1 files changed, 210 insertions, 161 deletions

diff --git a/lib/ssh/src/ssh_auth.erl b/lib/ssh/src/ssh_auth.erl
index a91b8c200e..0c378d084b 100644
--- a/lib/ssh/src/ssh_auth.erl
+++ b/lib/ssh/src/ssh_auth.erl
@@ -31,53 +31,83 @@
 -export([publickey_msg/1, password_msg/1, keyboard_interactive_msg/1,
 	 service_request_msg/1, init_userauth_request_msg/1,
 	 userauth_request_msg/1, handle_userauth_request/3,
-	 handle_userauth_info_request/3, handle_userauth_info_response/2,
-	 default_public_key_algorithms/0
+	 handle_userauth_info_request/2, handle_userauth_info_response/2
 	]).
 
 %%--------------------------------------------------------------------
 %%% Internal application API
 %%--------------------------------------------------------------------
-publickey_msg([Alg, #ssh{user = User,
-		       session_id = SessionId,
-		       service = Service,
-		       opts = Opts} = Ssh]) ->
+%%%----------------------------------------------------------------
+userauth_request_msg(#ssh{userauth_methods = ServerMethods,
+			  userauth_supported_methods = UserPrefMethods, % Note: this is not documented as supported for clients
+			  userauth_preference = ClientMethods0
+			 } = Ssh0) ->
+    case sort_select_mthds(ClientMethods0, UserPrefMethods, ServerMethods) of
+	[] ->
+	    Msg = #ssh_msg_disconnect{code = ?SSH_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE,
+				      description = "Unable to connect using the available authentication methods",
+				      language = "en"},
+	    {disconnect, Msg, ssh_transport:ssh_packet(Msg, Ssh0)};
+	
+	[{Pref,Module,Function,Args} | Prefs] ->
+	    Ssh = case Pref of
+		      "keyboard-interactive" -> Ssh0;
+		      _ -> Ssh0#ssh{userauth_preference = Prefs}
+		  end,
+	    case Module:Function(Args ++ [Ssh]) of
+		{not_ok, Ssh1} ->
+		    userauth_request_msg(Ssh1#ssh{userauth_preference = Prefs});
+		Result ->
+		    {Pref,Result}
+	    end
+    end.
 
-    Hash = sha, %% Maybe option?!
-    KeyCb = proplists:get_value(key_cb, Opts, ssh_file),
 
-    case KeyCb:user_key(Alg, Opts) of
-	{ok, Key} ->
-	    StrAlgo = algorithm_string(Alg),
-	    PubKeyBlob = encode_public_key(Key),
-	    SigData = build_sig_data(SessionId, 
-				     User, Service, PubKeyBlob, StrAlgo),
-	    Sig = ssh_transport:sign(SigData, Hash, Key),
-	    SigBlob = list_to_binary([?string(StrAlgo), ?binary(Sig)]),
-	    ssh_transport:ssh_packet(
-	      #ssh_msg_userauth_request{user = User,
-					service = Service,
-					method = "publickey",
-					data = [?TRUE,
-						?string(StrAlgo),
-						?binary(PubKeyBlob),
-						?binary(SigBlob)]},
-	      Ssh);
-     	_Error ->
-	    not_ok
-    end.
 
