dropbear: cli-authpubkey.c annotate

annotate cli-authpubkey.c @ 689:c3de235d9506

/dev/random blocks on busy servers too.

author	Matt Johnston <matt@ucc.asn.au>
date	Thu, 19 Jul 2012 21:34:27 +0800
parents	a8367733e8cd
children	f336d232fc63

rev	line source
74 e3adf4cf5465 License boilerplate etc, add Mihnea as an author to some of the files Matt Johnston <matt@ucc.asn.au> parents: 68 diff changeset	1 /*
e3adf4cf5465 License boilerplate etc, add Mihnea as an author to some of the files Matt Johnston <matt@ucc.asn.au> parents: 68 diff changeset	2 * Dropbear SSH
e3adf4cf5465 License boilerplate etc, add Mihnea as an author to some of the files Matt Johnston <matt@ucc.asn.au> parents: 68 diff changeset	3 *
e3adf4cf5465 License boilerplate etc, add Mihnea as an author to some of the files Matt Johnston <matt@ucc.asn.au> parents: 68 diff changeset	4 * Copyright (c) 2002,2003 Matt Johnston
e3adf4cf5465 License boilerplate etc, add Mihnea as an author to some of the files Matt Johnston <matt@ucc.asn.au> parents: 68 diff changeset	5 * Copyright (c) 2004 by Mihnea Stoenescu
e3adf4cf5465 License boilerplate etc, add Mihnea as an author to some of the files Matt Johnston <matt@ucc.asn.au> parents: 68 diff changeset	6 * All rights reserved.
e3adf4cf5465 License boilerplate etc, add Mihnea as an author to some of the files Matt Johnston <matt@ucc.asn.au> parents: 68 diff changeset	7 *
e3adf4cf5465 License boilerplate etc, add Mihnea as an author to some of the files Matt Johnston <matt@ucc.asn.au> parents: 68 diff changeset	8 * Permission is hereby granted, free of charge, to any person obtaining a copy
e3adf4cf5465 License boilerplate etc, add Mihnea as an author to some of the files Matt Johnston <matt@ucc.asn.au> parents: 68 diff changeset	9 * of this software and associated documentation files (the "Software"), to deal
e3adf4cf5465 License boilerplate etc, add Mihnea as an author to some of the files Matt Johnston <matt@ucc.asn.au> parents: 68 diff changeset	10 * in the Software without restriction, including without limitation the rights
e3adf4cf5465 License boilerplate etc, add Mihnea as an author to some of the files Matt Johnston <matt@ucc.asn.au> parents: 68 diff changeset	11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
e3adf4cf5465 License boilerplate etc, add Mihnea as an author to some of the files Matt Johnston <matt@ucc.asn.au> parents: 68 diff changeset	12 * copies of the Software, and to permit persons to whom the Software is
e3adf4cf5465 License boilerplate etc, add Mihnea as an author to some of the files Matt Johnston <matt@ucc.asn.au> parents: 68 diff changeset	13 * furnished to do so, subject to the following conditions:
e3adf4cf5465 License boilerplate etc, add Mihnea as an author to some of the files Matt Johnston <matt@ucc.asn.au> parents: 68 diff changeset	14 *
e3adf4cf5465 License boilerplate etc, add Mihnea as an author to some of the files Matt Johnston <matt@ucc.asn.au> parents: 68 diff changeset	15 * The above copyright notice and this permission notice shall be included in
e3adf4cf5465 License boilerplate etc, add Mihnea as an author to some of the files Matt Johnston <matt@ucc.asn.au> parents: 68 diff changeset	16 * all copies or substantial portions of the Software.
