Head

GCC Code Coverage Report

Directory:	./		Exec	Total	Coverage
File:	usr.bin/ssh/sshd/../auth2-chall.c	Lines:	0	140	0.0 %
Date:	2017-11-07	Branches:	0	85	0.0 %


/* $OpenBSD: auth2-chall.c,v 1.48 2017/05/30 14:29:59 markus Exp $ */
/*
 * Copyright (c) 2001 Markus Friedl.  All rights reserved.
 * Copyright (c) 2001 Per Allansson.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include <sys/types.h>

#include <stdio.h>
#include <string.h>

#include "xmalloc.h"
#include "ssh2.h"
#include "key.h"
#include "hostfile.h"
#include "auth.h"
#include "buffer.h"
#include "packet.h"
#include "dispatch.h"
#include "log.h"

static int auth2_challenge_start(struct ssh *);
static int send_userauth_info_request(Authctxt *);
static int input_userauth_info_response(int, u_int32_t, struct ssh *);

extern KbdintDevice bsdauth_device;

KbdintDevice *devices[] = {
	&bsdauth_device,
	NULL
};

typedef struct KbdintAuthctxt KbdintAuthctxt;
struct KbdintAuthctxt
{
	char *devices;
	void *ctxt;
	KbdintDevice *device;
	u_int nreq;
	u_int devices_done;
};

static KbdintAuthctxt *
kbdint_alloc(const char *devs)
{
	KbdintAuthctxt *kbdintctxt;
	Buffer b;
	int i;

	kbdintctxt = xcalloc(1, sizeof(KbdintAuthctxt));
	if (strcmp(devs, "") == 0) {
		buffer_init(&b);
		for (i = 0; devices[i]; i++) {
			if (buffer_len(&b) > 0)
				buffer_append(&b, ",", 1);
			buffer_append(&b, devices[i]->name,
			    strlen(devices[i]->name));
		}
		if ((kbdintctxt->devices = sshbuf_dup_string(&b)) == NULL)
			fatal("%s: sshbuf_dup_string failed", __func__);
		buffer_free(&b);
	} else {
		kbdintctxt->devices = xstrdup(devs);
	}
	debug("kbdint_alloc: devices '%s'", kbdintctxt->devices);
	kbdintctxt->ctxt = NULL;
	kbdintctxt->device = NULL;
	kbdintctxt->nreq = 0;

	return kbdintctxt;
}
static void
kbdint_reset_device(KbdintAuthctxt *kbdintctxt)
{
	if (kbdintctxt->ctxt) {
		kbdintctxt->device->free_ctx(kbdintctxt->ctxt);
		kbdintctxt->ctxt = NULL;
	}
	kbdintctxt->device = NULL;
}
static void
kbdint_free(KbdintAuthctxt *kbdintctxt)
{
	if (kbdintctxt->device)
		kbdint_reset_device(kbdintctxt);
	free(kbdintctxt->devices);
	explicit_bzero(kbdintctxt, sizeof(*kbdintctxt));
	free(kbdintctxt);
}
/* get next device */
static int
kbdint_next_device(Authctxt *authctxt, KbdintAuthctxt *kbdintctxt)
{
	size_t len;
	char *t;
	int i;

	if (kbdintctxt->device)
		kbdint_reset_device(kbdintctxt);
	do {
		len = kbdintctxt->devices ?
		    strcspn(kbdintctxt->devices, ",") : 0;

		if (len == 0)
			break;
		for (i = 0; devices[i]; i++) {
			if ((kbdintctxt->devices_done & (1 << i)) != 0 ||
			    !auth2_method_allowed(authctxt,
			    "keyboard-interactive", devices[i]->name))
				continue;
			if (strncmp(kbdintctxt->devices, devices[i]->name,
			    len) == 0) {
				kbdintctxt->device = devices[i];
				kbdintctxt->devices_done |= 1 << i;
			}
		}
		t = kbdintctxt->devices;
		kbdintctxt->devices = t[len] ? xstrdup(t+len+1) : NULL;
		free(t);
		debug2("kbdint_next_device: devices %s", kbdintctxt->devices ?
		    kbdintctxt->devices : "<empty>");
	} while (kbdintctxt->devices && !kbdintctxt->device);

