ssh_auth.h File Reference

SSH user-authentication layer (RFC 4252). More...

#include "ServerConfig.h"
#include <stddef.h>
#include <stdint.h>

Go to the source code of this file.

Classes
struct	SshAuthReq
	Parsed SSH_MSG_USERAUTH_REQUEST. More...

Typedefs
typedef bool(*	SshPasswordCb) (const char *user, const char *password)
	Application callback that validates a username/password pair.
typedef bool(*	SshPubkeyCb) (const char *user, const uint8_t *blob, size_t blob_len)
	Application callback that decides whether a public key is authorized for user. blob is the "ssh-rsa" public-key blob.

Functions
void	ssh_auth_set_password_cb (SshPasswordCb cb)
	Install the password-verification callback (nullptr → all fail).
void	ssh_auth_set_pubkey_cb (SshPubkeyCb cb)
	Install the publickey-authorization callback (nullptr → all fail).
int	ssh_auth_handle_service_request (const uint8_t *payload, size_t len, uint8_t *out, size_t *out_len, size_t cap)
	Handle SSH_MSG_SERVICE_REQUEST; emit SERVICE_ACCEPT for ssh-userauth.
int	ssh_auth_parse_request (const uint8_t *payload, size_t len, SshAuthReq *req)
	Parse an SSH_MSG_USERAUTH_REQUEST into req.
int	ssh_auth_build_failure (uint8_t *out, size_t *out_len, size_t cap, bool partial)
	Build SSH_MSG_USERAUTH_FAILURE advertising "password".
int	ssh_auth_build_success (uint8_t *out, size_t *out_len, size_t cap)
	Build SSH_MSG_USERAUTH_SUCCESS.
int	ssh_auth_handle_request (uint8_t i, const uint8_t *payload, size_t len, uint8_t *out, size_t *out_len, size_t cap)
	Handle a USERAUTH_REQUEST end-to-end for slot i.

Detailed Description

SSH user-authentication layer (RFC 4252).

After NEWKEYS the client requests the "ssh-userauth" service; the server accepts it and then drives SSH_MSG_USERAUTH_REQUEST exchanges until a method succeeds (SSH_MSG_USERAUTH_SUCCESS) or the connection is dropped.

This implementation supports the "password" method (RFC 4252 §8): the password travels inside the encrypted transport and is checked against an application-supplied callback. The "none" method is always answered with a failure that advertises "password" (RFC 4252 §5.2), which is how a client discovers the supported methods.

Author

Douglas Quigg (dstroy0)

Date

2026

Definition in file ssh_auth.h.

Typedef Documentation

SshPasswordCb

typedef bool(* SshPasswordCb) (const char *user, const char *password)

Application callback that validates a username/password pair.

Returns

true to accept the credentials.

Definition at line 54 of file ssh_auth.h.

SshPubkeyCb

typedef bool(* SshPubkeyCb) (const char *user, const uint8_t *blob, size_t blob_len)

Application callback that decides whether a public key is authorized for user. blob is the "ssh-rsa" public-key blob.

Returns

true if the key may authenticate this user.

Definition at line 64 of file ssh_auth.h.

Function Documentation

ssh_auth_set_password_cb()

void ssh_auth_set_password_cb

(

SshPasswordCb

cb

)

Install the password-verification callback (nullptr → all fail).

Definition at line 30 of file ssh_auth.cpp.

References SshAuthCtx::pw_cb.

ssh_auth_set_pubkey_cb()

void ssh_auth_set_pubkey_cb

(

SshPubkeyCb

cb

)

Install the publickey-authorization callback (nullptr → all fail).

Definition at line 35 of file ssh_auth.cpp.

References SshAuthCtx::pk_cb.

ssh_auth_handle_service_request()

int ssh_auth_handle_service_request	(	const uint8_t *	payload,
		size_t	len,
		uint8_t *	out,
		size_t *	out_len,
		size_t	cap
	)

Handle SSH_MSG_SERVICE_REQUEST; emit SERVICE_ACCEPT for ssh-userauth.

Returns

0 and writes SERVICE_ACCEPT to out, or -1 if the service is not "ssh-userauth" or the message is malformed.

Definition at line 194 of file ssh_auth.cpp.

References SSH_MSG_SERVICE_ACCEPT, and SSH_MSG_SERVICE_REQUEST.

Referenced by ssh_server_dispatch().

ssh_auth_parse_request()

int ssh_auth_parse_request	(	const uint8_t *	payload,
		size_t	len,
		SshAuthReq *	req
	)

Parse an SSH_MSG_USERAUTH_REQUEST into req.

Returns

0 on success, -1 if malformed.

Definition at line 222 of file ssh_auth.cpp.

References SshAuthReq::has_signature, SshAuthReq::is_password, SshAuthReq::is_pubkey, SshAuthReq::method, SshAuthReq::password, SshAuthReq::pk_algo, SshAuthReq::pk_blob, SshAuthReq::pk_blob_len, SshAuthReq::service, SshAuthReq::signature, SshAuthReq::signature_len, SshAuthReq::signed_prefix, SshAuthReq::signed_prefix_len, SSH_MSG_USERAUTH_REQUEST, and SshAuthReq::user.

Referenced by ssh_auth_handle_request().

ssh_auth_build_failure()

int ssh_auth_build_failure	(	uint8_t *	out,
		size_t *	out_len,
		size_t	cap,
		bool	partial
	)

Build SSH_MSG_USERAUTH_FAILURE advertising "password".

Definition at line 285 of file ssh_auth.cpp.

References SSH_MSG_USERAUTH_FAILURE.

Referenced by ssh_auth_handle_request().

ssh_auth_build_success()

int ssh_auth_build_success	(	uint8_t *	out,
		size_t *	out_len,
		size_t	cap
	)

Build SSH_MSG_USERAUTH_SUCCESS.

Definition at line 304 of file ssh_auth.cpp.

References SSH_MSG_USERAUTH_SUCCESS.

Referenced by ssh_auth_handle_request().

ssh_auth_handle_request()

int ssh_auth_handle_request	(	uint8_t	i,
		const uint8_t *	payload,
		size_t	len,
		uint8_t *	out,
		size_t *	out_len,
		size_t	cap
	)

Handle a USERAUTH_REQUEST end-to-end for slot i.

Parses the request, checks "password" credentials via the installed callback, and writes either USERAUTH_SUCCESS or USERAUTH_FAILURE to out. On success the session is marked authenticated and advanced to the connection phase.

Returns

0 if a response was produced (check the message type), -1 on parse error.

Definition at line 408 of file ssh_auth.cpp.

References SshSession::authed, SshAuthReq::is_password, SshAuthReq::is_pubkey, MAX_SSH_CONNS, SshAuthReq::password, SshSession::phase, SshAuthCtx::pw_cb, ssh_auth_build_failure(), ssh_auth_build_success(), ssh_auth_parse_request(), SSH_PHASE_OPEN, ssh_sess, and SshAuthReq::user.

Referenced by ssh_server_dispatch().