Mercurial > dropbear
annotate cli-auth.c @ 149:ed9ca2a9705c
Cleaned up the random code, use /dev/random by default,
and remove the addrandom() function which wasn't used.
| author | Matt Johnston <matt@ucc.asn.au> |
|---|---|
| date | Mon, 20 Dec 2004 13:11:15 +0000 |
| parents | 2be6aa26a8c9 |
| children | 0cfba3034be5 |
| rev | line source |
|---|---|
|
74
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
68
diff
changeset
|
1 /* |
|
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
68
diff
changeset
|
2 * Dropbear SSH |
|
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
68
diff
changeset
|
3 * |
|
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
68
diff
changeset
|
4 * Copyright (c) 2002,2003 Matt Johnston |
|
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
68
diff
changeset
|
5 * Copyright (c) 2004 by Mihnea Stoenescu |
|
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
68
diff
changeset
|
6 * All rights reserved. |
|
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
68
diff
changeset
|
7 * |
|
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
68
diff
changeset
|
8 * Permission is hereby granted, free of charge, to any person obtaining a copy |
|
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
68
diff
changeset
|
9 * of this software and associated documentation files (the "Software"), to deal |
|
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
68
diff
changeset
|
10 * in the Software without restriction, including without limitation the rights |
|
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
68
diff
changeset
|
11 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell |
|
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
68
diff
changeset
|
12 * copies of the Software, and to permit persons to whom the Software is |
|
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
68
diff
changeset
|
13 * furnished to do so, subject to the following conditions: |
|
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
68
diff
changeset
|
14 * |
|
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
68
diff
changeset
|
15 * The above copyright notice and this permission notice shall be included in |
|
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
68
diff
changeset
|
16 * all copies or substantial portions of the Software. |
|
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
68
diff
changeset
|
17 * |
|
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
68
diff
changeset
|
18 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR |
|
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
68
diff
changeset
|
19 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, |
|
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
68
diff
changeset
|
20 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE |
|
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
68
diff
changeset
|
21 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER |
|
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
68
diff
changeset
|
22 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, |
|
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
68
diff
changeset
|
23 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE |
|
