/* $OpenBSD: ssh-agent.c,v 1.324 2026/03/10 07:27:14 djm Exp $ */

/*

 * Author: Tatu Ylonen <ylo@cs.hut.fi>

 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland

 *                    All rights reserved

 * The authentication agent program.

 *

 * As far as I am concerned, the code I have written for this software

 * can be used freely for any purpose.  Any derived versions of this

 * software must be clearly marked as such, and if the derived work is

 * incompatible with the protocol description in the RFC file, it must be

 * called by a name other than "ssh" or "Secure Shell".

 *

 * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 * 1. Redistributions of source code must retain the above copyright

 *    notice, this list of conditions and the following disclaimer.

 * 2. Redistributions in binary form must reproduce the above copyright

 *    notice, this list of conditions and the following disclaimer in the

 *    documentation and/or other materials provided with the distribution.

 *

 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR

 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES

 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.

 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,

 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF

 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 */

#include "includes.h"

#include <sys/types.h>

#include <sys/time.h>

#include <sys/queue.h>

#include <sys/resource.h>

#include <sys/socket.h>

#include <sys/stat.h>

#include <sys/un.h>

#include <sys/wait.h>

#ifdef WITH_OPENSSL

#include <openssl/evp.h>

#include "openbsd-compat/openssl-compat.h"

#endif

#include <errno.h>

#include <fcntl.h>

#include <paths.h>

#include <poll.h>

#include <signal.h>

#include <stdlib.h>

#include <stdio.h>

#include <string.h>

#include <stdarg.h>

#include <limits.h>

#include <time.h>

#include <unistd.h>

#include <util.h>

#include "xmalloc.h"

#include "ssh.h"

#include "ssh2.h"

#include "sshbuf.h"

#include "sshkey.h"

#include "authfd.h"

#include "log.h"

#include "misc.h"

#include "digest.h"

#include "ssherr.h"

#include "match.h"

#include "msg.h"

#include "pathnames.h"

#include "ssh-pkcs11.h"

#include "sk-api.h"

#include "myproposal.h"

#ifndef DEFAULT_ALLOWED_PROVIDERS

# define DEFAULT_ALLOWED_PROVIDERS "/usr/lib*/*,/usr/local/lib*/*"

#endif

#ifndef DEFAULT_WEBSAFE_ALLOWLIST

# define DEFAULT_WEBSAFE_ALLOWLIST "ssh:*"

#endif

/* Maximum accepted message length */

#define AGENT_MAX_LEN   (256*1024)

/* Maximum bytes to read from client socket */

#define AGENT_RBUF_LEN    (4096)

/* Maximum number of recorded session IDs/hostkeys per connection */

#define AGENT_MAX_SESSION_IDS   16

/* Maximum size of session ID */

#define AGENT_MAX_SID_LEN   128

/* Maximum number of destination constraints to accept on a key */

#define AGENT_MAX_DEST_CONSTRAINTS  1024

/* Maximum number of associated certificate constraints to accept on a key */

#define AGENT_MAX_EXT_CERTS   1024

/* XXX store hostkey_sid in a refcounted tree */

typedef enum {

  AUTH_UNUSED = 0,

  AUTH_SOCKET = 1,

  AUTH_CONNECTION = 2,

} sock_type;

struct hostkey_sid {

  struct sshkey *key;

  struct sshbuf *sid;

  int forwarded;

};

typedef struct socket_entry {

  int fd;

  sock_type type;

  struct sshbuf *input;

  struct sshbuf *output;

  struct sshbuf *request;

  size_t nsession_ids;

  struct hostkey_sid *session_ids;

  int session_bind_attempted;

} SocketEntry;

u_int sockets_alloc = 0;

SocketEntry *sockets = NULL;

typedef struct identity {

  TAILQ_ENTRY(identity) next;

  struct sshkey *key;

  char *comment;

  char *provider;

  time_t death;

  u_int confirm;

  char *sk_provider;

  struct dest_constraint *dest_constraints;

  size_t ndest_constraints;