	return kbdintctxt->device ? 1 : 0;
}

/*
 * try challenge-response, set authctxt->postponed if we have to
 * wait for the response.
 */
int
auth2_challenge(struct ssh *ssh, char *devs)
{
	Authctxt *authctxt = ssh->authctxt;
	debug("auth2_challenge: user=%s devs=%s",
	    authctxt->user ? authctxt->user : "<nouser>",
	    devs ? devs : "<no devs>");

	if (authctxt->user == NULL || !devs)
		return 0;
	if (authctxt->kbdintctxt == NULL)
		authctxt->kbdintctxt = kbdint_alloc(devs);
	return auth2_challenge_start(ssh);
}

/* unregister kbd-int callbacks and context */
void
auth2_challenge_stop(struct ssh *ssh)
{
	Authctxt *authctxt = ssh->authctxt;
	/* unregister callback */
	ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_INFO_RESPONSE, NULL);
	if (authctxt->kbdintctxt != NULL) {
		kbdint_free(authctxt->kbdintctxt);
		authctxt->kbdintctxt = NULL;
	}
}

/* side effect: sets authctxt->postponed if a reply was sent*/
static int
auth2_challenge_start(struct ssh *ssh)
{
	Authctxt *authctxt = ssh->authctxt;
	KbdintAuthctxt *kbdintctxt = authctxt->kbdintctxt;

	debug2("auth2_challenge_start: devices %s",
	    kbdintctxt->devices ?  kbdintctxt->devices : "<empty>");

	if (kbdint_next_device(authctxt, kbdintctxt) == 0) {
		auth2_challenge_stop(ssh);
		return 0;
	}
	debug("auth2_challenge_start: trying authentication method '%s'",
	    kbdintctxt->device->name);

	if ((kbdintctxt->ctxt = kbdintctxt->device->init_ctx(authctxt)) == NULL) {
		auth2_challenge_stop(ssh);
		return 0;
	}
	if (send_userauth_info_request(authctxt) == 0) {
		auth2_challenge_stop(ssh);
		return 0;
	}
	ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_INFO_RESPONSE,
	    &input_userauth_info_response);

	authctxt->postponed = 1;
	return 0;
}

static int
send_userauth_info_request(Authctxt *authctxt)
{
	KbdintAuthctxt *kbdintctxt;
	char *name, *instr, **prompts;
	u_int i, *echo_on;

	kbdintctxt = authctxt->kbdintctxt;
	if (kbdintctxt->device->query(kbdintctxt->ctxt,
	    &name, &instr, &kbdintctxt->nreq, &prompts, &echo_on))
		return 0;

	packet_start(SSH2_MSG_USERAUTH_INFO_REQUEST);
	packet_put_cstring(name);
	packet_put_cstring(instr);
	packet_put_cstring("");		/* language not used */
	packet_put_int(kbdintctxt->nreq);
	for (i = 0; i < kbdintctxt->nreq; i++) {
		packet_put_cstring(prompts[i]);
		packet_put_char(echo_on[i]);
	}
	packet_send();
	packet_write_wait();

	for (i = 0; i < kbdintctxt->nreq; i++)
		free(prompts[i]);
	free(prompts);
	free(echo_on);
	free(name);
	free(instr);
	return 1;
}

static int
input_userauth_info_response(int type, u_int32_t seq, struct ssh *ssh)
{
	Authctxt *authctxt = ssh->authctxt;
	KbdintAuthctxt *kbdintctxt;
	int authenticated = 0, res;
	u_int i, nresp;
	const char *devicename = NULL;
	char **response = NULL;

	if (authctxt == NULL)
		fatal("input_userauth_info_response: no authctxt");
	kbdintctxt = authctxt->kbdintctxt;
	if (kbdintctxt == NULL || kbdintctxt->ctxt == NULL)
		fatal("input_userauth_info_response: no kbdintctxt");
	if (kbdintctxt->device == NULL)
		fatal("input_userauth_info_response: no device");

