freebsd-dev/crypto/openssh/auth-rsa.c

343 lines
8.9 KiB
C
Raw Normal View History

2014-03-22 15:23:38 +00:00
/* $OpenBSD: auth-rsa.c,v 1.86 2014/01/27 19:18:54 markus Exp $ */
2000-02-24 14:29:47 +00:00
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
* All rights reserved
* RSA-based authentication. This code determines whether to admit a login
* based on RSA authentication. This file also contains functions to check
* validity of the host key.
2000-05-15 04:37:24 +00:00
*
* As far as I am concerned, the code I have written for this software
* can be used freely for any purpose. Any derived versions of this
* software must be clearly marked as such, and if the derived work is
* incompatible with the protocol description in the RFC file, it must be
* called by a name other than "ssh" or "Secure Shell".
2000-02-24 14:29:47 +00:00
*/
#include "includes.h"
2006-09-30 13:29:51 +00:00
#include <sys/types.h>
#include <sys/stat.h>
#include <openssl/rsa.h>
2000-02-24 14:29:47 +00:00
2006-09-30 13:29:51 +00:00
#include <pwd.h>
#include <stdio.h>
#include <stdarg.h>
#include <string.h>
#include "xmalloc.h"
2000-02-24 14:29:47 +00:00
#include "rsa.h"
#include "packet.h"
#include "ssh1.h"
2000-02-24 14:29:47 +00:00
#include "uidswap.h"
#include "match.h"
2006-09-30 13:29:51 +00:00
#include "buffer.h"
#include "pathnames.h"
#include "log.h"
#include "servconf.h"
2006-09-30 13:29:51 +00:00
#include "key.h"
2010-11-08 10:45:44 +00:00
#include "auth-options.h"
2002-03-18 09:55:03 +00:00
#include "hostfile.h"
2006-09-30 13:29:51 +00:00
#include "auth.h"
#ifdef GSSAPI
#include "ssh-gss.h"
#endif
2002-06-23 14:01:54 +00:00
#include "monitor_wrap.h"
#include "ssh.h"
2005-06-05 15:40:50 +00:00
#include "misc.h"
2014-03-22 15:23:38 +00:00
#include "digest.h"
/* import */
extern ServerOptions options;
2000-02-24 14:29:47 +00:00
/*
* Session identifier that is used to bind key exchange and authentication
* responses to a particular session.
*/
extern u_char session_id[16];
2000-02-24 14:29:47 +00:00
/*
* The .ssh/authorized_keys file contains public keys, one per line, in the
* following format:
* options bits e n comment
* where bits, e and n are decimal numbers,
* and comment is any string of characters up to newline. The maximum
2005-06-05 15:40:50 +00:00
* length of a line is SSH_MAX_PUBKEY_BYTES characters. See sshd(8) for a
2000-02-24 14:29:47 +00:00
* description of the options.
*/
2002-06-23 14:01:54 +00:00
BIGNUM *
auth_rsa_generate_challenge(Key *key)
{
BIGNUM *challenge;
BN_CTX *ctx;
if ((challenge = BN_new()) == NULL)
fatal("auth_rsa_generate_challenge: BN_new() failed");
/* Generate a random challenge. */
2006-11-10 16:39:21 +00:00
if (BN_rand(challenge, 256, 0, 0) == 0)
fatal("auth_rsa_generate_challenge: BN_rand failed");
2002-06-23 14:01:54 +00:00
if ((ctx = BN_CTX_new()) == NULL)
2006-11-10 16:39:21 +00:00
fatal("auth_rsa_generate_challenge: BN_CTX_new failed");
if (BN_mod(challenge, challenge, key->rsa->n, ctx) == 0)
fatal("auth_rsa_generate_challenge: BN_mod failed");
2002-06-23 14:01:54 +00:00
BN_CTX_free(ctx);
return challenge;
}
int
auth_rsa_verify_response(Key *key, BIGNUM *challenge, u_char response[16])
{
u_char buf[32], mdbuf[16];
2014-03-22 15:23:38 +00:00
struct ssh_digest_ctx *md;
2002-06-23 14:01:54 +00:00
int len;
/* don't allow short keys */
if (BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE) {
2014-03-22 15:23:38 +00:00
error("%s: RSA modulus too small: %d < minimum %d bits",
__func__,
2002-06-23 14:01:54 +00:00
BN_num_bits(key->rsa->n), SSH_RSA_MINIMUM_MODULUS_SIZE);
return (0);
}
/* The response is MD5 of decrypted challenge plus session id. */
len = BN_num_bytes(challenge);
if (len <= 0 || len > 32)
2014-03-22 15:23:38 +00:00
fatal("%s: bad challenge length %d", __func__, len);
2002-06-23 14:01:54 +00:00
memset(buf, 0, 32);
BN_bn2bin(challenge, buf + 32 - len);
2014-03-22 15:23:38 +00:00
if ((md = ssh_digest_start(SSH_DIGEST_MD5)) == NULL ||
ssh_digest_update(md, buf, 32) < 0 ||
ssh_digest_update(md, session_id, 16) < 0 ||
ssh_digest_final(md, mdbuf, sizeof(mdbuf)) < 0)
fatal("%s: md5 failed", __func__);
ssh_digest_free(md);
2002-06-23 14:01:54 +00:00
/* Verify that the response is the original challenge. */
2010-11-08 10:45:44 +00:00
if (timingsafe_bcmp(response, mdbuf, 16) != 0) {
2002-06-23 14:01:54 +00:00
/* Wrong answer. */
return (0);
}
/* Correct answer. */
return (1);
}
2000-02-24 14:29:47 +00:00
/*
* Performs the RSA authentication challenge-response dialog with the client,
* and returns true (non-zero) if the client gave the correct answer to
* our challenge; returns zero if the client gives a wrong answer.
