+
+typedef struct Authctxt Authctxt;
+typedef struct Authmethod Authmethod;
+
+typedef int sign_cb_fn(
+ Authctxt *authctxt, Key *key,
+ u_char **sigp, int *lenp, u_char *data, int datalen);
+
+struct Authctxt {
+ const char *server_user;
+ const char *local_user;
+ const char *host;
+ const char *service;
+ Authmethod *method;
+ int success;
+ char *authlist;
+ /* pubkey */
+ Key *last_key;
+ sign_cb_fn *last_key_sign;
+ int last_key_hint;
+ AuthenticationConnection *agent;
+ /* hostbased */
+ Key **keys;
+ int nkeys;
+};
+struct Authmethod {
+ char *name; /* string to compare against server's list */
+ int (*userauth)(Authctxt *authctxt);
+ int *enabled; /* flag in option struct that enables method */
+ int *batch_flag; /* flag in option struct that disables method */
+};
+
+void input_userauth_success(int type, int plen, void *ctxt);
+void input_userauth_failure(int type, int plen, void *ctxt);
+void input_userauth_banner(int type, int plen, void *ctxt);
+void input_userauth_error(int type, int plen, void *ctxt);
+void input_userauth_info_req(int type, int plen, void *ctxt);
+void input_userauth_pk_ok(int type, int plen, void *ctxt);
+
+int userauth_none(Authctxt *authctxt);
+int userauth_pubkey(Authctxt *authctxt);
+int userauth_passwd(Authctxt *authctxt);
+int userauth_kbdint(Authctxt *authctxt);
+int userauth_hostbased(Authctxt *authctxt);
+
+void userauth(Authctxt *authctxt, char *authlist);
+
+static int sign_and_send_pubkey(Authctxt *, Key *, sign_cb_fn *);
+static void clear_auth_state(Authctxt *);
+
+static Authmethod *authmethod_get(char *authlist);
+static Authmethod *authmethod_lookup(const char *name);
+static char *authmethods_get(void);
+
+Authmethod authmethods[] = {
+ {"hostbased",
+ userauth_hostbased,
+ &options.hostbased_authentication,
+ NULL},
+ {"publickey",
+ userauth_pubkey,
+ &options.pubkey_authentication,
+ NULL},
+ {"keyboard-interactive",
+ userauth_kbdint,
+ &options.kbd_interactive_authentication,
+ &options.batch_mode},
+ {"password",
+ userauth_passwd,
+ &options.password_authentication,
+ &options.batch_mode},
+ {"none",
+ userauth_none,
+ NULL,
+ NULL},
+ {NULL, NULL, NULL, NULL}
+};
+
+void
+ssh_userauth2(const char *local_user, const char *server_user, char *host,
+ Key **keys, int nkeys)
+{
+ Authctxt authctxt;
+ int type;
+ int plen;
+
+ if (options.challenge_response_authentication)
+ options.kbd_interactive_authentication = 1;
+
+ debug("send SSH2_MSG_SERVICE_REQUEST");
+ packet_start(SSH2_MSG_SERVICE_REQUEST);
+ packet_put_cstring("ssh-userauth");
+ packet_send();
+ packet_write_wait();
+ type = packet_read(&plen);
+ if (type != SSH2_MSG_SERVICE_ACCEPT) {
+ fatal("denied SSH2_MSG_SERVICE_ACCEPT: %d", type);
+ }
+ if (packet_remaining() > 0) {
+ char *reply = packet_get_string(&plen);
+ debug("service_accept: %s", reply);
+ xfree(reply);
+ } else {
+ debug("buggy server: service_accept w/o service");
+ }
+ packet_done();
+ debug("got SSH2_MSG_SERVICE_ACCEPT");
+
+ if (options.preferred_authentications == NULL)
+ options.preferred_authentications = authmethods_get();
+
+ /* setup authentication context */
+ authctxt.agent = ssh_get_authentication_connection();
+ authctxt.server_user = server_user;
+ authctxt.local_user = local_user;
+ authctxt.host = host;
+ authctxt.service = "ssh-connection"; /* service name */
+ authctxt.success = 0;
+ authctxt.method = authmethod_lookup("none");
+ authctxt.authlist = NULL;
+ authctxt.keys = keys;
+ authctxt.nkeys = nkeys;
+ if (authctxt.method == NULL)
+ fatal("ssh_userauth2: internal error: cannot send userauth none request");
+
+ /* initial userauth request */
+ userauth_none(&authctxt);
+
+ dispatch_init(&input_userauth_error);
+ dispatch_set(SSH2_MSG_USERAUTH_SUCCESS, &input_userauth_success);
+ dispatch_set(SSH2_MSG_USERAUTH_FAILURE, &input_userauth_failure);
+ dispatch_set(SSH2_MSG_USERAUTH_BANNER, &input_userauth_banner);
+ dispatch_run(DISPATCH_BLOCK, &authctxt.success, &authctxt); /* loop until success */
