auth-rsa.c revision 264377
1/* $OpenBSD: auth-rsa.c,v 1.86 2014/01/27 19:18:54 markus Exp $ */ 2/* 3 * Author: Tatu Ylonen <ylo@cs.hut.fi> 4 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 5 * All rights reserved 6 * RSA-based authentication. This code determines whether to admit a login 7 * based on RSA authentication. This file also contains functions to check 8 * validity of the host key. 9 * 10 * As far as I am concerned, the code I have written for this software 11 * can be used freely for any purpose. Any derived versions of this 12 * software must be clearly marked as such, and if the derived work is 13 * incompatible with the protocol description in the RFC file, it must be 14 * called by a name other than "ssh" or "Secure Shell". 15 */ 16 17#include "includes.h" 18 19#include <sys/types.h> 20#include <sys/stat.h> 21 22#include <openssl/rsa.h> 23 24#include <pwd.h> 25#include <stdio.h> 26#include <stdarg.h> 27#include <string.h> 28 29#include "xmalloc.h" 30#include "rsa.h" 31#include "packet.h" 32#include "ssh1.h" 33#include "uidswap.h" 34#include "match.h" 35#include "buffer.h" 36#include "pathnames.h" 37#include "log.h" 38#include "servconf.h" 39#include "key.h" 40#include "auth-options.h" 41#include "hostfile.h" 42#include "auth.h" 43#ifdef GSSAPI 44#include "ssh-gss.h" 45#endif 46#include "monitor_wrap.h" 47#include "ssh.h" 48#include "misc.h" 49 50#include "digest.h" 51 52/* import */ 53extern ServerOptions options; 54 55/* 56 * Session identifier that is used to bind key exchange and authentication 57 * responses to a particular session. 58 */ 59extern u_char session_id[16]; 60 61/* 62 * The .ssh/authorized_keys file contains public keys, one per line, in the 63 * following format: 64 * options bits e n comment 65 * where bits, e and n are decimal numbers, 66 * and comment is any string of characters up to newline. The maximum 67 * length of a line is SSH_MAX_PUBKEY_BYTES characters. See sshd(8) for a 68 * description of the options. 69 */ 70 71BIGNUM * 72auth_rsa_generate_challenge(Key *key) 73{ 74 BIGNUM *challenge; 75 BN_CTX *ctx; 76 77 if ((challenge = BN_new()) == NULL) 78 fatal("auth_rsa_generate_challenge: BN_new() failed"); 79 /* Generate a random challenge. */ 80 if (BN_rand(challenge, 256, 0, 0) == 0) 81 fatal("auth_rsa_generate_challenge: BN_rand failed"); 82 if ((ctx = BN_CTX_new()) == NULL) 83 fatal("auth_rsa_generate_challenge: BN_CTX_new failed"); 84 if (BN_mod(challenge, challenge, key->rsa->n, ctx) == 0) 85 fatal("auth_rsa_generate_challenge: BN_mod failed"); 86 BN_CTX_free(ctx); 87 88 return challenge; 89} 90 91int 92auth_rsa_verify_response(Key *key, BIGNUM *challenge, u_char response[16]) 93{ 94 u_char buf[32], mdbuf[16]; 95 struct ssh_digest_ctx *md; 96 int len; 97 98 /* don't allow short keys */ 99 if (BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE) { 100 error("%s: RSA modulus too small: %d < minimum %d bits", 101 __func__, 102 BN_num_bits(key->rsa->n), SSH_RSA_MINIMUM_MODULUS_SIZE); 103 return (0); 104 } 105 106 /* The response is MD5 of decrypted challenge plus session id. */ 107 len = BN_num_bytes(challenge); 108 if (len <= 0 || len > 32) 109 fatal("%s: bad challenge length %d", __func__, len); 110 memset(buf, 0, 32); 111 BN_bn2bin(challenge, buf + 32 - len); 112 if ((md = ssh_digest_start(SSH_DIGEST_MD5)) == NULL || 113 ssh_digest_update(md, buf, 32) < 0 || 114 ssh_digest_update(md, session_id, 16) < 0 || 115 ssh_digest_final(md, mdbuf, sizeof(mdbuf)) < 0) 116 fatal("%s: md5 failed", __func__); 117 ssh_digest_free(md); 118 119 /* Verify that the response is the original challenge. */ 120 if (timingsafe_bcmp(response, mdbuf, 16) != 0) { 121 /* Wrong answer. */ 122 return (0); 123 } 124 /* Correct answer. */ 125 return (1); 126} 127 128/* 129 * Performs the RSA authentication challenge-response dialog with the client, 130 * and returns true (non-zero) if the client gave the correct answer to 131 * our challenge; returns zero if the client gives a wrong answer. 132 */ 133 134int 135auth_rsa_challenge_dialog(Key *key) 136{ 137 BIGNUM *challenge, *encrypted_challenge; 138 u_char response[16]; 139 int i, success; 140 141 if ((encrypted_challenge = BN_new()) == NULL) 142 fatal("auth_rsa_challenge_dialog: BN_new() failed"); 143 144 challenge = PRIVSEP(auth_rsa_generate_challenge(key)); 145 146 /* Encrypt the challenge with the public key. */ 147 rsa_public_encrypt(encrypted_challenge, challenge, key->rsa); 148 149 /* Send the encrypted challenge to the client. */ 150 packet_start(SSH_SMSG_AUTH_RSA_CHALLENGE); 151 packet_put_bignum(encrypted_challenge); 152 packet_send(); 153 BN_clear_free(encrypted_challenge); 154 packet_write_wait(); 155 156 /* Wait for a response. */ 157 packet_read_expect(SSH_CMSG_AUTH_RSA_RESPONSE); 158 for (i = 0; i < 16; i++) 159 response[i] = (u_char)packet_get_char(); 160 packet_check_eom(); 161 162 success = PRIVSEP(auth_rsa_verify_response(key, challenge, response)); 