Home | History | Annotate | Line # | Download | only in libtelnet
auth.c revision 1.11 
      1 /*	$NetBSD: auth.c,v 1.11 2000/06/22 06:47:42 thorpej Exp $	*/
      2 
      3 /*-
      4  * Copyright (c) 1991, 1993
      5  *	The Regents of the University of California.  All rights reserved.
      6  *
      7  * Redistribution and use in source and binary forms, with or without
      8  * modification, are permitted provided that the following conditions
      9  * are met:
     10  * 1. Redistributions of source code must retain the above copyright
     11  *    notice, this list of conditions and the following disclaimer.
     12  * 2. Redistributions in binary form must reproduce the above copyright
     13  *    notice, this list of conditions and the following disclaimer in the
     14  *    documentation and/or other materials provided with the distribution.
     15  * 3. All advertising materials mentioning features or use of this software
     16  *    must display the following acknowledgement:
     17  *	This product includes software developed by the University of
     18  *	California, Berkeley and its contributors.
     19  * 4. Neither the name of the University nor the names of its contributors
     20  *    may be used to endorse or promote products derived from this software
     21  *    without specific prior written permission.
     22  *
     23  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
     24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
     27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     33  * SUCH DAMAGE.
     34  */
     35 
     36 #include <sys/cdefs.h>
     37 #ifndef lint
     38 #if 0
     39 static char sccsid[] = "@(#)auth.c	8.3 (Berkeley) 5/30/95"
     40 #else
     41 __RCSID("$NetBSD: auth.c,v 1.11 2000/06/22 06:47:42 thorpej Exp $");
     42 #endif
     43 #endif /* not lint */
     44 
     45 /*
     46  * Copyright (C) 1990 by the Massachusetts Institute of Technology
     47  *
     48  * Export of this software from the United States of America is assumed
     49  * to require a specific license from the United States Government.
     50  * It is the responsibility of any person or organization contemplating
     51  * export to obtain such a license before exporting.
     52  *
     53  * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
     54  * distribute this software and its documentation for any purpose and
     55  * without fee is hereby granted, provided that the above copyright
     56  * notice appear in all copies and that both that copyright notice and
     57  * this permission notice appear in supporting documentation, and that
     58  * the name of M.I.T. not be used in advertising or publicity pertaining
     59  * to distribution of the software without specific, written prior
     60  * permission.  M.I.T. makes no representations about the suitability of
     61  * this software for any purpose.  It is provided "as is" without express
     62  * or implied warranty.
     63  */
     64 
     65 
     66 #if	defined(AUTHENTICATION)
     67 #include <stdio.h>
     68 #include <sys/types.h>
     69 #include <signal.h>
     70 #define	AUTH_NAMES
     71 #include <arpa/telnet.h>
     72 #ifdef	__STDC__
     73 #include <stdlib.h>
     74 #include <unistd.h>
     75 #endif
     76 #ifdef	NO_STRING_H
     77 #include <strings.h>
     78 #else
     79 #include <string.h>
     80 #endif
     81 
     82 #include "encrypt.h"
     83 #include "auth.h"
     84 #include "misc-proto.h"
     85 #include "auth-proto.h"
     86 
     87 #define	typemask(x)		(1<<((x)-1))
     88 
     89 #ifdef	KRB4_ENCPWD
     90 extern krb4encpwd_init();
     91 extern krb4encpwd_send();
     92 extern krb4encpwd_is();
     93 extern krb4encpwd_reply();
     94 extern krb4encpwd_status();
     95 extern krb4encpwd_printsub();
     96 #endif
     97 
     98 #ifdef	RSA_ENCPWD
     99 extern rsaencpwd_init();
    100 extern rsaencpwd_send();
    101 extern rsaencpwd_is();
    102 extern rsaencpwd_reply();
    103 extern rsaencpwd_status();
    104 extern rsaencpwd_printsub();
    105 #endif
    106 
    107 int auth_debug_mode = 0;
    108 static 	const char	*Name = "Noname";
    109 static	int	Server = 0;
    110 static	Authenticator	*authenticated = 0;
    111 static	int	authenticating = 0;
    112 static	int	validuser = 0;
    113 static	unsigned char	_auth_send_data[256];
    114 static	unsigned char	*auth_send_data;
    115 static	int	auth_send_cnt = 0;
    116 
    117 static void auth_intr P((int));
    118 
    119 /*
    120  * Authentication types supported.  Plese note that these are stored
    121  * in priority order, i.e. try the first one first.
