[openssh.git] / auth2-hostbased.c

/* $OpenBSD: auth2-hostbased.c,v 1.9 2006/07/06 16:03:53 stevesk Exp $ */
/*
 * Copyright (c) 2000 Markus Friedl.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "includes.h"

#include <sys/types.h>

#include <pwd.h>

#include "ssh2.h"
#include "xmalloc.h"
#include "packet.h"
#include "buffer.h"
#include "log.h"
#include "servconf.h"
#include "compat.h"
#include "bufaux.h"
#include "auth.h"
#include "key.h"
#include "canohost.h"
#include "monitor_wrap.h"
#include "pathnames.h"

/* import */
extern ServerOptions options;
extern u_char *session_id2;
extern u_int session_id2_len;

static int
userauth_hostbased(Authctxt *authctxt)
{
	Buffer b;
	Key *key = NULL;
	char *pkalg, *cuser, *chost, *service;
	u_char *pkblob, *sig;
	u_int alen, blen, slen;
	int pktype;
	int authenticated = 0;

	if (!authctxt->valid) {
		debug2("userauth_hostbased: disabled because of invalid user");
		return 0;
	}
	pkalg = packet_get_string(&alen);
	pkblob = packet_get_string(&blen);
	chost = packet_get_string(NULL);
	cuser = packet_get_string(NULL);
	sig = packet_get_string(&slen);

	debug("userauth_hostbased: cuser %s chost %s pkalg %s slen %d",
	    cuser, chost, pkalg, slen);
#ifdef DEBUG_PK
	debug("signature:");
	buffer_init(&b);
	buffer_append(&b, sig, slen);
	buffer_dump(&b);
	buffer_free(&b);
#endif
	pktype = key_type_from_name(pkalg);
	if (pktype == KEY_UNSPEC) {
		/* this is perfectly legal */
		logit("userauth_hostbased: unsupported "
		    "public key algorithm: %s", pkalg);
		goto done;
	}
	key = key_from_blob(pkblob, blen);
	if (key == NULL) {
		error("userauth_hostbased: cannot decode key: %s", pkalg);
		goto done;
	}
	if (key->type != pktype) {
		error("userauth_hostbased: type mismatch for decoded key "
		    "(received %d, expected %d)", key->type, pktype);
		goto done;
	}
	service = datafellows & SSH_BUG_HBSERVICE ? "ssh-userauth" :
	    authctxt->service;
	buffer_init(&b);
	buffer_put_string(&b, session_id2, session_id2_len);
	/* reconstruct packet */
	buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
	buffer_put_cstring(&b, authctxt->user);
	buffer_put_cstring(&b, service);
	buffer_put_cstring(&b, "hostbased");
	buffer_put_string(&b, pkalg, alen);
	buffer_put_string(&b, pkblob, blen);
	buffer_put_cstring(&b, chost);
	buffer_put_cstring(&b, cuser);
#ifdef DEBUG_PK
	buffer_dump(&b);
#endif
	/* test for allowed key and correct signature */
	authenticated = 0;
	if (PRIVSEP(hostbased_key_allowed(authctxt->pw, cuser, chost, key)) &&
	    PRIVSEP(key_verify(key, sig, slen, buffer_ptr(&b),
			buffer_len(&b))) == 1)
		authenticated = 1;

	buffer_free(&b);
done:
	debug2("userauth_hostbased: authenticated %d", authenticated);
	if (key != NULL)
		key_free(key);
	xfree(pkalg);
	xfree(pkblob);
	xfree(cuser);
	xfree(chost);
	xfree(sig);
	return authenticated;
}

/* return 1 if given hostkey is allowed */
int
hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost,
    Key *key)
{
	const char *resolvedname, *ipaddr, *lookup;
	HostStatus host_status;
	int len;

	resolvedname = get_canonical_hostname(options.use_dns);
	ipaddr = get_remote_ipaddr();

	debug2("userauth_hostbased: chost %s resolvedname %s ipaddr %s",
	    chost, resolvedname, ipaddr);

