auth.c revision 1.18
1 /* $NetBSD: auth.c,v 1.18 2005/02/19 21:55:52 christos Exp $ */ 2 3 /*- 4 * Copyright (c) 1991, 1993 5 * The Regents of the University of California. All rights reserved. 6 * 7 * Redistribution and use in source and binary forms, with or without 8 * modification, are permitted provided that the following conditions 9 * are met: 10 * 1. Redistributions of source code must retain the above copyright 11 * notice, this list of conditions and the following disclaimer. 12 * 2. Redistributions in binary form must reproduce the above copyright 13 * notice, this list of conditions and the following disclaimer in the 14 * documentation and/or other materials provided with the distribution. 15 * 3. Neither the name of the University nor the names of its contributors 16 * may be used to endorse or promote products derived from this software 17 * without specific prior written permission. 18 * 19 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29 * SUCH DAMAGE. 30 */ 31 32 #include <sys/cdefs.h> 33 #ifndef lint 34 #if 0 35 static char sccsid[] = "@(#)auth.c 8.3 (Berkeley) 5/30/95" 36 #else 37 __RCSID("$NetBSD: auth.c,v 1.18 2005/02/19 21:55:52 christos Exp $"); 38 #endif 39 #endif /* not lint */ 40 41 /* 42 * Copyright (C) 1990 by the Massachusetts Institute of Technology 43 * 44 * Export of this software from the United States of America is assumed 45 * to require a specific license from the United States Government. 46 * It is the responsibility of any person or organization contemplating 47 * export to obtain such a license before exporting. 48 * 49 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and 50 * distribute this software and its documentation for any purpose and 51 * without fee is hereby granted, provided that the above copyright 52 * notice appear in all copies and that both that copyright notice and 53 * this permission notice appear in supporting documentation, and that 54 * the name of M.I.T. not be used in advertising or publicity pertaining 55 * to distribution of the software without specific, written prior 56 * permission. M.I.T. makes no representations about the suitability of 57 * this software for any purpose. It is provided "as is" without express 58 * or implied warranty. 59 */ 60 61 62 #ifdef AUTHENTICATION 63 #include <stdio.h> 64 #include <sys/types.h> 65 #include <signal.h> 66 #define AUTH_NAMES 67 #include <arpa/telnet.h> 68 #include <stdlib.h> 69 #include <unistd.h> 70 #ifdef NO_STRING_H 71 #include <strings.h> 72 #else 73 #include <string.h> 74 #endif 75 76 #include "encrypt.h" 77 #include "auth.h" 78 #include "misc-proto.h" 79 #include "auth-proto.h" 80 81 #define typemask(x) (1<<((x)-1)) 82 83 #ifdef KRB4_ENCPWD 84 extern krb4encpwd_init(); 85 extern krb4encpwd_send(); 86 extern krb4encpwd_is(); 87 extern krb4encpwd_reply(); 88 extern krb4encpwd_status(); 89 extern krb4encpwd_printsub(); 90 #endif 91 92 #ifdef RSA_ENCPWD 93 extern rsaencpwd_init(); 94 extern rsaencpwd_send(); 95 extern rsaencpwd_is(); 96 extern rsaencpwd_reply(); 97 extern rsaencpwd_status(); 98 extern rsaencpwd_printsub(); 99 #endif 100 101 int auth_debug_mode = 0; 102 static const char *Name = "Noname"; 103 static int Server = 0; 104 static Authenticator *authenticated = 0; 105 static int authenticating = 0; 106 static int validuser = 0; 107 static unsigned char _auth_send_data[256]; 108 static unsigned char *auth_send_data; 109 static int auth_send_cnt = 0; 110 111 static void auth_intr(int); 112 113 /* 114 * Authentication types supported. Plese note that these are stored 115 * in priority order, i.e. try the first one first. 