Changeset 643 in openpam

Timestamp:

Mar 5, 2013, 3:24:00 PM (8 years ago)

Author:

Dag-Erling Smørgrav

Message:

• Add a provisional API for computing the current HOTP or TOTP code.
• Add a provisional API for matching a user response.
• Add a provisional API for generating a dummy key. When one of the matching functions recognizes a dummy key, it will go through the motions but never report a match.

Location:

trunk/modules/pam_oath

Files:

• oath.h (modified) (1 diff)
• oath_hotp.c (modified) (2 diffs)
• oath_key.c (modified) (7 diffs)
• oath_totp.c (modified) (2 diffs)

trunk/modules/pam_oath/oath.h

@@ -102 +102 @@
 char *oath_key_to_uri(const struct oath_key *);
 
+#define DUMMY_LABEL     ("oath-dummy-key")
+#define DUMMY_LABELLEN  (sizeof DUMMY_LABEL)
+#define DUMMY_KEYLEN    80
+
+struct oath_key *oath_dummy_key(enum oath_mode, enum oath_hash, unsigned int);
+
 unsigned int oath_hotp(const uint8_t *, size_t, uint64_t, unsigned int);
+int oath_hotp_current(struct oath_key *);
+int oath_hotp_match(struct oath_key *, unsigned int, int);
+
 unsigned int oath_totp(const uint8_t *, size_t, unsigned int);
+int oath_totp_match(const struct oath_key *, unsigned int, int);
+unsigned int oath_totp_current(const struct oath_key *);
 
 #endif

trunk/modules/pam_oath/oath_hotp.c

@@ -38 +38 @@
 
 #include <stdint.h>
+#include <string.h>
 
 #include "oath.h"
@@ -88 +89 @@
         return (D);
 }
+
+/*
+ * Computes the current code for the given key and advances the counter.
+ */
+int
+oath_hotp_current(struct oath_key *k)
+{
+        unsigned int code;
+
+        if (k == NULL)
+                return (-1);
+        if (k->mode != om_hotp)
+                return (-1);
+        if (k->counter == UINT64_MAX)
+                return (-1);
+        code = oath_hotp(k->key, k->keylen, k->counter, k->digits);
+        k->counter += 1;
+        return (code);
+}
+
+/*
+ * Compares the code provided by the user with expected values within a
+ * given window.  Returns 1 if there was a match, 0 if not, and -1 if an
+ * error occurred.
+ */
+int
+oath_hotp_match(struct oath_key *k, unsigned int response, int window)
+{
+        unsigned int code;
+        int dummy;
+
+        if (k == NULL)
+                return (-1);
+        if (window < 1)
+                return (-1);
+        if (k->mode != om_hotp)
+                return (-1);
+        if (k->counter >= UINT64_MAX - window)
+                return (-1);
+        dummy = (memcmp(k->label, DUMMY_LABEL, DUMMY_LABELLEN) == 0);
+        for (int i = 0; i < window; ++i) {
+                code = oath_hotp(k->key, k->keylen, k->counter + i, k->digits);
+                if (code == response && !dummy) {
+                        k->counter = k->counter + i;
+                        return (1);
+                }
+        }
+        return (0);
+}

trunk/modules/pam_oath/oath_key.c

@@ -113 +113 @@
                 goto invalid;
         if (strlcmp("hotp", p, q - p) == 0) {
-                openpam_log(PAM_LOG_DEBUG, "OATH mode: HOTP");
                 key->mode = om_hotp;
         } else if (strlcmp("totp", p, q - p) == 0) {
-                openpam_log(PAM_LOG_DEBUG, "OATH mode: TOTP");
                 key->mode = om_totp;
         } else {
@@ -133 +131 @@
 
         /* extract parameters */
-        key->counter = UINTMAX_MAX;
+        key->counter = UINT64_MAX;
         while (*p != '\0') {
                 if ((q = strchr(p, '=')) == NULL)
@@ -153 +151 @@
                                 goto invalid;
                         key->key = key->data + key->labellen;
+                        key->keylen = key->datalen - key->labellen;
                         if (base32_dec(q, r - q, key->key, &key->keylen) != 0)
                                 goto invalid;
@@ -180 +179 @@
                         key->digits = *q - '0';
                 } else if (strlcmp("counter=", p, q - p) == 0) {
-                        if (key->counter != UINTMAX_MAX)
+                        if (key->counter != UINT64_MAX)
                                 /* dupe */
                                 goto invalid;
                         n = strtoumax(q, &e, 10);
-                        if (e != r || n >= UINTMAX_MAX)
+                        if (e != r || n >= UINT64_MAX)
                                 goto invalid;
                         key->counter = (uint64_t)n;
@@ -227 +226 @@
         if (key->keylen == 0)
                 goto invalid;
+        return (key);
 
 invalid:
@@ -296 +296 @@
 
         /* compute length of base32-encoded key and append it */
-        kslen = base32_enclen(key->keylen);
-        if ((tmp = realloc(uri, urilen + kslen + 1)) == NULL) {
+        kslen = base32_enclen(key->keylen) + 1;
+        if ((tmp = realloc(uri, urilen + kslen)) == NULL) {
                 free(uri);
                 return (NULL);
@@ -309 +309 @@
         return (uri);
 }
+
+struct oath_key *
+oath_dummy_key(enum oath_mode mode, enum oath_hash hash, unsigned int digits)
+{
+        struct oath_key *key;
+
+        if ((key = oath_key_alloc(DUMMY_LABELLEN + DUMMY_KEYLEN)) == NULL)
+                return (NULL);
+        key->mode = mode;
+        key->digits = digits;
+        key->counter = 0;
+        key->timestep = 30;
+        key->hash = hash;
+        key->label = (char *)key->data;
+        memcpy(key->label, DUMMY_LABEL, DUMMY_LABELLEN);
+        key->key = key->data + DUMMY_LABELLEN;
+        key->keylen = DUMMY_KEYLEN;
+        return (key);
+}

trunk/modules/pam_oath/oath_totp.c

@@ -35 +35 @@
 
 #include <stdint.h>
+#include <string.h>
 #include <time.h>
 
@@ -49 +50 @@
         return (oath_hotp(K, Klen, now / TOTP_TIME_STEP, Digit));
 }
+
+unsigned int
+oath_totp_current(const struct oath_key *k)
+{
+        unsigned int code;
+        uint64_t seq;
+
+        if (k == NULL)
+                return (-1);
+        if (k->mode != om_totp)
+                return (-1);
+        if (k->timestep == 0)
+                return (-1);
+        seq = time(NULL) / k->timestep;
+        code = oath_hotp(k->key, k->keylen, seq, k->digits);
+        return (code);
+}
+
+int
+oath_totp_match(const struct oath_key *k, unsigned int response, int window)
+{
+        unsigned int code;
+        uint64_t seq;
+        int dummy;
+
+        if (k == NULL)
+                return (-1);
+        if (window < 1)
+                return (-1);
+        if (k->mode != om_totp)
+                return (-1);
+        if (k->timestep == 0)
+                return (-1);
+        seq = time(NULL) / k->timestep;
+        dummy = (memcmp(k->label, DUMMY_LABEL, DUMMY_LABELLEN) == 0);
+        for (int i = -window; i <= window; ++i) {
+                code = oath_hotp(k->key, k->keylen, seq + i, k->digits);
+                if (code == response && !dummy)
+                        return (1);
+        }
+        return (0);
+}