Home | History | Annotate | Line # | Download | only in dist
auth2-chall.c revision 1.5 
      1 /*	$NetBSD: auth2-chall.c,v 1.5 2013/11/08 19:18:24 christos Exp $	*/
      2 /* $OpenBSD: auth2-chall.c,v 1.38.2.1 2013/11/08 01:33:56 djm Exp $ */
      3 /*
      4  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
      5  * Copyright (c) 2001 Per Allansson.  All rights reserved.
      6  *
      7  * Redistribution and use in source and binary forms, with or without
      8  * modification, are permitted provided that the following conditions
      9  * are met:
     10  * 1. Redistributions of source code must retain the above copyright
     11  *    notice, this list of conditions and the following disclaimer.
     12  * 2. Redistributions in binary form must reproduce the above copyright
     13  *    notice, this list of conditions and the following disclaimer in the
     14  *    documentation and/or other materials provided with the distribution.
     15  *
     16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
     17  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     18  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     19  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
     20  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
     21  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
     22  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
     23  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     24  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
     25  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     26  */
     27 
     28 #include "includes.h"
     29 __RCSID("$NetBSD: auth2-chall.c,v 1.5 2013/11/08 19:18:24 christos Exp $");
     30 #include <sys/types.h>
     31 
     32 #include <stdio.h>
     33 #include <string.h>
     34 
     35 #include "xmalloc.h"
     36 #include "ssh2.h"
     37 #include "key.h"
     38 #include "hostfile.h"
     39 #include "auth.h"
     40 #include "buffer.h"
     41 #include "packet.h"
     42 #include "dispatch.h"
     43 #include "log.h"
     44 #include "servconf.h"
     45 
     46 /* import */
     47 extern ServerOptions options;
     48 
     49 static int auth2_challenge_start(Authctxt *);
     50 static int send_userauth_info_request(Authctxt *);
     51 static void input_userauth_info_response(int, u_int32_t, void *);
     52 
     53 #ifdef BSD_AUTH
     54 extern KbdintDevice bsdauth_device;
     55 #else
     56 #ifdef USE_PAM
     57 extern KbdintDevice sshpam_device;
     58 #endif
     59 #ifdef SKEY
     60 extern KbdintDevice skey_device;
     61 #endif
     62 #endif
     63 
     64 KbdintDevice *devices[] = {
     65 #ifdef BSD_AUTH
     66 	&bsdauth_device,
     67 #else
     68 #ifdef USE_PAM
     69 	&sshpam_device,
     70 #endif
     71 #ifdef SKEY
     72 	&skey_device,
     73 #endif
     74 #endif
     75 	NULL
     76 };
     77 
     78 typedef struct KbdintAuthctxt KbdintAuthctxt;
     79 struct KbdintAuthctxt
     80 {
     81 	char *devices;
     82 	void *ctxt;
     83 	KbdintDevice *device;
     84 	u_int nreq;
     85 };
     86 
     87 #ifdef USE_PAM
     88 void remove_kbdint_device(const char *);
     89 void
     90 remove_kbdint_device(const char *xdevname)
     91 {
     92 	int i, j;
     93 
     94 	for (i = 0; devices[i] != NULL; i++)
     95 		if (strcmp(devices[i]->name, xdevname) == 0) {
     96 			for (j = i; devices[j] != NULL; j++)
     97 				devices[j] = devices[j+1];
     98 			i--;
     99 		}
    100 }
    101 #endif
    102 
    103 static KbdintAuthctxt *
    104 kbdint_alloc(const char *devs)
    105 {
    106 	KbdintAuthctxt *kbdintctxt;
    107 	Buffer b;
    108 	int i;
    109 
    110 #ifdef USE_PAM
    111 	if (!options.use_pam)
    112 		remove_kbdint_device("pam");
    113 #endif
    114 
    115 	kbdintctxt = xcalloc(1, sizeof(KbdintAuthctxt));
    116 	if (strcmp(devs, "") == 0) {
    117 		buffer_init(&b);
    118 		for (i = 0; devices[i]; i++) {
    119 			if (buffer_len(&b) > 0)
    120 				buffer_append(&b, ",", 1);
    121 			buffer_append(&b, devices[i]->name,
    122 			    strlen(devices[i]->name));
    123 		}
    124 		buffer_append(&b, "\0", 1);
    125 		kbdintctxt->devices = xstrdup(buffer_ptr(&b));
    126 		buffer_free(&b);
    127 	} else {
    128 		kbdintctxt->devices = xstrdup(devs);
    129 	}
    130 	debug("kbdint_alloc: devices '%s'", kbdintctxt->devices);
    131 	kbdintctxt->ctxt = NULL;
    132 	kbdintctxt->device = NULL;
    133 	kbdintctxt->nreq = 0;
    134 
    135 	return kbdintctxt;
    136 }
    137 static void
    138 kbdint_reset_device(KbdintAuthctxt *kbdintctxt)
    139 {
    140 	if (kbdintctxt->ctxt) {
    141 		kbdintctxt->device->free_ctx(kbdintctxt->ctxt);
    142 		kbdintctxt->ctxt = NULL;
    143 	}
    144 	kbdintctxt->device = NULL;
    145 }
    146 static void
    147 kbdint_free(KbdintAuthctxt *kbdintctxt)
    148 {
    149 	if (kbdintctxt->device)
    150 		kbdint_reset_device(kbdintctxt);
    151 	free(kbdintctxt->devices);
    152 	bzero(kbdintctxt, sizeof(*kbdintctxt));
    153 	free(kbdintctxt);
    154 }
    155 /* get next device */
    156 static int
    157 kbdint_next_device(Authctxt *authctxt, KbdintAuthctxt *kbdintctxt)
    158 {
    159 	size_t len;
    160 	char *t;
    161 	int i;
    162 
    163 	if (kbdintctxt->device)
    164 		kbdint_reset_device(kbdintctxt);
    165 	do {
    166 		len = kbdintctxt->devices ?
