Mercurial > dropbear

annotate svr-authpasswd.c @ 1902:4a6725ac957c

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Revert "Don't include sk keys at all in KEX list" This reverts git commit f972813ecdc7bb981d25b5a63638bd158f1c8e72. The sk algorithms need to remain in the sigalgs list so that they are included in the server-sig-algs ext-info message sent by the server. RFC8308 for server-sig-algs requires that all algorithms are listed (though OpenSSH client 8.4p1 tested doesn't require that)
author Matt Johnston <matt@ucc.asn.au>
date Thu, 24 Mar 2022 13:42:08 +0800
parents 228b086794b7
children
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
4
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
1 /*
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
2 * Dropbear - a SSH2 server
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
3 *
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
4 * Copyright (c) 2002,2003 Matt Johnston
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
5 * All rights reserved.
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
6 *
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
7 * Permission is hereby granted, free of charge, to any person obtaining a copy
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
8 * of this software and associated documentation files (the "Software"), to deal
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
9 * in the Software without restriction, including without limitation the rights
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
11 * copies of the Software, and to permit persons to whom the Software is
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
12 * furnished to do so, subject to the following conditions:
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
13 *
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
14 * The above copyright notice and this permission notice shall be included in
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
15 * all copies or substantial portions of the Software.
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
16 *
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
20 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
23 * SOFTWARE. */
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
24
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
25 /* Validates a user password */
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
26
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
27 #include "includes.h"
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
28 #include "session.h"
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
29 #include "buffer.h"
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
30 #include "dbutil.h"
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
31 #include "auth.h"
692
c58a15983808 Allow configuring "allow blank password option" at runtime
Paul Eggleton <paul.eggleton@linux.intel.com>
parents: 677
diff changeset
32 #include "runopts.h"
4
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
33
1295
750ec4ec4cbe Convert #ifdef to #if, other build changes
Matt Johnston <matt@ucc.asn.au>
parents: 1122
diff changeset
34 #if DROPBEAR_SVR_PASSWORD_AUTH
4
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
35
1086
50f8a24953e6 note about constant_time_strcmp and lengths
Matt Johnston <matt@ucc.asn.au>
parents: 817
diff changeset
36 /* not constant time when strings are differing lengths.
50f8a24953e6 note about constant_time_strcmp and lengths
Matt Johnston <matt@ucc.asn.au>
parents: 817
diff changeset
37 string content isn't leaked, and crypt hashes are predictable length. */
817
a625f9e135a4 Constant time memcmp for the hmac and password crypt
Matt Johnston <matt@ucc.asn.au>
parents: 790
diff changeset
38 static int constant_time_strcmp(const char* a, const char* b) {
a625f9e135a4 Constant time memcmp for the hmac and password crypt
Matt Johnston <matt@ucc.asn.au>
parents: 790
diff changeset
39 size_t la = strlen(a);
a625f9e135a4 Constant time memcmp for the hmac and password crypt
Matt Johnston <matt@ucc.asn.au>
parents: 790
diff changeset
40 size_t lb = strlen(b);
a625f9e135a4 Constant time memcmp for the hmac and password crypt
Matt Johnston <matt@ucc.asn.au>
parents: 790
diff changeset
41
a625f9e135a4 Constant time memcmp for the hmac and password crypt
Matt Johnston <matt@ucc.asn.au>
parents: 790
diff changeset
42 if (la != lb) {
a625f9e135a4 Constant time memcmp for the hmac and password crypt
Matt Johnston <matt@ucc.asn.au>
parents: 790
diff changeset
43 return 1;
a625f9e135a4 Constant time memcmp for the hmac and password crypt
Matt Johnston <matt@ucc.asn.au>
parents: 790
diff changeset
44 }
a625f9e135a4 Constant time memcmp for the hmac and password crypt
Matt Johnston <matt@ucc.asn.au>
parents: 790
diff changeset
45
a625f9e135a4 Constant time memcmp for the hmac and password crypt
Matt Johnston <matt@ucc.asn.au>
parents: 790
diff changeset
