[openssh.git] / auth2-hostbased.c

/* $OpenBSD: auth2-hostbased.c,v 1.12 2008/07/17 08:51:07 djm Exp $ */
/*
 * Copyright (c) 2000 Markus Friedl.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "includes.h"

#include <sys/types.h>

#include <pwd.h>
#include <string.h>
#include <stdarg.h>

#include "xmalloc.h"
#include "ssh2.h"
#include "packet.h"
#include "buffer.h"
#include "log.h"
#include "servconf.h"
#include "compat.h"
#include "key.h"
#include "hostfile.h"
#include "auth.h"
#include "canohost.h"
#ifdef GSSAPI
#include "ssh-gss.h"
#endif
#include "monitor_wrap.h"
#include "pathnames.h"

/* import */
extern ServerOptions options;
extern u_char *session_id2;
extern u_int session_id2_len;

static int
userauth_hostbased(Authctxt *authctxt)
{
	Buffer b;
	Key *key = NULL;
	char *pkalg, *cuser, *chost, *service;
	u_char *pkblob, *sig;
	u_int alen, blen, slen;
	int pktype;
	int authenticated = 0;

	if (!authctxt->valid) {
		debug2("userauth_hostbased: disabled because of invalid user");
		return 0;
	}
	pkalg = packet_get_string(&alen);
	pkblob = packet_get_string(&blen);
	chost = packet_get_string(NULL);
	cuser = packet_get_string(NULL);
	sig = packet_get_string(&slen);

	debug("userauth_hostbased: cuser %s chost %s pkalg %s slen %d",
	    cuser, chost, pkalg, slen);
#ifdef DEBUG_PK
	debug("signature:");
	buffer_init(&b);
	buffer_append(&b, sig, slen);
	buffer_dump(&b);
	buffer_free(&b);
#endif
	pktype = key_type_from_name(pkalg);
	if (pktype == KEY_UNSPEC) {
		/* this is perfectly legal */
		logit("userauth_hostbased: unsupported "
		    "public key algorithm: %s", pkalg);
		goto done;
	}
	key = key_from_blob(pkblob, blen);
	if (key == NULL) {
		error("userauth_hostbased: cannot decode key: %s", pkalg);
		goto done;
	}
	if (key->type != pktype) {
		error("userauth_hostbased: type mismatch for decoded key "
		    "(received %d, expected %d)", key->type, pktype);
		goto done;
	}
	service = datafellows & SSH_BUG_HBSERVICE ? "ssh-userauth" :
	    authctxt->service;
	buffer_init(&b);
	buffer_put_string(&b, session_id2, session_id2_len);
	/* reconstruct packet */
	buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
	buffer_put_cstring(&b, authctxt->user);
	buffer_put_cstring(&b, service);
	buffer_put_cstring(&b, "hostbased");
	buffer_put_string(&b, pkalg, alen);
	buffer_put_string(&b, pkblob, blen);
	buffer_put_cstring(&b, chost);
	buffer_put_cstring(&b, cuser);
#ifdef DEBUG_PK
	buffer_dump(&b);
#endif
	/* test for allowed key and correct signature */
	authenticated = 0;
	if (PRIVSEP(hostbased_key_allowed(authctxt->pw, cuser, chost, key)) &&
	    PRIVSEP(key_verify(key, sig, slen, buffer_ptr(&b),
			buffer_len(&b))) == 1)
		authenticated = 1;

	buffer_free(&b);
done:
	debug2("userauth_hostbased: authenticated %d", authenticated);
	if (key != NULL)
		key_free(key);
	xfree(pkalg);
	xfree(pkblob);
	xfree(cuser);
	xfree(chost);
	xfree(sig);
	return authenticated;
}

/* return 1 if given hostkey is allowed */
int
hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost,
    Key *key)
{
	const char *resolvedname, *ipaddr, *lookup;
	HostStatus host_status;
	int len;

	resolvedname = get_canonical_hostname(options.use_dns);
	ipaddr = get_remote_ipaddr();

	debug2("userauth_hostbased: chost %s resolvedname %s ipaddr %s",
	    chost, resolvedname, ipaddr);

	if (((len = strlen(chost)) > 0) && chost[len - 1] == '.') {
		debug2("stripping trailing dot from chost %s", chost);
		chost[len - 1] = '\0';
	}