163 BN_clear_free(challenge); 164 return (success); 165} 166 167static int 168rsa_key_allowed_in_file(struct passwd *pw, char *file, 169 const BIGNUM *client_n, Key **rkey) 170{ 171 char *fp, line[SSH_MAX_PUBKEY_BYTES]; 172 int allowed = 0, bits; 173 FILE *f; 174 u_long linenum = 0; 175 Key *key; 176 177 debug("trying public RSA key file %s", file); 178 if ((f = auth_openkeyfile(file, pw, options.strict_modes)) == NULL) 179 return 0; 180 181 /* 182 * Go though the accepted keys, looking for the current key. If 183 * found, perform a challenge-response dialog to verify that the 184 * user really has the corresponding private key. 185 */ 186 key = key_new(KEY_RSA1); 187 while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) { 188 char *cp; 189 char *key_options; 190 int keybits; 191 192 /* Skip leading whitespace, empty and comment lines. */ 193 for (cp = line; *cp == ' ' || *cp == '\t'; cp++) 194 ; 195 if (!*cp || *cp == '\n' || *cp == '#') 196 continue; 197 198 /* 199 * Check if there are options for this key, and if so, 200 * save their starting address and skip the option part 201 * for now. If there are no options, set the starting 202 * address to NULL. 203 */ 204 if (*cp < '0' || *cp > '9') { 205 int quoted = 0; 206 key_options = cp; 207 for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) { 208 if (*cp == '\\' && cp[1] == '"') 209 cp++; /* Skip both */ 210 else if (*cp == '"') 211 quoted = !quoted; 212 } 213 } else 214 key_options = NULL; 215 216 /* Parse the key from the line. */ 217 if (hostfile_read_key(&cp, &bits, key) == 0) { 218 debug("%.100s, line %lu: non ssh1 key syntax", 219 file, linenum); 220 continue; 221 } 222 /* cp now points to the comment part. */ 223 224 /* 225 * Check if the we have found the desired key (identified 226 * by its modulus). 227 */ 228 if (BN_cmp(key->rsa->n, client_n) != 0) 229 continue; 230 231 /* check the real bits */ 232 keybits = BN_num_bits(key->rsa->n); 233 if (keybits < 0 || bits != keybits) 234 logit("Warning: %s, line %lu: keysize mismatch: " 235 "actual %d vs. announced %d.", 236 file, linenum, BN_num_bits(key->rsa->n), bits); 237 238 fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX); 239 debug("matching key found: file %s, line %lu %s %s", 240 file, linenum, key_type(key), fp); 241 free(fp); 242 243 /* Never accept a revoked key */ 244 if (auth_key_is_revoked(key)) 245 break; 246 247 /* We have found the desired key. */ 248 /* 249 * If our options do not allow this key to be used, 250 * do not send challenge. 251 */ 252 if (!auth_parse_options(pw, key_options, file, linenum)) 253 continue; 254 if (key_is_cert_authority) 255 continue; 256 /* break out, this key is allowed */ 257 allowed = 1; 258 break; 259 } 260 261 /* Close the file. */ 262 fclose(f); 263 264 /* return key if allowed */ 265 if (allowed && rkey != NULL) 266 *rkey = key; 267 else 268 key_free(key); 269 270 return allowed; 271} 272 273/* 274 * check if there's user key matching client_n, 275 * return key if login is allowed, NULL otherwise 276 */ 277 278int 279auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey) 280{ 281 char *file; 282 u_int i, allowed = 0; 283 284 temporarily_use_uid(pw); 285 286 for (i = 0; !allowed && i < options.num_authkeys_files; i++) { 287 if (strcasecmp(options.authorized_keys_files[i], "none") == 0) 288 continue; 289 file = expand_authorized_keys( 290 options.authorized_keys_files[i], pw); 291 allowed = rsa_key_allowed_in_file(pw, file, client_n, rkey); 292 free(file); 293 } 294 295 restore_uid(); 296 297 return allowed; 298} 299 300/* 301 * Performs the RSA authentication dialog with the client. This returns 302 * 0 if the client could not be authenticated, and 1 if authentication was 303 * successful. This may exit if there is a serious protocol violation. 304 */ 305int 306auth_rsa(Authctxt *authctxt, BIGNUM *client_n) 307{ 308 Key *key; 309 struct passwd *pw = authctxt->pw; 310 311 /* no user given */ 312 if (!authctxt->valid) 313 return 0; 314 315 if (!PRIVSEP(auth_rsa_key_allowed(pw, client_n, &key))) { 316 auth_clear_options(); 317 return (0); 318 } 319 320 /* Perform the challenge-response dialog for this key. */ 321 if (!auth_rsa_challenge_dialog(key)) { 322 /* Wrong response. */ 323 verbose("Wrong response to RSA authentication challenge."); 324 packet_send_debug("Wrong response to RSA authentication challenge."); 325 /* 326 * Break out of the loop. Otherwise we might send 327 * another challenge and break the protocol. 328 */ 329 key_free(key); 330 return (0); 331 } 332 /* 333 * Correct response. The client has been successfully 334 * authenticated. Note that we have not yet processed the 335 * options; this will be reset if the options cause the 336 * authentication to be rejected. 337 */ 338 pubkey_auth_info(authctxt, key, NULL); 339 340 packet_send_debug("RSA authentication accepted."); 341 return (1); 342} 343