5 Author: Pekka Riikonen <priikone@silcnet.org>
7 Copyright (C) 2005 - 2007 Pekka Riikonen
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; version 2 of the License.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
21 #include "silcconnauth.h"
23 /************************** Types and definitions ***************************/
25 SILC_FSM_STATE(silc_connauth_st_initiator_start);
26 SILC_FSM_STATE(silc_connauth_st_initiator_auth_send);
27 SILC_FSM_STATE(silc_connauth_st_initiator_result);
28 SILC_FSM_STATE(silc_connauth_st_initiator_failure);
29 SILC_FSM_STATE(silc_connauth_st_responder_start);
30 SILC_FSM_STATE(silc_connauth_st_responder_authenticate);
31 SILC_FSM_STATE(silc_connauth_st_responder_authenticate_pk);
32 SILC_FSM_STATE(silc_connauth_st_responder_success);
33 SILC_FSM_STATE(silc_connauth_st_responder_failure);
35 static SilcBool silc_connauth_packet_receive(SilcPacketEngine engine,
36 SilcPacketStream stream,
38 void *callback_context,
41 /* Connection authentication context */
42 struct SilcConnAuthStruct {
45 SilcAsyncOperationStruct op;
46 SilcAsyncOperation key_op;
47 SilcConnectionType conn_type;
48 SilcAuthMethod auth_method;
50 SilcUInt32 auth_data_len;
51 SilcConnAuthCompletion completion;
52 SilcConnAuthGetAuthData get_auth_data;
54 SilcDList public_keys;
55 SilcSKRStatus skr_status;
56 SilcUInt32 timeout_secs;
58 unsigned int aborted : 1;
59 unsigned int success : 1;
62 /* Packet stream callbacks */
63 static SilcPacketCallbacks silc_connauth_stream_cbs =
65 silc_connauth_packet_receive, NULL, NULL
69 /************************ Static utility functions **************************/
73 static SilcBool silc_connauth_packet_receive(SilcPacketEngine engine,
74 SilcPacketStream stream,
76 void *callback_context,
79 SilcConnAuth connauth = callback_context;
80 connauth->packet = packet;
81 silc_fsm_continue(connauth->fsm);
85 /* Async operation abortion callback */
87 static void silc_connauth_abort(SilcAsyncOperation op, void *context)
89 SilcConnAuth connauth = context;
91 silc_async_abort(connauth->key_op, NULL, NULL);
92 connauth->aborted = TRUE;
95 /* Signature callback */
97 static void silc_connauth_get_signature_cb(SilcBool success,
98 const unsigned char *signature,
99 SilcUInt32 signature_len,
102 SilcConnAuth connauth = context;
104 connauth->key_op = NULL;
107 silc_fsm_next(connauth->fsm, silc_connauth_st_initiator_failure);
108 SILC_FSM_CALL_CONTINUE(connauth->fsm);
112 connauth->auth_data = silc_memdup(signature, signature_len);
113 connauth->auth_data_len = signature_len;
115 SILC_FSM_CALL_CONTINUE(connauth->fsm);
118 /* Generates signature for public key based authentication */
120 static SilcAsyncOperation
121 silc_connauth_get_signature(SilcConnAuth connauth)
123 SilcAsyncOperation op;
125 SilcPrivateKey private_key;
129 SILC_LOG_DEBUG(("Compute signature"));
132 private_key = connauth->auth_data;
134 /* Make the authentication data. Protocol says it is HASH plus
136 len = ske->hash_len + silc_buffer_len(ske->start_payload_copy);
137 auth = silc_buffer_alloc_size(len);
139 silc_connauth_get_signature_cb(FALSE, NULL, 0, connauth);
142 silc_buffer_format(auth,
143 SILC_STR_DATA(ske->hash, ske->hash_len),
