Clean up hash selection in ECDSA.

[PuTTY.git] / ssh.c

diff --git a/ssh.c b/ssh.c
index d1e9d71f34c374ceb05124752f74c42baa1e18c7..fd3cdd64bcd0ac7d1b2a50d666e10da71d32b7e0 100644 (file)
--- a/ssh.c
+++ b/ssh.c
@@ -3876,7 +3876,7 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
        void *publickey_blob;
        int publickey_bloblen;
        char *publickey_comment;
-       int publickey_encrypted;
+       int privatekey_available, privatekey_encrypted;
        prompts_t *cur_prompt;
        char c;
        int pwpkt_type;
@@ -4210,20 +4210,24 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
     s->keyfile = conf_get_filename(ssh->conf, CONF_keyfile);
     if (!filename_is_null(s->keyfile)) {
        int keytype;
-       logeventf(ssh, "Reading private key file \"%.150s\"",
+       logeventf(ssh, "Reading key file \"%.150s\"",
                  filename_to_str(s->keyfile));
        keytype = key_type(s->keyfile);
-       if (keytype == SSH_KEYTYPE_SSH1) {
+       if (keytype == SSH_KEYTYPE_SSH1 ||
+            keytype == SSH_KEYTYPE_SSH1_PUBLIC) {
            const char *error;
            if (rsakey_pubblob(s->keyfile,
                               &s->publickey_blob, &s->publickey_bloblen,
                               &s->publickey_comment, &error)) {
-               s->publickey_encrypted = rsakey_encrypted(s->keyfile,
-                                                         NULL);
+                s->privatekey_available = (keytype == SSH_KEYTYPE_SSH1);
+                if (!s->privatekey_available)
+                    logeventf(ssh, "Key file contains public key only");
+               s->privatekey_encrypted = rsakey_encrypted(s->keyfile,
+                                                           NULL);
            } else {
                char *msgbuf;
-               logeventf(ssh, "Unable to load private key (%s)", error);
-               msgbuf = dupprintf("Unable to load private key file "
+               logeventf(ssh, "Unable to load key (%s)", error);
+               msgbuf = dupprintf("Unable to load key file "
                                   "\"%.150s\" (%s)\r\n",
                                   filename_to_str(s->keyfile),
                                   error);
@@ -4431,7 +4435,8 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
            if (s->authed)
                break;
        }
-       if (s->publickey_blob && !s->tried_publickey) {
+       if (s->publickey_blob && s->privatekey_available &&
+            !s->tried_publickey) {
            /*
             * Try public key authentication with the specified
             * key file.
@@ -4450,7 +4455,7 @@ static int do_ssh1_login(Ssh ssh, unsigned char *in, int inlen,
                 */
                char *passphrase = NULL;    /* only written after crReturn */
                const char *error;
-               if (!s->publickey_encrypted) {
+               if (!s->privatekey_encrypted) {
                    if (flags & FLAG_VERBOSE)
                        c_write_str(ssh, "No passphrase required.\r\n");
                    passphrase = NULL;
@@ -6735,7 +6740,7 @@ static void do_ssh2_transport(Ssh ssh, void *vin, int inlen,
          * If we're doing Diffie-Hellman group exchange, start by
          * requesting a group.
          */
-        if (!ssh->kex->pdata) {
+        if (dh_is_gex(ssh->kex)) {
             logevent("Doing Diffie-Hellman group exchange");
             ssh->pkt_kctx = SSH2_PKTCTX_DHGEX;
             /*
@@ -6800,7 +6805,8 @@ static void do_ssh2_transport(Ssh ssh, void *vin, int inlen,
         }
         set_busy_status(ssh->frontend, BUSY_CPU); /* cogitate */
         ssh_pkt_getstring(pktin, &s->hostkeydata, &s->hostkeylen);
-        s->hkey = ssh->hostkey->newkey(s->hostkeydata, s->hostkeylen);
+        s->hkey = ssh->hostkey->newkey(ssh->hostkey,
+                                       s->hostkeydata, s->hostkeylen);
         s->f = ssh2_pkt_getmp(pktin);
         if (!s->f) {
             bombout(("unable to parse key exchange reply packet"));
@@ -6822,7 +6828,7 @@ static void do_ssh2_transport(Ssh ssh, void *vin, int inlen,
         set_busy_status(ssh->frontend, BUSY_NOT);
 
         hash_string(ssh->kex->hash, ssh->exhash, s->hostkeydata, s->hostkeylen);
-        if (!ssh->kex->pdata) {
+        if (dh_is_gex(ssh->kex)) {
             if (!(ssh->remote_bugs & BUG_SSH2_OLDGEX))
                 hash_uint32(ssh->kex->hash, ssh->exhash, DH_MIN_SIZE);
             hash_uint32(ssh->kex->hash, ssh->exhash, s->pbits);
@@ -6836,7 +6842,7 @@ static void do_ssh2_transport(Ssh ssh, void *vin, int inlen,
 
         dh_cleanup(ssh->kex_ctx);
         freebn(s->f);
-        if (!ssh->kex->pdata) {
+        if (dh_is_gex(ssh->kex)) {
             freebn(s->g);
             freebn(s->p);
         }
@@ -6846,7 +6852,7 @@ static void do_ssh2_transport(Ssh ssh, void *vin, int inlen,
                   ssh->kex->hash->text_name);
         ssh->pkt_kctx = SSH2_PKTCTX_ECDHKEX;
 
