Rooba
/
odyssey
mirror of https://github.com/yandex/odyssey.git
1
1
Fork 0
Code Issues Packages Projects Releases Wiki Activity
odyssey/sources/auth.c

1196 lines
29 KiB
C
Raw Blame History

/*
* Odyssey.
*
* Scalable PostgreSQL connection pooler.
*/
#include <stdlib.h>
#include <stdarg.h>
#include <stdint.h>
#include <stdio.h>
#include <string.h>
#include <ctype.h>
#include <inttypes.h>
#include <assert.h>
#include <machinarium.h>
#include <kiwi.h>
#include <odyssey.h>
static inline int
od_auth_frontend_cleartext(od_client_t *client)
{
od_instance_t *instance = client->global->instance;
/* AuthenticationCleartextPassword */
machine_msg_t *msg;
msg = kiwi_be_write_authentication_clear_text(NULL);
if (msg == NULL)
return -1;
int rc;
rc = od_write(&client->io, msg);
if (rc == -1) {
od_error(&instance->logger,
"auth",
client,
NULL,
"write error: %s",
od_io_error(&client->io));
return -1;
}
/* wait for password response */
while (1) {
msg = od_read(&client->io, UINT32_MAX);
if (msg == NULL) {
od_error(&instance->logger,
"auth",
client,
NULL,
"read error: %s",
od_io_error(&client->io));
return -1;
}
kiwi_fe_type_t type = *(char *)machine_msg_data(msg);
od_debug(&instance->logger,
"auth",
client,
NULL,
"%s",
kiwi_fe_type_to_string(type));
if (type == KIWI_FE_PASSWORD_MESSAGE)
break;
machine_msg_free(msg);
}
/* read password message */
kiwi_password_t client_token;
kiwi_password_init(&client_token);
rc = kiwi_be_read_password(
machine_msg_data(msg), machine_msg_size(msg), &client_token);
if (rc == -1) {
od_error(
&instance->logger, "auth", client, NULL, "password read error");
od_frontend_error(
client, KIWI_PROTOCOL_VIOLATION, "bad password message");
kiwi_password_free(&client_token);
machine_msg_free(msg);
return -1;
}
#ifdef PAM_FOUND
/* support PAM authentication */
if (client->rule->auth_pam_service) {
od_pam_convert_passwd(client->rule->auth_pam_data,
client_token.password);
rc = od_pam_auth(client->rule->auth_pam_service,
client->startup.user.value,
client->rule->auth_pam_data,
client->io.io);
kiwi_password_free(&client_token);
machine_msg_free(msg);
if (rc == -1)
goto auth_failed;
return 0;
}
#endif
/* use remote or local password source */
kiwi_password_t client_password;
kiwi_password_init(&client_password);
if (client->rule->auth_query) {
char peer[128];
od_getpeername(client->io.io, peer, sizeof(peer), 1, 0);
rc = od_auth_query(client->global,
client->rule,
peer,
&client->startup.user,
&client_password);
if (rc == -1) {
od_error(&instance->logger,
"auth",
client,
NULL,
"failed to make auth_query");
od_frontend_error(client,
KIWI_INVALID_AUTHORIZATION_SPECIFICATION,
"failed to make auth query");
kiwi_password_free(&client_token);
kiwi_password_free(&client_password);
machine_msg_free(msg);
return -1;
}
if (client_password.password == NULL) {
od_log(&instance->logger,
"auth",
client,
NULL,
"user '%s.%s' incorrect user from %s",
client->startup.database.value,
client->startup.user.value,
peer);
od_frontend_error(client, KIWI_INVALID_PASSWORD, "incorrect user");
kiwi_password_free(&client_token);
machine_msg_free(msg);
return -1;
}
} else {
client_password.password_len = client->rule->password_len + 1;
client_password.password = client->rule->password;
}
/* authenticate */
int check = kiwi_password_compare(&client_password, &client_token);
kiwi_password_free(&client_token);
machine_msg_free(msg);
if (client->rule->auth_query)
kiwi_password_free(&client_password);
if (check)