	authctxt->postponed = 0;	/* reset */
	nresp = packet_get_int();
	if (nresp != kbdintctxt->nreq)
		fatal("input_userauth_info_response: wrong number of replies");
	if (nresp > 100)
		fatal("input_userauth_info_response: too many replies");
	if (nresp > 0) {
		response = xcalloc(nresp, sizeof(char *));
		for (i = 0; i < nresp; i++)
			response[i] = packet_get_string(NULL);
	}
	packet_check_eom();

	res = kbdintctxt->device->respond(kbdintctxt->ctxt, nresp, response);

	for (i = 0; i < nresp; i++) {
		explicit_bzero(response[i], strlen(response[i]));
		free(response[i]);
	}
	free(response);

	switch (res) {
	case 0:
		/* Success! */
		authenticated = authctxt->valid ? 1 : 0;
		break;
	case 1:
		/* Authentication needs further interaction */
		if (send_userauth_info_request(authctxt) == 1)
			authctxt->postponed = 1;
		break;
	default:
		/* Failure! */
		break;
	}
	devicename = kbdintctxt->device->name;
	if (!authctxt->postponed) {
		if (authenticated) {
			auth2_challenge_stop(ssh);
		} else {
			/* start next device */
			/* may set authctxt->postponed */
			auth2_challenge_start(ssh);
		}
	}
	userauth_finish(ssh, authenticated, "keyboard-interactive",
	    devicename);
	return 0;
}

void
privsep_challenge_enable(void)
{
	extern KbdintDevice mm_bsdauth_device;
	devices[0] = &mm_bsdauth_device;
}


Generated by: GCOVR (Version 3.3)