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
68
diff
changeset
|
24 * SOFTWARE. */ |
|
e3adf4cf5465
License boilerplate etc, add Mihnea as an author to some of the files
Matt Johnston <matt@ucc.asn.au>
parents:
68
diff
changeset
|
25 |
| 33 | 26 #include "includes.h" |
| 27 #include "session.h" | |
| 28 #include "auth.h" | |
| 29 #include "dbutil.h" | |
| 30 #include "buffer.h" | |
| 31 #include "ssh.h" | |
| 32 #include "packet.h" | |
| 33 #include "runopts.h" | |
| 34 | |
|
40
b4874d772210
- Added terminal mode handling etc for the client, and window change
Matt Johnston <matt@ucc.asn.au>
parents:
37
diff
changeset
|
35 |
| 33 | 36 void cli_authinitialise() { |
| 37 | |
| 38 memset(&ses.authstate, 0, sizeof(ses.authstate)); | |
| 39 } | |
| 40 | |
| 41 | |
| 42 /* Send a "none" auth request to get available methods */ | |
| 43 void cli_auth_getmethods() { | |
| 44 | |
| 45 TRACE(("enter cli_auth_getmethods")); | |
| 46 | |
| 47 CHECKCLEARTOWRITE(); | |
| 48 | |
| 49 buf_putbyte(ses.writepayload, SSH_MSG_USERAUTH_REQUEST); | |
|
35
0ad5fb979f42
set the isserver flag (oops)
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
50 buf_putstring(ses.writepayload, cli_opts.username, |
|
0ad5fb979f42
set the isserver flag (oops)
Matt Johnston <matt@ucc.asn.au>
parents:
34
diff
changeset
|
51 strlen(cli_opts.username)); |
| 33 | 52 buf_putstring(ses.writepayload, SSH_SERVICE_CONNECTION, |
| 53 SSH_SERVICE_CONNECTION_LEN); | |
| 54 buf_putstring(ses.writepayload, "none", 4); /* 'none' method */ | |
| 55 | |
| 56 encrypt_packet(); | |
| 57 TRACE(("leave cli_auth_getmethods")); | |
| 58 | |
| 59 } | |
| 60 | |
| 43 | 61 void recv_msg_userauth_banner() { |
| 62 | |
| 63 unsigned char* banner = NULL; | |
| 64 unsigned int bannerlen; | |
| 65 unsigned int i, linecount; | |
| 66 | |
| 67 TRACE(("enter recv_msg_userauth_banner")); | |
| 68 if (ses.authstate.authdone) { | |
| 69 TRACE(("leave recv_msg_userauth_banner: banner after auth done")); | |
| 70 return; | |
| 71 } | |
| 72 | |
| 73 banner = buf_getstring(ses.payload, &bannerlen); | |
| 74 buf_eatstring(ses.payload); /* The language string */ | |
| 75 | |
| 76 if (bannerlen > MAX_BANNER_SIZE) { | |
| 77 TRACE(("recv_msg_userauth_banner: bannerlen too long: %d", bannerlen)); | |
| 78 goto out; | |
| 79 } | |
| 80 | |
| 81 cleantext(banner); | |
| 82 | |
| 83 /* Limit to 25 lines */ | |
| 84 linecount = 1; | |
| 85 for (i = 0; i < bannerlen; i++) { | |
| 86 if (banner[i] == '\n') { | |
| 87 if (linecount >= MAX_BANNER_LINES) { | |
| 88 banner[i] = '\0'; | |
| 89 break; | |
| 90 } | |
| 91 linecount++; | |
| 92 } | |
| 93 } | |
| 94 | |
| 95 printf("%s\n", banner); | |
| 96 | |
| 97 out: | |
| 98 m_free(banner); | |
| 99 TRACE(("leave recv_msg_userauth_banner")); | |
| 100 } | |
| 101 | |
| 102 | |
| 33 | 103 void recv_msg_userauth_failure() { |
| 104 | |
| 105 unsigned char * methods = NULL; | |
| 106 unsigned char * tok = NULL; | |
| 107 unsigned int methlen = 0; | |
| 108 unsigned int partial = 0; | |
| 109 unsigned int i = 0; | |
| 110 | |
| 111 TRACE(("<- MSG_USERAUTH_FAILURE")); | |
| 112 TRACE(("enter recv_msg_userauth_failure")); | |
| 113 | |
|
45
9ee8996a375f
Pubkey auth is mostly there for the client. Something strange with