	if (options.hostbased_uses_name_from_packet_only) {
		if (auth_rhosts2(pw, cuser, chost, chost) == 0)
			return 0;
		lookup = chost;
	} else {
		if (((len = strlen(chost)) > 0) && chost[len - 1] == '.') {
			debug2("stripping trailing dot from chost %s", chost);
			chost[len - 1] = '\0';
		}
		if (strcasecmp(resolvedname, chost) != 0)
			logit("userauth_hostbased mismatch: "
			    "client sends %s, but we resolve %s to %s",
			    chost, ipaddr, resolvedname);
		if (auth_rhosts2(pw, cuser, resolvedname, ipaddr) == 0)
			return 0;
		lookup = resolvedname;
	}
	debug2("userauth_hostbased: access allowed by auth_rhosts2");

	host_status = check_key_in_hostfiles(pw, key, lookup,
	    _PATH_SSH_SYSTEM_HOSTFILE,
	    options.ignore_user_known_hosts ? NULL : _PATH_SSH_USER_HOSTFILE);

	/* backward compat if no key has been found. */
	if (host_status == HOST_NEW)
		host_status = check_key_in_hostfiles(pw, key, lookup,
		    _PATH_SSH_SYSTEM_HOSTFILE2,
		    options.ignore_user_known_hosts ? NULL :
		    _PATH_SSH_USER_HOSTFILE2);

