tyler.durden/openssh-portable
1
0
Fork 0
mirror of https://github.com/PowerShell/openssh-portable.git synced 2025-07-27 07:44:29 +02:00
Code Issues Packages Projects Releases Wiki Activity

- markus@cvs.openbsd.org 2001/01/22 23:06:39

Browse Source 
[auth1.c auth2.c readconf.c readconf.h servconf.c servconf.h
      sshconnect1.c sshconnect2.c sshd.c]
     rename skey -> challenge response.
     auto-enable kbd-interactive for ssh2 if challenge-reponse is enabled.
This commit is contained in:
Ben Lindstrom 2001-01-23 03:12:10 +00:00
parent b1985f7279
commit 95fb2dde77
10 changed files with 57 additions and 44 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
ChangeLog
View File

@ -15,6 +15,11 @@
- stevesk@cvs.openbsd.org 2001/01/22 17:22:28 - stevesk@cvs.openbsd.org 2001/01/22 17:22:28
[sshconnect2.c sshd.c] [sshconnect2.c sshd.c]
fix memory leaks in SSH2 key exchange; ok markus@ fix memory leaks in SSH2 key exchange; ok markus@
- markus@cvs.openbsd.org 2001/01/22 23:06:39
[auth1.c auth2.c readconf.c readconf.h servconf.c servconf.h
sshconnect1.c sshconnect2.c sshd.c]
rename skey -> challenge response.
auto-enable kbd-interactive for ssh2 if challenge-reponse is enabled.
20010122 20010122

6
auth1.c
View File

@ -10,7 +10,7 @@
*/ */
#include "includes.h" #include "includes.h"
RCSID("$OpenBSD: auth1.c,v 1.13 2001/01/21 19:05:43 markus Exp $"); RCSID("$OpenBSD: auth1.c,v 1.14 2001/01/22 23:06:39 markus Exp $");
#ifdef HAVE_OSF_SIA #ifdef HAVE_OSF_SIA
# include <sia.h> # include <sia.h>
@ -281,7 +281,7 @@ do_authloop(Authctxt *authctxt)
case SSH_CMSG_AUTH_TIS: case SSH_CMSG_AUTH_TIS:
debug("rcvd SSH_CMSG_AUTH_TIS"); debug("rcvd SSH_CMSG_AUTH_TIS");
if (options.skey_authentication == 1) { if (options.challenge_reponse_authentication == 1) {
char *challenge = get_challenge(authctxt, authctxt->style); char *challenge = get_challenge(authctxt, authctxt->style);
if (challenge != NULL) { if (challenge != NULL) {
debug("sending challenge '%s'", challenge); debug("sending challenge '%s'", challenge);
@ -296,7 +296,7 @@ do_authloop(Authctxt *authctxt)
case SSH_CMSG_AUTH_TIS_RESPONSE: case SSH_CMSG_AUTH_TIS_RESPONSE:
debug("rcvd SSH_CMSG_AUTH_TIS_RESPONSE"); debug("rcvd SSH_CMSG_AUTH_TIS_RESPONSE");
if (options.skey_authentication == 1) { if (options.challenge_reponse_authentication == 1) {
char *response = packet_get_string(&dlen); char *response = packet_get_string(&dlen);
debug("got response '%s'", response); debug("got response '%s'", response);
packet_integrity_check(plen, 4 + dlen, type); packet_integrity_check(plen, 4 + dlen, type);

9
auth2.c
View File

@ -23,7 +23,7 @@
*/ */
#include "includes.h" #include "includes.h"
RCSID("$OpenBSD: auth2.c,v 1.33 2001/01/22 08:32:53 markus Exp $"); RCSID("$OpenBSD: auth2.c,v 1.34 2001/01/22 23:06:39 markus Exp $");
#ifdef HAVE_OSF_SIA #ifdef HAVE_OSF_SIA
# include <sia.h> # include <sia.h>
@ -123,6 +123,10 @@ do_authentication2()
x_authctxt = authctxt; /*XXX*/ x_authctxt = authctxt; /*XXX*/
/* challenge-reponse is implemented via keyboard interactive */
if (options.challenge_reponse_authentication)
options.kbd_interactive_authentication = 1;
#ifdef AFS #ifdef AFS
/* If machine has AFS, set process authentication group. */ /* If machine has AFS, set process authentication group. */
if (k_hasafs()) { if (k_hasafs()) {
@ -401,7 +405,8 @@ userauth_kbdint(Authctxt *authctxt)
debug("keyboard-interactive language %s devs %s", lang, devs); debug("keyboard-interactive language %s devs %s", lang, devs);
authenticated = auth2_challenge(authctxt, devs); if (options.challenge_reponse_authentication)
authenticated = auth2_challenge(authctxt, devs);
#ifdef USE_PAM #ifdef USE_PAM
if (authenticated == 0) if (authenticated == 0)