*/
int
2002-06-23 14:01:54 +00:00
auth_rsa_challenge_dialog(Key *key)
2000-02-24 14:29:47 +00:00
{
BIGNUM *challenge, *encrypted_challenge;
2002-06-23 14:01:54 +00:00
u_char response[16];
int i, success;
2000-02-24 14:29:47 +00:00
2002-03-18 09:55:03 +00:00
if ((encrypted_challenge = BN_new()) == NULL)
fatal("auth_rsa_challenge_dialog: BN_new() failed");
2000-02-24 14:29:47 +00:00
2002-06-23 14:01:54 +00:00
challenge = PRIVSEP(auth_rsa_generate_challenge(key));
2000-02-24 14:29:47 +00:00
/* Encrypt the challenge with the public key. */
2002-06-23 14:01:54 +00:00
rsa_public_encrypt(encrypted_challenge, challenge, key->rsa);
2000-02-24 14:29:47 +00:00
/* Send the encrypted challenge to the client. */
packet_start(SSH_SMSG_AUTH_RSA_CHALLENGE);
packet_put_bignum(encrypted_challenge);
packet_send();
BN_clear_free(encrypted_challenge);
packet_write_wait();
/* Wait for a response. */
2002-03-18 09:55:03 +00:00
packet_read_expect(SSH_CMSG_AUTH_RSA_RESPONSE);
2000-02-24 14:29:47 +00:00
for (i = 0; i < 16; i++)
2006-09-30 13:29:51 +00:00
response[i] = (u_char)packet_get_char();
2002-03-18 09:55:03 +00:00
packet_check_eom();
2000-02-24 14:29:47 +00:00
2002-06-23 14:01:54 +00:00
success = PRIVSEP(auth_rsa_verify_response(key, challenge, response));
2000-02-24 14:29:47 +00:00
BN_clear_free(challenge);
2002-06-23 14:01:54 +00:00
return (success);
2000-02-24 14:29:47 +00:00
}
2011-09-28 08:14:41 +00:00
static int
rsa_key_allowed_in_file(struct passwd *pw, char *file,
const BIGNUM *client_n, Key **rkey)
2000-02-24 14:29:47 +00:00
{
2013-09-18 17:27:38 +00:00
char *fp, line[SSH_MAX_PUBKEY_BYTES];
int allowed = 0, bits;
2000-02-24 14:29:47 +00:00
FILE *f;
u_long linenum = 0;
2002-03-18 09:55:03 +00:00
Key *key;
2002-03-18 09:55:03 +00:00
debug("trying public RSA key file %s", file);
2011-09-28 08:14:41 +00:00
if ((f = auth_openkeyfile(file, pw, options.strict_modes)) == NULL)
return 0;
2000-02-24 14:29:47 +00:00
/*
* Go though the accepted keys, looking for the current key. If
* found, perform a challenge-response dialog to verify that the
* user really has the corresponding private key.
*/
2011-09-28 08:14:41 +00:00
key = key_new(KEY_RSA1);
2005-06-05 15:40:50 +00:00
while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) {
2000-02-24 14:29:47 +00:00
char *cp;
2004-10-28 16:03:53 +00:00
char *key_options;
2005-09-03 06:59:33 +00:00
int keybits;
2000-02-24 14:29:47 +00:00
/* Skip leading whitespace, empty and comment lines. */
for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
;
if (!*cp || *cp == '\n' || *cp == '#')
continue;
/*
* Check if there are options for this key, and if so,
* save their starting address and skip the option part
* for now. If there are no options, set the starting
* address to NULL.