return 0;
goto auth_failed;
auth_failed:
od_log(&instance->logger,
"auth",
client,
NULL,
"user '%s.%s' incorrect password",
client->startup.database.value,
client->startup.user.value);
od_frontend_error(client, KIWI_INVALID_PASSWORD, "incorrect password");
return -1;
}
static inline int
od_auth_frontend_md5(od_client_t *client)
{
od_instance_t *instance = client->global->instance;
/* generate salt */
uint32_t salt =
kiwi_password_salt(&client->key, (uint32_t)machine_lrand48());
/* AuthenticationMD5Password */
machine_msg_t *msg;
msg = kiwi_be_write_authentication_md5(NULL, (char *)&salt);
if (msg == NULL)
return -1;
int rc;
rc = od_write(&client->io, msg);
if (rc == -1) {
od_error(&instance->logger,
"auth",
client,
NULL,
"write error: %s",
od_io_error(&client->io));
return -1;
}
/* wait for password response */
while (1) {
msg = od_read(&client->io, UINT32_MAX);
if (msg == NULL) {
od_error(&instance->logger,
"auth",
client,
NULL,
"read error: %s",
od_io_error(&client->io));
return -1;
}
kiwi_fe_type_t type = *(char *)machine_msg_data(msg);
od_debug(&instance->logger,
"auth",
client,
NULL,
"%s",
kiwi_fe_type_to_string(type));
if (type == KIWI_FE_PASSWORD_MESSAGE)
break;
machine_msg_free(msg);
}
/* read password message */
kiwi_password_t client_token;
kiwi_password_init(&client_token);
rc = kiwi_be_read_password(
machine_msg_data(msg), machine_msg_size(msg), &client_token);
if (rc == -1) {
od_error(
&instance->logger, "auth", client, NULL, "password read error");
od_frontend_error(
client, KIWI_PROTOCOL_VIOLATION, "bad password message");
kiwi_password_free(&client_token);
machine_msg_free(msg);
return -1;
}
/* use remote or local password source */
kiwi_password_t client_password;
kiwi_password_init(&client_password);
kiwi_password_t query_password;
kiwi_password_init(&query_password);
if (client->rule->auth_query) {
char peer[128];
od_getpeername(client->io.io, peer, sizeof(peer), 1, 0);
rc = od_auth_query(client->global,
client->rule,
peer,
&client->startup.user,
&query_password);
if (rc == -1) {
od_error(&instance->logger,
"auth",
client,
NULL,
"failed to make auth_query");
od_frontend_error(client,
KIWI_INVALID_AUTHORIZATION_SPECIFICATION,
"failed to make auth query");
kiwi_password_free(&client_token);
kiwi_password_free(&query_password);
machine_msg_free(msg);
return -1;
}
if (query_password.password == NULL) {
od_log(&instance->logger,
"auth",
client,
NULL,
"user '%s.%s' incorrect user from %s",
client->startup.database.value,
client->startup.user.value,
peer);
od_frontend_error(client, KIWI_INVALID_PASSWORD, "incorrect user");
kiwi_password_free(&client_token);
machine_msg_free(msg);
return -1;
}
query_password.password_len--;
} else {
query_password.password_len = client->rule->password_len;
query_password.password = client->rule->password;
}
/* prepare password hash */
rc = kiwi_password_md5(&client_password,
client->startup.user.value,
client->startup.user.value_len - 1,
query_password.password,
query_password.password_len,
(char *)&salt);
if (rc == -1) {
od_error(
&instance->logger, "auth", client, NULL, "memory allocation error");
kiwi_password_free(&client_password);
kiwi_password_free(&client_token);
if (client->rule->auth_query)
kiwi_password_free(&query_password);
machine_msg_free(msg);
return -1;
}
/* authenticate */
int check = kiwi_password_compare(&client_password, &client_token);
kiwi_password_free(&client_password);
kiwi_password_free(&client_token);
