Annotation of embedaddon/iperf/src/iperf_auth.c, revision 1.1.1.1
1.1 misho 1: /*
2: * iperf, Copyright (c) 2014-2020, The Regents of the University of
3: * California, through Lawrence Berkeley National Laboratory (subject
4: * to receipt of any required approvals from the U.S. Dept. of
5: * Energy). All rights reserved.
6: *
7: * If you have questions about your rights to use or distribute this
8: * software, please contact Berkeley Lab's Technology Transfer
9: * Department at TTD@lbl.gov.
10: *
11: * NOTICE. This software is owned by the U.S. Department of Energy.
12: * As such, the U.S. Government has been granted for itself and others
13: * acting on its behalf a paid-up, nonexclusive, irrevocable,
14: * worldwide license in the Software to reproduce, prepare derivative
15: * works, and perform publicly and display publicly. Beginning five
16: * (5) years after the date permission to assert copyright is obtained
17: * from the U.S. Department of Energy, and subject to any subsequent
18: * five (5) year renewals, the U.S. Government is granted for itself
19: * and others acting on its behalf a paid-up, nonexclusive,
20: * irrevocable, worldwide license in the Software to reproduce,
21: * prepare derivative works, distribute copies to the public, perform
22: * publicly and display publicly, and to permit others to do so.
23: *
24: * This code is distributed under a BSD style license, see the LICENSE file
25: * for complete information.
26: */
27:
28: #include "iperf_config.h"
29:
30: #include <string.h>
31: #include <assert.h>
32: #include <time.h>
33: #include <sys/types.h>
34: /* FreeBSD needs _WITH_GETLINE to enable the getline() declaration */
35: #define _WITH_GETLINE
36: #include <stdio.h>
37: #include <termios.h>
38:
39: #if defined(HAVE_SSL)
40:
41: #include <openssl/rsa.h>
42: #include <openssl/bio.h>
43: #include <openssl/pem.h>
44: #include <openssl/sha.h>
45: #include <openssl/buffer.h>
46: #include <openssl/err.h>
47:
48: const char *auth_text_format = "user: %s\npwd: %s\nts: %ld";
49:
50: void sha256(const char *string, char outputBuffer[65])
51: {
52: unsigned char hash[SHA256_DIGEST_LENGTH];
53: SHA256_CTX sha256;
54: SHA256_Init(&sha256);
55: SHA256_Update(&sha256, string, strlen(string));
56: SHA256_Final(hash, &sha256);
57: int i = 0;
58: for(i = 0; i < SHA256_DIGEST_LENGTH; i++)
59: {
60: sprintf(outputBuffer + (i * 2), "%02x", hash[i]);
61: }
62: outputBuffer[64] = 0;
63: }
64:
65: int check_authentication(const char *username, const char *password, const time_t ts, const char *filename){
66: time_t t = time(NULL);
67: time_t utc_seconds = mktime(localtime(&t));
68: if ( (utc_seconds - ts) > 10 || (utc_seconds - ts) < -10 ) {
69: return 1;
70: }
71:
72: char passwordHash[65];
73: char salted[strlen(username) + strlen(password) + 3];
74: sprintf(salted, "{%s}%s", username, password);
75: sha256(&salted[0], passwordHash);
76:
77: char *s_username, *s_password;
78: int i;
79: FILE *ptr_file;
80: char buf[1024];
81:
82: ptr_file =fopen(filename,"r");
83: if (!ptr_file)
84: return 2;
85:
86: while (fgets(buf,1024, ptr_file)){
87: //strip the \n or \r\n chars
