Skip to content

Commit b8202d1

Browse files
LinuxJediLinuxJedi
committed
Make Keyboard Interactive a compile time option
Now an off-by-default compile-time option. This saves resources and confusion if you are not expecting it. ZD #19704
1 parent ea5f28d commit b8202d1

File tree

15 files changed

+307
-20
lines changed

15 files changed

+307
-20
lines changed

‎.github/workflows/os-check.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,7 @@ jobs:
7272
'--enable-all',
7373
'--enable-sftp',
7474
'--enable-scp',
75+
'--enable-keyboard-interactive',
7576
'--enable-shell',
7677
]
7778
name: Build wolfssh

‎configure.ac‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,11 @@ AC_ARG_ENABLE([keygen],
126126
[AS_HELP_STRING([--enable-keygen],[Enable key generation (default: disabled)])],
127127
[ENABLED_KEYGEN=$enableval],[ENABLED_KEYGEN=no])
128128

129+
# Keyboard Interactive
130+
AC_ARG_ENABLE([keyboard-interactive],
131+
[AS_HELP_STRING([--enable-keyboard-interactive],[Enable keyboard interactive authentication (default: disabled)])],
132+
[ENABLED_KEYBOARD_INTERACTIVE=$enableval],[ENABLED_KEYBOARD_INTERACTIVE=no])
133+
129134
# SCP
130135
AC_ARG_ENABLE([scp],
131136
[AS_HELP_STRING([--enable-scp],[Enable scp support (default: disabled)])],
@@ -206,7 +211,7 @@ AC_ARG_ENABLE([distro],
206211
AS_IF([test "x$ENABLED_DISTRO" = "xyes"],
207212
[ENABLED_ALL=yes; enable_shared=yes; enable_static=yes])
208213
AS_IF([test "x$ENABLED_ALL" = "xyes"],
209-
[ENABLED_KEYGEN=yes; ENABLED_SCP=yes; ENABLED_SFTP=yes; ENABLED_FWD=yes; ENABLED_SHELL=yes; ENABLED_AGENT=yes; ENABLED_SSHD=yes; ENABLED_SSHCLIENT=yes; ENABLED_CERTS=yes])
214+
[ENABLED_KEYGEN=yes; ENABLED_SCP=yes; ENABLED_SFTP=yes; ENABLED_FWD=yes; ENABLED_SHELL=yes; ENABLED_AGENT=yes; ENABLED_SSHD=yes; ENABLED_SSHCLIENT=yes; ENABLED_CERTS=yes; ENABLED_KEYBOARD_INTERACTIVE=yes])
210215
AS_IF([test "x$ENABLED_SSHD" = "xyes"],
211216
[ENABLED_SHELL=yes])
212217

@@ -215,6 +220,8 @@ AS_IF([test "x$ENABLED_INLINE" = "xno"],
215220
[AM_CPPFLAGS="$AM_CPPFLAGS -DNO_INLINE"])
216221
AS_IF([test "x$ENABLED_KEYGEN" = "xyes"],
217222
[AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_KEYGEN"])
223+
AS_IF([test "x$ENABLED_KEYBOARD_INTERACTIVE" = "xyes"],
224+
[AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_KEYBOARD_INTERACTIVE"])
218225
AS_IF([test "x$ENABLED_SCP" = "xyes"],
219226
[AM_CPPFLAGS="$AM_CPPFLAGS -DWOLFSSH_SCP"])
220227
AS_IF([test "x$ENABLED_SFTP" = "xyes"],
@@ -292,6 +299,7 @@ AM_CONDITIONAL([BUILD_SSHD],[test "x$ENABLED_SSHD" = "xyes"])
292299
AM_CONDITIONAL([BUILD_SSHCLIENT],[test "x$ENABLED_SSHCLIENT" = "xyes"])
293300
AM_CONDITIONAL([BUILD_CERTS],[test "x$ENABLED_CERTS" = "xyes"])
294301
AM_CONDITIONAL([BUILD_TPM],[test "x$ENABLED_TPM" = "xyes"])
302+
AM_CONDITIONAL([BUILD_KEYBOARD_INTERACTIVE],[test "x$ENABLED_KEYBOARD_INTERACTIVE" = "xyes"])
295303