27
readconf.c
View File

@ -12,7 +12,7 @@
*/ */
#include "includes.h" #include "includes.h"
RCSID("$OpenBSD: readconf.c,v 1.58 2001/01/21 19:05:53 markus Exp $"); RCSID("$OpenBSD: readconf.c,v 1.59 2001/01/22 23:06:39 markus Exp $");
#include "ssh.h" #include "ssh.h"
#include "xmalloc.h" #include "xmalloc.h"
@ -93,7 +93,7 @@ typedef enum {
oBadOption, oBadOption,
oForwardAgent, oForwardX11, oGatewayPorts, oRhostsAuthentication, oForwardAgent, oForwardX11, oGatewayPorts, oRhostsAuthentication,
oPasswordAuthentication, oRSAAuthentication, oFallBackToRsh, oUseRsh, oPasswordAuthentication, oRSAAuthentication, oFallBackToRsh, oUseRsh,
oSkeyAuthentication, oXAuthLocation, oChallengeResponseAuthentication, oXAuthLocation,
#ifdef KRB4 #ifdef KRB4
oKerberosAuthentication, oKerberosAuthentication,
#endif /* KRB4 */ #endif /* KRB4 */
@ -104,7 +104,7 @@ typedef enum {
oUser, oHost, oEscapeChar, oRhostsRSAAuthentication, oProxyCommand, oUser, oHost, oEscapeChar, oRhostsRSAAuthentication, oProxyCommand,
oGlobalKnownHostsFile, oUserKnownHostsFile, oConnectionAttempts, oGlobalKnownHostsFile, oUserKnownHostsFile, oConnectionAttempts,
oBatchMode, oCheckHostIP, oStrictHostKeyChecking, oCompression, oBatchMode, oCheckHostIP, oStrictHostKeyChecking, oCompression,
oCompressionLevel, oKeepAlives, oNumberOfPasswordPrompts, oTISAuthentication, oCompressionLevel, oKeepAlives, oNumberOfPasswordPrompts,
oUsePrivilegedPort, oLogLevel, oCiphers, oProtocol, oUsePrivilegedPort, oLogLevel, oCiphers, oProtocol,
oGlobalKnownHostsFile2, oUserKnownHostsFile2, oPubkeyAuthentication, oGlobalKnownHostsFile2, oUserKnownHostsFile2, oPubkeyAuthentication,
oKbdInteractiveAuthentication, oKbdInteractiveDevices, oHostKeyAlias oKbdInteractiveAuthentication, oKbdInteractiveDevices, oHostKeyAlias
@ -127,8 +127,10 @@ static struct {
{ "kbdinteractivedevices", oKbdInteractiveDevices }, { "kbdinteractivedevices", oKbdInteractiveDevices },
{ "rsaauthentication", oRSAAuthentication }, { "rsaauthentication", oRSAAuthentication },
{ "pubkeyauthentication", oPubkeyAuthentication }, { "pubkeyauthentication", oPubkeyAuthentication },
{ "dsaauthentication", oPubkeyAuthentication }, /* alias */ { "dsaauthentication", oPubkeyAuthentication }, /* alias */
{ "skeyauthentication", oSkeyAuthentication }, { "challengeresponseauthentication", oChallengeResponseAuthentication },
{ "skeyauthentication", oChallengeResponseAuthentication }, /* alias */
{ "tisauthentication", oChallengeResponseAuthentication }, /* alias */
#ifdef KRB4 #ifdef KRB4
{ "kerberosauthentication", oKerberosAuthentication }, { "kerberosauthentication", oKerberosAuthentication },
#endif /* KRB4 */ #endif /* KRB4 */