88: for (i = 0; buf[i] != '\0'; i++){
89: if (buf[i] == '\n' || buf[i] == '\r'){
90: buf[i] = '\0';
91: break;
92: }
93: }
94: //skip empty / not completed / comment lines
95: if (strlen(buf) == 0 || strchr(buf, ',') == NULL || buf[0] == '#'){
96: continue;
97: }
98: s_username = strtok(buf, ",");
99: s_password = strtok(NULL, ",");
100: if (strcmp( username, s_username ) == 0 && strcmp( passwordHash, s_password ) == 0){
101: fclose(ptr_file);
102: return 0;
103: }
104: }
105: fclose(ptr_file);
106: return 3;
107: }
108:
109:
110: int Base64Encode(const unsigned char* buffer, const size_t length, char** b64text) { //Encodes a binary safe base 64 string
111: BIO *bio, *b64;
112: BUF_MEM *bufferPtr;
113:
114: b64 = BIO_new(BIO_f_base64());
115: bio = BIO_new(BIO_s_mem());
116: bio = BIO_push(b64, bio);
117:
118: BIO_set_flags(bio, BIO_FLAGS_BASE64_NO_NL); //Ignore newlines - write everything in one line
119: BIO_write(bio, buffer, length);
120: BIO_flush(bio);
121: BIO_get_mem_ptr(bio, &bufferPtr);
122: *b64text = strndup( (*bufferPtr).data, (*bufferPtr).length );
123: BIO_free_all(bio);
124:
125: return (0); //success
126: }
127:
128: size_t calcDecodeLength(const char* b64input) { //Calculates the length of a decoded string
129: size_t len = strlen(b64input), padding = 0;
130: if (b64input[len-1] == '=' && b64input[len-2] == '=') //last two chars are =
131: padding = 2;
132: else if (b64input[len-1] == '=') //last char is =
133: padding = 1;
134:
135: return (len*3)/4 - padding;
136: }
137:
138: int Base64Decode(const char* b64message, unsigned char** buffer, size_t* length) { //Decodes a base64 encoded string
139: BIO *bio, *b64;
140:
141: int decodeLen = calcDecodeLength(b64message);
142: *buffer = (unsigned char*)malloc(decodeLen + 1);
143: (*buffer)[decodeLen] = '\0';
144:
145: bio = BIO_new_mem_buf(b64message, -1);
146: b64 = BIO_new(BIO_f_base64());
147: bio = BIO_push(b64, bio);
148:
149: BIO_set_flags(bio, BIO_FLAGS_BASE64_NO_NL); //Do not use newlines to flush buffer
150: *length = BIO_read(bio, *buffer, strlen(b64message));
151: assert(*length == decodeLen); //length should equal decodeLen, else something went horribly wrong
152: BIO_free_all(bio);
153:
154: return (0); //success
155: }
156:
157: EVP_PKEY *load_pubkey_from_file(const char *file) {
158: BIO *key = NULL;
159: EVP_PKEY *pkey = NULL;
160:
161: if (file) {
162: key = BIO_new_file(file, "r");
163: pkey = PEM_read_bio_PUBKEY(key, NULL, NULL, NULL);
164:
165: BIO_free(key);
166: }
167: return (pkey);
168: }
169:
170: EVP_PKEY *load_pubkey_from_base64(const char *buffer) {
171: unsigned char *key = NULL;
172: size_t key_len;
173: Base64Decode(buffer, &key, &key_len);
174:
175: BIO* bio = BIO_new(BIO_s_mem());
176: BIO_write(bio, key, key_len);
177: free(key);
178: EVP_PKEY *pkey = PEM_read_bio_PUBKEY(bio, NULL, NULL, NULL);
179: BIO_free(bio);
180: return (pkey);
181: }
182:
183: EVP_PKEY *load_privkey_from_file(const char *file) {
184: BIO *key = NULL;
185: EVP_PKEY *pkey = NULL;
186:
187: if (file) {
188: key = BIO_new_file(file, "r");
189: pkey = PEM_read_bio_PrivateKey(key, NULL, NULL, NULL);