144 SILC_STR_DATA(ske->start_payload_copy->data,
145 silc_buffer_len(ske->start_payload_copy)),
148 /* Compute signature */
149 op = silc_pkcs_sign(private_key, auth->data, silc_buffer_len(auth),
150 TRUE, ske->prop->hash,
151 silc_connauth_get_signature_cb, connauth);
153 silc_buffer_free(auth);
158 /* Verify callback */
160 static void silc_connauth_verify_signature_cb(SilcBool success,
163 SilcConnAuth connauth = context;
165 connauth->key_op = NULL;
166 silc_free(connauth->auth_data);
169 SILC_LOG_DEBUG(("Invalid signature"));
170 silc_fsm_next(connauth->fsm, silc_connauth_st_responder_failure);
171 SILC_FSM_CALL_CONTINUE(connauth->fsm);
175 SILC_FSM_CALL_CONTINUE(connauth->fsm);
178 /* Verifies digital signature */
180 static SilcAsyncOperation
181 silc_connauth_verify_signature(SilcConnAuth connauth,
182 SilcPublicKey pub_key,
186 SilcAsyncOperation op;
188 SilcSKE ske = connauth->ske;
191 if (!pub_key || !sign) {
192 silc_connauth_verify_signature_cb(FALSE, connauth);
196 /* Make the authentication data. Protocol says it is HASH plus
198 len = ske->hash_len + silc_buffer_len(ske->start_payload_copy);
199 auth = silc_buffer_alloc_size(len);
201 silc_connauth_verify_signature_cb(FALSE, connauth);
204 silc_buffer_format(auth,
205 SILC_STR_UI_XNSTRING(ske->hash, ske->hash_len),
206 SILC_STR_UI_XNSTRING(
207 ske->start_payload_copy->data,
208 silc_buffer_len(ske->start_payload_copy)),
211 /* Verify signature */
212 op = silc_pkcs_verify(pub_key, sign, sign_len, auth->data,
213 silc_buffer_len(auth), ske->prop->hash,
214 silc_connauth_verify_signature_cb, connauth);
216 silc_buffer_free(auth);
223 SILC_TASK_CALLBACK(silc_connauth_timeout)
225 SilcConnAuth connauth = context;
226 SILC_LOG_DEBUG(("Protocol timeout"));
227 if (connauth->key_op)
228 silc_async_abort(connauth->key_op, NULL, NULL);
229 connauth->aborted = TRUE;
230 silc_fsm_continue_sync(connauth->fsm);
235 static void silc_connauth_skr_callback(SilcSKR skr, SilcSKRFind find,
236 SilcSKRStatus status,
237 SilcDList results, void *context)
239 SilcConnAuth connauth = context;
241 silc_skr_find_free(find);
243 connauth->public_keys = results;
244 connauth->skr_status = status;
246 SILC_FSM_CALL_CONTINUE(connauth->fsm);
251 static void silc_connauth_fsm_destructor(SilcFSM fsm, void *fsm_context,
252 void *destructor_context)
258 /******************************* Protocol API *******************************/
260 /* Allocate connection authentication context */
262 SilcConnAuth silc_connauth_alloc(SilcSchedule schedule,
264 SilcUInt32 timeout_secs)
266 SilcConnAuth connauth;
268 if (!schedule || !ske)
271 connauth = silc_calloc(1, sizeof(*connauth));
275 connauth->fsm = silc_fsm_alloc(connauth, silc_connauth_fsm_destructor,
277 if (!connauth->fsm) {
278 silc_connauth_free(connauth);
282 connauth->timeout_secs = timeout_secs;
289 /* Free connection authentication context */
291 void silc_connauth_free(SilcConnAuth connauth)
293 if (connauth->public_keys)
294 silc_dlist_uninit(connauth->public_keys);
297 silc_ske_free(connauth->ske);
302 /* Return associated SKE context */
304 SilcSKE silc_connauth_get_ske(SilcConnAuth connauth)
306 return connauth->ske;
310 /******************************** Initiator *********************************/
