Ben Lindstrom
46c162204b
And I think I have all the bits right from the OpenBSD tree. 20001222 - Updated RCSID for pty.c - (bal) OpenBSD CVS Updates: - [email protected] 2000/12/21 15:10:16 [auth-rh-rsa.c hostfile.c hostfile.h sshconnect.c] print keyfile:line for changed hostkeys, for deraadt@, ok deraadt@ - [email protected] 2000/12/20 19:26:56 [authfile.c] allow ssh -i userkey for root - [email protected] 2000/12/20 19:37:21 [authfd.c authfd.h kex.c sshconnect2.c sshd.c uidswap.c uidswap.h] fix prototypes; from [email protected] - [email protected] 2000/12/20 19:32:08 [sshd.c] init pointer to NULL; report from [email protected] - [email protected] 2000/12/19 23:17:54 [auth-krb4.c auth-options.c auth-options.h auth-rhosts.c auth-rsa.c auth1.c auth2-skey.c auth2.c authfd.c authfd.h authfile.c bufaux.c bufaux.h buffer.c canohost.c channels.c clientloop.c compress.c crc32.c deattack.c getput.h hmac.c hmac.h hostfile.c kex.c kex.h key.c key.h log.c login.c match.c match.h mpaux.c mpaux.h packet.c packet.h radix.c readconf.c rsa.c scp.c servconf.c servconf.h serverloop.c session.c sftp-server.c ssh-agent.c ssh-dss.c ssh-dss.h ssh-keygen.c ssh-keyscan.c ssh-rsa.c ssh-rsa.h ssh.c ssh.h uuencode.c uuencode.h sshconnect1.c sshconnect2.c sshd.c tildexpand.c] replace 'unsigned bla' with 'u_bla' everywhere. also replace 'char unsigned' with u_char.
108 lines
2.8 KiB
C
108 lines
2.8 KiB
C
#include "includes.h"
|
|
RCSID("$OpenBSD: auth2-skey.c,v 1.2 2000/12/19 23:17:55 markus Exp $");
|
|
|
|
#ifdef SKEY
|
|
#include "ssh.h"
|
|
#include "ssh2.h"
|
|
#include "auth.h"
|
|
#include "packet.h"
|
|
#include "xmalloc.h"
|
|
#include "dispatch.h"
|
|
|
|
void send_userauth_into_request(Authctxt *authctxt, int echo);
|
|
void input_userauth_info_response(int type, int plen, void *ctxt);
|
|
|
|
/*
|
|
* try skey authentication, always return -1 (= postponed) since we have to
|
|
* wait for the s/key response.
|
|
*/
|
|
int
|
|
auth2_skey(Authctxt *authctxt)
|
|
{
|
|
send_userauth_into_request(authctxt, 0);
|
|
dispatch_set(SSH2_MSG_USERAUTH_INFO_RESPONSE, &input_userauth_info_response);
|
|
return -1;
|
|
}
|
|
|
|
void
|
|
send_userauth_into_request(Authctxt *authctxt, int echo)
|
|
{
|
|
int retval = -1;
|
|
struct skey skey;
|
|
char challenge[SKEY_MAX_CHALLENGE];
|
|
char *fake;
|
|
|
|
if (authctxt->user == NULL)
|
|
fatal("send_userauth_into_request: internal error: no user");
|
|
|
|
/* get skey challenge */
|
|
if (authctxt->valid)
|
|
retval = skeychallenge(&skey, authctxt->user, challenge);
|
|
|
|
if (retval == -1) {
|
|
fake = skey_fake_keyinfo(authctxt->user);
|
|
strlcpy(challenge, fake, sizeof challenge);
|
|
}
|
|
/* send our info request */
|
|
packet_start(SSH2_MSG_USERAUTH_INFO_REQUEST);
|
|
packet_put_cstring("S/Key Authentication"); /* Name */
|
|
packet_put_cstring(challenge); /* Instruction */
|
|
packet_put_cstring(""); /* Language */
|
|
packet_put_int(1); /* Number of prompts */
|
|
packet_put_cstring(echo ?
|
|
"Response [Echo]: ": "Response: "); /* Prompt */
|
|
packet_put_char(echo); /* Echo */
|
|
packet_send();
|
|
packet_write_wait();
|
|
memset(challenge, 'c', sizeof challenge);
|
|
}
|
|
|
|
void
|
|
input_userauth_info_response(int type, int plen, void *ctxt)
|
|
{
|
|
Authctxt *authctxt = ctxt;
|
|
int authenticated = 0;
|
|
u_int nresp, rlen;
|
|
char *resp, *method;
|
|
|
|
if (authctxt == NULL)
|
|
fatal("input_userauth_info_response: no authentication context");
|
|
|
|
if (authctxt->attempt++ >= AUTH_FAIL_MAX)
|
|
packet_disconnect("too many failed userauth_requests");
|
|
|
|
nresp = packet_get_int();
|
|
if (nresp == 1) {
|
|
/* we only support s/key and assume s/key for nresp == 1 */
|
|
method = "s/key";
|
|
resp = packet_get_string(&rlen);
|
|
packet_done();
|
|
if (strlen(resp) == 0) {
|
|
/*
|
|
* if we received a null response, resend prompt with
|
|
* echo enabled
|
|
*/
|
|
authenticated = -1;
|
|
userauth_log(authctxt, authenticated, method);
|
|
send_userauth_into_request(authctxt, 1);
|
|
} else {
|
|
/* verify skey response */
|
|
if (authctxt->valid &&
|
|
skey_haskey(authctxt->pw->pw_name) == 0 &&
|
|
skey_passcheck(authctxt->pw->pw_name, resp) != -1) {
|
|
authenticated = 1;
|
|
} else {
|
|
authenticated = 0;
|
|
}
|
|
memset(resp, 'r', rlen);
|
|
/* unregister callback */
|
|
dispatch_set(SSH2_MSG_USERAUTH_INFO_RESPONSE, NULL);
|
|
userauth_log(authctxt, authenticated, method);
|
|
userauth_reply(authctxt, authenticated);
|
|
}
|
|
xfree(resp);
|
|
}
|
|
}
|
|
|
|
#endif /* SKEY */
|