2 * Copyright (C) 2001, 2003, 2004, 2005, 2006, 2007, 2008, 2009, 2010
3 * Free Software Foundation, Inc.
5 * This file is part of GnuTLS.
7 * GnuTLS is free software: you can redistribute it and/or modify it
8 * under the terms of the GNU General Public License as published by
9 * the Free Software Foundation, either version 3 of the License, or
10 * (at your option) any later version.
12 * GnuTLS is distributed in the hope that it will be useful, but
13 * WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program. If not, see
19 * <http://www.gnu.org/licenses/>.
27 #include <gnutls/gnutls.h>
28 #include <gnutls/extra.h>
29 #include <crypt-gaa.h>
30 #include "../lib/random.h" /* for random */
32 #include <sys/types.h>
42 /* Gnulib portability files. */
46 #include <version-etc.h>
48 /* This may need some rewrite. A lot of stuff which should be here
49 * are in the library, which is not good.
52 int crypt_int (const char *username, const char *passwd, int salt,
53 char *tpasswd_conf, char *tpasswd, int uindex);
54 static int read_conf_values (gnutls_datum_t * g, gnutls_datum_t * n,
56 static int _verify_passwd_int (const char *username, const char *passwd,
57 char *verifier, char *salt,
58 const gnutls_datum_t * g,
59 const gnutls_datum_t * n);
62 print_num (const char *msg, const gnutls_datum_t * num)
66 printf ("%s:\t", msg);
68 for (i = 0; i < num->size; i++)
70 if (i != 0 && i % 12 == 0)
72 else if (i != 0 && i != num->size)
74 printf ("%.2x", num->data[i]);
81 generate_create_conf (char *tpasswd_conf)
87 gnutls_datum_t str_g, str_n;
89 fd = fopen (tpasswd_conf, "w");
92 fprintf (stderr, "Cannot open file '%s'\n", tpasswd_conf);
96 for (index = 1; index <= 3; index++)
101 n = gnutls_srp_1024_group_prime;
102 g = gnutls_srp_1024_group_generator;
106 n = gnutls_srp_1536_group_prime;
107 g = gnutls_srp_1536_group_generator;
111 n = gnutls_srp_2048_group_prime;
112 g = gnutls_srp_2048_group_generator;
115 printf ("\nGroup %d, of %d bits:\n", index, n.size * 8);
116 print_num ("Generator", &g);
117 print_num ("Prime", &n);
119 if (gnutls_srp_base64_encode_alloc (&n, &str_n) < 0)
121 fprintf (stderr, "Could not encode\n");
125 if (gnutls_srp_base64_encode_alloc (&g, &str_g) < 0)
127 fprintf (stderr, "Could not encode\n");
131 sprintf (line, "%d:%s:%s\n", index, str_n.data, str_g.data);
133 gnutls_free (str_n.data);
134 gnutls_free (str_g.data);
136 fwrite (line, 1, strlen (line), fd);
146 /* The format of a tpasswd file is:
147 * username:verifier:salt:index
149 * index is the index of the prime-generator pair in tpasswd.conf
152 _verify_passwd_int (const char *username, const char *passwd,
153 char *verifier, char *salt,
154 const gnutls_datum_t * g, const gnutls_datum_t * n)
157 gnutls_datum_t tmp, raw_salt, new_verifier;
161 if (salt == NULL || verifier == NULL)
164 if (strlen(salt) >= sizeof(_salt))
166 fprintf (stderr, "Too long salt.\n");
170 /* copy salt, and null terminate after the ':' */
171 strcpy (_salt, salt);
172 pos = strchr (_salt, ':');
176 /* convert salt to binary. */
178 tmp.size = strlen (_salt);
180 if (gnutls_srp_base64_decode_alloc (&tmp, &raw_salt) < 0)
182 fprintf (stderr, "Could not decode salt.\n");
186 if (gnutls_srp_verifier
187 (username, passwd, &raw_salt, g, n, &new_verifier) < 0)
189 fprintf (stderr, "Could not make the verifier\n");
193 free (raw_salt.data);
195 /* encode the verifier into _salt */
196 salt_size = sizeof (_salt);
197 memset (_salt, 0, salt_size);
198 if (gnutls_srp_base64_encode (&new_verifier, _salt, &salt_size) < 0)
200 fprintf (stderr, "Encoding error\n");
204 free (new_verifier.data);
206 if (strncmp (verifier, _salt, strlen (_salt)) == 0)
208 fprintf (stderr, "Password verified\n");
213 fprintf (stderr, "Password does NOT match\n");
219 filecopy (char *src, char *dst)
225 fd = fopen (dst, "w");
228 fprintf (stderr, "Cannot open '%s' for write\n", dst);
232 fd2 = fopen (src, "r");
240 line[sizeof (line) - 1] = 0;
243 p = fgets (line, sizeof (line) - 1, fd2);
257 /* accepts password file */
259 find_strchr (char *username, char *file)
266 fd = fopen (file, "r");
269 fprintf (stderr, "Cannot open file '%s'\n", file);
273 while (fgets (line, sizeof (line), fd) != NULL)
275 /* move to first ':' */
277 while ((line[i] != ':') && (line[i] != '\0') && (i < sizeof (line)))
281 if (strncmp (username, line, MAX (i, strlen (username))) == 0)
284 pos = strrchr (line, ':');
295 /* Parses the tpasswd files, in order to verify the given
296 * username/password pair.
