src/server/daemon/keyfile_auth.c

Mon, 06 Mar 2017 17:32:26 +0100

author
Olaf Wintermann <olaf.wintermann@gmail.com>
date
Mon, 06 Mar 2017 17:32:26 +0100
changeset 179
ef6827505bd2
parent 174
8f2a834d1d68
child 255
b5d15a4a19f5
permissions
-rw-r--r--

merge srvctrl into default branch

62
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
1 /*
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
2 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
3 *
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
4 * Copyright 2013 Olaf Wintermann. All rights reserved.
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
5 *
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
6 * Redistribution and use in source and binary forms, with or without
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
7 * modification, are permitted provided that the following conditions are met:
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
8 *
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
9 * 1. Redistributions of source code must retain the above copyright
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
10 * notice, this list of conditions and the following disclaimer.
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
11 *
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
12 * 2. Redistributions in binary form must reproduce the above copyright
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
13 * notice, this list of conditions and the following disclaimer in the
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
14 * documentation and/or other materials provided with the distribution.
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
15 *
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
16 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
17 * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
18 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
19 * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
20 * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
21 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
22 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
23 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
24 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
25 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
26 * POSSIBILITY OF SUCH DAMAGE.
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
27 */
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
28
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
29 #include <stdio.h>
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
30 #include <stdlib.h>
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
31 #include <string.h>
174
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
32
62
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
33 #include <openssl/sha.h>
174
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
34 #if defined(__sun) && defined(__SunOS_5_10)
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
35 #include <sha2.h>
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
36 #define SHA256_Init SHA256Init
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
37 #define SHA256_Update SHA256Update
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
38 #define SHA256_Final SHA256Final
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
39 #endif
62
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
40
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
41 #include "../util/atomic.h"
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
42 #include "../util/util.h"
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
43
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
44 #include "keyfile_auth.h"
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
45
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
46 Keyfile* keyfile_new() {
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
47 Keyfile *keyfile = malloc(sizeof(Keyfile));
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
48 keyfile->authdb.get_user = keyfile_get_user;
66
74babc0082b7 added authentication cache
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 64
diff changeset
49 keyfile->authdb.use_cache = 0;
62
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
50 keyfile->users = ucx_map_new(16);
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
51 keyfile->ref = 1;
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
52 return keyfile;
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
53 }
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
54
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
55 void keyfile_ref(Keyfile *keyfile) {
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
56 ws_atomic_inc32(&keyfile->ref);
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
57 }
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
58
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
59 void keyfile_unref(Keyfile *keyfile) {
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
60 uint32_t ref = ws_atomic_dec32(&keyfile->ref);
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
61 if(ref == 0) {
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
62 UcxMapIterator i = ucx_map_iterator(keyfile->users);
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
63 KeyfileUser *user;
88
73b3485e96f1 ucx update
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 66
diff changeset
64 UCX_MAP_FOREACH(key, user, i) {
62
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
65 free(user->user.name);
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
66 free(user->hash);
133
87b405d61f64 improves event handler and ssl error handling
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 99
diff changeset
67 for(int n=0;n<user->numgroups;n++) {
87b405d61f64 improves event handler and ssl error handling
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 99
diff changeset
68 free(user->groups[n].ptr);
62
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
69 }
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
70 free(user->groups);
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
71 }
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
72 ucx_map_free(keyfile->users);
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
73
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
74 free(keyfile->authdb.name);
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
75 free(keyfile);
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
76 }
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
77 }
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
78
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
79 void keyfile_add_user(
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
80 Keyfile *keyfile,
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
81 sstr_t name,
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
82 enum KeyfileHashType hash_type,
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
83 sstr_t hash,
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
84 sstr_t *groups,
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
85 size_t ngroups)
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
86 {
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
87 if(hash.length < 12) {
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
88 // hash too short
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
89 // TODO: log
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
90 return;
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
91 }
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
92
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
93 KeyfileUser *user = malloc(sizeof(KeyfileUser));
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
94 user->user.name = sstrdup(name).ptr;
63
66442f81f823 supports file system ACLs on Solaris
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 62
diff changeset
95 user->user.uid = -1;
66442f81f823 supports file system ACLs on Solaris
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 62
diff changeset
96 user->user.gid = -1;
62
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
