Home | History | Annotate | Line # | Download | only in dist
auth2-chall.c revision 1.8 
      1 /*	$NetBSD: auth2-chall.c,v 1.8 2015/07/29 15:04:40 christos Exp $	*/
      2 /* $OpenBSD: auth2-chall.c,v 1.42 2015/01/19 20:07:45 markus Exp $ */
      3 /*
      4  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
      5  * Copyright (c) 2001 Per Allansson.  All rights reserved.
      6  *
      7  * Redistribution and use in source and binary forms, with or without
      8  * modification, are permitted provided that the following conditions
      9  * are met:
     10  * 1. Redistributions of source code must retain the above copyright
     11  *    notice, this list of conditions and the following disclaimer.
     12  * 2. Redistributions in binary form must reproduce the above copyright
     13  *    notice, this list of conditions and the following disclaimer in the
     14  *    documentation and/or other materials provided with the distribution.
     15  *
     16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
     17  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
     18  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
     19  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
     20  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
     21  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
     22  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
     23  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
     24  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
     25  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     26  */
     27 
     28 #include "includes.h"
     29 __RCSID("$NetBSD: auth2-chall.c,v 1.8 2015/07/29 15:04:40 christos Exp $");
     30 #include <sys/types.h>
     31 
     32 #include <stdio.h>
     33 #include <string.h>
     34 
     35 #include "xmalloc.h"
     36 #include "ssh2.h"
     37 #include "key.h"
     38 #include "hostfile.h"
     39 #include "auth.h"
     40 #include "buffer.h"
     41 #include "packet.h"
     42 #include "dispatch.h"
     43 #include "log.h"
     44 #include "misc.h"
     45 #include "servconf.h"
     46 
     47 /* import */
     48 extern ServerOptions options;
     49 
     50 static int auth2_challenge_start(Authctxt *);
     51 static int send_userauth_info_request(Authctxt *);
     52 static int input_userauth_info_response(int, u_int32_t, void *);
     53 
     54 #ifdef BSD_AUTH
     55 extern KbdintDevice bsdauth_device;
     56 #else
     57 #ifdef USE_PAM
     58 extern KbdintDevice sshpam_device;
     59 #endif
     60 #ifdef SKEY
     61 extern KbdintDevice skey_device;
     62 #endif
     63 #endif
     64 
     65 KbdintDevice *devices[] = {
     66 #ifdef BSD_AUTH
     67 	&bsdauth_device,
     68 #else
     69 #ifdef USE_PAM
     70 	&sshpam_device,
     71 #endif
     72 #ifdef SKEY
     73 	&skey_device,
     74 #endif
     75 #endif
     76 	NULL
     77 };
     78 
     79 typedef struct KbdintAuthctxt KbdintAuthctxt;
     80 struct KbdintAuthctxt
     81 {
     82 	char *devices;
     83 	void *ctxt;
     84 	KbdintDevice *device;
     85 	u_int nreq;
     86 	u_int devices_done;
     87 };
     88 
     89 #ifdef USE_PAM
     90 void remove_kbdint_device(const char *);
     91 void
     92 remove_kbdint_device(const char *xdevname)
     93 {
     94 	int i, j;
     95 
     96 	for (i = 0; devices[i] != NULL; i++)
     97 		if (strcmp(devices[i]->name, xdevname) == 0) {
     98 			for (j = i; devices[j] != NULL; j++)
     99 				devices[j] = devices[j+1];
    100 			i--;
    101 		}
    102 }
    103 #endif
    104 
    105 static KbdintAuthctxt *
    106 kbdint_alloc(const char *devs)
    107 {
    108 	KbdintAuthctxt *kbdintctxt;
    109 	Buffer b;
    110 	int i;
    111 
    112 #ifdef USE_PAM
    113 	if (!options.use_pam)
    114 		remove_kbdint_device("pam");
    115 #endif
    116 
    117 	kbdintctxt = xcalloc(1, sizeof(KbdintAuthctxt));
    118 	if (strcmp(devs, "") == 0) {
    119 		buffer_init(&b);
    120 		for (i = 0; devices[i]; i++) {
    121 			if (buffer_len(&b) > 0)
    122 				buffer_append(&b, ",", 1);
    123 			buffer_append(&b, devices[i]->name,
    124 			    strlen(devices[i]->name));
    125 		}
    126 		buffer_append(&b, "\0", 1);
    127 		kbdintctxt->devices = xstrdup((const char *)buffer_ptr(&b));
    128 		buffer_free(&b);
    129 	} else {
    130 		kbdintctxt->devices = xstrdup(devs);
    131 	}
    132 	debug("kbdint_alloc: devices '%s'", kbdintctxt->devices);
    133 	kbdintctxt->ctxt = NULL;
    134 	kbdintctxt->device = NULL;
    135 	kbdintctxt->nreq = 0;
    136 
    137 	return kbdintctxt;
    138 }
    139 static void
    140 kbdint_reset_device(KbdintAuthctxt *kbdintctxt)
    141 {
    142 	if (kbdintctxt->ctxt) {
    143 		kbdintctxt->device->free_ctx(kbdintctxt->ctxt);
    144 		kbdintctxt->ctxt = NULL;
    145 	}
    146 	kbdintctxt->device = NULL;
    147 }
    148 static void
    149 kbdint_free(KbdintAuthctxt *kbdintctxt)
    150 {
    151 	if (kbdintctxt->device)
    152 		kbdint_reset_device(kbdintctxt);
    153 	free(kbdintctxt->devices);
    154 	explicit_bzero(kbdintctxt, sizeof(*kbdintctxt));
    155 	free(kbdintctxt);
    156 }
    157 /* get next device */
    158 static int
    159 kbdint_next_device(Authctxt *authctxt, KbdintAuthctxt *kbdintctxt)
    160 {
    161 	size_t len;
    162 	char *t;
    163 	int i;
    164 
    165 	if (kbdintctxt->device)
    166 		kbdint_reset_device(kbdintctxt);
    167 	do {
    168 		len = kbdintctxt->devices ?