46 return constant_time_memcmp(a, b, la);
a625f9e135a4 Constant time memcmp for the hmac and password crypt
Matt Johnston <matt@ucc.asn.au>
parents: 790
diff changeset
47 }
a625f9e135a4 Constant time memcmp for the hmac and password crypt
Matt Johnston <matt@ucc.asn.au>
parents: 790
diff changeset
48
4
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
49 /* Process a password auth request, sending success or failure messages as
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
50 * appropriate */
1616
5d2d1021ca00 Wait to fail invalid usernames
Matt Johnston <matt@ucc.asn.au>
parents: 1295
diff changeset
51 void svr_auth_password(int valid_user) {
4
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
52
70
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents: 68
diff changeset
53 char * passwdcrypt = NULL; /* the crypt from /etc/passwd or /etc/shadow */
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents: 68
diff changeset
54 char * testcrypt = NULL; /* crypt generated from the user's password sent */
1616
5d2d1021ca00 Wait to fail invalid usernames
Matt Johnston <matt@ucc.asn.au>
parents: 1295
diff changeset
55 char * password = NULL;
4
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
56 unsigned int passwordlen;
70
b0316ce64e4b Merging in the changes from 0.41-0.43 main Dropbear tree
Matt Johnston <matt@ucc.asn.au>
parents: 68
diff changeset
57 unsigned int changepw;
4
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
58
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
59 /* check if client wants to change password */
179
161557a9dde8 * fix longstanding bug with connections being closed on failure to
Matt Johnston <matt@ucc.asn.au>
parents: 158
diff changeset
60 changepw = buf_getbool(ses.payload);
4
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
61 if (changepw) {
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
62 /* not implemented by this server */
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
63 send_msg_userauth_failure(0, 1);
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
64 return;
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
65 }
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
66
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
67 password = buf_getstring(ses.payload, &passwordlen);
1640
228b086794b7 limit password length to 100
Matt Johnston <matt@ucc.asn.au>
parents: 1616
diff changeset
68 if (valid_user && passwordlen <= DROPBEAR_MAX_PASSWORD_LEN) {
1616
5d2d1021ca00 Wait to fail invalid usernames
Matt Johnston <matt@ucc.asn.au>
parents: 1295
diff changeset
69 /* the first bytes of passwdcrypt are the salt */
5d2d1021ca00 Wait to fail invalid usernames
Matt Johnston <matt@ucc.asn.au>
parents: 1295
diff changeset
70 passwdcrypt = ses.authstate.pw_passwd;
5d2d1021ca00 Wait to fail invalid usernames
Matt Johnston <matt@ucc.asn.au>
parents: 1295
diff changeset
71 testcrypt = crypt(password, passwdcrypt);
5d2d1021ca00 Wait to fail invalid usernames
Matt Johnston <matt@ucc.asn.au>
parents: 1295
diff changeset
72 }
54
a48ba599292a burn the buffer a bit earlier
Matt Johnston <matt@ucc.asn.au>
parents: 53
diff changeset
73 m_burn(password, passwordlen);
a48ba599292a burn the buffer a bit earlier
Matt Johnston <matt@ucc.asn.au>
parents: 53
diff changeset
74 m_free(password);
4
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
75
1616
5d2d1021ca00 Wait to fail invalid usernames
Matt Johnston <matt@ucc.asn.au>
parents: 1295
diff changeset
76 /* After we have got the payload contents we can exit if the username
5d2d1021ca00 Wait to fail invalid usernames
Matt Johnston <matt@ucc.asn.au>
parents: 1295
diff changeset
77 is invalid. Invalid users have already been logged. */
5d2d1021ca00 Wait to fail invalid usernames
Matt Johnston <matt@ucc.asn.au>
parents: 1295
diff changeset
78 if (!valid_user) {
5d2d1021ca00 Wait to fail invalid usernames
Matt Johnston <matt@ucc.asn.au>
parents: 1295
diff changeset
79 send_msg_userauth_failure(0, 1);
5d2d1021ca00 Wait to fail invalid usernames
Matt Johnston <matt@ucc.asn.au>
parents: 1295
diff changeset
80 return;
5d2d1021ca00 Wait to fail invalid usernames
Matt Johnston <matt@ucc.asn.au>
parents: 1295
diff changeset
81 }
5d2d1021ca00 Wait to fail invalid usernames
Matt Johnston <matt@ucc.asn.au>
parents: 1295
diff changeset
82
1640
228b086794b7 limit password length to 100
Matt Johnston <matt@ucc.asn.au>
parents: 1616
diff changeset
83 if (passwordlen > DROPBEAR_MAX_PASSWORD_LEN) {
228b086794b7 limit password length to 100
Matt Johnston <matt@ucc.asn.au>
parents: 1616
diff changeset
84 dropbear_log(LOG_WARNING,
228b086794b7 limit password length to 100
Matt Johnston <matt@ucc.asn.au>
parents: 1616
diff changeset
85 "Too-long password attempt for '%s' from %s",
228b086794b7 limit password length to 100
Matt Johnston <matt@ucc.asn.au>
parents: 1616
diff changeset
86 ses.authstate.pw_name,
228b086794b7 limit password length to 100
