#include "includes.h"#include "ssh2.h"#include "xmalloc.h"#include "packet.h"#include "buffer.h"#include "log.h"#include "servconf.h"#include "compat.h"#include "bufaux.h"#include "auth.h"#include "key.h"#include "canohost.h"#include "monitor_wrap.h"#include "pathnames.h"Go to the source code of this file.
Functions | |
| RCSID ("$OpenBSD: auth2-hostbased.c,v 1.6 2004/01/19 21:25:15 markus Exp $") | |
| static int | userauth_hostbased (Authctxt *authctxt) |
| int | hostbased_key_allowed (struct passwd *pw, const char *cuser, char *chost, Key *key) |
Variables | |
| ServerOptions | options |
| u_char * | session_id2 |
| u_int | session_id2_len |
| Authmethod | method_hostbased |
|
||||||||||||||||||||
|
Definition at line 132 of file auth2-hostbased.c. References _PATH_SSH_SYSTEM_HOSTFILE, _PATH_SSH_SYSTEM_HOSTFILE2, _PATH_SSH_USER_HOSTFILE, _PATH_SSH_USER_HOSTFILE2, auth_rhosts2(), check_key_in_hostfiles(), debug2(), get_canonical_hostname(), get_remote_ipaddr(), HOST_NEW, HOST_OK, ServerOptions::hostbased_uses_name_from_packet_only, ServerOptions::ignore_user_known_hosts, logit(), and ServerOptions::use_dns. Referenced by mm_answer_keyallowed(), and userauth_hostbased(). 00134 { 00135 const char *resolvedname, *ipaddr, *lookup; 00136 HostStatus host_status; 00137 int len; 00138 00139 resolvedname = get_canonical_hostname(options.use_dns); 00140 ipaddr = get_remote_ipaddr(); 00141 00142 debug2("userauth_hostbased: chost %s resolvedname %s ipaddr %s", 00143 chost, resolvedname, ipaddr); 00144 00145 if (options.hostbased_uses_name_from_packet_only) { 00146 if (auth_rhosts2(pw, cuser, chost, chost) == 0) 00147 return 0; 00148 lookup = chost; 00149 } else { 00150 if (((len = strlen(chost)) > 0) && chost[len - 1] == '.') { 00151 debug2("stripping trailing dot from chost %s", chost); 00152 chost[len - 1] = '\0'; 00153 } 00154 if (strcasecmp(resolvedname, chost) != 0) 00155 logit("userauth_hostbased mismatch: " 00156 "client sends %s, but we resolve %s to %s", 00157 chost, ipaddr, resolvedname); 00158 if (auth_rhosts2(pw, cuser, resolvedname, ipaddr) == 0) 00159 return 0; 00160 lookup = resolvedname; 00161 } 00162 debug2("userauth_hostbased: access allowed by auth_rhosts2"); 00163 00164 host_status = check_key_in_hostfiles(pw, key, lookup, 00165 _PATH_SSH_SYSTEM_HOSTFILE, 00166 options.ignore_user_known_hosts ? NULL : _PATH_SSH_USER_HOSTFILE); 00167 00168 /* backward compat if no key has been found. */ 00169 if (host_status == HOST_NEW) 00170 host_status = check_key_in_hostfiles(pw, key, lookup, 00171 _PATH_SSH_SYSTEM_HOSTFILE2, 00172 options.ignore_user_known_hosts ? NULL : 00173 _PATH_SSH_USER_HOSTFILE2); 00174 00175 return (host_status == HOST_OK); 00176 }
|
|
||||||||||||
|
|
|
|
Definition at line 48 of file auth2-hostbased.c. References buffer_append(), buffer_dump(), buffer_free(), buffer_init(), buffer_len(), buffer_ptr(), buffer_put_char(), buffer_put_cstring(), buffer_put_string(), datafellows, debug(), debug2(), error(), hostbased_key_allowed(), key_free(), key_from_blob(), key_type_from_name(), KEY_UNSPEC, key_verify(), logit(), packet_get_string(), PRIVSEP, Authctxt::pw, Authctxt::service, session_id2, session_id2_len, SSH2_MSG_USERAUTH_REQUEST, SSH_BUG_HBSERVICE, Key::type, Authctxt::user, Authctxt::valid, and xfree(). 