 packet_get_bignum(public_key->n, &clen);
1662 rbits = BN_num_bits(public_key->n);
1663 if (bits != rbits) {
1664 log("Warning: Server lies about size of server public key: "
1665 "actual size is %d bits vs. announced %d.", rbits, bits);
1666 log("Warning: This may be due to an old implementation of ssh.");
1668 /* Get the host key. */
1669 host_key = RSA_new();
1670 bits = packet_get_int();/* bits */
1671 host_key->e = BN_new();
1672 packet_get_bignum(host_key->e, &clen);
1674 host_key->n = BN_new();
1675 packet_get_bignum(host_key->n, &clen);
1678 rbits = BN_num_bits(host_key->n);
1679 if (bits != rbits) {
1680 log("Warning: Server lies about size of server host key: "
1681 "actual size is %d bits vs. announced %d.", rbits, bits);
1682 log("Warning: This may be due to an old implementation of ssh.");
1685 /* Get protocol flags. */
1686 server_flags = packet_get_int();
1687 packet_set_protocol_flags(server_flags);
1689 supported_ciphers = packet_get_int();
1690 supported_authentications = packet_get_int();
1692 debug("Received server public key (%d bits) and host key (%d bits).",
1693 BN_num_bits(public_key->n), BN_num_bits(host_key->n));
1695 packet_integrity_check(payload_len,
1696 8 + 4 + sum_len + 0 + 4 + 0 + 0 + 4 + 4 + 4,
1697 SSH_SMSG_PUBLIC_KEY);
1699 check_rsa_host_key(host, hostaddr, host_key);
1701 client_flags = SSH_PROTOFLAG_SCREEN_NUMBER | SSH_PROTOFLAG_HOST_IN_FWD_OPEN;
1703 compute_session_id(session_id, cookie, host_key->n, public_key->n);
1705 /* Generate a session key. */
1709 * Generate an encryption key for the session. The key is a 256 bit
1710 * random number, interpreted as a 32-byte key, with the least
1711 * significant 8 bits being the first byte of the key.
1713 for (i = 0; i < 32; i++) {
1715 rand = arc4random();
1716 session_key[i] = rand & 0xff;
1721 * According to the protocol spec, the first byte of the session key
1722 * is the highest byte of the integer. The session key is xored with
1723 * the first 16 bytes of the session id.
1726 BN_set_word(key, 0);
1727 for (i = 0; i < SSH_SESSION_KEY_LENGTH; i++) {
1728 BN_lshift(key, key, 8);
1730 BN_add_word(key, session_key[i] ^ session_id[i]);
1732 BN_add_word(key, session_key[i]);
1736 * Encrypt the integer using the public key and host key of the
1737 * server (key with smaller modulus first).
1739 if (BN_cmp(public_key->n, host_key->n) < 0) {
1740 /* Public key has smaller modulus. */
1741 if (BN_num_bits(host_key->n) <
1742 BN_num_bits(public_key->n) + SSH_KEY_BITS_RESERVED) {
1743 fatal("respond_to_rsa_challenge: host_key %d < public_key %d + "
1744 "SSH_KEY_BITS_RESERVED %d",
1745 BN_num_bits(host_key->n),
1746 BN_num_bits(public_key->n),
1747 SSH_KEY_BITS_RESERVED);
1749 rsa_public_encrypt(key, key, public_key);
1750 rsa_public_encrypt(key, key, host_key);
1752 /* Host key has smaller modulus (or they are equal). */
1753 if (BN_num_bits(public_key->n) <
1754 BN_num_bits(host_key->n) + SSH_KEY_BITS_RESERVED) {
1755 fatal("respond_to_rsa_challenge: public_key %d < host_key %d + "
1756 "SSH_KEY_BITS_RESERVED %d",
1757 BN_num_bits(public_key->n),
1758 BN_num_bits(host_key->n),
1759 SSH_KEY_BITS_RESERVED);
1761 rsa_public_encrypt(key, key, host_key);
1762 rsa_public_encrypt(key, key, public_key);
1765 /* Destroy the public keys since we no longer need them. */
1766 RSA_free(public_key);
1769 if (options.cipher == SSH_CIPHER_NOT_SET) {
1770 if (cipher_mask1() & supported_ciphers & (1 << ssh_cipher_default))
1771 options.cipher = ssh_cipher_default;
1773 debug("Cipher %s not supported, using %.100s instead.",
1774 cipher_name(ssh_cipher_default),
