fa325e9b42
Remote whitespace at the ends of lines. Remove blank lines from the ends of files. Change modes on source files so that they are not executable. Signed-off-by: Dan Cross <cross@gajendra.net>
353 lines
6.2 KiB
C
353 lines
6.2 KiB
C
/*
|
|
* APOP, CRAM - MD5 challenge/response authentication
|
|
*
|
|
* The client does not authenticate the server, hence no CAI.
|
|
*
|
|
* Protocol:
|
|
*
|
|
* S -> C: random@domain
|
|
* C -> S: user hex-response
|
|
* S -> C: ok
|
|
*
|
|
* Note that this is the protocol between factotum and the local
|
|
* program, not between the two factotums. The information
|
|
* exchanged here is wrapped in the APOP protocol by the local
|
|
* programs.
|
|
*
|
|
* If S sends "bad [msg]" instead of "ok", that is a hint that the key is bad.
|
|
* The protocol goes back to "C -> S: user hex-response".
|
|
*/
|
|
|
|
#include "std.h"
|
|
#include "dat.h"
|
|
|
|
extern Proto apop, cram;
|
|
|
|
static int
|
|
apopcheck(Key *k)
|
|
{
|
|
if(!strfindattr(k->attr, "user") || !strfindattr(k->privattr, "!password")){
|
|
werrstr("need user and !password attributes");
|
|
return -1;
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
static int
|
|
apopclient(Conv *c)
|
|
{
|
|
char *chal, *pw, *res;
|
|
int astype, nchal, npw, ntry, ret;
|
|
uchar resp[MD5dlen];
|
|
Attr *attr;
|
|
DigestState *ds;
|
|
Key *k;
|
|
|
|
chal = nil;
|
|
k = nil;
|
|
res = nil;
|
|
ret = -1;
|
|
attr = c->attr;
|
|
|
|
if(c->proto == &apop)
|
|
astype = AuthApop;
|
|
else if(c->proto == &cram)
|
|
astype = AuthCram;
|
|
else{
|
|
werrstr("bad proto");
|
|
goto out;
|
|
}
|
|
|
|
c->state = "find key";
|
|
k = keyfetch(c, "%A %s", attr, c->proto->keyprompt);
|
|
if(k == nil)
|
|
goto out;
|
|
|
|
c->state = "read challenge";
|
|
if((nchal = convreadm(c, &chal)) < 0)
|
|
goto out;
|
|
|
|
for(ntry=1;; ntry++){
|
|
if(c->attr != attr)
|
|
freeattr(c->attr);
|
|
c->attr = addattrs(copyattr(attr), k->attr);
|
|
if((pw = strfindattr(k->privattr, "!password")) == nil){
|
|
werrstr("key has no password (cannot happen?)");
|
|
goto out;
|
|
}
|
|
npw = strlen(pw);
|
|
|
|
switch(astype){
|
|
case AuthApop:
|
|
ds = md5((uchar*)chal, nchal, nil, nil);
|
|
md5((uchar*)pw, npw, resp, ds);
|
|
break;
|
|
case AuthCram:
|
|
hmac_md5((uchar*)chal, nchal, (uchar*)pw, npw, resp, nil);
|
|
break;
|
|
}
|
|
|
|
/* C->S: APOP user hex-response\n */
|
|
if(ntry == 1)
|
|
c->state = "write user";
|
|
else{
|
|
sprint(c->statebuf, "write user (auth attempt #%d)", ntry);
|
|
c->state = c->statebuf;
