first working version of challenge response authentication. needs

testing.

diff --git a/Makefile.in b/Makefile.in
index a222a81..385082d 100644 (file)
--- a/Makefile.in
+++ b/Makefile.in
@@ -23,7 +23,7 @@ SHELL=/bin/sh
 LIBOBJ=lib/getopt.o lib/fnmatch.o lib/zlib.o lib/compat.o
 OBJS1=rsync.o exclude.o util.o md4.o main.o checksum.o match.o syscall.o log.o
 OBJS2=options.o flist.o io.o compat.o hlink.o token.o uidlist.o socket.o 
-DAEMON_OBJ = params.o loadparm.o clientserver.o access.o connection.o
+DAEMON_OBJ = params.o loadparm.o clientserver.o access.o connection.o authenticate.o
 OBJS=$(OBJS1) $(OBJS2) $(DAEMON_OBJ) $(LIBOBJ)
 
 # note that the -I. is needed to handle config.h when using VPATH

diff --git a/authenticate.c b/authenticate.c
index 28f777e..4f4aac2 100644 (file)
--- a/authenticate.c
+++ b/authenticate.c
@@ -19,3 +19,180 @@
 /* support rsync authentication */
 #include "rsync.h"
 
+/***************************************************************************
+encode a buffer using base64 - simple and slow algorithm. null terminates
+the result.
+  ***************************************************************************/
+static void base64_encode(char *buf, int len, char *out)
+{
+       char *b64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+       int bit_offset, byte_offset, idx, i;
+       unsigned char *d = (unsigned char *)buf;
+       char *p;
+       int bytes = (len*8 + 5)/6;
+
+       memset(out, 0, bytes+1);
+
+       for (i=0;i<bytes;i++) {
+               byte_offset = (i*6)/8;
+               bit_offset = (i*6)%8;
+               if (bit_offset < 3) {
+                       idx = (d[byte_offset] >> (2-bit_offset)) & 0x3F;
+               } else {
+                       idx = (d[byte_offset] << (bit_offset-2)) & 0x3F;
+                       if (byte_offset+1 < len) {
+                               idx |= (d[byte_offset+1] >> (8-(bit_offset-2)));
+                       }
+               }
+               out[i] = b64[idx];
+       }
+}
+
+/* create a 16 byte challenge buffer */
+static void gen_challenge(char *addr, char *challenge)
+{
+       char input[32];
+       struct timeval tv;
+
+       memset(input, 0, sizeof(input));
+
+       strncpy((char *)input, addr, 16);
+       gettimeofday(&tv, NULL);
+       SIVAL(input, 16, tv.tv_sec);
+       SIVAL(input, 20, tv.tv_usec);
+       SIVAL(input, 24, getpid());
+
+       sum_init();
+       sum_update(input, sizeof(input));
+       sum_end(challenge);
+}
+
+
+/* return the secret for a user from the sercret file. maximum length
+   is len. null terminate it */
+static int get_secret(int module, char *user, char *secret, int len)
+{
+       char *fname = lp_secrets_file(module);
+       int fd, found=0;
+       char line[1024];
+       char *p, *pass;
+
+       if (!fname || !*fname) return 0;
+
+       fd = open(fname,O_RDONLY);
+       if (fd == -1) return 0;
+
+       while (!found) {
+               int i = 0;
+               memset(line, 0, sizeof(line));
+               while (i<(sizeof(line)-1)) {
+                       if (read(fd, &line[i], 1) != 1) {
+                               memset(line, 0, sizeof(line));
+                               close(fd);
+                               return 0;
+                       }
+                       if (line[i] == '\r') continue;
+                       if (line[i] == '\n') break;
+                       i++;
+               }
+               line[i] = 0;
+               if (line[0] == '#') continue;
+               p = strchr(line,':');
+               if (!p) continue;
+               *p = 0;
+               if (strcmp(user, line)) continue;
+               pass = p+1;
+               found = 1;
+       }
+
+       close(fd);
+       if (!found) return 0;
+
+       if (strlen(pass) > len-1) {
+               memset(line, 0, sizeof(line));
+               return 0;
+       }
+
+       strcpy(secret, pass);
+       return 1;
+}
+
+/* generate a 16 byte hash from a password and challenge */
+void generate_hash(char *in, char *challenge, char *out)
+{
+       char buf[16];
+
+       sum_init();
+       sum_update(in, strlen(in));
+       sum_update(challenge, strlen(challenge));
+       sum_end(buf);
+
+       base64_encode(buf, 16, out);
+}
+
+/* possible negotiate authentication with the client. Use "leader" to
+   start off the auth if necessary */
+int auth_server(int fd, int module, char *addr, char *leader)
+{
+       char *users = lp_auth_users(module);
+       char challenge[16];
+       char b64_challenge[30];
+       char line[1024];
+       char user[100];
+       char secret[100];
+       char pass[30];
+       char pass2[30];
+
+       /* if no auth list then allow anyone in! */
+       if (!users || !*users) return 1;
+
+       gen_challenge(addr, challenge);
+       
+       base64_encode(challenge, 16, b64_challenge);
+
+       io_printf(fd,"%s%s\n", leader, b64_challenge);
+
+       if (!read_line(fd, line, sizeof(line)-1)) {
+               return 0;
+       }
+
+       memset(user, 0, sizeof(user));
+       memset(pass, 0, sizeof(pass));
+
+       if (sscanf(line,"%99s %29s", user, pass) != 2) {
+               return 0;
+       }
+
+       memset(secret, 0, sizeof(secret));
+       if (!get_secret(module, user, secret, sizeof(secret)-1)) {
+               memset(secret, 0, sizeof(secret));
+               return 0;
+       }
+
+       generate_hash(secret, b64_challenge, pass2);
+       memset(secret, 0, sizeof(secret));
+       
+       return (strcmp(pass, pass2) == 0);
+}
+
+
+void auth_client(int fd, char *user, char *challenge)
+{
+       char *pass;
+       char pass2[30];
+
+       if (!user || !*user) return;
+
+       if (!(pass=getenv("RSYNC_PASSWORD"))) {
+               pass = getpass("Password: ");
+       }
+
+       if (!pass || !*pass) {
+               pass = "";
+       }
+
+       generate_hash(pass, challenge, pass2);
+       
+       io_printf(fd, "%s %s\n", user, pass2);
+}
+

diff --git a/clientserver.c b/clientserver.c
index 173ca0c..7fca65e 100644 (file)
--- a/clientserver.c
+++ b/clientserver.c
@@ -31,9 +31,19 @@ int start_socket_client(char *host, char *path, int argc, char *argv[])
        char *sargs[MAX_ARGS];
        int sargc=0;
        char line[1024];
-       char *p;
+       char *p, *user=NULL;
        extern int remote_version;
 
+       p = strchr(host, '@');
+       if (p) {
+               user = host;
+               host = p+1;
+               *p = 0;
+       }
+
+       if (!user) user = getenv("USER");
+       if (!user) user = getenv("LOGNAME");
+
        fd = open_socket_out(host, rsync_port);
        if (fd == -1) {
                exit_cleanup(1);
@@ -68,12 +78,10 @@ int start_socket_client(char *host, char *path, int argc, char *argv[])
                        return -1;
                }
 
-#if 0
                if (strncmp(line,"@RSYNCD: AUTHREQD ",18) == 0) {
-                       auth_client(fd, line+18);
+                       auth_client(fd, user, line+18);
                        continue;
                }
-#endif
 
                if (strcmp(line,"@RSYNCD: OK") == 0) break;
                rprintf(FINFO,"%s\n", line);
@@ -84,15 +92,6 @@ int start_socket_client(char *host, char *path, int argc, char *argv[])
        }
        io_printf(fd,"\n");
 
-#if 0
-       while (1) {
-               if (!read_line(fd, line, sizeof(line)-1)) {
-                       return -1;
-               }
-               rprintf(FINFO,"%s\n", line);
-       }
-#endif
-
        return client_run(fd, fd, -1, argc, argv);
 }
 
@@ -117,13 +116,11 @@ static int rsync_module(int fd, int i)
                return -1;
        }
 
-#if 0
-       if (!auth_server(fd, "@RSYNCD: AUTHREQD ")) {
+       if (!auth_server(fd, i, addr, "@RSYNCD: AUTHREQD ")) {
                rprintf(FERROR,"auth failed on module %s from %s (%s)\n",
                        lp_name(i), client_name(fd), client_addr(fd));
                return -1;              
        }
-#endif
 
        if (!claim_connection(lp_lock_file(), lp_max_connections())) {
                rprintf(FERROR,"ERROR: max connections reached\n");
@@ -266,7 +263,6 @@ static int start_daemon(int fd)
        }       
 
        while (i == -1) {
-
                line[0] = 0;
                if (!read_line(fd, line, sizeof(line)-1)) {
                        return -1;