mirror of
https://github.com/SoftEtherVPN/SoftEtherVPN.git
synced 2025-12-08 03:01:31 +03:00
v4.03-9408-rtm
This commit is contained in:
dnobori
415
src/Cedar/Sam.c
Normal file
415
src/Cedar/Sam.c
Normal file
@ -0,0 +1,415 @@
|
||||
// SoftEther VPN Source Code
|
||||
// Cedar Communication Module
|
||||
//
|
||||
// SoftEther VPN Server, Client and Bridge are free software under GPLv2.
|
||||
//
|
||||
// Copyright (c) 2012-2014 Daiyuu Nobori.
|
||||
// Copyright (c) 2012-2014 SoftEther VPN Project, University of Tsukuba, Japan.
|
||||
// Copyright (c) 2012-2014 SoftEther Corporation.
|
||||
//
|
||||
// All Rights Reserved.
|
||||
//
|
||||
// http://www.softether.org/
|
||||
//
|
||||
// Author: Daiyuu Nobori
|
||||
// Comments: Tetsuo Sugiyama, Ph.D.
|
||||
//
|
||||
//
|
||||
// This program is free software; you can redistribute it and/or
|
||||
// modify it under the terms of the GNU General Public License
|
||||
// version 2 as published by the Free Software Foundation.
|
||||
//
|
||||
// This program is distributed in the hope that it will be useful,
|
||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
// GNU General Public License for more details.
|
||||
//
|
||||
// You should have received a copy of the GNU General Public License version 2
|
||||
// along with this program; if not, write to the Free Software
|
||||
// Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
|
||||
//
|
||||
// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
|
||||
// EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
||||
// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
|
||||
// IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
|
||||
// CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
|
||||
// TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
|
||||
// SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
||||
//
|
||||
// THE LICENSE AGREEMENT IS ATTACHED ON THE SOURCE-CODE PACKAGE
|
||||
// AS "LICENSE.TXT" FILE. READ THE TEXT FILE IN ADVANCE TO USE THE SOFTWARE.
|
||||
//
|
||||
//
|
||||
// THIS SOFTWARE IS DEVELOPED IN JAPAN, AND DISTRIBUTED FROM JAPAN,
|
||||
// UNDER JAPANESE LAWS. YOU MUST AGREE IN ADVANCE TO USE, COPY, MODIFY,
|
||||
// MERGE, PUBLISH, DISTRIBUTE, SUBLICENSE, AND/OR SELL COPIES OF THIS
|
||||
// SOFTWARE, THAT ANY JURIDICAL DISPUTES WHICH ARE CONCERNED TO THIS
|
||||
// SOFTWARE OR ITS CONTENTS, AGAINST US (SOFTETHER PROJECT, SOFTETHER
|
||||
// CORPORATION, DAIYUU NOBORI OR OTHER SUPPLIERS), OR ANY JURIDICAL
|
||||
// DISPUTES AGAINST US WHICH ARE CAUSED BY ANY KIND OF USING, COPYING,
|
||||
// MODIFYING, MERGING, PUBLISHING, DISTRIBUTING, SUBLICENSING, AND/OR
|
||||
// SELLING COPIES OF THIS SOFTWARE SHALL BE REGARDED AS BE CONSTRUED AND
|
||||
// CONTROLLED BY JAPANESE LAWS, AND YOU MUST FURTHER CONSENT TO
|
||||
// EXCLUSIVE JURISDICTION AND VENUE IN THE COURTS SITTING IN TOKYO,
|
||||
// JAPAN. YOU MUST WAIVE ALL DEFENSES OF LACK OF PERSONAL JURISDICTION
|
||||
// AND FORUM NON CONVENIENS. PROCESS MAY BE SERVED ON EITHER PARTY IN
|
||||
// THE MANNER AUTHORIZED BY APPLICABLE LAW OR COURT RULE.
