=================================================================== RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/ssh/Attic/auth1.c,v retrieving revision 1.22.2.3 retrieving revision 1.23 diff -u -r1.22.2.3 -r1.23 --- src/usr.bin/ssh/Attic/auth1.c 2002/06/02 22:56:09 1.22.2.3 +++ src/usr.bin/ssh/Attic/auth1.c 2001/05/18 14:13:28 1.23 @@ -10,7 +10,7 @@ */ #include "includes.h" -RCSID("$OpenBSD: auth1.c,v 1.22.2.3 2002/06/02 22:56:09 miod Exp $"); +RCSID("$OpenBSD: auth1.c,v 1.23 2001/05/18 14:13:28 markus Exp $"); #include "xmalloc.h" #include "rsa.h" @@ -22,10 +22,8 @@ #include "servconf.h" #include "compat.h" #include "auth.h" -#include "channels.h" #include "session.h" -#include "uidswap.h" -#include "monitor_wrap.h" +#include "misc.h" /* import */ extern ServerOptions options; @@ -33,7 +31,7 @@ /* * convert ssh auth msg type into description */ -static char * +char * get_authname(int type) { static char buf[1024]; @@ -49,7 +47,7 @@ case SSH_CMSG_AUTH_TIS: case SSH_CMSG_AUTH_TIS_RESPONSE: return "challenge-response"; -#if defined(KRB4) || defined(KRB5) +#ifdef KRB4 case SSH_CMSG_AUTH_KERBEROS: return "kerberos"; #endif @@ -62,29 +60,30 @@ * read packets, try to authenticate the user and * return only if authentication is successful */ -static void +void do_authloop(Authctxt *authctxt) { int authenticated = 0; u_int bits; - Key *client_host_key; + RSA *client_host_key; BIGNUM *n; char *client_user, *password; char info[1024]; u_int dlen; + int plen, nlen, elen; u_int ulen; int type = 0; struct passwd *pw = authctxt->pw; debug("Attempting authentication for %s%.100s.", - authctxt->valid ? "" : "illegal user ", authctxt->user); + authctxt->valid ? "" : "illegal user ", authctxt->user); /* If the user has no password, accept authentication immediately. */ if (options.password_authentication && -#if defined(KRB4) || defined(KRB5) +#ifdef KRB4 (!options.kerberos_authentication || options.kerberos_or_local_passwd) && #endif - PRIVSEP(auth_password(authctxt, ""))) { + auth_password(authctxt, "")) { auth_log(authctxt, 1, "without authentication", ""); return; } @@ -101,67 +100,66 @@ info[0] = '\0'; /* Get a packet from the client. */ - type = packet_read(); + type = packet_read(&plen); /* Process the packet. */ switch (type) { +#ifdef AFS + case SSH_CMSG_HAVE_KERBEROS_TGT: + if (!options.kerberos_tgt_passing) { + verbose("Kerberos tgt passing disabled."); + break; + } else { + /* Accept Kerberos tgt. */ + char *tgt = packet_get_string(&dlen); + packet_integrity_check(plen, 4 + dlen, type); + if (!auth_kerberos_tgt(pw, tgt)) + verbose("Kerberos tgt REFUSED for %.100s", authctxt->user); + xfree(tgt); + } + continue; -#if defined(KRB4) || defined(KRB5) + case SSH_CMSG_HAVE_AFS_TOKEN: + if (!options.afs_token_passing || !k_hasafs()) { + verbose("AFS token passing disabled."); + break; + } else { + /* Accept AFS token. */ + char *token_string = packet_get_string(&dlen); + packet_integrity_check(plen, 4 + dlen, type); + if (!auth_afs_token(pw, token_string)) + verbose("AFS token REFUSED for %.100s", authctxt->user); + xfree(token_string); + } + continue; +#endif /* AFS */ +#ifdef KRB4 case SSH_CMSG_AUTH_KERBEROS: if (!options.kerberos_authentication) { verbose("Kerberos authentication disabled."); + break; } else { - char *kdata = packet_get_string(&dlen); - packet_check_eom(); + /* Try Kerberos v4 authentication. */ + KTEXT_ST auth; + char *tkt_user = NULL; + char *kdata = packet_get_string((u_int *) &auth.length); + packet_integrity_check(plen, 4 + auth.length, type); - if (kdata[0] == 4) { /* KRB_PROT_VERSION */ -#ifdef KRB4 - KTEXT_ST tkt; - - tkt.length = dlen; - if (tkt.length < MAX_KTXT_LEN) - memcpy(tkt.dat, kdata, tkt.length); - - if (auth_krb4(authctxt, &tkt, &client_user)) { - authenticated = 1; - snprintf(info, sizeof(info), - " tktuser %.100s", - client_user); - xfree(client_user); + if (authctxt->valid) { + if (auth.length < MAX_KTXT_LEN) + memcpy(auth.dat, kdata, auth.length); + authenticated = auth_krb4(pw->pw_name, &auth, &tkt_user); + if (authenticated) { + snprintf(info, sizeof info, + " tktuser %.100s", tkt_user); + xfree(tkt_user); } -#endif /* KRB4 */ - } else { -#ifdef KRB5 - krb5_data tkt; - tkt.length = dlen; - tkt.data = kdata; - - if (auth_krb5(authctxt, &tkt, &client_user)) { - authenticated = 1; - snprintf(info, sizeof(info), - " tktuser %.100s", - client_user); - xfree(client_user); - } -#endif /* KRB5 */ } xfree(kdata); } break; -#endif /* KRB4 || KRB5 */ +#endif /* KRB4 */ -#if defined(AFS) || defined(KRB5) - /* XXX - punt on backward compatibility here. */ - case SSH_CMSG_HAVE_KERBEROS_TGT: - packet_send_debug("Kerberos TGT passing disabled before authentication."); - break; -#ifdef