} Identity;

struct idtable {

  int nentries;

  TAILQ_HEAD(idqueue, identity) idlist;

};

/* private key table */

struct idtable *idtab;

int max_fd = 0;

/* pid of shell == parent of agent */

pid_t parent_pid = -1;

time_t parent_alive_interval = 0;

static sig_atomic_t signalled_exit;

static sig_atomic_t signalled_keydrop;

/* pid of process for which cleanup_socket is applicable */

pid_t cleanup_pid = 0;

/* pathname and directory for AUTH_SOCKET */

static char *socket_name;

static char socket_dir[PATH_MAX];

/* Pattern-list of allowed PKCS#11/Security key paths */

static char *allowed_providers;

/*

 * Allows PKCS11 providers or SK keys that use non-internal providers to

 * be added over a remote connection (identified by session-bind@openssh.com).

 */

static int remote_add_provider;

/* locking */

#define LOCK_SIZE 32

#define LOCK_SALT_SIZE  16

#define LOCK_ROUNDS 1

int locked = 0;

u_char lock_pwhash[LOCK_SIZE];

u_char lock_salt[LOCK_SALT_SIZE];

extern char *__progname;

/* Default lifetime in seconds (0 == forever) */

static int lifetime = 0;

static int fingerprint_hash = SSH_FP_HASH_DEFAULT;

/* Refuse signing of non-SSH messages for web-origin FIDO keys */

static int restrict_websafe = 1;

static char *websafe_allowlist;

static void

close_socket(SocketEntry *e)

{

  size_t i;

  close(e->fd);

  sshbuf_free(e->input);

  sshbuf_free(e->output);

  sshbuf_free(e->request);

  for (i = 0; i < e->nsession_ids; i++) {

    sshkey_free(e->session_ids[i].key);

    sshbuf_free(e->session_ids[i].sid);

  }

  free(e->session_ids);

  memset(e, '\0', sizeof(*e));

  e->fd = -1;

  e->type = AUTH_UNUSED;

}

static void

idtab_init(void)

{

  idtab = xcalloc(1, sizeof(*idtab));

  TAILQ_INIT(&idtab->idlist);

  idtab->nentries = 0;

}

static void

free_dest_constraint_hop(struct dest_constraint_hop *dch)

{

  u_int i;

  if (dch == NULL)

    return;

  free(dch->user);

  free(dch->hostname);

  for (i = 0; i < dch->nkeys; i++)

    sshkey_free(dch->keys[i]);

  free(dch->keys);

  free(dch->key_is_ca);

}

static void

free_dest_constraints(struct dest_constraint *dcs, size_t ndcs)

{

  size_t i;

  for (i = 0; i < ndcs; i++) {

    free_dest_constraint_hop(&dcs[i].from);

    free_dest_constraint_hop(&dcs[i].to);

  }

  free(dcs);

}

#ifdef ENABLE_PKCS11

static void

dup_dest_constraint_hop(const struct dest_constraint_hop *dch,

    struct dest_constraint_hop *out)

{

  u_int i;

  int r;

  out->user = dch->user == NULL ? NULL : xstrdup(dch->user);

  out->hostname = dch->hostname == NULL ? NULL : xstrdup(dch->hostname);

  out->is_ca = dch->is_ca;

  out->nkeys = dch->nkeys;

  out->keys = out->nkeys == 0 ? NULL :

      xcalloc(out->nkeys, sizeof(*out->keys));

  out->key_is_ca = out->nkeys == 0 ? NULL :

      xcalloc(out->nkeys, sizeof(*out->key_is_ca));

  for (i = 0; i < dch->nkeys; i++) {

    if (dch->keys[i] != NULL &&

        (r = sshkey_from_private(dch->keys[i],

        &(out->keys[i]))) != 0)

      fatal_fr(r, "copy key");

    out->key_is_ca[i] = dch->key_is_ca[i];