    122  */
    123 Authenticator authenticators[] = {
    124 #ifdef	SPX
    125 	{ AUTHTYPE_SPX, AUTH_WHO_CLIENT|AUTH_HOW_MUTUAL,
    126 				spx_init,
    127 				spx_send,
    128 				spx_is,
    129 				spx_reply,
    130 				spx_status,
    131 				spx_printsub },
    132 	{ AUTHTYPE_SPX, AUTH_WHO_CLIENT|AUTH_HOW_ONE_WAY,
    133 				spx_init,
    134 				spx_send,
    135 				spx_is,
    136 				spx_reply,
    137 				spx_status,
    138 				spx_printsub },
    139 #endif
    140 #ifdef	KRB5
    141 # ifdef	ENCRYPTION
    142 	{ AUTHTYPE_KERBEROS_V5, AUTH_WHO_CLIENT|AUTH_HOW_MUTUAL,
    143 				kerberos5_init,
    144 				kerberos5_send,
    145 				kerberos5_is,
    146 				kerberos5_reply,
    147 				kerberos5_status,
    148 				kerberos5_printsub },
    149 # endif	/* ENCRYPTION */
    150 	{ AUTHTYPE_KERBEROS_V5, AUTH_WHO_CLIENT|AUTH_HOW_ONE_WAY,
    151 				kerberos5_init,
    152 				kerberos5_send,
    153 				kerberos5_is,
    154 				kerberos5_reply,
    155 				kerberos5_status,
    156 				kerberos5_printsub },
    157 #endif
    158 #ifdef	KRB4
    159 # ifdef	ENCRYPTION
    160 	{ AUTHTYPE_KERBEROS_V4, AUTH_WHO_CLIENT|AUTH_HOW_MUTUAL,
    161 				kerberos4_init,
    162 				kerberos4_send,
    163 				kerberos4_is,
    164 				kerberos4_reply,
    165 				kerberos4_status,
    166 				kerberos4_printsub },
    167 # endif	/* ENCRYPTION */
    168 	{ AUTHTYPE_KERBEROS_V4, AUTH_WHO_CLIENT|AUTH_HOW_ONE_WAY,
    169 				kerberos4_init,
    170 				kerberos4_send,
    171 				kerberos4_is,
    172 				kerberos4_reply,
    173 				kerberos4_status,
    174 				kerberos4_printsub },
    175 #endif
    176 #ifdef	KRB4_ENCPWD
    177 	{ AUTHTYPE_KRB4_ENCPWD, AUTH_WHO_CLIENT|AUTH_HOW_MUTUAL,
    178 				krb4encpwd_init,
    179 				krb4encpwd_send,
    180 				krb4encpwd_is,
    181 				krb4encpwd_reply,
    182 				krb4encpwd_status,
    183 				krb4encpwd_printsub },
    184 #endif
    185 #ifdef	RSA_ENCPWD
    186 	{ AUTHTYPE_RSA_ENCPWD, AUTH_WHO_CLIENT|AUTH_HOW_ONE_WAY,
    187 				rsaencpwd_init,
    188 				rsaencpwd_send,
    189 				rsaencpwd_is,
    190 				rsaencpwd_reply,
    191 				rsaencpwd_status,
    192 				rsaencpwd_printsub },
    193 #endif
    194 	{ 0, },
    195 };
    196 
    197 static Authenticator NoAuth = { 0 };
    198 
    199 static int	i_support = 0;
    200 static int	i_wont_support = 0;
    201 
    202 	Authenticator *
    203 findauthenticator(type, way)
    204 	int type;
    205 	int way;
    206 {
    207 	Authenticator *ap = authenticators;
    208 
    209 	while (ap->type && (ap->type != type || ap->way != way))
    210 		++ap;
    211 	return(ap->type ? ap : 0);
    212 }
    213 
    214 	void
    215 auth_init(name, server)
    216 	const char *name;
    217 	int server;
    218 {
    219 	Authenticator *ap = authenticators;
    220 
    221 	Server = server;
    222 	Name = name;
    223 
    224 	i_support = 0;
    225 	authenticated = 0;
    226 	authenticating = 0;
    227 	while (ap->type) {
    228 		if (!ap->init || (*ap->init)(ap, server)) {
    229 			i_support |= typemask(ap->type);
