aboutsummaryrefslogtreecommitdiff
path: root/src/auth.c
AgeCommit message (Collapse)AuthorFilesLines
2024-01-09Fix docstring for ssh_userauth_kbdint_getanswer()JamesWrigley1-1/+2
This incorrectly stated that it would return an integer value instead of a string. Signed-off-by: James Wrigley <james@puiterwijk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-12-05Handle automatic certificate authenticationJakub Jelen1-31/+205
This involves reading the certificates from configuration files through options and handling them similarly as the OpenSSH does when doing the auto pubkey authentication, also in combination with agent or identities only. Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Sahana Prasad <sahana@redhat.com>
2023-12-05Reformat auth.cJakub Jelen1-48/+64
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Sahana Prasad <sahana@redhat.com>
2023-12-05auth: Reformat ssh_userauth_agentJakub Jelen1-13/+14
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Sahana Prasad <sahana@redhat.com>
2023-05-04auth: Avoid memory leaks during agent authenticationJakub Jelen1-2/+3
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Norbert Pocs <npocs@redhat.com>
2023-02-02Remove support for DSA KeysMohammad Shehar Yaar Tausif1-2/+0
Solving issue #110. The original work is at !231 Some changes were needed because the newly added features in master through time Signed-off-by: Mohammad Shehar Yaar Tausif <sheharyaar48@gmail.com> Signed-off-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2023-01-25Do not build the PKCS#11 when disabledJakub Jelen1-1/+4
This prevents building the pkcs11-related functions and printing pkcs11-related log messages when the libssh is built without PKCS#11 support. Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Norbert Pocs <npocs@redhat.com>
2022-12-20Move old DSA and RSA structs into EVP_PKEYNorbert Pocs1-4/+4
For code simplification and less ifdefs removing DSA and RSA structures of the old openssl api and using the new EVP_PKEY api to store the legacy keys. Signed-off-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2022-10-12auth: Avoid double freeJakub Jelen1-2/+2
Fixes CID 1498359 Thanks coverity Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
2022-10-12change the format specifier of uint32_t from PRId32 to PRIu32Xiang Xiao1-1/+1
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2022-10-12fix printf format warningXiang Xiao1-2/+2
uint32_t should be formated by PRI?32 Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> Change-Id: I811cfd764010f9e8bb599b370155ac065ee1905c
2022-10-07SSH_LOG_WARN: Recategorize loglevelsNorbert Pocs1-2/+2
These warning should be logging when something fatal happens and give information on the error to the user. Signed-off-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2022-10-07SSH_LOG_DEBUG: Recategorize loglevelsNorbert Pocs1-7/+7
Loglevel INFO is the default openssh configuration setting which does not print redundant information. On a system using openssh with loglevels set by the terms of openssh will cause unwanted log lines in the output. recategorized based on - SSH_LOG_DEBUG are informational debug logs (no error) Signed-off-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2022-10-07SSH_LOG_TRACE: Recategorize loglevelsNorbert Pocs1-4/+4
Do not print out logs when no fatal error happens. This approach is similiar to openssh, when Error/Fatal does not print recoverable error logs. recategorized based on - SSH_LOG_TRACE are debug logs when error happens Signed-off-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2022-09-29auth.c: Remove dot from documentation group definitionNorbert Pocs1-1/+1
Signed-off-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2022-09-22Implement IdentitiesOnlyLinus Kardell1-6/+98
Signed-off-by: Linus Kardell <linus.kardell@gmail.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2022-07-07Use EVP_PKEY as a key type in key structsNorbert Pocs1-0/+8
Merge multiple key variables into one variable. Signed-off-by: Norbert Pocs <npocs@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2022-06-23auth: Fix error returned in ssh_userauth_try_publickey()Andreas Schneider1-1/+1
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2022-06-22Enable ssh agent authentication on WindowsWez Furlong1-6/+0
Windows has supported unix domain sockets for a couple of years now; see this article for more information about that: <https://devblogs.microsoft.com/commandline/af_unix-comes-to-windows/> This commit allows libssh to consider using agent authentication on Windows systems. It is mostly removing `#ifndef _WIN32` that prevented the unix domain socket code from being compiled in, and adjusting the use of `read(2)` and `write(2)` to `recv(2)` and `send(2)`, as the former functions are not compatible with sockets on Windows systems. For mingw systems, afunix.h isn't available so we use the technique as was used to resolve building with mingw as used by the curl project in: https://github.com/curl/curl/pull/5170 Signed-off-by: Wez Furlong <wez@fb.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2022-06-09Reformat most of the function headersJakub Jelen1-23/+43
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2022-05-12Allow limiting RSA key size used for authenticationJakub Jelen1-0/+25
Thanks to Harry Sintonen from WithSecure for pointing this out. Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2022-05-10unsorted formatting cleanupJakub Jelen1-3/+6
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2022-05-02Fix multiple spelling and grammar mistakesJunda Ai1-2/+2
Signed-off-by: Junda Ai <aijunda29@gmail.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2022-04-19trivial fix: Fixes some spelling errorsDhanuka Warusadura1-2/+2