    167 		    strcspn(kbdintctxt->devices, ",") : 0;
    168 
    169 		if (len == 0)
    170 			break;
    171 		for (i = 0; devices[i]; i++) {
    172 			if (!auth2_method_allowed(authctxt,
    173 			    "keyboard-interactive", devices[i]->name))
    174 				continue;
    175 			if (strncmp(kbdintctxt->devices, devices[i]->name, len) == 0)
    176 				kbdintctxt->device = devices[i];
    177 		}
    178 		t = kbdintctxt->devices;
    179 		kbdintctxt->devices = t[len] ? xstrdup(t+len+1) : NULL;
    180 		free(t);
    181 		debug2("kbdint_next_device: devices %s", kbdintctxt->devices ?
    182 		    kbdintctxt->devices : "<empty>");
    183 	} while (kbdintctxt->devices && !kbdintctxt->device);
    184 
    185 	return kbdintctxt->device ? 1 : 0;
    186 }
    187 
    188 /*
    189  * try challenge-response, set authctxt->postponed if we have to
    190  * wait for the response.
    191  */
    192 int
    193 auth2_challenge(Authctxt *authctxt, char *devs)
    194 {
    195 	debug("auth2_challenge: user=%s devs=%s",
    196 	    authctxt->user ? authctxt->user : "<nouser>",
    197 	    devs ? devs : "<no devs>");
    198 
    199 	if (authctxt->user == NULL || !devs)
    200 		return 0;
    201 	if (authctxt->kbdintctxt == NULL)
    202 		authctxt->kbdintctxt = kbdint_alloc(devs);
    203 	return auth2_challenge_start(authctxt);
    204 }
    205 
    206 /* unregister kbd-int callbacks and context */
    207 void
    208 auth2_challenge_stop(Authctxt *authctxt)
    209 {
    210 	/* unregister callback */
    211 	dispatch_set(SSH2_MSG_USERAUTH_INFO_RESPONSE, NULL);
    212 	if (authctxt->kbdintctxt != NULL) {
    213 		kbdint_free(authctxt->kbdintctxt);
    214 		authctxt->kbdintctxt = NULL;
    215 	}
    216 }
    217 
    218 /* side effect: sets authctxt->postponed if a reply was sent*/
    219 static int
    220 auth2_challenge_start(Authctxt *authctxt)
    221 {
    222 	KbdintAuthctxt *kbdintctxt = authctxt->kbdintctxt;
    223 
    224 	debug2("auth2_challenge_start: devices %s",
    225 	    kbdintctxt->devices ?  kbdintctxt->devices : "<empty>");
    226 
    227 	if (kbdint_next_device(authctxt, kbdintctxt) == 0) {
    228 		auth2_challenge_stop(authctxt);
    229 		return 0;
    230 	}
    231 	debug("auth2_challenge_start: trying authentication method '%s'",
    232 	    kbdintctxt->device->name);
    233 
    234 	if ((kbdintctxt->ctxt = kbdintctxt->device->init_ctx(authctxt)) == NULL) {
    235 		auth2_challenge_stop(authctxt);
    236 		return 0;
    237 	}
    238 	if (send_userauth_info_request(authctxt) == 0) {
    239 		auth2_challenge_stop(authctxt);
    240 		return 0;
    241 	}
    242 	dispatch_set(SSH2_MSG_USERAUTH_INFO_RESPONSE,
    243 	    &input_userauth_info_response);
    244 
    245 	authctxt->postponed = 1;
    246 	return 0;
    247 }
    248 
    249 static int
    250 send_userauth_info_request(Authctxt *authctxt)
    251 {
    252 	KbdintAuthctxt *kbdintctxt;
    253 	char *name, *instr, **prompts;
    254 	u_int i, *echo_on;
    255 
    256 	kbdintctxt = authctxt->kbdintctxt;
    257 	if (kbdintctxt->device->query(kbdintctxt->ctxt,
    258 	    &name, &instr, &kbdintctxt->nreq, &prompts, &echo_on))
    259 		return 0;
    260 
    261 	packet_start(SSH2_MSG_USERAUTH_INFO_REQUEST);
    262 	packet_put_cstring(name);
    263 	packet_put_cstring(instr);
    264 	packet_put_cstring("");		/* language not used */
    265 	packet_put_int(kbdintctxt->nreq);