  }

}

static struct dest_constraint *

dup_dest_constraints(const struct dest_constraint *dcs, size_t ndcs)

{

  size_t i;

  struct dest_constraint *ret;

  if (ndcs == 0)

    return NULL;

  ret = xcalloc(ndcs, sizeof(*ret));

  for (i = 0; i < ndcs; i++) {

    dup_dest_constraint_hop(&dcs[i].from, &ret[i].from);

    dup_dest_constraint_hop(&dcs[i].to, &ret[i].to);

  }

  return ret;

}

#endif /* ENABLE_PKCS11 */

#ifdef DEBUG_CONSTRAINTS

static void

dump_dest_constraint_hop(const struct dest_constraint_hop *dch)

{

  u_int i;

  char *fp;

  debug_f("user %s hostname %s is_ca %d nkeys %u",

      dch->user == NULL ? "(null)" : dch->user,

      dch->hostname == NULL ? "(null)" : dch->hostname,

      dch->is_ca, dch->nkeys);

  for (i = 0; i < dch->nkeys; i++) {

    fp = NULL;

    if (dch->keys[i] != NULL &&

        (fp = sshkey_fingerprint(dch->keys[i],

        SSH_FP_HASH_DEFAULT, SSH_FP_DEFAULT)) == NULL)

      fatal_f("fingerprint failed");

    debug_f("key %u/%u: %s%s%s key_is_ca %d", i, dch->nkeys,

        dch->keys[i] == NULL ? "" : sshkey_ssh_name(dch->keys[i]),

        dch->keys[i] == NULL ? "" : " ",

        dch->keys[i] == NULL ? "none" : fp,

        dch->key_is_ca[i]);

    free(fp);

  }

}

#endif /* DEBUG_CONSTRAINTS */

static void

dump_dest_constraints(const char *context,

    const struct dest_constraint *dcs, size_t ndcs)

{

#ifdef DEBUG_CONSTRAINTS

  size_t i;

  debug_f("%s: %zu constraints", context, ndcs);

  for (i = 0; i < ndcs; i++) {

    debug_f("constraint %zu / %zu: from: ", i, ndcs);

    dump_dest_constraint_hop(&dcs[i].from);

    debug_f("constraint %zu / %zu: to: ", i, ndcs);

    dump_dest_constraint_hop(&dcs[i].to);

  }

  debug_f("done for %s", context);

#endif /* DEBUG_CONSTRAINTS */

}

static void

free_identity(Identity *id)

{

  sshkey_free(id->key);

  free(id->provider);

  free(id->comment);

  free(id->sk_provider);

  free_dest_constraints(id->dest_constraints, id->ndest_constraints);

  free(id);

}

/*

 * Match 'key' against the key/CA list in a destination constraint hop

 * Returns 0 on success or -1 otherwise.

 */

static int

match_key_hop(const char *tag, const struct sshkey *key,

    const struct dest_constraint_hop *dch)

{

  const char *reason = NULL;

  const char *hostname = dch->hostname ? dch->hostname : "(ORIGIN)";

  u_int i;

  char *fp;

  if (key == NULL)

    return -1;

  /* XXX logspam */

  if ((fp = sshkey_fingerprint(key, SSH_FP_HASH_DEFAULT,

      SSH_FP_DEFAULT)) == NULL)

    fatal_f("fingerprint failed");

  debug3_f("%s: entering hostname %s, requested key %s %s, %u keys avail",

      tag, hostname, sshkey_type(key), fp, dch->nkeys);

  free(fp);

  for (i = 0; i < dch->nkeys; i++) {

    if (dch->keys[i] == NULL)

      return -1;

    /* XXX logspam */

    if ((fp = sshkey_fingerprint(dch->keys[i], SSH_FP_HASH_DEFAULT,

        SSH_FP_DEFAULT)) == NULL)

      fatal_f("fingerprint failed");

    debug3_f("%s: key %u: %s%s %s", tag, i,

        dch->key_is_ca[i] ? "CA " : "",

        sshkey_type(dch->keys[i]), fp);

    free(fp);

    if (!sshkey_is_cert(key)) {

      /* plain key */

      if (dch->key_is_ca[i] ||

          !sshkey_equal(key, dch->keys[i]))

        continue;

      return 0;