|
||||
//
|
||||
// USE ONLY IN JAPAN. DO NOT USE IT IN OTHER COUNTRIES. IMPORTING THIS
|
||||
// SOFTWARE INTO OTHER COUNTRIES IS AT YOUR OWN RISK. SOME COUNTRIES
|
||||
// PROHIBIT ENCRYPTED COMMUNICATIONS. USING THIS SOFTWARE IN OTHER
|
||||
// COUNTRIES MIGHT BE RESTRICTED.
|
||||
//
|
||||
//
|
||||
// DEAR SECURITY EXPERTS
|
||||
// ---------------------
|
||||
//
|
||||
// If you find a bug or a security vulnerability please kindly inform us
|
||||
// about the problem immediately so that we can fix the security problem
|
||||
// to protect a lot of users around the world as soon as possible.
|
||||
//
|
||||
// Our e-mail address for security reports is:
|
||||
// softether-vpn-security [at] softether.org
|
||||
//
|
||||
// Please note that the above e-mail address is not a technical support
|
||||
// inquiry address. If you need technical assistance, please visit
|
||||
// http://www.softether.org/ and ask your question on the users forum.
|
||||
//
|
||||
// Thank you for your cooperation.
|
||||
|
||||
|
||||
// Sam.c
|
||||
// Security Accounts Manager
|
||||
|
||||
#include "CedarPch.h"
|
||||
|
||||
// Password encryption
|
||||
void SecurePassword(void *secure_password, void *password, void *random)
|
||||
{
|
||||
BUF *b;
|
||||
// Validate arguments
|
||||
if (secure_password == NULL || password == NULL || random == NULL)
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
b = NewBuf();
|
||||
WriteBuf(b, password, SHA1_SIZE);
|
||||
WriteBuf(b, random, SHA1_SIZE);
|
||||
Hash(secure_password, b->Buf, b->Size, true);
|
||||
|
||||
FreeBuf(b);
|
||||
}
|
||||
|
||||
// Generate 160bit random number
|
||||
void GenRamdom(void *random)
|
||||
{
|
||||
// Validate arguments
|
||||
if (random == NULL)
|
||||
{
|
||||
return;
|
||||
}
|
||||
|
||||
Rand(random, SHA1_SIZE);
|
||||
}
|
||||
|
||||
// Anonymous authentication of user
|
||||
bool SamAuthUserByAnonymous(HUB *h, char *username)
|
||||
{
|
||||
bool b = false;
|
||||
// Validate arguments
|
||||
if (h == NULL || username == NULL)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
AcLock(h);
|
||||
{
|
||||
USER *u = AcGetUser(h, username);
|
||||
if (u)
|
||||
{
|
||||
Lock(u->lock);
|
||||
{
|
||||
if (u->AuthType == AUTHTYPE_ANONYMOUS)
|
||||
{
|
||||
b = true;
|
||||
}
|
||||
}
|
||||
Unlock(u->lock);
|
||||
}
|
||||
ReleaseUser(u);
|
||||
}
|
||||
AcUnlock(h);
|
||||
|
||||
return b;
|
||||
}
|
||||
|
||||
// Plaintext password authentication of user
|
||||
bool SamAuthUserByPlainPassword(CONNECTION *c, HUB *hub, char *username, char *password, bool ast, UCHAR *mschap_v2_server_response_20)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
// Certificate authentication of user
|
||||
bool SamAuthUserByCert(HUB *h, char *username, X *x)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
// Get the root certificate that signed the specified certificate from the list
|
||||
X *GetIssuerFromList(LIST *cert_list, X *cert)