Matt Johnston <matt@ucc.asn.au>
parents: 1616
diff changeset
87 svr_ses.addrstring);
228b086794b7 limit password length to 100
Matt Johnston <matt@ucc.asn.au>
parents: 1616
diff changeset
88 send_msg_userauth_failure(0, 1);
228b086794b7 limit password length to 100
Matt Johnston <matt@ucc.asn.au>
parents: 1616
diff changeset
89 return;
228b086794b7 limit password length to 100
Matt Johnston <matt@ucc.asn.au>
parents: 1616
diff changeset
90 }
228b086794b7 limit password length to 100
Matt Johnston <matt@ucc.asn.au>
parents: 1616
diff changeset
91
790
7bd88d546627 Avoid segfault for locked accounts (invalid salt to crypt())
Matt Johnston <matt@ucc.asn.au>
parents: 692
diff changeset
92 if (testcrypt == NULL) {
7bd88d546627 Avoid segfault for locked accounts (invalid salt to crypt())
Matt Johnston <matt@ucc.asn.au>
parents: 692
diff changeset
93 /* crypt() with an invalid salt like "!!" */
7bd88d546627 Avoid segfault for locked accounts (invalid salt to crypt())
Matt Johnston <matt@ucc.asn.au>
parents: 692
diff changeset
94 dropbear_log(LOG_WARNING, "User account '%s' is locked",
7bd88d546627 Avoid segfault for locked accounts (invalid salt to crypt())
Matt Johnston <matt@ucc.asn.au>
parents: 692
diff changeset
95 ses.authstate.pw_name);
7bd88d546627 Avoid segfault for locked accounts (invalid salt to crypt())
Matt Johnston <matt@ucc.asn.au>
parents: 692
diff changeset
96 send_msg_userauth_failure(0, 1);
7bd88d546627 Avoid segfault for locked accounts (invalid salt to crypt())
Matt Johnston <matt@ucc.asn.au>
parents: 692
diff changeset
97 return;
7bd88d546627 Avoid segfault for locked accounts (invalid salt to crypt())
Matt Johnston <matt@ucc.asn.au>
parents: 692
diff changeset
98 }
7bd88d546627 Avoid segfault for locked accounts (invalid salt to crypt())
Matt Johnston <matt@ucc.asn.au>
parents: 692
diff changeset
99
628
d40f3cc47aed - Add ALLOW_BLANK_PASSWORD option
Matt Johnston <matt@ucc.asn.au>
parents: 594
diff changeset
100 /* check for empty password */
d40f3cc47aed - Add ALLOW_BLANK_PASSWORD option
Matt Johnston <matt@ucc.asn.au>
parents: 594
diff changeset
101 if (passwdcrypt[0] == '\0') {
d40f3cc47aed - Add ALLOW_BLANK_PASSWORD option
Matt Johnston <matt@ucc.asn.au>
parents: 594
diff changeset
102 dropbear_log(LOG_WARNING, "User '%s' has blank password, rejected",
d40f3cc47aed - Add ALLOW_BLANK_PASSWORD option
Matt Johnston <matt@ucc.asn.au>
parents: 594
diff changeset
103 ses.authstate.pw_name);
d40f3cc47aed - Add ALLOW_BLANK_PASSWORD option
Matt Johnston <matt@ucc.asn.au>
parents: 594
diff changeset
104 send_msg_userauth_failure(0, 1);
d40f3cc47aed - Add ALLOW_BLANK_PASSWORD option
Matt Johnston <matt@ucc.asn.au>
parents: 594
diff changeset
105 return;
d40f3cc47aed - Add ALLOW_BLANK_PASSWORD option
Matt Johnston <matt@ucc.asn.au>
parents: 594
diff changeset
106 }
d40f3cc47aed - Add ALLOW_BLANK_PASSWORD option
Matt Johnston <matt@ucc.asn.au>
parents: 594
diff changeset
107
817
a625f9e135a4 Constant time memcmp for the hmac and password crypt
Matt Johnston <matt@ucc.asn.au>
parents: 790
diff changeset
108 if (constant_time_strcmp(testcrypt, passwdcrypt) == 0) {
4
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
109 /* successful authentication */
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
110 dropbear_log(LOG_NOTICE,
594
a98a2138364a Improve capitalisation for all logged strings
Matt Johnston <matt@ucc.asn.au>
parents: 464
diff changeset
111 "Password auth succeeded for '%s' from %s",
464
4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep
Matt Johnston <matt@ucc.asn.au>
parents: 179
diff changeset
112 ses.authstate.pw_name,
158
364a75cfebab Log the IP along with auth success/fail attempts
Matt Johnston <matt@ucc.asn.au>
parents: 119
diff changeset
113 svr_ses.addrstring);
4
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
114 send_msg_userauth_success();
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
115 } else {
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
116 dropbear_log(LOG_WARNING,
594
a98a2138364a Improve capitalisation for all logged strings
Matt Johnston <matt@ucc.asn.au>
parents: 464
diff changeset
117 "Bad password attempt for '%s' from %s",
464
4317be8b7cf9 Make a copy of passwd fields since getpwnam()'s retval isn't safe to keep
Matt Johnston <matt@ucc.asn.au>
parents: 179
diff changeset
118 ses.authstate.pw_name,
158
364a75cfebab Log the IP along with auth success/fail attempts
Matt Johnston <matt@ucc.asn.au>
parents: 119
diff changeset
119 svr_ses.addrstring);
4
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
120 send_msg_userauth_failure(0, 1);
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
121 }
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
122 }
fe6bca95afa7 Makefile.in contains updated files required
Matt Johnston <matt@ucc.asn.au>
parents:
diff changeset
123
68
eee77ac31ccc cleaning up the pubkey defines
Matt Johnston <matt@ucc.asn.au>
parents: 54
diff changeset
124 #endif