296304
AX_HARDEN_CC_COMPILER_FLAGS
297305

@@ -328,6 +336,7 @@ AS_ECHO([" Features"])
328336
AS_ECHO([" * Inline Code: $ENABLED_INLINE"])
329337
AS_ECHO([" * Small stack: $ENABLED_SMALLSTACK"])
330338
AS_ECHO([" * keygen: $ENABLED_KEYGEN"])
339+
AS_ECHO([" * keyboard interactive: $ENABLED_KEYBOARD_INTERACTIVE"])
331340
AS_ECHO([" * psuedo-terminal: $ENABLED_TERM"])
332341
AS_ECHO([" * echoserver shell support: $ENABLED_SHELL"])
333342
AS_ECHO([" * scp: $ENABLED_SCP"])

‎examples/client/common.c‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -64,10 +64,11 @@ static word32 userPrivateKeySz = 0;
6464
static word32 userPrivateKeyTypeSz = 0;
6565
static byte isPrivate = 0;
6666

67+
#ifdef WOLFSSH_KEYBOARD_INTERACTIVE
6768
static word32 keyboardResponseCount = 0;
6869
static byte** keyboardResponses;
6970
static word32* keyboardResponseLengths;
70-
71+
#endif
7172

7273
#ifdef WOLFSSH_CERTS
7374
#if 0
@@ -460,7 +461,7 @@ int ClientUserAuth(byte authType,
460461
{
461462
const char* defaultPassword = (const char*)ctx;
462463
word32 passwordSz = 0;
463-
#ifdef WOLFSSH_TERM
464+
#if defined(WOLFSSH_TERM) && defined(WOLFSSH_KEYBOARD_INTERACTIVE)
464465
word32 entry;
465466
#endif
466467
int ret = WOLFSSH_USERAUTH_SUCCESS;
@@ -474,9 +475,11 @@ int ClientUserAuth(byte authType,
474475
if (authData->type & WOLFSSH_USERAUTH_PUBLICKEY) {
475476
printf(" - publickey\n");
476477
}
478+
#ifdef WOLFSSH_KEYBOARD_INTERACTIVE
477479
if (authData->type & WOLFSSH_USERAUTH_KEYBOARD) {
478480
printf(" - keyboard\n");
479481
}
482+
#endif
480483
printf("wolfSSH requesting to use type %d\n", authType);
481484
#endif
482485

@@ -544,7 +547,7 @@ int ClientUserAuth(byte authType,
544547
authData->sf.password.passwordSz = passwordSz;
545548
}
546549
}
547-
#ifdef WOLFSSH_TERM
550+
#if defined(WOLFSSH_TERM) && defined(WOLFSSH_KEYBOARD_INTERACTIVE)
548551
else if (authType == WOLFSSH_USERAUTH_KEYBOARD) {
549552
if (authData->sf.keyboard.promptName &&
550553
authData->sf.keyboard.promptName[0] != '\0') {
@@ -1112,7 +1115,9 @@ int ClientLoadCA(WOLFSSH_CTX* ctx, const char* caCert)
11121115
void ClientFreeBuffers(const char* pubKeyName, const char* privKeyName,
11131116
void* heap)
11141117
{
1118+
#if defined(WOLFSSH_TERM) && defined(WOLFSSH_KEYBOARD_INTERACTIVE)
11151119
word32 entry;
1120+
#endif
11161121
#ifdef WOLFSSH_TPM
11171122
wolfSSH_TPM_Cleanup(&tpmDev, &tpmKey);
11181123
#endif
@@ -1126,9 +1131,11 @@ void ClientFreeBuffers(const char* pubKeyName, const char* privKeyName,
11261131
WFREE(userPrivateKey, heap, DYNTYPE_PRIVKEY);
11271132
}
11281133

1134+
#ifdef WOLFSSH_KEYBOARD_INTERACTIVE
11291135
for (entry = 0; entry < keyboardResponseCount; entry++) {
11301136
WFREE(keyboardResponses[entry], NULL, 0);
11311137
}
11321138
WFREE(keyboardResponses, NULL, 0);
11331139
WFREE(keyboardResponseLengths, NULL, 0);
1140+
#endif
11341141
}

‎examples/echoserver/echoserver.c‎

Lines changed: 26 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2006,7 +2006,7 @@ static int LoadPasswdList(StrList* strList, PwMapList* mapList)
20062006

20072007
return count;
20082008
}
2009-
2009+
#ifdef WOLFSSH_KEYBOARD_INTERACTIVE
20102010
static int LoadKeyboardList(StrList* strList, PwMapList* mapList)
20112011
{
20122012
char names[256];
@@ -2034,6 +2034,7 @@ static int LoadKeyboardList(StrList* strList, PwMapList* mapList)
20342034