Signed-off-by: Dhanuka Warusadura <csx@tuta.io> Reviewed-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2021-07-06Fix error in documentationSerdar Sanli1-2/+1
Signed-off-by: Serdar Sanli <mserdarsanli@gmail.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2021-05-27Replace the hardcode max path length with PATH_MAXXiang Xiao1-1/+1
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> Change-Id: Icb1d36b48a759ec11dbaa4c09a39037a80ab0f85
2020-12-10auth: Add ssh_userauth_publickey_auto_get_current_identity()Marius Vollmer1-0/+49
Signed-off-by: Marius Vollmer <mvollmer@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2020-03-29auth: Fix memory leak in ssh_userauth_publickey_auto()Anderson Toshiyuki Sasaki1-0/+5
When a key is rejected, free the allocated memory before returning. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-12-20src: Implements PKCS11 URI supportSahana Prasad1-1/+17
Imports private and public keys from the engine via PKCS11 URIs. Uses the imported keys to authenticate to the ssh server. Signed-off-by: Sahana Prasad <sahana@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-12-09auth: Use SSH_STRING_FREE()Andreas Schneider1-10/+10
Fixes T183 Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2019-12-09auth: Cast echo to char in ssh_userauth_kbdint_getprompt()Andreas Schneider1-1/+1
Fixes T188 Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2019-12-09auth: Fix integer type in ssh_kbdint_free()Andreas Schneider1-1/+1
Fixes T188 Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2019-12-09auth: Fix integer type in ssh_kbdint_clean()Andreas Schneider1-1/+1
Fixes T188 Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2019-11-18auth: Set auto_state->state explicitlyAnderson Toshiyuki Sasaki1-0/+3
When a new ssh_auth_auto_state_struct is allocated in ssh_userauth_publickey_auto(), initialize the state explicitly for better readability. Fixes T194 Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-11-04auth: Add missing include for explicit_bzero()Andreas Schneider1-0/+1
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2019-06-27auth: Do not print error message for SSH_AGAINAnderson Toshiyuki Sasaki1-1/+1
In non-blocking mode, it is expected SSH_AGAIN to be returned many times. Do not flood the log with error messages. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-05-13auth, pki: Calculate hash internally when signing/verifyingAnderson Toshiyuki Sasaki1-1/+5
This makes pki_do_sign() and pki_signature_verify() to receive the original input instead of the pre-calculated hash. The hash is then calculated internally. The hash to be used inside the signature is decided earlier, when all the information about the signature to be generated/verified is available. Simplify ssh_pki_do_sign() and ssh_srv_pki_do_sign_sessionid(). The tests were modified to use pki_do_sign() instead of pki_do_sign_hash(). Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-05-06auth: Avoid memory on error in ssh_userauth_agent_publickey()Andreas Schneider1-0/+1
CID 1401095 Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com>
2019-04-17libssh: deprecate SSH_KEYTYPE_ECDSABen Toews1-35/+14
This type is imprecise. We often need the ecdsa_nid in addition to the key type in order to do anything. We replace this singluar ECDSA type with one type per curve. Signed-off-by: Ben Toews <mastahyeti@gmail.com> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2019-03-25auth: Set buffer used to store password as secureAnderson Toshiyuki Sasaki1-0/+3
This will make such buffer to be explicity overwritten with zeroes when freed. Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2019-01-09packet: Introduce a new function to access cryptoJakub Jelen1-5/+11
And remove most of the direct access to the structure throughout the code Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Daiki Ueno <dueno@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2018-10-16CVE-2018-10933: Introduce SSH_AUTH_STATE_AUTH_NONE_SENTAnderson Toshiyuki Sasaki1-1/+3
The introduced auth state allows to identify when a request without authentication information was sent. Fixes T101 Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2018-10-16CVE-2018-10933: Introduce SSH_AUTH_STATE_PASSWORD_AUTH_SENTAnderson Toshiyuki Sasaki1-1/+3
The introduced auth state allows to identify when authentication using password was tried. Fixes T101 Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2018-10-16CVE-2018-10933: Introduced new auth statesAnderson Toshiyuki Sasaki1-17/+27
Introduced the states SSH_AUTH_STATE_PUBKEY_OFFER_SENT and SSH_AUTH_STATE_PUBKEY_AUTH_SENT to know when SSH2_MSG_USERAUTH_PK_OK and SSH2_MSG_USERAUTH_SUCCESS should be expected. Fixes T101 Signed-off-by: Anderson Toshiyuki Sasaki <ansasaki@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2018-09-17auth: Fix ecdsa pubkey authAndreas Schneider1-3/+38
Pair-Programmed-With: Jakub Jelen <jjelen@redhat.com> Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Signed-off-by: Jakub Jelen <jjelen@redhat.com>
2018-09-04auth: Use calloc to allocate memoryAndreas Schneider1-2/+1
Signed-off-by: Andreas Schneider <asn@cryptomilk.org> Reviewed-by: Jakub Jelen <jjelen@redhat.com>
2018-09-02auth: Fix freeing memory in ssh_userauth_agent_publickey()Andreas Schneider1-11/+11
CID 1395453 Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-09-01auth: Fix a memory leak in ssh_userauth_agent_publickey()Andreas Schneider1-2/+2
CID 1230358 Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
2018-08-31auth: Prevent authentication with non-allowed key algorithmsJakub Jelen1-6/+33
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
2018-08-31auth: Support SHA2 extension for pubkey authentication (RFC 8332)Jakub Jelen1-5/+9
Signed-off-by: Jakub Jelen <jjelen@redhat.com> Reviewed-by: Andreas Schneider <asn@cryptomilk.org>
generated by cgit v1.2.3 (git 2.25.1) at 2024-04-20 08:50:19 +0000