+sort_select_mthds(Clients, undefined, Servers) ->
+    %% User has not expressed an opinion via option "auth_methods", use the server's prefs
+    sort_select_mthds1(Clients, Servers, string:tokens(?SUPPORTED_AUTH_METHODS,","));
+
+sort_select_mthds(Clients, Users0, Servers0) ->
+    %% The User has an opinion, use the intersection of that and the Servers whishes but
+    %% in the Users order
+    sort_select_mthds1(Clients, string:tokens(Users0,","), Servers0).
+
+
+sort_select_mthds1(Clients, Users0, Servers0) ->
+    Servers = unique(Servers0),
+    Users = unique(Users0),
+    [C || Key <- Users,
+	  lists:member(Key, Servers),
+	  C <- Clients,
+	  element(1,C) == Key].
+
+unique(L) -> 
+    lists:reverse(
+      lists:foldl(fun(E,Acc) -> 
+			  case lists:member(E,Acc) of
+			      true -> Acc;
+			      false -> [E|Acc]
+			  end
+		  end, [], L)).
+    
+
+%%%---- userauth_request_msg "callbacks"
 password_msg([#ssh{opts = Opts, io_cb = IoCb,
-		   user = User, service = Service} = Ssh]) ->
-    Password = case proplists:get_value(password, Opts) of
-		   undefined -> 
-		       user_interaction(IoCb, Ssh);
-		   PW -> 
-		       PW
-	       end,
+		   user = User, service = Service} = Ssh0]) ->
+    {Password,Ssh} = 
+	case proplists:get_value(password, Opts) of
+	    undefined when IoCb == ssh_no_io ->
+		{not_ok, Ssh0};
+	    undefined -> 
+		{IoCb:read_password("ssh password: ",Ssh0), Ssh0};
+	    PW ->
+		%% If "password" option is given it should not be tried again
+		{PW, Ssh0#ssh{opts = lists:keyreplace(password,1,Opts,{password,not_ok})}}
+	end,
     case Password of
 	not_ok ->
-	    not_ok;
+	    {not_ok, Ssh};
 	_  ->
 	    ssh_transport:ssh_packet(
 	      #ssh_msg_userauth_request{user = User,
@@ -89,27 +119,60 @@ password_msg([#ssh{opts = Opts, io_cb = IoCb,
 	      Ssh)
     end.
 
-user_interaction(ssh_no_io, _) ->
-    not_ok;
-user_interaction(IoCb, Ssh) ->
-    IoCb:read_password("ssh password: ", Ssh).
-
-
 %% See RFC 4256 for info on keyboard-interactive
 keyboard_interactive_msg([#ssh{user = User,
+			       opts = Opts,
 			       service = Service} = Ssh]) ->
-    ssh_transport:ssh_packet(
-      #ssh_msg_userauth_request{user = User,
-				service = Service,
-				method = "keyboard-interactive",
-				data = << ?STRING(<<"">>),
-					  ?STRING(<<>>) >> },
-      Ssh).
+    case proplists:get_value(password, Opts) of
+	not_ok ->
+	    {not_ok,Ssh};       % No need to use a failed pwd once more
+	_ ->
+	    ssh_transport:ssh_packet(
+	      #ssh_msg_userauth_request{user = User,
+					service = Service,
+					method = "keyboard-interactive",
+					data = << ?STRING(<<"">>),
+						  ?STRING(<<>>) >> },
+	      Ssh)
+    end.
+
+publickey_msg([Alg, #ssh{user = User,
+		       session_id = SessionId,
+		       service = Service,
+		       opts = Opts} = Ssh]) ->
+    Hash = sha, %% Maybe option?!
+    KeyCb = proplists:get_value(key_cb, Opts, ssh_file),
+    case KeyCb:user_key(Alg, Opts) of
+	{ok, PrivKey} ->
+	    StrAlgo = atom_to_list(Alg),
+            case encode_public_key(StrAlgo, ssh_transport:extract_public_key(PrivKey)) of
+		not_ok ->
+		    {not_ok, Ssh};
+		PubKeyBlob ->
+		    SigData = build_sig_data(SessionId, 
+					     User, Service, PubKeyBlob, StrAlgo),
+		    Sig = ssh_transport:sign(SigData, Hash, PrivKey),
+		    SigBlob = list_to_binary([?string(StrAlgo), ?binary(Sig)]),
+		    ssh_transport:ssh_packet(
+		      #ssh_msg_userauth_request{user = User,
+						service = Service,
+						method = "publickey",
+						data = [?TRUE,
+							?string(StrAlgo),
+							?binary(PubKeyBlob),
+							?binary(SigBlob)]},
+		      Ssh)
+	    end;
+     	_Error ->
+	    {not_ok, Ssh}
+    end.
 