	if (options.hostbased_uses_name_from_packet_only) {
		if (auth_rhosts2(pw, cuser, chost, chost) == 0)
			return 0;
		lookup = chost;
	} else {
		if (strcasecmp(resolvedname, chost) != 0)
			logit("userauth_hostbased mismatch: "
			    "client sends %s, but we resolve %s to %s",
			    chost, ipaddr, resolvedname);
		if (auth_rhosts2(pw, cuser, resolvedname, ipaddr) == 0)
			return 0;
		lookup = resolvedname;
	}
	debug2("userauth_hostbased: access allowed by auth_rhosts2");

	host_status = check_key_in_hostfiles(pw, key, lookup,
	    _PATH_SSH_SYSTEM_HOSTFILE,
	    options.ignore_user_known_hosts ? NULL : _PATH_SSH_USER_HOSTFILE);

	/* backward compat if no key has been found. */
	if (host_status == HOST_NEW)
		host_status = check_key_in_hostfiles(pw, key, lookup,
		    _PATH_SSH_SYSTEM_HOSTFILE2,
		    options.ignore_user_known_hosts ? NULL :
		    _PATH_SSH_USER_HOSTFILE2);

	return (host_status == HOST_OK);
}

Authmethod method_hostbased = {
	"hostbased",
	userauth_hostbased,
	&options.hostbased_authentication
};
Commit	Line	Data
2800468d	1	/* $OpenBSD: auth2-hostbased.c,v 1.12 2008/07/17 08:51:07 djm Exp $ */
013eab17	2	/*
	3	* Copyright (c) 2000 Markus Friedl. All rights reserved.
	4	*
	5	* Redistribution and use in source and binary forms, with or without
	6	* modification, are permitted provided that the following conditions
	7	* are met:
	8	* 1. Redistributions of source code must retain the above copyright
	9	* notice, this list of conditions and the following disclaimer.
	10	* 2. Redistributions in binary form must reproduce the above copyright
	11	* notice, this list of conditions and the following disclaimer in the
	12	* documentation and/or other materials provided with the distribution.
	13	*
	14	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
	15	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
	16	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
	17	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
	18	* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
	19	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
	20	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
	21	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
	23	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	24	*/
	25
	26	#include "includes.h"
013eab17	27
b1842393	28	#include <sys/types.h>
	29
	30	#include <pwd.h>
00146caa	31	#include <string.h>
31652869	32	#include <stdarg.h>
b1842393	33
013eab17	34	#include "xmalloc.h"
31652869	35	#include "ssh2.h"
013eab17	36	#include "packet.h"
	37	#include "buffer.h"
	38	#include "log.h"
	39	#include "servconf.h"
	40	#include "compat.h"
013eab17	41	#include "key.h"
31652869	42	#include "hostfile.h"
31652869	43	#include "auth.h"
013eab17	44	#include "canohost.h"
31652869	45	#ifdef GSSAPI
	46	#include "ssh-gss.h"
	47	#endif
013eab17	48	#include "monitor_wrap.h"
	49	#include "pathnames.h"
	50
	51	/* import */
	52	extern ServerOptions options;
	53	extern u_char *session_id2;
a27002e5	54	extern u_int session_id2_len;
013eab17	55
	56	static int
	57	userauth_hostbased(Authctxt *authctxt)
	58	{
	59	Buffer b;
	60	Key *key = NULL;
	61	char pkalg, cuser, chost, service;
	62	u_char pkblob, sig;
	63	u_int alen, blen, slen;
	64	int pktype;
	65	int authenticated = 0;
	66
	67	if (!authctxt->valid) {
	68	debug2("userauth_hostbased: disabled because of invalid user");
	69	return 0;
	70	}
	71	pkalg = packet_get_string(&alen);
	72	pkblob = packet_get_string(&blen);
	73	chost = packet_get_string(NULL);
	74	cuser = packet_get_string(NULL);
	75	sig = packet_get_string(&slen);
	76
	77	debug("userauth_hostbased: cuser %s chost %s pkalg %s slen %d",
	78	cuser, chost, pkalg, slen);
