mirror of https://github.com/libssh2/libssh2.git synced 2026-10-24 03:48:58 +03:00

Files

Viktor Szakats 59329f3402 libssh2_userauth_keyboard_interactive_ex.md: fix allocator requirement

Prior to this patch, the documentation stated that the `.text` buffers
filled by the API caller are "free(3)d" by libssh2, referring to the
default system deallocator. In reality however, libssh2 was using
`SSH2_FREE*()` to free these buffers, respecting custom allocators, if
set by the user via `libssh2_session_init_ex()`.

libssh2 behaved this way since the initial implementation committed in
da653774aa 2005-06-11, v0.11

Later, examples were added that use `strdup()` to allocate, which was
(and is) accurate because they do not use a custom allocator:
9a1ce06e31 2007-07-22

Then, when the documentation landed, it incorrectly documented
`free(3)`, perhaps basing it on the examples added earlier:
d4aa801f6f 2008-03-08

I assume that callers overriding the custom allocators are more likely
to have fixed their code to adhere with how libssh2 actually behaved,
rather than believing the documentation and live with an allocator
mismatch for all these years.

Therefore I think this is a documentation error, and this patch
addresses this.

Reported-by: Makise Kurisu
Fixes GHSA-p6p8-66vc-3f24
Reverts ce631aafe1 #2659
Follow-up to d4aa801f6f
Follow-up to da653774aa

Closes #2661

2026-10-07 15:35:05 +02:00

2.3 KiB

Raw Permalink Blame History

c, SPDX-License-Identifier, Title, Section, Source, See-also

SPDX-License-Identifier

Title

Section

Source

See-also

BSD-3-Clause

libssh2_userauth_keyboard_interactive_ex

libssh2

libssh2_session_init_ex(3)

NAME

libssh2_userauth_keyboard_interactive_ex - authenticate a session using keyboard-interactive authentication

SYNOPSIS

#include <libssh2.h>

int libssh2_userauth_keyboard_interactive_ex(
    LIBSSH2_SESSION *session,
    const char *username,
    unsigned int username_len,
    LIBSSH2_USERAUTH_KBDINT_RESPONSE_FUNC(*response_callback));

DESCRIPTION

session - Session instance as returned by libssh2_session_init_ex(3).

username - Name of user to attempt keyboard-interactive authentication for.

username_len - Length of username parameter.

response_callback - As authentication proceeds, the host issues several (1 or more) challenges and requires responses. This callback is called at this moment. The callback is responsible to obtain responses for the challenges, fill the provided data structure and then return control. Use the custom LIBSSH2_ALLOC_FUNC (or, if not set, the default system allocator) to allocate memory for the text field. Responses are sent to the host. The callback prototype must match this:

void response(const char *name,
              int name_len, const char *instruction,
              int instruction_len,
              int num_prompts,
              const LIBSSH2_USERAUTH_KBDINT_PROMPT *prompts,
              LIBSSH2_USERAUTH_KBDINT_RESPONSE *responses,
              void **abstract);

Attempts keyboard-interactive (challenge/response) authentication.

Note that many SSH servers always issue a single "password" challenge, requesting actual password as response, but it is not required by the protocol, and various authentication schemes, such as smartcard authentication may use keyboard-interactive authentication type too.

RETURN VALUE

Return 0 on success or negative on failure. It returns LIBSSH2_ERROR_EAGAIN when it would otherwise block. While LIBSSH2_ERROR_EAGAIN is a negative number, it is not really a failure per se.

ERRORS

LIBSSH2_ERROR_ALLOC - An internal memory allocation call failed.

LIBSSH2_ERROR_SOCKET_SEND - Unable to send data on socket.

LIBSSH2_ERROR_AUTHENTICATION_FAILED - failed, invalid username/password or public/private key.

2.3 KiB Raw Permalink Blame History