312 SILC_FSM_STATE(silc_connauth_st_initiator_start)
314 SilcConnAuth connauth = fsm_context;
316 SILC_LOG_DEBUG(("Start"));
318 if (connauth->aborted) {
320 silc_fsm_next(fsm, silc_connauth_st_initiator_failure);
321 return SILC_FSM_CONTINUE;
325 if (connauth->timeout_secs)
326 silc_schedule_task_add_timeout(silc_fsm_get_schedule(fsm),
327 silc_connauth_timeout, connauth,
328 connauth->timeout_secs, 0);
330 /** Generate auth data */
331 silc_fsm_next(fsm, silc_connauth_st_initiator_auth_send);
333 /* Get authentication data */
334 switch (connauth->auth_method) {
336 /* No authentication required */
337 connauth->auth_data = NULL;
338 connauth->auth_data_len = 0;
339 return SILC_FSM_CONTINUE;
342 case SILC_AUTH_PASSWORD:
343 /* We have authentication data already */
344 return SILC_FSM_CONTINUE;
347 case SILC_AUTH_PUBLIC_KEY:
348 /* Compute signature */
349 SILC_FSM_CALL(connauth->key_op = silc_connauth_get_signature(connauth));
354 silc_fsm_next(fsm, silc_connauth_st_initiator_failure);
355 return SILC_FSM_CONTINUE;
358 SILC_FSM_STATE(silc_connauth_st_initiator_auth_send)
360 SilcConnAuth connauth = fsm_context;
363 SilcPacketFlags flags = 0;
365 if (connauth->auth_method == SILC_AUTH_PASSWORD)
366 flags |= SILC_PACKET_FLAG_LONG_PAD;
368 payload_len = 4 + connauth->auth_data_len;
369 packet = silc_buffer_alloc_size(payload_len);
372 silc_fsm_next(fsm, silc_connauth_st_initiator_failure);
373 return SILC_FSM_CONTINUE;
376 silc_buffer_format(packet,
377 SILC_STR_UI_SHORT(payload_len),
378 SILC_STR_UI_SHORT(connauth->conn_type),
379 SILC_STR_DATA(connauth->auth_data,
380 connauth->auth_data_len),
383 silc_free(connauth->auth_data);
385 /* Send the packet */
386 if (!silc_packet_send(connauth->ske->stream, SILC_PACKET_CONNECTION_AUTH,
387 flags, packet->data, silc_buffer_len(packet))) {
388 /** Error sending packet */
389 silc_fsm_next(fsm, silc_connauth_st_initiator_failure);
390 return SILC_FSM_CONTINUE;
393 silc_buffer_free(packet);
395 /** Wait for responder */
396 silc_fsm_next(fsm, silc_connauth_st_initiator_result);
397 return SILC_FSM_WAIT;
400 SILC_FSM_STATE(silc_connauth_st_initiator_result)
402 SilcConnAuth connauth = fsm_context;
404 SILC_LOG_DEBUG(("Start"));
406 if (connauth->aborted) {
408 silc_fsm_next(fsm, silc_connauth_st_initiator_failure);
409 return SILC_FSM_CONTINUE;
412 /* Check the status of authentication */
413 if (connauth->packet->type == SILC_PACKET_SUCCESS) {
414 SILC_LOG_DEBUG(("Authentication successful"));
415 connauth->success = TRUE;
417 SILC_LOG_DEBUG(("Authentication failed, packet %s received",
418 silc_get_packet_name(connauth->packet->type)));
419 connauth->success = FALSE;
421 silc_packet_free(connauth->packet);
423 silc_packet_stream_unlink(connauth->ske->stream,
424 &silc_connauth_stream_cbs, connauth);
425 silc_schedule_task_del_by_context(silc_fsm_get_schedule(fsm), connauth);
427 /* Call completion callback */
428 connauth->completion(connauth, connauth->success, connauth->context);
430 return SILC_FSM_FINISH;
433 SILC_FSM_STATE(silc_connauth_st_initiator_failure)
435 SilcConnAuth connauth = fsm_context;
436 unsigned char error[4];
438 SILC_LOG_DEBUG(("Start"));