machine_msg_free(msg);
if (client->rule->auth_query)
kiwi_password_free(&query_password);
if (!check) {
od_log(&instance->logger,
"auth",
client,
NULL,
"user '%s.%s' incorrect password",
client->startup.database.value,
client->startup.user.value);
od_frontend_error(client, KIWI_INVALID_PASSWORD, "incorrect password");
return -1;
}
return 0;
}
#ifdef USE_SCRAM
static inline int
od_auth_frontend_scram_sha_256(od_client_t *client)
{
od_instance_t *instance = client->global->instance;
/* request AuthenticationSASL */
machine_msg_t *msg =
kiwi_be_write_authentication_sasl(NULL, "SCRAM-SHA-256");
if (msg == NULL)
return -1;
int rc = od_write(&client->io, msg);
if (rc == -1) {
od_error(&instance->logger,
"auth",
client,
NULL,
"write error: %s",
od_io_error(&client->io));
return -1;
}
/* wait for SASLInitialResponse */
while (1) {
msg = od_read(&client->io, UINT32_MAX);
if (msg == NULL) {
od_error(&instance->logger,
"auth",
client,
NULL,
"read error: %s",
od_io_error(&client->io));
return -1;
}
kiwi_fe_type_t type = *(char *)machine_msg_data(msg);
od_debug(&instance->logger,
"auth",
client,
NULL,
"%s",
kiwi_fe_type_to_string(type));
if (type == KIWI_FE_PASSWORD_MESSAGE)
break;
machine_msg_free(msg);
}
/* read the SASLInitialResponse */
char *mechanism;
char *auth_data;
size_t auth_data_size;
rc = kiwi_be_read_authentication_sasl_initial(machine_msg_data(msg),
machine_msg_size(msg),
&mechanism,
&auth_data,
&auth_data_size);
if (rc == -1) {
od_frontend_error(client,
KIWI_INVALID_AUTHORIZATION_SPECIFICATION,
"malformed SASLInitialResponse message");
machine_msg_free(msg);
return -1;
}
if (strcmp(mechanism, "SCRAM-SHA-256") != 0) {
od_frontend_error(client,
KIWI_INVALID_AUTHORIZATION_SPECIFICATION,
"unsupported SASL authorization mechanism");
machine_msg_free(msg);
return -1;
}
/* use remote or local password source */
kiwi_password_t query_password;
kiwi_password_init(&query_password);
if (client->rule->auth_query) {
char peer[128];
od_getpeername(client->io.io, peer, sizeof(peer), 1, 0);
rc = od_auth_query(client->global,
client->rule,
peer,
&client->startup.user,
&query_password);
if (rc == -1) {
od_error(&instance->logger,
"auth",
client,
NULL,
"failed to make auth_query");
od_frontend_error(client,
KIWI_INVALID_AUTHORIZATION_SPECIFICATION,
"failed to make auth query");
kiwi_password_free(&query_password);
machine_msg_free(msg);
return -1;
}
if (query_password.password == NULL) {
od_log(&instance->logger,
"auth",
client,
NULL,
"user '%s.%s' incorrect user from %s",
client->startup.database.value,
client->startup.user.value,
peer);
od_frontend_error(client, KIWI_INVALID_PASSWORD, "incorrect user");
machine_msg_free(msg);
return -1;
}
query_password.password_len--;
} else {
query_password.password_len = client->rule->password_len;
query_password.password = client->rule->password;
}
od_scram_state_t scram_state;
od_scram_state_init(&scram_state);
/* try to parse authentication data */
rc = od_scram_read_client_first_message(
&scram_state, auth_data, auth_data_size);
machine_msg_free(msg);
switch (rc) {
case 0:
break;
case -1:
return -1;
case -2:
od_frontend_error(client,
KIWI_INVALID_AUTHORIZATION_SPECIFICATION,
"malformed SASLInitialResponse message");
return -1;
case -3:
od_frontend_error(client,
KIWI_FEATURE_NOT_SUPPORTED,
"doesn't support channel binding at the moment");
return -1;
case -4:
od_frontend_error(
client,
KIWI_FEATURE_NOT_SUPPORTED,
"doesn't support authorization identity at the moment");