|
||||
{
|
||||
UINT i;
|
||||
X *ret = NULL;
|
||||
// Validate arguments
|
||||
if (cert_list == NULL || cert == NULL)
|
||||
{
|
||||
return NULL;
|
||||
}
|
||||
|
||||
for (i = 0;i < LIST_NUM(cert_list);i++)
|
||||
{
|
||||
X *x = LIST_DATA(cert_list, i);
|
||||
// Name comparison
|
||||
if (CheckXDateNow(x))
|
||||
{
|
||||
if (CompareName(x->subject_name, cert->issuer_name))
|
||||
{
|
||||
// Get the public key of the root certificate
|
||||
K *k = GetKFromX(x);
|
||||
|
||||
if (k != NULL)
|
||||
{
|
||||
// Check the signature
|
||||
if (CheckSignature(cert, k))
|
||||
{
|
||||
ret = x;
|
||||
}
|
||||
FreeK(k);
|
||||
}
|
||||
}
|
||||
}
|
||||
if (CompareX(x, cert))
|
||||
{
|
||||
// Complete identical
|
||||
ret = x;
|
||||
}
|
||||
}
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
// Get the policy to be applied for the user
|
||||
POLICY *SamGetUserPolicy(HUB *h, char *username)
|
||||
{
|
||||
POLICY *ret = NULL;
|
||||
// Validate arguments
|
||||
if (h == NULL || username == NULL)
|
||||
{
|
||||
return NULL;
|
||||
}
|
||||
|
||||
AcLock(h);
|
||||
{
|
||||
USER *u;
|
||||
u = AcGetUser(h, username);
|
||||
if (u)
|
||||
{
|
||||
USERGROUP *g = NULL;
|
||||
Lock(u->lock);
|
||||
{
|
||||
if (u->Policy != NULL)
|
||||
{
|
||||
ret = ClonePolicy(u->Policy);
|
||||
}
|
||||
|
||||
g = u->Group;
|
||||
|
||||
if (g != NULL)
|
||||
{
|
||||
AddRef(g->ref);
|
||||
}
|
||||
}
|
||||
Unlock(u->lock);
|
||||
|
||||
ReleaseUser(u);
|
||||
u = NULL;
|
||||
|
||||
if (ret == NULL)
|
||||
{
|
||||
if (g != NULL)
|
||||
{
|
||||
Lock(g->lock);
|
||||
{
|
||||
ret = ClonePolicy(g->Policy);
|
||||
}
|
||||
Unlock(g->lock);
|
||||
}
|
||||
}
|
||||
|
||||
if (g != NULL)
|
||||
{
|
||||
ReleaseGroup(g);
|
||||
}
|
||||
}
|
||||
}
|
||||
AcUnlock(h);
|
||||
|
||||
return ret;
|
||||
}
|
||||
|
||||
// Password authentication of user
|
||||
bool SamAuthUserByPassword(HUB *h, char *username, void *random, void *secure_password, char *mschap_v2_password, UCHAR *mschap_v2_server_response_20, UINT *err)
|
||||
{
|
||||
bool b = false;
|
||||
UCHAR secure_password_check[SHA1_SIZE];
|
||||
bool is_mschap = false;
|
||||
IPC_MSCHAP_V2_AUTHINFO mschap;
|
||||
UINT dummy = 0;
|
||||
// Validate arguments
|
||||
if (h == NULL || username == NULL || secure_password == NULL)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
if (err == NULL)
|
||||
{
|
||||
err = &dummy;
|
||||
}
|
||||
|
||||
*err = 0;
|
||||
|
||||
Zero(&mschap, sizeof(mschap));
|
||||
|
||||
is_mschap = ParseAndExtractMsChapV2InfoFromPassword(&mschap, mschap_v2_password);
|
||||
|
||||
if (StrCmpi(username, ADMINISTRATOR_USERNAME) == 0)
|
||||
{
|
||||
// Administrator mode
|
||||
SecurePassword(secure_password_check, h->SecurePassword, random);
|
||||
if (Cmp(secure_password_check, secure_password, SHA1_SIZE) == 0)
|
||||
{
|
||||
return true;
|
||||
}
|
||||
else
|
||||
{
|
||||
return false;
|
||||
}
|
||||
}
|
||||
|
||||
AcLock(h);