Line	Branch	Exec	Source
1			/* $OpenBSD: auth2-chall.c,v 1.48 2017/05/30 14:29:59 markus Exp $ */
2			/*
3			* Copyright (c) 2001 Markus Friedl. All rights reserved.
4			* Copyright (c) 2001 Per Allansson. All rights reserved.
5			*
6			* Redistribution and use in source and binary forms, with or without
7			* modification, are permitted provided that the following conditions
8			* are met:
9			* 1. Redistributions of source code must retain the above copyright
10			* notice, this list of conditions and the following disclaimer.
11			* 2. Redistributions in binary form must reproduce the above copyright
12			* notice, this list of conditions and the following disclaimer in the
13			* documentation and/or other materials provided with the distribution.
14			*
15			* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
16			* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
17			* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
18			* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
19			* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
20			* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
21			* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
22			* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
23			* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
24			* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
25			*/
26
27			#include <sys/types.h>
28
29			#include <stdio.h>
30			#include <string.h>
31
32			#include "xmalloc.h"
33			#include "ssh2.h"
34			#include "key.h"
35			#include "hostfile.h"
36			#include "auth.h"
37			#include "buffer.h"
38			#include "packet.h"
39			#include "dispatch.h"
40			#include "log.h"
41
42			static int auth2_challenge_start(struct ssh *);
43			static int send_userauth_info_request(Authctxt *);
44			static int input_userauth_info_response(int, u_int32_t, struct ssh *);
45
46			extern KbdintDevice bsdauth_device;
47
48			KbdintDevice *devices[] = {
49			&bsdauth_device,
50			NULL
51			};
52
53			typedef struct KbdintAuthctxt KbdintAuthctxt;
54			struct KbdintAuthctxt
55			{
56			char *devices;
57			void *ctxt;
58			KbdintDevice *device;
59			u_int nreq;
60			u_int devices_done;
61			};
62
63			static KbdintAuthctxt *
64			kbdint_alloc(const char *devs)
65			{
66			KbdintAuthctxt *kbdintctxt;
67			Buffer b;
68			int i;
69
70			kbdintctxt = xcalloc(1, sizeof(KbdintAuthctxt));
71			if (strcmp(devs, "") == 0) {
72			buffer_init(&b);
73			for (i = 0; devices[i]; i++) {
74			if (buffer_len(&b) > 0)
75			buffer_append(&b, ",", 1);
76			buffer_append(&b, devices[i]->name,
77			strlen(devices[i]->name));
78			}
79			if ((kbdintctxt->devices = sshbuf_dup_string(&b)) == NULL)
80			fatal("%s: sshbuf_dup_string failed", __func__);
81			buffer_free(&b);
82			} else {
83			kbdintctxt->devices = xstrdup(devs);
84			}
85			debug("kbdint_alloc: devices '%s'", kbdintctxt->devices);
86			kbdintctxt->ctxt = NULL;
87			kbdintctxt->device = NULL;
88			kbdintctxt->nreq = 0;
89
90			return kbdintctxt;
91			}
92			static void
93			kbdint_reset_device(KbdintAuthctxt *kbdintctxt)
94			{
95			if (kbdintctxt->ctxt) {
96			kbdintctxt->device->free_ctx(kbdintctxt->ctxt);
97			kbdintctxt->ctxt = NULL;
98			}
99			kbdintctxt->device = NULL;
100			}
101			static void
102			kbdint_free(KbdintAuthctxt *kbdintctxt)
103			{
104			if (kbdintctxt->device)
105			kbdint_reset_device(kbdintctxt);
106			free(kbdintctxt->devices);
107			explicit_bzero(kbdintctxt, sizeof(*kbdintctxt));
108			free(kbdintctxt);
109			}
110			/* get next device */
111			static int
112			kbdint_next_device(Authctxt authctxt, KbdintAuthctxt kbdintctxt)
113			{
114			size_t len;
115			char *t;
116			int i;
117
118			if (kbdintctxt->device)
119			kbdint_reset_device(kbdintctxt);
120			do {
121			len = kbdintctxt->devices ?
122			strcspn(kbdintctxt->devices, ",") : 0;
123
124			if (len == 0)
125			break;
126			for (i = 0; devices[i]; i++) {
127			if ((kbdintctxt->devices_done & (1 << i)) != 0 \|\|
128			!auth2_method_allowed(authctxt,
129			"keyboard-interactive", devices[i]->name))
130			continue;
131			if (strncmp(kbdintctxt->devices, devices[i]->name,
132			len) == 0) {
133			kbdintctxt->device = devices[i];
134			kbdintctxt->devices_done \|= 1 << i;
135			}
136			}
137			t = kbdintctxt->devices;
138			kbdintctxt->devices = t[len] ? xstrdup(t+len+1) : NULL;
139			free(t);
140			debug2("kbdint_next_device: devices %s", kbdintctxt->devices ?
141			kbdintctxt->devices : "<empty>");
142			} while (kbdintctxt->devices && !kbdintctxt->device);
143
144			return kbdintctxt->device ? 1 : 0;
145			}
146
147			/*
148			* try challenge-response, set authctxt->postponed if we have to
149			* wait for the response.
150			*/
151			int
152			auth2_challenge(struct ssh ssh, char devs)
153			{
154			Authctxt *authctxt = ssh->authctxt;
155			debug("auth2_challenge: user=%s devs=%s",