    230 			if (auth_debug_mode)
    231 				printf(">>>%s: I support auth type %d %d\r\n",
    232 					Name,
    233 					ap->type, ap->way);
    234 		}
    235 		else if (auth_debug_mode)
    236 			printf(">>>%s: Init failed: auth type %d %d\r\n",
    237 				Name, ap->type, ap->way);
    238 		++ap;
    239 	}
    240 }
    241 
    242 	void
    243 auth_disable_name(name)
    244 	char *name;
    245 {
    246 	int x;
    247 	for (x = 0; x < AUTHTYPE_CNT; ++x) {
    248 		if (!strcasecmp(name, AUTHTYPE_NAME(x))) {
    249 			i_wont_support |= typemask(x);
    250 			break;
    251 		}
    252 	}
    253 }
    254 
    255 	int
    256 getauthmask(type, maskp)
    257 	char *type;
    258 	int *maskp;
    259 {
    260 	register int x;
    261 
    262 	if (!strcasecmp(type, AUTHTYPE_NAME(0))) {
    263 		*maskp = -1;
    264 		return(1);
    265 	}
    266 
    267 	for (x = 1; x < AUTHTYPE_CNT; ++x) {
    268 		if (!strcasecmp(type, AUTHTYPE_NAME(x))) {
    269 			*maskp = typemask(x);
    270 			return(1);
    271 		}
    272 	}
    273 	return(0);
    274 }
    275 
    276 	int
    277 auth_enable(type)
    278 	char *type;
    279 {
    280 	return(auth_onoff(type, 1));
    281 }
    282 
    283 	int
    284 auth_disable(type)
    285 	char *type;
    286 {
    287 	return(auth_onoff(type, 0));
    288 }
    289 
    290 	int
    291 auth_onoff(type, on)
    292 	char *type;
    293 	int on;
    294 {
    295 	int i, mask = -1;
    296 	Authenticator *ap;
    297 
    298 	if (!strcasecmp(type, "?") || !strcasecmp(type, "help")) {
    299 		printf("auth %s 'type'\n", on ? "enable" : "disable");
    300 		printf("Where 'type' is one of:\n");
    301 		printf("\t%s\n", AUTHTYPE_NAME(0));
    302 		mask = 0;
    303 		for (ap = authenticators; ap->type; ap++) {
    304 			if ((mask & (i = typemask(ap->type))) != 0)
    305 				continue;
    306 			mask |= i;
    307 			printf("\t%s\n", AUTHTYPE_NAME(ap->type));
    308 		}
    309 		return(0);
    310 	}
    311 
    312 	if (!getauthmask(type, &mask)) {
    313 		printf("%s: invalid authentication type\n", type);
    314 		return(0);
    315 	}
    316 	if (on)
    317 		i_wont_support &= ~mask;
    318 	else
    319 		i_wont_support |= mask;
    320 	return(1);
    321 }
    322 
    323 	int
    324 auth_togdebug(on)
    325 	int on;
    326 {
    327 	if (on < 0)
    328 		auth_debug_mode ^= 1;
    329 	else
    330 		auth_debug_mode = on;
    331 	printf("auth debugging %s\n", auth_debug_mode ? "enabled" : "disabled");
    332 	return(1);
    333 }
    334 
    335 	int
    336 auth_status(s)
    337 	char *s;
    338 {
    339 	Authenticator *ap;
    340 	int i, mask;
    341 
    342 	if (i_wont_support == -1)
    343 		printf("Authentication disabled\n");
    344 	else
    345 		printf("Authentication enabled\n");
    346 
    347 	mask = 0;
    348 	for (ap = authenticators; ap->type; ap++) {
    349 		if ((mask & (i = typemask(ap->type))) != 0)
    350 			continue;
    351 		mask |= i;
    352 		printf("%s: %s\n", AUTHTYPE_NAME(ap->type),
    353 			(i_wont_support & typemask(ap->type)) ?
