[Openvas-commits] r3430 - in trunk/openvas-libraries: . libopenvas
scm-commit@wald.intevation.org
scm-commit at wald.intevation.org
Tue May 19 19:45:50 CEST 2009
Author: mattm
Date: 2009-05-19 19:45:49 +0200 (Tue, 19 May 2009)
New Revision: 3430
Added:
trunk/openvas-libraries/libopenvas/openvas_auth.c
trunk/openvas-libraries/libopenvas/openvas_auth.h
Modified:
trunk/openvas-libraries/ChangeLog
trunk/openvas-libraries/Makefile
trunk/openvas-libraries/libopenvas/Makefile
Log:
Add authentication facilities.
* libopenvas/openvas_auth.c: New file. Contains functions digest_hex and
get_password_hashes from ../config-manager/src/openvascd.c.
* libopenvas/openvas_auth.h: New file.
* libopenvas/Makefile (openvas_auth.o): New rule.
* Makefile (install): Add openvas_auth.h.
(doc-full): Fix comment typo.
Modified: trunk/openvas-libraries/ChangeLog
===================================================================
--- trunk/openvas-libraries/ChangeLog 2009-05-19 13:51:55 UTC (rev 3429)
+++ trunk/openvas-libraries/ChangeLog 2009-05-19 17:45:49 UTC (rev 3430)
@@ -1,3 +1,16 @@
+2009-05-19 Matthew Mundell <mmundell at intevation.de>
+
+ Add authentication facilities.
+
+ * libopenvas/openvas_auth.c: New file. Contains functions digest_hex and
+ get_password_hashes from ../config-manager/src/openvascd.c.
+ * libopenvas/openvas_auth.h: New file.
+
+ * libopenvas/Makefile (openvas_auth.o): New rule.
+
+ * Makefile (install): Add openvas_auth.h.
+ (doc-full): Fix comment typo.
+
2009-05-18 Matthew Mundell <mmundell at intevation.de>
* doc/Doxyfile (EXTRACT_ALL): Turn off, to enable warnings about
Modified: trunk/openvas-libraries/Makefile
===================================================================
--- trunk/openvas-libraries/Makefile 2009-05-19 13:51:55 UTC (rev 3429)
+++ trunk/openvas-libraries/Makefile 2009-05-19 17:45:49 UTC (rev 3430)
@@ -62,6 +62,7 @@
$(INSTALL) -m 0444 libopenvas/resolve.h $(DESTDIR)${includedir}/openvas
$(INSTALL) -m 0444 libopenvas/openvas_ssh_login.h $(DESTDIR)${includedir}/openvas
$(INSTALL) -m 0444 libopenvas/openvas_server.h $(DESTDIR)${includedir}/openvas
+ $(INSTALL) -m 0444 libopenvas/openvas_auth.h $(DESTDIR)${includedir}/openvas
$(INSTALL) -m 0444 libopenvas/scanners_utils.h $(DESTDIR)${includedir}/openvas
$(INSTALL) -m 0444 libopenvas/services1.h $(DESTDIR)${includedir}/openvas
$(INSTALL) -m 0444 libopenvas/share_fd.h $(DESTDIR)${includedir}/openvas
@@ -110,7 +111,7 @@
doxygen doc/Doxyfile
# Generates more extensive code documentation with graphs
-# (placed in doc/generated) and builts doc/generated/latex/refman.pdf
+# (placed in doc/generated) and builds doc/generated/latex/refman.pdf
doc-full:
doxygen doc/Doxyfile_full
if [ -d doc/generated/latex ]; then make -C doc/generated/latex; fi
Modified: trunk/openvas-libraries/libopenvas/Makefile
===================================================================
--- trunk/openvas-libraries/libopenvas/Makefile 2009-05-19 13:51:55 UTC (rev 3429)
+++ trunk/openvas-libraries/libopenvas/Makefile 2009-05-19 17:45:49 UTC (rev 3430)