-        s->eckey = ssh_ecdhkex_newkey(ssh->kex->name);
+        s->eckey = ssh_ecdhkex_newkey(ssh->kex);
         if (!s->eckey) {
             bombout(("Unable to generate key for ECDH"));
             crStopV;
@@ -6878,7 +6884,8 @@ static void do_ssh2_transport(Ssh ssh, void *vin, int inlen,
 
         ssh_pkt_getstring(pktin, &s->hostkeydata, &s->hostkeylen);
         hash_string(ssh->kex->hash, ssh->exhash, s->hostkeydata, s->hostkeylen);
-        s->hkey = ssh->hostkey->newkey(s->hostkeydata, s->hostkeylen);
+        s->hkey = ssh->hostkey->newkey(ssh->hostkey,
+                                       s->hostkeydata, s->hostkeylen);
 
         {
             char *publicPoint;
@@ -6927,7 +6934,8 @@ static void do_ssh2_transport(Ssh ssh, void *vin, int inlen,
         ssh_pkt_getstring(pktin, &s->hostkeydata, &s->hostkeylen);
         hash_string(ssh->kex->hash, ssh->exhash,
                    s->hostkeydata, s->hostkeylen);
-       s->hkey = ssh->hostkey->newkey(s->hostkeydata, s->hostkeylen);
+       s->hkey = ssh->hostkey->newkey(ssh->hostkey,
+                                       s->hostkeydata, s->hostkeylen);
 
         {
             char *keydata;
@@ -7037,7 +7045,7 @@ static void do_ssh2_transport(Ssh ssh, void *vin, int inlen,
          * Authenticate remote host: verify host key. (We've already
          * checked the signature of the exchange hash.)
          */
-        s->fingerprint = ssh->hostkey->fingerprint(s->hkey);
+        s->fingerprint = ssh2_fingerprint(ssh->hostkey, s->hkey);
         logevent("Host key fingerprint is:");
         logevent(s->fingerprint);
         /* First check against manually configured host keys. */
@@ -8852,7 +8860,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
        int got_username;
        void *publickey_blob;
        int publickey_bloblen;
-       int publickey_encrypted;
+       int privatekey_available, privatekey_encrypted;
        char *publickey_algorithm;
        char *publickey_comment;
        unsigned char agent_request[5], *agent_response, *agentp;
@@ -8958,10 +8966,12 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
        s->keyfile = conf_get_filename(ssh->conf, CONF_keyfile);
        if (!filename_is_null(s->keyfile)) {
            int keytype;
-           logeventf(ssh, "Reading private key file \"%.150s\"",
+           logeventf(ssh, "Reading key file \"%.150s\"",
                      filename_to_str(s->keyfile));
            keytype = key_type(s->keyfile);
-           if (keytype == SSH_KEYTYPE_SSH2) {
+           if (keytype == SSH_KEYTYPE_SSH2 ||
+                keytype == SSH_KEYTYPE_SSH2_PUBLIC_RFC4716 ||
+                keytype == SSH_KEYTYPE_SSH2_PUBLIC_OPENSSH) {
                const char *error;
                s->publickey_blob =
                    ssh2_userkey_loadpub(s->keyfile,
@@ -8969,13 +8979,16 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
                                         &s->publickey_bloblen, 
                                         &s->publickey_comment, &error);
                if (s->publickey_blob) {
-                   s->publickey_encrypted =
+                   s->privatekey_available = (keytype == SSH_KEYTYPE_SSH2);
+                    if (!s->privatekey_available)
+                        logeventf(ssh, "Key file contains public key only");
+                   s->privatekey_encrypted =
                        ssh2_userkey_encrypted(s->keyfile, NULL);
                } else {
                    char *msgbuf;
-                   logeventf(ssh, "Unable to load private key (%s)", 
+                   logeventf(ssh, "Unable to load key (%s)", 
                              error);
-                   msgbuf = dupprintf("Unable to load private key file "
+                   msgbuf = dupprintf("Unable to load key file "
                                       "\"%.150s\" (%s)\r\n",
                                       filename_to_str(s->keyfile),
                                       error);
@@ -9489,7 +9502,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
                }
 
            } else if (s->can_pubkey && s->publickey_blob &&
-                      !s->tried_pubkey_config) {
+                      s->privatekey_available && !s->tried_pubkey_config) {
 
                struct ssh2_userkey *key;   /* not live over crReturn */
                char *passphrase;           /* not live over crReturn */
@@ -9540,7 +9553,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
                key = NULL;
                while (!key) {
                    const char *error;  /* not live over crReturn */
-                   if (s->publickey_encrypted) {
+                   if (s->privatekey_encrypted) {
                        /*
                         * Get a passphrase from the user.
                         */
@@ -10265,6 +10278,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
 
     /* Clear up various bits and pieces from authentication. */
     if (s->publickey_blob) {
+       sfree(s->publickey_algorithm);
        sfree(s->publickey_blob);
        sfree(s->publickey_comment);
     }