authenticate.c

   1 /*
   2  * Support rsync daemon authentication.
   3  *
   4  * Copyright (C) 1998-2000 Andrew Tridgell
   5  * Copyright (C) 2002-2020 Wayne Davison
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License as published by
   9  * the Free Software Foundation; either version 3 of the License, or
  10  * (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License along
  18  * with this program; if not, visit the http://fsf.org website.
  19  */
  20
  21 #include "rsync.h"
  22 #include "itypes.h"
  23 #include "ifuncs.h"
  24
  25 extern int read_only;
  26 extern char *password_file;
  27
  28 /***************************************************************************
  29 encode a buffer using base64 - simple and slow algorithm. null terminates
  30 the result.
  31   ***************************************************************************/
  32 void base64_encode(const char *buf, int len, char *out, int pad)
  33 {
  34         char *b64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
  35         int bit_offset, byte_offset, idx, i;
  36         const uchar *d = (const uchar *)buf;
  37         int bytes = (len*8 + 5)/6;
  38
  39         for (i = 0; i < bytes; i++) {
  40                 byte_offset = (i*6)/8;
  41                 bit_offset = (i*6)%8;
  42                 if (bit_offset < 3) {
  43                         idx = (d[byte_offset] >> (2-bit_offset)) & 0x3F;
  44                 } else {
  45                         idx = (d[byte_offset] << (bit_offset-2)) & 0x3F;
  46                         if (byte_offset+1 < len) {
  47                                 idx |= (d[byte_offset+1] >> (8-(bit_offset-2)));
  48                         }
  49                 }
  50                 out[i] = b64[idx];
  51         }
  52
  53         while (pad && (i % 4))
  54                 out[i++] = '=';
  55
  56         out[i] = '\0';
  57 }
  58
  59 /* Generate a challenge buffer and return it base64-encoded. */
  60 static void gen_challenge(const char *addr, char *challenge)
  61 {
  62         char input[32];
  63         char digest[MAX_DIGEST_LEN];
  64         struct timeval tv;
  65         int len;
  66
  67         memset(input, 0, sizeof input);
  68
  69         strlcpy(input, addr, 17);
  70         sys_gettimeofday(&tv);
  71         SIVAL(input, 16, tv.tv_sec);
  72         SIVAL(input, 20, tv.tv_usec);
  73         SIVAL(input, 24, getpid());
  74
  75         sum_init(-1, 0);
  76         sum_update(input, sizeof input);
  77         len = sum_end(digest);
  78
  79         base64_encode(digest, len, challenge, 0);
  80 }
  81
  82 /* Generate an MD4 hash created from the combination of the password
  83  * and the challenge string and return it base64-encoded. */
  84 static void generate_hash(const char *in, const char *challenge, char *out)
  85 {
  86         char buf[MAX_DIGEST_LEN];
  87         int len;
  88
  89         sum_init(-1, 0);
  90         sum_update(in, strlen(in));
  91         sum_update(challenge, strlen(challenge));
  92         len = sum_end(buf);
  93
  94         base64_encode(buf, len, out, 0);
  95 }
  96
  97 /* Return the secret for a user from the secret file, null terminated.
  98  * Maximum length is len (not counting the null). */
  99 static const char *check_secret(int module, const char *user, const char *group,
 100                                 const char *challenge, const char *pass)
 101 {
 102         char line[1024];
 103         char pass2[MAX_DIGEST_LEN*2];
 104         const char *fname = lp_secrets_file(module);
 105         STRUCT_STAT st;
 106         int ok = 1;
 107         int user_len = strlen(user);
 108         int group_len = group ? strlen(group) : 0;
 109         char *err;
 110         FILE *fh;
 111
 112         if (!fname || !*fname || (fh = fopen(fname, "r")) == NULL)
 113                 return "no secrets file";
 114
 115         if (do_fstat(fileno(fh), &st) == -1) {
 116                 rsyserr(FLOG, errno, "fstat(%s)", fname);
 117                 ok = 0;
 118         } else if (lp_strict_modes(module)) {
 119                 if ((st.st_mode & 06) != 0) {
