Refactored username and password authentication code

Signed-off-by: Adriaan de Jong <dejong@fox-it.com>
Acked-by: James Yonan <james@openvpn.net>
Signed-off-by: David Sommerseth <davids@redhat.com>

1 files changed, 13 insertions, 514 deletions

diff --git a/ssl.c b/ssl.c
index fbb0d02..ec524e7 100644
--- a/ssl.c
+++ b/ssl.c
@@ -1086,45 +1086,6 @@ verify_callback (int preverify_ok, X509_STORE_CTX * ctx)
 
 /** @} name Function for authenticating a new connection from a remote OpenVPN peer */
 
-
-static bool
-tls_lock_username (struct tls_multi *multi, const char *username)
-{
-  if (multi->locked_username)
-    {
-      if (!username || strcmp (username, multi->locked_username))
-	{
-	  msg (D_TLS_ERRORS, "TLS Auth Error: username attempted to change from '%s' to '%s' -- tunnel disabled",
-	       multi->locked_username,
-	       np(username));
-
-	  /* disable the tunnel */
-	  tls_deauthenticate (multi);
-	  return false;
-	}
-    }
-  else
-    {
-      if (username)
-	multi->locked_username = string_alloc (username, NULL);
-    }
-  return true;
-}
-
-const char *
-tls_username (const struct tls_multi *multi, const bool null)
-{
-  const char *ret = NULL;
-  if (multi)
-    ret = multi->locked_username;
-  if (ret && strlen (ret))
-    return ret;
-  else if (null)
-    return NULL;
-  else
-    return "UNDEF";
-}
-
 #ifdef ENABLE_X509_TRACK
 
 void
@@ -1150,234 +1111,6 @@ x509_track_add (const struct x509_track **ll_head, const char *name, int msgleve
 