+
+ if (authctxt.agent != NULL)
+ ssh_close_authentication_connection(authctxt.agent);
+
+ debug("ssh-userauth2 successful: method %s", authctxt.method->name);
+}
+void
+userauth(Authctxt *authctxt, char *authlist)
+{
+ if (authlist == NULL) {
+ authlist = authctxt->authlist;
+ } else {
+ if (authctxt->authlist)
+ xfree(authctxt->authlist);
+ authctxt->authlist = authlist;
+ }
+ for (;;) {
+ Authmethod *method = authmethod_get(authlist);
+ if (method == NULL)
+ fatal("Permission denied (%s).", authlist);
+ authctxt->method = method;
+ if (method->userauth(authctxt) != 0) {
+ debug2("we sent a %s packet, wait for reply", method->name);
+ break;
+ } else {
+ debug2("we did not send a packet, disable method");
+ method->enabled = NULL;
+ }
+ }
+}
+void
+input_userauth_error(int type, int plen, void *ctxt)
+{
+ fatal("input_userauth_error: bad message during authentication: "
+ "type %d", type);
+}
+void
+input_userauth_banner(int type, int plen, void *ctxt)
+{
+ char *msg, *lang;
+ debug3("input_userauth_banner");
+ msg = packet_get_string(NULL);
+ lang = packet_get_string(NULL);
+ fprintf(stderr, "%s", msg);
+ xfree(msg);
+ xfree(lang);
+}
+void
+input_userauth_success(int type, int plen, void *ctxt)
+{
+ Authctxt *authctxt = ctxt;
+ if (authctxt == NULL)
+ fatal("input_userauth_success: no authentication context");
+ if (authctxt->authlist)
+ xfree(authctxt->authlist);
+ clear_auth_state(authctxt);
+ authctxt->success = 1; /* break out */
+}
+void
+input_userauth_failure(int type, int plen, void *ctxt)
+{
+ Authctxt *authctxt = ctxt;
+ char *authlist = NULL;
+ int partial;
+
+ if (authctxt == NULL)
+ fatal("input_userauth_failure: no authentication context");
+
+ authlist = packet_get_string(NULL);
+ partial = packet_get_char();
+ packet_done();
+
+ if (partial != 0)
+ log("Authenticated with partial success.");
+ debug("authentications that can continue: %s", authlist);
+
+ clear_auth_state(authctxt);
+ userauth(authctxt, authlist);
+}
+void
+input_userauth_pk_ok(int type, int plen, void *ctxt)
+{
+ Authctxt *authctxt = ctxt;
+ Key *key = NULL;
+ Buffer b;
+ int alen, blen, sent = 0;
+ char *pkalg, *pkblob, *fp;
+
+ if (authctxt == NULL)
+ fatal("input_userauth_pk_ok: no authentication context");
+ if (datafellows & SSH_BUG_PKOK) {
+ /* this is similar to SSH_BUG_PKAUTH */
+ debug2("input_userauth_pk_ok: SSH_BUG_PKOK");
+ pkblob = packet_get_string(&blen);
+ buffer_init(&b);
+ buffer_append(&b, pkblob, blen);
+ pkalg = buffer_get_string(&b, &alen);
+ buffer_free(&b);
+ } else {
+ pkalg = packet_get_string(&alen);
+ pkblob = packet_get_string(&blen);
+ }
+ packet_done();
+
+ debug("input_userauth_pk_ok: pkalg %s blen %d lastkey %p hint %d",
+ pkalg, blen, authctxt->last_key, authctxt->last_key_hint);
+
+ do {
+ if (authctxt->last_key == NULL ||
+ authctxt->last_key_sign == NULL) {
+ debug("no last key or no sign cb");
+ break;
+ }
+ if (key_type_from_name(pkalg) == KEY_UNSPEC) {
+ debug("unknown pkalg %s", pkalg);
+ break;
+ }
+ if ((key = key_from_blob(pkblob, blen)) == NULL) {
+ debug("no key from blob. pkalg %s", pkalg);
+ break;
+ }
+ fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+ debug2("input_userauth_pk_ok: fp %s", fp);
+ xfree(fp);
+ if (!key_equal(key, authctxt->last_key)) {
+ debug("key != last_key");
+ break;
+ }
+ sent = sign_and_send_pubkey(authctxt, key,
+ authctxt->last_key_sign);
+ } while(0);
+
+ if (key != NULL)
+ key_free(key);
+ xfree(pkalg);
+ xfree(pkblob);
+
+ /* unregister */
+ clear_auth_state(authctxt);
+ dispatch_set(SSH2_MSG_USERAUTH_PK_OK, NULL);
+
+ /* try another method if we did not send a packet*/
+ if (sent == 0)
+ userauth(authctxt, NULL);
+
+}
+
+int
+userauth_none(Authctxt *authctxt)
+{
+ /* initial userauth request */
+ packet_start(SSH2_MSG_USERAUTH_REQUEST);
+ packet_put_cstring(authctxt->server_user);
+ packet_put_cstring(authctxt->service);
+ packet_put_cstring(authctxt->method->name);
+ packet_send();
+ return 1;
+}
+