    }

    /* certificate */

    if (!dch->key_is_ca[i])

      continue;

    if (key->cert == NULL || key->cert->signature_key == NULL)

      return -1; /* shouldn't happen */

    if (!sshkey_equal(key->cert->signature_key, dch->keys[i]))

      continue;

    if (sshkey_cert_check_host(key, hostname,

        SSH_ALLOWED_CA_SIGALGS, &reason) != 0) {

      debug_f("cert %s / hostname %s rejected: %s",

          key->cert->key_id, hostname, reason);

      continue;

    }

    return 0;

  }

  return -1;

}

/* Check destination constraints on an identity against the hostkey/user */

static int

permitted_by_dest_constraints(const struct sshkey *fromkey,

    const struct sshkey *tokey, Identity *id, const char *user,

    const char **hostnamep)

{

  size_t i;

  struct dest_constraint *d;

  if (hostnamep != NULL)

    *hostnamep = NULL;

  for (i = 0; i < id->ndest_constraints; i++) {

    d = id->dest_constraints + i;

    /* XXX remove logspam */

    debug2_f("constraint %zu %s%s%s (%u keys) > %s%s%s (%u keys)",

        i, d->from.user ? d->from.user : "",

        d->from.user ? "@" : "",

        d->from.hostname ? d->from.hostname : "(ORIGIN)",

        d->from.nkeys,

        d->to.user ? d->to.user : "", d->to.user ? "@" : "",

        d->to.hostname ? d->to.hostname : "(ANY)", d->to.nkeys);

    /* Match 'from' key */

    if (fromkey == NULL) {

      /* We are matching the first hop */

      if (d->from.hostname != NULL || d->from.nkeys != 0)

        continue;

    } else if (match_key_hop("from", fromkey, &d->from) != 0)

      continue;

    /* Match 'to' key */

    if (tokey != NULL && match_key_hop("to", tokey, &d->to) != 0)

      continue;

    /* Match user if specified */

    if (d->to.user != NULL && user != NULL &&

        !match_pattern(user, d->to.user))

      continue;

    /* successfully matched this constraint */

    if (hostnamep != NULL)

      *hostnamep = d->to.hostname;

    debug2_f("allowed for hostname %s",

        d->to.hostname == NULL ? "*" : d->to.hostname);

    return 0;

  }

  /* no match */

  debug2_f("%s identity \"%s\" not permitted for this destination",

      sshkey_type(id->key), id->comment);

  return -1;

}

/*

 * Check whether hostkeys on a SocketEntry and the optionally specified user

 * are permitted by the destination constraints on the Identity.

 * Returns 0 on success or -1 otherwise.

 */

static int

identity_permitted(Identity *id, SocketEntry *e, char *user,

    const char **forward_hostnamep, const char **last_hostnamep)

{

  size_t i;

  const char **hp;

  struct hostkey_sid *hks;

  const struct sshkey *fromkey = NULL;

  const char *test_user;

  char *fp1, *fp2;

  /* XXX remove logspam */

  debug3_f("entering: key %s comment \"%s\", %zu socket bindings, "

      "%zu constraints", sshkey_type(id->key), id->comment,

      e->nsession_ids, id->ndest_constraints);

  if (id->ndest_constraints == 0)

    return 0; /* unconstrained */

  if (e->session_bind_attempted && e->nsession_ids == 0) {

    error_f("previous session bind failed on socket");

    return -1;

  }

  if (e->nsession_ids == 0)

    return 0; /* local use */

  /*

   * Walk through the hops recorded by session_id and try to find a

   * constraint that satisfies each.

