2 * Author: Tatu Ylonen <ylo@cs.hut.fi>
3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
5 * Code to connect to a remote host, and to perform the client side of the
6 * login (authentication) dialog.
8 * As far as I am concerned, the code I have written for this software
9 * can be used freely for any purpose. Any derived versions of this
10 * software must be clearly marked as such, and if the derived work is
11 * incompatible with the protocol description in the RFC file, it must be
12 * called by a name other than "ssh" or "Secure Shell".
16 RCSID("$OpenBSD: sshconnect1.c,v 1.60 2004/07/28 09:40:29 markus Exp $");
18 #include <openssl/bn.h>
19 #include <openssl/md5.h>
33 #include "sshconnect.h"
40 /* Session id for the current session. */
41 u_char session_id[16];
42 u_int supported_authentications = 0;
44 extern Options options;
45 extern char *__progname;
48 * Checks if the user has an authentication agent, and if so, tries to
49 * authenticate using the agent.
52 try_agent_authentication(void)
56 AuthenticationConnection *auth;
62 /* Get connection to the agent. */
63 auth = ssh_get_authentication_connection();
67 if ((challenge = BN_new()) == NULL)
68 fatal("try_agent_authentication: BN_new failed");
69 /* Loop through identities served by the agent. */
70 for (key = ssh_get_first_identity(auth, &comment, 1);
72 key = ssh_get_next_identity(auth, &comment, 1)) {
74 /* Try this identity. */
75 debug("Trying RSA authentication via agent with '%.100s'", comment);
78 /* Tell the server that we are willing to authenticate using this key. */
79 packet_start(SSH_CMSG_AUTH_RSA);
80 packet_put_bignum(key->rsa->n);
84 /* Wait for server's response. */
87 /* The server sends failure if it doesn\'t like our key or
88 does not support RSA authentication. */
89 if (type == SSH_SMSG_FAILURE) {
90 debug("Server refused our key.");
94 /* Otherwise it should have sent a challenge. */
95 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
96 packet_disconnect("Protocol error during RSA authentication: %d",
99 packet_get_bignum(challenge);
102 debug("Received RSA challenge from server.");
104 /* Ask the agent to decrypt the challenge. */
105 if (!ssh_decrypt_challenge(auth, key, challenge, session_id, 1, response)) {
107 * The agent failed to authenticate this identifier
108 * although it advertised it supports this. Just
109 * return a wrong value.
111 logit("Authentication agent failed to decrypt challenge.");
112 memset(response, 0, sizeof(response));
115 debug("Sending response to RSA challenge.");
117 /* Send the decrypted challenge back to the server. */
118 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
119 for (i = 0; i < 16; i++)
120 packet_put_char(response[i]);
124 /* Wait for response from the server. */
125 type = packet_read();
127 /* The server returns success if it accepted the authentication. */
128 if (type == SSH_SMSG_SUCCESS) {
129 ssh_close_authentication_connection(auth);
130 BN_clear_free(challenge);
131 debug("RSA authentication accepted by server.");
134 /* Otherwise it should return failure. */
135 if (type != SSH_SMSG_FAILURE)
136 packet_disconnect("Protocol error waiting RSA auth response: %d",
139 ssh_close_authentication_connection(auth);
140 BN_clear_free(challenge);
141 debug("RSA authentication using agent refused.");
146 * Computes the proper response to a RSA challenge, and sends the response to
150 respond_to_rsa_challenge(BIGNUM * challenge, RSA * prv)
152 u_char buf[32], response[16];
156 /* Decrypt the challenge using the private key. */
157 /* XXX think about Bleichenbacher, too */
158 if (rsa_private_decrypt(challenge, challenge, prv) <= 0)
160 "respond_to_rsa_challenge: rsa_private_decrypt failed");
162 /* Compute the response. */
163 /* The response is MD5 of decrypted challenge plus session id. */
164 len = BN_num_bytes(challenge);
165 if (len <= 0 || len > sizeof(buf))
167 "respond_to_rsa_challenge: bad challenge length %d", len);
169 memset(buf, 0, sizeof(buf));
170 BN_bn2bin(challenge, buf + sizeof(buf) - len);
172 MD5_Update(&md, buf, 32);
173 MD5_Update(&md, session_id, 16);
174 MD5_Final(response, &md);
176 debug("Sending response to host key RSA challenge.");
178 /* Send the response back to the server. */
179 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
180 for (i = 0; i < 16; i++)
181 packet_put_char(response[i]);
185 memset(buf, 0, sizeof(buf));
186 memset(response, 0, sizeof(response));
187 memset(&md, 0, sizeof(md));
191 * Checks if the user has authentication file, and if so, tries to authenticate
195 try_rsa_authentication(int idx)
198 Key *public, *private;
199 char buf[300], *passphrase, *comment, *authfile;
202 public = options.identity_keys[idx];
203 authfile = options.identity_files[idx];
204 comment = xstrdup(authfile);
206 debug("Trying RSA authentication with key '%.100s'", comment);
208 /* Tell the server that we are willing to authenticate using this key. */
209 packet_start(SSH_CMSG_AUTH_RSA);
210 packet_put_bignum(public->rsa->n);
214 /* Wait for server's response. */
215 type = packet_read();
218 * The server responds with failure if it doesn\'t like our key or
219 * doesn\'t support RSA authentication.