|
|
}
|
|
if(convprint(c, "%s", strfindattr(k->attr, "user")) < 0)
|
|
goto out;
|
|
|
|
c->state = "write response";
|
|
if(convprint(c, "%.*H", sizeof resp, resp) < 0)
|
|
goto out;
|
|
|
|
c->state = "read result";
|
|
if(convreadm(c, &res) < 0)
|
|
goto out;
|
|
|
|
if(strcmp(res, "ok") == 0)
|
|
break;
|
|
|
|
if(strncmp(res, "bad ", 4) != 0){
|
|
werrstr("bad result: %s", res);
|
|
goto out;
|
|
}
|
|
|
|
c->state = "replace key";
|
|
if((k = keyreplace(c, k, "%s", res+4)) == nil){
|
|
c->state = "auth failed";
|
|
werrstr("%s", res+4);
|
|
goto out;
|
|
}
|
|
free(res);
|
|
res = nil;
|
|
}
|
|
|
|
werrstr("succeeded");
|
|
ret = 0;
|
|
|
|
out:
|
|
keyclose(k);
|
|
free(chal);
|
|
if(c->attr != attr)
|
|
freeattr(attr);
|
|
return ret;
|
|
}
|
|
|
|
/* shared with auth dialing routines */
|
|
typedef struct ServerState ServerState;
|
|
struct ServerState
|
|
{
|
|
int asfd;
|
|
Key *k;
|
|
Ticketreq tr;
|
|
Ticket t;
|
|
char *dom;
|
|
char *hostid;
|
|
};
|
|
|
|
enum
|
|
{
|
|
APOPCHALLEN = 128
|
|
};
|
|
|
|
static int apopchal(ServerState*, int, char[APOPCHALLEN]);
|
|
static int apopresp(ServerState*, char*, char*);
|
|
|
|
static int
|
|
apopserver(Conv *c)
|
|
{
|
|
char chal[APOPCHALLEN], *user, *resp;
|
|
ServerState s;
|
|
int astype, ret;
|
|
Attr *a;
|
|
|
|
ret = -1;
|
|
user = nil;
|
|
resp = nil;
|
|
memset(&s, 0, sizeof s);
|
|
s.asfd = -1;
|
|
|
|
if(c->proto == &apop)
|
|
astype = AuthApop;
|
|
else if(c->proto == &cram)
|
|
astype = AuthCram;
|
|
else{
|
|
werrstr("bad proto");
|
|
goto out;
|
|
}
|
|
|
|
c->state = "find key";
|
|
if((s.k = plan9authkey(c->attr)) == nil)
|
|
goto out;
|
|
|
|
a = copyattr(s.k->attr);
|
|
a = delattr(a, "proto");
|
|
c->attr = addattrs(c->attr, a);
|
|
freeattr(a);
|
|
|
|
c->state = "authdial";
|
|
s.hostid = strfindattr(s.k->attr, "user");
|
|
s.dom = strfindattr(s.k->attr, "dom");
|
|
if((s.asfd = xioauthdial(nil, s.dom)) < 0){
|
|
werrstr("authdial %s: %r", s.dom);
|
|
goto out;
|
|
}
|
|
|
|
c->state = "authchal";
|
|
if(apopchal(&s, astype, chal) < 0)
|
|
goto out;
|
|
|
|
c->state = "write challenge";
|
|
if(convprint(c, "%s", chal) < 0)
|
|
goto out;
|
|
|
|
for(;;){
|
|
c->state = "read user";
|
|
if(convreadm(c, &user) < 0)
|
|
goto out;
|
|
|
|
c->state = "read response";
|
|
if(convreadm(c, &resp) < 0)
|
|
goto out;
|
|
|
|
c->state = "authwrite";
|
|
switch(apopresp(&s, user, resp)){
|
|
case -1:
|
|
goto out;
|
|
case 0:
|
|
c->state = "write status";
|
|
if(convprint(c, "bad authentication failed") < 0)
