2 * Copyright (c) 1991, 1993
3 * The Regents of the University of California. All rights reserved.
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. All advertising materials mentioning features or use of this software
14 * must display the following acknowledgement:
15 * This product includes software developed by the University of
16 * California, Berkeley and its contributors.
17 * 4. Neither the name of the University nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 * Copyright (C) 1990 by the Massachusetts Institute of Technology
37 * Export of this software from the United States of America is assumed
38 * to require a specific license from the United States Government.
39 * It is the responsibility of any person or organization contemplating
40 * export to obtain such a license before exporting.
42 * WITHIN THAT CONSTRAINT, permission to use, copy, modify, and
43 * distribute this software and its documentation for any purpose and
44 * without fee is hereby granted, provided that the above copyright
45 * notice appear in all copies and that both that copyright notice and
46 * this permission notice appear in supporting documentation, and that
47 * the name of M.I.T. not be used in advertising or publicity pertaining
48 * to distribution of the software without specific, written prior
49 * permission. M.I.T. makes no representations about the suitability of
50 * this software for any purpose. It is provided "as is" without express
51 * or implied warranty.
56 RCSID("$Id: auth.c 10809 2002-01-18 12:58:49Z joda $");
58 #if defined(AUTHENTICATION)
60 #ifdef HAVE_SYS_TYPES_H
61 #include <sys/types.h>
65 #ifdef HAVE_ARPA_TELNET_H
66 #include <arpa/telnet.h>
79 #include "misc-proto.h"
80 #include "auth-proto.h"
82 #define typemask(x) (1<<((x)-1))
85 extern krb4encpwd_init();
86 extern krb4encpwd_send();
87 extern krb4encpwd_is();
88 extern krb4encpwd_reply();
89 extern krb4encpwd_status();
90 extern krb4encpwd_printsub();
94 extern rsaencpwd_init();
95 extern rsaencpwd_send();
96 extern rsaencpwd_is();
97 extern rsaencpwd_reply();
98 extern rsaencpwd_status();
99 extern rsaencpwd_printsub();
102 int auth_debug_mode = 0;
103 int auth_has_failed = 0;
104 int auth_enable_encrypt = 0;
105 static const char *Name = "Noname";
106 static int Server = 0;
107 static Authenticator *authenticated = 0;
108 static int authenticating = 0;
109 static int validuser = 0;
110 static unsigned char _auth_send_data[256];
111 static unsigned char *auth_send_data;
112 static int auth_send_cnt = 0;
115 * Authentication types supported. Plese note that these are stored
116 * in priority order, i.e. try the first one first.
118 Authenticator authenticators[] = {
120 { AUTHTYPE_UNSAFE, AUTH_WHO_CLIENT|AUTH_HOW_ONE_WAY,
129 { AUTHTYPE_SRA, AUTH_WHO_CLIENT|AUTH_HOW_ONE_WAY,
138 { AUTHTYPE_SPX, AUTH_WHO_CLIENT|AUTH_HOW_MUTUAL,
145 { AUTHTYPE_SPX, AUTH_WHO_CLIENT|AUTH_HOW_ONE_WAY,
154 { AUTHTYPE_KERBEROS_V5, AUTH_WHO_CLIENT|AUTH_HOW_MUTUAL,
156 kerberos5_send_mutual,
160 kerberos5_printsub },
161 { AUTHTYPE_KERBEROS_V5, AUTH_WHO_CLIENT|AUTH_HOW_ONE_WAY,
163 kerberos5_send_oneway,
167 kerberos5_printsub },
170 { AUTHTYPE_KERBEROS_V4, AUTH_WHO_CLIENT|AUTH_HOW_MUTUAL,
172 kerberos4_send_mutual,
176 kerberos4_printsub },
177 { AUTHTYPE_KERBEROS_V4, AUTH_WHO_CLIENT|AUTH_HOW_ONE_WAY,
179 kerberos4_send_oneway,
183 kerberos4_printsub },
186 { AUTHTYPE_KRB4_ENCPWD, AUTH_WHO_CLIENT|AUTH_HOW_MUTUAL,
192 krb4encpwd_printsub },
195 { AUTHTYPE_RSA_ENCPWD, AUTH_WHO_CLIENT|AUTH_HOW_ONE_WAY,
201 rsaencpwd_printsub },
206 static Authenticator NoAuth = { 0 };
208 static int i_support = 0;
209 static int i_wont_support = 0;
212 findauthenticator(int type, int way)
214 Authenticator *ap = authenticators;
216 while (ap->type && (ap->type != type || ap->way != way))
218 return(ap->type ? ap : 0);
222 auth_init(const char *name, int server)
224 Authenticator *ap = authenticators;