440 if (!connauth->aborted) {
441 /* Send FAILURE packet */
442 SILC_PUT32_MSB(SILC_AUTH_FAILED, error);
443 silc_packet_send(connauth->ske->stream, SILC_PACKET_FAILURE, 0, error, 4);
445 silc_packet_stream_unlink(connauth->ske->stream,
446 &silc_connauth_stream_cbs, connauth);
447 silc_schedule_task_del_by_context(silc_fsm_get_schedule(fsm), connauth);
449 /* Call completion callback */
450 connauth->completion(connauth, FALSE, connauth->context);
451 return SILC_FSM_FINISH;
454 silc_packet_stream_unlink(connauth->ske->stream,
455 &silc_connauth_stream_cbs, connauth);
456 silc_schedule_task_del_by_context(silc_fsm_get_schedule(fsm), connauth);
458 return SILC_FSM_FINISH;
462 silc_connauth_initiator(SilcConnAuth connauth,
463 SilcConnectionType conn_type,
464 SilcAuthMethod auth_method, void *auth_data,
465 SilcUInt32 auth_data_len,
466 SilcConnAuthCompletion completion,
469 SILC_LOG_DEBUG(("Connection authentication as initiator"));
471 if (auth_method == SILC_AUTH_PASSWORD && !auth_data) {
472 completion(connauth, FALSE, context);
476 if (auth_method == SILC_AUTH_PUBLIC_KEY && !auth_data) {
477 completion(connauth, FALSE, context);
481 connauth->conn_type = conn_type;
482 connauth->auth_method = auth_method;
483 connauth->completion = completion;
484 connauth->context = context;
485 connauth->auth_data = auth_data;
486 connauth->auth_data_len = auth_data_len;
488 if (connauth->auth_method == SILC_AUTH_PASSWORD)
489 connauth->auth_data = silc_memdup(connauth->auth_data,
490 connauth->auth_data_len);
492 /* Link to packet stream to get packets */
493 silc_packet_stream_link(connauth->ske->stream,
494 &silc_connauth_stream_cbs, connauth, 1000000,
496 SILC_PACKET_FAILURE, -1);
498 /* Start the protocol */
499 silc_async_init(&connauth->op, silc_connauth_abort, NULL, connauth);
500 silc_fsm_start(connauth->fsm, silc_connauth_st_initiator_start);
502 return &connauth->op;
506 /******************************** Responder *********************************/
508 SILC_FSM_STATE(silc_connauth_st_responder_start)
510 SilcConnAuth connauth = fsm_context;
512 SILC_LOG_DEBUG(("Start"));
514 if (connauth->aborted) {
516 silc_fsm_next(fsm, silc_connauth_st_responder_failure);
517 return SILC_FSM_CONTINUE;
521 if (connauth->timeout_secs)
522 silc_schedule_task_add_timeout(silc_fsm_get_schedule(fsm),
523 silc_connauth_timeout, connauth,
524 connauth->timeout_secs, 0);
526 /** Wait for initiator */
527 silc_fsm_next(fsm, silc_connauth_st_responder_authenticate);
528 return SILC_FSM_WAIT;
531 SILC_FSM_STATE(silc_connauth_st_responder_authenticate)
533 SilcConnAuth connauth = fsm_context;
534 SilcUInt16 payload_len;
535 SilcUInt16 conn_type;
536 unsigned char *auth_data = NULL, *passphrase = NULL;
537 SilcUInt32 passphrase_len;
538 SilcSKR repository = NULL;
541 SILC_LOG_DEBUG(("Start"));
543 if (connauth->aborted) {
545 if (connauth->packet)
546 silc_packet_free(connauth->packet);
547 silc_fsm_next(fsm, silc_connauth_st_responder_failure);
548 return SILC_FSM_CONTINUE;
551 if (connauth->packet->type != SILC_PACKET_CONNECTION_AUTH) {
552 /** Protocol failure */
553 silc_packet_free(connauth->packet);
554 silc_fsm_next(fsm, silc_connauth_st_responder_failure);
555 return SILC_FSM_CONTINUE;