   */

  for (i = 0; i < e->nsession_ids; i++) {

    hks = e->session_ids + i;

    if (hks->key == NULL)

      fatal_f("internal error: no bound key");

    /* XXX remove logspam */

    fp1 = fp2 = NULL;

    if (fromkey != NULL &&

        (fp1 = sshkey_fingerprint(fromkey, SSH_FP_HASH_DEFAULT,

        SSH_FP_DEFAULT)) == NULL)

      fatal_f("fingerprint failed");

    if ((fp2 = sshkey_fingerprint(hks->key, SSH_FP_HASH_DEFAULT,

        SSH_FP_DEFAULT)) == NULL)

      fatal_f("fingerprint failed");

    debug3_f("socketentry fd=%d, entry %zu %s, "

        "from hostkey %s %s to user %s hostkey %s %s",

        e->fd, i, hks->forwarded ? "FORWARD" : "AUTH",

        fromkey ? sshkey_type(fromkey) : "(ORIGIN)",

        fromkey ? fp1 : "", user ? user : "(ANY)",

        sshkey_type(hks->key), fp2);

    free(fp1);

    free(fp2);

    /*

     * Record the hostnames for the initial forwarding and

     * the final destination.

     */

    hp = NULL;

    if (i == e->nsession_ids - 1)

      hp = last_hostnamep;

    else if (i == 0)

      hp = forward_hostnamep;

    /* Special handling for final recorded binding */

    test_user = NULL;

    if (i == e->nsession_ids - 1) {

      /* Can only check user at final hop */

      test_user = user;

      /*

       * user is only presented for signature requests.

       * If this is the case, make sure last binding is not

       * for a forwarding.

       */

      if (hks->forwarded && user != NULL) {

        error_f("tried to sign on forwarding hop");

        return -1;

      }

    } else if (!hks->forwarded) {

      error_f("tried to forward though signing bind");

      return -1;

    }

    if (permitted_by_dest_constraints(fromkey, hks->key, id,

        test_user, hp) != 0)

      return -1;

    fromkey = hks->key;

  }

  /*

   * Another special case: if the last bound session ID was for a

   * forwarding, and this function is not being called to check a sign

   * request (i.e. no 'user' supplied), then only permit the key if

   * there is a permission that would allow it to be used at another

   * destination. This hides keys that are allowed to be used to

   * authenticate *to* a host but not permitted for *use* beyond it.

   */

  hks = &e->session_ids[e->nsession_ids - 1];

  if (hks->forwarded && user == NULL &&

      permitted_by_dest_constraints(hks->key, NULL, id,

      NULL, NULL) != 0) {

    debug3_f("key permitted at host but not after");

    return -1;

  }

  /* success */

  return 0;

}

static int

socket_is_remote(SocketEntry *e)

{

  return e->session_bind_attempted || (e->nsession_ids != 0);

}

/* return matching private key for given public key */

static Identity *

lookup_identity(struct sshkey *key)

{

  Identity *id;

  TAILQ_FOREACH(id, &idtab->idlist, next) {

    if (sshkey_equal(key, id->key))

      return (id);

  }

  return (NULL);

}

/* Check confirmation of keysign request */

static int

confirm_key(Identity *id, const char *extra)

{

  char *p;

  int ret = -1;

  p = sshkey_fingerprint(id->key, fingerprint_hash, SSH_FP_DEFAULT);

  if (p != NULL &&

      ask_permission("Allow use of key %s?\nKey fingerprint %s.%s%s",

      id->comment, p,

      extra == NULL ? "" : "\n", extra == NULL ? "" : extra))

    ret = 0;

  free(p);

  return (ret);

}

static void

send_status_generic(SocketEntry *e, u_int code)

{

  int r;

  if ((r = sshbuf_put_u32(e->output, 1)) != 0 ||

      (r = sshbuf_put_u8(e->output, code)) != 0)

    fatal_fr(r, "compose");

}

static void

send_status(SocketEntry *e, int success)

{

  return send_status_generic(e,

      success ? SSH_AGENT_SUCCESS : SSH_AGENT_FAILURE);