|
||||
{
|
||||
USER *u;
|
||||
u = AcGetUser(h, username);
|
||||
if (u)
|
||||
{
|
||||
Lock(u->lock);
|
||||
{
|
||||
if (u->AuthType == AUTHTYPE_PASSWORD)
|
||||
{
|
||||
AUTHPASSWORD *auth = (AUTHPASSWORD *)u->AuthData;
|
||||
|
||||
if (is_mschap == false)
|
||||
{
|
||||
// Normal password authentication
|
||||
SecurePassword(secure_password_check, auth->HashedKey, random);
|
||||
if (Cmp(secure_password_check, secure_password, SHA1_SIZE) == 0)
|
||||
{
|
||||
b = true;
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
// MS-CHAP v2 authentication via PPP
|
||||
UCHAR challenge8[8];
|
||||
UCHAR client_response[24];
|
||||
|
||||
if (IsZero(auth->NtLmSecureHash, MD5_SIZE))
|
||||
{
|
||||
// NTLM hash is not registered in the user account
|
||||
*err = ERR_MSCHAP2_PASSWORD_NEED_RESET;
|
||||
}
|
||||
else
|
||||
{
|
||||
UCHAR nt_pw_hash_hash[16];
|
||||
Zero(challenge8, sizeof(challenge8));
|
||||
Zero(client_response, sizeof(client_response));
|
||||
|
||||
MsChapV2_GenerateChallenge8(challenge8, mschap.MsChapV2_ClientChallenge, mschap.MsChapV2_ServerChallenge,
|
||||
mschap.MsChapV2_PPPUsername);
|
||||
|
||||
MsChapV2Client_GenerateResponse(client_response, challenge8, auth->NtLmSecureHash);
|
||||
|
||||
if (Cmp(client_response, mschap.MsChapV2_ClientResponse, 24) == 0)
|
||||
{
|
||||
// Hash matched
|
||||
b = true;
|
||||
|
||||
// Calculate the response
|
||||
GenerateNtPasswordHashHash(nt_pw_hash_hash, auth->NtLmSecureHash);
|
||||
MsChapV2Server_GenerateResponse(mschap_v2_server_response_20, nt_pw_hash_hash,
|
||||
client_response, challenge8);
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
Unlock(u->lock);
|
||||
ReleaseUser(u);
|
||||
}
|
||||
}
|
||||
AcUnlock(h);
|
||||
|
||||
return b;
|
||||
}
|
||||
|
||||
// Make sure that the user exists
|
||||
bool SamIsUser(HUB *h, char *username)
|
||||
{
|
||||
bool b;
|
||||
// Validate arguments
|
||||
if (h == NULL || username == NULL)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
AcLock(h);
|
||||
{
|
||||
b = AcIsUser(h, username);
|
||||
}
|
||||
AcUnlock(h);
|
||||
|
||||
return b;
|
||||
}
|
||||
|
||||
// Get the type of authentication used by the user
|
||||
UINT SamGetUserAuthType(HUB *h, char *username)
|
||||
{
|
||||
UINT authtype;
|
||||
// Validate arguments
|
||||
if (h == NULL || username == NULL)
|
||||
{
|
||||
return INFINITE;
|
||||
}
|
||||
|
||||
AcLock(h);
|
||||
{
|
||||
USER *u = AcGetUser(h, username);
|
||||
if (u == NULL)
|
||||
{
|
||||
authtype = INFINITE;
|
||||
}
|
||||
else
|
||||
{
|
||||
authtype = u->AuthType;
|
||||
ReleaseUser(u);
|
||||
}
|
||||
}
|
||||
AcUnlock(h);
|
||||
|
||||
return authtype;
|
||||
}
|
||||
|
||||
|
||||
// Developed by SoftEther VPN Project at University of Tsukuba in Japan.
|
||||
// Department of Computer Science has dozens of overly-enthusiastic geeks.
|
||||
// Join us: http://www.tsukuba.ac.jp/english/admission/
|
||||
Reference in New Issue
Block a user