    354 					"disabled" : "enabled");
    355 	}
    356 	return(1);
    357 }
    358 
    359 /*
    360  * This routine is called by the server to start authentication
    361  * negotiation.
    362  */
    363 	void
    364 auth_request()
    365 {
    366 	static unsigned char str_request[64] = { IAC, SB,
    367 						 TELOPT_AUTHENTICATION,
    368 						 TELQUAL_SEND, };
    369 	Authenticator *ap = authenticators;
    370 	unsigned char *e = str_request + 4;
    371 
    372 	if (!authenticating) {
    373 		authenticating = 1;
    374 		while (ap->type) {
    375 			if (i_support & ~i_wont_support & typemask(ap->type)) {
    376 				if (auth_debug_mode) {
    377 					printf(">>>%s: Sending type %d %d\r\n",
    378 						Name, ap->type, ap->way);
    379 				}
    380 				*e++ = ap->type;
    381 				*e++ = ap->way;
    382 			}
    383 			++ap;
    384 		}
    385 		*e++ = IAC;
    386 		*e++ = SE;
    387 		telnet_net_write(str_request, e - str_request);
    388 		printsub('>', &str_request[2], e - str_request - 2);
    389 	}
    390 }
    391 
    392 /*
    393  * This is called when an AUTH SEND is received.
    394  * It should never arrive on the server side (as only the server can
    395  * send an AUTH SEND).
    396  * You should probably respond to it if you can...
    397  *
    398  * If you want to respond to the types out of order (i.e. even
    399  * if he sends  LOGIN KERBEROS and you support both, you respond
    400  * with KERBEROS instead of LOGIN (which is against what the
    401  * protocol says)) you will have to hack this code...
    402  */
    403 	void
    404 auth_send(data, cnt)
    405 	unsigned char *data;
    406 	int cnt;
    407 {
    408 	Authenticator *ap;
    409 	static unsigned char str_none[] = { IAC, SB, TELOPT_AUTHENTICATION,
    410 					    TELQUAL_IS, AUTHTYPE_NULL, 0,
    411 					    IAC, SE };
    412 	if (Server) {
    413 		if (auth_debug_mode) {
    414 			printf(">>>%s: auth_send called!\r\n", Name);
    415 		}
    416 		return;
    417 	}
    418 
    419 	if (auth_debug_mode) {
    420 		printf(">>>%s: auth_send got:", Name);
    421 		printd(data, cnt); printf("\r\n");
    422 	}
    423 
    424 	/*
    425 	 * Save the data, if it is new, so that we can continue looking
    426 	 * at it if the authorization we try doesn't work
    427 	 */
    428 	if (data < _auth_send_data ||
    429 	    data > _auth_send_data + sizeof(_auth_send_data)) {
    430 		auth_send_cnt = cnt > sizeof(_auth_send_data)
    431 					? sizeof(_auth_send_data)
    432 					: cnt;
    433 		memmove((void *)_auth_send_data, (void *)data, auth_send_cnt);
    434 		auth_send_data = _auth_send_data;
    435 	} else {
    436 		/*
    437 		 * This is probably a no-op, but we just make sure
    438 		 */
    439 		auth_send_data = data;
    440 		auth_send_cnt = cnt;
    441 	}
    442 	while ((auth_send_cnt -= 2) >= 0) {
    443 		if (auth_debug_mode)
    444 			printf(">>>%s: He supports %d\r\n",
    445 				Name, *auth_send_data);
    446 		if ((i_support & ~i_wont_support) & typemask(*auth_send_data)) {
    447 			ap = findauthenticator(auth_send_data[0],
    448 					       auth_send_data[1]);
    449 			if (ap && ap->send) {
    450 				if (auth_debug_mode)
    451 					printf(">>>%s: Trying %d %d\r\n",
    452 						Name, auth_send_data[0],
    453 							auth_send_data[1]);
    454 				if ((*ap->send)(ap)) {
    455 					/*
    456 					 * Okay, we found one we like
    457 					 * and did it.