}

/* send list of supported public keys to 'client' */

static void

process_request_identities(SocketEntry *e)

{

  Identity *id;

  struct sshbuf *msg, *keys;

  int r;

  u_int i = 0, nentries = 0;

  char *fp;

  debug2_f("entering");

  if ((msg = sshbuf_new()) == NULL || (keys = sshbuf_new()) == NULL)

    fatal_f("sshbuf_new failed");

  TAILQ_FOREACH(id, &idtab->idlist, next) {

    if ((fp = sshkey_fingerprint(id->key, SSH_FP_HASH_DEFAULT,

        SSH_FP_DEFAULT)) == NULL)

      fatal_f("fingerprint failed");

    debug_f("key %u / %u: %s %s", i++, idtab->nentries,

        sshkey_ssh_name(id->key), fp);

    dump_dest_constraints(__func__,

        id->dest_constraints, id->ndest_constraints);

    free(fp);

    /* identity not visible, don't include in response */

    if (identity_permitted(id, e, NULL, NULL, NULL) != 0)

      continue;

    if ((r = sshkey_puts(id->key, keys)) != 0 ||

        (r = sshbuf_put_cstring(keys, id->comment)) != 0) {

      error_fr(r, "compose key/comment");

      continue;

    }

    nentries++;

  }

  debug2_f("replying with %u allowed of %u available keys",

      nentries, idtab->nentries);

  if ((r = sshbuf_put_u8(msg, SSH2_AGENT_IDENTITIES_ANSWER)) != 0 ||

      (r = sshbuf_put_u32(msg, nentries)) != 0 ||

      (r = sshbuf_putb(msg, keys)) != 0)

    fatal_fr(r, "compose");

  if ((r = sshbuf_put_stringb(e->output, msg)) != 0)

    fatal_fr(r, "enqueue");

  sshbuf_free(msg);

  sshbuf_free(keys);

}

static char *

agent_decode_alg(struct sshkey *key, u_int flags)

{

  if (key->type == KEY_RSA) {

    if (flags & SSH_AGENT_RSA_SHA2_256)

      return "rsa-sha2-256";

    else if (flags & SSH_AGENT_RSA_SHA2_512)

      return "rsa-sha2-512";

  } else if (key->type == KEY_RSA_CERT) {

    if (flags & SSH_AGENT_RSA_SHA2_256)

      return "rsa-sha2-256-cert-v01@openssh.com";

    else if (flags & SSH_AGENT_RSA_SHA2_512)

      return "rsa-sha2-512-cert-v01@openssh.com";

  }

  return NULL;

}

/*

 * Attempt to parse the contents of a buffer as a SSH publickey userauth

 * request, checking its contents for consistency and matching the embedded

 * key against the one that is being used for signing.

 * Note: does not modify msg buffer.

 * Optionally extract the username, session ID and/or hostkey from the request.

 */

static int

parse_userauth_request(struct sshbuf *msg, const struct sshkey *expected_key,

    char **userp, struct sshbuf **sess_idp, struct sshkey **hostkeyp)

{

  struct sshbuf *b = NULL, *sess_id = NULL;

  char *user = NULL, *service = NULL, *method = NULL, *pkalg = NULL;

  int r;

  u_char t, sig_follows;

  struct sshkey *mkey = NULL, *hostkey = NULL;

  if (userp != NULL)

    *userp = NULL;

  if (sess_idp != NULL)

    *sess_idp = NULL;

  if (hostkeyp != NULL)

    *hostkeyp = NULL;

  if ((b = sshbuf_fromb(msg)) == NULL)

    fatal_f("sshbuf_fromb");

  /* SSH userauth request */

  if ((r = sshbuf_froms(b, &sess_id)) != 0)

    goto out;

  if (sshbuf_len(sess_id) == 0) {

    r = SSH_ERR_INVALID_FORMAT;

    goto out;

