Greenbone Vulnerability Management Libraries  11.0.0
authutils.h File Reference

Authentication mechanism(s). More...

#include <glib.h>
Include dependency graph for authutils.h:
This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Typedefs

typedef enum authentication_method auth_method_t
 Type for the numerical representation of the supported authentication methods. More...
 

Enumerations

enum  authentication_method { AUTHENTICATION_METHOD_FILE = 0, AUTHENTICATION_METHOD_LDAP_CONNECT, AUTHENTICATION_METHOD_RADIUS_CONNECT, AUTHENTICATION_METHOD_LAST }
 Numerical representation of the supported authentication methods. Beware to have it in sync with authentication_methods in authutils.c. More...
 

Functions

const gchar * auth_method_name (auth_method_t)
 Return name of auth_method_t. More...
 
int gvm_auth_init ()
 Initializes Gcrypt. More...
 
int gvm_authenticate_classic (const gchar *, const gchar *, const gchar *)
 Authenticate a credential pair against user file contents. More...
 
gchar * get_password_hashes (const gchar *)
 Generate a pair of md5 hashes to be used in the "auth/hash" file for the user. More...
 
gchar * digest_hex (int, const guchar *)
 Generate a hexadecimal representation of a message digest. More...
 
int gvm_auth_ldap_enabled ()
 Return whether libraries has been compiled with LDAP support. More...
 
int gvm_auth_radius_enabled ()
 Return whether libraries has been compiled with RADIUS support. More...
 

Detailed Description

Authentication mechanism(s).

Definition in file authutils.h.

Typedef Documentation

◆ auth_method_t

Type for the numerical representation of the supported authentication methods.

Definition at line 45 of file authutils.h.

Enumeration Type Documentation

◆ authentication_method

Numerical representation of the supported authentication methods. Beware to have it in sync with authentication_methods in authutils.c.

Enumerator
AUTHENTICATION_METHOD_FILE 
AUTHENTICATION_METHOD_LDAP_CONNECT 
AUTHENTICATION_METHOD_RADIUS_CONNECT 
AUTHENTICATION_METHOD_LAST 

Definition at line 35 of file authutils.h.

Function Documentation

◆ auth_method_name()

const gchar* auth_method_name ( auth_method_t  method)

Return name of auth_method_t.

Keep in sync with authentication_methods and authentication_method .

Parameters
methodAuth method.
Returns
Name of auth method.

Definition at line 90 of file authutils.c.

91 {
92  if (method >= AUTHENTICATION_METHOD_LAST)
93  return "ERROR";
94  return authentication_methods[method];
95 }

References AUTHENTICATION_METHOD_LAST, and authentication_methods.

◆ digest_hex()

gchar* digest_hex ( int  gcrypt_algorithm,
const guchar *  digest 
)

Generate a hexadecimal representation of a message digest.

Parameters
gcrypt_algorithmThe libgcrypt message digest algorithm used to create the digest (e.g. GCRY_MD_MD5; see the enum gcry_md_algos in gcrypt.h).
digestThe binary representation of the digest.
Returns
A pointer to the hexadecimal representation of the message digest or NULL if an unavailable message digest algorithm was selected.

Definition at line 168 of file authutils.c.

169 {
170  unsigned int i;
171  gchar *hex;
172 
173  gcry_error_t err = gcry_md_test_algo (gcrypt_algorithm);
174  if (err != 0)
175  {
176  g_warning ("Could not select gcrypt algorithm: %s", gcry_strerror (err));
177  return NULL;
178  }
179 
180  hex = g_malloc0 (gcry_md_get_algo_dlen (gcrypt_algorithm) * 2 + 1);
181  for (i = 0; i < gcry_md_get_algo_dlen (gcrypt_algorithm); i++)
182  {
183  g_snprintf (hex + i * 2, 3, "%02x", digest[i]);
184  }
185 
186  return hex;
187 }

Referenced by get_password_hashes(), and gvm_authenticate_classic().

