first working version of challenge response authentication. needs

testing.

Makefile.in

@@ -23,7 +23,7 @@ SHELL=/bin/sh
 LIBOBJ=lib/getopt.o lib/fnmatch.o lib/zlib.o lib/compat.o
 OBJS1=rsync.o exclude.o util.o md4.o main.o checksum.o match.o syscall.o log.o
 OBJS2=options.o flist.o io.o compat.o hlink.o token.o uidlist.o socket.o 
-DAEMON_OBJ = params.o loadparm.o clientserver.o access.o connection.o
+DAEMON_OBJ = params.o loadparm.o clientserver.o access.o connection.o authenticate.o
 OBJS=$(OBJS1) $(OBJS2) $(DAEMON_OBJ) $(LIBOBJ)
 
 # note that the -I. is needed to handle config.h when using VPATH

authenticate.c

@@ -19,3 +19,180 @@
 /* support rsync authentication */
 #include "rsync.h"
 
+/***************************************************************************
+encode a buffer using base64 - simple and slow algorithm. null terminates
+the result.
+  ***************************************************************************/
+static void base64_encode(char *buf, int len, char *out)
+{
+	char *b64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+	int bit_offset, byte_offset, idx, i;
+	unsigned char *d = (unsigned char *)buf;
+	char *p;
+	int bytes = (len*8 + 5)/6;
+
+	memset(out, 0, bytes+1);
+
+	for (i=0;i<bytes;i++) {
+		byte_offset = (i*6)/8;
+		bit_offset = (i*6)%8;
+		if (bit_offset < 3) {
+			idx = (d[byte_offset] >> (2-bit_offset)) & 0x3F;
+		} else {
+			idx = (d[byte_offset] << (bit_offset-2)) & 0x3F;
+			if (byte_offset+1 < len) {
+				idx |= (d[byte_offset+1] >> (8-(bit_offset-2)));
+			}
+		}
+		out[i] = b64[idx];
+	}
+}
+
+/* create a 16 byte challenge buffer */
+static void gen_challenge(char *addr, char *challenge)
+{
+	char input[32];
+	struct timeval tv;
+
+	memset(input, 0, sizeof(input));
+
+	strncpy((char *)input, addr, 16);
+	gettimeofday(&tv, NULL);
+	SIVAL(input, 16, tv.tv_sec);
+	SIVAL(input, 20, tv.tv_usec);
+	SIVAL(input, 24, getpid());
+
+	sum_init();
+	sum_update(input, sizeof(input));
+	sum_end(challenge);
+}
+
+
+/* return the secret for a user from the sercret file. maximum length
+   is len. null terminate it */
+static int get_secret(int module, char *user, char *secret, int len)
+{
+	char *fname = lp_secrets_file(module);
+	int fd, found=0;
+	char line[1024];
+	char *p, *pass;
+
+	if (!fname || !*fname) return 0;
+
+	fd = open(fname,O_RDONLY);
+	if (fd == -1) return 0;
+
+	while (!found) {
+		int i = 0;
+		memset(line, 0, sizeof(line));
+		while (i<(sizeof(line)-1)) {
+			if (read(fd, &line[i], 1) != 1) {
+				memset(line, 0, sizeof(line));
+				close(fd);
+				return 0;
+			}
+			if (line[i] == '\r') continue;
+			if (line[i] == '\n') break;
+			i++;
+		}
+		line[i] = 0;
+		if (line[0] == '#') continue;
+		p = strchr(line,':');
+		if (!p) continue;
+		*p = 0;
+		if (strcmp(user, line)) continue;
+		pass = p+1;
+		found = 1;
+	}
+
+	close(fd);
+	if (!found) return 0;
+
+	if (strlen(pass) > len-1) {
+		memset(line, 0, sizeof(line));
+		return 0;
+	}
+
+	strcpy(secret, pass);
+	return 1;
+}
+
+/* generate a 16 byte hash from a password and challenge */
+void generate_hash(char *in, char *challenge, char *out)
+{
+	char buf[16];
+
+	sum_init();
+	sum_update(in, strlen(in));
+	sum_update(challenge, strlen(challenge));
+	sum_end(buf);
+
+	base64_encode(buf, 16, out);
+}
+
+/* possible negotiate authentication with the client. Use "leader" to
+   start off the auth if necessary */
+int auth_server(int fd, int module, char *addr, char *leader)
+{
+	char *users = lp_auth_users(module);
+	char challenge[16];
+	char b64_challenge[30];
+	char line[1024];
+	char user[100];
+	char secret[100];
+	char pass[30];
+	char pass2[30];
+
+	/* if no auth list then allow anyone in! */
+	if (!users || !*users) return 1;
+
+	gen_challenge(addr, challenge);
+	
+	base64_encode(challenge, 16, b64_challenge);
+
+	io_printf(fd,"%s%s\n", leader, b64_challenge);
+
+	if (!read_line(fd, line, sizeof(line)-1)) {
+		return 0;
+	}
+
+	memset(user, 0, sizeof(user));
+	memset(pass, 0, sizeof(pass));
+
+	if (sscanf(line,"%99s %29s", user, pass) != 2) {
+		return 0;
+	}
+
+	memset(secret, 0, sizeof(secret));
+	if (!get_secret(module, user, secret, sizeof(secret)-1)) {
+		memset(secret, 0, sizeof(secret));
+		return 0;
+	}
+
+	generate_hash(secret, b64_challenge, pass2);
+	memset(secret, 0, sizeof(secret));
+	
+	return (strcmp(pass, pass2) == 0);
+}
+
+
+void auth_client(int fd, char *user, char *challenge)
+{
+	char *pass;
+	char pass2[30];
+
+	if (!user || !*user) return;
+
+	if (!(pass=getenv("RSYNC_PASSWORD"))) {
+		pass = getpass("Password: ");
+	}
+
+	if (!pass || !*pass) {
+		pass = "";
+	}
+
+	generate_hash(pass, challenge, pass2);
+	
+	io_printf(fd, "%s %s\n", user, pass2);
+}
+