299 verify_passwd (char *conffile, char *tpasswd, char *username,
309 iindex = find_strchr (username, tpasswd);
312 fprintf (stderr, "Cannot find '%s' in %s\n", username, tpasswd);
316 fd = fopen (conffile, "r");
319 fprintf (stderr, "Cannot find %s\n", conffile);
325 p = fgets (line, sizeof (line) - 1, fd);
327 while (p != NULL && atoi (p) != iindex);
331 fprintf (stderr, "Cannot find entry in %s\n", conffile);
334 line[sizeof (line) - 1] = 0;
338 if ((iindex = read_conf_values (&g, &n, line)) < 0)
340 fprintf (stderr, "Cannot parse conf file '%s'\n", conffile);
344 fd = fopen (tpasswd, "r");
347 fprintf (stderr, "Cannot open file '%s'\n", tpasswd);
351 while (fgets (line, sizeof (line), fd) != NULL)
354 * This is the actual verifier.
357 while ((line[i] != ':') && (line[i] != '\0') && (i < sizeof (line)))
361 if (strncmp (username, line, MAX (i, strlen (username))) == 0)
363 char *verifier_pos, *salt_pos;
365 pos = strchr (line, ':');
369 fprintf (stderr, "Cannot parse conf file '%s'\n", conffile);
375 /* Move to the salt */
376 pos = strchr (pos, ':');
379 fprintf (stderr, "Cannot parse conf file '%s'\n", conffile);
385 return _verify_passwd_int (username, passwd,
386 verifier_pos, salt_pos, &g, &n);
395 #define KPASSWD "/etc/tpasswd"
396 #define KPASSWD_CONF "/etc/tpasswd.conf"
399 tls_log_func (int level, const char *str)
401 fprintf (stderr, "|<%d>| %s", level, str);
404 int main (int argc, char **argv)
413 set_program_name (argv[0]);
415 if ((ret = gnutls_global_init ()) < 0)
417 fprintf (stderr, "global_init: %s\n", gnutls_strerror (ret));
423 if (gaa (argc, argv, &info) != -1)
425 fprintf (stderr, "Error in the arguments.\n");
429 gnutls_global_set_log_function (tls_log_func);
430 gnutls_global_set_log_level (info.debug);
432 if (info.create_conf != NULL)
434 return generate_create_conf (info.create_conf);
437 if (info.passwd == NULL)
438 info.passwd = (char *) KPASSWD;
439 if (info.passwd_conf == NULL)
440 info.passwd_conf = (char *) KPASSWD_CONF;
442 if (info.username == NULL)
445 pwd = getpwuid (getuid ());
449 fprintf (stderr, "No such user\n");
453 info.username = pwd->pw_name;
455 fprintf (stderr, "Please specify a user\n");
462 passwd = getpass ("Enter password: ");
465 fprintf (stderr, "Please specify a password\n");
470 if (info.verify != 0)
472 return verify_passwd (info.passwd_conf, info.passwd,
473 info.username, passwd);
477 return crypt_int (info.username, passwd, salt_size,
478 info.passwd_conf, info.passwd, info.index);
483 _srp_crypt (const char *username, const char *passwd, int salt_size,
484 const gnutls_datum_t * g, const gnutls_datum_t * n)
487 static char result[1024];
488 gnutls_datum_t dat_salt, txt_salt;
489 gnutls_datum_t verifier, txt_verifier;
491 if ((unsigned) salt_size > sizeof (salt))
496 if (gnutls_rnd (GNUTLS_RND_NONCE, salt, salt_size) < 0)
498 fprintf (stderr, "Could not create nonce\n");
502 dat_salt.data = salt;
503 dat_salt.size = salt_size;
