github/xrdp
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update sesman authentication processing

Browse Source 
Update sesman to cope with separate authentication/authorization (AA) and
command processing.

Also, internally users are now tracked by UID rather thn username.
This addresses a problem found by some users using federated naming
services (e.g. Active Directory) where the same user can be referred to
in more than one way. See https://github.com/neutrinolabs/xrdp/issues/1823

The separation of AA in this way allows for multiple attempts to be made
on one connection to get a password right. This addresses MaxLoginRetry
not working (https://github.com/neutrinolabs/xrdp/issues/1739)
This commit is contained in:
matt335672
2022-12-14 09:36:07 +00:00
parent c5b6479985
commit fd99653957
8 changed files with 626 additions and 222 deletions
Download Patch File Download Diff File Expand all files Collapse all files
sesman/scp_process.c
+412 -119
View File
@@ -35,7 +35,10 @@
#include "scp_process.h"
#include "access.h"
#include "auth.h"
#include "os_calls.h"
#include "session.h"
#include "sesman.h"
#include "string_calls.h"
/**************************************************************************//**
* Logs an authentication failure message
@@ -58,142 +61,408 @@ log_authfail_message(const char *username, const char *ip_addr)
/******************************************************************************/
static int
process_gateway_request(struct trans *trans)
/**
* Mode parameter for authenticate_and_authorize_connection()
*/
enum login_mode
{
int rv;
const char *username;
const char *password;
const char *ip_addr;
AM_SYSTEM,
AM_UDS
};
rv = scp_get_gateway_request(trans, &username, &password, &ip_addr);
if (rv == 0)
/**
* Authenticate and authorize the connection
*
* @param sc Connection to sesman
* @param login_mode Describes the type of login in use
* @param uid UID for user
* @param username Name for user
* @param password Password (AM_SYSTEM) or NULL.
* @param ip_addr Remote IP address (AM_SYSTEM) or NULL.
* @return Status for the operation
*
* @pre sc->auth_info, sc->username and sc->ip_addr must be NULL
*
* @post If E_SCP_LOGIN_OK is returned, sc->auth_info is non-NULL
* @post If E_SCP_LOGIN_OK is returned, sc->username is non-NULL
* @post If E_SCP_LOGIN_OK is returned, sc->ip_addr is non-NULL
*
*/
static enum scp_login_status
authenticate_and_authorize_connection(struct sesman_con *sc,
enum login_mode login_mode,
int uid,
const char *username,
const char *password,
const char *ip_addr)
{
enum scp_login_status status = E_SCP_LOGIN_GENERAL_ERROR;
struct auth_info *auth_info = NULL;
/* Check preconditions */
if (sc->auth_info != NULL || sc->username != NULL || sc->ip_addr != NULL)
{
int errorcode = 0;
struct auth_info *auth_info;
LOG(LOG_LEVEL_ERROR,
"Internal error - connection already logged in");
}
else
{
switch (login_mode)
{
case AM_SYSTEM:
auth_info = auth_userpass(username, password, ip_addr, &status);
break;
case AM_UDS:
auth_info = auth_uds(username, &status);
break;
default:
LOG(LOG_LEVEL_ERROR, "%s called with invalid mode %d",
__func__, (int)login_mode);
}
LOG(LOG_LEVEL_INFO, "Received authentication request for user: %s",
username);
auth_info = auth_userpass(username, password, ip_addr, &errorcode);
if (auth_info != NULL)
{
if (1 == access_login_allowed(username))
if (status != E_SCP_LOGIN_OK)
{
/* the user is member of the correct groups. */
LOG(LOG_LEVEL_INFO, "Access permitted for user: %s",
username);
/* This shouldn't happen */
LOG(LOG_LEVEL_ERROR,
"Unexpected status return %d from auth call",
(int)status);
}
else
else if (!access_login_allowed(username))
{
/* all first 32 are reserved for PAM errors */
errorcode = 32 + 3;
status = E_SCP_LOGIN_NOT_AUTHORIZED;
LOG(LOG_LEVEL_INFO, "Username okay but group problem for "
"user: %s", username);
}
/* If all is well, put the auth_info in the sesman connection