221 if (type == SSH_SMSG_FAILURE) {
222 debug("Server refused our key.");
226 /* Otherwise, the server should respond with a challenge. */
227 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
228 packet_disconnect("Protocol error during RSA authentication: %d", type);
230 /* Get the challenge from the packet. */
231 if ((challenge = BN_new()) == NULL)
232 fatal("try_rsa_authentication: BN_new failed");
233 packet_get_bignum(challenge);
236 debug("Received RSA challenge from server.");
239 * If the key is not stored in external hardware, we have to
240 * load the private key. Try first with empty passphrase; if it
241 * fails, ask for a passphrase.
243 if (public->flags & KEY_FLAG_EXT)
246 private = key_load_private_type(KEY_RSA1, authfile, "", NULL);
247 if (private == NULL && !options.batch_mode) {
248 snprintf(buf, sizeof(buf),
249 "Enter passphrase for RSA key '%.100s': ", comment);
250 for (i = 0; i < options.number_of_password_prompts; i++) {
251 passphrase = read_passphrase(buf, 0);
252 if (strcmp(passphrase, "") != 0) {
253 private = key_load_private_type(KEY_RSA1,
254 authfile, passphrase, NULL);
257 debug2("no passphrase given, try next key");
260 memset(passphrase, 0, strlen(passphrase));
262 if (private != NULL || quit)
264 debug2("bad passphrase given, try again...");
267 /* We no longer need the comment. */
270 if (private == NULL) {
271 if (!options.batch_mode)
272 error("Bad passphrase.");
274 /* Send a dummy response packet to avoid protocol error. */
275 packet_start(SSH_CMSG_AUTH_RSA_RESPONSE);
276 for (i = 0; i < 16; i++)
281 /* Expect the server to reject it... */
282 packet_read_expect(SSH_SMSG_FAILURE);
283 BN_clear_free(challenge);
287 /* Compute and send a response to the challenge. */
288 respond_to_rsa_challenge(challenge, private->rsa);
290 /* Destroy the private key unless it in external hardware. */
291 if (!(private->flags & KEY_FLAG_EXT))
294 /* We no longer need the challenge. */
295 BN_clear_free(challenge);
297 /* Wait for response from the server. */
298 type = packet_read();
299 if (type == SSH_SMSG_SUCCESS) {
300 debug("RSA authentication accepted by server.");
303 if (type != SSH_SMSG_FAILURE)
304 packet_disconnect("Protocol error waiting RSA auth response: %d", type);
305 debug("RSA authentication refused.");
310 * Tries to authenticate the user using combined rhosts or /etc/hosts.equiv
311 * authentication and RSA host authentication.
