#include "includes.h"#include "ssh.h"#include "ssh2.h"#include "xmalloc.h"#include "packet.h"#include "buffer.h"#include "log.h"#include "servconf.h"#include "compat.h"#include "bufaux.h"#include "auth.h"#include "key.h"#include "pathnames.h"#include "uidswap.h"#include "auth-options.h"#include "canohost.h"#include "monitor_wrap.h"#include "misc.h"Go to the source code of this file.
Functions | |
| RCSID ("$OpenBSD: auth2-pubkey.c,v 1.9 2004/12/11 01:48:56 dtucker Exp $") | |
| static int | userauth_pubkey (Authctxt *authctxt) |
| static int | user_key_allowed2 (struct passwd *pw, Key *key, char *file) |
| int | user_key_allowed (struct passwd *pw, Key *key) |
Variables | |
| ServerOptions | options |
| u_char * | session_id2 |
| u_int | session_id2_len |
| Authmethod | method_pubkey |
|
||||||||||||
|
|
|
||||||||||||
|
Definition at line 260 of file auth2-pubkey.c. References authorized_keys_file(), authorized_keys_file2(), file, user_key_allowed2(), and xfree(). 00261 { 00262 int success; 00263 char *file; 00264 00265 file = authorized_keys_file(pw); 00266 success = user_key_allowed2(pw, key, file); 00267 xfree(file); 00268 if (success) 00269 return success; 00270 00271 /* try suffix "2" for backward compat, too */ 00272 file = authorized_keys_file2(pw); 00273 success = user_key_allowed2(pw, key, file); 00274 xfree(file); 00275 return success; 00276 }
|
|
||||||||||||||||
|
Definition at line 170 of file auth2-pubkey.c. References auth_parse_options(), debug(), debug2(), key_equal(), key_fingerprint(), key_free(), key_new(), key_read(), key_type(), logit(), read_keyfile_line(), restore_uid(), secure_filename(), SSH_FP_HEX, SSH_FP_MD5, SSH_MAX_PUBKEY_BYTES, ServerOptions::strict_modes, temporarily_use_uid(), Key::type, verbose(), and xfree(). Referenced by user_key_allowed(). 00171 { 00172 char line[SSH_MAX_PUBKEY_BYTES]; 00173 int found_key = 0; 00174 FILE *f; 00175 u_long linenum = 0; 00176 struct stat st; 00177 Key *found; 00178 char *fp; 00179 00180 /* Temporarily use the user's uid. */ 00181 temporarily_use_uid(pw); 00182 00183 debug("trying public key file %s", file); 00184 00185 /* Fail quietly if file does not exist */ 00186 if (stat(file, &st) < 0) { 00187 /* Restore the privileged uid. */ 00188 restore_uid(); 00189 return 0; 00190 } 00191 /* Open the file containing the authorized keys. */ 00192 f = fopen(file, "r"); 00193 if (!f) { 00194 /* Restore the privileged uid. */ 00195 restore_uid(); 00196 return 0; 00197 } 00198 if (options.strict_modes && 00199 secure_filename(f, file, pw, line, sizeof(line)) != 0) { 00200 fclose(f); 00201 logit("Authentication refused: %s", line); 00202 restore_uid(); 00203 return 0; 00204 } 00205 00206 found_key = 0; 00207 found = key_new(key->type); 00208 00209 while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) { 00210 char *cp, *key_options = NULL; 00211 00212 /* Skip leading whitespace, empty and comment lines. */ 00213 for (cp = line; *cp == ' ' || *cp == '\t'; cp++) 00214 ; 00215 if (!*cp || *cp == '\n' || *cp == '#') 00216 continue; 00217 00218 if (key_read(found, &cp) != 1) { 00219 /* no key? check if there are options for this key */ 00220 int quoted = 0; 00221 debug2("user_key_allowed: check options: '%s'", cp); 00222 key_options = cp; 00223 for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) { 00224 if (*cp == '\\' && cp[1] == '"') 00225 cp++; /* Skip both */ 00226 else if (*cp == '"') 00227 quoted = !quoted; 00228 } 00229 /* Skip remaining whitespace. */ 00230 for (; *cp == ' ' || *cp == '\t'; cp++) 00231 ; 00232 if (key_read(found, &cp) != 1) { 00233 debug2("user_key_allowed: advance: '%s'", cp); 00234 /* still no key? advance to next line*/ 00235 continue; 00236 } 00237 } 00238 if (key_equal(found, key) && 00239 auth_parse_options(pw, key_options, file, linenum) == 1) { 00240 found_key = 1; 00241 debug("matching key found: file %s, line %lu", 00242 file, linenum); 00243 fp = key_fingerprint(found, SSH_FP_MD5, SSH_FP_HEX); 00244 verbose("Found matching %s key: %s", 00245 key_type(found), fp); 00246 xfree(fp); 00247 break; 00248 } 00249 } 00250 restore_uid(); 00251 fclose(f); 00252 key_free(found); 00253 if (!found_key) 00254 debug2("key not found"); 00255 return found_key; 00256 }
|
|
|
