shinys000114/libssh
1
0
Fork 0
mirror of https://git.libssh.org/projects/libssh.git synced 2026-02-11 18:50:28 +09:00
Code Issues Packages Projects Releases Wiki Activity

reformat: functions related to pubkey authentication

Browse Source 
Signed-off-by: Abdallah Alhadad <abdallahselhdad@gmail.com>
Reviewed-by: Jakub Jelen <jjelen@redhat.com>
This commit is contained in:
Abdallah Alhadad
2025-03-15 14:15:27 +02:00
parent bf2b8954e8
commit 1f76cc0c6a
2 changed files with 307 additions and 282 deletions
Download Patch File Download Diff File Expand all files Collapse all files

60
src/auth.c
View File

@@ -508,7 +508,7 @@ int ssh_userauth_try_publickey(ssh_session session,
return SSH_AUTH_ERROR; return SSH_AUTH_ERROR;
} }
switch(session->pending_call_state) { switch (session->pending_call_state) {
case SSH_PENDING_CALL_NONE: case SSH_PENDING_CALL_NONE:
break; break;
case SSH_PENDING_CALL_AUTH_OFFER_PUBKEY: case SSH_PENDING_CALL_AUTH_OFFER_PUBKEY:
@@ -524,13 +524,15 @@ int ssh_userauth_try_publickey(ssh_session session,
/* Check if the given public key algorithm is allowed */ /* Check if the given public key algorithm is allowed */
sig_type_c = ssh_key_get_signature_algorithm(session, pubkey->type); sig_type_c = ssh_key_get_signature_algorithm(session, pubkey->type);
if (sig_type_c == NULL) { if (sig_type_c == NULL) {
ssh_set_error(session, SSH_REQUEST_DENIED, ssh_set_error(session,
SSH_REQUEST_DENIED,
"Invalid key type (unknown)"); "Invalid key type (unknown)");
return SSH_AUTH_DENIED; return SSH_AUTH_DENIED;
} }
rc = ssh_key_algorithm_allowed(session, sig_type_c); rc = ssh_key_algorithm_allowed(session, sig_type_c);
if (!rc) { if (!rc) {
ssh_set_error(session, SSH_REQUEST_DENIED, ssh_set_error(session,
SSH_REQUEST_DENIED,
"The key algorithm '%s' is not allowed to be used by" "The key algorithm '%s' is not allowed to be used by"
" PUBLICKEY_ACCEPTED_TYPES configuration option", " PUBLICKEY_ACCEPTED_TYPES configuration option",
sig_type_c); sig_type_c);
@@ -538,9 +540,12 @@ int ssh_userauth_try_publickey(ssh_session session,
} }
allowed = ssh_key_size_allowed(session, pubkey); allowed = ssh_key_size_allowed(session, pubkey);
if (!allowed) { if (!allowed) {
ssh_set_error(session, SSH_REQUEST_DENIED, ssh_set_error(session,
SSH_REQUEST_DENIED,
"The '%s' key type of size %d is not allowed by " "The '%s' key type of size %d is not allowed by "
"RSA_MIN_SIZE", sig_type_c, ssh_key_size(pubkey)); "RSA_MIN_SIZE",
sig_type_c,
ssh_key_size(pubkey));
return SSH_AUTH_DENIED; return SSH_AUTH_DENIED;
} }
@@ -559,7 +564,8 @@ int ssh_userauth_try_publickey(ssh_session session,
SSH_LOG(SSH_LOG_TRACE, "Trying signature type %s", sig_type_c); SSH_LOG(SSH_LOG_TRACE, "Trying signature type %s", sig_type_c);
/* request */ /* request */
rc = ssh_buffer_pack(session->out_buffer, "bsssbsS", rc = ssh_buffer_pack(session->out_buffer,
"bsssbsS",
SSH2_MSG_USERAUTH_REQUEST, SSH2_MSG_USERAUTH_REQUEST,
username ? username : session->opts.username, username ? username : session->opts.username,
"ssh-connection", "ssh-connection",