* for later use. If not, remove the auth_info */
if (status == E_SCP_LOGIN_OK)
{
char *dup_username = g_strdup(username);
char *dup_ip_addr =
(ip_addr == NULL) ? g_strdup("") : g_strdup(ip_addr);
if (dup_username == NULL || dup_ip_addr == NULL)
{
LOG(LOG_LEVEL_ERROR, "%s : Memory allocation failed",
__func__);
g_free(dup_username);
g_free(dup_ip_addr);
status = E_SCP_LOGIN_NO_MEMORY;
}
else
{
LOG(LOG_LEVEL_INFO, "Access permitted for user: %s",
username);
sc->auth_info = auth_info;
sc->uid = uid;
sc->username = dup_username;
sc->ip_addr = dup_ip_addr;
}
}
if (status != E_SCP_LOGIN_OK)
{
auth_end(auth_info);
}
}
else
{
log_authfail_message(username, ip_addr);
}
rv = scp_send_gateway_response(trans, errorcode);
auth_end(auth_info);
}
return status;
}
/******************************************************************************/
static int
process_set_peername_request(struct sesman_con *sc)
{
int rv;
const char *peername;
rv = scp_get_set_peername_request(sc->t, &peername);
if (rv == 0)
{
if (sesman_set_connection_peername(sc, peername) != 0)
{
LOG(LOG_LEVEL_WARNING,
"Failed to set connection peername from %s to %s",
sc->peername, peername);
}
}
return rv;
}
/******************************************************************************/
static int
process_create_session_request(struct trans *trans)
process_sys_login_request(struct sesman_con *sc)
{
int rv;
const char *supplied_username;
const char *password;
const char *ip_addr;
rv = scp_get_sys_login_request(sc->t, &supplied_username,
&password, &ip_addr);
if (rv == 0)
{
enum scp_login_status errorcode;
int server_closed = 1;
int uid;
char *username = NULL;
LOG(LOG_LEVEL_INFO,
"Received system login request from %s for user: %s IP: %s",
sc->peername, supplied_username, ip_addr);
if (sc->auth_info != NULL)
{
errorcode = E_SCP_LOGIN_ALREADY_LOGGED_IN;
LOG(LOG_LEVEL_ERROR, "Connection is already logged in for %s",
sc->username);
}
else if (g_getuser_info_by_name(supplied_username,
&uid, NULL, NULL, NULL, NULL) != 0)
{
/* we can't get a UID for the user */
errorcode = E_SCP_LOGIN_NOT_AUTHENTICATED;
LOG(LOG_LEVEL_ERROR, "Can't get UID for user %s",
supplied_username);
log_authfail_message(username, ip_addr);
}
else if (g_getuser_info_by_uid(uid,
&username, NULL, NULL, NULL, NULL) != 0)
{
errorcode = E_SCP_LOGIN_GENERAL_ERROR;
LOG(LOG_LEVEL_ERROR, "Can't reverse lookup UID %d", uid);
}
else
{
if (g_strcmp(supplied_username, username) != 0)
{
/*
* If using a federated naming service (e.g. AD), the
* username supplied may not match that name mapped to by
* the UID. We will generate a warning in this instance so
* the user can see what is being used within sesman
*/
LOG(LOG_LEVEL_WARNING,
"Using username %s for the session (from UID %d)",
username, uid);
}
errorcode = authenticate_and_authorize_connection(
sc, AM_SYSTEM,
uid, username,
password, ip_addr);
if (errorcode == E_SCP_LOGIN_OK)
{
server_closed = 0;
}
else if (errorcode == E_SCP_LOGIN_NOT_AUTHENTICATED)
{
log_authfail_message(username, ip_addr);
if (sc->auth_retry_count > 0)
{
/* Password problem? Invite the user to retry */
server_closed = 0;
--sc->auth_retry_count;
}
}
g_free(username);
}
if (server_closed)
{
/* Expecting no more client messages. Close the connection
* after returning from this callback */
sc->close_requested = 1;
}
rv = scp_send_login_response(sc->t, errorcode, server_closed);
}
return rv;
}
/******************************************************************************/
static int
process_uds_login_request(struct sesman_con *sc)
{
enum scp_login_status errorcode;
int rv;
int uid;
int pid;
char *username = NULL;
int server_closed = 1;
rv = g_sck_get_peer_cred(sc->t->sck, &pid, &uid, NULL);
if (rv != 0)
{
LOG(LOG_LEVEL_INFO,
"Unable to get peer credentials for socket %d",
(int)sc->t->sck);
errorcode = E_SCP_LOGIN_GENERAL_ERROR;
}
else
{
LOG(LOG_LEVEL_INFO,
"Received UDS login request from %s for UID: %d from PID: %d",
sc->peername, uid, pid);