return -1;
case -5:
od_frontend_error(
client,
KIWI_FEATURE_NOT_SUPPORTED,
"doesn't support mandatory extensions at the moment");
return -1;
}
rc = od_scram_parse_verifier(&scram_state, query_password.password);
if (rc == -1)
rc = od_scram_init_from_plain_password(&scram_state,
query_password.password);
if (rc == -1) {
od_frontend_error(
client,
KIWI_INVALID_AUTHORIZATION_SPECIFICATION,
"invalid user password or SCRAM secret, check your config");
return -1;
}
msg = od_scram_create_server_first_message(&scram_state);
if (msg == NULL) {
kiwi_password_free(&query_password);
od_scram_state_free(&scram_state);
return -1;
}
rc = od_write(&client->io, msg);
if (rc == -1) {
od_error(&instance->logger,
"auth",
client,
NULL,
"write error: %s",
od_io_error(&client->io));
return -1;
}
/* wait for SASLResponse */
while (1) {
// TODO: here's infinite wait, need to replace it with
// client_login_timeout
msg = od_read(&client->io, UINT32_MAX);
if (msg == NULL) {
od_error(&instance->logger,
"auth",
client,
NULL,
"read error: %s",
od_io_error(&client->io));
return -1;
}
kiwi_fe_type_t type = *(char *)machine_msg_data(msg);
od_debug(&instance->logger,
"auth",
client,
NULL,
"%s",
kiwi_fe_type_to_string(type));
if (type == KIWI_FE_PASSWORD_MESSAGE)
break;
machine_msg_free(msg);
}
/* read the SASLResponse */
rc = kiwi_be_read_authentication_sasl(machine_msg_data(msg),
machine_msg_size(msg),
&auth_data,
&auth_data_size);
if (rc == -1) {
od_frontend_error(client,
KIWI_INVALID_AUTHORIZATION_SPECIFICATION,
"malformed client SASLResponse");
machine_msg_free(msg);
return -1;
}
char *final_nonce;
size_t final_nonce_size;
char *client_proof;
rc = od_scram_read_client_final_message(&scram_state,
auth_data,
auth_data_size,
&final_nonce,
&final_nonce_size,
&client_proof);
if (rc == -1) {
od_frontend_error(client,
KIWI_INVALID_AUTHORIZATION_SPECIFICATION,
"malformed client SASLResponse");
machine_msg_free(msg);
return -1;
}
/* verify signatures */
rc =
od_scram_verify_final_nonce(&scram_state, final_nonce, final_nonce_size);
if (rc == -1) {
od_frontend_error(client,
KIWI_INVALID_AUTHORIZATION_SPECIFICATION,
"malformed client SASLResponse: nonce doesn't match");
machine_msg_free(msg);
return -1;
}
rc = od_scram_verify_client_proof(&scram_state, client_proof);
if (rc == -1) {
od_frontend_error(client,
KIWI_INVALID_AUTHORIZATION_SPECIFICATION,
"password authentication failed");
machine_msg_free(msg);
return -1;
}
machine_msg_free(msg);
/* SASLFinal Message */
msg = od_scram_create_server_final_message(&scram_state);
if (msg == NULL) {
kiwi_password_free(&query_password);
od_scram_state_free(&scram_state);
return -1;
}
rc = od_write(&client->io, msg);
if (rc == -1) {
od_error(&instance->logger,
"auth",
client,
NULL,
"write error: %s",
od_io_error(&client->io));
return -1;
}
return 0;
}
#endif
static inline int
od_auth_frontend_cert(od_client_t *client)
{
od_instance_t *instance = client->global->instance;
if (!client->startup.is_ssl_request) {
od_error(
&instance->logger, "auth", client, NULL, "TLS connection required");
od_frontend_error(client,
KIWI_INVALID_AUTHORIZATION_SPECIFICATION,
"TLS connection required");
return -1;
}
/* compare client certificate common name */
od_route_t *route = client->route;
int rc;
if (route->rule->auth_common_name_default) {
rc = machine_io_verify(client->io.io, route->rule->user_name);
if (!rc) {
return 0;
}
}
od_list_t *i;
od_list_foreach(&route->rule->auth_common_names, i)
