Checking remote authorized_keys without entering key passphrase, done more neatly — and against .ssh/config

Enter passphrase for key '/path/to/key': 

Permission denied (publickey).

debug1: Authentications that can continue: publickey,password,keyboard-interactive
debug1: Next authentication method: publickey
debug1: Will attempt key: /path/to/key ED25519 SHA256:... explicit
debug1: Offering public key: /path/to/key ED25519 SHA256:... explicit
debug1: Server accepts key: /path/to/key ED25519 SHA256:... explicit
Enter passphrase for key '/path/to/key': 

// LGPL (c) 2024-02-27 Mika Feiler <m@mikf.pl>
// BUILD: cc -lssh

/*
      This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU Lesser General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.

    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    GNU Lesser General Public License for more details.

    You should have received a copy of the GNU Lesser General Public License
    along with this program.  If not, see <http://www.gnu.org/licenses/>
*/

#include <libssh/libssh.h>
#include <libssh/callbacks.h>
#include <stdlib.h>
#include <stdio.h>
#include <unistd.h>

ssh_session s;

int leave = -1;

int callback(const char *_prompt, char *_buf, size_t _len,
         int _echo, int _verify, void* _) {
  int rc;
  char *value[500];
  rc = ssh_userauth_publickey_auto_get_current_identity(s, value);
  // Thanks, Cockpit Project!
  printf("%s\n", *value);
  leave = 0;
}

int usage(char* a0) {
    printf("Usage: %s hostname [port [keypath|'' [keyuser [disregardunknownhost]]]]\n\n%s\n%s\n%s\n\n%s\n",
       a0,
       "This little program uses ssh_userauth_publickey_auto_get_current_identity,",
       "thanks to Cockpit, to offer keys (per config) to host and print out path",
       "of one that gets accepted by the host, even if it has a passphrase.",
       "This program is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.");
    return 0;
}

void handle_host_verification(int pass_unknown) {
  enum ssh_known_hosts_e state = ssh_session_is_known_server(s);
  switch(state) {
  case SSH_KNOWN_HOSTS_UNKNOWN: if(pass_unknown) exit(5);
  case SSH_KNOWN_HOSTS_OK: break;
  default:
    exit(3);
  }
}

int main(int argc, char* argv[]) {
  if(argc < 2)
    return usage(argv[0]);

  s = ssh_new();
  if (s == NULL)
    exit(-1);

  int verbosity = SSH_LOG_WARNING;
  ssh_options_set(s, SSH_OPTIONS_LOG_VERBOSITY, &verbosity);

  ssh_options_set(s, SSH_OPTIONS_HOST, argv[1]);
  ssh_options_set(s, SSH_OPTIONS_PORT_STR, argc > 2 ? argv[2] : "22");

  int rc;
  rc = ssh_connect(s);
  if (rc != SSH_OK)
    exit(rc);

  handle_host_verification(argc < 6); // will allow unknown host with one more arg

  struct ssh_callbacks_struct callbacks = {
    .auth_function = callback
  };
  // As per test example for ssh_userauth_publickey_auto_get_current_identity !

  ssh_set_blocking(s, 1);

  // "User SHOULD be NULL" lol
  char* user = argc > 4 && strlen(argv[4]) > 0 ? argv[4] : NULL;

  if (argc > 3 && strlen(argv[3]) > 0) { // if key path specified
    ssh_key key = ssh_key_new();
    rc = ssh_pki_import_pubkey_file(argv[3], &key);
    if (rc != SSH_OK)
      exit(rc);
    rc = ssh_userauth_try_publickey(s, user, key);
    leave = rc;
  } else { // the cool behavior doing .ssh/config :3
    ssh_callbacks_init(&callbacks);
    ssh_set_callbacks(s, &callbacks);

    rc = ssh_userauth_publickey_auto(s, user, NULL);
  }
  leave = leave == -1 ? rc : leave;

  ssh_disconnect(s); ssh_free(s);
  exit(leave);
}