e3adf4cf5465 License boilerplate etc, add Mihnea as an author to some of the files Matt Johnston <matt@ucc.asn.au> parents: 68 diff changeset	17 *
e3adf4cf5465 License boilerplate etc, add Mihnea as an author to some of the files Matt Johnston <matt@ucc.asn.au> parents: 68 diff changeset	18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
e3adf4cf5465 License boilerplate etc, add Mihnea as an author to some of the files Matt Johnston <matt@ucc.asn.au> parents: 68 diff changeset	19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
e3adf4cf5465 License boilerplate etc, add Mihnea as an author to some of the files Matt Johnston <matt@ucc.asn.au> parents: 68 diff changeset	20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
e3adf4cf5465 License boilerplate etc, add Mihnea as an author to some of the files Matt Johnston <matt@ucc.asn.au> parents: 68 diff changeset	21 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
e3adf4cf5465 License boilerplate etc, add Mihnea as an author to some of the files Matt Johnston <matt@ucc.asn.au> parents: 68 diff changeset	22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
e3adf4cf5465 License boilerplate etc, add Mihnea as an author to some of the files Matt Johnston <matt@ucc.asn.au> parents: 68 diff changeset	23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
e3adf4cf5465 License boilerplate etc, add Mihnea as an author to some of the files Matt Johnston <matt@ucc.asn.au> parents: 68 diff changeset	24 * SOFTWARE. */
e3adf4cf5465 License boilerplate etc, add Mihnea as an author to some of the files Matt Johnston <matt@ucc.asn.au> parents: 68 diff changeset	25
45 9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	26 #include "includes.h"
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	27 #include "buffer.h"
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	28 #include "dbutil.h"
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	29 #include "session.h"
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	30 #include "ssh.h"
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	31 #include "runopts.h"
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	32 #include "auth.h"
551 c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	33 #include "agentfwd.h"
45 9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	34
68 eee77ac31ccc cleaning up the pubkey defines Matt Johnston <matt@ucc.asn.au> parents: 62 diff changeset	35 #ifdef ENABLE_CLI_PUBKEY_AUTH
45 9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	36 static void send_msg_userauth_pubkey(sign_key *key, int type, int realsign);
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	37
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	38 /* Called when we receive a SSH_MSG_USERAUTH_FAILURE for a pubkey request.
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	39 * We use it to remove the key we tried from the list */
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	40 void cli_pubkeyfail() {
551 c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	41 m_list_elem *iter;
c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	42 for (iter = cli_opts.privkeys->first; iter; iter = iter->next) {
c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	43 sign_key iter_key = (sign_key)iter->item;
c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	44
c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	45 if (iter_key == cli_ses.lastprivkey)
c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	46 {
c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	47 /* found the failing key */
c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	48 list_remove(iter);
c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	49 sign_key_free(iter_key);
c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	50 cli_ses.lastprivkey = NULL;
c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	51 return;
45 9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	52 }
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	53 }
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	54 }
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	55
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	56 void recv_msg_userauth_pk_ok() {
551 c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	57 m_list_elem *iter;
406 2448ae3e75b5 Fix leak of keybuf in recv_msg_userauth_pk_ok, courtesy of Klocwork Matt Johnston <matt@ucc.asn.au> parents: 215 diff changeset	58 buffer* keybuf = NULL;
45 9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	59 char* algotype = NULL;
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	60 unsigned int algolen;
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	61 int keytype;
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	62 unsigned int remotelen;
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	63
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 74 diff changeset	64 TRACE(("enter recv_msg_userauth_pk_ok"))
45 9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	65
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	66 algotype = buf_getstring(ses.payload, &algolen);
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	67 keytype = signkey_type_from_name(algotype, algolen);
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 74 diff changeset	68 TRACE(("recv_msg_userauth_pk_ok: type %d", keytype))
45 9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	69 m_free(algotype);
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	70