1775 cipher_name(SSH_FALLBACK_CIPHER));
1776 options.cipher = SSH_FALLBACK_CIPHER;
1779 /* Check that the selected cipher is supported. */
1780 if (!(supported_ciphers & (1 << options.cipher)))
1781 fatal("Selected cipher type %.100s not supported by server.",
1782 cipher_name(options.cipher));
1784 debug("Encryption type: %.100s", cipher_name(options.cipher));
1786 /* Send the encrypted session key to the server. */
1787 packet_start(SSH_CMSG_SESSION_KEY);
1788 packet_put_char(options.cipher);
1790 /* Send the cookie back to the server. */
1791 for (i = 0; i < 8; i++)
1792 packet_put_char(cookie[i]);
1794 /* Send and destroy the encrypted encryption key integer. */
1795 packet_put_bignum(key);
1798 /* Send protocol flags. */
1799 packet_put_int(client_flags);
1801 /* Send the packet now. */
1803 packet_write_wait();
1805 debug("Sent encrypted session key.");
1807 /* Set the encryption key. */
1808 packet_set_encryption_key(session_key, SSH_SESSION_KEY_LENGTH, options.cipher);
1810 /* We will no longer need the session key here. Destroy any extra copies. */
1811 memset(session_key, 0, sizeof(session_key));
1814 * Expect a success message from the server. Note that this message
1815 * will be received in encrypted form.
1817 packet_read_expect(&payload_len, SSH_SMSG_SUCCESS);
1819 debug("Received encrypted confirmation.");
1826 ssh_userauth(int host_key_valid, RSA *own_host_key,
1827 uid_t original_real_uid, char *host)
1832 const char *server_user, *local_user;
1834 /* Get local user name. Use it as server user if no user name was given. */
1835 pw = getpwuid(original_real_uid);
1837 fatal("User id %d not found from user database.", original_real_uid);
1838 local_user = xstrdup(pw->pw_name);
1839 server_user = options.user ? options.user : local_user;
1841 /* Send the name of the user to log in as on the server. */
1842 packet_start(SSH_CMSG_USER);
1843 packet_put_string(server_user, strlen(server_user));
1845 packet_write_wait();
1848 * The server should respond with success if no authentication is
1849 * needed (the user has no password). Otherwise the server responds
1852 type = packet_read(&payload_len);
1854 /* check whether the connection was accepted without authentication. */
1855 if (type == SSH_SMSG_SUCCESS)
1857 if (type != SSH_SMSG_FAILURE)
1858 packet_disconnect("Protocol error: got %d in response to SSH_CMSG_USER",
1862 /* Try Kerberos tgt passing if the server supports it. */
1863 if ((supported_authentications & (1 << SSH_PASS_KERBEROS_TGT)) &&
1864 options.kerberos_tgt_passing) {
1865 if (options.cipher == SSH_CIPHER_NONE)
1866 log("WARNING: Encryption is disabled! Ticket will be transmitted in the clear!");
1867 (void) send_kerberos_tgt();
1869 /* Try AFS token passing if the server supports it. */
1870 if ((supported_authentications & (1 << SSH_PASS_AFS_TOKEN)) &&
1871 options.afs_token_passing && k_hasafs()) {
1872 if (options.cipher == SSH_CIPHER_NONE)
1873 log("WARNING: Encryption is disabled! Token will be transmitted in the clear!");
1879 if ((supported_authentications & (1 << SSH_AUTH_KERBEROS)) &&
1880 options.kerberos_authentication) {
1881 debug("Trying Kerberos authentication.");
1882 if (try_kerberos_authentication()) {
1883 /* The server should respond with success or failure. */
1884 type = packet_read(&payload_len);
1885 if (type == SSH_SMSG_SUCCESS)
1887 if (type != SSH_SMSG_FAILURE)
1888 packet_disconnect("Protocol error: got %d in response to Kerberos auth", type);
1894 * Use rhosts authentication if running in privileged socket and we
1895 * do not wish to remain anonymous.