314 try_rhosts_rsa_authentication(const char *local_user, Key * host_key)
319 debug("Trying rhosts or /etc/hosts.equiv with RSA host authentication.");
321 /* Tell the server that we are willing to authenticate using this key. */
322 packet_start(SSH_CMSG_AUTH_RHOSTS_RSA);
323 packet_put_cstring(local_user);
324 packet_put_int(BN_num_bits(host_key->rsa->n));
325 packet_put_bignum(host_key->rsa->e);
326 packet_put_bignum(host_key->rsa->n);
330 /* Wait for server's response. */
331 type = packet_read();
333 /* The server responds with failure if it doesn't admit our
334 .rhosts authentication or doesn't know our host key. */
335 if (type == SSH_SMSG_FAILURE) {
336 debug("Server refused our rhosts authentication or host key.");
339 /* Otherwise, the server should respond with a challenge. */
340 if (type != SSH_SMSG_AUTH_RSA_CHALLENGE)
341 packet_disconnect("Protocol error during RSA authentication: %d", type);
343 /* Get the challenge from the packet. */
344 if ((challenge = BN_new()) == NULL)
345 fatal("try_rhosts_rsa_authentication: BN_new failed");
346 packet_get_bignum(challenge);
349 debug("Received RSA challenge for host key from server.");
351 /* Compute a response to the challenge. */
352 respond_to_rsa_challenge(challenge, host_key->rsa);
354 /* We no longer need the challenge. */
355 BN_clear_free(challenge);
357 /* Wait for response from the server. */
358 type = packet_read();
359 if (type == SSH_SMSG_SUCCESS) {
360 debug("Rhosts or /etc/hosts.equiv with RSA host authentication accepted by server.");
363 if (type != SSH_SMSG_FAILURE)
364 packet_disconnect("Protocol error waiting RSA auth response: %d", type);
365 debug("Rhosts or /etc/hosts.equiv with RSA host authentication refused.");
370 * Tries to authenticate with any string-based challenge/response system.
371 * Note that the client code is not tied to s/key or TIS.
374 try_challenge_response_authentication(void)
379 char *challenge, *response;
381 debug("Doing challenge response authentication.");
383 for (i = 0; i < options.number_of_password_prompts; i++) {
384 /* request a challenge */
385 packet_start(SSH_CMSG_AUTH_TIS);
389 type = packet_read();
390 if (type != SSH_SMSG_FAILURE &&
391 type != SSH_SMSG_AUTH_TIS_CHALLENGE) {
392 packet_disconnect("Protocol error: got %d in response "
393 "to SSH_CMSG_AUTH_TIS", type);
395 if (type != SSH_SMSG_AUTH_TIS_CHALLENGE) {
396 debug("No challenge.");
399 challenge = packet_get_string(&clen);
401 snprintf(prompt, sizeof prompt, "%s%s", challenge,
402 strchr(challenge, '\n') ? "" : "\nResponse: ");
405 error("Permission denied, please try again.");
406 if (options.cipher == SSH_CIPHER_NONE)
407 logit("WARNING: Encryption is disabled! "
408 "Response will be transmitted in clear text.");
409 response = read_passphrase(prompt, 0);
410 if (strcmp(response, "") == 0) {
414 packet_start(SSH_CMSG_AUTH_TIS_RESPONSE);
415 ssh_put_password(response);
416 memset(response, 0, strlen(response));
420 type = packet_read();
421 if (type == SSH_SMSG_SUCCESS)
423 if (type != SSH_SMSG_FAILURE)
424 packet_disconnect("Protocol error: got %d in response "
425 "to SSH_CMSG_AUTH_TIS_RESPONSE", type);
432 * Tries to authenticate with plain passwd authentication.