00049 { 00050 Buffer b; 00051 Key *key = NULL; 00052 char *pkalg, *cuser, *chost, *service; 00053 u_char *pkblob, *sig; 00054 u_int alen, blen, slen; 00055 int pktype; 00056 int authenticated = 0; 00057 00058 if (!authctxt->valid) { 00059 debug2("userauth_hostbased: disabled because of invalid user"); 00060 return 0; 00061 } 00062 pkalg = packet_get_string(&alen); 00063 pkblob = packet_get_string(&blen); 00064 chost = packet_get_string(NULL); 00065 cuser = packet_get_string(NULL); 00066 sig = packet_get_string(&slen); 00067 00068 debug("userauth_hostbased: cuser %s chost %s pkalg %s slen %d", 00069 cuser, chost, pkalg, slen); 00070 #ifdef DEBUG_PK 00071 debug("signature:"); 00072 buffer_init(&b); 00073 buffer_append(&b, sig, slen); 00074 buffer_dump(&b); 00075 buffer_free(&b); 00076 #endif 00077 pktype = key_type_from_name(pkalg); 00078 if (pktype == KEY_UNSPEC) { 00079 /* this is perfectly legal */ 00080 logit("userauth_hostbased: unsupported " 00081 "public key algorithm: %s", pkalg); 00082 goto done; 00083 } 00084 key = key_from_blob(pkblob, blen); 00085 if (key == NULL) { 00086 error("userauth_hostbased: cannot decode key: %s", pkalg); 00087 goto done; 00088 } 00089 if (key->type != pktype) { 00090 error("userauth_hostbased: type mismatch for decoded key " 00091 "(received %d, expected %d)", key->type, pktype); 00092 goto done; 00093 } 00094 service = datafellows & SSH_BUG_HBSERVICE ? "ssh-userauth" : 00095 authctxt->service; 00096 buffer_init(&b); 00097 buffer_put_string(&b, session_id2, session_id2_len); 00098 /* reconstruct packet */ 00099 buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST); 00100 buffer_put_cstring(&b, authctxt->user); 00101 buffer_put_cstring(&b, service); 00102 buffer_put_cstring(&b, "hostbased"); 00103 buffer_put_string(&b, pkalg, alen); 00104 buffer_put_string(&b, pkblob, blen); 00105 buffer_put_cstring(&b, chost); 00106 buffer_put_cstring(&b, cuser); 00107 #ifdef DEBUG_PK 00108 buffer_dump(&b); 00109 #endif 00110 /* test for allowed key and correct signature */ 00111 authenticated = 0; 00112 if (PRIVSEP(hostbased_key_allowed(authctxt->pw, cuser, chost, key)) && 00113 PRIVSEP(key_verify(key, sig, slen, buffer_ptr(&b), 00114 buffer_len(&b))) == 1) 00115 authenticated = 1; 00116 00117 buffer_free(&b); 00118 done: 00119 debug2("userauth_hostbased: authenticated %d", authenticated); 00120 if (key != NULL) 00121 key_free(key); 00122 xfree(pkalg); 00123 xfree(pkblob); 00124 xfree(cuser); 00125 xfree(chost); 00126 xfree(sig); 00127 return authenticated; 00128 }
|
|
|
Initial value: {
"hostbased",
userauth_hostbased,
&options.hostbased_authentication
}
Definition at line 178 of file auth2-hostbased.c. |
|
|
|
|
|
Definition at line 66 of file sshconnect2.c. Referenced by do_ssh2_kex(), mm_answer_sign(), mm_get_kex(), monitor_valid_hostbasedblob(), monitor_valid_userblob(), sign_and_send_pubkey(), ssh_kex2(), userauth_hostbased(), and userauth_pubkey(). |
|
|
Definition at line 67 of file sshconnect2.c. Referenced by do_ssh2_kex(), mm_answer_sign(), mm_get_kex(), monitor_valid_hostbasedblob(), monitor_valid_userblob(), sign_and_send_pubkey(), ssh_kex2(), userauth_hostbased(), and userauth_pubkey(). |