@@ -640,13 +646,14 @@ int ssh_userauth_publickey(ssh_session session,
return SSH_AUTH_ERROR; return SSH_AUTH_ERROR;
} }
switch(session->pending_call_state) { switch (session->pending_call_state) {
case SSH_PENDING_CALL_NONE: case SSH_PENDING_CALL_NONE:
break; break;
case SSH_PENDING_CALL_AUTH_PUBKEY: case SSH_PENDING_CALL_AUTH_PUBKEY:
goto pending; goto pending;
default: default:
ssh_set_error(session, ssh_set_error(
session,
SSH_FATAL, SSH_FATAL,
"Bad call during pending SSH call in ssh_userauth_try_publickey"); "Bad call during pending SSH call in ssh_userauth_try_publickey");
return SSH_AUTH_ERROR; return SSH_AUTH_ERROR;
@@ -658,13 +665,15 @@ int ssh_userauth_publickey(ssh_session session,
/* Check if the given public key algorithm is allowed */ /* Check if the given public key algorithm is allowed */
sig_type_c = ssh_key_get_signature_algorithm(session, key_type); sig_type_c = ssh_key_get_signature_algorithm(session, key_type);
if (sig_type_c == NULL) { if (sig_type_c == NULL) {
ssh_set_error(session, SSH_REQUEST_DENIED, ssh_set_error(session,
SSH_REQUEST_DENIED,
"Invalid key type (unknown)"); "Invalid key type (unknown)");
return SSH_AUTH_DENIED; return SSH_AUTH_DENIED;
} }
rc = ssh_key_algorithm_allowed(session, sig_type_c); rc = ssh_key_algorithm_allowed(session, sig_type_c);
if (!rc) { if (!rc) {
ssh_set_error(session, SSH_REQUEST_DENIED, ssh_set_error(session,
SSH_REQUEST_DENIED,
"The key algorithm '%s' is not allowed to be used by" "The key algorithm '%s' is not allowed to be used by"
" PUBLICKEY_ACCEPTED_TYPES configuration option", " PUBLICKEY_ACCEPTED_TYPES configuration option",
sig_type_c); sig_type_c);
@@ -672,9 +681,12 @@ int ssh_userauth_publickey(ssh_session session,
} }
allowed = ssh_key_size_allowed(session, privkey); allowed = ssh_key_size_allowed(session, privkey);
if (!allowed) { if (!allowed) {
ssh_set_error(session, SSH_REQUEST_DENIED, ssh_set_error(session,
SSH_REQUEST_DENIED,
"The '%s' key type of size %d is not allowed by " "The '%s' key type of size %d is not allowed by "
"RSA_MIN_SIZE", sig_type_c, ssh_key_size(privkey)); "RSA_MIN_SIZE",
sig_type_c,
ssh_key_size(privkey));
return SSH_AUTH_DENIED; return SSH_AUTH_DENIED;
} }
@@ -693,7 +705,8 @@ int ssh_userauth_publickey(ssh_session session,
SSH_LOG(SSH_LOG_TRACE, "Sending signature type %s", sig_type_c); SSH_LOG(SSH_LOG_TRACE, "Sending signature type %s", sig_type_c);
/* request */ /* request */
rc = ssh_buffer_pack(session->out_buffer, "bsssbsS", rc = ssh_buffer_pack(session->out_buffer,
"bsssbsS",
SSH2_MSG_USERAUTH_REQUEST, SSH2_MSG_USERAUTH_REQUEST,
username ? username : session->opts.username, username ? username : session->opts.username,
"ssh-connection", "ssh-connection",
@@ -785,14 +798,16 @@ static int ssh_userauth_agent_publickey(ssh_session session,
/* Check if the given public key algorithm is allowed */ /* Check if the given public key algorithm is allowed */
sig_type_c = ssh_key_get_signature_algorithm(session, pubkey->type); sig_type_c = ssh_key_get_signature_algorithm(session, pubkey->type);
