[gssapi-openssh.git] / openssh / auth.h

/*
 * Copyright (c) 2000 Markus Friedl.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 *
 * $OpenBSD: auth.h,v 1.22 2001/06/26 17:27:22 markus Exp $
 */
#ifndef AUTH_H
#define AUTH_H

#include "key.h"
#include "hostfile.h"
#include <openssl/rsa.h>

#ifdef HAVE_LOGIN_CAP
#include <login_cap.h>
#endif
#ifdef BSD_AUTH
#include <bsd_auth.h>
#endif
#ifdef KRB5
#include <krb5.h>
#endif

typedef struct Authctxt Authctxt;
typedef struct KbdintDevice KbdintDevice;

struct Authctxt {
	int		 success;
	int		 postponed;
	int		 valid;
	int		 attempt;
	int		 failures;
	char		*user;
	char		*service;
	struct passwd	*pw;
	char		*style;
	void		*kbdintctxt;
#ifdef BSD_AUTH
	auth_session_t	*as;
#endif
#ifdef KRB4
	char		*krb4_ticket_file;
#endif
#ifdef KRB5
	krb5_context	 krb5_ctx;
	krb5_auth_context krb5_auth_ctx;
	krb5_ccache	 krb5_fwd_ccache;
	krb5_principal	 krb5_user;
	char		*krb5_ticket_file;
#endif
};

/*
 * Keyboard interactive device:
 * init_ctx	returns: non NULL upon success 
 * query	returns: 0 - success, otherwise failure 
 * respond	returns: 0 - success, 1 - need further interaction,
 *		otherwise - failure
 */
struct KbdintDevice
{
	const char *name;
	void*	(*init_ctx)	__P((Authctxt*));
	int	(*query)	__P((void *ctx, char **name, char **infotxt,
				u_int *numprompts, char ***prompts,
				u_int **echo_on));
	int	(*respond)	__P((void *ctx, u_int numresp, char **responses));
	void	(*free_ctx)	__P((void *ctx));
};

int     auth_rhosts(struct passwd *, const char *);
int
auth_rhosts2(struct passwd *, const char *, const char *, const char *);

int	 auth_rhosts_rsa(struct passwd *, const char *, RSA *);
int      auth_password(Authctxt *, const char *);
int      auth_rsa(struct passwd *, BIGNUM *);
int      auth_rsa_read_key(char **, u_int *, BIGNUM *, BIGNUM *);
int      auth_rsa_challenge_dialog(RSA *);

#ifdef KRB4
#include <krb.h>
int     auth_krb4(Authctxt *, KTEXT, char **);
int	auth_krb4_password(Authctxt *, const char *);
void    krb4_cleanup_proc(void *);

#ifdef AFS
#include <kafs.h>
int     auth_krb4_tgt(Authctxt *, const char *);
int     auth_afs_token(Authctxt *, const char *);
#endif /* AFS */

#endif /* KRB4 */

#ifdef KRB5
int	auth_krb5(Authctxt *authctxt, krb5_data *auth, char **client);
int	auth_krb5_tgt(Authctxt *authctxt, krb5_data *tgt);
int	auth_krb5_password(Authctxt *authctxt, const char *password);
void	krb5_cleanup_proc(void *authctxt);
#endif /* KRB5 */

#include "auth-pam.h"
#include "auth2-pam.h"

void	do_authentication(void);
void	do_authentication2(void);

Authctxt *authctxt_new(void);
void	auth_log(Authctxt *, int, char *, char *);
void	userauth_finish(Authctxt *, int, char *);
int	auth_root_allowed(char *);

int	auth2_challenge(Authctxt *, char *);

int	allowed_user(struct passwd *);

char	*get_challenge(Authctxt *);
int	verify_response(Authctxt *, const char *);

struct passwd * auth_get_user(void);

char	*expand_filename(const char *, struct passwd *);
char	*authorized_keys_file(struct passwd *);
char	*authorized_keys_file2(struct passwd *);

int
secure_filename(FILE *, const char *, struct passwd *, char *, size_t);

HostStatus
check_key_in_hostfiles(struct passwd *, Key *, const char *,
    const char *, const char *);

#define AUTH_FAIL_MAX 6
#define AUTH_FAIL_LOG (AUTH_FAIL_MAX/2)
#define AUTH_FAIL_MSG "Too many authentication failures for %.100s"

#endif
Commit	Line	Data
3c0ef626	1	/*
	2	* Copyright (c) 2000 Markus Friedl. All rights reserved.
	3	*
	4	* Redistribution and use in source and binary forms, with or without
	5	* modification, are permitted provided that the following conditions
	6	* are met:
	7	* 1. Redistributions of source code must retain the above copyright
	8	* notice, this list of conditions and the following disclaimer.
	9	* 2. Redistributions in binary form must reproduce the above copyright
	10	* notice, this list of conditions and the following disclaimer in the
	11	* documentation and/or other materials provided with the distribution.
	12	*
	13	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
	14	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
	15	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
	16	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
	17	* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
	18	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
	19	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
	20	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	21	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
	22	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	23	*
	24	* $OpenBSD: auth.h,v 1.22 2001/06/26 17:27:22 markus Exp $
	25	*/
	26	#ifndef AUTH_H
	27	#define AUTH_H
	28
	29	#include "key.h"
	30	#include "hostfile.h"
	31	#include <openssl/rsa.h>
	32
	33	#ifdef HAVE_LOGIN_CAP
	34	#include <login_cap.h>
	35	#endif
	36	#ifdef BSD_AUTH
	37	#include <bsd_auth.h>
	38	#endif
	39	#ifdef KRB5
	40	#include <krb5.h>
	41	#endif
	42
	43	typedef struct Authctxt Authctxt;
	44	typedef struct KbdintDevice KbdintDevice;
	45
	46	struct Authctxt {
	47	int success;
	48	int postponed;
	49	int valid;
	50	int attempt;
	51	int failures;
	52	char *user;
	53	char *service;
	54	struct passwd *pw;
	55	char *style;
	56	void *kbdintctxt;
	57	#ifdef BSD_AUTH
	58	auth_session_t *as;
	59	#endif
	60	#ifdef KRB4
	61	char *krb4_ticket_file;
	62	#endif
	63	#ifdef KRB5
	64	krb5_context krb5_ctx;
65	krb5_auth_context krb5_auth_ctx;
66	krb5_ccache krb5_fwd_ccache;
67	krb5_principal krb5_user;
68	char *krb5_ticket_file;
69	#endif
70	};
71
72	/*
73	* Keyboard interactive device:
74	* init_ctx returns: non NULL upon success
75	* query returns: 0 - success, otherwise failure
76	* respond returns: 0 - success, 1 - need further interaction,
77	* otherwise - failure
78	*/
79	struct KbdintDevice
80	{
81	const char *name;
82	void* (init_ctx) __P((Authctxt));
83	int (query) __P((void ctx, char name, char infotxt,
84	u_int numprompts, char **prompts,
85	u_int **echo_on));
86	int (respond) __P((void ctx, u_int numresp, char **responses));
87	void (free_ctx) __P((void ctx));
88	};
89
90	int auth_rhosts(struct passwd , const char );
91	int
92	auth_rhosts2(struct passwd , const char , const char , const char );
93
94	int auth_rhosts_rsa(struct passwd , const char , RSA *);
95	int auth_password(Authctxt , const char );
96	int auth_rsa(struct passwd , BIGNUM );
97	int auth_rsa_read_key(char *, u_int , BIGNUM , BIGNUM );
98	int auth_rsa_challenge_dialog(RSA *);
99
100	#ifdef KRB4
101	#include <krb.h>
102	int auth_krb4(Authctxt , KTEXT, char *);
103	int auth_krb4_password(Authctxt , const char );
104	void krb4_cleanup_proc(void *);
105
106	#ifdef AFS
107	#include <kafs.h>
108	int auth_krb4_tgt(Authctxt , const char );
109	int auth_afs_token(Authctxt , const char );
110	#endif /* AFS */
111
112	#endif /* KRB4 */
113
114	#ifdef KRB5
115	int auth_krb5(Authctxt authctxt, krb5_data auth, char **client);
116	int auth_krb5_tgt(Authctxt authctxt, krb5_data tgt);
117	int auth_krb5_password(Authctxt authctxt, const char password);
118	void krb5_cleanup_proc(void *authctxt);
119	#endif /* KRB5 */
120
121	#include "auth-pam.h"
122	#include "auth2-pam.h"
123
124	void do_authentication(void);
125	void do_authentication2(void);
126
127	Authctxt *authctxt_new(void);
128	void auth_log(Authctxt , int, char , char *);
129	void userauth_finish(Authctxt , int, char );
130	int auth_root_allowed(char *);
131
132	int auth2_challenge(Authctxt , char );
133
134	int allowed_user(struct passwd *);
135
136	char get_challenge(Authctxt );
137	int verify_response(Authctxt , const char );
138
139	struct passwd * auth_get_user(void);
140
141	char expand_filename(const char , struct passwd *);
142	char authorized_keys_file(struct passwd );
143	char authorized_keys_file2(struct passwd );
144
145	int
146	secure_filename(FILE , const char , struct passwd , char , size_t);
147
148	HostStatus
149	check_key_in_hostfiles(struct passwd , Key , const char *,
150	const char , const char );
151
152	#define AUTH_FAIL_MAX 6
153	#define AUTH_FAIL_LOG (AUTH_FAIL_MAX/2)
154	#define AUTH_FAIL_MSG "Too many authentication failures for %.100s"
155
156	#endif