{
od_rule_auth_t *auth;
auth = od_container_of(i, od_rule_auth_t, link);
rc = machine_io_verify(client->io.io, auth->common_name);
if (!rc) {
return 0;
}
}
od_error(&instance->logger,
"auth",
client,
NULL,
"TLS certificate common name mismatch");
od_frontend_error(
client, KIWI_INVALID_PASSWORD, "TLS certificate common name mismatch");
return -1;
}
static inline int
od_auth_frontend_block(od_client_t *client)
{
od_instance_t *instance = client->global->instance;
od_log(&instance->logger,
"auth",
client,
NULL,
"user '%s.%s' is blocked",
client->startup.database.value,
client->startup.user.value);
od_frontend_error(client,
KIWI_INVALID_AUTHORIZATION_SPECIFICATION,
"user blocked%s%s",
client->rule->db_is_default ? " (unknown database)" : "",
client->rule->user_is_default ? " (unknown user)" : "");
return 0;
}
int
od_auth_frontend(od_client_t *client)
{
od_instance_t *instance = client->global->instance;
/* authentication mode */
int rc;
switch (client->rule->auth_mode) {
case OD_RULE_AUTH_CLEAR_TEXT:
rc = od_auth_frontend_cleartext(client);
if (rc == -1)
return -1;
break;
case OD_RULE_AUTH_MD5:
rc = od_auth_frontend_md5(client);
if (rc == -1)
return -1;
break;
#ifdef USE_SCRAM
case OD_RULE_AUTH_SCRAM_SHA_256:
rc = od_auth_frontend_scram_sha_256(client);
if (rc == -1)
return -1;
break;
#endif
case OD_RULE_AUTH_CERT:
rc = od_auth_frontend_cert(client);
if (rc == -1)
return -1;
break;
case OD_RULE_AUTH_BLOCK:
od_auth_frontend_block(client);
return -1;
case OD_RULE_AUTH_NONE:
break;
default:
assert(0);
break;
}
/* pass */
machine_msg_t *msg;
msg = kiwi_be_write_authentication_ok(NULL);
if (msg == NULL)
return -1;
rc = od_write(&client->io, msg);
if (rc == -1) {
od_error(&instance->logger,
"auth",
client,
NULL,
"write error: %s",
od_io_error(&client->io));
return -1;
}
return 0;
}
static inline int
od_auth_backend_cleartext(od_server_t *server)
{
od_instance_t *instance = server->global->instance;
od_route_t *route = server->route;
assert(route != NULL);
od_debug(&instance->logger,
"auth",
NULL,
server,
"requested clear-text authentication");
/* use storage or user password */
char *password;
int password_len;
if (route->rule->storage_password) {
password = route->rule->storage_password;
password_len = route->rule->storage_password_len;
} else if (route->rule->password) {
password = route->rule->password;
password_len = route->rule->password_len;
} else {
od_error(&instance->logger,
"auth",
NULL,
server,
"password required for route '%s.%s'",
route->rule->db_name,
route->rule->user_name);
return -1;
}
/* PasswordMessage */
machine_msg_t *msg;
msg = kiwi_fe_write_password(NULL, password, password_len + 1);
if (msg == NULL) {
od_error(
&instance->logger, "auth", NULL, server, "memory allocation error");
return -1;
}
int rc;
rc = od_write(&server->io, msg);
if (rc == -1) {
od_error(&instance->logger,
"auth",
NULL,
server,
"write error: %s",
od_io_error(&server->io));
return -1;
}
return 0;
}
static inline int
od_auth_backend_md5(od_server_t *server, char salt[4])
{
od_instance_t *instance = server->global->instance;
od_route_t *route = server->route;
assert(route != NULL);
od_debug(
&instance->logger, "auth", NULL, server, "requested md5 authentication");
/* use storage user or route user */
char *user;
int user_len;
if (route->rule->storage_user) {
user = route->rule->storage_user;
user_len = route->rule->storage_user_len;
} else {
user = route->rule->user_name;
