1 /*
2 * Dropbear - a SSH2 server
3 *
4 * Copyright (c) 2002,2003 Matt Johnston
5 * All rights reserved.
6 *
7 * Permission is hereby granted, free of charge, to any person obtaining a copy
8 * of this software and associated documentation files (the "Software"), to deal
9 * in the Software without restriction, including without limitation the rights
10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11 * copies of the Software, and to permit persons to whom the Software is
12 * furnished to do so, subject to the following conditions:
13 *
14 * The above copyright notice and this permission notice shall be included in
15 * all copies or substantial portions of the Software.
16 *
17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
20 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
23 * SOFTWARE. */
24
25 #ifndef DROPBEAR_AUTH_H_
26 #define DROPBEAR_AUTH_H_
27
28 #include "includes.h"
29 #include "signkey.h"
30 #include "chansession.h"
31
32 void svr_authinitialise(void);
33 void cli_authinitialise(void);
34
35 /* Server functions */
36 void recv_msg_userauth_request(void);
37 void send_msg_userauth_failure(int partial, int incrfail);
38 void send_msg_userauth_success(void);
39 void send_msg_userauth_banner(const buffer *msg);
40 void svr_auth_password(int valid_user);
41 void svr_auth_pubkey(int valid_user);
42 void svr_auth_pam(int valid_user);
43
44 #if DROPBEAR_SVR_PUBKEY_OPTIONS_BUILT
45 int svr_pubkey_allows_agentfwd(void);
46 int svr_pubkey_allows_tcpfwd(void);
47 int svr_pubkey_allows_x11fwd(void);
48 int svr_pubkey_allows_pty(void);
49 void svr_pubkey_set_forced_command(struct ChanSess *chansess);
50 void svr_pubkey_options_cleanup(void);
51 int svr_add_pubkey_options(buffer *options_buf, int line_num, const char* filename);
52 #else
53 /* no option : success */
54 #define svr_pubkey_allows_agentfwd() 1
55 #define svr_pubkey_allows_tcpfwd() 1
56 #define svr_pubkey_allows_x11fwd() 1
57 #define svr_pubkey_allows_pty() 1
svr_pubkey_set_forced_command(struct ChanSess * chansess)58 static inline void svr_pubkey_set_forced_command(struct ChanSess *chansess) { }
svr_pubkey_options_cleanup(void)59 static inline void svr_pubkey_options_cleanup(void) { }
60 #define svr_add_pubkey_options(x,y,z) DROPBEAR_SUCCESS
61 #endif
62
63 /* Client functions */
64 void recv_msg_userauth_failure(void);
65 void recv_msg_userauth_success(void);
66 void recv_msg_userauth_specific_60(void);
67 void recv_msg_userauth_pk_ok(void);
68 void recv_msg_userauth_info_request(void);
69 void cli_get_user(void);
70 void cli_auth_getmethods(void);
71 int cli_auth_try(void);
72 void recv_msg_userauth_banner(void);
73 void cli_pubkeyfail(void);
74 void cli_auth_password(void);
75 int cli_auth_pubkey(void);
76 void cli_auth_interactive(void);
77 char* getpass_or_cancel(const char* prompt);
78 void cli_auth_pubkey_cleanup(void);
79
80
81 #define MAX_USERNAME_LEN 100 /* arbitrary for the moment */
82
83 #define AUTH_TYPE_NONE 1
84 #define AUTH_TYPE_PUBKEY (1 << 1)
85 #define AUTH_TYPE_PASSWORD (1 << 2)
86 #define AUTH_TYPE_INTERACT (1 << 3)
87
88 #define AUTH_METHOD_NONE "none"
89 #define AUTH_METHOD_NONE_LEN 4
90 #define AUTH_METHOD_PUBKEY "publickey"
91 #define AUTH_METHOD_PUBKEY_LEN 9
92 #define AUTH_METHOD_PASSWORD "password"
93 #define AUTH_METHOD_PASSWORD_LEN 8
94 #define AUTH_METHOD_INTERACT "keyboard-interactive"
95 #define AUTH_METHOD_INTERACT_LEN 20
96
97
98
99 /* This structure is shared between server and client - it contains
100 * relatively little extraneous bits when used for the client rather than the
101 * server */
102 struct AuthState {
103 char *username; /* This is the username the client presents to check. It
104 is updated each run through, used for auth checking */
105 unsigned char authtypes; /* Flags indicating which auth types are still
106 valid */
107 unsigned int failcount; /* Number of (failed) authentication attempts.*/
108 unsigned int authdone; /* 0 if we haven't authed, 1 if we have. Applies for
109 client and server (though has differing
110 meanings). */
111
112 unsigned int perm_warn; /* Server only, set if bad permissions on
113 ~/.ssh/authorized_keys have already been
114 logged. */
115 unsigned int checkusername_failed; /* Server only, set if checkusername
116 has already failed */
117 struct timespec auth_starttime; /* Server only, time of receiving current
118 SSH_MSG_USERAUTH_REQUEST */
119
120 /* These are only used for the server */
121 uid_t pw_uid;
122 gid_t pw_gid;
123 char *pw_dir;
124 char *pw_shell;
125 char *pw_name;
126 char *pw_passwd;
127 #if DROPBEAR_SVR_PUBKEY_OPTIONS_BUILT
128 struct PubKeyOptions* pubkey_options;
129 #endif
130 };
131
132 #if DROPBEAR_SVR_PUBKEY_OPTIONS_BUILT
133 struct PubKeyOptions;
134 struct PubKeyOptions {
135 /* Flags */
136 int no_port_forwarding_flag;
137 int no_agent_forwarding_flag;
138 int no_x11_forwarding_flag;
139 int no_pty_flag;
140 /* "command=" option. */
141 char * forced_command;
142 };
143 #endif
144
145 #endif /* DROPBEAR_AUTH_H_ */
146