233 if (!ap->init || (*ap->init)(ap, server)) {
234 i_support |= typemask(ap->type);
236 printf(">>>%s: I support auth type %d %d\r\n",
240 else if (auth_debug_mode)
241 printf(">>>%s: Init failed: auth type %d %d\r\n",
242 Name, ap->type, ap->way);
248 auth_disable_name(char *name)
251 for (x = 0; x < AUTHTYPE_CNT; ++x) {
252 if (!strcasecmp(name, AUTHTYPE_NAME(x))) {
253 i_wont_support |= typemask(x);
260 getauthmask(char *type, int *maskp)
264 if (!strcasecmp(type, AUTHTYPE_NAME(0))) {
269 for (x = 1; x < AUTHTYPE_CNT; ++x) {
270 if (!strcasecmp(type, AUTHTYPE_NAME(x))) {
271 *maskp = typemask(x);
279 auth_enable(char *type)
281 return(auth_onoff(type, 1));
285 auth_disable(char *type)
287 return(auth_onoff(type, 0));
291 auth_onoff(char *type, int on)
296 if (!strcasecmp(type, "?") || !strcasecmp(type, "help")) {
297 printf("auth %s 'type'\n", on ? "enable" : "disable");
298 printf("Where 'type' is one of:\n");
299 printf("\t%s\n", AUTHTYPE_NAME(0));
301 for (ap = authenticators; ap->type; ap++) {
302 if ((mask & (i = typemask(ap->type))) != 0)
305 printf("\t%s\n", AUTHTYPE_NAME(ap->type));
310 if (!getauthmask(type, &mask)) {
311 printf("%s: invalid authentication type\n", type);
315 i_wont_support &= ~mask;
317 i_wont_support |= mask;
322 auth_togdebug(int on)
325 auth_debug_mode ^= 1;
327 auth_debug_mode = on;
328 printf("auth debugging %s\n", auth_debug_mode ? "enabled" : "disabled");
338 if (i_wont_support == -1)
339 printf("Authentication disabled\n");
341 printf("Authentication enabled\n");
344 for (ap = authenticators; ap->type; ap++) {
345 if ((mask & (i = typemask(ap->type))) != 0)
348 printf("%s: %s\n", AUTHTYPE_NAME(ap->type),
349 (i_wont_support & typemask(ap->type)) ?
350 "disabled" : "enabled");
356 * This routine is called by the server to start authentication
362 static unsigned char str_request[64] = { IAC, SB,
363 TELOPT_AUTHENTICATION,
365 Authenticator *ap = authenticators;
366 unsigned char *e = str_request + 4;
368 if (!authenticating) {
371 if (i_support & ~i_wont_support & typemask(ap->type)) {
372 if (auth_debug_mode) {
373 printf(">>>%s: Sending type %d %d\r\n",
374 Name, ap->type, ap->way);
383 telnet_net_write(str_request, e - str_request);
384 printsub('>', &str_request[2], e - str_request - 2);
389 * This is called when an AUTH SEND is received.
390 * It should never arrive on the server side (as only the server can
391 * send an AUTH SEND).
392 * You should probably respond to it if you can...
394 * If you want to respond to the types out of order (i.e. even
395 * if he sends LOGIN KERBEROS and you support both, you respond
396 * with KERBEROS instead of LOGIN (which is against what the
397 * protocol says)) you will have to hack this code...
400 auth_send(unsigned char *data, int cnt)
403 static unsigned char str_none[] = { IAC, SB, TELOPT_AUTHENTICATION,
404 TELQUAL_IS, AUTHTYPE_NULL, 0,
407 if (auth_debug_mode) {
408 printf(">>>%s: auth_send called!\r\n", Name);
413 if (auth_debug_mode) {
414 printf(">>>%s: auth_send got:", Name);
415 printd(data, cnt); printf("\r\n");
419 * Save the data, if it is new, so that we can continue looking
420 * at it if the authorization we try doesn't work
422 if (data < _auth_send_data ||
423 data > _auth_send_data + sizeof(_auth_send_data)) {
424 auth_send_cnt = cnt > sizeof(_auth_send_data)
425 ? sizeof(_auth_send_data)
427 memmove(_auth_send_data, data, auth_send_cnt);
428 auth_send_data = _auth_send_data;
431 * This is probably a no-op, but we just make sure
433 auth_send_data = data;
436 while ((auth_send_cnt -= 2) >= 0) {
438 printf(">>>%s: He supports %d\r\n",
439 Name, *auth_send_data);
440 if ((i_support & ~i_wont_support) & typemask(*auth_send_data)) {
441 ap = findauthenticator(auth_send_data[0],
443 if (ap && ap->send) {
445 printf(">>>%s: Trying %d %d\r\n",
446 Name, auth_send_data[0],
448 if ((*ap->send)(ap)) {
450 * Okay, we found one we like
452 * we can go home now.