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	71 keybuf = buf_new(MAX_PUBKEY_SIZE);
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	72
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	73 remotelen = buf_getint(ses.payload);
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	74
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	75 /* Iterate through our keys, find which one it was that matched, and
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	76 * send a real request with that key */
551 c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	77 for (iter = cli_opts.privkeys->first; iter; iter = iter->next) {
c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	78 sign_key key = (sign_key)iter->item;
c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	79 if (key->type != keytype) {
45 9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	80 /* Types differed */
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 74 diff changeset	81 TRACE(("types differed"))
45 9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	82 continue;
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	83 }
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	84
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	85 /* Now we compare the contents of the key */
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	86 keybuf->pos = keybuf->len = 0;
551 c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	87 buf_put_pub_key(keybuf, key, keytype);
47 4b53a43f0082 - client pubkey auth works Matt Johnston <matt@ucc.asn.au> parents: 45 diff changeset	88 buf_setpos(keybuf, 0);
4b53a43f0082 - client pubkey auth works Matt Johnston <matt@ucc.asn.au> parents: 45 diff changeset	89 buf_incrpos(keybuf, 4); /* first int is the length of the remainder (ie
4b53a43f0082 - client pubkey auth works Matt Johnston <matt@ucc.asn.au> parents: 45 diff changeset	90 remotelen) which has already been taken from
4b53a43f0082 - client pubkey auth works Matt Johnston <matt@ucc.asn.au> parents: 45 diff changeset	91 the remote buffer */
45 9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	92
47 4b53a43f0082 - client pubkey auth works Matt Johnston <matt@ucc.asn.au> parents: 45 diff changeset	93
4b53a43f0082 - client pubkey auth works Matt Johnston <matt@ucc.asn.au> parents: 45 diff changeset	94 if (keybuf->len-4 != remotelen) {
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 74 diff changeset	95 TRACE(("lengths differed: localh %d remote %d", keybuf->len, remotelen))
45 9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	96 /* Lengths differed */
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	97 continue;
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	98 }
47 4b53a43f0082 - client pubkey auth works Matt Johnston <matt@ucc.asn.au> parents: 45 diff changeset	99 if (memcmp(buf_getptr(keybuf, remotelen),
45 9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	100 buf_getptr(ses.payload, remotelen), remotelen) != 0) {
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	101 /* Data didn't match this key */
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 74 diff changeset	102 TRACE(("data differed"))
45 9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	103 continue;
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	104 }
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	105
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	106 /* Success */
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	107 break;
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	108 }
340 454a34b2dfd1 Fixes from Erik Hovland: Matt Johnston <matt@ucc.asn.au> parents: 215 diff changeset	109 buf_free(keybuf);
45 9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	110
551 c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	111 if (iter != NULL) {
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 74 diff changeset	112 TRACE(("matching key"))
45 9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	113 /* XXX TODO: if it's an encrypted key, here we ask for their
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	114 * password */
551 c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	115 send_msg_userauth_pubkey((sign_key*)iter->item, keytype, 1);
45 9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	116 } else {
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 74 diff changeset	117 TRACE(("That was whacky. We got told that a key was valid, but it didn't match our list. Sounds like dodgy code on Dropbear's part"))
45 9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	118 }
406 2448ae3e75b5 Fix leak of keybuf in recv_msg_userauth_pk_ok, courtesy of Klocwork Matt Johnston <matt@ucc.asn.au> parents: 215 diff changeset	119
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 74 diff changeset	120 TRACE(("leave recv_msg_userauth_pk_ok"))
45 9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	121 }
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	122
551 c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	123 void cli_buf_put_sign(buffer* buf, sign_key *key, int type,
c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	124 const unsigned char *data, unsigned int len)
c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	125 {
668 405418f7dc5e Fixed compilation with unset ENABLE_{SVR,CLI}_AGENTFWD. Andrey Mazo <ahippo@yandex.ru> parents: 560 diff changeset	126 #ifdef ENABLE_CLI_AGENTFWD
551 c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	127 if (key->source == SIGNKEY_SOURCE_AGENT) {
