1 /*
2 * Copyright (c) 2000 Markus Friedl. All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 * 1. Redistributions of source code must retain the above copyright
8 * notice, this list of conditions and the following disclaimer.
9 * 2. Redistributions in binary form must reproduce the above copyright
10 * notice, this list of conditions and the following disclaimer in the
11 * documentation and/or other materials provided with the distribution.
12 *
13 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
14 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
15 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
16 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
17 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
18 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
19 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
20 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
21 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
22 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
23 */
24 /*
25 * Copyright 2007 Sun Microsystems, Inc. All rights reserved.
26 * Use is subject to license terms.
27 */
28
29 #include "includes.h"
30 RCSID("$OpenBSD: auth2-hostbased.c,v 1.2 2002/05/31 11:35:15 markus Exp $");
31
32 #pragma ident "%Z%%M% %I% %E% SMI"
33
34 #include "ssh2.h"
35 #include "xmalloc.h"
36 #include "packet.h"
37 #include "buffer.h"
38 #include "log.h"
39 #include "servconf.h"
40 #include "compat.h"
41 #include "bufaux.h"
42 #include "auth.h"
43
44 #ifdef USE_PAM
45 #include "auth-pam.h"
46 #endif /* USE_PAM */
47
48 #include "key.h"
49 #include "canohost.h"
50 #include "pathnames.h"
51
52 /* import */
53 extern ServerOptions options;
54 extern u_char *session_id2;
55 extern int session_id2_len;
56
57 static void
userauth_hostbased(Authctxt * authctxt)58 userauth_hostbased(Authctxt *authctxt)
59 {
60 Buffer b;
61 Key *key = NULL;
62 char *pkalg, *cuser, *chost, *service;
63 u_char *pkblob, *sig;
64 u_int alen, blen, slen;
65 int pktype;
66 int authenticated = 0;
67
68 if (!authctxt || !authctxt->method)
69 fatal("%s: missing context", __func__);
70
71 pkalg = packet_get_string(&alen);
72 pkblob = packet_get_string(&blen);
73 chost = packet_get_string(NULL);
74 cuser = packet_get_string(NULL);
75 sig = packet_get_string(&slen);
76
77 debug("userauth_hostbased: cuser %s chost %s pkalg %s slen %d",
78 cuser, chost, pkalg, slen);
79 #ifdef DEBUG_PK
80 debug("signature:");
81 buffer_init(&b);
82 buffer_append(&b, sig, slen);
83 buffer_dump(&b);
84 buffer_free(&b);
85 #endif
86 pktype = key_type_from_name(pkalg);
87 if (pktype == KEY_UNSPEC) {
88 /* this is perfectly legal */
89 log("userauth_hostbased: unsupported "
90 "public key algorithm: %s", pkalg);
91 goto done;
92 }
93 key = key_from_blob(pkblob, blen);
94 if (key == NULL) {
95 error("userauth_hostbased: cannot decode key: %s", pkalg);
96 goto done;
97 }
98 if (key->type != pktype) {
99 error("userauth_hostbased: type mismatch for decoded key "
100 "(received %d, expected %d)", key->type, pktype);
101 goto done;
102 }
103 service = datafellows & SSH_BUG_HBSERVICE ? "ssh-userauth" :
104 authctxt->service;
105 buffer_init(&b);
106 buffer_put_string(&b, session_id2, session_id2_len);
107 /* reconstruct packet */
108 buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
109 buffer_put_cstring(&b, authctxt->user);
110 buffer_put_cstring(&b, service);
111 buffer_put_cstring(&b, "hostbased");
112 buffer_put_string(&b, pkalg, alen);
113 buffer_put_string(&b, pkblob, blen);
114 buffer_put_cstring(&b, chost);
115 buffer_put_cstring(&b, cuser);
116 #ifdef DEBUG_PK
117 buffer_dump(&b);
118 #endif
119 /* test for allowed key and correct signature */
120 authenticated = 0;
121 if (hostbased_key_allowed(authctxt->pw, cuser, chost, key) &&
122 key_verify(key, sig, slen, buffer_ptr(&b), buffer_len(&b)) == 1)
123 authenticated = 1;
124
125 buffer_clear(&b);
126 done:
127 /*
128 * XXX TODO: Add config options for specifying users for whom
129 * this userauth is insufficient and what userauths
130 * may continue.
131 *
132 * NOTE: do_pam_non_initial_userauth() does this for
133 * users with expired passwords.
134 */
135 #ifdef USE_PAM
136 if (authenticated) {
137 authctxt->cuser = cuser;
138 if (!do_pam_non_initial_userauth(authctxt))
139 authenticated = 0;
140 /* Make sure nobody else will use this pointer since we are
141 * going to free that string. */
142 authctxt->cuser = NULL;
143 }
144 #endif /* USE_PAM */
145
146 if (authenticated)
147 authctxt->method->authenticated = 1;
148
149 debug2("userauth_hostbased: authenticated %d", authenticated);
150 if (key != NULL)
151 key_free(key);
152 xfree(pkalg);
153 xfree(pkblob);
154 xfree(cuser);
155 xfree(chost);
156 xfree(sig);
157 return;
158 }
159
160 /* return 1 if given hostkey is allowed */
161 int
hostbased_key_allowed(struct passwd * pw,const char * cuser,char * chost,Key * key)162 hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost,
163 Key *key)
164 {
165 const char *resolvedname, *ipaddr, *lookup;
166 HostStatus host_status;
167 int len;
168
169 resolvedname = get_canonical_hostname(options.verify_reverse_mapping);
170 ipaddr = get_remote_ipaddr();
171
172 debug2("userauth_hostbased: chost %s resolvedname %s ipaddr %s",
173 chost, resolvedname, ipaddr);
174
175 if (pw == NULL)
176 return 0;
177
178 if (options.hostbased_uses_name_from_packet_only) {
179 if (auth_rhosts2(pw, cuser, chost, chost) == 0)
180 return 0;
181 lookup = chost;
182 } else {
183 if (((len = strlen(chost)) > 0) && chost[len - 1] == '.') {
184 debug2("stripping trailing dot from chost %s", chost);
185 chost[len - 1] = '\0';
186 }
187 if (strcasecmp(resolvedname, chost) != 0)
188 log("userauth_hostbased mismatch: "
189 "client sends %s, but we resolve %s to %s",
190 chost, ipaddr, resolvedname);
191 if (auth_rhosts2(pw, cuser, resolvedname, ipaddr) == 0)
192 return 0;
193 lookup = resolvedname;
194 }
195 debug2("userauth_hostbased: access allowed by auth_rhosts2");
196
197 host_status = check_key_in_hostfiles(pw, key, lookup,
198 _PATH_SSH_SYSTEM_HOSTFILE,
199 options.ignore_user_known_hosts ? NULL : _PATH_SSH_USER_HOSTFILE);
200
201 /* backward compat if no key has been found. */
202 if (host_status == HOST_NEW)
203 host_status = check_key_in_hostfiles(pw, key, lookup,
204 _PATH_SSH_SYSTEM_HOSTFILE2,
205 options.ignore_user_known_hosts ? NULL :
206 _PATH_SSH_USER_HOSTFILE2);
207
208 return (host_status == HOST_OK);
209 }
210
211 Authmethod method_hostbased = {
212 "hostbased",
213 &options.hostbased_authentication,
214 userauth_hostbased,
215 NULL, /* no abandon function */
216 NULL, NULL, /* method data and hist data */
217 0, /* is not initial userauth */
218 0, 0, 0, /* counters */
219 0, 0, 0, 0, 0, 0 /* state */
220 };
221