116 */ 117 Authenticator authenticators[] = { 118 #ifdef SPX 119 { AUTHTYPE_SPX, AUTH_WHO_CLIENT|AUTH_HOW_MUTUAL, 120 spx_init, 121 spx_send, 122 spx_is, 123 spx_reply, 124 spx_status, 125 spx_printsub }, 126 { AUTHTYPE_SPX, AUTH_WHO_CLIENT|AUTH_HOW_ONE_WAY, 127 spx_init, 128 spx_send, 129 spx_is, 130 spx_reply, 131 spx_status, 132 spx_printsub }, 133 #endif 134 #ifdef KRB5 135 # ifdef ENCRYPTION 136 { AUTHTYPE_KERBEROS_V5, AUTH_WHO_CLIENT|AUTH_HOW_MUTUAL, 137 kerberos5_init, 138 kerberos5_send, 139 kerberos5_is, 140 kerberos5_reply, 141 kerberos5_status, 142 kerberos5_printsub }, 143 # endif /* ENCRYPTION */ 144 { AUTHTYPE_KERBEROS_V5, AUTH_WHO_CLIENT|AUTH_HOW_ONE_WAY, 145 kerberos5_init, 146 kerberos5_send, 147 kerberos5_is, 148 kerberos5_reply, 149 kerberos5_status, 150 kerberos5_printsub }, 151 #endif 152 #ifdef KRB4 153 # ifdef ENCRYPTION 154 { AUTHTYPE_KERBEROS_V4, AUTH_WHO_CLIENT|AUTH_HOW_MUTUAL, 155 kerberos4_init, 156 kerberos4_send, 157 kerberos4_is, 158 kerberos4_reply, 159 kerberos4_status, 160 kerberos4_printsub }, 161 # endif /* ENCRYPTION */ 162 { AUTHTYPE_KERBEROS_V4, AUTH_WHO_CLIENT|AUTH_HOW_ONE_WAY, 163 kerberos4_init, 164 kerberos4_send, 165 kerberos4_is, 166 kerberos4_reply, 167 kerberos4_status, 168 kerberos4_printsub }, 169 #endif 170 #ifdef KRB4_ENCPWD 171 { AUTHTYPE_KRB4_ENCPWD, AUTH_WHO_CLIENT|AUTH_HOW_MUTUAL, 172 krb4encpwd_init, 173 krb4encpwd_send, 174 krb4encpwd_is, 175 krb4encpwd_reply, 176 krb4encpwd_status, 177 krb4encpwd_printsub }, 178 #endif 179 #ifdef RSA_ENCPWD 180 { AUTHTYPE_RSA_ENCPWD, AUTH_WHO_CLIENT|AUTH_HOW_ONE_WAY, 181 rsaencpwd_init, 182 rsaencpwd_send, 183 rsaencpwd_is, 184 rsaencpwd_reply, 185 rsaencpwd_status, 186 rsaencpwd_printsub }, 187 #endif 188 #ifdef SRA 189 { AUTHTYPE_SRA, AUTH_WHO_CLIENT|AUTH_HOW_ONE_WAY, 190 sra_init, 191 sra_send, 192 sra_is, 193 sra_reply, 194 sra_status, 195 sra_printsub }, 196 197 #endif 198 { 0, 0, 0, 0, 0, 0, 0, 0 }, 199 }; 200 201 static Authenticator NoAuth = { 0 }; 202 203 static int i_support = 0; 204 static int i_wont_support = 0; 205 206 Authenticator * 207 findauthenticator(type, way) 208 int type; 209 int way; 210 { 211 Authenticator *ap = authenticators; 212 213 while (ap->type && (ap->type != type || ap->way != way)) 214 ++ap; 215 return(ap->type ? ap : 0); 216 } 217 218 void 219 auth_init(name, server) 220 const char *name; 221 int server; 222 { 223 Authenticator *ap = authenticators; 224 225 Server = server; 226 Name = name; 227 228 i_support = 0; 229 authenticated = 0; 230 authenticating = 0; 231 while (ap->type) { 232 if (!ap->init || (*ap->init)(ap, server)) { 233 i_support |= typemask(ap->type); 234 if (auth_debug_mode) 235 printf(">>>%s: I support auth type %d %d\r\n", 236 Name, 237 ap->type, ap->way); 238 } 239 else if (auth_debug_mode) 240 printf(">>>%s: Init failed: auth type %d %d\r\n", 241 Name, ap->type, ap->way); 242 ++ap; 243 } 244 } 245 246 void 247 auth_disable_name(name) 248 char *name; 249 { 250 int x; 251 for (x = 0; x < AUTHTYPE_CNT; ++x) { 252 if (AUTHTYPE_NAME(x) && !strcasecmp(name, AUTHTYPE_NAME(x))) { 253 i_wont_support |= typemask(x); 254 break; 255 } 256 } 257 } 258 259 int 260 getauthmask(type, maskp) 261 char *type; 262 int *maskp; 263 { 264 register int x; 265 266 if (AUTHTYPE_NAME(0) && !strcasecmp(type, AUTHTYPE_NAME(0))) { 267 *maskp = -1; 268 return(1); 269 } 270 271 for (x = 1; x < AUTHTYPE_CNT; ++x) { 272 if (AUTHTYPE_NAME(x) && !strcasecmp(type, AUTHTYPE_NAME(x))) { 273 *maskp = typemask(x); 274 return(1); 275 } 276 } 277 return(0); 278 } 279 280 int 281 auth_enable(type) 282 char *type; 283 { 284 return(auth_onoff(type, 1)); 285 } 286 287 int 288 auth_disable(type) 289 char *type; 290 { 291 return(auth_onoff(type, 0)); 292 } 293 294 int 295 auth_onoff(type, on) 296 char *type; 297 int on; 298 { 299 int i, mask = -1; 300 Authenticator *ap; 301 302 if (!strcasecmp(type, "?") || !strcasecmp(type, "help")) { 303 printf("auth %s 'type'\n", on ? "enable" : "disable"); 304 printf("Where 'type' is one of:\n"); 305 printf("\t%s\n", AUTHTYPE_NAME(0)); 306 mask = 0; 307 for (ap = authenticators; ap->type; ap++) { 308 if ((mask & (i = typemask(ap->type))) != 0) 309 continue; 310 mask |= i; 311 printf("\t%s\n", AUTHTYPE_NAME(ap->type)); 312 } 313 return(0); 314 } 315 316 if (!getauthmask(type, &mask)) { 317 printf("%s: invalid authentication type\n", type); 318 return(0); 319 } 320 if (on) 321 i_wont_support &= ~mask; 322 else 323 i_wont_support |= mask; 324 return(1); 325 } 326 327 int 328 auth_togdebug(on) 329 int on; 330 { 331 if (on < 0) 332 auth_debug_mode ^= 1; 333 else 334 auth_debug_mode = on; 335 printf("auth debugging %s\n", auth_debug_mode ? "enabled" : "disabled"); 336 return(1); 337 } 338 339 int 340 auth_status(s) 341 char *s; 342 { 343 Authenticator *ap; 344 int i, mask; 345 346 if (i_wont_support == -1) 347 printf("Authentication disabled\n"); 348 else 349 printf("Authentication enabled\n"); 350 351 mask = 0; 352 for (ap = authenticators; ap->type; ap++) { 353 if ((mask & (i = typemask(ap->type))) != 0) 354 continue; 355 mask |= i; 356 printf("%s: %s\n", AUTHTYPE_NAME(ap->type), 357 (i_wont_support & typemask(ap->type)) ? 358 "disabled" : "enabled"); 359 } 360 return(1); 361 } 362 363 /* 364 * This routine is called by the server to start authentication 365 * negotiation. 366 */ 367 void 368 auth_request() 369 { 370 static unsigned char str_request[64] = { IAC, SB, 371 TELOPT_AUTHENTICATION, 372 TELQUAL_SEND, }; 373 Authenticator *ap = authenticators; 374 unsigned char *e = str_request + 4; 375 376 if (!authenticating) { 377 authenticating = 1; 378 while (ap->type) { 379 if (i_support & ~i_wont_support & typemask(ap->type)) { 380 if (auth_debug_mode) { 381 printf(">>>%s: Sending type %d %d\r\n", 382 Name, ap->type, ap->way); 383 } 384 *e++ = ap->type; 385 *e++ = ap->way; 386 } 387 ++ap; 388 } 389 *e++ = IAC; 390 *e++ = SE; 391 telnet_net_write(str_request, e - str_request); 392 printsub('>', &str_request[2], e - str_request - 2); 393 } 394 } 395 396 /* 397 * This is called when an AUTH SEND is received. 398 * It should never arrive on the server side (as only the server can 399 * send an AUTH SEND). 