if (sig_type_c == NULL) { if (sig_type_c == NULL) {
ssh_set_error(session, SSH_REQUEST_DENIED, ssh_set_error(session,
SSH_REQUEST_DENIED,
"Invalid key type (unknown)"); "Invalid key type (unknown)");
SSH_STRING_FREE(pubkey_s); SSH_STRING_FREE(pubkey_s);
return SSH_AUTH_DENIED; return SSH_AUTH_DENIED;
} }
rc = ssh_key_algorithm_allowed(session, sig_type_c); rc = ssh_key_algorithm_allowed(session, sig_type_c);
if (!rc) { if (!rc) {
ssh_set_error(session, SSH_REQUEST_DENIED, ssh_set_error(session,
SSH_REQUEST_DENIED,
"The key algorithm '%s' is not allowed to be used by" "The key algorithm '%s' is not allowed to be used by"
" PUBLICKEY_ACCEPTED_TYPES configuration option", " PUBLICKEY_ACCEPTED_TYPES configuration option",
sig_type_c); sig_type_c);
@@ -801,15 +816,19 @@ static int ssh_userauth_agent_publickey(ssh_session session,
} }
allowed = ssh_key_size_allowed(session, pubkey); allowed = ssh_key_size_allowed(session, pubkey);
if (!allowed) { if (!allowed) {
ssh_set_error(session, SSH_REQUEST_DENIED, ssh_set_error(session,
SSH_REQUEST_DENIED,
"The '%s' key type of size %d is not allowed by " "The '%s' key type of size %d is not allowed by "
"RSA_MIN_SIZE", sig_type_c, ssh_key_size(pubkey)); "RSA_MIN_SIZE",
sig_type_c,
ssh_key_size(pubkey));
SSH_STRING_FREE(pubkey_s); SSH_STRING_FREE(pubkey_s);
return SSH_AUTH_DENIED; return SSH_AUTH_DENIED;
} }
/* request */ /* request */
rc = ssh_buffer_pack(session->out_buffer, "bsssbsS", rc = ssh_buffer_pack(session->out_buffer,
"bsssbsS",
SSH2_MSG_USERAUTH_REQUEST, SSH2_MSG_USERAUTH_REQUEST,
username ? username : session->opts.username, username ? username : session->opts.username,
"ssh-connection", "ssh-connection",
@@ -879,7 +898,7 @@ void ssh_agent_state_free(void *data)
if (state) { if (state) {
SSH_STRING_FREE_CHAR(state->comment); SSH_STRING_FREE_CHAR(state->comment);
ssh_key_free(state->pubkey); ssh_key_free(state->pubkey);
free (state); free(state);
} }
} }
@@ -905,8 +924,7 @@ void ssh_agent_state_free(void *data)
* authentication. The username should only be set with ssh_options_set() only * authentication. The username should only be set with ssh_options_set() only
* before you connect to the server. * before you connect to the server.
*/ */
int ssh_userauth_agent(ssh_session session, int ssh_userauth_agent(ssh_session session, const char *username)
const char *username)
{ {
int rc = SSH_AUTH_ERROR; int rc = SSH_AUTH_ERROR;
struct ssh_agent_state_struct *state = NULL; struct ssh_agent_state_struct *state = NULL;

71
src/messages.c
View File

@@ -737,7 +737,7 @@ static ssh_buffer ssh_msg_userauth_build_digest(ssh_session session,
{ {
struct ssh_crypto_struct *crypto = NULL; struct ssh_crypto_struct *crypto = NULL;
ssh_buffer buffer; ssh_buffer buffer;
ssh_string str=NULL; ssh_string str = NULL;
int rc; int rc;
crypto = ssh_packet_get_current_crypto(session, SSH_DIRECTION_IN); crypto = ssh_packet_get_current_crypto(session, SSH_DIRECTION_IN);
@@ -758,7 +758,8 @@ static ssh_buffer ssh_msg_userauth_build_digest(ssh_session session,
rc = ssh_buffer_pack(buffer, rc = ssh_buffer_pack(buffer,