97 user->user.verify_password = keyfile_user_verify_password;
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
98 user->user.check_group = keyfile_user_check_group;
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
99 user->user.free = keyfile_user_free;
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
100
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
101 user->hash_type = hash_type;
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
102 user->hash = malloc(hash.length + 1);
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
103 user->hashlen = util_base64decode(hash.ptr, hash.length, user->hash);
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
104
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
105 user->groups = calloc(ngroups, sizeof(sstr_t));
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
106 for(int i=0;i<ngroups;i++) {
97
09fbefc0e6a9 added ldap group support
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 88
diff changeset
107 user->groups[i] = sstrdup(groups[i]);
62
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
108 }
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
109
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
110 // add to keyfile
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
111 ucx_map_sstr_put(keyfile->users, name, user);
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
112 }
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
113
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
114 // authdb functions
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
115
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
116 User* keyfile_get_user(AuthDB *db, char *user) {
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
117 Keyfile *keyfile = (Keyfile*)db;
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
118 return ucx_map_cstr_get(keyfile->users, user);
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
119 }
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
120
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
121 int keyfile_user_verify_password(User *user, char *password) {
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
122 KeyfileUser *usr = (KeyfileUser*)user;
174
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
123 return ssha_verify(usr, password);
62
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
124 }
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
125
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
126 int keyfile_user_check_group(User *user, char *group) {
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
127 KeyfileUser *usr = (KeyfileUser*)user;
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
128 sstr_t grp = sstr(group);
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
129 for(int i=0;i<usr->numgroups;i++) {
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
130 if(!sstrcmp(usr->groups[i], grp)) {
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
131 return 1;
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
132 }
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
133 }
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
134 return 0;
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
135 }
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
136
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
137 void keyfile_user_free(User *user) {
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
138 // don't free, it will be freed by keyfile_unref
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
139 }
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
140
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
141
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
142 int ssha_verify(KeyfileUser *user, char *password) {
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
143 /*
174
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
144 * SSHA: SHA(pw + salt) + salt
97
09fbefc0e6a9 added ldap group support
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 88
diff changeset
145 * user->hash is already base64 decoded
62
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
146 */
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
147
174
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
148 size_t hlen;
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
149 switch(user->hash_type) {
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
150 case KEYFILE_SSHA: hlen = 20; break;
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
151 case KEYFILE_SSHA256: hlen = 32; break;
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
152 case KEYFILE_SSHA512: hlen = 64; break;
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
153 }
97
09fbefc0e6a9 added ldap group support
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 88
diff changeset
154
174
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
155 char *salt = user->hash + hlen;
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
156 size_t saltlen = user->hashlen - hlen;
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
157
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
158 size_t pwlen = strlen(password);
62
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
159
174
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
160 unsigned char pwhash[64];
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
161 switch(user->hash_type) {
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
162 case KEYFILE_SSHA: {
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
163 SHA_CTX ctx;
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
164 SHA1_Init(&ctx);
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
165 SHA1_Update(&ctx, password, pwlen);
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
166 SHA1_Update(&ctx, salt, saltlen);
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
167 SHA1_Final(pwhash, &ctx);
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
168 break;
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
169 }
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
170 case KEYFILE_SSHA256: {
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
171 SHA256_CTX ctx;
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
172 SHA256_Init(&ctx);
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
173 SHA256_Update(&ctx, password, pwlen);
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
174 SHA256_Update(&ctx, salt, saltlen);
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
175 SHA256_Final(pwhash, &ctx);
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
176 break;
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
177 }
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
178 case KEYFILE_SSHA512: {
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
179 SHA512_CTX ctx;
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
180 SHA512_Init(&ctx);
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
181 SHA512_Update(&ctx, password, pwlen);
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
182 SHA512_Update(&ctx, salt, saltlen);
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
183 SHA512_Final(pwhash, &ctx);
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
184 break;
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
185 }
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
186 }
62
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
187
174
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
188 if(!memcmp(user->hash, pwhash, hlen)) {
62
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
189 return 1;
64
c7f5b062e622 added net_writev
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 63
diff changeset
190 } else {
c7f5b062e622 added net_writev
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 63
diff changeset
191 return 0;
62
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
192 }
c47e081b6c0f added keyfile based authentication
Olaf Wintermann <olaf.wintermann@gmail.com>
parents:
diff changeset
193 }
174
8f2a834d1d68 adds sha2 support for keyfile auth
Olaf Wintermann <olaf.wintermann@gmail.com>
parents: 133
diff changeset
194

mercurial