if (sc->auth_info != NULL)
{
errorcode = E_SCP_LOGIN_ALREADY_LOGGED_IN;
LOG(LOG_LEVEL_ERROR, "Connection is already logged in for %s",
sc->username);
}
else if (g_getuser_info_by_uid(uid, &username,
NULL, NULL, NULL, NULL) != 0)
{
errorcode = E_SCP_LOGIN_GENERAL_ERROR;
LOG(LOG_LEVEL_ERROR, "Can't reverse lookup UID %d", uid);
}
else
{
errorcode = authenticate_and_authorize_connection(
sc, AM_UDS,
uid, username,
NULL, NULL);
g_free(username);
if (errorcode == E_SCP_LOGIN_OK)
{
server_closed = 0;
}
}
}
if (server_closed)
{
/* Close the connection after returning from this callback */
sc->close_requested = 1;
}
return scp_send_login_response(sc->t, errorcode, server_closed);
}
/******************************************************************************/
static int
process_logout_request(struct sesman_con *sc)
{
if (sc->auth_info != NULL)
{
LOG(LOG_LEVEL_INFO, "Logging out %s from sesman", sc->username);
auth_end(sc->auth_info);
sc->auth_info = NULL;
sc->uid = -1;
g_free(sc->username);
sc->username = NULL;
g_free(sc->ip_addr);
sc->ip_addr = NULL;
}
return 0;
}
/******************************************************************************/
static int
process_create_session_request(struct sesman_con *sc)
{
int rv;
struct session_parameters sp;
const char *password;
struct guid guid;
int display = 0;
enum scp_screate_status status = E_SCP_SCREATE_OK;
guid_clear(&guid);
int display = 0;
rv = scp_get_create_session_request(
trans,
&sp.username, &password,
&sp.type, &sp.width, &sp.height, &sp.bpp,
&sp.shell, &sp.directory, &sp.ip_addr);
rv = scp_get_create_session_request(sc->t,
&sp.type, &sp.width, &sp.height,
&sp.bpp, &sp.shell, &sp.directory);
if (rv == 0)
{
struct auth_info *auth_info;
struct session_item *s_item;
int errorcode = 0;
bool_t do_auth_end = 1;
LOG(LOG_LEVEL_INFO,
"Received request to create %s session for user: %s",
SCP_SESSION_TYPE_TO_STR(sp.type),
sp.username);
auth_info = auth_userpass(sp.username, password, sp.ip_addr, &errorcode);
if (auth_info != NULL)
if (sc->auth_info == NULL)
{
s_item = session_get_bydata(&sp);
status = E_SCP_SCREATE_NOT_LOGGED_IN;
}
else
{
LOG(LOG_LEVEL_INFO,
"Received request from %s to create a session for user %s",
sc->peername, sc->username);
// Copy over the items we got from the login request,
// but which we need to describe the session
sp.uid = sc->uid;
sp.ip_addr = sc->ip_addr; // Guaranteed to be non-NULL
struct session_item *s_item = session_get_bydata(&sp);
if (s_item != 0)
{
// Found an existing session
display = s_item->display;
guid = s_item->guid;
if (sp.ip_addr[0] != '\0')
{
LOG( LOG_LEVEL_INFO, "++ reconnected session: username %s, "
"display :%d.0, session_pid %d, ip %s",
sp.username, display, s_item->pid, sp.ip_addr);
sc->username, display, s_item->pid, sp.ip_addr);
}
else
{
LOG(LOG_LEVEL_INFO, "++ reconnected session: username %s, "
"display :%d.0, session_pid %d", sp.username, display,
s_item->pid);
"display :%d.0, session_pid %d",
sc->username, display, s_item->pid);
}
session_reconnect(display, sp.username, auth_info);
session_reconnect(display, sc->uid, sc->auth_info);
}
else
{
LOG_DEVEL(LOG_LEVEL_DEBUG, "pre auth");
if (1 == access_login_allowed(sp.username))
// Need to create a new session
if (sp.ip_addr[0] != '\0')
{
if (sp.ip_addr[0] != '\0')
{
LOG(LOG_LEVEL_INFO,
"++ created session (access granted): "
"username %s, ip %s", sp.username, sp.ip_addr);
}
else
{
LOG(LOG_LEVEL_INFO,
"++ created session (access granted): "
"username %s", sp.username);
}
LOG(LOG_LEVEL_INFO,
"++ created session: username %s, ip %s",
sc->username, sp.ip_addr);
}
else
{
LOG(LOG_LEVEL_INFO,
"++ created session: username %s", sc->username);
}
display = session_start(auth_info, &sp, &guid);
/* if the session started up ok, auth_end will be called on
sig child */
do_auth_end = display == 0;
// The new session will have a lifetime longer than
// the sesman connection, and so needs to own
// the auth_info struct.