"dPbsssbsS", "dPbsssbsS",
crypto->session_id_len, /* session ID string */ crypto->session_id_len, /* session ID string */
crypto->session_id_len, crypto->session_id, crypto->session_id_len,
crypto->session_id,
SSH2_MSG_USERAUTH_REQUEST, /* type */ SSH2_MSG_USERAUTH_REQUEST, /* type */
msg->auth_request.username, msg->auth_request.username,
service, service,
@@ -783,7 +784,8 @@ static ssh_buffer ssh_msg_userauth_build_digest(ssh_session session,
* @brief Handle a SSH_MSG_MSG_USERAUTH_REQUEST packet and queue a * @brief Handle a SSH_MSG_MSG_USERAUTH_REQUEST packet and queue a
* SSH Message * SSH Message
*/ */
SSH_PACKET_CALLBACK(ssh_packet_userauth_request){ SSH_PACKET_CALLBACK(ssh_packet_userauth_request)
{
ssh_message msg = NULL; ssh_message msg = NULL;
ssh_signature sig = NULL; ssh_signature sig = NULL;
char *service = NULL; char *service = NULL;
@@ -812,14 +814,13 @@ SSH_PACKET_CALLBACK(ssh_packet_userauth_request){
SSH_LOG(SSH_LOG_PACKET, SSH_LOG(SSH_LOG_PACKET,
"Auth request for service %s, method %s for user '%s'", "Auth request for service %s, method %s for user '%s'",
service, method, service,
method,
msg->auth_request.username); msg->auth_request.username);
cmp = strcmp(service, "ssh-connection"); cmp = strcmp(service, "ssh-connection");
if (cmp != 0) { if (cmp != 0) {
SSH_LOG(SSH_LOG_TRACE, SSH_LOG(SSH_LOG_TRACE, "Invalid service request: %s", service);
"Invalid service request: %s",
service);
goto end; goto end;
} }
@@ -876,11 +877,7 @@ SSH_PACKET_CALLBACK(ssh_packet_userauth_request){
msg->auth_request.method = SSH_AUTH_METHOD_PUBLICKEY; msg->auth_request.method = SSH_AUTH_METHOD_PUBLICKEY;
SAFE_FREE(method); SAFE_FREE(method);
rc = ssh_buffer_unpack(packet, "bSS", rc = ssh_buffer_unpack(packet, "bSS", &has_sign, &algo, &pubkey_blob);
&has_sign,
&algo,
&pubkey_blob
);
if (rc != SSH_OK) { if (rc != SSH_OK) {
goto error; goto error;
@@ -904,12 +901,12 @@ SSH_PACKET_CALLBACK(ssh_packet_userauth_request){
} }
// has a valid signature ? // has a valid signature ?
if(has_sign) { if (has_sign) {
ssh_string sig_blob = NULL; ssh_string sig_blob = NULL;
ssh_buffer digest = NULL; ssh_buffer digest = NULL;
sig_blob = ssh_buffer_get_ssh_string(packet); sig_blob = ssh_buffer_get_ssh_string(packet);
if(sig_blob == NULL) { if (sig_blob == NULL) {
SSH_LOG(SSH_LOG_PACKET, "Invalid signature packet from peer"); SSH_LOG(SSH_LOG_PACKET, "Invalid signature packet from peer");
msg->auth_request.signature_state = SSH_PUBLICKEY_STATE_ERROR; msg->auth_request.signature_state = SSH_PUBLICKEY_STATE_ERROR;
SSH_STRING_FREE(algo); SSH_STRING_FREE(algo);
@@ -931,12 +928,14 @@ SSH_PACKET_CALLBACK(ssh_packet_userauth_request){
msg->auth_request.pubkey, msg->auth_request.pubkey,
&sig); &sig);
if (rc == SSH_OK) { if (rc == SSH_OK) {
/* Check if the signature from client matches server preferences */ /* Check if the signature from client matches server preferences
*/
if (session->opts.pubkey_accepted_types) { if (session->opts.pubkey_accepted_types) {
cmp = match_group(session->opts.pubkey_accepted_types, cmp = match_group(session->opts.pubkey_accepted_types,