  }

  if ((r = sshbuf_get_u8(b, &t)) != 0 || /* SSH2_MSG_USERAUTH_REQUEST */

      (r = sshbuf_get_cstring(b, &user, NULL)) != 0 || /* server user */

      (r = sshbuf_get_cstring(b, &service, NULL)) != 0 || /* service */

      (r = sshbuf_get_cstring(b, &method, NULL)) != 0 || /* method */

      (r = sshbuf_get_u8(b, &sig_follows)) != 0 || /* sig-follows */

      (r = sshbuf_get_cstring(b, &pkalg, NULL)) != 0 || /* alg */

      (r = sshkey_froms(b, &mkey)) != 0) /* key */

    goto out;

  if (t != SSH2_MSG_USERAUTH_REQUEST ||

      sig_follows != 1 ||

      strcmp(service, "ssh-connection") != 0 ||

      !sshkey_equal(expected_key, mkey) ||

      sshkey_type_from_name(pkalg) != expected_key->type) {

    r = SSH_ERR_INVALID_FORMAT;

    goto out;

  }

  if (strcmp(method, "publickey-hostbound-v00@openssh.com") == 0) {

    if ((r = sshkey_froms(b, &hostkey)) != 0)

      goto out;

  } else if (strcmp(method, "publickey") != 0) {

    r = SSH_ERR_INVALID_FORMAT;

    goto out;

  }

  if (sshbuf_len(b) != 0) {

    r = SSH_ERR_INVALID_FORMAT;

    goto out;

  }

  /* success */

  r = 0;

  debug3_f("well formed userauth");

  if (userp != NULL) {

    *userp = user;

    user = NULL;

  }

  if (sess_idp != NULL) {

    *sess_idp = sess_id;

    sess_id = NULL;

  }

  if (hostkeyp != NULL) {

    *hostkeyp = hostkey;

    hostkey = NULL;

  }

 out:

  sshbuf_free(b);

  sshbuf_free(sess_id);

  free(user);

  free(service);

  free(method);

  free(pkalg);

  sshkey_free(mkey);

  sshkey_free(hostkey);

  return r;

}

/*

 * Attempt to parse the contents of a buffer as a SSHSIG signature request.

 * Note: does not modify buffer.

 */

static int

parse_sshsig_request(struct sshbuf *msg)

{

  int r;

  struct sshbuf *b;

  if ((b = sshbuf_fromb(msg)) == NULL)

    fatal_f("sshbuf_fromb");

  if ((r = sshbuf_cmp(b, 0, "SSHSIG", 6)) != 0 ||

      (r = sshbuf_consume(b, 6)) != 0 ||

      (r = sshbuf_get_cstring(b, NULL, NULL)) != 0 || /* namespace */

      (r = sshbuf_get_string_direct(b, NULL, NULL)) != 0 || /* reserved */

      (r = sshbuf_get_cstring(b, NULL, NULL)) != 0 || /* hashalg */

      (r = sshbuf_get_string_direct(b, NULL, NULL)) != 0) /* H(msg) */

    goto out;

  if (sshbuf_len(b) != 0) {

    r = SSH_ERR_INVALID_FORMAT;

    goto out;

  }

  /* success */

  r = 0;

 out:

  sshbuf_free(b);

  return r;

}

/*

 * This function inspects a message to be signed by a FIDO key that has a

 * web-like application string (i.e. one that does not begin with "ssh:".

 * It checks that the message is one of those expected for SSH operations

 * (pubkey userauth, sshsig, CA key signing) to exclude signing challenges

 * for the web.