Here is the caller graph for this function:

◆ get_password_hashes()

gchar* get_password_hashes ( const gchar *  password)

Generate a pair of md5 hashes to be used in the "auth/hash" file for the user.

The "auth/hash" file consist of two hashes, h_1 and h_2. h_2 (the "seed") is the message digest of (currently) 256 bytes of random data. h_1 is the message digest of h_2 concatenated with the password in plaintext.

Parameters
passwordThe password in plaintext.
Returns
A pointer to a gchar containing the two hashes separated by a space or NULL if an unavailable message digest algorithm was selected.

Definition at line 203 of file authutils.c.

204 {
205  g_assert (password);
206 
207  unsigned char *nonce_buffer[256];
208  guchar *seed = g_malloc0 (gcry_md_get_algo_dlen (GCRY_MD_MD5));
209  gchar *seed_hex = NULL;
210  gchar *seed_pass = NULL;
211  guchar *hash = g_malloc0 (gcry_md_get_algo_dlen (GCRY_MD_MD5));
212  gchar *hash_hex = NULL;
213  gchar *hashes_out = NULL;
214 
215  gcry_create_nonce (nonce_buffer, 256);
216  gcry_md_hash_buffer (GCRY_MD_MD5, seed, nonce_buffer, 256);
217  seed_hex = digest_hex (GCRY_MD_MD5, seed);
218  seed_pass = g_strconcat (seed_hex, password, NULL);
219  gcry_md_hash_buffer (GCRY_MD_MD5, hash, seed_pass, strlen (seed_pass));
220  hash_hex = digest_hex (GCRY_MD_MD5, hash);
221 
222  hashes_out = g_strjoin (" ", hash_hex, seed_hex, NULL);
223 
224  g_free (seed);
225  g_free (seed_hex);
226  g_free (seed_pass);
227  g_free (hash);
228  g_free (hash_hex);
229 
230  return hashes_out;
231 }

References digest_hex().

Here is the call graph for this function:

◆ gvm_auth_init()

int gvm_auth_init ( )

Initializes Gcrypt.

Returns
0 success, -1 error.

Definition at line 103 of file authutils.c.

104 {
105  if (initialized == TRUE)
106  {
107  g_warning ("gvm_auth_init called a second time.");
108  return -1;
109  }
110 
111  /* Init Libgcrypt. */
112 
113  /* Check if libgcrypt is already initialized */
114  if (gcry_control (GCRYCTL_ANY_INITIALIZATION_P))
115  {
116  initialized = TRUE;
117  return 0;
118  }
119 
120  /* Version check should be the very first call because it makes sure that
121  * important subsystems are initialized.
122  * We pass NULL to gcry_check_version to disable the internal version mismatch
123  * test. */
124  if (!gcry_check_version (NULL))
125  {
126  g_critical ("%s: libgcrypt version check failed\n", __FUNCTION__);
127  return -1;
128  }
129 
130  /* We don't want to see any warnings, e.g. because we have not yet parsed
131  * program options which might be used to suppress such warnings. */
132  gcry_control (GCRYCTL_SUSPEND_SECMEM_WARN);
133 
134  /* ... If required, other initialization goes here. Note that the process
135  * might still be running with increased privileges and that the secure
136  * memory has not been initialized. */
137 
138  /* Allocate a pool of 16k secure memory. This make the secure memory
139  * available and also drops privileges where needed. */
140  gcry_control (GCRYCTL_INIT_SECMEM, 16384, 0);
141 
142  /* It is now okay to let Libgcrypt complain when there was/is a problem with
143  * the secure memory. */
144  gcry_control (GCRYCTL_RESUME_SECMEM_WARN);
145 
146  /* ... If required, other initialization goes here. */
147 
148  /* Tell Libgcrypt that initialization has completed. */
149  gcry_control (GCRYCTL_INITIALIZATION_FINISHED, 0);
150 
151  initialized = TRUE;
152 
153  return 0;
154 }

References initialized.