1897 if ((supported_authentications & (1 << SSH_AUTH_RHOSTS)) &&
1898 options.rhosts_authentication) {
1899 debug("Trying rhosts authentication.");
1900 packet_start(SSH_CMSG_AUTH_RHOSTS);
1901 packet_put_string(local_user, strlen(local_user));
1903 packet_write_wait();
1905 /* The server should respond with success or failure. */
1906 type = packet_read(&payload_len);
1907 if (type == SSH_SMSG_SUCCESS)
1909 if (type != SSH_SMSG_FAILURE)
1910 packet_disconnect("Protocol error: got %d in response to rhosts auth",
1914 * Try .rhosts or /etc/hosts.equiv authentication with RSA host
1917 if ((supported_authentications & (1 << SSH_AUTH_RHOSTS_RSA)) &&
1918 options.rhosts_rsa_authentication && host_key_valid) {
1919 if (try_rhosts_rsa_authentication(local_user, own_host_key))
1922 /* Try RSA authentication if the server supports it. */
1923 if ((supported_authentications & (1 << SSH_AUTH_RSA)) &&
1924 options.rsa_authentication) {
1926 * Try RSA authentication using the authentication agent. The
1927 * agent is tried first because no passphrase is needed for
1928 * it, whereas identity files may require passphrases.
1930 if (try_agent_authentication())
1933 /* Try RSA authentication for each identity. */
1934 for (i = 0; i < options.num_identity_files; i++)
1935 if (try_rsa_authentication(options.identity_files[i]))
1938 /* Try skey authentication if the server supports it. */
1939 if ((supported_authentications & (1 << SSH_AUTH_TIS)) &&
1940 options.skey_authentication && !options.batch_mode) {
1941 if (try_skey_authentication())
1944 /* Try password authentication if the server supports it. */
1945 if ((supported_authentications & (1 << SSH_AUTH_PASSWORD)) &&
1946 options.password_authentication && !options.batch_mode) {
1949 snprintf(prompt, sizeof(prompt), "%.30s@%.40s's password: ",
1951 if (try_password_authentication(prompt))
1954 /* All authentication methods have failed. Exit with an error message. */
1955 fatal("Permission denied.");
1959 * Starts a dialog with the server, and authenticates the current user on the
1960 * server. This does not need any extra privileges. The basic connection
1961 * to the server must already have been established before this is called.
1962 * If login fails, this function prints an error and never returns.
1963 * This function does not require super-user privileges.
1966 ssh_login(int host_key_valid, RSA *own_host_key, const char *orighost,
1967 struct sockaddr *hostaddr, uid_t original_real_uid)
1971 /* Convert the user-supplied hostname into all lowercase. */
1972 host = xstrdup(orighost);
1973 for (cp = host; *cp; cp++)
1977 /* Exchange protocol version identification strings with the server. */
1978 ssh_exchange_identification();
1980 /* Put the connection into non-blocking mode. */
1981 packet_set_nonblocking();
1984 /* authenticate user */
1986 ssh_kex2(host, hostaddr);
1987 ssh_userauth2(host_key_valid, own_host_key, original_real_uid, host);
1989 supported_authentications = 0;
1990 ssh_kex(host, hostaddr);
1991 if (supported_authentications == 0)
1992 fatal("supported_authentications == 0.");
1993 ssh_userauth(host_key_valid, own_host_key, original_real_uid, host);