 120                         rprintf(FLOG, "secrets file must not be other-accessible (see strict modes option)\n");
 121                         ok = 0;
 122                 } else if (MY_UID() == 0 && st.st_uid != 0) {
 123                         rprintf(FLOG, "secrets file must be owned by root when running as root (see strict modes)\n");
 124                         ok = 0;
 125                 }
 126         }
 127         if (!ok) {
 128                 fclose(fh);
 129                 return "ignoring secrets file";
 130         }
 131
 132         if (*user == '#') {
 133                 /* Reject attempt to match a comment. */
 134                 fclose(fh);
 135                 return "invalid username";
 136         }
 137
 138         /* Try to find a line that starts with the user (or @group) name and a ':'. */
 139         err = "secret not found";
 140         while ((user || group) && fgets(line, sizeof line, fh) != NULL) {
 141                 const char **ptr, *s = strtok(line, "\n\r");
 142                 int len;
 143                 if (!s)
 144                         continue;
 145                 if (*s == '@') {
 146                         ptr = &group;
 147                         len = group_len;
 148                         s++;
 149                 } else {
 150                         ptr = &user;
 151                         len = user_len;
 152                 }
 153                 if (!*ptr || strncmp(s, *ptr, len) != 0 || s[len] != ':')
 154                         continue;
 155                 generate_hash(s+len+1, challenge, pass2);
 156                 if (strcmp(pass, pass2) == 0) {
 157                         err = NULL;
 158                         break;
 159                 }
 160                 err = "password mismatch";
 161                 *ptr = NULL; /* Don't look for name again. */
 162         }
 163
 164         fclose(fh);
 165
 166         force_memzero(line, sizeof line);
 167         force_memzero(pass2, sizeof pass2);
 168
 169         return err;
 170 }
 171
 172 static const char *getpassf(const char *filename)
 173 {
 174         STRUCT_STAT st;
 175         char buffer[512], *p;
 176         int n;
 177
 178         if (!filename)
 179                 return NULL;
 180
 181         if (strcmp(filename, "-") == 0) {
 182                 n = fgets(buffer, sizeof buffer, stdin) == NULL ? -1 : (int)strlen(buffer);
 183         } else {
 184                 int fd;
 185
 186                 if ((fd = open(filename,O_RDONLY)) < 0) {
 187                         rsyserr(FERROR, errno, "could not open password file %s", filename);
 188                         exit_cleanup(RERR_SYNTAX);
 189                 }
 190
 191                 if (do_stat(filename, &st) == -1) {
 192                         rsyserr(FERROR, errno, "stat(%s)", filename);
 193                         exit_cleanup(RERR_SYNTAX);
 194                 }
 195                 if ((st.st_mode & 06) != 0) {
 196                         rprintf(FERROR, "ERROR: password file must not be other-accessible\n");
 197                         exit_cleanup(RERR_SYNTAX);
 198                 }
 199                 if (MY_UID() == 0 && st.st_uid != 0) {
 200                         rprintf(FERROR, "ERROR: password file must be owned by root when running as root\n");
 201                         exit_cleanup(RERR_SYNTAX);
 202                 }
 203
 204                 n = read(fd, buffer, sizeof buffer - 1);
 205                 close(fd);
 206         }
 207
 208         if (n > 0) {
 209                 buffer[n] = '\0';
 210                 if ((p = strtok(buffer, "\n\r")) != NULL)
 211                         return strdup(p);
 212         }
 213
 214         rprintf(FERROR, "ERROR: failed to read a password from %s\n", filename);
 215         exit_cleanup(RERR_SYNTAX);
 216 }
 217
 218 /* Possibly negotiate authentication with the client.  Use "leader" to
 219  * start off the auth if necessary.
 220  *
 221  * Return NULL if authentication failed.  Return "" if anonymous access.
 222  * Otherwise return username.