◆ gvm_auth_ldap_enabled()

int gvm_auth_ldap_enabled ( )

Return whether libraries has been compiled with LDAP support.

Returns
1 if enabled, else 0.

Definition at line 55 of file authutils.c.

56 {
57 #ifdef ENABLE_LDAP_AUTH
58  return 1;
59 #else
60  return 0;
61 #endif /* ENABLE_LDAP_AUTH */
62 }

◆ gvm_auth_radius_enabled()

int gvm_auth_radius_enabled ( )

Return whether libraries has been compiled with RADIUS support.

Returns
1 if enabled, else 0.

Definition at line 70 of file authutils.c.

71 {
72 #ifdef ENABLE_RADIUS_AUTH
73  return 1;
74 #else
75  return 0;
76 #endif /* ENABLE_RADIUS_AUTH */
77 }

◆ gvm_authenticate_classic()

int gvm_authenticate_classic ( const gchar *  username,
const gchar *  password,
const gchar *  hash_arg 
)

Authenticate a credential pair against user file contents.

Parameters
usernameUsername.
passwordPassword.
hash_argHash.
Returns
0 authentication success, 1 authentication failure, -1 error.

Definition at line 243 of file authutils.c.

245 {
246  int gcrypt_algorithm = GCRY_MD_MD5; // FIX whatever configure used
247  int ret;
248  gchar *actual, *expect, *seed_pass;
249  guchar *hash;
250  gchar *hash_hex, **seed_hex, **split;
251 
252  (void) username;
253  if (hash_arg == NULL)
254  return 1;
255  actual = g_strdup (hash_arg);
256 
257  split = g_strsplit_set (g_strchomp (actual), " ", 2);
258  seed_hex = split + 1;
259  if (*split == NULL || *seed_hex == NULL)
260  {
261  g_warning ("Failed to split auth contents.");
262  g_strfreev (split);
263  g_free (actual);
264  return -1;
265  }
266 
267  seed_pass = g_strconcat (*seed_hex, password, NULL);
268  hash = g_malloc0 (gcry_md_get_algo_dlen (gcrypt_algorithm));
269  gcry_md_hash_buffer (GCRY_MD_MD5, hash, seed_pass, strlen (seed_pass));
270  hash_hex = digest_hex (GCRY_MD_MD5, hash);
271 
272  expect = g_strjoin (" ", hash_hex, *seed_hex, NULL);
273 
274  g_strfreev (split);
275  g_free (seed_pass);
276  g_free (hash);
277  g_free (hash_hex);
278 
279  ret = strcmp (expect, actual) ? 1 : 0;
280  g_free (expect);
281  g_free (actual);
282  return ret;
283 }

References digest_hex().

Here is the call graph for this function:
AUTHENTICATION_METHOD_FILE
@ AUTHENTICATION_METHOD_FILE
Definition: authutils.h:37
AUTHENTICATION_METHOD_LDAP_CONNECT
@ AUTHENTICATION_METHOD_LDAP_CONNECT
Definition: authutils.h:38
AUTHENTICATION_METHOD_LAST
@ AUTHENTICATION_METHOD_LAST
Definition: authutils.h:40
authentication_methods
static const gchar * authentication_methods[]
Array of string representations of the supported authentication methods.
Definition: authutils.c:41
initialized
static gboolean initialized
Flag whether the config file was read.
Definition: authutils.c:47
AUTHENTICATION_METHOD_RADIUS_CONNECT
@ AUTHENTICATION_METHOD_RADIUS_CONNECT
Definition: authutils.h:39
digest_hex
gchar * digest_hex(int gcrypt_algorithm, const guchar *digest)
Generate a hexadecimal representation of a message digest.
Definition: authutils.c:168