+%%%----------------------------------------------------------------
 service_request_msg(Ssh) ->
     ssh_transport:ssh_packet(#ssh_msg_service_request{name = "ssh-userauth"},
 			   Ssh#ssh{service = "ssh-userauth"}).
 
+%%%----------------------------------------------------------------
 init_userauth_request_msg(#ssh{opts = Opts} = Ssh) ->
     case user_name(Opts) of
 	{ok, User} ->
@@ -117,11 +180,16 @@ init_userauth_request_msg(#ssh{opts = Opts} = Ssh) ->
 					    service = "ssh-connection",
 					    method = "none",
 					    data = <<>>},
+	    Algs0 = proplists:get_value(pref_public_key_algs, Opts, ?SUPPORTED_USER_KEYS),
+	    %% The following line is not strictly correct. The call returns the
+	    %% supported HOST key types while we are interested in USER keys. However,
+	    %% they "happens" to be the same (for now).  This could change....
+	    %% There is no danger as long as the set of user keys is a subset of the set
+	    %% of host keys.
+	    CryptoSupported = ssh_transport:supported_algorithms(public_key),
+	    Algs = [A || A <- Algs0,
+			 lists:member(A, CryptoSupported)],
 
-
-	    Algs = proplists:get_value(public_key, 
-				       proplists:get_value(preferred_algorithms, Opts, []),
-				       default_public_key_algorithms()),
 	    Prefs = method_preference(Algs),
 	    ssh_transport:ssh_packet(Msg, Ssh#ssh{user = User,
 						  userauth_preference = Prefs,
@@ -134,34 +202,9 @@ init_userauth_request_msg(#ssh{opts = Opts} = Ssh) ->
 				      language = "en"})
     end.
 
-userauth_request_msg(#ssh{userauth_preference = []} = Ssh) ->    
-    Msg = #ssh_msg_disconnect{code = 
-			      ?SSH_DISCONNECT_NO_MORE_AUTH_METHODS_AVAILABLE,
-			      description = "Unable to connect using the available"
-			      " authentication methods",
-			      language = "en"},
-    {disconnect, Msg, ssh_transport:ssh_packet(Msg, Ssh)};
-
-userauth_request_msg(#ssh{userauth_methods = Methods, 
-			  userauth_preference = [{Pref, Module,
-					      Function, Args} | Prefs]} 
-		     = Ssh0) ->
-    Ssh = Ssh0#ssh{userauth_preference = Prefs},
-    case lists:member(Pref, Methods) of
-	true ->
-	    case Module:Function(Args ++ [Ssh]) of
-		not_ok ->
-		    userauth_request_msg(Ssh);
-		Result ->
-		    Result
-	    end;
-	false ->
-	    userauth_request_msg(Ssh)
-    end.
-
-
-handle_userauth_request(#ssh_msg_service_request{name = 
-						 Name = "ssh-userauth"},
+%%%----------------------------------------------------------------
+%%% called by server
+handle_userauth_request(#ssh_msg_service_request{name = Name = "ssh-userauth"},
 			_, Ssh) ->
     {ok, ssh_transport:ssh_packet(#ssh_msg_service_accept{name = Name},
 				  Ssh#ssh{service = "ssh-connection"})};
@@ -173,15 +216,15 @@ handle_userauth_request(#ssh_msg_userauth_request{user = User,
 			#ssh{opts = Opts,
 			     userauth_supported_methods = Methods} = Ssh) ->
     Password = unicode:characters_to_list(BinPwd),
-    case check_password(User, Password, Opts) of
-	true ->
+    case check_password(User, Password, Opts, Ssh) of
+	{true,Ssh1} ->
 	    {authorized, User,
-	     ssh_transport:ssh_packet(#ssh_msg_userauth_success{}, Ssh)};
-	false  ->
+	     ssh_transport:ssh_packet(#ssh_msg_userauth_success{}, Ssh1)};
+	{false,Ssh1}  ->
 	    {not_authorized, {User, {error,"Bad user or password"}}, 
 	     ssh_transport:ssh_packet(#ssh_msg_userauth_failure{
 		     authentications = Methods,
-		     partial_success = false}, Ssh)}
+		     partial_success = false}, Ssh1)}
     end;
 