 #endif
 
-#ifdef ENABLE_DEF_AUTH
-/* key_state_test_auth_control_file return values,
-   NOTE: acf_merge indexing depends on these values */
-#define ACF_UNDEFINED 0
-#define ACF_SUCCEEDED 1
-#define ACF_DISABLED  2
-#define ACF_FAILED    3
-#endif
-
-#ifdef MANAGEMENT_DEF_AUTH
-static void
-man_def_auth_set_client_reason (struct tls_multi *multi, const char *client_reason)
-{
-  if (multi->client_reason)
-    {
-      free (multi->client_reason);
-      multi->client_reason = NULL;
-    }
-  if (client_reason && strlen (client_reason))
-    multi->client_reason = string_alloc (client_reason, NULL);
-}
-
-static inline unsigned int
-man_def_auth_test (const struct key_state *ks)
-{
-  if (management_enable_def_auth (management))
-    return ks->mda_status;
-  else
-    return ACF_DISABLED;
-}
-#endif
-
-#ifdef PLUGIN_DEF_AUTH
-
-/*
- * auth_control_file functions
- */
-
-static void
-key_state_rm_auth_control_file (struct key_state *ks)
-{
-  if (ks && ks->auth_control_file)
-    {
-      delete_file (ks->auth_control_file);
-      free (ks->auth_control_file);
-      ks->auth_control_file = NULL;
-    }
-}
-
-static void
-key_state_gen_auth_control_file (struct key_state *ks, const struct tls_options *opt)
-{
-  struct gc_arena gc = gc_new ();
-  const char *acf;
-
-  key_state_rm_auth_control_file (ks);
-  acf = create_temp_file (opt->tmp_dir, "acf", &gc);
-  if( acf ) {
-    ks->auth_control_file = string_alloc (acf, NULL);
-    setenv_str (opt->es, "auth_control_file", ks->auth_control_file);
-  } /* FIXME: Should have better error handling? */
-  gc_free (&gc);					  
-}
-
-static unsigned int
-key_state_test_auth_control_file (struct key_state *ks)
-{
-  if (ks && ks->auth_control_file)
-    {
-      unsigned int ret = ks->auth_control_status;
-      if (ret == ACF_UNDEFINED)
-	{
-	  FILE *fp = fopen (ks->auth_control_file, "r");
-	  if (fp)
-	    {
-	      const int c = fgetc (fp);
-	      if (c == '1')
-		ret = ACF_SUCCEEDED;
-	      else if (c == '0')
-		ret = ACF_FAILED;
-	      fclose (fp);
-	      ks->auth_control_status = ret;
-	    }
-	}
-      return ret;
-    }
-  return ACF_DISABLED;
-}
-
-#endif
-
-/*
- * Return current session authentication state.  Return
- * value is TLS_AUTHENTICATION_x.
- */
-
-int
-tls_authentication_status (struct tls_multi *multi, const int latency)
-{
-  bool deferred = false;
-  bool success = false;
-  bool active = false;
-
-#ifdef ENABLE_DEF_AUTH
-  static const unsigned char acf_merge[] =
-    {
-      ACF_UNDEFINED, /* s1=ACF_UNDEFINED s2=ACF_UNDEFINED */
-      ACF_UNDEFINED, /* s1=ACF_UNDEFINED s2=ACF_SUCCEEDED */
-      ACF_UNDEFINED, /* s1=ACF_UNDEFINED s2=ACF_DISABLED */
-      ACF_FAILED,    /* s1=ACF_UNDEFINED s2=ACF_FAILED */
-      ACF_UNDEFINED, /* s1=ACF_SUCCEEDED s2=ACF_UNDEFINED */
-      ACF_SUCCEEDED, /* s1=ACF_SUCCEEDED s2=ACF_SUCCEEDED */
-      ACF_SUCCEEDED, /* s1=ACF_SUCCEEDED s2=ACF_DISABLED */
-      ACF_FAILED,    /* s1=ACF_SUCCEEDED s2=ACF_FAILED */
-      ACF_UNDEFINED, /* s1=ACF_DISABLED  s2=ACF_UNDEFINED */
-      ACF_SUCCEEDED, /* s1=ACF_DISABLED  s2=ACF_SUCCEEDED */
-      ACF_DISABLED,  /* s1=ACF_DISABLED  s2=ACF_DISABLED */
-      ACF_FAILED,    /* s1=ACF_DISABLED  s2=ACF_FAILED */
-      ACF_FAILED,    /* s1=ACF_FAILED    s2=ACF_UNDEFINED */
-      ACF_FAILED,    /* s1=ACF_FAILED    s2=ACF_SUCCEEDED */
-      ACF_FAILED,    /* s1=ACF_FAILED    s2=ACF_DISABLED */
-      ACF_FAILED     /* s1=ACF_FAILED    s2=ACF_FAILED */
-    };
-#endif
-
-  if (multi)
-    {
-      int i;
-
-#ifdef ENABLE_DEF_AUTH
-      if (latency && multi->tas_last && multi->tas_last + latency >= now)
-	return TLS_AUTHENTICATION_UNDEFINED;
-      multi->tas_last = now;
-#endif
-
-      for (i = 0; i < KEY_SCAN_SIZE; ++i)
-	{
-	  struct key_state *ks = multi->key_scan[i];
-	  if (DECRYPT_KEY_ENABLED (multi, ks))
-	    {
-	      active = true;
-	      if (ks->authenticated)
-		{
-#ifdef ENABLE_DEF_AUTH
-		  unsigned int s1 = ACF_DISABLED;
-		  unsigned int s2 = ACF_DISABLED;
-#ifdef PLUGIN_DEF_AUTH
-		  s1 = key_state_test_auth_control_file (ks); 
-#endif
-#ifdef MANAGEMENT_DEF_AUTH
-		  s2 = man_def_auth_test (ks);
-#endif
-		  ASSERT (s1 < 4 && s2 < 4);
-		  switch (acf_merge[(s1<<2) + s2])
-		    {
-		    case ACF_SUCCEEDED:
-		    case ACF_DISABLED:
-		      success = true;
-		      ks->auth_deferred = false;
-		      break;
-		    case ACF_UNDEFINED:
-		      if (now < ks->auth_deferred_expire)
-			deferred = true;
-		      break;
-		    case ACF_FAILED:
-		      ks->authenticated = false;
-		      break;
-		    default:
-		      ASSERT (0);
-		    }
-#else
-		  success = true;
-#endif
-		}
-	    }
-	}
-    }
-
-#if 0
-  dmsg (D_TLS_ERRORS, "TAS: a=%d s=%d d=%d", active, success, deferred);
-#endif
-
-  if (success)
-    return TLS_AUTHENTICATION_SUCCEEDED;
-  else if (!active || deferred)
-    return TLS_AUTHENTICATION_DEFERRED;
-  else
-    return TLS_AUTHENTICATION_FAILED;
-}
-
-#ifdef MANAGEMENT_DEF_AUTH
-/*
- * For deferred auth, this is where the management interface calls (on server)
- * to indicate auth failure/success.
- */
-bool
-tls_authenticate_key (struct tls_multi *multi, const unsigned int mda_key_id, const bool auth, const char *client_reason)
-{
-  bool ret = false;
-  if (multi)
-    {
-      int i;
-      man_def_auth_set_client_reason (multi, client_reason);
-      for (i = 0; i < KEY_SCAN_SIZE; ++i)
-	{
-	  struct key_state *ks = multi->key_scan[i];
-	  if (ks->mda_key_id == mda_key_id)
-	    {
-	      ks->mda_status = auth ? ACF_SUCCEEDED : ACF_FAILED;
-	      ret = true;
-	    }
-	}
-    }
-  return ret;
-}
-#endif
-
-void
-tls_deauthenticate (struct tls_multi *multi)
-{
-  if (multi)
-    {
-      int i, j;
-      for (i = 0; i < TM_SIZE; ++i)
-	for (j = 0; j < KS_SIZE; ++j)
-	  multi->session[i].key[j].authenticated = false;
-    }
-}
 