400 * You should probably respond to it if you can... 401 * 402 * If you want to respond to the types out of order (i.e. even 403 * if he sends LOGIN KERBEROS and you support both, you respond 404 * with KERBEROS instead of LOGIN (which is against what the 405 * protocol says)) you will have to hack this code... 406 */ 407 void 408 auth_send(data, cnt) 409 unsigned char *data; 410 int cnt; 411 { 412 Authenticator *ap; 413 static unsigned char str_none[] = { IAC, SB, TELOPT_AUTHENTICATION, 414 TELQUAL_IS, AUTHTYPE_NULL, 0, 415 IAC, SE }; 416 if (Server) { 417 if (auth_debug_mode) { 418 printf(">>>%s: auth_send called!\r\n", Name); 419 } 420 return; 421 } 422 423 if (auth_debug_mode) { 424 printf(">>>%s: auth_send got:", Name); 425 printd(data, cnt); printf("\r\n"); 426 } 427 428 /* 429 * Save the data, if it is new, so that we can continue looking 430 * at it if the authorization we try doesn't work 431 */ 432 if (data < _auth_send_data || 433 data > _auth_send_data + sizeof(_auth_send_data)) { 434 auth_send_cnt = cnt > sizeof(_auth_send_data) 435 ? sizeof(_auth_send_data) 436 : cnt; 437 memmove((void *)_auth_send_data, (void *)data, auth_send_cnt); 438 auth_send_data = _auth_send_data; 439 } else { 440 /* 441 * This is probably a no-op, but we just make sure 442 */ 443 auth_send_data = data; 444 auth_send_cnt = cnt; 445 } 446 while ((auth_send_cnt -= 2) >= 0) { 447 if (auth_debug_mode) 448 printf(">>>%s: He supports %d\r\n", 449 Name, *auth_send_data); 450 if ((i_support & ~i_wont_support) & typemask(*auth_send_data)) { 451 ap = findauthenticator(auth_send_data[0], 452 auth_send_data[1]); 453 if (ap && ap->send) { 454 if (auth_debug_mode) 455 printf(">>>%s: Trying %d %d\r\n", 456 Name, auth_send_data[0], 457 auth_send_data[1]); 458 if ((*ap->send)(ap)) { 459 /* 460 * Okay, we found one we like 461 * and did it. 462 * we can go home now. 463 */ 464 if (auth_debug_mode) 465 printf(">>>%s: Using type %d\r\n", 466 Name, *auth_send_data); 467 auth_send_data += 2; 468 return; 469 } 470 } 471 /* else 472 * just continue on and look for the 473 * next one if we didn't do anything. 474 */ 475 } 476 auth_send_data += 2; 477 } 478 telnet_net_write(str_none, sizeof(str_none)); 479 printsub('>', &str_none[2], sizeof(str_none) - 2); 480 if (auth_debug_mode) 481 printf(">>>%s: Sent failure message\r\n", Name); 482 auth_finished(0, AUTH_REJECT); 483 #ifdef KANNAN 484 /* 485 * We requested strong authentication, however no mechanisms worked. 486 * Therefore, exit on client end. 487 */ 488 printf("Unable to securely authenticate user ... exit\n"); 489 exit(0); 490 #endif /* KANNAN */ 491 } 492 493 void 494 auth_send_retry() 495 { 496 /* 497 * if auth_send_cnt <= 0 then auth_send will end up rejecting 498 * the authentication and informing the other side of this. 499 */ 500 auth_send(auth_send_data, auth_send_cnt); 501 } 502 503 void 504 auth_is(data, cnt) 505 unsigned char *data; 506 int cnt; 507 { 508 Authenticator *ap; 509 510 if (cnt < 2) 511 return; 512 513 if (data[0] == AUTHTYPE_NULL) { 514 auth_finished(0, AUTH_REJECT); 515 return; 516 } 517 518 if ((ap = findauthenticator(data[0], data[1])) != NULL) { 519 if (ap->is) 520 (*ap->is)(ap, data+2, cnt-2); 521 } else if (auth_debug_mode) 522 printf(">>>%s: Invalid authentication in IS: %d\r\n", 523 Name, *data); 524 } 525 526 void 527 auth_reply(data, cnt) 528 unsigned char *data; 529 int cnt; 530 { 531 Authenticator *ap; 532 533 if (cnt < 2) 534 return; 535 536 if ((ap = findauthenticator(data[0], data[1])) != NULL) { 537 if (ap->reply) 538 (*ap->reply)(ap, data+2, cnt-2); 539 } else if (auth_debug_mode) 540 printf(">>>%s: Invalid authentication in SEND: %d\r\n", 541 Name, *data); 542 } 543 544 void 545 auth_name(data, cnt) 546 unsigned char *data; 547 int cnt; 548 { 549 unsigned char savename[256]; 550 551 if (cnt < 1) { 552 if (auth_debug_mode) 553 printf(">>>%s: Empty name in NAME\r\n", Name); 554 return; 555 } 556 if (cnt > sizeof(savename) - 1) { 557 if (auth_debug_mode) 558 printf(">>>%s: Name in NAME (%d) exceeds %ld length\r\n", 559 Name, cnt, (long)sizeof(savename)-1); 560 return; 561 } 562 memmove((void *)savename, (void *)data, cnt); 563 savename[cnt] = '\0'; /* Null terminate */ 564 if (auth_debug_mode) 565 printf(">>>%s: Got NAME [%s]\r\n", Name, savename); 566 auth_encrypt_user(savename); 567 } 568 569 int 570 auth_sendname(cp, len) 571 unsigned char *cp; 572 int len; 573 { 574 static unsigned char str_request[256+6] 575 = { IAC, SB, TELOPT_AUTHENTICATION, TELQUAL_NAME, }; 576 register unsigned char *e = str_request + 4; 577 register unsigned char *ee = &str_request[sizeof(str_request)-2]; 578 579 while (--len >= 0) { 580 if ((*e++ = *cp++) == IAC) 581 *e++ = IAC; 582 if (e >= ee) 583 return(0); 584 } 585 *e++ = IAC; 586 *e++ = SE; 587 telnet_net_write(str_request, e - str_request); 588 printsub('>', &str_request[2], e - &str_request[2]); 589 return(1); 590 } 591 592 void 593 auth_finished(ap, result) 594 Authenticator *ap; 595 int result; 596 { 597 if (!(authenticated = ap)) 598 authenticated = &NoAuth; 599 validuser = result; 600 } 601 602 /* ARGSUSED */ 603 static void 604 auth_intr(sig) 605 int sig; 606 { 607 auth_finished(0, AUTH_REJECT); 608 } 609 610 int 611 auth_wait(name, l) 612 char *name; 613 size_t l; 614 { 615 if (auth_debug_mode) 616 printf(">>>%s: in auth_wait.\r\n", Name); 617 618 if (Server && !authenticating) 619 return(0); 620 621 (void) signal(SIGALRM, auth_intr); 622 alarm(30); 623 while (!authenticated) 624 if (telnet_spin()) 625 break; 626 alarm(0); 627 (void) signal(SIGALRM, SIG_DFL); 628 629 /* 630 * Now check to see if the user is valid or not 631 */ 632 if (!authenticated || authenticated == &NoAuth) 633 return(AUTH_REJECT); 634 635 if (validuser == AUTH_VALID) 636 validuser = AUTH_USER; 637 638 if (authenticated->status) 639 validuser = (*authenticated->status)(authenticated, 640 name, l, validuser); 641 return(validuser); 642 } 643 644 void 645 auth_debug(mode) 646 int mode; 647 { 648 auth_debug_mode = mode; 649 } 650 651 void 652 auth_printsub(data, cnt, buf, buflen) 653 unsigned char *data, *buf; 654 int cnt, buflen; 655 { 656 Authenticator *ap; 657 658 if ((ap = findauthenticator(data[1], data[2])) && ap->printsub) 659 (*ap->printsub)(data, cnt, buf, buflen); 660 else 661 auth_gen_printsub(data, cnt, buf, buflen); 662 } 663 664 void 665 auth_gen_printsub(data, cnt, buf, buflen) 666 unsigned char *data, *buf; 667 int cnt, buflen; 668 { 669 register unsigned char *cp; 670 unsigned char tbuf[16]; 671 672 cnt -= 3; 673 data += 3; 674 buf[buflen-1] = '\0'; 675 buf[buflen-2] = '*'; 676 buflen -= 2; 677 for (; cnt > 0; cnt--, data++) { 678 snprintf((char *)tbuf, sizeof(tbuf), " %d", *data); 679 for (cp = tbuf; *cp && buflen > 0; --buflen) 680 *buf++ = *cp++; 681 if (buflen <= 0) 682 return; 683 } 684 *buf = '\0'; 685 } 686 #endif 687
Indexes created Fri Sep 26 20:09:58 GMT 2025