|
|
goto out;
|
|
break;
|
|
case 1:
|
|
c->state = "write status";
|
|
if(convprint(c, "ok") < 0)
|
|
goto out;
|
|
goto ok;
|
|
}
|
|
free(user);
|
|
free(resp);
|
|
user = nil;
|
|
resp = nil;
|
|
}
|
|
|
|
ok:
|
|
ret = 0;
|
|
c->attr = addcap(c->attr, c->sysuser, &s.t);
|
|
|
|
out:
|
|
keyclose(s.k);
|
|
free(user);
|
|
free(resp);
|
|
xioclose(s.asfd);
|
|
return ret;
|
|
}
|
|
|
|
static int
|
|
apopchal(ServerState *s, int astype, char chal[APOPCHALLEN])
|
|
{
|
|
char trbuf[TICKREQLEN];
|
|
Ticketreq tr;
|
|
|
|
memset(&tr, 0, sizeof tr);
|
|
|
|
tr.type = astype;
|
|
|
|
if(strlen(s->hostid) >= sizeof tr.hostid){
|
|
werrstr("hostid too long");
|
|
return -1;
|
|
}
|
|
strcpy(tr.hostid, s->hostid);
|
|
|
|
if(strlen(s->dom) >= sizeof tr.authdom){
|
|
werrstr("domain too long");
|
|
return -1;
|
|
}
|
|
strcpy(tr.authdom, s->dom);
|
|
|
|
convTR2M(&tr, trbuf);
|
|
if(xiowrite(s->asfd, trbuf, TICKREQLEN) != TICKREQLEN)
|
|
return -1;
|
|
|
|
if(xioasrdresp(s->asfd, chal, APOPCHALLEN) <= 5)
|
|
return -1;
|
|
|
|
s->tr = tr;
|
|
return 0;
|
|
}
|
|
|
|
static int
|
|
apopresp(ServerState *s, char *user, char *resp)
|
|
{
|
|
char tabuf[TICKETLEN+AUTHENTLEN];
|
|
char trbuf[TICKREQLEN];
|
|
int len;
|
|
Authenticator a;
|
|
Ticket t;
|
|
Ticketreq tr;
|
|
|
|
tr = s->tr;
|
|
if(memrandom(tr.chal, CHALLEN) < 0)
|
|
return -1;
|
|
|
|
if(strlen(user) >= sizeof tr.uid){
|
|
werrstr("uid too long");
|
|
return -1;
|
|
}
|
|
strcpy(tr.uid, user);
|
|
|
|
convTR2M(&tr, trbuf);
|
|
if(xiowrite(s->asfd, trbuf, TICKREQLEN) != TICKREQLEN)
|
|
return -1;
|
|
|
|
len = strlen(resp);
|
|
if(xiowrite(s->asfd, resp, len) != len)
|
|
return -1;
|
|
|
|
if(xioasrdresp(s->asfd, tabuf, TICKETLEN+AUTHENTLEN) != TICKETLEN+AUTHENTLEN)
|
|
return 0;
|
|
|
|
convM2T(tabuf, &t, s->k->priv);
|
|
if(t.num != AuthTs
|
|
|| memcmp(t.chal, tr.chal, sizeof tr.chal) != 0){
|
|
werrstr("key mismatch with auth server");
|
|
return -1;
|
|
}
|
|
|
|
convM2A(tabuf+TICKETLEN, &a, t.key);
|
|
if(a.num != AuthAc
|
|
|| memcmp(a.chal, tr.chal, sizeof a.chal) != 0
|
|
|| a.id != 0){
|
|
werrstr("key2 mismatch with auth server");
|
|
return -1;
|
|
}
|
|
|
|
s->t = t;
|
|
return 1;
|
|
}
|
|
|
|
static Role
|
|
apoproles[] =
|
|
{
|
|
"client", apopclient,
|
|
"server", apopserver,
|
|
0
|
|
};
|
|
|
|
Proto apop = {
|
|
"apop",
|
|
apoproles,
|
|
"user? !password?",
|
|
apopcheck,
|
|
nil
|
|
};
|
|
|
|
Proto cram = {
|
|
"cram",
|
|
apoproles,
|
|
"user? !password?",
|
|
apopcheck,
|
|
nil
|
|
};
|