@@ -31,14 +31,14 @@
www_funcs.o ids_send.o rand.o popen.o \
bpf_share.o rand.o popen.o services.o services1.o \
proctitle.o store.o kb.o share_fd.o hash_table_file.o \
- openvas_ssh_login.o openvas_server.o
+ openvas_ssh_login.o openvas_server.o openvas_auth.o
LO_OBJS = plugutils.lo system.lo network.lo resolve.lo arglists.lo \
ftp_funcs.lo scanners_utils.lo pcap.lo hlst.lo harglists.lo \
www_funcs.lo ids_send.lo \
rand.lo popen.lo bpf_share.lo services.lo services1.lo \
proctitle.lo store.lo kb.lo share_fd.lo hash_table_file.lo \
- openvas_ssh_login.lo openvas_server.lo
+ openvas_ssh_login.lo openvas_server.lo openvas_auth.lo
# += does not work with non-GNU make ...
# CFLAGS+=-I../$(CIPHER_SUBDIR)
@@ -125,6 +125,11 @@
openvas_server.o: openvas_server.c openvas_server.h
$(COMPILE) -c openvas_server.c
+OPENVAS_USERS_DIR = $(localstatedir)/lib/openvas/users/
+
+openvas_auth.o: openvas_auth.c openvas_auth.h
+ $(COMPILE) -DOPENVAS_USERS_DIR=\"$(OPENVAS_USERS_DIR)\" -c openvas_auth.c $(DESTDIR)
+
libopenvas.la: $(OBJS)
$(LINK) -o libopenvas.la $(LO_OBJS) $(LIBS) -rpath ${libdir} \
-version-info ${PACKAGE_VERSION}
Added: trunk/openvas-libraries/libopenvas/openvas_auth.c
===================================================================
--- trunk/openvas-libraries/libopenvas/openvas_auth.c 2009-05-19 13:51:55 UTC (rev 3429)
+++ trunk/openvas-libraries/libopenvas/openvas_auth.c 2009-05-19 17:45:49 UTC (rev 3430)
@@ -0,0 +1,182 @@
+/* OpenVAS-Client
+ * $Id$
+ * Description: SSH Key management.
+ *
+ * Authors:
+ * Matthew Mundell <matt at mundell.ukfsn.org>
+ * Michael Wiegand <michael.wiegand at greenbone.net>
+ *
+ * Copyright:
+ * Copyright (C) 2009 Greenbone Networks GmbH
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA.
+ */
+
+#include "openvas_auth.h"
+#include <gcrypt.h>
+
+/**
+ * @brief Generate a hexadecimal representation of a message digest.
+ *
+ * @param gcrypt_algorithm The libgcrypt message digest algorithm used to
+ * create the digest (e.g. GCRY_MD_MD5; see the enum gcry_md_algos in
+ * gcrypt.h).
+ * @param digest The binary representation of the digest.
+ *
+ * @return A pointer to the hexadecimal representation of the message digest
+ * or NULL if an unavailable message digest algorithm was selected.
+ */
+gchar *
+digest_hex (int gcrypt_algorithm, const guchar * digest)
+{
+ gcry_error_t err = gcry_md_test_algo (gcrypt_algorithm);
+ if (err != 0)
+ {
+ g_warning ("Could not select gcrypt algorithm: %s",
+ gcry_strerror (err));
+ return NULL;
+ }
+
+ gchar *hex = g_malloc0(gcry_md_get_algo_dlen (gcrypt_algorithm) * 2 + 1);
+ int i;
+
+ for (i = 0; i < gcry_md_get_algo_dlen (gcrypt_algorithm); i++)
+ {
+ g_snprintf(hex + i * 2, 3, "%02x", digest[i]);
+ }
+
+ return hex;
+}
+
+/**
+ * @brief Generate a pair of hashes to be used in the OpenVAS "auth/hash" file
+ * for the user.
+ *
+ * The "auth/hash" file consist of two hashes, h_1 and h_2. h_2 (the "seed")
+ * is the message digest of (currently) 256 bytes of random data. h_1 is the
+ * message digest of h_2 concatenated with the password in plaintext.
+ *
+ * The current implementation was taken from the openvas-adduser shell script
+ * provided with openvas-server.
+ *
+ * @param gcrypt_algorithm The libgcrypt message digest algorithm used to
+ * create the digest (e.g. GCRY_MD_MD5; see the enum gcry_md_algos in
+ * gcrypt.h)
+ * @param password The password in plaintext.
+ *
+ * @return A pointer to a gchar containing the two hashes separated by a
+ * space or NULL if an unavailable message digest algorithm was selected.