 223  */
 224 char *auth_server(int f_in, int f_out, int module, const char *host,
 225                   const char *addr, const char *leader)
 226 {
 227         char *users = lp_auth_users(module);
 228         char challenge[MAX_DIGEST_LEN*2];
 229         char line[BIGPATHBUFLEN];
 230         char **auth_uid_groups = NULL;
 231         int auth_uid_groups_cnt = -1;
 232         const char *err = NULL;
 233         int group_match = -1;
 234         char *tok, *pass;
 235         char opt_ch = '\0';
 236
 237         /* if no auth list then allow anyone in! */
 238         if (!users || !*users)
 239                 return "";
 240
 241         gen_challenge(addr, challenge);
 242
 243         io_printf(f_out, "%s%s\n", leader, challenge);
 244
 245         if (!read_line_old(f_in, line, sizeof line, 0)
 246          || (pass = strchr(line, ' ')) == NULL) {
 247                 rprintf(FLOG, "auth failed on module %s from %s (%s): "
 248                         "invalid challenge response\n",
 249                         lp_name(module), host, addr);
 250                 return NULL;
 251         }
 252         *pass++ = '\0';
 253
 254         users = strdup(users);
 255
 256         for (tok = strtok(users, " ,\t"); tok; tok = strtok(NULL, " ,\t")) {
 257                 char *opts;
 258                 /* See if the user appended :deny, :ro, or :rw. */
 259                 if ((opts = strchr(tok, ':')) != NULL) {
 260                         *opts++ = '\0';
 261                         opt_ch = isUpper(opts) ? toLower(opts) : *opts;
 262                         if (opt_ch == 'r') { /* handle ro and rw */
 263                                 opt_ch = isUpper(opts+1) ? toLower(opts+1) : opts[1];
 264                                 if (opt_ch == 'o')
 265                                         opt_ch = 'r';
 266                                 else if (opt_ch != 'w')
 267                                         opt_ch = '\0';
 268                         } else if (opt_ch != 'd') /* if it's not deny, ignore it */
 269                                 opt_ch = '\0';
 270                 } else
 271                         opt_ch = '\0';
 272                 if (*tok != '@') {
 273                         /* Match the username */
 274                         if (wildmatch(tok, line))
 275                                 break;
 276                 } else {
 277 #ifdef HAVE_GETGROUPLIST
 278                         int j;
 279                         /* See if authorizing user is a real user, and if so, see
 280                          * if it is in a group that matches tok+1 wildmat. */
 281                         if (auth_uid_groups_cnt < 0) {
 282                                 item_list gid_list = EMPTY_ITEM_LIST;
 283                                 uid_t auth_uid;
 284                                 if (!user_to_uid(line, &auth_uid, False)
 285                                  || getallgroups(auth_uid, &gid_list) != NULL)
 286                                         auth_uid_groups_cnt = 0;
 287                                 else {
 288                                         gid_t *gid_array = gid_list.items;
 289                                         auth_uid_groups_cnt = gid_list.count;
 290                                         auth_uid_groups = new_array(char *, auth_uid_groups_cnt);
 291                                         for (j = 0; j < auth_uid_groups_cnt; j++)
 292                                                 auth_uid_groups[j] = gid_to_group(gid_array[j]);
 293                                 }
 294                         }
 295                         for (j = 0; j < auth_uid_groups_cnt; j++) {
 296                                 if (auth_uid_groups[j] && wildmatch(tok+1, auth_uid_groups[j])) {
 297                                         group_match = j;
 298                                         break;
 299                                 }
 300                         }
 301                         if (group_match >= 0)
 302                                 break;
 303 #else
 304                         rprintf(FLOG, "your computer doesn't support getgrouplist(), so no @group authorization is possible.\n");
 305 #endif
 306                 }
 307         }
 308
 309         free(users);
 310
 311         if (!tok)
 312                 err = "no matching rule";
 313         else if (opt_ch == 'd')
 314                 err = "denied by rule";
 315         else {
 316                 char *group = group_match >= 0 ? auth_uid_groups[group_match] : NULL;
 317                 err = check_secret(module, line, group, challenge, pass);
 318         }
 319
 320         force_memzero(challenge, sizeof challenge);
 321         force_memzero(pass, strlen(pass));
 322
 323         if (auth_uid_groups) {
 324                 int j;
 325                 for (j = 0; j < auth_uid_groups_cnt; j++) {
 326                         if (auth_uid_groups[j])
 327                                 free(auth_uid_groups[j]);
 328                 }
 329                 free(auth_uid_groups);
 330         }
 331
 332         if (err) {
 333                 rprintf(FLOG, "auth failed on module %s from %s (%s) for %s: %s\n",
 334                         lp_name(module), host, addr, line, err);
 335                 return NULL;
 336         }
 337
 338         if (opt_ch == 'r')
 339                 read_only = 1;
 340         else if (opt_ch == 'w')
 341                 read_only = 0;
 342
 343         return strdup(line);
 344 }
 345
 346 void auth_client(int fd, const char *user, const char *challenge)
 347 {
 348         const char *pass;
 349         char pass2[MAX_DIGEST_LEN*2];
 350
 351         if (!user || !*user)
 352                 user = "nobody";
 353
 354         if (!(pass = getpassf(password_file))
 355          && !(pass = getenv("RSYNC_PASSWORD"))) {
 356                 /* XXX: cyeoh says that getpass is deprecated, because
 357                  * it may return a truncated password on some systems,
 358                  * and it is not in the LSB.
 359                  *
 360                  * Andrew Klein says that getpassphrase() is present
 361                  * on Solaris and reads up to 256 characters.
 362                  *
 363                  * OpenBSD has a readpassphrase() that might be more suitable.
 364                  */
 365                 pass = getpass("Password: ");
 366         }
 367
 368         if (!pass)
 369                 pass = "";
 370
 371         generate_hash(pass, challenge, pass2);
 372         io_printf(fd, "%s %s\n", user, pass2);
 373 }