Branch data     Line data    Source code

       1                 :            : /* $OpenBSD: auth-chall.c,v 1.13 2013/05/17 00:13:13 djm Exp $ */
       2                 :            : /*
       3                 :            :  * Copyright (c) 2001 Markus Friedl.  All rights reserved.
       4                 :            :  *
       5                 :            :  * Redistribution and use in source and binary forms, with or without
       6                 :            :  * modification, are permitted provided that the following conditions
       7                 :            :  * are met:
       8                 :            :  * 1. Redistributions of source code must retain the above copyright
       9                 :            :  *    notice, this list of conditions and the following disclaimer.
      10                 :            :  * 2. Redistributions in binary form must reproduce the above copyright
      11                 :            :  *    notice, this list of conditions and the following disclaimer in the
      12                 :            :  *    documentation and/or other materials provided with the distribution.
      13                 :            :  *
      14                 :            :  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
      15                 :            :  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
      16                 :            :  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
      17                 :            :  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
      18                 :            :  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
      19                 :            :  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
      20                 :            :  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
      21                 :            :  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
      22                 :            :  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
      23                 :            :  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
      24                 :            :  */
      25                 :            : 
      26                 :            : #include "includes.h"
      27                 :            : 
      28                 :            : #include <sys/types.h>
      29                 :            : 
      30                 :            : #include <stdarg.h>
      31                 :            : 
      32                 :            : #include "xmalloc.h"
      33                 :            : #include "key.h"
      34                 :            : #include "hostfile.h"
      35                 :            : #include "auth.h"
      36                 :            : #include "log.h"
      37                 :            : #include "servconf.h"
      38                 :            : 
      39                 :            : /* limited protocol v1 interface to kbd-interactive authentication */
      40                 :            : 
      41                 :            : extern KbdintDevice *devices[];
      42                 :            : static KbdintDevice *device;
      43                 :            : extern ServerOptions options;
      44                 :            : 
      45                 :            : char *
      46                 :          0 : get_challenge(Authctxt *authctxt)
      47                 :            : {
      48                 :            :         char *challenge, *name, *info, **prompts;
      49                 :            :         u_int i, numprompts;
      50                 :            :         u_int *echo_on;
      51                 :            : 
      52                 :            : #ifdef USE_PAM
      53                 :            :         if (!options.use_pam)
      54                 :            :                 remove_kbdint_device("pam");
      55                 :            : #endif
      56                 :            : 
      57                 :          0 :         device = devices[0]; /* we always use the 1st device for protocol 1 */
      58         [ #  # ]:          0 :         if (device == NULL)
      59                 :            :                 return NULL;
      60         [ #  # ]:          0 :         if ((authctxt->kbdintctxt = device->init_ctx(authctxt)) == NULL)
      61                 :            :                 return NULL;
      62         [ #  # ]:          0 :         if (device->query(authctxt->kbdintctxt, &name, &info,
      63                 :            :             &numprompts, &prompts, &echo_on)) {
      64                 :          0 :                 device->free_ctx(authctxt->kbdintctxt);
      65                 :          0 :                 authctxt->kbdintctxt = NULL;
      66                 :          0 :                 return NULL;
      67                 :            :         }
      68         [ #  # ]:          0 :         if (numprompts < 1)
      69                 :          0 :                 fatal("get_challenge: numprompts < 1");
      70                 :          0 :         challenge = xstrdup(prompts[0]);
      71         [ #  # ]:          0 :         for (i = 0; i < numprompts; i++)
      72                 :          0 :                 free(prompts[i]);
      73                 :          0 :         free(prompts);
      74                 :          0 :         free(name);
      75                 :          0 :         free(echo_on);
      76                 :          0 :         free(info);
      77                 :            : 
      78                 :          0 :         return (challenge);
      79                 :            : }
      80                 :            : int
      81                 :          0 : verify_response(Authctxt *authctxt, const char *response)
      82                 :            : {
      83                 :            :         char *resp[1], *name, *info, **prompts;
      84                 :            :         u_int i, numprompts, *echo_on;
      85                 :          0 :         int authenticated = 0;
      86                 :            : 
      87         [ #  # ]:          0 :         if (device == NULL)
      88                 :            :                 return 0;
      89         [ #  # ]:          0 :         if (authctxt->kbdintctxt == NULL)
      90                 :            :                 return 0;
      91                 :          0 :         resp[0] = (char *)response;
      92      [ #  #  # ]:          0 :         switch (device->respond(authctxt->kbdintctxt, 1, resp)) {
      93                 :            :         case 0: /* Success */
      94                 :          0 :                 authenticated = 1;
      95                 :          0 :                 break;
      96                 :            :         case 1: /* Postponed - retry with empty query for PAM */
      97         [ #  # ]:          0 :                 if ((device->query(authctxt->kbdintctxt, &name, &info,
      98                 :            :                     &numprompts, &prompts, &echo_on)) != 0)
      99                 :            :                         break;
     100   [ #  #  #  # ]:          0 :                 if (numprompts == 0 &&
     101                 :          0 :                     device->respond(authctxt->kbdintctxt, 0, resp) == 0)
     102                 :          0 :                         authenticated = 1;
     103                 :            : 
     104         [ #  # ]:          0 :                 for (i = 0; i < numprompts; i++)
     105                 :          0 :                         free(prompts[i]);
     106                 :          0 :                 free(prompts);
     107                 :          0 :                 free(name);
     108                 :          0 :                 free(echo_on);
     109                 :          0 :                 free(info);
     110                 :          0 :                 break;
     111                 :            :         }
     112                 :          0 :         device->free_ctx(authctxt->kbdintctxt);
     113                 :          0 :         authctxt->kbdintctxt = NULL;
     114                 :          0 :         return authenticated;
     115                 :            : }
     116                 :            : void
     117                 :          0 : abandon_challenge_response(Authctxt *authctxt)
     118                 :            : {
     119         [ #  # ]:          0 :         if (authctxt->kbdintctxt != NULL) {
     120                 :          0 :                 device->free_ctx(authctxt->kbdintctxt);
     121                 :          0 :                 authctxt->kbdintctxt = NULL;
     122                 :            :         }
     123                 :          0 : }