 handle_userauth_request(#ssh_msg_userauth_request{user = User,
@@ -299,8 +342,7 @@ handle_userauth_request(#ssh_msg_userauth_request{user = User,
 							>>
 						},
 	    {not_authorized, {User, undefined}, 
-	     ssh_transport:ssh_packet(Msg, Ssh#ssh{user = User,
-						   kb_data = Msg
+	     ssh_transport:ssh_packet(Msg, Ssh#ssh{user = User
 						  })}
     end;
 
@@ -313,53 +355,45 @@ handle_userauth_request(#ssh_msg_userauth_request{user = User,
        #ssh_msg_userauth_failure{authentications = Methods,
 				 partial_success = false}, Ssh)}.
 
-handle_userauth_info_request(
-  #ssh_msg_userauth_info_request{name = Name,
-				 instruction = Instr,
-				 num_prompts = NumPrompts,
-				 data  = Data}, IoCb, 
-  #ssh{opts = Opts} = Ssh) ->
+
+%%%----------------------------------------------------------------
+%%% keyboard-interactive client
+handle_userauth_info_request(#ssh_msg_userauth_info_request{name = Name,
+							    instruction = Instr,
+							    num_prompts = NumPrompts,
+							    data  = Data},
+			     #ssh{opts = Opts,
+				  io_cb = IoCb
+				 } = Ssh) ->
     PromptInfos = decode_keyboard_interactive_prompts(NumPrompts,Data),
-    Responses = keyboard_interact_get_responses(IoCb, Opts,
-					    Name, Instr, PromptInfos),
-    {ok, 
-     ssh_transport:ssh_packet(
-       #ssh_msg_userauth_info_response{num_responses = NumPrompts,
-				       data = Responses}, Ssh)}.
+    case keyboard_interact_get_responses(IoCb, Opts, Name, Instr, PromptInfos) of
+	not_ok ->
+	    not_ok;
+	Responses ->
+	    {ok, 
+	     ssh_transport:ssh_packet(
+	       #ssh_msg_userauth_info_response{num_responses = NumPrompts,
+					       data = Responses}, Ssh)}
+    end.
 
+%%%----------------------------------------------------------------
+%%% keyboard-interactive server
 handle_userauth_info_response(#ssh_msg_userauth_info_response{num_responses = 1,
 							      data = <<?UINT32(Sz), Password:Sz/binary>>},
 			      #ssh{opts = Opts,
-				   kb_tries_left = KbTriesLeft0,
-				   kb_data = InfoMsg,
+				   kb_tries_left = KbTriesLeft,
 				   user = User,
 				   userauth_supported_methods = Methods} = Ssh) ->
-    KbTriesLeft = KbTriesLeft0 - 1,
-    case check_password(User, unicode:characters_to_list(Password), Opts) of
-	true ->
+    case check_password(User, unicode:characters_to_list(Password), Opts, Ssh) of
+	{true,Ssh1} ->
 	    {authorized, User,
-	     ssh_transport:ssh_packet(#ssh_msg_userauth_success{}, Ssh)};
-	false when KbTriesLeft > 0 ->
-	    UserAuthInfoMsg = 
-		InfoMsg#ssh_msg_userauth_info_request{
-		  name = "",
-		  instruction = 
-		      lists:concat(
-			["Bad user or password, try again. ",
-			 integer_to_list(KbTriesLeft),
-			 " tries left."])
-		 },
-	    {not_authorized, {User, undefined}, 
-	     ssh_transport:ssh_packet(UserAuthInfoMsg,
-				      Ssh#ssh{kb_tries_left = KbTriesLeft})};
-	     
-	false ->
+	     ssh_transport:ssh_packet(#ssh_msg_userauth_success{}, Ssh1)};
+	{false,Ssh1} ->
 	    {not_authorized, {User, {error,"Bad user or password"}}, 
 	     ssh_transport:ssh_packet(#ssh_msg_userauth_failure{
 					 authentications = Methods,
 					 partial_success = false}, 
-				      Ssh#ssh{kb_data = undefined,
-					      kb_tries_left = 0}
+				      Ssh1#ssh{kb_tries_left = max(KbTriesLeft-1, 0)}
 				     )}
     end;
 