455 printf(">>>%s: Using type %d\r\n",
456 Name, *auth_send_data);
462 * just continue on and look for the
463 * next one if we didn't do anything.
468 telnet_net_write(str_none, sizeof(str_none));
469 printsub('>', &str_none[2], sizeof(str_none) - 2);
471 printf(">>>%s: Sent failure message\r\n", Name);
472 auth_finished(0, AUTH_REJECT);
476 * We requested strong authentication, however no mechanisms worked.
477 * Therefore, exit on client end.
479 printf("Unable to securely authenticate user ... exit\n");
485 auth_send_retry(void)
488 * if auth_send_cnt <= 0 then auth_send will end up rejecting
489 * the authentication and informing the other side of this.
491 auth_send(auth_send_data, auth_send_cnt);
495 auth_is(unsigned char *data, int cnt)
502 if (data[0] == AUTHTYPE_NULL) {
503 auth_finished(0, AUTH_REJECT);
507 if ((ap = findauthenticator(data[0], data[1]))) {
509 (*ap->is)(ap, data+2, cnt-2);
510 } else if (auth_debug_mode)
511 printf(">>>%s: Invalid authentication in IS: %d\r\n",
516 auth_reply(unsigned char *data, int cnt)
523 if ((ap = findauthenticator(data[0], data[1]))) {
525 (*ap->reply)(ap, data+2, cnt-2);
526 } else if (auth_debug_mode)
527 printf(">>>%s: Invalid authentication in SEND: %d\r\n",
532 auth_name(unsigned char *data, int cnt)
538 printf(">>>%s: Empty name in NAME\r\n", Name);
541 if (cnt > sizeof(savename) - 1) {
543 printf(">>>%s: Name in NAME (%d) exceeds %lu length\r\n",
544 Name, cnt, (unsigned long)(sizeof(savename)-1));
547 memmove(savename, data, cnt);
548 savename[cnt] = '\0'; /* Null terminate */
550 printf(">>>%s: Got NAME [%s]\r\n", Name, savename);
551 auth_encrypt_user(savename);
555 auth_sendname(unsigned char *cp, int len)
557 static unsigned char str_request[256+6]
558 = { IAC, SB, TELOPT_AUTHENTICATION, TELQUAL_NAME, };
559 unsigned char *e = str_request + 4;
560 unsigned char *ee = &str_request[sizeof(str_request)-2];
563 if ((*e++ = *cp++) == IAC)
570 telnet_net_write(str_request, e - str_request);
571 printsub('>', &str_request[2], e - &str_request[2]);
576 auth_finished(Authenticator *ap, int result)
578 if (!(authenticated = ap))
579 authenticated = &NoAuth;
587 auth_finished(0, AUTH_REJECT);
591 auth_wait(char *name, size_t name_sz)
594 printf(">>>%s: in auth_wait.\r\n", Name);
596 if (Server && !authenticating)
599 signal(SIGALRM, auth_intr);
601 while (!authenticated)
605 signal(SIGALRM, SIG_DFL);
608 * Now check to see if the user is valid or not
610 if (!authenticated || authenticated == &NoAuth)
613 if (validuser == AUTH_VALID)
614 validuser = AUTH_USER;
616 if (authenticated->status)
617 validuser = (*authenticated->status)(authenticated,
626 auth_debug_mode = mode;
630 auth_printsub(unsigned char *data, int cnt, unsigned char *buf, int buflen)
634 if ((ap = findauthenticator(data[1], data[2])) && ap->printsub)
635 (*ap->printsub)(data, cnt, buf, buflen);
637 auth_gen_printsub(data, cnt, buf, buflen);
641 auth_gen_printsub(unsigned char *data, int cnt, unsigned char *buf, int buflen)
644 unsigned char tbuf[16];
648 buf[buflen-1] = '\0';
651 for (; cnt > 0; cnt--, data++) {
652 snprintf((char*)tbuf, sizeof(tbuf), " %d", *data);
653 for (cp = tbuf; *cp && buflen > 0; --buflen)