user_len = route->rule->user_name_len;
}
/* use storage or user password */
char *password;
int password_len;
if (route->rule->storage_password) {
password = route->rule->storage_password;
password_len = route->rule->storage_password_len;
} else if (route->rule->password) {
password = route->rule->password;
password_len = route->rule->password_len;
} else {
od_error(&instance->logger,
"auth",
NULL,
server,
"password required for route '%s.%s'",
route->rule->db_name,
route->rule->user_name);
return -1;
}
/* prepare md5 password using server supplied salt */
kiwi_password_t client_password;
kiwi_password_init(&client_password);
int rc;
rc = kiwi_password_md5(
&client_password, user, user_len, password, password_len, salt);
if (rc == -1) {
od_error(
&instance->logger, "auth", NULL, server, "memory allocation error");
kiwi_password_free(&client_password);
return -1;
}
/* PasswordMessage */
machine_msg_t *msg;
msg = kiwi_fe_write_password(
NULL, client_password.password, client_password.password_len);
kiwi_password_free(&client_password);
if (msg == NULL) {
od_error(
&instance->logger, "auth", NULL, server, "memory allocation error");
return -1;
}
rc = od_write(&server->io, msg);
if (rc == -1) {
od_error(&instance->logger,
"auth",
NULL,
server,
"write error: %s",
od_io_error(&server->io));
return -1;
}
return 0;
}
#ifdef USE_SCRAM
static inline int
od_auth_backend_sasl(od_server_t *server)
{
od_instance_t *instance = server->global->instance;
od_route_t *route = server->route;
assert(route != NULL);
if (server->scram_state.client_nonce != NULL) {
od_error(&instance->logger,
"auth",
NULL,
server,
"unexpected message: AuthenticationSASL was already received");
return -1;
}
od_debug(
&instance->logger, "auth", NULL, server, "requested SASL authentication");
if (!route->rule->storage_password && !route->rule->password) {
od_error(&instance->logger,
"auth",
NULL,
server,
"password required for route '%s.%s'",
route->rule->db_name,
route->rule->user_name);
return -1;
}
/* SASLInitialResponse Message */
machine_msg_t *msg =
od_scram_create_client_first_message(&server->scram_state);
if (msg == NULL) {
od_error(
&instance->logger, "auth", NULL, server, "memory allocation error");
return -1;
}
int rc = od_write(&server->io, msg);
if (rc == -1) {
od_error(&instance->logger,
"auth",
NULL,
server,
"write error: %s",
od_io_error(&server->io));
return -1;
}
return 0;
}
static inline int
od_auth_backend_sasl_continue(od_server_t *server,
char *auth_data,
size_t auth_data_size)
{
od_instance_t *instance = server->global->instance;
od_route_t *route = server->route;
assert(route != NULL);
if (server->scram_state.client_nonce == NULL) {
od_error(&instance->logger,
"auth",
NULL,
server,
"unexpected message: AuthenticationSASL is missing");
return -1;
}
if (server->scram_state.server_first_message != NULL) {
od_error(&instance->logger,
"auth",
NULL,
server,
"unexpected message: AuthenticationSASLContinue was already "
"received");
return -1;
}
/* use storage or user password */
char *password;
if (route->rule->storage_password) {
password = route->rule->storage_password;
} else if (route->rule->password) {
password = route->rule->password;
} else {
od_error(&instance->logger,
"auth",
NULL,
server,
"password required for route '%s.%s'",
route->rule->db_name,
route->rule->user_name);
return -1;
}
od_debug(
&instance->logger, "auth", NULL, server, "continue SASL authentication");
/* SASLResponse Message */
