1 | /* $OpenBSD: auth.h,v 1.41 2002/09/26 11:38:43 markus Exp $ */ |
---|
2 | |
---|
3 | /* |
---|
4 | * Copyright (c) 2000 Markus Friedl. All rights reserved. |
---|
5 | * |
---|
6 | * Redistribution and use in source and binary forms, with or without |
---|
7 | * modification, are permitted provided that the following conditions |
---|
8 | * are met: |
---|
9 | * 1. Redistributions of source code must retain the above copyright |
---|
10 | * notice, this list of conditions and the following disclaimer. |
---|
11 | * 2. Redistributions in binary form must reproduce the above copyright |
---|
12 | * notice, this list of conditions and the following disclaimer in the |
---|
13 | * documentation and/or other materials provided with the distribution. |
---|
14 | * |
---|
15 | * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR |
---|
16 | * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES |
---|
17 | * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. |
---|
18 | * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, |
---|
19 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT |
---|
20 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
---|
21 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
---|
22 | * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
---|
23 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
---|
24 | * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
---|
25 | * |
---|
26 | */ |
---|
27 | |
---|
28 | #ifndef AUTH_H |
---|
29 | #define AUTH_H |
---|
30 | |
---|
31 | #include "key.h" |
---|
32 | #include "hostfile.h" |
---|
33 | #include <openssl/rsa.h> |
---|
34 | |
---|
35 | #ifdef HAVE_LOGIN_CAP |
---|
36 | #include <login_cap.h> |
---|
37 | #endif |
---|
38 | #ifdef BSD_AUTH |
---|
39 | #include <bsd_auth.h> |
---|
40 | #endif |
---|
41 | #ifdef KRB5 |
---|
42 | #include <krb5.h> |
---|
43 | #endif |
---|
44 | |
---|
45 | typedef struct Authctxt Authctxt; |
---|
46 | typedef struct Authmethod Authmethod; |
---|
47 | typedef struct KbdintDevice KbdintDevice; |
---|
48 | |
---|
49 | struct Authctxt { |
---|
50 | int success; |
---|
51 | int postponed; |
---|
52 | int valid; |
---|
53 | int attempt; |
---|
54 | int failures; |
---|
55 | char *user; |
---|
56 | char *service; |
---|
57 | struct passwd *pw; |
---|
58 | char *style; |
---|
59 | void *kbdintctxt; |
---|
60 | #ifdef BSD_AUTH |
---|
61 | auth_session_t *as; |
---|
62 | #endif |
---|
63 | #ifdef KRB4 |
---|
64 | char *krb4_ticket_file; |
---|
65 | #endif |
---|
66 | #ifdef KRB5 |
---|
67 | krb5_context krb5_ctx; |
---|
68 | krb5_auth_context krb5_auth_ctx; |
---|
69 | krb5_ccache krb5_fwd_ccache; |
---|
70 | krb5_principal krb5_user; |
---|
71 | char *krb5_ticket_file; |
---|
72 | #endif |
---|
73 | void *methoddata; |
---|
74 | }; |
---|
75 | |
---|
76 | struct Authmethod { |
---|
77 | char *name; |
---|
78 | int (*userauth)(Authctxt *authctxt); |
---|
79 | int *enabled; |
---|
80 | }; |
---|
81 | |
---|
82 | /* |
---|
83 | * Keyboard interactive device: |
---|
84 | * init_ctx returns: non NULL upon success |
---|
85 | * query returns: 0 - success, otherwise failure |
---|
86 | * respond returns: 0 - success, 1 - need further interaction, |
---|
87 | * otherwise - failure |
---|
88 | */ |
---|
89 | struct KbdintDevice |
---|
90 | { |
---|
91 | const char *name; |
---|
92 | void* (*init_ctx)(Authctxt*); |
---|
93 | int (*query)(void *ctx, char **name, char **infotxt, |
---|
94 | u_int *numprompts, char ***prompts, u_int **echo_on); |
---|
95 | int (*respond)(void *ctx, u_int numresp, char **responses); |
---|
96 | void (*free_ctx)(void *ctx); |
---|
97 | }; |
---|
98 | |
---|
99 | int auth_rhosts(struct passwd *, const char *); |
---|
100 | int |
---|
101 | auth_rhosts2(struct passwd *, const char *, const char *, const char *); |
---|
102 | |
---|
103 | int auth_rhosts_rsa(struct passwd *, char *, Key *); |
---|
104 | int auth_password(Authctxt *, const char *); |