 /*
  * Initialize SSL context.
@@ -2659,173 +2392,6 @@ read_string_discard (struct buffer *buf)
 }
 
 /*
- * Authenticate a client using username/password.
- * Runs on server.
- *
- * If you want to add new authentication methods,
- * this is the place to start.
- */
-
-static bool
-verify_user_pass_script (struct tls_session *session, const struct user_pass *up)
-{
-  struct gc_arena gc = gc_new ();
-  struct argv argv = argv_new ();
-  const char *tmp_file = "";
-  bool ret = false;
-
-  /* Is username defined? */
-  if ((session->opt->ssl_flags & SSLF_AUTH_USER_PASS_OPTIONAL) || strlen (up->username))
-    {
-      /* Set environmental variables prior to calling script */
-      setenv_str (session->opt->es, "script_type", "user-pass-verify");
-
-      if (session->opt->auth_user_pass_verify_script_via_file)
-	{
-	  struct status_output *so;
-
-	  tmp_file = create_temp_file (session->opt->tmp_dir, "up", &gc);
-          if( tmp_file ) {
-            so = status_open (tmp_file, 0, -1, NULL, STATUS_OUTPUT_WRITE);
-            status_printf (so, "%s", up->username);
-            status_printf (so, "%s", up->password);
-            if (!status_close (so))
-              {
-                msg (D_TLS_ERRORS, "TLS Auth Error: could not write username/password to file: %s",
-                     tmp_file);
-                goto done;
-              }
-          } else {
-            msg (D_TLS_ERRORS, "TLS Auth Error: could not create write "
-                 "username/password to temp file");
-          }
-        }
-      else
-	{
-	  setenv_str (session->opt->es, "username", up->username);
-	  setenv_str (session->opt->es, "password", up->password);
-	}
-
-      /* setenv incoming cert common name for script */
-      setenv_str (session->opt->es, "common_name", session->common_name);
-
-      /* setenv client real IP address */
-      setenv_untrusted (session);
-
-      /* format command line */
-      argv_printf (&argv, "%sc %s", session->opt->auth_user_pass_verify_script, tmp_file);
-
-      /* call command */
-      ret = openvpn_run_script (&argv, session->opt->es, 0,
-				"--auth-user-pass-verify");
-
-      if (!session->opt->auth_user_pass_verify_script_via_file)
-	setenv_del (session->opt->es, "password");
-    }
-  else
-    {
-      msg (D_TLS_ERRORS, "TLS Auth Error: peer provided a blank username");
-    }
-
- done:
-  if (tmp_file && strlen (tmp_file) > 0)
-    delete_file (tmp_file);
-
-  argv_reset (&argv);
-  gc_free (&gc);
-  return ret;
-}
-
-static int
-verify_user_pass_plugin (struct tls_session *session, const struct user_pass *up, const char *raw_username)
-{
-  int retval = OPENVPN_PLUGIN_FUNC_ERROR;
-  struct key_state *ks = &session->key[KS_PRIMARY]; 	   /* primary key */
-
-  /* Is username defined? */
-  if ((session->opt->ssl_flags & SSLF_AUTH_USER_PASS_OPTIONAL) || strlen (up->username))
-    {
-      /* set username/password in private env space */
-      setenv_str (session->opt->es, "username", raw_username);
-      setenv_str (session->opt->es, "password", up->password);
-
-      /* setenv incoming cert common name for script */
-      setenv_str (session->opt->es, "common_name", session->common_name);
-
-      /* setenv client real IP address */
-      setenv_untrusted (session);
-
-#ifdef PLUGIN_DEF_AUTH
-      /* generate filename for deferred auth control file */
-      key_state_gen_auth_control_file (ks, session->opt);
-#endif
-
-      /* call command */
-      retval = plugin_call (session->opt->plugins, OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY, NULL, NULL, session->opt->es, -1, NULL);
-
-#ifdef PLUGIN_DEF_AUTH
-      /* purge auth control filename (and file itself) for non-deferred returns */
-      if (retval != OPENVPN_PLUGIN_FUNC_DEFERRED)
-	key_state_rm_auth_control_file (ks);
-#endif
-
-      setenv_del (session->opt->es, "password");
-      setenv_str (session->opt->es, "username", up->username);
-    }
-  else
-    {
-      msg (D_TLS_ERRORS, "TLS Auth Error (verify_user_pass_plugin): peer provided a blank username");
-    }
-
-  return retval;
-}
-
-/*
- * MANAGEMENT_DEF_AUTH internal ssl.c status codes
- */
-#define KMDA_ERROR   0
-#define KMDA_SUCCESS 1
-#define KMDA_UNDEF   2
-#define KMDA_DEF     3
-
-#ifdef MANAGEMENT_DEF_AUTH
-static int
-verify_user_pass_management (struct tls_session *session, const struct user_pass *up, const char *raw_username)
-{
-  int retval = KMDA_ERROR;
-  struct key_state *ks = &session->key[KS_PRIMARY]; 	   /* primary key */
-
-  /* Is username defined? */
-  if ((session->opt->ssl_flags & SSLF_AUTH_USER_PASS_OPTIONAL) || strlen (up->username))
-    {
-      /* set username/password in private env space */
-      setenv_str (session->opt->es, "username", raw_username);
-      setenv_str (session->opt->es, "password", up->password);
-
-      /* setenv incoming cert common name for script */
-      setenv_str (session->opt->es, "common_name", session->common_name);
-
-      /* setenv client real IP address */
-      setenv_untrusted (session);
-
-      if (management)
-	management_notify_client_needing_auth (management, ks->mda_key_id, session->opt->mda_context, session->opt->es);
-
-      setenv_del (session->opt->es, "password");
-      setenv_str (session->opt->es, "username", up->username);
-
-      retval = KMDA_SUCCESS;
-    }
-  else
-    {
-      msg (D_TLS_ERRORS, "TLS Auth Error (verify_user_pass_management): peer provided a blank username");
-    }
-
-  return retval;
-}
-#endif
-
-/*
  * Handle the reading and writing of key data to and from
  * the TLS control channel (cleartext).
  */
@@ -3091,23 +2657,18 @@ key_method_2_read (struct buffer *buf, struct tls_multi *multi, struct tls_sessi
 {
   struct key_state *ks = &session->key[KS_PRIMARY]; 	   /* primary key */
   struct key_state *ks_lame = &session->key[KS_LAME_DUCK]; /* retiring key */
-  struct gc_arena gc = gc_new ();
+
   int key_method_flags;
-  char *options;
-  struct user_pass *up;
+  bool username_status, password_status;
 
