auth-chall.c revision 162856
1/* $OpenBSD: auth-chall.c,v 1.12 2006/08/03 03:34:41 deraadt Exp $ */ 2/* 3 * Copyright (c) 2001 Markus Friedl. All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 15 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 16 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 17 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 18 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 19 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 20 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 21 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 22 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 23 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 24 */ 25 26#include "includes.h" 27__RCSID("$FreeBSD: head/crypto/openssh/auth-chall.c 162856 2006-09-30 13:38:06Z des $"); 28 29#include <sys/types.h> 30 31#include <stdarg.h> 32 33#include "xmalloc.h" 34#include "key.h" 35#include "hostfile.h" 36#include "auth.h" 37#include "log.h" 38#include "servconf.h" 39 40/* limited protocol v1 interface to kbd-interactive authentication */ 41 42extern KbdintDevice *devices[]; 43static KbdintDevice *device; 44extern ServerOptions options; 45 46char * 47get_challenge(Authctxt *authctxt) 48{ 49 char *challenge, *name, *info, **prompts; 50 u_int i, numprompts; 51 u_int *echo_on; 52 53#ifdef USE_PAM 54 if (!options.use_pam) 55 remove_kbdint_device("pam"); 56#endif 57 58 device = devices[0]; /* we always use the 1st device for protocol 1 */ 59 if (device == NULL) 60 return NULL; 61 if ((authctxt->kbdintctxt = device->init_ctx(authctxt)) == NULL) 62 return NULL; 63 if (device->query(authctxt->kbdintctxt, &name, &info, 64 &numprompts, &prompts, &echo_on)) { 65 device->free_ctx(authctxt->kbdintctxt); 66 authctxt->kbdintctxt = NULL; 67 return NULL; 68 } 69 if (numprompts < 1) 70 fatal("get_challenge: numprompts < 1"); 71 challenge = xstrdup(prompts[0]); 72 for (i = 0; i < numprompts; i++) 73 xfree(prompts[i]); 74 xfree(prompts); 75 xfree(name); 76 xfree(echo_on); 77 xfree(info); 78 79 return (challenge); 80} 81int 82verify_response(Authctxt *authctxt, const char *response) 83{ 84 char *resp[1], *name, *info, **prompts; 85 u_int i, numprompts, *echo_on; 86 int authenticated = 0; 87 88 if (device == NULL) 89 return 0; 90 if (authctxt->kbdintctxt == NULL) 91 return 0; 92 resp[0] = (char *)response; 93 switch (device->respond(authctxt->kbdintctxt, 1, resp)) { 94 case 0: /* Success */ 95 authenticated = 1; 96 break; 97 case 1: /* Postponed - retry with empty query for PAM */ 98 if ((device->query(authctxt->kbdintctxt, &name, &info, 99 &numprompts, &prompts, &echo_on)) != 0) 100 break; 101 if (numprompts == 0 && 102 device->respond(authctxt->kbdintctxt, 0, resp) == 0) 103 authenticated = 1; 104 105 for (i = 0; i < numprompts; i++) 106 xfree(prompts[i]); 107 xfree(prompts); 108 xfree(name); 109 xfree(echo_on); 110 xfree(info); 111 break; 112 } 113 device->free_ctx(authctxt->kbdintctxt); 114 authctxt->kbdintctxt = NULL; 115 return authenticated; 116} 117void 118abandon_challenge_response(Authctxt *authctxt) 119{ 120 if (authctxt->kbdintctxt != NULL) { 121 device->free_ctx(authctxt->kbdintctxt); 122 authctxt->kbdintctxt = NULL; 123 } 124} 125