@@ -371,8 +405,6 @@ handle_userauth_info_response(#ssh_msg_userauth_info_response{},
 			      language = "en"}).
 
 
-default_public_key_algorithms() -> ?PREFERRED_PK_ALGS.
-
 %%--------------------------------------------------------------------
 %%% Internal functions
 %%--------------------------------------------------------------------
@@ -404,13 +436,34 @@ user_name(Opts) ->
 	    {ok, User}
     end.
 
-check_password(User, Password, Opts) ->
+check_password(User, Password, Opts, Ssh) ->
     case proplists:get_value(pwdfun, Opts) of
 	undefined ->
 	    Static = get_password_option(Opts, User),
-	    Password == Static;
-	Cheker ->
-	    Cheker(User, Password)
+	    {Password == Static, Ssh};
+
+	Checker when is_function(Checker,2) ->
+	    {Checker(User, Password), Ssh};
+
+	Checker when is_function(Checker,4) ->
+	    #ssh{pwdfun_user_state = PrivateState,
+		 peer = {_,PeerAddr={_,_}}
+		} = Ssh,
+	    case Checker(User, Password, PeerAddr, PrivateState) of
+		true ->
+		    {true,Ssh};
+		false ->
+		    {false,Ssh};
+		{true,NewState} ->
+		    {true, Ssh#ssh{pwdfun_user_state=NewState}};
+		{false,NewState} ->
+		    {false, Ssh#ssh{pwdfun_user_state=NewState}};
+		disconnect ->
+		    throw(#ssh_msg_disconnect{code = ?SSH_DISCONNECT_SERVICE_NOT_AVAILABLE,
+					      description = 
+						  "Unable to connect using the available authentication methods",
+					      language = ""})
+	    end
     end.
 
 get_password_option(Opts, User) ->
@@ -447,10 +500,7 @@ build_sig_data(SessionId, User, Service, KeyBlob, Alg) ->
 	   ?binary(KeyBlob)],
     list_to_binary(Sig).
 
-algorithm_string('ssh-rsa') ->
-    "ssh-rsa";
-algorithm_string('ssh-dss') ->
-    "ssh-dss".
+
 
 decode_keyboard_interactive_prompts(_NumPrompts, Data) ->
     ssh_message:decode_keyboard_interactive_prompts(Data, []).
@@ -462,30 +512,34 @@ keyboard_interact_get_responses(IoCb, Opts, Name, Instr, PromptInfos) ->
 				    proplists:get_value(password, Opts, undefined), IoCb, Name,
 				    Instr, PromptInfos, Opts, NumPrompts).
 