sig->type_c); sig->type_c);
if (cmp != 1) { if (cmp != 1) {
ssh_set_error(session, ssh_set_error(
session,
SSH_FATAL, SSH_FATAL,
"Public key from client (%s) doesn't match server " "Public key from client (%s) doesn't match server "
"preference (%s)", "preference (%s)",
@@ -958,8 +957,7 @@ SSH_PACKET_CALLBACK(ssh_packet_userauth_request){
SSH_BUFFER_FREE(digest); SSH_BUFFER_FREE(digest);
ssh_signature_free(sig); ssh_signature_free(sig);
if (rc < 0) { if (rc < 0) {
SSH_LOG( SSH_LOG(SSH_LOG_PACKET,
SSH_LOG_PACKET,
"Received an invalid signature from peer"); "Received an invalid signature from peer");
msg->auth_request.signature_state = SSH_PUBLICKEY_STATE_WRONG; msg->auth_request.signature_state = SSH_PUBLICKEY_STATE_WRONG;
goto error; goto error;
@@ -980,37 +978,46 @@ SSH_PACKET_CALLBACK(ssh_packet_userauth_request){
char *hexa; char *hexa;
int i; int i;
ssh_buffer_get_u32(packet, &n_oid); ssh_buffer_get_u32(packet, &n_oid);
n_oid=ntohl(n_oid); n_oid = ntohl(n_oid);
if(n_oid > 100){ if (n_oid > 100) {
ssh_set_error(session, SSH_FATAL, "USERAUTH_REQUEST: gssapi-with-mic OID count too big (%d)",n_oid); ssh_set_error(
session,
SSH_FATAL,
"USERAUTH_REQUEST: gssapi-with-mic OID count too big (%d)",
n_oid);
goto error; goto error;
} }
SSH_LOG(SSH_LOG_PACKET, "gssapi: %d OIDs", n_oid); SSH_LOG(SSH_LOG_PACKET, "gssapi: %d OIDs", n_oid);
oids = calloc(n_oid, sizeof(ssh_string)); oids = calloc(n_oid, sizeof(ssh_string));
if (oids == NULL){ if (oids == NULL) {
ssh_set_error_oom(session); ssh_set_error_oom(session);
goto error; goto error;
} }
for (i=0;i<(int) n_oid;++i){ for (i = 0; i < (int)n_oid; ++i) {
oid=ssh_buffer_get_ssh_string(packet); oid = ssh_buffer_get_ssh_string(packet);
if(oid == NULL){ if (oid == NULL) {
for(i=i-1;i>=0;--i){ for (i = i - 1; i >= 0; --i) {
SAFE_FREE(oids[i]); SAFE_FREE(oids[i]);
} }
SAFE_FREE(oids); SAFE_FREE(oids);
ssh_set_error(session, SSH_LOG_PACKET, "USERAUTH_REQUEST: gssapi-with-mic missing OID"); ssh_set_error(session,
SSH_LOG_PACKET,
"USERAUTH_REQUEST: gssapi-with-mic missing OID");
goto error; goto error;
} }
oids[i] = oid; oids[i] = oid;
if(session->common.log_verbosity >= SSH_LOG_PACKET){ if (session->common.log_verbosity >= SSH_LOG_PACKET) {
hexa = ssh_get_hexa(ssh_string_data(oid), ssh_string_len(oid)); hexa = ssh_get_hexa(ssh_string_data(oid), ssh_string_len(oid));
SSH_LOG(SSH_LOG_PACKET,"gssapi: OID %d: %s",i, hexa); SSH_LOG(SSH_LOG_PACKET, "gssapi: OID %d: %s", i, hexa);
SAFE_FREE(hexa); SAFE_FREE(hexa);
} }
} }
ssh_gssapi_handle_userauth(session, msg->auth_request.username, n_oid, oids); ssh_gssapi_handle_userauth(session,
msg->auth_request.username,
n_oid,
oids);
for(i=0;i<(int)n_oid;++i){ for (i = 0; i < (int)n_oid; ++i) {
SAFE_FREE(oids[i]); SAFE_FREE(oids[i]);
} }
SAFE_FREE(oids); SAFE_FREE(oids);
@@ -1037,7 +1044,7 @@ end:
SAFE_FREE(service); SAFE_FREE(service);
SAFE_FREE(method); SAFE_FREE(method);
ssh_message_queue(session,msg); ssh_message_queue(session, msg);
return SSH_PACKET_USED; return SSH_PACKET_USED;
} }