156			authctxt->user ? authctxt->user : "<nouser>",
157			devs ? devs : "<no devs>");
158
159			if (authctxt->user == NULL \|\| !devs)
160			return 0;
161			if (authctxt->kbdintctxt == NULL)
162			authctxt->kbdintctxt = kbdint_alloc(devs);
163			return auth2_challenge_start(ssh);
164			}
165
166			/* unregister kbd-int callbacks and context */
167			void
168			auth2_challenge_stop(struct ssh *ssh)
169			{
170			Authctxt *authctxt = ssh->authctxt;
171			/* unregister callback */
172			ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_INFO_RESPONSE, NULL);
173			if (authctxt->kbdintctxt != NULL) {
174			kbdint_free(authctxt->kbdintctxt);
175			authctxt->kbdintctxt = NULL;
176			}
177			}
178
179			/* side effect: sets authctxt->postponed if a reply was sent*/
180			static int
181			auth2_challenge_start(struct ssh *ssh)
182			{
183			Authctxt *authctxt = ssh->authctxt;
184			KbdintAuthctxt *kbdintctxt = authctxt->kbdintctxt;
185
186			debug2("auth2_challenge_start: devices %s",
187			kbdintctxt->devices ? kbdintctxt->devices : "<empty>");
188
189			if (kbdint_next_device(authctxt, kbdintctxt) == 0) {
190			auth2_challenge_stop(ssh);
191			return 0;
192			}
193			debug("auth2_challenge_start: trying authentication method '%s'",
194			kbdintctxt->device->name);
195
196			if ((kbdintctxt->ctxt = kbdintctxt->device->init_ctx(authctxt)) == NULL) {
197			auth2_challenge_stop(ssh);
198			return 0;
199			}
200			if (send_userauth_info_request(authctxt) == 0) {
201			auth2_challenge_stop(ssh);
202			return 0;
203			}
204			ssh_dispatch_set(ssh, SSH2_MSG_USERAUTH_INFO_RESPONSE,
205			&input_userauth_info_response);
206
207			authctxt->postponed = 1;
208			return 0;
209			}
210
211			static int
212			send_userauth_info_request(Authctxt *authctxt)
213			{
214			KbdintAuthctxt *kbdintctxt;
215			char name, instr, **prompts;
216			u_int i, *echo_on;
217
218			kbdintctxt = authctxt->kbdintctxt;
219			if (kbdintctxt->device->query(kbdintctxt->ctxt,
220			&name, &instr, &kbdintctxt->nreq, &prompts, &echo_on))
221			return 0;
222
223			packet_start(SSH2_MSG_USERAUTH_INFO_REQUEST);
224			packet_put_cstring(name);
225			packet_put_cstring(instr);
226			packet_put_cstring(""); /* language not used */
227			packet_put_int(kbdintctxt->nreq);
228			for (i = 0; i < kbdintctxt->nreq; i++) {
229			packet_put_cstring(prompts[i]);
230			packet_put_char(echo_on[i]);
231			}
232			packet_send();
233			packet_write_wait();
234
235			for (i = 0; i < kbdintctxt->nreq; i++)
236			free(prompts[i]);
237			free(prompts);
238			free(echo_on);
239			free(name);
240			free(instr);
241			return 1;
242			}
243
244			static int
245			input_userauth_info_response(int type, u_int32_t seq, struct ssh *ssh)
246			{
247			Authctxt *authctxt = ssh->authctxt;
248			KbdintAuthctxt *kbdintctxt;
249			int authenticated = 0, res;
250			u_int i, nresp;
251			const char *devicename = NULL;
252			char **response = NULL;
253
254			if (authctxt == NULL)
255			fatal("input_userauth_info_response: no authctxt");
256			kbdintctxt = authctxt->kbdintctxt;
257			if (kbdintctxt == NULL \|\| kbdintctxt->ctxt == NULL)
258			fatal("input_userauth_info_response: no kbdintctxt");
259			if (kbdintctxt->device == NULL)
260			fatal("input_userauth_info_response: no device");
261
262			authctxt->postponed = 0; /* reset */
263			nresp = packet_get_int();
264			if (nresp != kbdintctxt->nreq)
265			fatal("input_userauth_info_response: wrong number of replies");
266			if (nresp > 100)
267			fatal("input_userauth_info_response: too many replies");
268			if (nresp > 0) {
269			response = xcalloc(nresp, sizeof(char *));
270			for (i = 0; i < nresp; i++)
271			response[i] = packet_get_string(NULL);
272			}
273			packet_check_eom();
274
275			res = kbdintctxt->device->respond(kbdintctxt->ctxt, nresp, response);
276
277			for (i = 0; i < nresp; i++) {
278			explicit_bzero(response[i], strlen(response[i]));
279			free(response[i]);
280			}
281			free(response);
282
283			switch (res) {
284			case 0:
285			/* Success! */
286			authenticated = authctxt->valid ? 1 : 0;
287			break;
288			case 1:
289			/* Authentication needs further interaction */
290			if (send_userauth_info_request(authctxt) == 1)
291			authctxt->postponed = 1;
292			break;
293			default:
294			/* Failure! */
295			break;
296			}
297			devicename = kbdintctxt->device->name;
298			if (!authctxt->postponed) {
299			if (authenticated) {
300			auth2_challenge_stop(ssh);
301			} else {
302			/* start next device */
303			/* may set authctxt->postponed */
304			auth2_challenge_start(ssh);
305			}
306			}
307			userauth_finish(ssh, authenticated, "keyboard-interactive",
308			devicename);
309			return 0;
310			}
311
312			void
313			privsep_challenge_enable(void)
314			{
315			extern KbdintDevice mm_bsdauth_device;
316			devices[0] = &mm_bsdauth_device;
317			}