@ -165,7 +167,6 @@ static struct {
{ "compressionlevel", oCompressionLevel }, { "compressionlevel", oCompressionLevel },
{ "keepalive", oKeepAlives }, { "keepalive", oKeepAlives },
{ "numberofpasswordprompts", oNumberOfPasswordPrompts }, { "numberofpasswordprompts", oNumberOfPasswordPrompts },
{ "tisauthentication", oTISAuthentication },
{ "loglevel", oLogLevel }, { "loglevel", oLogLevel },
{ NULL, 0 } { NULL, 0 }
}; };
@ -318,10 +319,8 @@ parse_flag:
intptr = &options->rhosts_rsa_authentication; intptr = &options->rhosts_rsa_authentication;
goto parse_flag; goto parse_flag;
case oTISAuthentication: case oChallengeResponseAuthentication:
/* fallthrough, there is no difference on the client side */ intptr = &options->challenge_reponse_authentication;
case oSkeyAuthentication:
intptr = &options->skey_authentication;
goto parse_flag; goto parse_flag;
#ifdef KRB4 #ifdef KRB4
@ -669,7 +668,7 @@ initialize_options(Options * options)
options->rhosts_authentication = -1; options->rhosts_authentication = -1;
options->rsa_authentication = -1; options->rsa_authentication = -1;
options->pubkey_authentication = -1; options->pubkey_authentication = -1;
options->skey_authentication = -1; options->challenge_reponse_authentication = -1;
#ifdef KRB4 #ifdef KRB4
options->kerberos_authentication = -1; options->kerberos_authentication = -1;
#endif #endif
@ -736,8 +735,8 @@ fill_default_options(Options * options)
options->rsa_authentication = 1; options->rsa_authentication = 1;
if (options->pubkey_authentication == -1) if (options->pubkey_authentication == -1)
options->pubkey_authentication = 1; options->pubkey_authentication = 1;
if (options->skey_authentication == -1) if (options->challenge_reponse_authentication == -1)
options->skey_authentication = 0; options->challenge_reponse_authentication = 0;
#ifdef KRB4 #ifdef KRB4
if (options->kerberos_authentication == -1) if (options->kerberos_authentication == -1)
options->kerberos_authentication = 1; options->kerberos_authentication = 1;
@ -751,7 +750,7 @@ fill_default_options(Options * options)
if (options->password_authentication == -1) if (options->password_authentication == -1)
options->password_authentication = 1; options->password_authentication = 1;
if (options->kbd_interactive_authentication == -1) if (options->kbd_interactive_authentication == -1)
options->kbd_interactive_authentication = 0; options->kbd_interactive_authentication = 1;
if (options->rhosts_rsa_authentication == -1) if (options->rhosts_rsa_authentication == -1)
options->rhosts_rsa_authentication = 1; options->rhosts_rsa_authentication = 1;
if (options->fallback_to_rsh == -1) if (options->fallback_to_rsh == -1)