clientserver.c

@@ -31,9 +31,19 @@ int start_socket_client(char *host, char *path, int argc, char *argv[])
 	char *sargs[MAX_ARGS];
 	int sargc=0;
 	char line[1024];
-	char *p;
+	char *p, *user=NULL;
 	extern int remote_version;
 
+	p = strchr(host, '@');
+	if (p) {
+		user = host;
+		host = p+1;
+		*p = 0;
+	}
+
+	if (!user) user = getenv("USER");
+	if (!user) user = getenv("LOGNAME");
+
 	fd = open_socket_out(host, rsync_port);
 	if (fd == -1) {
 		exit_cleanup(1);
@@ -68,12 +78,10 @@ int start_socket_client(char *host, char *path, int argc, char *argv[])
 			return -1;
 		}
 
-#if 0
 		if (strncmp(line,"@RSYNCD: AUTHREQD ",18) == 0) {
-			auth_client(fd, line+18);
+			auth_client(fd, user, line+18);
 			continue;
 		}
-#endif
 
 		if (strcmp(line,"@RSYNCD: OK") == 0) break;
 		rprintf(FINFO,"%s\n", line);
@@ -84,15 +92,6 @@ int start_socket_client(char *host, char *path, int argc, char *argv[])
 	}
 	io_printf(fd,"\n");
 
-#if 0
-	while (1) {
-		if (!read_line(fd, line, sizeof(line)-1)) {
-			return -1;
-		}
-		rprintf(FINFO,"%s\n", line);
-	}
-#endif
-
 	return client_run(fd, fd, -1, argc, argv);
 }
 
@@ -117,13 +116,11 @@ static int rsync_module(int fd, int i)
 		return -1;
 	}
 
-#if 0
-	if (!auth_server(fd, "@RSYNCD: AUTHREQD ")) {
+	if (!auth_server(fd, i, addr, "@RSYNCD: AUTHREQD ")) {
 		rprintf(FERROR,"auth failed on module %s from %s (%s)\n",
 			lp_name(i), client_name(fd), client_addr(fd));
 		return -1;		
 	}
-#endif
 
 	if (!claim_connection(lp_lock_file(), lp_max_connections())) {
 		rprintf(FERROR,"ERROR: max connections reached\n");
@@ -266,7 +263,6 @@ static int start_daemon(int fd)
 	}	
 
 	while (i == -1) {
-
 		line[0] = 0;
 		if (!read_line(fd, line, sizeof(line)-1)) {
 			return -1;