190:
191: BIO_free(key);
192: }
193: return (pkey);
194: }
195:
196: EVP_PKEY *load_privkey_from_base64(const char *buffer) {
197: unsigned char *key = NULL;
198: size_t key_len;
199: Base64Decode(buffer, &key, &key_len);
200:
201: BIO* bio = BIO_new(BIO_s_mem());
202: BIO_write(bio, key, key_len);
203: free(key);
204: EVP_PKEY *pkey = PEM_read_bio_PrivateKey(bio, NULL, NULL, NULL);
205: BIO_free(bio);
206: return (pkey);
207: }
208:
209: int test_load_pubkey_from_file(const char *file){
210: EVP_PKEY *key = load_pubkey_from_file(file);
211: if (key == NULL){
212: return -1;
213: }
214: EVP_PKEY_free(key);
215: return 0;
216: }
217:
218: int test_load_private_key_from_file(const char *file){
219: EVP_PKEY *key = load_privkey_from_file(file);
220: if (key == NULL){
221: return -1;
222: }
223: EVP_PKEY_free(key);
224: return 0;
225: }
226:
227: int encrypt_rsa_message(const char *plaintext, EVP_PKEY *public_key, unsigned char **encryptedtext) {
228: RSA *rsa = NULL;
229: unsigned char *rsa_buffer = NULL, pad = RSA_PKCS1_PADDING;
230: int keysize, encryptedtext_len, rsa_buffer_len;
231:
232: rsa = EVP_PKEY_get1_RSA(public_key);
233: keysize = RSA_size(rsa);
234:
235: rsa_buffer = OPENSSL_malloc(keysize * 2);
236: *encryptedtext = (unsigned char*)OPENSSL_malloc(keysize);
237:
238: BIO *bioBuff = BIO_new_mem_buf((void*)plaintext, (int)strlen(plaintext));
239: rsa_buffer_len = BIO_read(bioBuff, rsa_buffer, keysize * 2);
240: encryptedtext_len = RSA_public_encrypt(rsa_buffer_len, rsa_buffer, *encryptedtext, rsa, pad);
241:
242: RSA_free(rsa);
243: OPENSSL_free(rsa_buffer);
244: BIO_free(bioBuff);
245:
246: if (encryptedtext_len < 0) {
247: /* We probably shoudln't be printing stuff like this */
248: fprintf(stderr, "%s\n", ERR_error_string(ERR_get_error(), NULL));
249: }
250:
251: return encryptedtext_len;
252: }
253:
254: int decrypt_rsa_message(const unsigned char *encryptedtext, const int encryptedtext_len, EVP_PKEY *private_key, unsigned char **plaintext) {
255: RSA *rsa = NULL;
256: unsigned char *rsa_buffer = NULL, pad = RSA_PKCS1_PADDING;
257: int plaintext_len, rsa_buffer_len, keysize;
258:
259: rsa = EVP_PKEY_get1_RSA(private_key);
260:
261: keysize = RSA_size(rsa);
262: rsa_buffer = OPENSSL_malloc(keysize * 2);
263: *plaintext = (unsigned char*)OPENSSL_malloc(keysize);
264:
265: BIO *bioBuff = BIO_new_mem_buf((void*)encryptedtext, encryptedtext_len);
266: rsa_buffer_len = BIO_read(bioBuff, rsa_buffer, keysize * 2);
267: plaintext_len = RSA_private_decrypt(rsa_buffer_len, rsa_buffer, *plaintext, rsa, pad);
268:
269: RSA_free(rsa);
270: OPENSSL_free(rsa_buffer);
271: BIO_free(bioBuff);
272:
273: if (plaintext_len < 0) {
274: /* We probably shoudln't be printing stuff like this */
275: fprintf(stderr, "%s\n", ERR_error_string(ERR_get_error(), NULL));
276: }
277:
278: return plaintext_len;
279: }
280:
281: int encode_auth_setting(const char *username, const char *password, EVP_PKEY *public_key, char **authtoken){
282: time_t t = time(NULL);
283: time_t utc_seconds = mktime(localtime(&t));
284:
285: /*
286: * Compute a pessimistic/conservative estimate of storage required.