20352035
return count;
20362036
}
2037+
#endif
20372038

20382039
#ifndef NO_FILESYSTEM
20392040
static int LoadPubKeyList(StrList* strList, int format, PwMapList* mapList)
@@ -2183,8 +2184,10 @@ static int wsUserAuth(byte authType,
21832184
#ifdef WOLFSSH_ALLOW_USERAUTH_NONE
21842185
authType != WOLFSSH_USERAUTH_NONE &&
21852186
#endif
2186-
authType != WOLFSSH_USERAUTH_PUBLICKEY &&
2187-
authType != WOLFSSH_USERAUTH_KEYBOARD) {
2187+
#ifdef WOLFSSH_KEYBOARD_INTERACTIVE
2188+
authType != WOLFSSH_USERAUTH_KEYBOARD &&
2189+
#endif
2190+
authType != WOLFSSH_USERAUTH_PUBLICKEY) {
21882191

21892192
return WOLFSSH_USERAUTH_FAILURE;
21902193
}
@@ -2194,6 +2197,7 @@ static int wsUserAuth(byte authType,
21942197
authData->sf.password.passwordSz,
21952198
authHash);
21962199
}
2200+
#ifdef WOLFSSH_KEYBOARD_INTERACTIVE
21972201
else if (authType == WOLFSSH_USERAUTH_KEYBOARD) {
21982202
if (authData->sf.keyboard.responseCount != 1) {
21992203
return WOLFSSH_USERAUTH_FAILURE;
@@ -2202,6 +2206,7 @@ static int wsUserAuth(byte authType,
22022206
authData->sf.keyboard.responseLengths[0],
22032207
authHash);
22042208
}
2209+
#endif
22052210
else if (authType == WOLFSSH_USERAUTH_PUBLICKEY) {
22062211
wc_Sha256Hash(authData->sf.publicKey.publicKey,
22072212
authData->sf.publicKey.publicKeySz,
@@ -2302,6 +2307,7 @@ static int wsUserAuth(byte authType,
23022307
WOLFSSH_USERAUTH_REJECTED;
23032308
}
23042309
}
2310+
#ifdef WOLFSSH_KEYBOARD_INTERACTIVE
23052311
else if (authData->type == WOLFSSH_USERAUTH_KEYBOARD) {
23062312
if (WMEMCMP(map->p, authHash, WC_SHA256_DIGEST_SIZE) == 0) {
23072313
return WOLFSSH_USERAUTH_SUCCESS;
@@ -2310,6 +2316,7 @@ static int wsUserAuth(byte authType,
23102316
return WOLFSSH_USERAUTH_INVALID_PASSWORD;
23112317
}
23122318
}
2319+
#endif
23132320
#ifdef WOLFSSH_ALLOW_USERAUTH_NONE
23142321
else if (authData->type == WOLFSSH_USERAUTH_NONE) {
23152322
return WOLFSSH_USERAUTH_SUCCESS;
@@ -2325,13 +2332,15 @@ static int wsUserAuth(byte authType,
23252332
return WOLFSSH_USERAUTH_INVALID_USER;
23262333
}
23272334

2335+
#ifdef WOLFSSH_KEYBOARD_INTERACTIVE
23282336
static int keyboardCallback(WS_UserAuthData_Keyboard *kbAuth, void *ctx)
23292337
{
23302338
WS_UserAuthData_Keyboard *kbAuthData = (WS_UserAuthData_Keyboard*) ctx;
23312339
WMEMCPY(kbAuth, kbAuthData, sizeof(WS_UserAuthData_Keyboard));
23322340