AFS - case SSH_CMSG_HAVE_AFS_TOKEN: - packet_send_debug("AFS token passing disabled before authentication."); - break; -#endif /* AFS */ -#endif /* AFS || KRB5 */ - case SSH_CMSG_AUTH_RHOSTS: if (!options.rhosts_authentication) { verbose("Rhosts authentication disabled."); @@ -174,7 +172,7 @@ * IP-spoofing on a local network.) */ client_user = packet_get_string(&ulen); - packet_check_eom(); + packet_integrity_check(plen, 4 + ulen, type); /* Try to authenticate using /etc/hosts.equiv and .rhosts. */ authenticated = auth_rhosts(pw, client_user); @@ -196,20 +194,24 @@ client_user = packet_get_string(&ulen); /* Get the client host key. */ - client_host_key = key_new(KEY_RSA1); + client_host_key = RSA_new(); + if (client_host_key == NULL) + fatal("RSA_new failed"); + client_host_key->e = BN_new(); + client_host_key->n = BN_new(); + if (client_host_key->e == NULL || client_host_key->n == NULL) + fatal("BN_new failed"); bits = packet_get_int(); - packet_get_bignum(client_host_key->rsa->e); - packet_get_bignum(client_host_key->rsa->n); + packet_get_bignum(client_host_key->e, &elen); + packet_get_bignum(client_host_key->n, &nlen); - if (bits != BN_num_bits(client_host_key->rsa->n)) + if (bits != BN_num_bits(client_host_key->n)) verbose("Warning: keysize mismatch for client_host_key: " - "actual %d, announced %d", - BN_num_bits(client_host_key->rsa->n), bits); - packet_check_eom(); + "actual %d, announced %d", BN_num_bits(client_host_key->n), bits); + packet_integrity_check(plen, (4 + ulen) + 4 + elen + nlen, type); - authenticated = auth_rhosts_rsa(pw, client_user, - client_host_key); - key_free(client_host_key); + authenticated = auth_rhosts_rsa(pw, client_user, client_host_key); + RSA_free(client_host_key); snprintf(info, sizeof info, " ruser %.100s", client_user); xfree(client_user); @@ -221,10 +223,9 @@ break; } /* RSA authentication requested. */ - if ((n = BN_new()) == NULL) - fatal("do_authloop: BN_new failed"); - packet_get_bignum(n); - packet_check_eom(); + n = BN_new(); + packet_get_bignum(n, &nlen); + packet_integrity_check(plen, nlen, type); authenticated = auth_rsa(pw, n); BN_clear_free(n); break; @@ -240,10 +241,10 @@ * not visible to an outside observer. */ password = packet_get_string(&dlen); - packet_check_eom(); + packet_integrity_check(plen, 4 + dlen, type); /* Try authentication with the password. */ - authenticated = PRIVSEP(auth_password(authctxt, password)); + authenticated = auth_password(authctxt, password); memset(password, 0, strlen(password)); xfree(password); @@ -269,7 +270,7 @@ if (options.challenge_response_authentication == 1) { char *response = packet_get_string(&dlen); debug("got response '%s'", response); - packet_check_eom(); + packet_integrity_check(plen, 4 + dlen, type); authenticated = verify_response(authctxt, response); memset(response, 'r', dlen); xfree(response); @@ -318,52 +319,47 @@ * Performs authentication of an incoming connection. Session key has already * been exchanged and encryption is enabled. */ -Authctxt * -do_authentication(void) +void +do_authentication() { Authctxt *authctxt; + struct passwd *pw; + int plen; u_int ulen; char *user, *style = NULL; /* Get the name of the user that we wish to log in as. */ - packet_read_expect(SSH_CMSG_USER); + packet_read_expect(&plen, SSH_CMSG_USER); /* Get the user name. */ user = packet_get_string(&ulen); - packet_check_eom(); + packet_integrity_check(plen, (4 + ulen), SSH_CMSG_USER); if ((style = strchr(user, ':')) != NULL) - *style++ = '\0'; + *style++ = 0; -#ifdef KRB5 - /* XXX - SSH.com Kerberos v5 braindeath. */ - if ((datafellows & SSH_BUG_K5USER) && - options.kerberos_authentication) { - char *p; - if ((p = strchr(user, '@')) != NULL) - *p = '\0'; - } -#endif - authctxt = authctxt_new(); authctxt->user = user; authctxt->style = style; /* Verify that the user is a valid user. */ - if ((authctxt->pw = PRIVSEP(getpwnamallow(user))) != NULL) + pw = getpwnam(user); + if (pw && allowed_user(pw)) { authctxt->valid = 1; - else + pw = pwcopy(pw); + } else { debug("do_authentication: illegal user %s", user); + pw = NULL; + } + authctxt->pw = pw; - setproctitle("%s%s", authctxt->pw ? user : "unknown", - use_privsep ? " [net]" : ""); + setproctitle("%s", pw ? user : "unknown"); /* * If we are not running as root, the user must have the same uid as * the server. */ - if (!use_privsep && getuid() != 0 && authctxt->pw && - authctxt->pw->pw_uid != getuid()) + if (getuid() != 0 && pw && pw->pw_uid != getuid()) packet_disconnect("Cannot change user when server not running as root."); /* @@ -377,5 +373,6 @@ packet_send(); packet_write_wait(); - return (authctxt); + /* Perform session preparation. */ + do_authenticated(authctxt); }