    458 					 * we can go home now.
    459 					 */
    460 					if (auth_debug_mode)
    461 						printf(">>>%s: Using type %d\r\n",
    462 							Name, *auth_send_data);
    463 					auth_send_data += 2;
    464 					return;
    465 				}
    466 			}
    467 			/* else
    468 			 *	just continue on and look for the
    469 			 *	next one if we didn't do anything.
    470 			 */
    471 		}
    472 		auth_send_data += 2;
    473 	}
    474 	telnet_net_write(str_none, sizeof(str_none));
    475 	printsub('>', &str_none[2], sizeof(str_none) - 2);
    476 	if (auth_debug_mode)
    477 		printf(">>>%s: Sent failure message\r\n", Name);
    478 	auth_finished(0, AUTH_REJECT);
    479 #ifdef KANNAN
    480 	/*
    481 	 *  We requested strong authentication, however no mechanisms worked.
    482 	 *  Therefore, exit on client end.
    483 	 */
    484 	printf("Unable to securely authenticate user ... exit\n");
    485 	exit(0);
    486 #endif /* KANNAN */
    487 }
    488 
    489 	void
    490 auth_send_retry()
    491 {
    492 	/*
    493 	 * if auth_send_cnt <= 0 then auth_send will end up rejecting
    494 	 * the authentication and informing the other side of this.
    495 	 */
    496 	auth_send(auth_send_data, auth_send_cnt);
    497 }
    498 
    499 	void
    500 auth_is(data, cnt)
    501 	unsigned char *data;
    502 	int cnt;
    503 {
    504 	Authenticator *ap;
    505 
    506 	if (cnt < 2)
    507 		return;
    508 
    509 	if (data[0] == AUTHTYPE_NULL) {
    510 		auth_finished(0, AUTH_REJECT);
    511 		return;
    512 	}
    513 
    514 	if ((ap = findauthenticator(data[0], data[1])) != NULL) {
    515 		if (ap->is)
    516 			(*ap->is)(ap, data+2, cnt-2);
    517 	} else if (auth_debug_mode)
    518 		printf(">>>%s: Invalid authentication in IS: %d\r\n",
    519 			Name, *data);
    520 }
    521 
    522 	void
    523 auth_reply(data, cnt)
    524 	unsigned char *data;
    525 	int cnt;
    526 {
    527 	Authenticator *ap;
    528 
    529 	if (cnt < 2)
    530 		return;
    531 
    532 	if ((ap = findauthenticator(data[0], data[1])) != NULL) {
    533 		if (ap->reply)
    534 			(*ap->reply)(ap, data+2, cnt-2);
    535 	} else if (auth_debug_mode)
    536 		printf(">>>%s: Invalid authentication in SEND: %d\r\n",
    537 			Name, *data);
    538 }
    539 
    540 	void
    541 auth_name(data, cnt)
    542 	unsigned char *data;
    543 	int cnt;
    544 {
    545 	unsigned char savename[256];
    546 
    547 	if (cnt < 1) {
    548 		if (auth_debug_mode)
    549 			printf(">>>%s: Empty name in NAME\r\n", Name);
    550 		return;
    551 	}
    552 	if (cnt > sizeof(savename) - 1) {
    553 		if (auth_debug_mode)
    554 			printf(">>>%s: Name in NAME (%d) exceeds %ld length\r\n",
    555 					Name, cnt, (long)sizeof(savename)-1);
    556 		return;
    557 	}
    558 	memmove((void *)savename, (void *)data, cnt);
    559 	savename[cnt] = '\0';	/* Null terminate */
    560 	if (auth_debug_mode)
    561 		printf(">>>%s: Got NAME [%s]\r\n", Name, savename);
    562 	auth_encrypt_user(savename);
    563 }