-  bool man_def_auth = KMDA_UNDEF;
+  struct gc_arena gc = gc_new ();
+  char *options;
 
-#ifdef MANAGEMENT_DEF_AUTH
-  if (management_enable_def_auth (management))
-    man_def_auth = KMDA_DEF;
-#endif
+  /* allocate temporary objects */
+  ALLOC_ARRAY_CLEAR_GC (options, char, TLS_OPTIONS_LEN, &gc);
 
   ASSERT (session->opt->key_method == 2);
 
-  /* allocate temporary objects */
-  ALLOC_ARRAY_CLEAR_GC (options, char, TLS_OPTIONS_LEN, &gc);
-		  
   /* discard leading uint32 */
   ASSERT (buf_advance (buf, 4));
 
@@ -3135,21 +2696,17 @@ key_method_2_read (struct buffer *buf, struct tls_multi *multi, struct tls_sessi
       goto error;
     }
 
-  /* should we check username/password? */
   ks->authenticated = false;
-  if (session->opt->auth_user_pass_verify_script
-      || plugin_defined (session->opt->plugins, OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY)
-      || man_def_auth == KMDA_DEF)
+
+  if (verify_user_pass_enabled(session))
     {
-      int s1 = OPENVPN_PLUGIN_FUNC_SUCCESS;
-      bool s2 = true;
-      char *raw_username;
-      bool username_status, password_status;
+      /* Perform username/password authentication */
+      struct user_pass *up;
 