558 /* Parse the received authentication data packet. The received
559 payload is Connection Auth Payload. */
560 ret = silc_buffer_unformat(&connauth->packet->buffer,
561 SILC_STR_UI_SHORT(&payload_len),
562 SILC_STR_UI_SHORT(&conn_type),
566 SILC_LOG_ERROR(("Bad payload in authentication packet"));
567 silc_packet_free(connauth->packet);
568 silc_fsm_next(fsm, silc_connauth_st_responder_failure);
569 return SILC_FSM_CONTINUE;
572 if (payload_len != silc_buffer_len(&connauth->packet->buffer)) {
573 /** Bad payload length */
574 SILC_LOG_ERROR(("Bad payload length in authentication packet"));
575 silc_packet_free(connauth->packet);
576 silc_fsm_next(fsm, silc_connauth_st_responder_failure);
577 return SILC_FSM_CONTINUE;
582 if (conn_type < SILC_CONN_CLIENT || conn_type > SILC_CONN_ROUTER) {
583 /** Bad connection type */
584 SILC_LOG_ERROR(("Bad connection type (%d) in authentication packet",
586 silc_packet_free(connauth->packet);
587 silc_fsm_next(fsm, silc_connauth_st_responder_failure);
588 return SILC_FSM_CONTINUE;
591 if (payload_len > 0) {
592 /* Get authentication data */
593 ret = silc_buffer_unformat(&connauth->packet->buffer,
595 SILC_STR_UI_XNSTRING(&auth_data,
600 SILC_LOG_DEBUG(("Bad payload in authentication payload"));
601 silc_packet_free(connauth->packet);
602 silc_fsm_next(fsm, silc_connauth_st_responder_failure);
603 return SILC_FSM_CONTINUE;
606 silc_packet_free(connauth->packet);
608 SILC_LOG_DEBUG(("Remote connection type %d", conn_type));
610 /* Get authentication data */
611 if (!connauth->get_auth_data(connauth, conn_type, &passphrase,
612 &passphrase_len, &repository,
613 connauth->context)) {
614 /** Connection not configured */
615 SILC_LOG_ERROR(("Remote connection not configured"));
616 silc_fsm_next(fsm, silc_connauth_st_responder_failure);
617 return SILC_FSM_CONTINUE;
622 /* Passphrase authentication */
623 if (passphrase && passphrase_len) {
624 SILC_LOG_DEBUG(("Passphrase authentication"));
625 if (!auth_data || payload_len != passphrase_len ||
626 memcmp(auth_data, passphrase, passphrase_len)) {
627 /** Authentication failed */
628 silc_fsm_next(fsm, silc_connauth_st_responder_failure);
629 return SILC_FSM_CONTINUE;
631 } else if (repository) {
632 /* Digital signature */
635 SILC_LOG_DEBUG(("Digital signature authentication"));
638 /** Authentication failed */
639 silc_fsm_next(fsm, silc_connauth_st_responder_failure);
640 return SILC_FSM_CONTINUE;
643 connauth->auth_data = silc_memdup(auth_data, payload_len);
644 connauth->auth_data_len = payload_len;
646 /* Allocate search constraints for finding the key */
647 find = silc_skr_find_alloc();
649 if (!find || !connauth->auth_data) {
651 silc_fsm_next(fsm, silc_connauth_st_responder_failure);
652 return SILC_FSM_CONTINUE;
655 silc_skr_find_set_pkcs_type(find, connauth->ske->pk_type);
656 silc_skr_find_set_public_key(find, connauth->ske->public_key);
657 silc_skr_find_set_usage(find, (SILC_SKR_USAGE_AUTH |
658 SILC_SKR_USAGE_KEY_AGREEMENT));
660 /** Find public key */
661 silc_fsm_next(fsm, silc_connauth_st_responder_authenticate_pk);
662 SILC_FSM_CALL(connauth->key_op =
663 silc_skr_find(repository, silc_fsm_get_schedule(fsm),
664 find, silc_connauth_skr_callback,