    169 		    strcspn(kbdintctxt->devices, ",") : 0;
    170 
    171 		if (len == 0)
    172 			break;
    173 		for (i = 0; devices[i]; i++) {
    174 			if ((kbdintctxt->devices_done & (1 << i)) != 0 ||
    175 			    !auth2_method_allowed(authctxt,
    176 			    "keyboard-interactive", devices[i]->name))
    177 				continue;
    178 			if (strncmp(kbdintctxt->devices, devices[i]->name,
    179 			    len) == 0) {
    180 				kbdintctxt->device = devices[i];
    181 				kbdintctxt->devices_done |= 1 << i;
    182 			}
    183 		}
    184 		t = kbdintctxt->devices;
    185 		kbdintctxt->devices = t[len] ? xstrdup(t+len+1) : NULL;
    186 		free(t);
    187 		debug2("kbdint_next_device: devices %s", kbdintctxt->devices ?
    188 		    kbdintctxt->devices : "<empty>");
    189 	} while (kbdintctxt->devices && !kbdintctxt->device);
    190 
    191 	return kbdintctxt->device ? 1 : 0;
    192 }
    193 
    194 /*
    195  * try challenge-response, set authctxt->postponed if we have to
    196  * wait for the response.
    197  */
    198 int
    199 auth2_challenge(Authctxt *authctxt, char *devs)
    200 {
    201 	debug("auth2_challenge: user=%s devs=%s",
    202 	    authctxt->user ? authctxt->user : "<nouser>",
    203 	    devs ? devs : "<no devs>");
    204 
    205 	if (authctxt->user == NULL || !devs)
    206 		return 0;
    207 	if (authctxt->kbdintctxt == NULL)
    208 		authctxt->kbdintctxt = kbdint_alloc(devs);
    209 	return auth2_challenge_start(authctxt);
    210 }
    211 
    212 /* unregister kbd-int callbacks and context */
    213 void
    214 auth2_challenge_stop(Authctxt *authctxt)
    215 {
    216 	/* unregister callback */
    217 	dispatch_set(SSH2_MSG_USERAUTH_INFO_RESPONSE, NULL);
    218 	if (authctxt->kbdintctxt != NULL) {
    219 		kbdint_free(authctxt->kbdintctxt);
    220 		authctxt->kbdintctxt = NULL;
    221 	}
    222 }
    223 
    224 /* side effect: sets authctxt->postponed if a reply was sent*/
    225 static int
    226 auth2_challenge_start(Authctxt *authctxt)
    227 {
    228 	KbdintAuthctxt *kbdintctxt = authctxt->kbdintctxt;
    229 
    230 	debug2("auth2_challenge_start: devices %s",
    231 	    kbdintctxt->devices ?  kbdintctxt->devices : "<empty>");
    232 
    233 	if (kbdint_next_device(authctxt, kbdintctxt) == 0) {
    234 		auth2_challenge_stop(authctxt);
    235 		return 0;
    236 	}
    237 	debug("auth2_challenge_start: trying authentication method '%s'",
    238 	    kbdintctxt->device->name);
    239 
    240 	if ((kbdintctxt->ctxt = kbdintctxt->device->init_ctx(authctxt)) == NULL) {
    241 		auth2_challenge_stop(authctxt);
    242 		return 0;
    243 	}
    244 	if (send_userauth_info_request(authctxt) == 0) {
    245 		auth2_challenge_stop(authctxt);
    246 		return 0;
    247 	}
    248 	dispatch_set(SSH2_MSG_USERAUTH_INFO_RESPONSE,
    249 	    &input_userauth_info_response);
    250 
    251 	authctxt->postponed = 1;
    252 	return 0;
    253 }
    254 
    255 static int
    256 send_userauth_info_request(Authctxt *authctxt)
    257 {
    258 	KbdintAuthctxt *kbdintctxt;
    259 	char *name, *instr, **prompts;
    260 	u_int i, *echo_on;
    261 
    262 	kbdintctxt = authctxt->kbdintctxt;
    263 	if (kbdintctxt->device->query(kbdintctxt->ctxt,
    264 	    &name, &instr, &kbdintctxt->nreq, &prompts, &echo_on))
    265 		return 0;
    266 
    267 	packet_start(SSH2_MSG_USERAUTH_INFO_REQUEST);
    268 	packet_put_cstring(name);
    269 	packet_put_cstring(instr);
    270 	packet_put_cstring("");		/* language not used */
