- OpenBSD CVS updates:

[openssh.git] / auth-skey.c

diff --git a/auth-skey.c b/auth-skey.c
index d54f3d556803a9389a3ab2c59fb6b4bda88b9c15..d7d8422f17a794250b4c8175f18cbe527150d14d 100644 (file)
--- a/auth-skey.c
+++ b/auth-skey.c
@@ -1,14 +1,49 @@
 #include "includes.h"
 
 #ifdef SKEY
-
 RCSID("$Id$");
 
 #include "ssh.h"
-#include <sha1.h>
+#include "packet.h"
+
+#ifdef HAVE_OPENSSL
+#include <openssl/sha.h>
+#endif
+#ifdef HAVE_SSL
+#include <ssl/sha.h>
+#endif
 
 /* from %OpenBSD: skeylogin.c,v 1.32 1999/08/16 14:46:56 millert Exp % */
 
+/* 
+ * try skey authentication,
+ * return 1 on success, 0 on failure, -1 if skey is not available 
+ */
+
+int 
+auth_skey_password(struct passwd * pw, const char *password)
+{
+       if (strncasecmp(password, "s/key", 5) == 0) {
+               char *skeyinfo = skey_keyinfo(pw->pw_name);
+               if (skeyinfo == NULL) {
+                       debug("generating fake skeyinfo for %.100s.",
+                           pw->pw_name);
+                       skeyinfo = skey_fake_keyinfo(pw->pw_name);
+               }
+               if (skeyinfo != NULL)
+                       packet_send_debug(skeyinfo);
+               /* Try again. */
+               return 0;
+       } else if (skey_haskey(pw->pw_name) == 0 &&
+                  skey_passcheck(pw->pw_name, (char *) password) != -1) {
+               /* Authentication succeeded. */
+               return 1;
+       }
+       /* Fall back to ordinary passwd authentication. */
+       return -1;
+}
+
+/* from %OpenBSD: skeylogin.c,v 1.32 1999/08/16 14:46:56 millert Exp % */
 
 #define ROUND(x)   (((x)[0] << 24) + (((x)[1]) << 16) + (((x)[2]) << 8) + \
                    ((x)[3]))
@@ -44,8 +79,9 @@ skey_fake_keyinfo(char *username)
        static char skeyprompt[SKEY_MAX_CHALLENGE+1];
        char *secret = NULL;
        size_t secretlen = 0;
-       SHA1_CTX ctx;
+       SHA_CTX ctx;
        char *p, *u;
+       char md[SHA_DIGEST_LENGTH];
 
        /*
         * Base first 4 chars of seed on hostname.
@@ -62,11 +98,16 @@ skey_fake_keyinfo(char *username)
        pbuf[4] = '\0';
 
        /* Hash the username if possible */
-       if ((up = SHA1Data(username, strlen(username), NULL)) != NULL) {
+       up = malloc(SHA_DIGEST_LENGTH);
+       if (up != NULL) {
                struct stat sb;
                time_t t;
                int fd;
 
+               SHA1_Init(&ctx);
+               SHA1_Update(&ctx, username, strlen(username));
+               SHA1_End(&ctx, up);
+
                /* Collapse the hash */
                ptr = hash_collapse(up);
                memset(up, 0, strlen(up));
@@ -79,6 +120,7 @@ skey_fake_keyinfo(char *username)
                    SEEK_SET) != -1 && read(fd, hseed,
                    SKEY_MAX_SEED_LEN) == SKEY_MAX_SEED_LEN) {
                        close(fd);
+                       fd = -1;
                        secret = hseed;
                        secretlen = SKEY_MAX_SEED_LEN;
                        flg = 0;
@@ -88,23 +130,25 @@ skey_fake_keyinfo(char *username)
                        secretlen = strlen(secret);
                        flg = 0;
                }
+               if (fd != -1)
+                       close(fd);
        }
 
        /* Put that in your pipe and smoke it */
        if (flg == 0) {
                /* Hash secret value with username */
-               SHA1Init(&ctx);
-               SHA1Update(&ctx, secret, secretlen);
-               SHA1Update(&ctx, username, strlen(username));
-               SHA1End(&ctx, up);
+               SHA1_Init(&ctx);
+               SHA1_Update(&ctx, secret, secretlen);
+               SHA1_Update(&ctx, username, strlen(username));
+               SHA1_End(&ctx, up);
                
                /* Zero out */
                memset(secret, 0, secretlen);
 
                /* Now hash the hash */
-               SHA1Init(&ctx);
-               SHA1Update(&ctx, up, strlen(up));
-               SHA1End(&ctx, up);
+               SHA1_Init(&ctx);
+               SHA1_Update(&ctx, up, strlen(up));
+               SHA1_End(&ctx, up);
                
                ptr = hash_collapse(up + 4);
                
@@ -117,7 +161,7 @@ skey_fake_keyinfo(char *username)
                /* Sequence number */
                ptr = ((up[2] + up[3]) % 99) + 1;
 
-               memset(up, 0, 20); /* SHA1 specific */
+               memset(up, 0, SHA_DIGEST_LENGTH); /* SHA1 specific */
                free(up);
 
                (void)snprintf(skeyprompt, sizeof skeyprompt,