287: * It's OK to allocate too much storage but too little is bad.
288: */
289: const int text_len = strlen(auth_text_format) + strlen(username) + strlen(password) + 32;
290: char *text = (char *) calloc(text_len, sizeof(char));
291: if (text == NULL) {
292: return -1;
293: }
294: snprintf(text, text_len, auth_text_format, username, password, utc_seconds);
295:
296: unsigned char *encrypted = NULL;
297: int encrypted_len;
298: encrypted_len = encrypt_rsa_message(text, public_key, &encrypted);
299: free(text);
300: if (encrypted_len < 0) {
301: return -1;
302: }
303: Base64Encode(encrypted, encrypted_len, authtoken);
304: OPENSSL_free(encrypted);
305:
306: return (0); //success
307: }
308:
309: int decode_auth_setting(int enable_debug, const char *authtoken, EVP_PKEY *private_key, char **username, char **password, time_t *ts){
310: unsigned char *encrypted_b64 = NULL;
311: size_t encrypted_len_b64;
312: Base64Decode(authtoken, &encrypted_b64, &encrypted_len_b64);
313:
314: unsigned char *plaintext = NULL;
315: int plaintext_len;
316: plaintext_len = decrypt_rsa_message(encrypted_b64, encrypted_len_b64, private_key, &plaintext);
317: free(encrypted_b64);
318: if (plaintext_len < 0) {
319: return -1;
320: }
321: plaintext[plaintext_len] = '\0';
322:
323: char *s_username, *s_password;
324: s_username = (char *) calloc(plaintext_len, sizeof(char));
325: if (s_username == NULL) {
326: return -1;
327: }
328: s_password = (char *) calloc(plaintext_len, sizeof(char));
329: if (s_password == NULL) {
330: free(s_username);
331: return -1;
332: }
333:
334: int rc = sscanf((char *) plaintext, auth_text_format, s_username, s_password, ts);
335: if (rc != 3) {
336: free(s_password);
337: free(s_username);
338: return -1;
339: }
340:
341: if (enable_debug) {
342: printf("Auth Token Content:\n%s\n", plaintext);
343: printf("Auth Token Credentials:\n--> %s %s\n", s_username, s_password);
344: }
345: *username = s_username;
346: *password = s_password;
347: OPENSSL_free(plaintext);
348: return (0);
349: }
350:
351: #endif //HAVE_SSL
352:
353: ssize_t iperf_getpass (char **lineptr, size_t *n, FILE *stream) {
354: struct termios old, new;
355: ssize_t nread;
356:
357: /* Turn echoing off and fail if we can't. */
358: if (tcgetattr (fileno (stream), &old) != 0)
359: return -1;
360: new = old;
361: new.c_lflag &= ~ECHO;
362: if (tcsetattr (fileno (stream), TCSAFLUSH, &new) != 0)
363: return -1;
364:
365: /* Read the password. */
366: printf("Password: ");
367: nread = getline (lineptr, n, stream);
368:
369: /* Restore terminal. */
370: (void) tcsetattr (fileno (stream), TCSAFLUSH, &old);
371:
372: //strip the \n or \r\n chars
373: char *buf = *lineptr;
374: int i;
375: for (i = 0; buf[i] != '\0'; i++){
376: if (buf[i] == '\n' || buf[i] == '\r'){
377: buf[i] = '\0';
378: break;
379: }
380: }
381:
382: return nread;
383: }
384:
385:
FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>
![[BACK]](/icons/cvsweb/back.gif){kind=icon}
Return to iperf_auth.c CVS log ![[TXT]](/icons/cvsweb/text.gif){kind=icon}
![[DIR]](/icons/cvsweb/dir.gif){kind=icon}
Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / iperf / src