1/* $OpenBSD: auth-rsa.c,v 1.81 2012/10/30 21:29:54 djm Exp $ */ 2/* 3 * Author: Tatu Ylonen <ylo@cs.hut.fi> 4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 5 * All rights reserved 6 * RSA-based authentication. This code determines whether to admit a login 7 * based on RSA authentication. This file also contains functions to check 8 * validity of the host key. 9 * 10 * As far as I am concerned, the code I have written for this software 11 * can be used freely for any purpose. Any derived versions of this 12 * software must be clearly marked as such, and if the derived work is 13 * incompatible with the protocol description in the RFC file, it must be 14 * called by a name other than "ssh" or "Secure Shell". 15 */ 16 17#include "includes.h" 18 19#include <sys/types.h> 20#include <sys/stat.h> 21 22#ifdef __APPLE_CRYPTO__ 23#include "ossl-rsa.h" 24#include "ossl-md5.h" 25#else 26#include <openssl/rsa.h> 27#include <openssl/md5.h> 28#endif 29 30#include <pwd.h> 31#include <stdio.h> 32#include <stdarg.h> 33#include <string.h> 34 35#include "xmalloc.h" 36#include "rsa.h" 37#include "packet.h" 38#include "ssh1.h" 39#include "uidswap.h" 40#include "match.h" 41#include "buffer.h" 42#include "pathnames.h" 43#include "log.h" 44#include "servconf.h" 45#include "key.h" 46#include "auth-options.h" 47#include "hostfile.h" 48#include "auth.h" 49#ifdef GSSAPI 50#include "ssh-gss.h" 51#endif 52#include "monitor_wrap.h" 53#include "ssh.h" 54#include "misc.h" 55 56/* import */ 57extern ServerOptions options; 58 59/* 60 * Session identifier that is used to bind key exchange and authentication 61 * responses to a particular session. 62 */ 63extern u_char session_id[16]; 64 65/* 66 * The .ssh/authorized_keys file contains public keys, one per line, in the 67 * following format: 68 * options bits e n comment 69 * where bits, e and n are decimal numbers, 70 * and comment is any string of characters up to newline. The maximum 71 * length of a line is SSH_MAX_PUBKEY_BYTES characters. See sshd(8) for a 72 * description of the options. 73 */ 74 75BIGNUM * 76auth_rsa_generate_challenge(Key *key) 77{ 78 BIGNUM *challenge; 79 BN_CTX *ctx; 80 81 if ((challenge = BN_new()) == NULL) 82 fatal("auth_rsa_generate_challenge: BN_new() failed"); 83 /* Generate a random challenge. */ 84 if (BN_rand(challenge, 256, 0, 0) == 0) 85 fatal("auth_rsa_generate_challenge: BN_rand failed"); 86 if ((ctx = BN_CTX_new()) == NULL) 87 fatal("auth_rsa_generate_challenge: BN_CTX_new failed"); 88 if (BN_mod(challenge, challenge, key->rsa->n, ctx) == 0) 89 fatal("auth_rsa_generate_challenge: BN_mod failed"); 90 BN_CTX_free(ctx); 91 92 return challenge; 93} 94 95int 96auth_rsa_verify_response(Key *key, BIGNUM *challenge, u_char response[16]) 97{ 98 u_char buf[32], mdbuf[16]; 99 MD5_CTX md; 100 int len; 101 102 /* don't allow short keys */ 103 if (BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE) { 104 error("auth_rsa_verify_response: RSA modulus too small: %d < minimum %d bits", 105 BN_num_bits(key->rsa->n), SSH_RSA_MINIMUM_MODULUS_SIZE); 106 return (0); 107 } 108 109 /* The response is MD5 of decrypted challenge plus session id. */ 110 len = BN_num_bytes(challenge); 111 if (len <= 0 || len > 32) 112 fatal("auth_rsa_verify_response: bad challenge length %d", len); 113 memset(buf, 0, 32); 114 BN_bn2bin(challenge, buf + 32 - len); 115 MD5_Init(&md); 116 MD5_Update(&md, buf, 32); 117 MD5_Update(&md, session_id, 16); 118 MD5_Final(mdbuf, &md); 119 120 /* Verify that the response is the original challenge. */ 121 if (timingsafe_bcmp(response, mdbuf, 16) != 0) { 122 /* Wrong answer. */ 123 return (0); 124 } 125 /* Correct answer. */ 126 return (1); 127} 128 129/* 130 * Performs the RSA authentication challenge-response dialog with the client, 131 * and returns true (non-zero) if the client gave the correct answer to 132 * our challenge; returns zero if the client gives a wrong answer. 133 */ 134 135int 136auth_rsa_challenge_dialog(Key *key) 137{ 138 BIGNUM *challenge, *encrypted_challenge; 139 u_char response[16]; 140 int i, success; 141 142 if ((encrypted_challenge = BN_new()) == NULL) 143 fatal("auth_rsa_challenge_dialog: BN_new() failed"); 144 145 challenge = PRIVSEP(auth_rsa_generate_challenge(key)); 146 147 /* Encrypt the challenge with the public key. */ 148 rsa_public_encrypt(encrypted_challenge, challenge, key->rsa); 149 150 /* Send the encrypted challenge to the client. */ 151 packet_start(SSH_SMSG_AUTH_RSA_CHALLENGE); 152 packet_put_bignum(encrypted_challenge); 153 packet_send(); 154 BN_clear_free(encrypted_challenge); 155 packet_write_wait(); 156 157 /* Wait for a response. */ 158 packet_read_expect(SSH_CMSG_AUTH_RSA_RESPONSE); 159 for (i = 0; i < 16; i++) 160 response[i] = (u_char)packet_get_char(); 161 packet_check_eom(); 162 163 success = PRIVSEP(auth_rsa_verify_response(key, challenge, response)); 