c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	128 /* Format the agent signature ourselves, as buf_put_sign would. */
c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	129 buffer *sigblob;
c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	130 sigblob = buf_new(MAX_PUBKEY_SIZE);
c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	131 agent_buf_sign(sigblob, key, data, len);
c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	132 buf_setpos(sigblob, 0);
c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	133 buf_putstring(buf, buf_getptr(sigblob, sigblob->len),
c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	134 sigblob->len);
c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	135
c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	136 buf_free(sigblob);
669 a8367733e8cd Slight formatting change for ENABLE_CLI_AGENTFWD if statement Matt Johnston <matt@ucc.asn.au> parents: 668 diff changeset	137 } else
a8367733e8cd Slight formatting change for ENABLE_CLI_AGENTFWD if statement Matt Johnston <matt@ucc.asn.au> parents: 668 diff changeset	138 #endif /* ENABLE_CLI_AGENTFWD */
a8367733e8cd Slight formatting change for ENABLE_CLI_AGENTFWD if statement Matt Johnston <matt@ucc.asn.au> parents: 668 diff changeset	139 {
551 c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	140 buf_put_sign(buf, key, type, data, len);
c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	141 }
c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	142 }
c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	143
45 9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	144 /* TODO: make it take an agent reference to use as well */
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	145 static void send_msg_userauth_pubkey(sign_key *key, int type, int realsign) {
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	146
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	147 const char *algoname = NULL;
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	148 int algolen;
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	149 buffer* sigbuf = NULL;
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	150
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 74 diff changeset	151 TRACE(("enter send_msg_userauth_pubkey"))
45 9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	152 CHECKCLEARTOWRITE();
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	153
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	154 buf_putbyte(ses.writepayload, SSH_MSG_USERAUTH_REQUEST);
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	155
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	156 buf_putstring(ses.writepayload, cli_opts.username,
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	157 strlen(cli_opts.username));
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	158
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	159 buf_putstring(ses.writepayload, SSH_SERVICE_CONNECTION,
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	160 SSH_SERVICE_CONNECTION_LEN);
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	161
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	162 buf_putstring(ses.writepayload, AUTH_METHOD_PUBKEY,
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	163 AUTH_METHOD_PUBKEY_LEN);
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	164
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	165 buf_putbyte(ses.writepayload, realsign);
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	166
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	167 algoname = signkey_name_from_type(type, &algolen);
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	168
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	169 buf_putstring(ses.writepayload, algoname, algolen);
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	170 buf_put_pub_key(ses.writepayload, key, type);
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	171
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	172 if (realsign) {
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 74 diff changeset	173 TRACE(("realsign"))
45 9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	174 /* We put the signature as well - this contains string(session id), then
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	175 * the contents of the write payload to this point */
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	176 sigbuf = buf_new(4 + SHA1_HASH_SIZE + ses.writepayload->len);
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	177 buf_putstring(sigbuf, ses.session_id, SHA1_HASH_SIZE);
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	178 buf_putbytes(sigbuf, ses.writepayload->data, ses.writepayload->len);
552 de3653483ac0 - Client auth using an agent's key works. Still need to implement client Matt Johnston <matt@ucc.asn.au> parents: 551 diff changeset	179 cli_buf_put_sign(ses.writepayload, key, type, sigbuf->data, sigbuf->len);
45 9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	180 buf_free(sigbuf); /* Nothing confidential in the buffer */
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	181 }
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	182
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	183 encrypt_packet();
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 74 diff changeset	184 TRACE(("leave send_msg_userauth_pubkey"))
45 9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	185 }
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	186
