google-authenticator/0000755000175000017500000000000012725567073013674 5ustar ocsiocsigoogle-authenticator/libpam/0000755000175000017500000000000012725566215015135 5ustar ocsiocsigoogle-authenticator/libpam/build/0000755000175000017500000000000012725566215016234 5ustar ocsiocsigoogle-authenticator/libpam/build/.gitignore0000644000175000017500000000001612725566215020221 0ustar ocsiocsi* !.gitignore google-authenticator/libpam/configure.ac0000644000175000017500000000361412725566215017427 0ustar ocsiocsiAC_PREREQ(2.61) AC_INIT(google-authenticator, 1.01, habets@google.com) AC_CONFIG_SRCDIR([src/google-authenticator.c]) AC_CONFIG_AUX_DIR([build]) AC_CONFIG_MACRO_DIR([build]) AC_USE_SYSTEM_EXTENSIONS AM_INIT_AUTOMAKE([foreign subdir-objects]) AM_MAINTAINER_MODE([enable]) LT_INIT AC_PROG_CC AC_PROG_CC_STDC AC_CHECK_HEADERS([sys/fsuid.h]) AC_CHECK_FUNCS([setfsuid]) AC_CHECK_HEADERS_ONCE([security/pam_appl.h]) # On Solaris at least, requires # to be included first AC_CHECK_HEADER([security/pam_modules.h], [], [], \ [#ifdef HAVE_SECURITY_PAM_APPL_H # include #endif ]) AC_CHECK_LIB([pam], [pam_get_user], [:]) AS_IF([test "x$ac_cv_header_security_pam_modules_h" = "xno" \ -o "x$ac_cv_lib_pam_pam_get_user" = "xno"], [ AC_MSG_ERROR([Unable to find the PAM library or the PAM header files]) ]) AC_MSG_CHECKING([whether certain PAM functions require const arguments]) AC_LANG_PUSH(C) # Force test to bail if const isn't needed AC_LANG_WERROR AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ #include #include ]],[[ const void **item = 0; int dummy = 0; /* * since pam_handle_t is opaque on at least some platforms, give it * a non-NULL dummy value */ const pam_handle_t *ph = (const pam_handle_t *)&dummy; (void) pam_get_item(ph, 0, item); ]])],[AC_DEFINE([PAM_CONST], [const], \ [Define if certain PAM functions require const arguments]) AC_MSG_RESULT([yes])], [AC_DEFINE([PAM_CONST], [], \ [Prevent certain PAM functions from using const arguments]) AC_MSG_RESULT([no])]) AC_LANG_POP(C) AC_SEARCH_LIBS([dlopen], [dl]) AC_CONFIG_HEADER(config.h) AC_CONFIG_FILES([Makefile contrib/rpm.spec]) AC_OUTPUT echo " $PACKAGE_NAME version $PACKAGE_VERSION Prefix.........: $prefix Debug Build....: $debug C Compiler.....: $CC $CFLAGS $CPPFLAGS Linker.........: $LD $LDFLAGS $LIBS " google-authenticator/libpam/Makefile.am0000644000175000017500000000361412725566215017175 0ustar ocsiocsiAUTOMAKE_OPTIONS = foreign subdir-objects ACLOCAL_AMFLAGS = -I build pamdir = $(libdir)/security bin_PROGRAMS = google-authenticator pam_LTLIBRARIES = pam_google_authenticator.la dist_doc_DATA = FILEFORMAT README.md dist_html_DATA = totp.html MODULES_LDFLAGS = -avoid-version -module -shared -export-dynamic CORE_SRC = CORE_SRC += src/base32.h src/base32.c CORE_SRC += src/hmac.h src/hmac.c CORE_SRC += src/sha1.h src/sha1.c google_authenticator_SOURCES = \ src/google-authenticator.c \ $(CORE_SRC) pam_google_authenticator_la_SOURCES = \ src/pam_google_authenticator.c \ $(CORE_SRC) pam_google_authenticator_la_LIBADD = -lpam pam_google_authenticator_la_CFLAGS = $(AM_CFLAGS) pam_google_authenticator_la_LDFLAGS = $(AM_LDFLAGS) $(MODULES_LDFLAGS) -export-symbols-regex "pam_sm_(setcred|open_session|authenticate)" check_PROGRAMS = examples/demo tests/pam_google_authenticator_unittest check_LTLIBRARIES = libpam_google_authenticator_testing.la TESTS = tests/pam_google_authenticator_unittest libpam_google_authenticator_testing_la_SOURCES = \ src/pam_google_authenticator.c \ $(CORE_SRC) libpam_google_authenticator_testing_la_CFLAGS = $(AM_CFLAGS) -DTESTING=1 libpam_google_authenticator_testing_la_LDFLAGS = $(AM_LDFLAGS) $(MODULES_LDFLAGS) -rpath $(abs_top_builddir) tests_pam_google_authenticator_unittest_SOURCES = \ tests/pam_google_authenticator_unittest.c \ $(CORE_SRC) tests_pam_google_authenticator_unittest_LDFLAGS = $(AM_LDFLAGS) -export-dynamic test: check examples_demo_SOURCES = \ src/pam_google_authenticator.c \ $(CORE_SRC) \ examples/demo.c examples_demo_CFLAGS = $(AM_CFLAGS) -DDEMO=1 super-clean: maintainer-clean rm -fr aclocal autom4te.cache/ m4 missing libtool config.guess rm -fr config.lt config.status config.sub configure depcomp rm -fr libtool install-sh *~ Makefile aclocal.m4 config.h.in ltmain.sh rm -fr Makefile.in test-driver compile google-authenticator/libpam/FILEFORMAT0000644000175000017500000000507612725566215016520 0ustar ocsiocsiAll configuration data and state is kept in ~/.google_authenticator The file is all ASCII, but is kept in a very simple-to-parse and rigid file format. The file size is currently limited to 1kB. This should be generous even when using a very large list of scratch codes. The first line is the base32 encoded secret. It uses characters in the range A..Z2..7. The following lines are optional. They all start with a double quote character, followed by a space character. Followed by an option name. Option names are all upper-case and must include an underscore. This ensures that they cannot accidentally appear anywhere else in the file. Options can be followed by option-specific parameters. Currently, the following options are recognized: DISALLOW_REUSE if present, this signals that a time-based token can be used at most once. Any attempt to log in using the same token will be denied. This means that users can typically not log in faster than once every ~30 seconds. The option is followed by a space-separated list of time stamps that have previously been used for login attempts. This option has no effect when HOTP_COUNTER is present. RATE_LIMIT n m ... this optional parameter restricts the number of logins to at most "n" within each "m" second interval. Additional parameters in this line are undocumented; they are used internally to keep track of state. TOTP_AUTH the presence of this option indicates that the secret can be used to authenticate users with a time-based token. HOTP_COUNTER n the presence of this option indicates that the secret can be used to authenticate users with a counter-based token. The argument "n" represents which counter value the token will accept next. It should be initialized to 1. WINDOW_SIZE n the default window size is 3, allowing up to one extra valid token before and after the currently active one. This might be too restrictive if the client and the server experience significant time skew. You can provide a parameter to increase the login window size from 3 to "n" In counter-based mode, this option is the number of valid tokens after the currently active one. The default is almost certainly too restrictive for most users as invalid login attempts and generated-but-not-used tokens both contribute to synchronization problems. Any all-numeric sequence of eight-digit numbers are randomly generated one-time tokens. The user can enter any arbitrary one-time code to log into his account. The code will then be removed from the file. google-authenticator/libpam/examples/0000755000175000017500000000000012725566215016753 5ustar ocsiocsigoogle-authenticator/libpam/examples/demo.c0000644000175000017500000001135712725566215020052 0ustar ocsiocsi// Demo wrapper for the PAM module. This is part of the Google Authenticator // project. // // Copyright 2011 Google Inc. // Author: Markus Gutschke // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. // #include "config.h" #include #include #include #include #include #include #include #include #include #include #include #include #include #if !defined(PAM_BAD_ITEM) // FreeBSD does not know about PAM_BAD_ITEM. And PAM_SYMBOL_ERR is an "enum", // we can't test for it at compile-time. #define PAM_BAD_ITEM PAM_SYMBOL_ERR #endif static struct termios old_termios; static int jmpbuf_valid; static sigjmp_buf jmpbuf; static int conversation(int num_msg, PAM_CONST struct pam_message **msg, struct pam_response **resp, void *appdata_ptr) { if (num_msg == 1 && (msg[0]->msg_style == PAM_PROMPT_ECHO_OFF || msg[0]->msg_style == PAM_PROMPT_ECHO_ON)) { *resp = malloc(sizeof(struct pam_response)); assert(*resp); (*resp)->resp = calloc(1024, 1); struct termios termios = old_termios; if (msg[0]->msg_style == PAM_PROMPT_ECHO_OFF) { termios.c_lflag &= ~(ECHO|ECHONL); } sigsetjmp(jmpbuf, 1); jmpbuf_valid = 1; sigset_t mask; sigemptyset(&mask); sigaddset(&mask, SIGTSTP); assert(!sigprocmask(SIG_UNBLOCK, &mask, NULL)); printf("%s ", msg[0]->msg); assert(!tcsetattr(0, TCSAFLUSH, &termios)); assert(fgets((*resp)->resp, 1024, stdin)); assert(!tcsetattr(0, TCSAFLUSH, &old_termios)); puts(""); assert(!sigprocmask(SIG_BLOCK, &mask, NULL)); jmpbuf_valid = 0; char *ptr = strrchr((*resp)->resp, '\n'); if (ptr) { *ptr = '\000'; } (*resp)->resp_retcode = 0; return PAM_SUCCESS; } return PAM_CONV_ERR; } #ifdef sun #define PAM_CONST #else #define PAM_CONST const #endif int pam_get_user(pam_handle_t *pamh, PAM_CONST char **user, const char *prompt) { return pam_get_item(pamh, PAM_USER, (void *)user); } int pam_get_item(const pam_handle_t *pamh, int item_type, PAM_CONST void **item) { switch (item_type) { case PAM_SERVICE: { static const char service[] = "google_authenticator_demo"; *item = service; return PAM_SUCCESS; } case PAM_USER: { char *user = getenv("USER"); *item = user; return PAM_SUCCESS; } case PAM_CONV: { static struct pam_conv conv = { .conv = conversation }, *p_conv = &conv; *item = p_conv; return PAM_SUCCESS; } default: return PAM_BAD_ITEM; } } int pam_set_item(pam_handle_t *pamh, int item_type, const void *item) { switch (item_type) { case PAM_AUTHTOK: return PAM_SUCCESS; default: return PAM_BAD_ITEM; } } static void print_diagnostics(int signo) { extern const char *get_error_msg(void); assert(!tcsetattr(0, TCSAFLUSH, &old_termios)); fprintf(stderr, "%s\n", get_error_msg()); _exit(1); } static void reset_console(int signo) { assert(!tcsetattr(0, TCSAFLUSH, &old_termios)); puts(""); _exit(1); } static void stop(int signo) { assert(!tcsetattr(0, TCSAFLUSH, &old_termios)); puts(""); raise(SIGSTOP); } static void cont(int signo) { if (jmpbuf_valid) { siglongjmp(jmpbuf, 0); } } int main(int argc, char *argv[]) { extern int pam_sm_authenticate(pam_handle_t *, int, int, const char **); // Try to redirect stdio to /dev/tty int fd = open("/dev/tty", O_RDWR); if (fd >= 0) { dup2(fd, 0); dup2(fd, 1); dup2(fd, 2); close(fd); } // Disable core files assert(!setrlimit(RLIMIT_CORE, (struct rlimit []){ { 0, 0 } })); // Set up error and job control handlers assert(!tcgetattr(0, &old_termios)); sigset_t mask; sigemptyset(&mask); sigaddset(&mask, SIGTSTP); assert(!sigprocmask(SIG_BLOCK, &mask, NULL)); assert(!signal(SIGABRT, print_diagnostics)); assert(!signal(SIGINT, reset_console)); assert(!signal(SIGTSTP, stop)); assert(!signal(SIGCONT, cont)); // Attempt login if (pam_sm_authenticate(NULL, 0, argc-1, (const char **)argv+1) != PAM_SUCCESS) { fprintf(stderr, "Login failed\n"); abort(); } return 0; } google-authenticator/libpam/README.md0000644000175000017500000001516212725566215016421 0ustar ocsiocsi# Google Authenticator PAM module Example PAM module demonstrating two-factor authentication. ## Build & install ```shell ./bootstrap.sh ./configure make sudo make install ``` If you don't have access to "sudo", you have to manually become "root" prior to calling "make install". ## Setting up the PAM module for your system For highest security, make sure that both password and OTP are being requested even if password and/or OTP are incorrect. This means that *at least* the first of `pam_unix.so` (or whatever other module is used to verify passwords) and `pam_google_authenticator.so` should be set as `required`, not `requisite`. It probably can't hurt to have both be `required`, but it could depend on the rest of your PAM config. If you use HOTP (counter based as opposed