+
+keyboard_interact_get_responses(_, _, not_ok, _, _, _, _, _, _) ->
+    not_ok;
 keyboard_interact_get_responses(_, undefined, Password, _, _, _, _, _,
 				1) when Password =/= undefined ->
     [Password]; %% Password auth implemented with keyboard-interaction and passwd is known
 keyboard_interact_get_responses(_, _, _, _, _, _, _, _, 0)  ->
-    [""];
+    [];
 keyboard_interact_get_responses(false, undefined, undefined, _, _, _, [Prompt|_], Opts, _) ->
     ssh_no_io:read_line(Prompt, Opts); %% Throws error as keyboard interaction is not allowed
 keyboard_interact_get_responses(true, undefined, _,IoCb, Name, Instr, PromptInfos, Opts, _) ->
     keyboard_interact(IoCb, Name, Instr, PromptInfos, Opts);
-keyboard_interact_get_responses(true, Fun, _, Name, Instr, PromptInfos, _, _, NumPrompts) ->
+keyboard_interact_get_responses(true, Fun, _Pwd, _IoCb, Name, Instr, PromptInfos, _Opts, NumPrompts) ->
     keyboard_interact_fun(Fun, Name, Instr, PromptInfos, NumPrompts).
 
 keyboard_interact(IoCb, Name, Instr, Prompts, Opts) ->
-    if Name /= "" -> IoCb:format("~s", [Name]);
-       true       -> ok
-    end,
-    if Instr /= "" -> IoCb:format("~s", [Instr]);
-       true        -> ok
-    end,
+    write_if_nonempty(IoCb, Name),
+    write_if_nonempty(IoCb, Instr),
     lists:map(fun({Prompt, true})  -> IoCb:read_line(Prompt, Opts);
 		 ({Prompt, false}) -> IoCb:read_password(Prompt, Opts)
 	      end,
 	      Prompts).
 
+write_if_nonempty(_, "") -> ok;
+write_if_nonempty(_, <<>>) -> ok;
+write_if_nonempty(IoCb, Text) -> IoCb:format("~s~n",[Text]).
+
+
 keyboard_interact_fun(KbdInteractFun, Name, Instr,  PromptInfos, NumPrompts) ->
     Prompts = lists:map(fun({Prompt, _Echo}) -> Prompt end,
 			PromptInfos),
@@ -501,23 +555,18 @@ keyboard_interact_fun(KbdInteractFun, Name, Instr,  PromptInfos, NumPrompts) ->
 				       language = "en"}})
     end.
 
-decode_public_key_v2(<<?UINT32(Len0), _:Len0/binary,
-		       ?UINT32(Len1), E:Len1/big-signed-integer-unit:8,
-		       ?UINT32(Len2), N:Len2/big-signed-integer-unit:8>>
-			 ,"ssh-rsa") ->
-    {ok, #'RSAPublicKey'{publicExponent = E, modulus = N}};
-decode_public_key_v2(<<?UINT32(Len0), _:Len0/binary,
-		       ?UINT32(Len1), P:Len1/big-signed-integer-unit:8,
-		       ?UINT32(Len2), Q:Len2/big-signed-integer-unit:8,
-		       ?UINT32(Len3), G:Len3/big-signed-integer-unit:8,
-		       ?UINT32(Len4), Y:Len4/big-signed-integer-unit:8>>
-			 , "ssh-dss") ->
-    {ok, {Y, #'Dss-Parms'{p = P, q = Q, g = G}}};
-
-decode_public_key_v2(_, _) ->
-    {error, bad_format}.
-
-encode_public_key(#'RSAPrivateKey'{publicExponent = E, modulus = N}) ->
-    ssh_bits:encode(["ssh-rsa",E,N], [string,mpint,mpint]);
-encode_public_key(#'DSAPrivateKey'{p = P, q = Q, g = G, y = Y}) ->
-    ssh_bits:encode(["ssh-dss",P,Q,G,Y], [string,mpint,mpint,mpint,mpint]).
+decode_public_key_v2(Bin, _Type) ->
+    try 
+	public_key:ssh_decode(Bin, ssh2_pubkey)
+    of
+	Key -> {ok, Key}
+    catch
+	_:_ -> {error, bad_format}
+    end.
+
+encode_public_key(_Alg, Key) ->
+    try
+	public_key:ssh_encode(Key, ssh2_pubkey)
+    catch
+	_:_ -> not_ok
+    end.