5
readconf.h
View File

@ -11,7 +11,7 @@
* called by a name other than "ssh" or "Secure Shell". * called by a name other than "ssh" or "Secure Shell".
*/ */
/* RCSID("$OpenBSD: readconf.h,v 1.24 2000/12/27 12:30:20 markus Exp $"); */ /* RCSID("$OpenBSD: readconf.h,v 1.25 2001/01/22 23:06:39 markus Exp $"); */
#ifndef READCONF_H #ifndef READCONF_H
#define READCONF_H #define READCONF_H
@ -36,7 +36,8 @@ typedef struct {
* authentication. */ * authentication. */
int rsa_authentication; /* Try RSA authentication. */ int rsa_authentication; /* Try RSA authentication. */
int pubkey_authentication; /* Try ssh2 pubkey authentication. */ int pubkey_authentication; /* Try ssh2 pubkey authentication. */
int skey_authentication; /* Try S/Key or TIS authentication. */ int challenge_reponse_authentication;
/* Try S/Key or TIS, authentication. */
#ifdef KRB4 #ifdef KRB4
int kerberos_authentication; /* Try Kerberos int kerberos_authentication; /* Try Kerberos
* authentication. */ * authentication. */

17
servconf.c
View File

@ -10,7 +10,7 @@
*/ */
#include "includes.h" #include "includes.h"
RCSID("$OpenBSD: servconf.c,v 1.62 2001/01/21 19:05:55 markus Exp $"); RCSID("$OpenBSD: servconf.c,v 1.63 2001/01/22 23:06:39 markus Exp $");
#ifdef KRB4 #ifdef KRB4
#include <krb.h> #include <krb.h>
@ -77,7 +77,7 @@ initialize_server_options(ServerOptions *options)
#endif #endif
options->password_authentication = -1; options->password_authentication = -1;
options->kbd_interactive_authentication = -1; options->kbd_interactive_authentication = -1;
options->skey_authentication = -1; options->challenge_reponse_authentication = -1;
options->permit_empty_passwd = -1; options->permit_empty_passwd = -1;
options->use_login = -1; options->use_login = -1;
options->allow_tcp_forwarding = -1; options->allow_tcp_forwarding = -1;
@ -171,8 +171,8 @@ fill_default_server_options(ServerOptions *options)
options->password_authentication = 1; options->password_authentication = 1;
if (options->kbd_interactive_authentication == -1) if (options->kbd_interactive_authentication == -1)
options->kbd_interactive_authentication = 0; options->kbd_interactive_authentication = 0;
if (options->skey_authentication == -1) if (options->challenge_reponse_authentication == -1)
options->skey_authentication = 1; options->challenge_reponse_authentication = 1;
if (options->permit_empty_passwd == -1) if (options->permit_empty_passwd == -1)
options->permit_empty_passwd = 0; options->permit_empty_passwd = 0;
if (options->use_login == -1) if (options->use_login == -1)
@ -201,7 +201,7 @@ typedef enum {
#ifdef AFS #ifdef AFS
sKerberosTgtPassing, sAFSTokenPassing, sKerberosTgtPassing, sAFSTokenPassing,
#endif #endif
sSkeyAuthentication, sChallengeResponseAuthentication,
sPasswordAuthentication, sKbdInteractiveAuthentication, sListenAddress, sPasswordAuthentication, sKbdInteractiveAuthentication, sListenAddress,
sPrintMotd, sIgnoreRhosts, sX11Forwarding, sX11DisplayOffset, sPrintMotd, sIgnoreRhosts, sX11Forwarding, sX11DisplayOffset,
sStrictModes, sEmptyPasswd, sRandomSeedFile, sKeepAlives, sCheckMail, sStrictModes, sEmptyPasswd, sRandomSeedFile, sKeepAlives, sCheckMail,
@ -243,7 +243,8 @@ static struct {
#endif #endif
{ "passwordauthentication", sPasswordAuthentication }, { "passwordauthentication", sPasswordAuthentication },
{ "kbdinteractiveauthentication", sKbdInteractiveAuthentication }, { "kbdinteractiveauthentication", sKbdInteractiveAuthentication },
{ "skeyauthentication", sSkeyAuthentication }, { "challengeresponseauthentication", sChallengeResponseAuthentication },
{ "skeyauthentication", sChallengeResponseAuthentication }, /* alias */
{ "checkmail", sCheckMail }, { "checkmail", sCheckMail },
{ "listenaddress", sListenAddress }, { "listenaddress", sListenAddress },
{ "printmotd", sPrintMotd }, { "printmotd", sPrintMotd },
@ -537,8 +538,8 @@ parse_flag:
intptr = &options->check_mail; intptr = &options->check_mail;
goto parse_flag; goto parse_flag;
case sSkeyAuthentication: case sChallengeResponseAuthentication:
intptr = &options->skey_authentication; intptr = &options->challenge_reponse_authentication;
goto parse_flag; goto parse_flag;
case sPrintMotd: case sPrintMotd:

5
servconf.h
View File

@ -11,7 +11,7 @@
* called by a name other than "ssh" or "Secure Shell". * called by a name other than "ssh" or "Secure Shell".
*/ */
/* RCSID("$OpenBSD: servconf.h,v 1.34 2001/01/19 12:45:27 markus Exp $"); */ /* RCSID("$OpenBSD: servconf.h,v 1.35 2001/01/22 23:06:40 markus Exp $"); */
#ifndef SERVCONF_H #ifndef SERVCONF_H
#define SERVCONF_H #define SERVCONF_H
@ -80,8 +80,7 @@ typedef struct {
int password_authentication; /* If true, permit password int password_authentication; /* If true, permit password
* authentication. */ * authentication. */
int kbd_interactive_authentication; /* If true, permit */ int kbd_interactive_authentication; /* If true, permit */
int skey_authentication; /* If true, permit s/key int challenge_reponse_authentication;
* authentication. */
int permit_empty_passwd; /* If false, do not permit empty int permit_empty_passwd; /* If false, do not permit empty
* passwords. */ * passwords. */
int use_login; /* If true, login(1) is used */ int use_login; /* If true, login(1) is used */