164 BN_clear_free(challenge); 165 return (success); 166} 167 168static int 169rsa_key_allowed_in_file(struct passwd *pw, char *file, 170 const BIGNUM *client_n, Key **rkey) 171{ 172 char line[SSH_MAX_PUBKEY_BYTES]; 173 int allowed = 0; 174 u_int bits; 175 FILE *f; 176 u_long linenum = 0; 177 Key *key; 178 179 debug("trying public RSA key file %s", file); 180 if ((f = auth_openkeyfile(file, pw, options.strict_modes)) == NULL) 181 return 0; 182 183 /* 184 * Go though the accepted keys, looking for the current key. If 185 * found, perform a challenge-response dialog to verify that the 186 * user really has the corresponding private key. 187 */ 188 key = key_new(KEY_RSA1); 189 while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) { 190 char *cp; 191 char *key_options; 192 int keybits; 193 194 /* Skip leading whitespace, empty and comment lines. */ 195 for (cp = line; *cp == ' ' || *cp == '\t'; cp++) 196 ; 197 if (!*cp || *cp == '\n' || *cp == '#') 198 continue; 199 200 /* 201 * Check if there are options for this key, and if so, 202 * save their starting address and skip the option part 203 * for now. If there are no options, set the starting 204 * address to NULL. 205 */ 206 if (*cp < '0' || *cp > '9') { 207 int quoted = 0; 208 key_options = cp; 209 for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) { 210 if (*cp == '\\' && cp[1] == '"') 211 cp++; /* Skip both */ 212 else if (*cp == '"') 213 quoted = !quoted; 214 } 215 } else 216 key_options = NULL; 217 218 /* Parse the key from the line. */ 219 if (hostfile_read_key(&cp, &bits, key) == 0) { 220 debug("%.100s, line %lu: non ssh1 key syntax", 221 file, linenum); 222 continue; 223 } 224 /* cp now points to the comment part. */ 225 226 /* 227 * Check if the we have found the desired key (identified 228 * by its modulus). 229 */ 230 if (BN_cmp(key->rsa->n, client_n) != 0) 231 continue; 232 233 /* check the real bits */ 234 keybits = BN_num_bits(key->rsa->n); 235 if (keybits < 0 || bits != (u_int)keybits) 236 logit("Warning: %s, line %lu: keysize mismatch: " 237 "actual %d vs. announced %d.", 238 file, linenum, BN_num_bits(key->rsa->n), bits); 239 240 /* Never accept a revoked key */ 241 if (auth_key_is_revoked(key)) 242 break; 243 244 /* We have found the desired key. */ 245 /* 246 * If our options do not allow this key to be used, 247 * do not send challenge. 248 */ 249 if (!auth_parse_options(pw, key_options, file, linenum)) 250 continue; 251 if (key_is_cert_authority) 252 continue; 253 /* break out, this key is allowed */ 254 allowed = 1; 255 break; 256 } 257 258 /* Close the file. */ 259 fclose(f); 260 261 /* return key if allowed */ 262 if (allowed && rkey != NULL) 263 *rkey = key; 264 else 265 key_free(key); 266 267 return allowed; 268} 269 270/* 271 * check if there's user key matching client_n, 272 * return key if login is allowed, NULL otherwise 273 */ 274 275int 276auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey) 277{ 278 char *file; 279 u_int i, allowed = 0; 280 281 temporarily_use_uid(pw); 282 283 for (i = 0; !allowed && i < options.num_authkeys_files; i++) { 284 if (strcasecmp(options.authorized_keys_files[i], "none") == 0) 285 continue; 286 file = expand_authorized_keys( 287 options.authorized_keys_files[i], pw); 288 allowed = rsa_key_allowed_in_file(pw, file, client_n, rkey); 289 xfree(file); 290 } 291 292 restore_uid(); 293 294 return allowed; 295} 296 297/* 298 * Performs the RSA authentication dialog with the client. This returns 299 * 0 if the client could not be authenticated, and 1 if authentication was 300 * successful. This may exit if there is a serious protocol violation. 301 */ 302int 303auth_rsa(Authctxt *authctxt, BIGNUM *client_n) 304{ 305 Key *key; 306 char *fp; 307 struct passwd *pw = authctxt->pw; 308 309 /* no user given */ 310 if (!authctxt->valid) 311 return 0; 312 313 if (!PRIVSEP(auth_rsa_key_allowed(pw, client_n, &key))) { 314 auth_clear_options(); 315 return (0); 316 } 317 318 /* Perform the challenge-response dialog for this key. */ 319 if (!auth_rsa_challenge_dialog(key)) { 320 /* Wrong response. */ 321 verbose("Wrong response to RSA authentication challenge."); 322 packet_send_debug("Wrong response to RSA authentication challenge."); 323 /* 324 * Break out of the loop. Otherwise we might send 325 * another challenge and break the protocol. 326 */ 327 key_free(key); 328 return (0); 329 } 330 /* 331 * Correct response. The client has been successfully 332 * authenticated. Note that we have not yet processed the 333 * options; this will be reset if the options cause the 334 * authentication to be rejected. 335 */ 336 fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX); 337 verbose("Found matching %s key: %s", 338 key_type(key), fp); 339 xfree(fp); 340 key_free(key); 341 342 packet_send_debug("RSA authentication accepted."); 343 return (1); 344} 345