*/
if (*cp < '0' || *cp > '9') {
int quoted = 0;
2004-10-28 16:03:53 +00:00
key_options = cp;
2000-02-24 14:29:47 +00:00
for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) {
if (*cp == '\\' && cp[1] == '"')
cp++; /* Skip both */
else if (*cp == '"')
quoted = !quoted;
}
} else
2004-10-28 16:03:53 +00:00
key_options = NULL;
2000-02-24 14:29:47 +00:00
/* Parse the key from the line. */
2002-03-18 09:55:03 +00:00
if (hostfile_read_key(&cp, &bits, key) == 0) {
debug("%.100s, line %lu: non ssh1 key syntax",
file, linenum);
2000-02-24 14:29:47 +00:00
continue;
}
/* cp now points to the comment part. */
2011-09-28 08:14:41 +00:00
/*
* Check if the we have found the desired key (identified
* by its modulus).
*/
2002-03-18 09:55:03 +00:00
if (BN_cmp(key->rsa->n, client_n) != 0)
2000-02-24 14:29:47 +00:00
continue;
/* check the real bits */
2005-09-03 06:59:33 +00:00
keybits = BN_num_bits(key->rsa->n);
2013-09-18 17:27:38 +00:00
if (keybits < 0 || bits != keybits)
2004-01-07 11:10:17 +00:00
logit("Warning: %s, line %lu: keysize mismatch: "
2000-02-24 14:29:47 +00:00
"actual %d vs. announced %d.",
2002-03-18 09:55:03 +00:00
file, linenum, BN_num_bits(key->rsa->n), bits);
2000-02-24 14:29:47 +00:00
2013-09-18 17:27:38 +00:00
fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
debug("matching key found: file %s, line %lu %s %s",
file, linenum, key_type(key), fp);
free(fp);
2011-02-17 11:47:40 +00:00
/* Never accept a revoked key */
if (auth_key_is_revoked(key))
break;
2000-02-24 14:29:47 +00:00
/* We have found the desired key. */
/*
* If our options do not allow this key to be used,
* do not send challenge.
*/
2004-10-28 16:03:53 +00:00
if (!auth_parse_options(pw, key_options, file, linenum))
continue;
2010-11-08 10:45:44 +00:00
if (key_is_cert_authority)
continue;
2002-06-23 14:01:54 +00:00
/* break out, this key is allowed */
allowed = 1;
break;
2000-02-24 14:29:47 +00:00
}
/* Close the file. */
fclose(f);
2002-06-23 14:01:54 +00:00
/* return key if allowed */
if (allowed && rkey != NULL)
*rkey = key;
else
2002-06-23 14:01:54 +00:00
key_free(key);
2011-09-28 08:14:41 +00:00
return allowed;
}
/*
* check if there's user key matching client_n,
* return key if login is allowed, NULL otherwise
*/
int
auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey)
{
char *file;
u_int i, allowed = 0;
temporarily_use_uid(pw);
for (i = 0; !allowed && i < options.num_authkeys_files; i++) {
2013-03-22 11:19:48 +00:00
if (strcasecmp(options.authorized_keys_files[i], "none") == 0)
continue;
2011-09-28 08:14:41 +00:00
file = expand_authorized_keys(
options.authorized_keys_files[i], pw);
allowed = rsa_key_allowed_in_file(pw, file, client_n, rkey);
2013-09-18 17:27:38 +00:00
free(file);
2011-09-28 08:14:41 +00:00
}
restore_uid();
return allowed;
2002-06-23 14:01:54 +00:00
}
/*
* Performs the RSA authentication dialog with the client. This returns
* 0 if the client could not be authenticated, and 1 if authentication was
* successful. This may exit if there is a serious protocol violation.
*/
int
2004-02-26 10:38:49 +00:00
auth_rsa(Authctxt *authctxt, BIGNUM *client_n)
2002-06-23 14:01:54 +00:00
{
Key *key;
2004-02-26 10:38:49 +00:00
struct passwd *pw = authctxt->pw;
2002-06-23 14:01:54 +00:00
/* no user given */
2004-02-26 10:38:49 +00:00
if (!authctxt->valid)
2002-06-23 14:01:54 +00:00
return 0;
if (!PRIVSEP(auth_rsa_key_allowed(pw, client_n, &key))) {
auth_clear_options();
2002-06-23 14:01:54 +00:00
return (0);
}
/* Perform the challenge-response dialog for this key. */
if (!auth_rsa_challenge_dialog(key)) {
/* Wrong response. */
verbose("Wrong response to RSA authentication challenge.");
packet_send_debug("Wrong response to RSA authentication challenge.");
/*
* Break out of the loop. Otherwise we might send
* another challenge and break the protocol.
*/
key_free(key);
return (0);
}
/*
* Correct response. The client has been successfully
* authenticated. Note that we have not yet processed the
* options; this will be reset if the options cause the
* authentication to be rejected.
*/
2013-09-18 17:27:38 +00:00
pubkey_auth_info(authctxt, key, NULL);
2000-02-24 14:29:47 +00:00
2002-06-23 14:01:54 +00:00
packet_send_debug("RSA authentication accepted.");
return (1);
2000-02-24 14:29:47 +00:00
}