Definition at line 52 of file auth2-pubkey.c. References auth_clear_options(), buffer_append(), buffer_dump(), buffer_free(), buffer_get_string(), buffer_init(), buffer_len(), buffer_ptr(), buffer_put_char(), buffer_put_cstring(), buffer_put_string(), datafellows, debug(), debug2(), error(), key_free(), key_from_blob(), key_type_from_name(), KEY_UNSPEC, key_verify(), logit(), packet_check_eom, packet_get_char(), packet_get_string(), packet_put_string(), packet_send(), packet_start(), packet_write_wait(), Authctxt::postponed, PRIVSEP, Authctxt::pw, Authctxt::service, session_id2, session_id2_len, SSH2_MSG_USERAUTH_PK_OK, SSH2_MSG_USERAUTH_REQUEST, SSH_BUG_PKAUTH, SSH_BUG_PKSERVICE, SSH_OLD_SESSIONID, Key::type, Authctxt::user, user_key_allowed(), Authctxt::valid, and xfree(). 00053 { 00054 Buffer b; 00055 Key *key = NULL; 00056 char *pkalg; 00057 u_char *pkblob, *sig; 00058 u_int alen, blen, slen; 00059 int have_sig, pktype; 00060 int authenticated = 0; 00061 00062 if (!authctxt->valid) { 00063 debug2("userauth_pubkey: disabled because of invalid user"); 00064 return 0; 00065 } 00066 have_sig = packet_get_char(); 00067 if (datafellows & SSH_BUG_PKAUTH) { 00068 debug2("userauth_pubkey: SSH_BUG_PKAUTH"); 00069 /* no explicit pkalg given */ 00070 pkblob = packet_get_string(&blen); 00071 buffer_init(&b); 00072 buffer_append(&b, pkblob, blen); 00073 /* so we have to extract the pkalg from the pkblob */ 00074 pkalg = buffer_get_string(&b, &alen); 00075 buffer_free(&b); 00076 } else { 00077 pkalg = packet_get_string(&alen); 00078 pkblob = packet_get_string(&blen); 00079 } 00080 pktype = key_type_from_name(pkalg); 00081 if (pktype == KEY_UNSPEC) { 00082 /* this is perfectly legal */ 00083 logit("userauth_pubkey: unsupported public key algorithm: %s", 00084 pkalg); 00085 goto done; 00086 } 00087 key = key_from_blob(pkblob, blen); 00088 if (key == NULL) { 00089 error("userauth_pubkey: cannot decode key: %s", pkalg); 00090 goto done; 00091 } 00092 if (key->type != pktype) { 00093 error("userauth_pubkey: type mismatch for decoded key " 00094 "(received %d, expected %d)", key->type, pktype); 00095 goto done; 00096 } 00097 if (have_sig) { 00098 sig = packet_get_string(&slen); 00099 packet_check_eom(); 00100 buffer_init(&b); 00101 if (datafellows & SSH_OLD_SESSIONID) { 00102 buffer_append(&b, session_id2, session_id2_len); 00103 } else { 00104 buffer_put_string(&b, session_id2, session_id2_len); 00105 } 00106 /* reconstruct packet */ 00107 buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST); 00108 buffer_put_cstring(&b, authctxt->user); 00109 buffer_put_cstring(&b, 00110 datafellows & SSH_BUG_PKSERVICE ? 00111 "ssh-userauth" : 00112 authctxt->service); 00113 if (datafellows & SSH_BUG_PKAUTH) { 00114 buffer_put_char(&b, have_sig); 00115 } else { 00116 buffer_put_cstring(&b, "publickey"); 00117 buffer_put_char(&b, have_sig); 00118 buffer_put_cstring(&b, pkalg); 00119 } 00120 buffer_put_string(&b, pkblob, blen); 00121 #ifdef DEBUG_PK 00122 buffer_dump(&b); 00123 #endif 00124 /* test for correct signature */ 00125 authenticated = 0; 00126 if (PRIVSEP(user_key_allowed(authctxt->pw, key)) && 00127 PRIVSEP(key_verify(key, sig, slen, buffer_ptr(&b), 00128 buffer_len(&b))) == 1) 00129 authenticated = 1; 00130 buffer_free(&b); 00131 xfree(sig); 00132 } else { 00133 debug("test whether pkalg/pkblob are acceptable"); 00134 packet_check_eom(); 00135 00136 /* XXX fake reply and always send PK_OK ? */ 00137 /* 00138 * XXX this allows testing whether a user is allowed 00139 * to login: if you happen to have a valid pubkey this 00140 * message is sent. the message is NEVER sent at all 00141 * if a user is not allowed to login. is this an 00142 * issue? -markus 00143 */ 00144 if (PRIVSEP(user_key_allowed(authctxt->pw, key))) { 00145 packet_start(SSH2_MSG_USERAUTH_PK_OK); 00146 packet_put_string(pkalg, alen); 00147 packet_put_string(pkblob, blen); 00148 packet_send(); 00149 packet_write_wait(); 00150 authctxt->postponed = 1; 00151 } 00152 } 00153 if (authenticated != 1) 00154 auth_clear_options(); 00155 done: 00156 debug2("userauth_pubkey: authenticated %d pkalg %s", authenticated, pkalg); 00157 if (key != NULL) 00158 key_free(key); 00159 xfree(pkalg); 00160 xfree(pkblob); 00161 #ifdef HAVE_CYGWIN 00162 if (check_nt_auth(0, authctxt->pw) == 0) 00163 authenticated = 0; 00164 #endif 00165 return authenticated; 00166 }
|
|
|
Initial value: {
"publickey",
userauth_pubkey,
&options.pubkey_authentication
}
Definition at line 278 of file auth2-pubkey.c. |
|
|
|
|
|
Definition at line 66 of file sshconnect2.c. |
|
|
Definition at line 67 of file sshconnect2.c. |