505 if (gnutls_srp_verifier (username, passwd, &dat_salt, g, n, &verifier) < 0)
507 fprintf (stderr, "Error getting verifier\n");
511 /* base64 encode the verifier */
512 if (gnutls_srp_base64_encode_alloc (&verifier, &txt_verifier) < 0)
514 fprintf (stderr, "Error encoding\n");
515 free (verifier.data);
519 free (verifier.data);
521 if (gnutls_srp_base64_encode_alloc (&dat_salt, &txt_salt) < 0)
523 fprintf (stderr, "Error encoding\n");
527 sprintf (result, "%s:%s", txt_verifier.data, txt_salt.data);
528 free (txt_salt.data);
529 free (txt_verifier.data);
537 crypt_int (const char *username, const char *passwd, int salt_size,
538 char *tpasswd_conf, char *tpasswd, int uindex)
548 fd = fopen (tpasswd_conf, "r");
551 fprintf (stderr, "Cannot find %s\n", tpasswd_conf);
556 { /* find the specified uindex in file */
557 p = fgets (line, sizeof (line) - 1, fd);
560 while (p != NULL && iindex != uindex);
564 fprintf (stderr, "Cannot find entry in %s\n", tpasswd_conf);
567 line[sizeof (line) - 1] = 0;
570 if ((iindex = read_conf_values (&g, &n, line)) < 0)
572 fprintf (stderr, "Cannot parse conf file '%s'\n", tpasswd_conf);
576 cr = _srp_crypt (username, passwd, salt_size, &g, &n);
579 fprintf (stderr, "Cannot _srp_crypt()...\n");
584 /* delete previous entry */
589 if (strlen (tpasswd) > sizeof (tmpname) + 5)
591 fprintf (stderr, "file '%s' is tooooo long\n", tpasswd);
594 strcpy (tmpname, tpasswd);
595 strcat (tmpname, ".tmp");
597 if (stat (tmpname, &st) != -1)
599 fprintf (stderr, "file '%s' is locked\n", tpasswd);
603 if (filecopy (tpasswd, tmpname) != 0)
605 fprintf (stderr, "Cannot copy '%s' to '%s'\n", tpasswd, tmpname);
609 fd = fopen (tpasswd, "w");
612 fprintf (stderr, "Cannot open '%s' for write\n", tpasswd);
617 fd2 = fopen (tmpname, "r");
620 fprintf (stderr, "Cannot open '%s' for read\n", tmpname);
628 p = fgets (line, sizeof (line) - 1, fd2);
632 pp = strchr (line, ':');
636 if (strncmp (p, username,
637 MAX (strlen (username), (unsigned int) (pp - p))) == 0)
640 fprintf (fd, "%s:%s:%u\n", username, cr, iindex);
651 fprintf (fd, "%s:%s:%u\n", username, cr, iindex);
667 /* this function parses tpasswd.conf file. Format is:
668 * int(index):base64(n):base64(g)
671 read_conf_values (gnutls_datum_t * g, gnutls_datum_t * n, char *str)
680 p = strrchr (str, ':'); /* we have g */
689 /* read the generator */
691 if (p[len - 1] == '\n')
696 ret = gnutls_srp_base64_decode_alloc (&dat, g);
700 fprintf (stderr, "Decoding error\n");
704 /* now go for n - modulo */
705 p = strrchr (str, ':'); /* we have n */
715 dat.size = strlen (p);
717 ret = gnutls_srp_base64_decode_alloc (&dat, n);
721 fprintf (stderr, "Decoding error\n");
729 extern void srptool_version (void);
732 srptool_version (void)
734 const char *p = PACKAGE_NAME;
735 if (strcmp (gnutls_check_version (NULL), PACKAGE_VERSION) != 0)
737 version_etc (stdout, "srptool", p, gnutls_check_version (NULL),
738 "Nikos Mavrogiannopoulos", (char *) NULL);