Matt Johnston <matt@ucc.asn.au>
parents:
43
diff
changeset
|
114 if (cli_ses.state != USERAUTH_REQ_SENT) { |
|
9ee8996a375f
Pubkey auth is mostly there for the client. Something strange with
Matt Johnston <matt@ucc.asn.au>
parents:
43
diff
changeset
|
115 /* Perhaps we should be more fatal? */ |
|
9ee8996a375f
Pubkey auth is mostly there for the client. Something strange with
Matt Johnston <matt@ucc.asn.au>
parents:
43
diff
changeset
|
116 TRACE(("But we didn't send a userauth request!!!!!!")); |
|
9ee8996a375f
Pubkey auth is mostly there for the client. Something strange with
Matt Johnston <matt@ucc.asn.au>
parents:
43
diff
changeset
|
117 return; |
|
9ee8996a375f
Pubkey auth is mostly there for the client. Something strange with
Matt Johnston <matt@ucc.asn.au>
parents:
43
diff
changeset
|
118 } |
|
9ee8996a375f
Pubkey auth is mostly there for the client. Something strange with
Matt Johnston <matt@ucc.asn.au>
parents:
43
diff
changeset
|
119 |
|
68
eee77ac31ccc
cleaning up the pubkey defines
Matt Johnston <matt@ucc.asn.au>
parents:
45
diff
changeset
|
120 #ifdef ENABLE_CLI_PUBKEY_AUTH |
|
45
9ee8996a375f
Pubkey auth is mostly there for the client. Something strange with
Matt Johnston <matt@ucc.asn.au>
parents:
43
diff
changeset
|
121 /* If it was a pubkey auth request, we should cross that key |
|
9ee8996a375f
Pubkey auth is mostly there for the client. Something strange with
Matt Johnston <matt@ucc.asn.au>
parents:
43
diff
changeset
|
122 * off the list. */ |
|
9ee8996a375f
Pubkey auth is mostly there for the client. Something strange with
Matt Johnston <matt@ucc.asn.au>
parents:
43
diff
changeset
|
123 if (cli_ses.lastauthtype == AUTH_TYPE_PUBKEY) { |
|
9ee8996a375f
Pubkey auth is mostly there for the client. Something strange with
Matt Johnston <matt@ucc.asn.au>
parents:
43
diff
changeset
|
124 cli_pubkeyfail(); |
|
9ee8996a375f
Pubkey auth is mostly there for the client. Something strange with
Matt Johnston <matt@ucc.asn.au>
parents:
43
diff
changeset
|
125 } |
|
9ee8996a375f
Pubkey auth is mostly there for the client. Something strange with
Matt Johnston <matt@ucc.asn.au>
parents:
43
diff
changeset
|
126 #endif |
|
9ee8996a375f
Pubkey auth is mostly there for the client. Something strange with
Matt Johnston <matt@ucc.asn.au>
parents:
43
diff
changeset
|
127 |
| 33 | 128 methods = buf_getstring(ses.payload, &methlen); |
| 129 | |
| 130 partial = buf_getbyte(ses.payload); | |
| 131 | |
| 132 if (partial) { | |
| 133 dropbear_log(LOG_INFO, "Authentication partially succeeded, more attempts required"); | |
| 134 } else { | |
| 135 ses.authstate.failcount++; | |
| 136 } | |
| 137 | |
| 138 TRACE(("Methods (len %d): '%s'", methlen, methods)); | |
| 139 | |
| 140 ses.authstate.authdone=0; | |
| 141 ses.authstate.authtypes=0; | |
| 142 | |
| 143 /* Split with nulls rather than commas */ | |
| 144 for (i = 0; i < methlen; i++) { | |
| 145 if (methods[i] == ',') { | |
| 146 methods[i] = '\0'; | |
| 147 } | |
| 148 } | |
| 149 | |
| 150 tok = methods; /* tok stores the next method we'll compare */ | |
| 151 for (i = 0; i <= methlen; i++) { | |
| 152 if (methods[i] == '\0') { | |
|
34
e2a1eaa19f22
Client mostly works up to password auth
Matt Johnston <matt@ucc.asn.au>
parents:
33
diff
changeset
|
153 TRACE(("auth method '%s'", tok)); |
|
68
eee77ac31ccc
cleaning up the pubkey defines
Matt Johnston <matt@ucc.asn.au>
parents:
45
diff
changeset
|
154 #ifdef ENABLE_CLI_PUBKEY_AUTH |
| 33 | 155 if (strncmp(AUTH_METHOD_PUBKEY, tok, |
| 156 AUTH_METHOD_PUBKEY_LEN) == 0) { | |
| 157 ses.authstate.authtypes |= AUTH_TYPE_PUBKEY; | |
| 158 } | |
| 159 #endif | |
|
68
eee77ac31ccc
cleaning up the pubkey defines
Matt Johnston <matt@ucc.asn.au>
parents:
45
diff
changeset
|
160 #ifdef ENABLE_CLI_PASSWORD_AUTH |
| 33 | 161 if (strncmp(AUTH_METHOD_PASSWORD, tok, |
| 162 AUTH_METHOD_PASSWORD_LEN) == 0) { | |
| 163 ses.authstate.authtypes |= AUTH_TYPE_PASSWORD; | |
| 164 } | |
| 165 #endif | |
|
34
e2a1eaa19f22
Client mostly works up to password auth
Matt Johnston <matt@ucc.asn.au>
parents:
33
diff
changeset
|
166 tok = &methods[i+1]; /* Must make sure we don't use it after the |
|
e2a1eaa19f22
Client mostly works up to password auth
Matt Johnston <matt@ucc.asn.au>
parents:
33
diff
changeset
|
167 last loop, since it'll point to something |
|
e2a1eaa19f22
Client mostly works up to password auth
Matt Johnston <matt@ucc.asn.au>
parents:
33
diff
changeset
|
168 undefined */ |
| 33 | 169 } |
| 170 } | |
| 171 | |
|
114
2be6aa26a8c9
Leak found with MallocDebug - it's kinda useful
Matt Johnston <matt@ucc.asn.au>
parents:
74
diff
changeset
|
172 m_free(methods); |
|
2be6aa26a8c9
Leak found with MallocDebug - it's kinda useful
Matt Johnston <matt@ucc.asn.au>
parents:
74
diff
changeset
|
173 |
| 33 | 174 cli_ses.state = USERAUTH_FAIL_RCVD; |
| 175 | |
| 176 TRACE(("leave recv_msg_userauth_failure")); | |
| 177 } | |
| 178 | |
| 179 void recv_msg_userauth_success() { | |
| 180 TRACE(("received msg_userauth_success")); | |
| 181 ses.authstate.authdone = 1; | |
| 37 | 182 cli_ses.state = USERAUTH_SUCCESS_RCVD; |
| 33 | 183 } |
| 184 | |
| 185 void cli_auth_try() { | |
| 186 | |
| 187 TRACE(("enter cli_auth_try")); | |
| 188 int finished = 0; | |
| 189 | |
| 190 CHECKCLEARTOWRITE(); | |
| 191 | |
| 192 /* XXX We hardcode that we try a pubkey first */ | |
|
68
eee77ac31ccc
cleaning up the pubkey defines
Matt Johnston <matt@ucc.asn.au>
parents:
45
diff
changeset
|
193 #ifdef ENABLE_CLI_PUBKEY_AUTH |
| 33 | 194 if (ses.authstate.authtypes & AUTH_TYPE_PUBKEY) { |
| 195 finished = cli_auth_pubkey(); | |
|
45
9ee8996a375f
Pubkey auth is mostly there for the client. Something strange with
Matt Johnston <matt@ucc.asn.au>
parents:
43
diff
changeset
|
196 cli_ses.lastauthtype = AUTH_TYPE_PUBKEY; |
| 33 | 197 } |
| 198 #endif | |
| 199 | |
|
68
eee77ac31ccc
cleaning up the pubkey defines
Matt Johnston <matt@ucc.asn.au>
parents:
45
diff
changeset
|
200 #ifdef ENABLE_CLI_PASSWORD_AUTH |
| 33 | 201 if (!finished && ses.authstate.authtypes & AUTH_TYPE_PASSWORD) { |
| 202 finished = cli_auth_password(); | |
|
45
9ee8996a375f
Pubkey auth is mostly there for the client. Something strange with
Matt Johnston <matt@ucc.asn.au>
parents:
43
diff
changeset
|
203 cli_ses.lastauthtype = AUTH_TYPE_PASSWORD; |
| 33 | 204 } |
| 205 #endif | |
| 206 | |
| 207 if (!finished) { | |
| 208 dropbear_exit("No auth methods could be used."); | |
| 209 } | |
| 210 | |
| 211 TRACE(("leave cli_auth_try")); | |
| 212 } |