    271 	packet_put_int(kbdintctxt->nreq);
    272 	for (i = 0; i < kbdintctxt->nreq; i++) {
    273 		packet_put_cstring(prompts[i]);
    274 		packet_put_char(echo_on[i]);
    275 	}
    276 	packet_send();
    277 	packet_write_wait();
    278 
    279 	for (i = 0; i < kbdintctxt->nreq; i++)
    280 		free(prompts[i]);
    281 	free(prompts);
    282 	free(echo_on);
    283 	free(name);
    284 	free(instr);
    285 	return 1;
    286 }
    287 
    288 static int
    289 input_userauth_info_response(int type, u_int32_t seq, void *ctxt)
    290 {
    291 	Authctxt *authctxt = ctxt;
    292 	KbdintAuthctxt *kbdintctxt;
    293 	int authenticated = 0, res;
    294 	u_int i, nresp;
    295 	const char *devicename = NULL;
    296 	char **response = NULL;
    297 
    298 	if (authctxt == NULL)
    299 		fatal("input_userauth_info_response: no authctxt");
    300 	kbdintctxt = authctxt->kbdintctxt;
    301 	if (kbdintctxt == NULL || kbdintctxt->ctxt == NULL)
    302 		fatal("input_userauth_info_response: no kbdintctxt");
    303 	if (kbdintctxt->device == NULL)
    304 		fatal("input_userauth_info_response: no device");
    305 
    306 	authctxt->postponed = 0;	/* reset */
    307 	nresp = packet_get_int();
    308 	if (nresp != kbdintctxt->nreq)
    309 		fatal("input_userauth_info_response: wrong number of replies");
    310 	if (nresp > 100)
    311 		fatal("input_userauth_info_response: too many replies");
    312 	if (nresp > 0) {
    313 		response = xcalloc(nresp, sizeof(char *));
    314 		for (i = 0; i < nresp; i++)
    315 			response[i] = packet_get_string(NULL);
    316 	}
    317 	packet_check_eom();
    318 
    319 	res = kbdintctxt->device->respond(kbdintctxt->ctxt, nresp, response);
    320 
    321 	for (i = 0; i < nresp; i++) {
    322 		explicit_bzero(response[i], strlen(response[i]));
    323 		free(response[i]);
    324 	}
    325 	free(response);
    326 
    327 	switch (res) {
    328 	case 0:
    329 		/* Success! */
    330 		authenticated = authctxt->valid ? 1 : 0;
    331 		break;
    332 	case 1:
    333 		/* Authentication needs further interaction */
    334 		if (send_userauth_info_request(authctxt) == 1)
    335 			authctxt->postponed = 1;
    336 		break;
    337 	default:
    338 		/* Failure! */
    339 		break;
    340 	}
    341 	devicename = kbdintctxt->device->name;
    342 	if (!authctxt->postponed) {
    343 		if (authenticated) {
    344 			auth2_challenge_stop(authctxt);
    345 		} else {
    346 			/* start next device */
    347 			/* may set authctxt->postponed */
    348 			auth2_challenge_start(authctxt);
    349 		}
    350 	}
    351 	userauth_finish(authctxt, authenticated, "keyboard-interactive",
    352 	    devicename);
    353 	return 0;
    354 }
    355 
    356 void
    357 privsep_challenge_enable(void)
    358 {
    359 #if defined(BSD_AUTH) || defined(USE_PAM) || defined(SKEY)
    360 	int n = 0;
    361 #endif
    362 #ifdef BSD_AUTH
    363 	extern KbdintDevice mm_bsdauth_device;
    364 #endif
    365 #ifdef USE_PAM
    366 	extern KbdintDevice mm_sshpam_device;
    367 #endif
    368 #ifdef SKEY
    369 	extern KbdintDevice mm_skey_device;
    370 #endif
    371 	/* As long as SSHv1 has devices[0] hard coded this is fine */
    372 #ifdef BSD_AUTH
    373 	devices[n++] = &mm_bsdauth_device;
    374 #endif
    375 #ifdef USE_PAM
    376 	devices[n++] = &mm_sshpam_device;
    377 #endif
    378 #ifdef SKEY
    379 	devices[n++] = &mm_skey_device;
    380 #endif
    381 }
    382