18
sshconnect1.c
View File

@ -13,7 +13,7 @@
*/ */
#include "includes.h" #include "includes.h"
RCSID("$OpenBSD: sshconnect1.c,v 1.19 2001/01/22 08:15:00 markus Exp $"); RCSID("$OpenBSD: sshconnect1.c,v 1.20 2001/01/22 23:06:40 markus Exp $");
#include <openssl/bn.h> #include <openssl/bn.h>
#include <openssl/evp.h> #include <openssl/evp.h>
@ -613,7 +613,7 @@ send_afs_tokens(void)
* Note that the client code is not tied to s/key or TIS. * Note that the client code is not tied to s/key or TIS.
*/ */
int int
try_skey_authentication() try_challenge_reponse_authentication()
{ {
int type, i; int type, i;
int payload_len; int payload_len;
@ -621,7 +621,7 @@ try_skey_authentication()
char prompt[1024]; char prompt[1024];
char *challenge, *response; char *challenge, *response;
debug("Doing skey authentication."); debug("Doing challenge reponse authentication.");
for (i = 0; i < options.number_of_password_prompts; i++) { for (i = 0; i < options.number_of_password_prompts; i++) {
/* request a challenge */ /* request a challenge */
@ -633,10 +633,10 @@ try_skey_authentication()
if (type != SSH_SMSG_FAILURE && if (type != SSH_SMSG_FAILURE &&
type != SSH_SMSG_AUTH_TIS_CHALLENGE) { type != SSH_SMSG_AUTH_TIS_CHALLENGE) {
packet_disconnect("Protocol error: got %d in response " packet_disconnect("Protocol error: got %d in response "
"to skey-auth", type); "to SSH_CMSG_AUTH_TIS", type);
} }
if (type != SSH_SMSG_AUTH_TIS_CHALLENGE) { if (type != SSH_SMSG_AUTH_TIS_CHALLENGE) {
debug("No challenge for skey authentication."); debug("No challenge.");
return 0; return 0;
} }
challenge = packet_get_string(&clen); challenge = packet_get_string(&clen);
@ -665,7 +665,7 @@ try_skey_authentication()
return 1; return 1;
if (type != SSH_SMSG_FAILURE) if (type != SSH_SMSG_FAILURE)
packet_disconnect("Protocol error: got %d in response " packet_disconnect("Protocol error: got %d in response "
"to skey-auth-reponse", type); "to SSH_CMSG_AUTH_TIS_RESPONSE", type);
} }
/* failure */ /* failure */
return 0; return 0;
@ -1018,10 +1018,10 @@ ssh_userauth(
try_rsa_authentication(options.identity_files[i])) try_rsa_authentication(options.identity_files[i]))
return; return;
} }
/* Try skey authentication if the server supports it. */ /* Try challenge response authentication if the server supports it. */
if ((supported_authentications & (1 << SSH_AUTH_TIS)) && if ((supported_authentications & (1 << SSH_AUTH_TIS)) &&
options.skey_authentication && !options.batch_mode) { options.challenge_reponse_authentication && !options.batch_mode) {
if (try_skey_authentication()) if (try_challenge_reponse_authentication())
return; return;
} }
/* Try password authentication if the server supports it. */ /* Try password authentication if the server supports it. */

5
sshconnect2.c
View File

@ -23,7 +23,7 @@
*/ */
#include "includes.h" #include "includes.h"
RCSID("$OpenBSD: sshconnect2.c,v 1.38 2001/01/22 17:22:28 stevesk Exp $"); RCSID("$OpenBSD: sshconnect2.c,v 1.39 2001/01/22 23:06:40 markus Exp $");
#include <openssl/bn.h> #include <openssl/bn.h>
#include <openssl/md5.h> #include <openssl/md5.h>
@ -513,6 +513,9 @@ ssh_userauth2(const char *server_user, char *host)
int type; int type;
int plen; int plen;
if (options.challenge_reponse_authentication)
options.kbd_interactive_authentication = 1;
debug("send SSH2_MSG_SERVICE_REQUEST"); debug("send SSH2_MSG_SERVICE_REQUEST");
packet_start(SSH2_MSG_SERVICE_REQUEST); packet_start(SSH2_MSG_SERVICE_REQUEST);
packet_put_cstring("ssh-userauth"); packet_put_cstring("ssh-userauth");

4
sshd.c
View File

@ -40,7 +40,7 @@
*/ */
#include "includes.h" #include "includes.h"
RCSID("$OpenBSD: sshd.c,v 1.156 2001/01/22 17:22:28 stevesk Exp $"); RCSID("$OpenBSD: sshd.c,v 1.157 2001/01/22 23:06:40 markus Exp $");
#include <openssl/dh.h> #include <openssl/dh.h>
#include <openssl/bn.h> #include <openssl/bn.h>
@ -1254,7 +1254,7 @@ do_ssh1_kex(void)
if (options.afs_token_passing) if (options.afs_token_passing)
auth_mask |= 1 << SSH_PASS_AFS_TOKEN; auth_mask |= 1 << SSH_PASS_AFS_TOKEN;
#endif #endif
if (options.skey_authentication == 1) if (options.challenge_reponse_authentication == 1)
auth_mask |= 1 << SSH_AUTH_TIS; auth_mask |= 1 << SSH_AUTH_TIS;
if (options.password_authentication) if (options.password_authentication)
auth_mask |= 1 << SSH_AUTH_PASSWORD; auth_mask |= 1 << SSH_AUTH_PASSWORD;