+ */
+gchar *
+get_password_hashes (int gcrypt_algorithm, const gchar * password)
+{
+ gcry_error_t err = gcry_md_test_algo (gcrypt_algorithm);
+ if (err != 0)
+ {
+ g_warning ("Could not select gcrypt algorithm: %s",
+ gcry_strerror (err));
+ return NULL;
+ }
+
+ g_assert (password);
+
+ unsigned char *nonce_buffer[256];
+ guchar *seed = g_malloc0 (gcry_md_get_algo_dlen (gcrypt_algorithm));
+ gchar *seed_hex = NULL;
+ gchar *seed_pass = NULL;
+ guchar *hash = g_malloc0 (gcry_md_get_algo_dlen (gcrypt_algorithm));
+ gchar *hash_hex = NULL;
+ gchar *hashes_out = NULL;
+
+ gcry_create_nonce (nonce_buffer, 256);
+ gcry_md_hash_buffer (GCRY_MD_MD5, seed, nonce_buffer, 256);
+ seed_hex = digest_hex (GCRY_MD_MD5, seed);
+ seed_pass = g_strconcat (seed_hex, password, NULL);
+ gcry_md_hash_buffer (GCRY_MD_MD5, hash, seed_pass, strlen (seed_pass));
+ hash_hex = digest_hex (GCRY_MD_MD5, hash);
+
+ hashes_out = g_strjoin (" ", hash_hex, seed_hex, NULL);
+
+ g_free (seed);
+ g_free (seed_hex);
+ g_free (seed_pass);
+ g_free (hash);
+ g_free (hash_hex);
+
+ return hashes_out;
+}
+
+/**
+ * @brief Authenticate a credential pair.
+ *
+ * @param username Username.
+ * @param password Password.
+ *
+ * @return 0 if authentic, -1 on error, else 1.
+ */
+int
+openvas_authenticate (const gchar * username, const gchar * password)
+{
+ int gcrypt_algorithm = GCRY_MD_MD5; // FIX whatever configer used
+ int ret;
+ gchar* actual;
+ gchar* expect;
+ GError* error = NULL;
+ gchar *seed_pass = NULL;
+ guchar *hash = g_malloc0 (gcry_md_get_algo_dlen (gcrypt_algorithm));
+ gchar *hash_hex = NULL;
+ gchar **seed_hex;
+ gchar **split;
+
+ gchar *file_name = g_build_filename (OPENVAS_USERS_DIR,
+ username,
+ "auth",
+ "hash",
+ NULL);
+ g_file_get_contents (file_name, &actual, NULL, &error);
+ g_free (file_name);
+ if (error)
+ {
+ g_warning ("Failed to read auth contents: %s.", error->message);
+ g_error_free (error);
+ return -1;
+ }
+
+ split = g_strsplit_set (g_strchomp (actual), " ", 2);
+ seed_hex = split + 1;
+ if (*split == NULL || *seed_hex == NULL)
+ {
+ g_warning ("Failed to split auth contents.");
+ g_strfreev (split);
+ return -1;
+ }
+
+ seed_pass = g_strconcat (*seed_hex, password, NULL);
+ gcry_md_hash_buffer (GCRY_MD_MD5, hash, seed_pass, strlen (seed_pass));
+ hash_hex = digest_hex (GCRY_MD_MD5, hash);
+
+ expect = g_strjoin (" ", hash_hex, *seed_hex, NULL);
+
+ g_strfreev (split);
+ g_free (seed_pass);
+ g_free (hash);
+ g_free (hash_hex);
+
+ ret = strcmp (expect, actual) ? 1 : 0;
+ g_free (expect);
+ g_free (actual);
+ return ret;
+}
Added: trunk/openvas-libraries/libopenvas/openvas_auth.h
===================================================================
--- trunk/openvas-libraries/libopenvas/openvas_auth.h 2009-05-19 13:51:55 UTC (rev 3429)
+++ trunk/openvas-libraries/libopenvas/openvas_auth.h 2009-05-19 17:45:49 UTC (rev 3430)
@@ -0,0 +1,42 @@
+/* OpenVAS-Client
+ * $Id$
+ * Description: SSH Key management.
+ *
+ * Authors:
+ * Matthew Mundell <matt at mundell.ukfsn.org>
+ * Michael Wiegand <michael.wiegand at greenbone.net>
+ *
+ * Copyright:
+ * Copyright (C) 2009 Greenbone Networks GmbH
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301,
+ * USA.
+ */
+
+#ifndef _OPENVAS_AUTH_H
+#define _OPENVAS_AUTH_H
+
+#include <glib.h>
+
+gchar *
+get_password_hashes (int, const gchar *);
+
+gchar *
+digest_hex (int, const guchar *);
+
+int
+openvas_authenticate (const gchar *, const gchar *);
+
+#endif
More information about the Openvas-commits
mailing list