    266 	for (i = 0; i < kbdintctxt->nreq; i++) {
    267 		packet_put_cstring(prompts[i]);
    268 		packet_put_char(echo_on[i]);
    269 	}
    270 	packet_send();
    271 	packet_write_wait();
    272 
    273 	for (i = 0; i < kbdintctxt->nreq; i++)
    274 		free(prompts[i]);
    275 	free(prompts);
    276 	free(echo_on);
    277 	free(name);
    278 	free(instr);
    279 	return 1;
    280 }
    281 
    282 static void
    283 input_userauth_info_response(int type, u_int32_t seq, void *ctxt)
    284 {
    285 	Authctxt *authctxt = ctxt;
    286 	KbdintAuthctxt *kbdintctxt;
    287 	int authenticated = 0, res;
    288 	u_int i, nresp;
    289 	const char *devicename = NULL;
    290 	char **response = NULL;
    291 
    292 	if (authctxt == NULL)
    293 		fatal("input_userauth_info_response: no authctxt");
    294 	kbdintctxt = authctxt->kbdintctxt;
    295 	if (kbdintctxt == NULL || kbdintctxt->ctxt == NULL)
    296 		fatal("input_userauth_info_response: no kbdintctxt");
    297 	if (kbdintctxt->device == NULL)
    298 		fatal("input_userauth_info_response: no device");
    299 
    300 	authctxt->postponed = 0;	/* reset */
    301 	nresp = packet_get_int();
    302 	if (nresp != kbdintctxt->nreq)
    303 		fatal("input_userauth_info_response: wrong number of replies");
    304 	if (nresp > 100)
    305 		fatal("input_userauth_info_response: too many replies");
    306 	if (nresp > 0) {
    307 		response = xcalloc(nresp, sizeof(char *));
    308 		for (i = 0; i < nresp; i++)
    309 			response[i] = packet_get_string(NULL);
    310 	}
    311 	packet_check_eom();
    312 
    313 	res = kbdintctxt->device->respond(kbdintctxt->ctxt, nresp, response);
    314 
    315 	for (i = 0; i < nresp; i++) {
    316 		memset(response[i], 'r', strlen(response[i]));
    317 		free(response[i]);
    318 	}
    319 	free(response);
    320 
    321 	switch (res) {
    322 	case 0:
    323 		/* Success! */
    324 		authenticated = authctxt->valid ? 1 : 0;
    325 		break;
    326 	case 1:
    327 		/* Authentication needs further interaction */
    328 		if (send_userauth_info_request(authctxt) == 1)
    329 			authctxt->postponed = 1;
    330 		break;
    331 	default:
    332 		/* Failure! */
    333 		break;
    334 	}
    335 	devicename = kbdintctxt->device->name;
    336 	if (!authctxt->postponed) {
    337 		if (authenticated) {
    338 			auth2_challenge_stop(authctxt);
    339 		} else {
    340 			/* start next device */
    341 			/* may set authctxt->postponed */
    342 			auth2_challenge_start(authctxt);
    343 		}
    344 	}
    345 	userauth_finish(authctxt, authenticated, "keyboard-interactive",
    346 	    devicename);
    347 }
    348 
    349 void
    350 privsep_challenge_enable(void)
    351 {
    352 #if defined(BSD_AUTH) || defined(USE_PAM) || defined(SKEY)
    353 	int n = 0;
    354 #endif
    355 #ifdef BSD_AUTH
    356 	extern KbdintDevice mm_bsdauth_device;
    357 #endif
    358 #ifdef USE_PAM
    359 	extern KbdintDevice mm_sshpam_device;
    360 #endif
    361 #ifdef SKEY
    362 	extern KbdintDevice mm_skey_device;
    363 #endif
    364 	/* As long as SSHv1 has devices[0] hard coded this is fine */
    365 #ifdef BSD_AUTH
    366 	devices[n++] = &mm_bsdauth_device;
    367 #endif
    368 #ifdef USE_PAM
    369 	devices[n++] = &mm_sshpam_device;
    370 #endif
    371 #ifdef SKEY
    372 	devices[n++] = &mm_skey_device;
    373 #endif
    374 }
    375