	return (host_status == HOST_OK);
}

Authmethod method_hostbased = {
	"hostbased",
	userauth_hostbased,
	&options.hostbased_authentication
};
Commit	Line	Data
b1842393	1	/* $OpenBSD: auth2-hostbased.c,v 1.9 2006/07/06 16:03:53 stevesk Exp $ */
013eab17	2	/*
	3	* Copyright (c) 2000 Markus Friedl. All rights reserved.
	4	*
	5	* Redistribution and use in source and binary forms, with or without
	6	* modification, are permitted provided that the following conditions
	7	* are met:
	8	* 1. Redistributions of source code must retain the above copyright
	9	* notice, this list of conditions and the following disclaimer.
	10	* 2. Redistributions in binary form must reproduce the above copyright
	11	* notice, this list of conditions and the following disclaimer in the
	12	* documentation and/or other materials provided with the distribution.
	13	*
	14	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
	15	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
	16	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
	17	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
	18	* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
	19	* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
	20	* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
	21	* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
	22	* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
	23	* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
	24	*/
	25
	26	#include "includes.h"
013eab17	27
b1842393	28	#include <sys/types.h>
	29
	30	#include <pwd.h>
	31
013eab17	32	#include "ssh2.h"
	33	#include "xmalloc.h"
	34	#include "packet.h"
	35	#include "buffer.h"
	36	#include "log.h"
	37	#include "servconf.h"
	38	#include "compat.h"
	39	#include "bufaux.h"
	40	#include "auth.h"
	41	#include "key.h"
	42	#include "canohost.h"
	43	#include "monitor_wrap.h"
	44	#include "pathnames.h"
	45
	46	/* import */
	47	extern ServerOptions options;
	48	extern u_char *session_id2;
a27002e5	49	extern u_int session_id2_len;
013eab17	50
	51	static int
	52	userauth_hostbased(Authctxt *authctxt)
	53	{
	54	Buffer b;
	55	Key *key = NULL;
	56	char pkalg, cuser, chost, service;
	57	u_char pkblob, sig;
	58	u_int alen, blen, slen;
	59	int pktype;
	60	int authenticated = 0;
	61
	62	if (!authctxt->valid) {
	63	debug2("userauth_hostbased: disabled because of invalid user");
	64	return 0;
	65	}
	66	pkalg = packet_get_string(&alen);
	67	pkblob = packet_get_string(&blen);
	68	chost = packet_get_string(NULL);
	69	cuser = packet_get_string(NULL);
	70	sig = packet_get_string(&slen);
	71
	72	debug("userauth_hostbased: cuser %s chost %s pkalg %s slen %d",
	73	cuser, chost, pkalg, slen);
	74	#ifdef DEBUG_PK
	75	debug("signature:");
	76	buffer_init(&b);
	77	buffer_append(&b, sig, slen);
	78	buffer_dump(&b);
	79	buffer_free(&b);
	80	#endif
	81	pktype = key_type_from_name(pkalg);
	82	if (pktype == KEY_UNSPEC) {
	83	/* this is perfectly legal */
bbe88b6d	84	logit("userauth_hostbased: unsupported "
013eab17	85	"public key algorithm: %s", pkalg);
	86	goto done;
	87	}
	88	key = key_from_blob(pkblob, blen);
	89	if (key == NULL) {
	90	error("userauth_hostbased: cannot decode key: %s", pkalg);
	91	goto done;
	92	}
	93	if (key->type != pktype) {
	94	error("userauth_hostbased: type mismatch for decoded key "
	95	"(received %d, expected %d)", key->type, pktype);
	96	goto done;
	97	}
	98	service = datafellows & SSH_BUG_HBSERVICE ? "ssh-userauth" :
	99	authctxt->service;
	100	buffer_init(&b);
	101	buffer_put_string(&b, session_id2, session_id2_len);
	102	/* reconstruct packet */
	103	buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
	104	buffer_put_cstring(&b, authctxt->user);
	105	buffer_put_cstring(&b, service);
	106	buffer_put_cstring(&b, "hostbased");
	107	buffer_put_string(&b, pkalg, alen);
	108	buffer_put_string(&b, pkblob, blen);
	109	buffer_put_cstring(&b, chost);
	110	buffer_put_cstring(&b, cuser);
	111	#ifdef DEBUG_PK
	112	buffer_dump(&b);
	113	#endif
	114	/* test for allowed key and correct signature */
	115	authenticated = 0;
	116	if (PRIVSEP(hostbased_key_allowed(authctxt->pw, cuser, chost, key)) &&
	117	PRIVSEP(key_verify(key, sig, slen, buffer_ptr(&b),
	118	buffer_len(&b))) == 1)
	119	authenticated = 1;
	120
43f7a4b8	121	buffer_free(&b);
013eab17	122	done:
	123	debug2("userauth_hostbased: authenticated %d", authenticated);
	124	if (key != NULL)
	125	key_free(key);
	126	xfree(pkalg);
	127	xfree(pkblob);
	128	xfree(cuser);
	129	xfree(chost);
	130	xfree(sig);
	131	return authenticated;
	132	}
	133
	134	/* return 1 if given hostkey is allowed */
	135	int
	136	hostbased_key_allowed(struct passwd pw, const char cuser, char *chost,
	137	Key *key)
	138	{
	139	const char resolvedname, ipaddr, *lookup;
	140	HostStatus host_status;
	141	int len;
	142
c5a7d788	143	resolvedname = get_canonical_hostname(options.use_dns);
013eab17	144	ipaddr = get_remote_ipaddr();
	145
	146	debug2("userauth_hostbased: chost %s resolvedname %s ipaddr %s",
	147	chost, resolvedname, ipaddr);
	148
	149	if (options.hostbased_uses_name_from_packet_only) {
	150	if (auth_rhosts2(pw, cuser, chost, chost) == 0)
	151	return 0;
	152	lookup = chost;
	153	} else {
	154	if (((len = strlen(chost)) > 0) && chost[len - 1] == '.') {
	155	debug2("stripping trailing dot from chost %s", chost);
	156	chost[len - 1] = '\0';
	157	}
	158	if (strcasecmp(resolvedname, chost) != 0)
bbe88b6d	159	logit("userauth_hostbased mismatch: "
013eab17	160	"client sends %s, but we resolve %s to %s",
	161	chost, ipaddr, resolvedname);
	162	if (auth_rhosts2(pw, cuser, resolvedname, ipaddr) == 0)
	163	return 0;
	164	lookup = resolvedname;
	165	}
	166	debug2("userauth_hostbased: access allowed by auth_rhosts2");
	167
	168	host_status = check_key_in_hostfiles(pw, key, lookup,
	169	_PATH_SSH_SYSTEM_HOSTFILE,
	170	options.ignore_user_known_hosts ? NULL : _PATH_SSH_USER_HOSTFILE);
	171
	172	/* backward compat if no key has been found. */
	173	if (host_status == HOST_NEW)
	174	host_status = check_key_in_hostfiles(pw, key, lookup,
	175	_PATH_SSH_SYSTEM_HOSTFILE2,
	176	options.ignore_user_known_hosts ? NULL :
	177	_PATH_SSH_USER_HOSTFILE2);
	178
	179	return (host_status == HOST_OK);
	180	}
	181
	182	Authmethod method_hostbased = {
	183	"hostbased",
	184	userauth_hostbased,
	185	&options.hostbased_authentication
	186	};