machine_msg_t *msg = od_scram_create_client_final_message(
&server->scram_state, password, auth_data, auth_data_size);
if (msg == NULL) {
od_error(&instance->logger,
"auth",
NULL,
server,
"malformed SASLResponse message");
return -1;
}
int rc = od_write(&server->io, msg);
if (rc == -1) {
od_error(&instance->logger,
"auth",
NULL,
server,
"write error: %s",
od_io_error(&server->io));
return -1;
}
return 0;
}
static inline int
od_auth_backend_sasl_final(od_server_t *server,
char *auth_data,
size_t auth_data_size)
{
od_instance_t *instance = server->global->instance;
assert(server->route);
if (server->scram_state.server_first_message == NULL) {
od_error(&instance->logger,
"auth",
NULL,
server,
"unexpected message: AuthenticationSASLContinue is missing");
return -1;
}
od_debug(
&instance->logger, "auth", NULL, server, "finishing SASL authentication");
int rc = od_scram_verify_server_signature(
&server->scram_state, auth_data, auth_data_size);
if (rc == -1) {
od_error(&instance->logger,
"auth",
NULL,
server,
"server verify failed: invalid signature");
return -1;
}
od_scram_state_free(&server->scram_state);
return 0;
}
#endif
int
od_auth_backend(od_server_t *server, machine_msg_t *msg)
{
od_instance_t *instance = server->global->instance;
assert(*(char *)machine_msg_data(msg) == KIWI_BE_AUTHENTICATION);
uint32_t auth_type;
char salt[4];
char *auth_data = NULL;
size_t auth_data_size = 0;
int rc;
rc = kiwi_fe_read_auth(machine_msg_data(msg),
machine_msg_size(msg),
&auth_type,
salt,
&auth_data,
&auth_data_size);
if (rc == -1) {
od_error(&instance->logger,
"auth",
NULL,
server,
"failed to parse authentication message");
return -1;
}
msg = NULL;
switch (auth_type) {
/* AuthenticationOk */
case 0:
return 0;
/* AuthenticationCleartextPassword */
case 3:
rc = od_auth_backend_cleartext(server);
if (rc == -1)
return -1;
break;
/* AuthenticationMD5Password */
case 5:
rc = od_auth_backend_md5(server, salt);
if (rc == -1)
return -1;
break;
#ifdef USE_SCRAM
/* AuthenticationSASL */
case 10:
return od_auth_backend_sasl(server);
/* AuthenticationSASLContinue */
case 11:
return od_auth_backend_sasl_continue(
server, auth_data, auth_data_size);
/* AuthenticationSASLContinue */
case 12:
return od_auth_backend_sasl_final(
server, auth_data, auth_data_size);
#endif
/* unsupported */
default:
od_error(&instance->logger,
"auth",
NULL,
server,
"unsupported authentication method");
return -1;
}
/* wait for authentication response */
while (1) {
msg = od_read(&server->io, UINT32_MAX);
if (msg == NULL) {
od_error(&instance->logger,
"auth",
NULL,
server,
"read error: %s",
od_io_error(&server->io));
return -1;
}
kiwi_be_type_t type = *(char *)machine_msg_data(msg);
od_debug(&instance->logger,
"auth",
NULL,
server,
"%s",
kiwi_be_type_to_string(type));
int rc;
switch (type) {
case KIWI_BE_AUTHENTICATION:
rc = kiwi_fe_read_auth(machine_msg_data(msg),
machine_msg_size(msg),
&auth_type,
salt,
NULL,
NULL);
machine_msg_free(msg);
if (rc == -1) {
od_error(&instance->logger,
"auth",
NULL,
server,
"failed to parse authentication message");
return -1;
}
if (auth_type != 0) {
od_error(&instance->logger,
"auth",
NULL,
server,
"incorrect authentication flow");
return 0;
}
return 0;
case KIWI_BE_ERROR_RESPONSE:
od_backend_error(
server, "auth", machine_msg_data(msg), machine_msg_size(msg));
server->error_connect = msg;
return -1;
default:
machine_msg_free(msg);
break;
}
}
return 0;
}
Reference in New Issue View Git Blame Copy Permalink