From: Andrew Tridgell Date: Wed, 13 May 1998 11:49:05 +0000 (+0000) Subject: first working version of challenge response authentication. needs X-Git-Tag: v2.0.0~13 X-Git-Url: http://git.samba.org/samba.git/?p=rsync.git;a=commitdiff_plain;h=bcb7e50250111ebfd299355783201223097212bd first working version of challenge response authentication. needs testing. --- diff --git a/Makefile.in b/Makefile.in index a222a813..385082de 100644 --- a/Makefile.in +++ b/Makefile.in @@ -23,7 +23,7 @@ SHELL=/bin/sh LIBOBJ=lib/getopt.o lib/fnmatch.o lib/zlib.o lib/compat.o OBJS1=rsync.o exclude.o util.o md4.o main.o checksum.o match.o syscall.o log.o OBJS2=options.o flist.o io.o compat.o hlink.o token.o uidlist.o socket.o -DAEMON_OBJ = params.o loadparm.o clientserver.o access.o connection.o +DAEMON_OBJ = params.o loadparm.o clientserver.o access.o connection.o authenticate.o OBJS=$(OBJS1) $(OBJS2) $(DAEMON_OBJ) $(LIBOBJ) # note that the -I. is needed to handle config.h when using VPATH diff --git a/authenticate.c b/authenticate.c index 28f777e1..4f4aac22 100644 --- a/authenticate.c +++ b/authenticate.c @@ -19,3 +19,180 @@ /* support rsync authentication */ #include "rsync.h" +/*************************************************************************** +encode a buffer using base64 - simple and slow algorithm. null terminates +the result. + ***************************************************************************/ +static void base64_encode(char *buf, int len, char *out) +{ + char *b64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; + int bit_offset, byte_offset, idx, i; + unsigned char *d = (unsigned char *)buf; + char *p; + int bytes = (len*8 + 5)/6; + + memset(out, 0, bytes+1); + + for (i=0;i> (2-bit_offset)) & 0x3F; + } else { + idx = (d[byte_offset] << (bit_offset-2)) & 0x3F; + if (byte_offset+1 < len) { + idx |= (d[byte_offset+1] >> (8-(bit_offset-2))); + } + } + out[i] = b64[idx]; + } +} + +/* create a 16 byte challenge buffer */ +static void gen_challenge(char *addr, char *challenge) +{ + char input[32]; + struct timeval tv; + + memset(input, 0, sizeof(input)); + + strncpy((char *)input, addr, 16); + gettimeofday(&tv, NULL); + SIVAL(input, 16, tv.tv_sec); + SIVAL(input, 20, tv.tv_usec); + SIVAL(input, 24, getpid()); + + sum_init(); + sum_update(input, sizeof(input)); + sum_end(challenge); +} + + +/* return the secret for a user from the sercret file. maximum length + is len. null terminate it */ +static int get_secret(int module, char *user, char *secret, int len) +{ + char *fname = lp_secrets_file(module); + int fd, found=0; + char line[1024]; + char *p, *pass; + + if (!fname || !*fname) return 0; + + fd = open(fname,O_RDONLY); + if (fd == -1) return 0; + + while (!found) { + int i = 0; + memset(line, 0, sizeof(line)); + while (i<(sizeof(line)-1)) { + if (read(fd, &line[i], 1) != 1) { + memset(line, 0, sizeof(line)); + close(fd); + return 0; + } + if (line[i] == '\r') continue; + if (line[i] == '\n') break; + i++; + } + line[i] = 0; + if (line[0] == '#') continue; + p = strchr(line,':'); + if (!p) continue; + *p = 0; + if (strcmp(user, line)) continue; + pass = p+1; + found = 1; + } + + close(fd); + if (!found) return 0; + + if (strlen(pass) > len-1) { + memset(line, 0, sizeof(line)); + return 0; + } + + strcpy(secret, pass); + return 1; +} + +/* generate a 16 byte hash from a password and challenge */ +void generate_hash(char *in, char *challenge, char *out) +{ + char buf[16]; + + sum_init(); + sum_update(in, strlen(in)); + sum_update(challenge, strlen(challenge)); + sum_end(buf); + + base64_encode(buf, 16, out); +} + +/* possible negotiate authentication with the client. Use "leader" to + start off the auth if necessary */ +int auth_server(int fd, int module, char *addr, char *leader) +{ + char *users = lp_auth_users(module); + char challenge[16]; + char b64_challenge[30]; + char line[1024]; + char user[100]; + char secret[100]; + char pass[30]; + char pass2[30]; + + /* if no auth list then allow anyone in! */ + if (!users || !*users) return 1; + + gen_challenge(addr, challenge); + + base64_encode(challenge, 16, b64_challenge); + + io_printf(fd,"%s%s\n", leader, b64_challenge); + + if (!read_line(fd, line, sizeof(line)-1)) { + return 0; + } + + memset(user, 0, sizeof(user)); + memset(pass, 0, sizeof(pass)); + + if (sscanf(line,"%99s %29s", user, pass) != 2) { + return 0; + } + + memset(secret, 0, sizeof(secret)); + if (!get_secret(module, user, secret, sizeof(secret)-1)) { + memset(secret, 0, sizeof(secret)); + return 0; + } + + generate_hash(secret, b64_challenge, pass2); + memset(secret, 0, sizeof(secret)); + + return (strcmp(pass, pass2) == 0); +} + + +void auth_client(int fd, char *user, char *challenge) +{ + char *pass; + char pass2[30]; + + if (!user || !*user) return; + + if (!(pass=getenv("RSYNC_PASSWORD"))) { + pass = getpass("Password: "); + } + + if (!pass || !*pass) { + pass = ""; + } + + generate_hash(pass, challenge, pass2); + + io_printf(fd, "%s %s\n", user, pass2); +} + diff --git a/clientserver.c b/clientserver.c index 173ca0c5..7fca65ec 100644 --- a/clientserver.c +++ b/clientserver.c @@ -31,9 +31,19 @@ int start_socket_client(char *host, char *path, int argc, char *argv[]) char *sargs[MAX_ARGS]; int sargc=0; char line[1024]; - char *p; + char *p, *user=NULL; extern int remote_version; + p = strchr(host, '@'); + if (p) { + user = host; + host = p+1; + *p = 0; + } + + if (!user) user = getenv("USER"); + if (!user) user = getenv("LOGNAME"); + fd = open_socket_out(host, rsync_port); if (fd == -1) { exit_cleanup(1); @@ -68,12 +78,10 @@ int start_socket_client(char *host, char *path, int argc, char *argv[]) return -1; } -#if 0 if (strncmp(line,"@RSYNCD: AUTHREQD ",18) == 0) { - auth_client(fd, line+18); + auth_client(fd, user, line+18); continue; } -#endif if (strcmp(line,"@RSYNCD: OK") == 0) break; rprintf(FINFO,"%s\n", line); @@ -84,15 +92,6 @@ int start_socket_client(char *host, char *path, int argc, char *argv[]) } io_printf(fd,"\n"); -#if 0 - while (1) { - if (!read_line(fd, line, sizeof(line)-1)) { - return -1; - } - rprintf(FINFO,"%s\n", line); - } -#endif - return client_run(fd, fd, -1, argc, argv); } @@ -117,13 +116,11 @@ static int rsync_module(int fd, int i) return -1; } -#if 0 - if (!auth_server(fd, "@RSYNCD: AUTHREQD ")) { + if (!auth_server(fd, i, addr, "@RSYNCD: AUTHREQD ")) { rprintf(FERROR,"auth failed on module %s from %s (%s)\n", lp_name(i), client_name(fd), client_addr(fd)); return -1; } -#endif if (!claim_connection(lp_lock_file(), lp_max_connections())) { rprintf(FERROR,"ERROR: max connections reached\n"); @@ -266,7 +263,6 @@ static int start_daemon(int fd) } while (i == -1) { - line[0] = 0; if (!read_line(fd, line, sizeof(line)-1)) { return -1;