-      /* get username/password from plaintext buffer */
       ALLOC_OBJ_CLEAR_GC (up, struct user_pass, &gc);
       username_status = read_string (buf, up->username, USER_PASS_LEN);
       password_status = read_string (buf, up->password, USER_PASS_LEN);
+
       if (!username_status || !password_status)
 	{
 	  CLEAR (*up);
@@ -3160,76 +2717,18 @@ key_method_2_read (struct buffer *buf, struct tls_multi *multi, struct tls_sessi
 	    }
 	}
 
-      /* preserve raw username before string_mod remapping, for plugins */
-      ALLOC_ARRAY_CLEAR_GC (raw_username, char, USER_PASS_LEN, &gc);
-      strcpy (raw_username, up->username);
-      string_mod (raw_username, CC_PRINT, CC_CRLF, '_');
-
-      /* enforce character class restrictions in username/password */
-      string_mod_sslname (up->username, COMMON_NAME_CHAR_CLASS, session->opt->ssl_flags);
-      string_mod (up->password, CC_PRINT, CC_CRLF, '_');
-
-      /* call plugin(s) and/or script */
 #ifdef MANAGEMENT_DEF_AUTH
       /* get peer info from control channel */
       free (multi->peer_info);
       multi->peer_info = read_string_alloc (buf);
-
-      if (man_def_auth == KMDA_DEF)
-	man_def_auth = verify_user_pass_management (session, up, raw_username);
 #endif
-      if (plugin_defined (session->opt->plugins, OPENVPN_PLUGIN_AUTH_USER_PASS_VERIFY))
-	s1 = verify_user_pass_plugin (session, up, raw_username);
-      if (session->opt->auth_user_pass_verify_script)
-	s2 = verify_user_pass_script (session, up);
-
-      /* check sizing of username if it will become our common name */
-      if ((session->opt->ssl_flags & SSLF_USERNAME_AS_COMMON_NAME) && strlen (up->username) >= TLS_USERNAME_LEN)
-	{
-	  msg (D_TLS_ERRORS, "TLS Auth Error: --username-as-common name specified and username is longer than the maximum permitted Common Name length of %d characters", TLS_USERNAME_LEN);
-	  s1 = OPENVPN_PLUGIN_FUNC_ERROR;
-	}
-
-      /* auth succeeded? */
-      if ((s1 == OPENVPN_PLUGIN_FUNC_SUCCESS
-#ifdef PLUGIN_DEF_AUTH
-	   || s1 == OPENVPN_PLUGIN_FUNC_DEFERRED
-#endif
-	   ) && s2 && man_def_auth != KMDA_ERROR
-	  && tls_lock_username (multi, up->username))
-	{
-	  ks->authenticated = true;
-#ifdef PLUGIN_DEF_AUTH
-	  if (s1 == OPENVPN_PLUGIN_FUNC_DEFERRED)
-	    ks->auth_deferred = true;
-#endif
-#ifdef MANAGEMENT_DEF_AUTH
-	  if (man_def_auth != KMDA_UNDEF)
-	    ks->auth_deferred = true;
-#endif
-	  if ((session->opt->ssl_flags & SSLF_USERNAME_AS_COMMON_NAME))
-	    set_common_name (session, up->username);
-#ifdef ENABLE_DEF_AUTH
-	  msg (D_HANDSHAKE, "TLS: Username/Password authentication %s for username '%s' %s",
-	       ks->auth_deferred ? "deferred" : "succeeded",
-	       up->username,
-	       (session->opt->ssl_flags & SSLF_USERNAME_AS_COMMON_NAME) ? "[CN SET]" : "");
-#else
-	  msg (D_HANDSHAKE, "TLS: Username/Password authentication %s for username '%s' %s",
-	       "succeeded",
-	       up->username,
-	       (session->opt->ssl_flags & SSLF_USERNAME_AS_COMMON_NAME) ? "[CN SET]" : "");
-#endif
-	}
-      else
-	{
-	  msg (D_TLS_ERRORS, "TLS Auth Error: Auth Username/Password verification failed for peer");
-	}
 
+      verify_user_pass(up, multi, session);
       CLEAR (*up);
     }
   else
     {
+      /* Session verification should have occurred during TLS negotiation*/
       if (!session->verified)
 	{
 	  msg (D_TLS_ERRORS,