---|
105 | int auth_rsa(struct passwd *, BIGNUM *); |
---|
106 | int auth_rsa_challenge_dialog(Key *); |
---|
107 | BIGNUM *auth_rsa_generate_challenge(Key *); |
---|
108 | int auth_rsa_verify_response(Key *, BIGNUM *, u_char[]); |
---|
109 | int auth_rsa_key_allowed(struct passwd *, BIGNUM *, Key **); |
---|
110 | |
---|
111 | int auth_rhosts_rsa_key_allowed(struct passwd *, char *, char *, Key *); |
---|
112 | int hostbased_key_allowed(struct passwd *, const char *, char *, Key *); |
---|
113 | int user_key_allowed(struct passwd *, Key *); |
---|
114 | |
---|
115 | #ifdef KRB4 |
---|
116 | #include <krb.h> |
---|
117 | int auth_krb4(Authctxt *, KTEXT, char **, KTEXT); |
---|
118 | int auth_krb4_password(Authctxt *, const char *); |
---|
119 | void krb4_cleanup_proc(void *); |
---|
120 | |
---|
121 | #ifdef AFS |
---|
122 | #include <kafs.h> |
---|
123 | int auth_krb4_tgt(Authctxt *, const char *); |
---|
124 | int auth_afs_token(Authctxt *, const char *); |
---|
125 | #endif /* AFS */ |
---|
126 | |
---|
127 | #endif /* KRB4 */ |
---|
128 | |
---|
129 | #ifdef KRB5 |
---|
130 | int auth_krb5(Authctxt *authctxt, krb5_data *auth, char **client, krb5_data *); |
---|
131 | int auth_krb5_tgt(Authctxt *authctxt, krb5_data *tgt); |
---|
132 | int auth_krb5_password(Authctxt *authctxt, const char *password); |
---|
133 | void krb5_cleanup_proc(void *authctxt); |
---|
134 | #endif /* KRB5 */ |
---|
135 | |
---|
136 | void session_cleanup(void); |
---|
137 | |
---|
138 | #include "auth-pam.h" |
---|
139 | #include "auth2-pam.h" |
---|
140 | |
---|
141 | Authctxt *do_authentication(void); |
---|
142 | Authctxt *do_authentication2(void); |
---|
143 | |
---|
144 | Authctxt *authctxt_new(void); |
---|
145 | void auth_log(Authctxt *, int, char *, char *); |
---|
146 | void userauth_finish(Authctxt *, int, char *); |
---|
147 | int auth_root_allowed(char *); |
---|
148 | |
---|
149 | char *auth2_read_banner(void); |
---|
150 | |
---|
151 | void privsep_challenge_enable(void); |
---|
152 | |
---|
153 | int auth2_challenge(Authctxt *, char *); |
---|
154 | void auth2_challenge_stop(Authctxt *); |
---|
155 | int bsdauth_query(void *, char **, char **, u_int *, char ***, u_int **); |
---|
156 | int bsdauth_respond(void *, u_int, char **); |
---|
157 | int skey_query(void *, char **, char **, u_int *, char ***, u_int **); |
---|
158 | int skey_respond(void *, u_int, char **); |
---|
159 | |
---|
160 | int allowed_user(struct passwd *); |
---|
161 | struct passwd * getpwnamallow(const char *user); |
---|
162 | |
---|
163 | char *get_challenge(Authctxt *); |
---|
164 | int verify_response(Authctxt *, const char *); |
---|
165 | |
---|
166 | struct passwd * auth_get_user(void); |
---|
167 | |
---|
168 | char *expand_filename(const char *, struct passwd *); |
---|
169 | char *authorized_keys_file(struct passwd *); |
---|
170 | char *authorized_keys_file2(struct passwd *); |
---|
171 | |
---|
172 | int |
---|
173 | secure_filename(FILE *, const char *, struct passwd *, char *, size_t); |
---|
174 | |
---|
175 | HostStatus |
---|
176 | check_key_in_hostfiles(struct passwd *, Key *, const char *, |
---|
177 | const char *, const char *); |
---|
178 | |
---|
179 | /* hostkey handling */ |
---|
180 | Key *get_hostkey_by_index(int); |
---|
181 | Key *get_hostkey_by_type(int); |
---|
182 | int get_hostkey_index(Key *); |
---|
183 | int ssh1_session_key(BIGNUM *); |
---|
184 | |
---|
185 | /* debug messages during authentication */ |
---|
186 | void auth_debug_add(const char *fmt,...) __attribute__((format(printf, 1, 2))); |
---|
187 | void auth_debug_send(void); |
---|
188 | void auth_debug_reset(void); |
---|
189 | |
---|
190 | #define AUTH_FAIL_MAX 6 |
---|
191 | #define AUTH_FAIL_LOG (AUTH_FAIL_MAX/2) |
---|
192 | #define AUTH_FAIL_MSG "Too many authentication failures for %.100s" |
---|
193 | |
---|
194 | #define SKEY_PROMPT "\nS/Key Password: " |
---|
195 | #endif |
---|