551 c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	187 /* Returns 1 if a key was tried */
45 9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	188 int cli_auth_pubkey() {
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	189
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 74 diff changeset	190 TRACE(("enter cli_auth_pubkey"))
45 9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	191
668 405418f7dc5e Fixed compilation with unset ENABLE_{SVR,CLI}_AGENTFWD. Andrey Mazo <ahippo@yandex.ru> parents: 560 diff changeset	192 #ifdef ENABLE_CLI_AGENTFWD
560 52d7301e46bd Agent forwarding works Matt Johnston <matt@ucc.asn.au> parents: 552 diff changeset	193 if (!cli_opts.agent_keys_loaded) {
225 ca7e76d981d9 - progress towards client agent forwarding Matt Johnston <matt@ucc.asn.au> parents: 215 diff changeset	194 /* get the list of available keys from the agent */
560 52d7301e46bd Agent forwarding works Matt Johnston <matt@ucc.asn.au> parents: 552 diff changeset	195 cli_load_agent_keys(cli_opts.privkeys);
550 61c3513825b0 Talking to the agent works now. Can't interpret the pubkeys. Matt Johnston <matt@ucc.asn.au> parents: 547 diff changeset	196 cli_opts.agent_keys_loaded = 1;
225 ca7e76d981d9 - progress towards client agent forwarding Matt Johnston <matt@ucc.asn.au> parents: 215 diff changeset	197 }
668 405418f7dc5e Fixed compilation with unset ENABLE_{SVR,CLI}_AGENTFWD. Andrey Mazo <ahippo@yandex.ru> parents: 560 diff changeset	198 #endif
225 ca7e76d981d9 - progress towards client agent forwarding Matt Johnston <matt@ucc.asn.au> parents: 215 diff changeset	199
551 c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	200 if (cli_opts.privkeys->first) {
c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	201 sign_key * key = (sign_key*)cli_opts.privkeys->first->item;
45 9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	202 /* Send a trial request */
551 c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	203 send_msg_userauth_pubkey(key, key->type, 0);
c3f2ec71e3d4 New standard linked list to use, rather than adhoc SignKeyList or TCPFwdList Matt Johnston <matt@ucc.asn.au> parents: 550 diff changeset	204 cli_ses.lastprivkey = key;
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 74 diff changeset	205 TRACE(("leave cli_auth_pubkey-success"))
45 9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	206 return 1;
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	207 } else {
552 de3653483ac0 - Client auth using an agent's key works. Still need to implement client Matt Johnston <matt@ucc.asn.au> parents: 551 diff changeset	208 /* no more keys left */
165 0cfba3034be5 Fixed DEBUG_TRACE macro so that we don't get semicolons left about the place Matt Johnston <matt@ucc.asn.au> parents: 74 diff changeset	209 TRACE(("leave cli_auth_pubkey-failure"))
45 9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	210 return 0;
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	211 }
9ee8996a375f Pubkey auth is mostly there for the client. Something strange with Matt Johnston <matt@ucc.asn.au> parents: diff changeset	212 }
552 de3653483ac0 - Client auth using an agent's key works. Still need to implement client Matt Johnston <matt@ucc.asn.au> parents: 551 diff changeset	213
de3653483ac0 - Client auth using an agent's key works. Still need to implement client Matt Johnston <matt@ucc.asn.au> parents: 551 diff changeset	214 void cli_auth_pubkey_cleanup() {
de3653483ac0 - Client auth using an agent's key works. Still need to implement client Matt Johnston <matt@ucc.asn.au> parents: 551 diff changeset	215
de3653483ac0 - Client auth using an agent's key works. Still need to implement client Matt Johnston <matt@ucc.asn.au> parents: 551 diff changeset	216 #ifdef ENABLE_CLI_AGENTFWD
de3653483ac0 - Client auth using an agent's key works. Still need to implement client Matt Johnston <matt@ucc.asn.au> parents: 551 diff changeset	217 m_close(cli_opts.agent_fd);
de3653483ac0 - Client auth using an agent's key works. Still need to implement client Matt Johnston <matt@ucc.asn.au> parents: 551 diff changeset	218 cli_opts.agent_fd = -1;
de3653483ac0 - Client auth using an agent's key works. Still need to implement client Matt Johnston <matt@ucc.asn.au> parents: 551 diff changeset	219 #endif
de3653483ac0 - Client auth using an agent's key works. Still need to implement client Matt Johnston <matt@ucc.asn.au> parents: 551 diff changeset	220
de3653483ac0 - Client auth using an agent's key works. Still need to implement client Matt Johnston <matt@ucc.asn.au> parents: 551 diff changeset	221 while (cli_opts.privkeys->first) {
de3653483ac0 - Client auth using an agent's key works. Still need to implement client Matt Johnston <matt@ucc.asn.au> parents: 551 diff changeset	222 sign_key * key = list_remove(cli_opts.privkeys->first);
de3653483ac0 - Client auth using an agent's key works. Still need to implement client Matt Johnston <matt@ucc.asn.au> parents: 551 diff changeset	223 sign_key_free(key);
de3653483ac0 - Client auth using an agent's key works. Still need to implement client Matt Johnston <matt@ucc.asn.au> parents: 551 diff changeset	224 }
de3653483ac0 - Client auth using an agent's key works. Still need to implement client Matt Johnston <matt@ucc.asn.au> parents: 551 diff changeset	225 }
68 eee77ac31ccc cleaning up the pubkey defines Matt Johnston <matt@ucc.asn.au> parents: 62 diff changeset	226 #endif /* Pubkey auth */

Mercurial > dropbear

annotate cli-authpubkey.c @ 689:c3de235d9506