23332341
return WS_SUCCESS;
23342342
}
2343+
#endif
23352344

23362345
#ifdef WOLFSSH_SFTP
23372346
/*
@@ -2417,9 +2426,11 @@ static void ShowUsage(void)
24172426
" load in an X.509 DER cert to accept from peer\n");
24182427
printf(" -P <name>:<password>\n"
24192428
" add password to accept from peer\n");
2429+
#ifdef WOLFSSH_KEYBOARD_INTERACTIVE
24202430
printf(" -i <name>:<password>\n"
24212431
" add passowrd to accept via keyboard-interactive "
24222432
"from peer\n");
2433+
#endif
24232434
#ifdef WOLFSSH_CERTS
24242435
printf(" -a <file> load in a root CA certificate file\n");
24252436
#endif
@@ -2463,8 +2474,10 @@ THREAD_RETURN WOLFSSH_THREAD echoserver_test(void* args)
24632474
StrList* derPubKeyList = NULL;
24642475
#endif
24652476
StrList* passwdList = NULL;
2477+
#ifdef WOLFSSH_KEYBOARD_INTERACTIVE
24662478
StrList* keyboardList = NULL;
24672479
WS_UserAuthData_Keyboard kbAuthData;
2480+
#endif
24682481
WS_SOCKET_T listenFd = WOLFSSH_SOCKET_INVALID;
24692482
word32 defaultHighwater = EXAMPLE_HIGHWATER_MARK;
24702483
word32 threadCount = 0;
@@ -2495,7 +2508,9 @@ THREAD_RETURN WOLFSSH_THREAD echoserver_test(void* args)
24952508
int argc = serverArgs->argc;
24962509
char** argv = serverArgs->argv;
24972510
serverArgs->return_code = EXIT_SUCCESS;
2511+
#ifdef WOLFSSH_KEYBOARD_INTERACTIVE
24982512
kbAuthData.promptCount = 0;
2513+
#endif
24992514

25002515
if (argc > 0) {
25012516
const char* optlist = "?1a:d:efEp:R:Ni:j:i:I:J:K:P:k:b:x:m:c:s:";
@@ -2582,9 +2597,11 @@ THREAD_RETURN WOLFSSH_THREAD echoserver_test(void* args)
25822597
passwdList = StrListAdd(passwdList, myoptarg);
25832598
break;
25842599

2600+
#ifdef WOLFSSH_KEYBOARD_INTERACTIVE
25852601
case 'i':
25862602
keyboardList = StrListAdd(keyboardList, myoptarg);
25872603
break;
2604+
#endif
25882605

25892606
case 'b':
25902607
userAuthWouldBlock = atoi(myoptarg);
@@ -2739,6 +2756,7 @@ THREAD_RETURN WOLFSSH_THREAD echoserver_test(void* args)
27392756
passwdList = NULL;
27402757
}
27412758

2759+
#ifdef WOLFSSH_KEYBOARD_INTERACTIVE
27422760
if (keyboardList) {
27432761
LoadKeyboardList(keyboardList, &pwMapList);
27442762
StrListFree(keyboardList);
@@ -2767,6 +2785,7 @@ THREAD_RETURN WOLFSSH_THREAD echoserver_test(void* args)
27672785
kbAuthData.promptEcho[0] = 0;
27682786
wolfSSH_SetKeyboardAuthPrompts(ctx, keyboardCallback);
27692787
}
2788+
#endif
27702789

27712790
{
27722791
const char* bufName = NULL;
@@ -2973,7 +2992,9 @@ THREAD_RETURN WOLFSSH_THREAD echoserver_test(void* args)
29732992
#endif
29742993
wolfSSH_SetUserAuthCtx(ssh, &pwMapList);
29752994
wolfSSH_SetKeyingCompletionCbCtx(ssh, (void*)ssh);
2995+
#ifdef WOLFSSH_KEYBOARD_INTERACTIVE
29762996
wolfSSH_SetKeyboardAuthCtx(ssh, &kbAuthData);
2997+
#endif
29772998
/* Use the session object for its own highwater callback ctx */
29782999
if (defaultHighwater > 0) {
29793000
wolfSSH_SetHighwaterCtx(ssh, (void*)ssh);
@@ -3046,11 +3067,13 @@ THREAD_RETURN WOLFSSH_THREAD echoserver_test(void* args)
30463067
if (listenFd != WOLFSSH_SOCKET_INVALID) {
30473068
WCLOSESOCKET(listenFd);
30483069
}
3070+
#ifdef WOLFSSH_KEYBOARD_INTERACTIVE
30493071
if (kbAuthData.promptCount > 0) {
30503072
WFREE(kbAuthData.promptLengths, NULL, 0);
30513073
WFREE(kbAuthData.prompts, NULL, 0);
30523074
WFREE(kbAuthData.promptEcho, NULL, 0);
30533075
}
3076+
#endif
30543077
wc_FreeMutex(&doneLock);
30553078
PwMapListDelete(&pwMapList);
30563079
wolfSSH_CTX_free(ctx);

0 commit comments

Comments
 (0)