	79	#ifdef DEBUG_PK
	80	debug("signature:");
	81	buffer_init(&b);
	82	buffer_append(&b, sig, slen);
	83	buffer_dump(&b);
	84	buffer_free(&b);
	85	#endif
	86	pktype = key_type_from_name(pkalg);
	87	if (pktype == KEY_UNSPEC) {
	88	/* this is perfectly legal */
bbe88b6d	89	logit("userauth_hostbased: unsupported "
013eab17	90	"public key algorithm: %s", pkalg);
	91	goto done;
	92	}
	93	key = key_from_blob(pkblob, blen);
	94	if (key == NULL) {
	95	error("userauth_hostbased: cannot decode key: %s", pkalg);
	96	goto done;
	97	}
	98	if (key->type != pktype) {
	99	error("userauth_hostbased: type mismatch for decoded key "
	100	"(received %d, expected %d)", key->type, pktype);
	101	goto done;
	102	}
	103	service = datafellows & SSH_BUG_HBSERVICE ? "ssh-userauth" :
	104	authctxt->service;
	105	buffer_init(&b);
	106	buffer_put_string(&b, session_id2, session_id2_len);
	107	/* reconstruct packet */
	108	buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
	109	buffer_put_cstring(&b, authctxt->user);
	110	buffer_put_cstring(&b, service);
	111	buffer_put_cstring(&b, "hostbased");
	112	buffer_put_string(&b, pkalg, alen);
	113	buffer_put_string(&b, pkblob, blen);
	114	buffer_put_cstring(&b, chost);
	115	buffer_put_cstring(&b, cuser);
	116	#ifdef DEBUG_PK
	117	buffer_dump(&b);
	118	#endif
	119	/* test for allowed key and correct signature */
	120	authenticated = 0;
	121	if (PRIVSEP(hostbased_key_allowed(authctxt->pw, cuser, chost, key)) &&
	122	PRIVSEP(key_verify(key, sig, slen, buffer_ptr(&b),
	123	buffer_len(&b))) == 1)
	124	authenticated = 1;
	125
43f7a4b8	126	buffer_free(&b);
013eab17	127	done:
	128	debug2("userauth_hostbased: authenticated %d", authenticated);
	129	if (key != NULL)
	130	key_free(key);
	131	xfree(pkalg);
	132	xfree(pkblob);
	133	xfree(cuser);
	134	xfree(chost);
	135	xfree(sig);
	136	return authenticated;
	137	}
	138
	139	/* return 1 if given hostkey is allowed */
	140	int
	141	hostbased_key_allowed(struct passwd pw, const char cuser, char *chost,
	142	Key *key)
	143	{
	144	const char resolvedname, ipaddr, *lookup;
	145	HostStatus host_status;
	146	int len;
	147
c5a7d788	148	resolvedname = get_canonical_hostname(options.use_dns);
013eab17	149	ipaddr = get_remote_ipaddr();
	150
	151	debug2("userauth_hostbased: chost %s resolvedname %s ipaddr %s",
	152	chost, resolvedname, ipaddr);
	153
2800468d	154	if (((len = strlen(chost)) > 0) && chost[len - 1] == '.') {
	155	debug2("stripping trailing dot from chost %s", chost);
	156	chost[len - 1] = '\0';
	157	}
	158
013eab17	159	if (options.hostbased_uses_name_from_packet_only) {
	160	if (auth_rhosts2(pw, cuser, chost, chost) == 0)
	161	return 0;
	162	lookup = chost;
	163	} else {
013eab17	164	if (strcasecmp(resolvedname, chost) != 0)
bbe88b6d	165	logit("userauth_hostbased mismatch: "
013eab17	166	"client sends %s, but we resolve %s to %s",
	167	chost, ipaddr, resolvedname);
	168	if (auth_rhosts2(pw, cuser, resolvedname, ipaddr) == 0)
	169	return 0;
	170	lookup = resolvedname;
	171	}
	172	debug2("userauth_hostbased: access allowed by auth_rhosts2");
	173
	174	host_status = check_key_in_hostfiles(pw, key, lookup,
	175	_PATH_SSH_SYSTEM_HOSTFILE,
	176	options.ignore_user_known_hosts ? NULL : _PATH_SSH_USER_HOSTFILE);
	177
	178	/* backward compat if no key has been found. */
	179	if (host_status == HOST_NEW)
	180	host_status = check_key_in_hostfiles(pw, key, lookup,
	181	_PATH_SSH_SYSTEM_HOSTFILE2,
	182	options.ignore_user_known_hosts ? NULL :
	183	_PATH_SSH_USER_HOSTFILE2);
	184
	185	return (host_status == HOST_OK);
	186	}
	187
	188	Authmethod method_hostbased = {
	189	"hostbased",
	190	userauth_hostbased,
	191	&options.hostbased_authentication
	192	};