    564 
    565 	int
    566 auth_sendname(cp, len)
    567 	unsigned char *cp;
    568 	int len;
    569 {
    570 	static unsigned char str_request[256+6]
    571 			= { IAC, SB, TELOPT_AUTHENTICATION, TELQUAL_NAME, };
    572 	register unsigned char *e = str_request + 4;
    573 	register unsigned char *ee = &str_request[sizeof(str_request)-2];
    574 
    575 	while (--len >= 0) {
    576 		if ((*e++ = *cp++) == IAC)
    577 			*e++ = IAC;
    578 		if (e >= ee)
    579 			return(0);
    580 	}
    581 	*e++ = IAC;
    582 	*e++ = SE;
    583 	telnet_net_write(str_request, e - str_request);
    584 	printsub('>', &str_request[2], e - &str_request[2]);
    585 	return(1);
    586 }
    587 
    588 	void
    589 auth_finished(ap, result)
    590 	Authenticator *ap;
    591 	int result;
    592 {
    593 	if (!(authenticated = ap))
    594 		authenticated = &NoAuth;
    595 	validuser = result;
    596 }
    597 
    598 	/* ARGSUSED */
    599 	static void
    600 auth_intr(sig)
    601 	int sig;
    602 {
    603 	auth_finished(0, AUTH_REJECT);
    604 }
    605 
    606 	int
    607 auth_wait(name)
    608 	char *name;
    609 {
    610 	if (auth_debug_mode)
    611 		printf(">>>%s: in auth_wait.\r\n", Name);
    612 
    613 	if (Server && !authenticating)
    614 		return(0);
    615 
    616 	(void) signal(SIGALRM, auth_intr);
    617 	alarm(30);
    618 	while (!authenticated)
    619 		if (telnet_spin())
    620 			break;
    621 	alarm(0);
    622 	(void) signal(SIGALRM, SIG_DFL);
    623 
    624 	/*
    625 	 * Now check to see if the user is valid or not
    626 	 */
    627 	if (!authenticated || authenticated == &NoAuth)
    628 		return(AUTH_REJECT);
    629 
    630 	if (validuser == AUTH_VALID)
    631 		validuser = AUTH_USER;
    632 
    633 	if (authenticated->status)
    634 		validuser = (*authenticated->status)(authenticated,
    635 						     name, validuser);
    636 	return(validuser);
    637 }
    638 
    639 	void
    640 auth_debug(mode)
    641 	int mode;
    642 {
    643 	auth_debug_mode = mode;
    644 }
    645 
    646 	void
    647 auth_printsub(data, cnt, buf, buflen)
    648 	unsigned char *data, *buf;
    649 	int cnt, buflen;
    650 {
    651 	Authenticator *ap;
    652 
    653 	if ((ap = findauthenticator(data[1], data[2])) && ap->printsub)
    654 		(*ap->printsub)(data, cnt, buf, buflen);
    655 	else
    656 		auth_gen_printsub(data, cnt, buf, buflen);
    657 }
    658 
    659 	void
    660 auth_gen_printsub(data, cnt, buf, buflen)
    661 	unsigned char *data, *buf;
    662 	int cnt, buflen;
    663 {
    664 	register unsigned char *cp;
    665 	unsigned char tbuf[16];
    666 
    667 	cnt -= 3;
    668 	data += 3;
    669 	buf[buflen-1] = '\0';
    670 	buf[buflen-2] = '*';
    671 	buflen -= 2;
    672 	for (; cnt > 0; cnt--, data++) {
    673 		sprintf((char *)tbuf, " %d", *data);
    674 		for (cp = tbuf; *cp && buflen > 0; --buflen)
    675 			*buf++ = *cp++;
    676 		if (buflen <= 0)
    677 			return;
    678 	}
    679 	*buf = '\0';
    680 }
    681 #endif
    682