 */

static int

check_websafe_message_contents(struct sshkey *key, struct sshbuf *data)

{

  if (parse_userauth_request(data, key, NULL, NULL, NULL) == 0) {

    debug_f("signed data matches public key userauth request");

    return 1;

  }

  if (parse_sshsig_request(data) == 0) {

    debug_f("signed data matches SSHSIG signature request");

    return 1;

  }

  /* XXX check CA signature operation */

  error("web-origin key attempting to sign non-SSH message");

  return 0;

}

static int

buf_equal(const struct sshbuf *a, const struct sshbuf *b)

{

  if (sshbuf_ptr(a) == NULL || sshbuf_ptr(b) == NULL)

    return SSH_ERR_INVALID_ARGUMENT;

  if (sshbuf_len(a) != sshbuf_len(b))

    return SSH_ERR_INVALID_FORMAT;

  if (timingsafe_bcmp(sshbuf_ptr(a), sshbuf_ptr(b), sshbuf_len(a)) != 0)

    return SSH_ERR_INVALID_FORMAT;

  return 0;

}

/* ssh2 only */

static void

process_sign_request2(SocketEntry *e)

{

  u_char *signature = NULL;

  size_t slen = 0;

  u_int compat = 0, flags;

  int r, ok = -1, retried = 0;

  char *fp = NULL, *pin = NULL, *prompt = NULL;

  char *user = NULL, *sig_dest = NULL;

  const char *fwd_host = NULL, *dest_host = NULL;

  struct sshbuf *msg = NULL, *data = NULL, *sid = NULL;

  struct sshkey *key = NULL, *hostkey = NULL;

  struct identity *id;

  struct notifier_ctx *notifier = NULL;

  debug_f("entering");

  if ((msg = sshbuf_new()) == NULL || (data = sshbuf_new()) == NULL)

    fatal_f("sshbuf_new failed");

  if ((r = sshkey_froms(e->request, &key)) != 0 ||

      (r = sshbuf_get_stringb(e->request, data)) != 0 ||

      (r = sshbuf_get_u32(e->request, &flags)) != 0) {

    error_fr(r, "parse");

    goto send;

  }

  if ((id = lookup_identity(key)) == NULL) {

    verbose_f("%s key not found", sshkey_type(key));

    goto send;

  }

  if ((fp = sshkey_fingerprint(key, SSH_FP_HASH_DEFAULT,

      SSH_FP_DEFAULT)) == NULL)

    fatal_f("fingerprint failed");

  if (id->ndest_constraints != 0) {

    if (e->nsession_ids == 0) {

      logit_f("refusing use of destination-constrained key "

          "to sign on unbound connection");

      goto send;

    }

    if (parse_userauth_request(data, key, &user, &sid,

        &hostkey) != 0) {

      logit_f("refusing use of destination-constrained key "

         "to sign an unidentified signature");

      goto send;

    }

    /* XXX logspam */

    debug_f("user=%s", user);

    if (identity_permitted(id, e, user, &fwd_host, &dest_host) != 0)

      goto send;

    /* XXX display fwd_host/dest_host in askpass UI */

    /*

     * Ensure that the session ID is the most recent one

     * registered on the socket - it should have been bound by

     * ssh immediately before userauth.

     */

    if (buf_equal(sid,

        e->session_ids[e->nsession_ids - 1].sid) != 0) {

      error_f("unexpected session ID (%zu listed) on "

          "signature request for target user %s with "

          "key %s %s", e->nsession_ids, user,

          sshkey_type(id->key), fp);

      goto send;

    }

    /*

     * Ensure that the hostkey embedded in the signature matches

     * the one most recently bound to the socket. An exception is

     * made for the initial forwarding hop.

     */

    if (e->nsession_ids > 1 && hostkey == NULL) {

      error_f("refusing use of destination-constrained key: "

          "no hostkey recorded in signature for forwarded "

          "connection");

      goto send;

    }

    if (hostkey != NULL && !sshkey_equal(hostkey,

        e->session_ids[e->nsession_ids - 1].key)) {

      error_f("refusing use of destination-constrained key: "

          "mismatch between hostkey in request and most "

          "recently bound session");

      goto send;

    }

    xasprintf(&sig_dest, "public key authentication request for "

        "user \"%s\" to listed host", user);

  }

  if (id->confirm && confirm_key(id, sig_dest) != 0) {

    verbose_f("user refused key");