669 /* Passphrase auth Ok, or no authentication required */
671 /** Authentication successful */
672 silc_fsm_next(fsm, silc_connauth_st_responder_success);
673 return SILC_FSM_CONTINUE;
676 SILC_FSM_STATE(silc_connauth_st_responder_authenticate_pk)
678 SilcConnAuth connauth = fsm_context;
681 if (connauth->aborted) {
683 silc_fsm_next(fsm, silc_connauth_st_responder_failure);
684 return SILC_FSM_CONTINUE;
687 if (connauth->skr_status != SILC_SKR_OK) {
688 /** Public key not found */
689 SILC_LOG_DEBUG(("Public key not found, error %d", connauth->skr_status));
690 silc_fsm_next(fsm, silc_connauth_st_responder_failure);
691 return SILC_FSM_CONTINUE;
694 SILC_LOG_DEBUG(("Found %d public keys",
695 silc_dlist_count(connauth->public_keys)));
697 /** Verify signature */
698 key = silc_dlist_get(connauth->public_keys);
699 silc_fsm_next(fsm, silc_connauth_st_responder_success);
700 SILC_FSM_CALL(connauth->key_op =
701 silc_connauth_verify_signature(connauth, key->key,
703 connauth->auth_data_len));
707 SILC_FSM_STATE(silc_connauth_st_responder_success)
709 SilcConnAuth connauth = fsm_context;
710 unsigned char tmp[4];
712 SILC_LOG_DEBUG(("Authentication successful"));
714 /* Send FAILURE packet */
715 SILC_PUT32_MSB(SILC_AUTH_OK, tmp);
716 silc_packet_send(connauth->ske->stream, SILC_PACKET_SUCCESS, 0, tmp, 4);
718 silc_packet_stream_unlink(connauth->ske->stream,
719 &silc_connauth_stream_cbs, connauth);
720 silc_schedule_task_del_by_context(silc_fsm_get_schedule(fsm), connauth);
722 /* Call completion callback */
723 connauth->completion(connauth, TRUE, connauth->context);
725 return SILC_FSM_FINISH;
728 SILC_FSM_STATE(silc_connauth_st_responder_failure)
730 SilcConnAuth connauth = fsm_context;
731 unsigned char error[4];
733 SILC_LOG_ERROR(("Authentication failed"));
735 if (!connauth->aborted) {
736 /* Send FAILURE packet */
737 SILC_PUT32_MSB(SILC_AUTH_FAILED, error);
738 silc_packet_send(connauth->ske->stream, SILC_PACKET_FAILURE, 0, error, 4);
740 silc_packet_stream_unlink(connauth->ske->stream,
741 &silc_connauth_stream_cbs, connauth);
742 silc_schedule_task_del_by_context(silc_fsm_get_schedule(fsm), connauth);
744 /* Call completion callback */
745 connauth->completion(connauth, FALSE, connauth->context);
747 return SILC_FSM_FINISH;
750 silc_packet_stream_unlink(connauth->ske->stream,
751 &silc_connauth_stream_cbs, connauth);
752 silc_schedule_task_del_by_context(silc_fsm_get_schedule(fsm), connauth);
754 return SILC_FSM_FINISH;
758 silc_connauth_responder(SilcConnAuth connauth,
759 SilcConnAuthGetAuthData get_auth_data,
760 SilcConnAuthCompletion completion,
763 SILC_LOG_DEBUG(("Connection authentication as responder"));
765 connauth->get_auth_data = get_auth_data;
766 connauth->completion = completion;
767 connauth->context = context;
769 /* Link to packet stream to get packets */
770 silc_packet_stream_link(connauth->ske->stream,
771 &silc_connauth_stream_cbs, connauth, 1000000,
772 SILC_PACKET_CONNECTION_AUTH,
773 SILC_PACKET_FAILURE, -1);
775 /* Start the protocol */
776 silc_async_init(&connauth->op, silc_connauth_abort, NULL, connauth);
777 silc_fsm_start(connauth->fsm, silc_connauth_st_responder_start);
779 return &connauth->op;