//
// Copy the auth_info struct out of the connection and pass
// it to the session
struct auth_info *auth_info = sc->auth_info;
sc->auth_info = NULL;
status = session_start(auth_info, &sp, &display, &guid);
if (status != E_SCP_SCREATE_OK)
{
// Close the auth session down as it can't be re-used.
auth_end(auth_info);
}
}
}
else
{
log_authfail_message(sp.username, sp.ip_addr);
}
if (do_auth_end)
{
auth_end(auth_info);
}
/* Currently a create session request is the last thing on a
* connection, and results in automatic closure */
sc->close_requested = 1;
rv = scp_send_create_session_response(trans, errorcode, display, &guid);
rv = scp_send_create_session_response(sc->t, status, display, &guid);
}
return rv;
@@ -202,75 +471,99 @@ process_create_session_request(struct trans *trans)
/******************************************************************************/
static int
process_list_sessions_request(struct trans *trans)
process_list_sessions_request(struct sesman_con *sc)
{
int rv;
int rv = 0;
const char *username;
const char *password;
struct scp_session_info *info = NULL;
unsigned int cnt = 0;
unsigned int i;
rv = scp_get_list_sessions_request(trans, &username, &password);
if (rv == 0)
if (sc->auth_info == NULL)
{
rv = scp_send_list_sessions_response(sc->t,
E_SCP_LS_NOT_LOGGED_IN,
NULL);
}
else
{
enum scp_list_sessions_status status;
int errorcode = 0;
struct auth_info *auth_info;
LOG(LOG_LEVEL_INFO,
"Received request to list sessions for user %s", username);
"Received request from %s to list sessions for user %s",
sc->peername, sc->username);
auth_info = auth_userpass(username, password, NULL, &errorcode);
if (auth_info != NULL)
{
struct scp_session_info *info = NULL;
unsigned int cnt = 0;
unsigned int i;
info = session_get_byuser(username, &cnt,
SESMAN_SESSION_STATUS_ALL);
info = session_get_byuid(sc->uid, &cnt,
SESMAN_SESSION_STATUS_ALL);
for (i = 0; rv == 0 && i < cnt; ++i)
{
rv = scp_send_list_sessions_response(trans,
E_SCP_LS_SESSION_INFO,
&info[i]);
}
free_session_info_list(info, cnt);
status = E_SCP_LS_END_OF_LIST;
}
else
for (i = 0; rv == 0 && i < cnt; ++i)
{
status = E_SCP_LS_AUTHENTICATION_FAIL;
rv = scp_send_list_sessions_response(sc->t,
E_SCP_LS_SESSION_INFO,
&info[i]);
}
auth_end(auth_info);
free_session_info_list(info, cnt);
if (rv == 0)
{
rv = scp_send_list_sessions_response(trans, status, NULL);
rv = scp_send_list_sessions_response(sc->t,
E_SCP_LS_END_OF_LIST,
NULL);
}
}
return rv;
}
/******************************************************************************/
static int
process_close_connection_request(struct sesman_con *sc)
{
int rv = 0;
LOG(LOG_LEVEL_INFO, "Received request to close connection from %s",
sc->peername);
/* Expecting no more client messages. Close the connection
* after returning from this callback */
sc->close_requested = 1;
return rv;
}
/******************************************************************************/
int
scp_process(struct trans *t)
scp_process(struct sesman_con *sc)
{
enum scp_msg_code msgno;
int rv = 0;
switch ((msgno = scp_msg_in_start(t)))
switch ((msgno = scp_msg_in_start(sc->t)))
{
case E_SCP_GATEWAY_REQUEST:
rv = process_gateway_request(t);
case E_SCP_SET_PEERNAME_REQUEST:
rv = process_set_peername_request(sc);
break;
case E_SCP_SYS_LOGIN_REQUEST:
rv = process_sys_login_request(sc);
break;
case E_SCP_UDS_LOGIN_REQUEST:
rv = process_uds_login_request(sc);
break;
case E_SCP_LOGOUT_REQUEST:
rv = process_logout_request(sc);
break;
case E_SCP_CREATE_SESSION_REQUEST:
rv = process_create_session_request(t);
rv = process_create_session_request(sc);
break;
case E_SCP_LIST_SESSIONS_REQUEST:
rv = process_list_sessions_request(t);
rv = process_list_sessions_request(sc);
break;
case E_SCP_CLOSE_CONNECTION_REQUEST:
rv = process_close_connection_request(sc);
break;
default: