release/src/router/dropbear/cli-auth.c

   1 /*
   2  * Dropbear SSH
   3  *
   4  * Copyright (c) 2002,2003 Matt Johnston
   5  * Copyright (c) 2004 by Mihnea Stoenescu
   6  * All rights reserved.
   7  *
   8  * Permission is hereby granted, free of charge, to any person obtaining a copy
   9  * of this software and associated documentation files (the "Software"), to deal
  10  * in the Software without restriction, including without limitation the rights
  11  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  12  * copies of the Software, and to permit persons to whom the Software is
  13  * furnished to do so, subject to the following conditions:
  14  *
  15  * The above copyright notice and this permission notice shall be included in
  16  * all copies or substantial portions of the Software.
  17  *
  18  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  19  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  20  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
  21  * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  22  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  23  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  24  * SOFTWARE. */
  25
  26 #include "includes.h"
  27 #include "session.h"
  28 #include "auth.h"
  29 #include "dbutil.h"
  30 #include "buffer.h"
  31 #include "ssh.h"
  32 #include "packet.h"
  33 #include "runopts.h"
  34
  35 void cli_authinitialise() {
  36
  37         memset(&ses.authstate, 0, sizeof(ses.authstate));
  38 }
  39
  40
  41 /* Send a "none" auth request to get available methods */
  42 void cli_auth_getmethods() {
  43         TRACE(("enter cli_auth_getmethods"))
  44 #ifdef CLI_IMMEDIATE_AUTH
  45         ses.authstate.authtypes = AUTH_TYPE_PUBKEY;
  46     if (getenv(DROPBEAR_PASSWORD_ENV)) {
  47                 ses.authstate.authtypes |= AUTH_TYPE_PASSWORD | AUTH_TYPE_INTERACT;
  48         }
  49         if (cli_auth_try() == DROPBEAR_SUCCESS) {
  50                 TRACE(("skipped initial none auth query"))
  51                 return;
  52         }
  53 #endif
  54         CHECKCLEARTOWRITE();
  55         buf_putbyte(ses.writepayload, SSH_MSG_USERAUTH_REQUEST);
  56         buf_putstring(ses.writepayload, cli_opts.username,
  57                         strlen(cli_opts.username));
  58         buf_putstring(ses.writepayload, SSH_SERVICE_CONNECTION,
  59                         SSH_SERVICE_CONNECTION_LEN);
  60         buf_putstring(ses.writepayload, "none", 4); /* 'none' method */
  61
  62         encrypt_packet();
  63         TRACE(("leave cli_auth_getmethods"))
  64 }
  65
  66 void recv_msg_userauth_banner() {
  67
  68         unsigned char* banner = NULL;
  69         unsigned int bannerlen;
  70         unsigned int i, linecount;
  71
  72         TRACE(("enter recv_msg_userauth_banner"))
  73         if (ses.authstate.authdone) {
  74                 TRACE(("leave recv_msg_userauth_banner: banner after auth done"))
  75                 return;
  76         }
  77
  78         banner = buf_getstring(ses.payload, &bannerlen);
  79         buf_eatstring(ses.payload); /* The language string */
  80
  81         if (bannerlen > MAX_BANNER_SIZE) {
  82                 TRACE(("recv_msg_userauth_banner: bannerlen too long: %d", bannerlen))
  83                 goto out;
  84         }
  85
  86         cleantext(banner);
  87
  88         /* Limit to 25 lines */
  89         linecount = 1;
  90         for (i = 0; i < bannerlen; i++) {
  91                 if (banner[i] == '\n') {
  92                         if (linecount >= MAX_BANNER_LINES) {
  93                                 banner[i] = '\0';
  94                                 break;
  95                         }
  96                         linecount++;
  97                 }
  98         }
  99
 100         fprintf(stderr, "%s\n", banner);
 101
 102 out:
 103         m_free(banner);
 104         TRACE(("leave recv_msg_userauth_banner"))
 105 }
 106
 107 /* This handles the message-specific types which
 108  * all have a value of 60. These are
 109  * SSH_MSG_USERAUTH_PASSWD_CHANGEREQ,
 110  * SSH_MSG_USERAUTH_PK_OK, &
 111  * SSH_MSG_USERAUTH_INFO_REQUEST. */
 112 void recv_msg_userauth_specific_60() {
 113
 114 #ifdef ENABLE_CLI_PUBKEY_AUTH
 115         if (cli_ses.lastauthtype == AUTH_TYPE_PUBKEY) {
 116                 recv_msg_userauth_pk_ok();
 117                 return;
 118         }
 119 #endif
 120
 121 #ifdef ENABLE_CLI_INTERACT_AUTH
 122         if (cli_ses.lastauthtype == AUTH_TYPE_INTERACT) {
 123                 recv_msg_userauth_info_request();
 124                 return;
 125         }
 126 #endif
 127
 128 #ifdef ENABLE_CLI_PASSWORD_AUTH
 129         if (cli_ses.lastauthtype == AUTH_TYPE_PASSWORD) {
 130                 /* Eventually there could be proper password-changing
 131                  * support. However currently few servers seem to
 132                  * implement it, and password auth is last-resort
 133                  * regardless - keyboard-interactive is more likely
 134                  * to be used anyway. */
 135                 dropbear_close("Your password has expired.");
 136         }
 137 #endif
 138
 139         dropbear_exit("Unexpected userauth packet");
 140 }
 141
 142 void recv_msg_userauth_failure() {
 143
 144         unsigned char * methods = NULL;
 145         unsigned char * tok = NULL;
 146         unsigned int methlen = 0;
 147         unsigned int partial = 0;
 148         unsigned int i = 0;
 149
 150         TRACE(("<- MSG_USERAUTH_FAILURE"))
 151         TRACE(("enter recv_msg_userauth_failure"))
 152
 153         if (cli_ses.state != USERAUTH_REQ_SENT) {
 154                 /* Perhaps we should be more fatal? */
 155                 dropbear_exit("Unexpected userauth failure");
 156         }
 157
 158 #ifdef ENABLE_CLI_PUBKEY_AUTH
 159         /* If it was a pubkey auth request, we should cross that key
 160          * off the list. */
 161         if (cli_ses.lastauthtype == AUTH_TYPE_PUBKEY) {
 162                 cli_pubkeyfail();
 163         }
 164 #endif
 165
 166 #ifdef ENABLE_CLI_INTERACT_AUTH
 167         /* If we get a failure message for keyboard interactive without
 168          * receiving any request info packet, then we don't bother trying
 169          * keyboard interactive again */
 170         if (cli_ses.lastauthtype == AUTH_TYPE_INTERACT
 171                         && !cli_ses.interact_request_received) {
 172                 TRACE(("setting auth_interact_failed = 1"))
 173                 cli_ses.auth_interact_failed = 1;
 174         }
 175 #endif
 176
 177         cli_ses.lastauthtype = AUTH_TYPE_NONE;
 178
 179         methods = buf_getstring(ses.payload, &methlen);
 180
 181         partial = buf_getbool(ses.payload);
 182
 183         if (partial) {
 184                 dropbear_log(LOG_INFO, "Authentication partially succeeded, more attempts required");
 185         } else {
 186                 ses.authstate.failcount++;
 187         }
 188
 189         TRACE(("Methods (len %d): '%s'", methlen, methods))
 190
 191         ses.authstate.authdone=0;
 192         ses.authstate.authtypes=0;
 193
 194         /* Split with nulls rather than commas */
 195         for (i = 0; i < methlen; i++) {
 196                 if (methods[i] == ',') {
 197                         methods[i] = '\0';
 198                 }
 199         }
 200
 201         tok = methods; /* tok stores the next method we'll compare */
 202         for (i = 0; i <= methlen; i++) {
 203                 if (methods[i] == '\0') {
 204                         TRACE(("auth method '%s'", tok))
 205 #ifdef ENABLE_CLI_PUBKEY_AUTH
 206                         if (strncmp(AUTH_METHOD_PUBKEY, tok,
 207                                 AUTH_METHOD_PUBKEY_LEN) == 0) {
 208                                 ses.authstate.authtypes |= AUTH_TYPE_PUBKEY;
 209                         }
 210 #endif
 211 #ifdef ENABLE_CLI_INTERACT_AUTH
 212                         if (strncmp(AUTH_METHOD_INTERACT, tok,
 213                                 AUTH_METHOD_INTERACT_LEN) == 0) {
 214                                 ses.authstate.authtypes |= AUTH_TYPE_INTERACT;
 215                         }
 216 #endif
 217 #ifdef ENABLE_CLI_PASSWORD_AUTH
 218                         if (strncmp(AUTH_METHOD_PASSWORD, tok,
 219                                 AUTH_METHOD_PASSWORD_LEN) == 0) {
 220                                 ses.authstate.authtypes |= AUTH_TYPE_PASSWORD;
 221                         }
 222 #endif
 223                         tok = &methods[i+1]; /* Must make sure we don't use it after the
 224                                                                         last loop, since it'll point to something
 225                                                                         undefined */
 226                 }
 227         }
 228
 229         m_free(methods);
 230
 231         cli_ses.state = USERAUTH_FAIL_RCVD;
 232
 233         TRACE(("leave recv_msg_userauth_failure"))
 234 }
 235
 236 void recv_msg_userauth_success() {
 237         TRACE(("received msg_userauth_success"))
 238         /* Note: in delayed-zlib mode, setting authdone here
 239          * will enable compression in the transport layer */
 240         ses.authstate.authdone = 1;
 241         cli_ses.state = USERAUTH_SUCCESS_RCVD;
 242         cli_ses.lastauthtype = AUTH_TYPE_NONE;
 243
 244 #ifdef ENABLE_CLI_PUBKEY_AUTH
 245         cli_auth_pubkey_cleanup();
 246 #endif
 247 }
 248
 249 int cli_auth_try() {
 250
 251         int finished = 0;
 252         TRACE(("enter cli_auth_try"))
 253
 254         CHECKCLEARTOWRITE();
 255
 256         /* Order to try is pubkey, interactive, password.
 257          * As soon as "finished" is set for one, we don't do any more. */
 258 #ifdef ENABLE_CLI_PUBKEY_AUTH
 259         if (ses.authstate.authtypes & AUTH_TYPE_PUBKEY) {
 260                 finished = cli_auth_pubkey();
 261                 cli_ses.lastauthtype = AUTH_TYPE_PUBKEY;
 262         }
 263 #endif
 264
 265 #ifdef ENABLE_CLI_PASSWORD_AUTH
 266         if (!finished && (ses.authstate.authtypes & AUTH_TYPE_PASSWORD)) {
 267                 if (ses.keys->trans.algo_crypt->cipherdesc == NULL) {
 268                         fprintf(stderr, "Sorry, I won't let you use password auth unencrypted.\n");
 269                 } else {
 270                         cli_auth_password();
 271                         finished = 1;
 272                         cli_ses.lastauthtype = AUTH_TYPE_PASSWORD;
 273                 }
 274         }
 275 #endif
 276
 277 #ifdef ENABLE_CLI_INTERACT_AUTH
 278         if (!finished && (ses.authstate.authtypes & AUTH_TYPE_INTERACT)) {
 279                 if (ses.keys->trans.algo_crypt->cipherdesc == NULL) {
 280                         fprintf(stderr, "Sorry, I won't let you use interactive auth unencrypted.\n");
 281                 } else {
 282                         if (!cli_ses.auth_interact_failed) {
 283                                 cli_auth_interactive();
 284                                 cli_ses.lastauthtype = AUTH_TYPE_INTERACT;
 285                                 finished = 1;
 286                         }
 287                 }
 288         }
 289 #endif
 290
 291         TRACE(("cli_auth_try lastauthtype %d", cli_ses.lastauthtype))
 292
 293         if (finished) {
 294                 TRACE(("leave cli_auth_try success"))
 295                 return DROPBEAR_SUCCESS;
 296         }
 297         TRACE(("leave cli_auth_try failure"))
 298         return DROPBEAR_FAILURE;
 299 }
 300
 301 /* A helper for getpass() that exits if the user cancels. The returned
 302  * password is statically allocated by getpass() */
 303 char* getpass_or_cancel(char* prompt)
 304 {
 305         char* password = NULL;
 306
 307 #ifdef DROPBEAR_PASSWORD_ENV
 308     /* Password provided in an environment var */
 309     password = getenv(DROPBEAR_PASSWORD_ENV);
 310     if (password)
 311     {
 312         return password;
 313     }
 314 #endif
 315
 316         password = getpass(prompt);
 317
 318         /* 0x03 is a ctrl-c character in the buffer. */
 319         if (password == NULL || strchr(password, '\3') != NULL) {
 320                 dropbear_close("Interrupted.");
 321         }
 322         return password;
 323 }