435 try_password_authentication(char *prompt)
440 debug("Doing password authentication.");
441 if (options.cipher == SSH_CIPHER_NONE)
442 logit("WARNING: Encryption is disabled! Password will be transmitted in clear text.");
443 for (i = 0; i < options.number_of_password_prompts; i++) {
445 error("Permission denied, please try again.");
446 password = read_passphrase(prompt, 0);
447 packet_start(SSH_CMSG_AUTH_PASSWORD);
448 ssh_put_password(password);
449 memset(password, 0, strlen(password));
454 type = packet_read();
455 if (type == SSH_SMSG_SUCCESS)
457 if (type != SSH_SMSG_FAILURE)
458 packet_disconnect("Protocol error: got %d in response to passwd auth", type);
468 ssh_kex(char *host, struct sockaddr *hostaddr)
472 Key *host_key, *server_key;
474 int ssh_cipher_default = SSH_CIPHER_3DES;
475 u_char session_key[SSH_SESSION_KEY_LENGTH];
477 u_int supported_ciphers;
478 u_int server_flags, client_flags;
481 debug("Waiting for server public key.");
483 /* Wait for a public key packet from the server. */
484 packet_read_expect(SSH_SMSG_PUBLIC_KEY);
486 /* Get cookie from the packet. */
487 for (i = 0; i < 8; i++)
488 cookie[i] = packet_get_char();
490 /* Get the public key. */
491 server_key = key_new(KEY_RSA1);
492 bits = packet_get_int();
493 packet_get_bignum(server_key->rsa->e);
494 packet_get_bignum(server_key->rsa->n);
496 rbits = BN_num_bits(server_key->rsa->n);
498 logit("Warning: Server lies about size of server public key: "
499 "actual size is %d bits vs. announced %d.", rbits, bits);
500 logit("Warning: This may be due to an old implementation of ssh.");
502 /* Get the host key. */
503 host_key = key_new(KEY_RSA1);
504 bits = packet_get_int();
505 packet_get_bignum(host_key->rsa->e);
506 packet_get_bignum(host_key->rsa->n);
508 rbits = BN_num_bits(host_key->rsa->n);
510 logit("Warning: Server lies about size of server host key: "
511 "actual size is %d bits vs. announced %d.", rbits, bits);
512 logit("Warning: This may be due to an old implementation of ssh.");
515 /* Get protocol flags. */
516 server_flags = packet_get_int();
517 packet_set_protocol_flags(server_flags);
519 supported_ciphers = packet_get_int();
520 supported_authentications = packet_get_int();
523 debug("Received server public key (%d bits) and host key (%d bits).",
524 BN_num_bits(server_key->rsa->n), BN_num_bits(host_key->rsa->n));
526 if (verify_host_key(host, hostaddr, host_key) == -1)
527 fatal("Host key verification failed.");
529 client_flags = SSH_PROTOFLAG_SCREEN_NUMBER | SSH_PROTOFLAG_HOST_IN_FWD_OPEN;
531 derive_ssh1_session_id(host_key->rsa->n, server_key->rsa->n, cookie, session_id);
533 /* Generate a session key. */
537 * Generate an encryption key for the session. The key is a 256 bit
538 * random number, interpreted as a 32-byte key, with the least
539 * significant 8 bits being the first byte of the key.
541 for (i = 0; i < 32; i++) {
544 session_key[i] = rnd & 0xff;
549 * According to the protocol spec, the first byte of the session key
550 * is the highest byte of the integer. The session key is xored with
551 * the first 16 bytes of the session id.
553 if ((key = BN_new()) == NULL)
554 fatal("respond_to_rsa_challenge: BN_new failed");
556 for (i = 0; i < SSH_SESSION_KEY_LENGTH; i++) {
557 BN_lshift(key, key, 8);
559 BN_add_word(key, session_key[i] ^ session_id[i]);
561 BN_add_word(key, session_key[i]);
565 * Encrypt the integer using the public key and host key of the
566 * server (key with smaller modulus first).
568 if (BN_cmp(server_key->rsa->n, host_key->rsa->n) < 0) {
569 /* Public key has smaller modulus. */
570 if (BN_num_bits(host_key->rsa->n) <
571 BN_num_bits(server_key->rsa->n) + SSH_KEY_BITS_RESERVED) {
572 fatal("respond_to_rsa_challenge: host_key %d < server_key %d + "
573 "SSH_KEY_BITS_RESERVED %d",
574 BN_num_bits(host_key->rsa->n),
575 BN_num_bits(server_key->rsa->n),
576 SSH_KEY_BITS_RESERVED);
578 rsa_public_encrypt(key, key, server_key->rsa);
579 rsa_public_encrypt(key, key, host_key->rsa);
581 /* Host key has smaller modulus (or they are equal). */
582 if (BN_num_bits(server_key->rsa->n) <
583 BN_num_bits(host_key->rsa->n) + SSH_KEY_BITS_RESERVED) {
584 fatal("respond_to_rsa_challenge: server_key %d < host_key %d + "
585 "SSH_KEY_BITS_RESERVED %d",
586 BN_num_bits(server_key->rsa->n),
587 BN_num_bits(host_key->rsa->n),
588 SSH_KEY_BITS_RESERVED);
590 rsa_public_encrypt(key, key, host_key->rsa);
591 rsa_public_encrypt(key, key, server_key->rsa);
594 /* Destroy the public keys since we no longer need them. */
595 key_free(server_key);
598 if (options.cipher == SSH_CIPHER_NOT_SET) {
599 if (cipher_mask_ssh1(1) & supported_ciphers & (1 << ssh_cipher_default))
600 options.cipher = ssh_cipher_default;
601 } else if (options.cipher == SSH_CIPHER_INVALID ||
602 !(cipher_mask_ssh1(1) & (1 << options.cipher))) {
603 logit("No valid SSH1 cipher, using %.100s instead.",
604 cipher_name(ssh_cipher_default));
605 options.cipher = ssh_cipher_default;
607 /* Check that the selected cipher is supported. */
608 if (!(supported_ciphers & (1 << options.cipher)))
609 fatal("Selected cipher type %.100s not supported by server.",
610 cipher_name(options.cipher));
612 debug("Encryption type: %.100s", cipher_name(options.cipher));
614 /* Send the encrypted session key to the server. */
615 packet_start(SSH_CMSG_SESSION_KEY);
616 packet_put_char(options.cipher);
618 /* Send the cookie back to the server. */
619 for (i = 0; i < 8; i++)
620 packet_put_char(cookie[i]);
622 /* Send and destroy the encrypted encryption key integer. */
623 packet_put_bignum(key);
626 /* Send protocol flags. */
627 packet_put_int(client_flags);
629 /* Send the packet now. */
633 debug("Sent encrypted session key.");
635 /* Set the encryption key. */
636 packet_set_encryption_key(session_key, SSH_SESSION_KEY_LENGTH, options.cipher);
638 /* We will no longer need the session key here. Destroy any extra copies. */
639 memset(session_key, 0, sizeof(session_key));
642 * Expect a success message from the server. Note that this message
643 * will be received in encrypted form.
645 packet_read_expect(SSH_SMSG_SUCCESS);
647 debug("Received encrypted confirmation.");
654 ssh_userauth1(const char *local_user, const char *server_user, char *host,
655 Sensitive *sensitive)
659 if (supported_authentications == 0)
660 fatal("ssh_userauth1: server supports no auth methods");
662 /* Send the name of the user to log in as on the server. */
663 packet_start(SSH_CMSG_USER);
664 packet_put_cstring(server_user);
669 * The server should respond with success if no authentication is
670 * needed (the user has no password). Otherwise the server responds
673 type = packet_read();
675 /* check whether the connection was accepted without authentication. */
676 if (type == SSH_SMSG_SUCCESS)
678 if (type != SSH_SMSG_FAILURE)
679 packet_disconnect("Protocol error: got %d in response to SSH_CMSG_USER", type);
682 * Try .rhosts or /etc/hosts.equiv authentication with RSA host
685 if ((supported_authentications & (1 << SSH_AUTH_RHOSTS_RSA)) &&
686 options.rhosts_rsa_authentication) {
687 for (i = 0; i < sensitive->nkeys; i++) {
688 if (sensitive->keys[i] != NULL &&
689 sensitive->keys[i]->type == KEY_RSA1 &&
690 try_rhosts_rsa_authentication(local_user,
695 /* Try RSA authentication if the server supports it. */
696 if ((supported_authentications & (1 << SSH_AUTH_RSA)) &&
697 options.rsa_authentication) {
699 * Try RSA authentication using the authentication agent. The
700 * agent is tried first because no passphrase is needed for
701 * it, whereas identity files may require passphrases.
703 if (try_agent_authentication())
706 /* Try RSA authentication for each identity. */
707 for (i = 0; i < options.num_identity_files; i++)
708 if (options.identity_keys[i] != NULL &&
709 options.identity_keys[i]->type == KEY_RSA1 &&
710 try_rsa_authentication(i))
713 /* Try challenge response authentication if the server supports it. */
714 if ((supported_authentications & (1 << SSH_AUTH_TIS)) &&
715 options.challenge_response_authentication && !options.batch_mode) {
716 if (try_challenge_response_authentication())
719 /* Try password authentication if the server supports it. */
720 if ((supported_authentications & (1 << SSH_AUTH_PASSWORD)) &&
721 options.password_authentication && !options.batch_mode) {
724 snprintf(prompt, sizeof(prompt), "%.30s@%.128s's password: ",
726 if (try_password_authentication(prompt))
729 /* All authentication methods have failed. Exit with an error message. */
730 fatal("Permission denied.");
734 return; /* need statement after label */