to time based) then add the option `no_increment_hotp` to make sure the counter isn't incremented for failed attempts. Add this line to your PAM configuration file: ` auth required pam_google_authenticator.so no_increment_hotp` ## Setting up a user Run the `google-authenticator` binary to create a new secret key in your home directory. These settings will be stored in `~/.google_authenticator`. If your system supports the "libqrencode" library, you will be shown a QRCode that you can scan using the Android "Google Authenticator" application. If your system does not have this library, you can either follow the URL that `google-authenticator` outputs, or you have to manually enter the alphanumeric secret key into the Android "Google Authenticator" application. In either case, after you have added the key, click-and-hold until the context menu shows. Then check that the key's verification value matches (this feature might not be available in all builds of the Android application). Each time you log into your system, you will now be prompted for your TOTP code (time based one-time-password) or HOTP (counter-based), depending on options given to `google-authenticator`, after having entered your normal user id and your normal UNIX account password. During the initial roll-out process, you might find that not all users have created a secret key yet. If you would still like them to be able to log in, you can pass the "nullok" option on the module's command line: ` auth required pam_google_authenticator.so nullok` ## Encrypted home directories If your system encrypts home directories until after your users entered their password, you either have to re-arrange the entries in the PAM configuration file to decrypt the home directory prior to asking for the OTP code, or you have to store the secret file in a non-standard location: ` auth required pam_google_authenticator.so secret=/var/unencrypted-home/${USER}/.google_authenticator` would be a possible choice. Make sure to set appropriate permissions. You also have to tell your users to manually move their .google_authenticator file to this location. In addition to "${USER}", the `secret=` option also recognizes both "~" and `${HOME}` as short-hands for the user's home directory. When using the `secret=` option, you might want to also set the `user=` option. The latter forces the PAM module to switch to a dedicated hard-coded user id prior to doing any file operations. When using the `user=` option, you must not include "~" or "${HOME}" in the filename. The `user=` option can also be useful if you want to authenticate users who do not have traditional UNIX accounts on your system. ## Module options ### secret=/path/to/secret/file See "encrypted home directories", above. ### user=some-user Force the PAM module to switch to a hard-coded user id prior to doing any file operations. Commonly used with `secret=`. ### no_strict_owner DANGEROUS OPTION! By default the PAM module requires that the secrets file must be owned the user logging in (or if `user=` is specified, owned by that user). This option disables that check. This option can be used to allow daemons not running as root to still handle configuration files not owned by that user, for example owned by the users themselves. ### allowed_perm=0nnn DANGEROUS OPTION! By default, the PAM module requires the secrets file to be readable only by the owner of the file (mode 0600 by default). In situations where the module is used in a non-default configuration, an administrator may need more leanient file permissions, or a specific setting for their use case. ### debug Enable more verbose log messages in syslog. ### try_first_pass / use_first_pass / forward_pass Some PAM clients cannot prompt the user for more than just the password. To work around this problem, this PAM module supports stacking. If you pass the `forward_pass` option, the `pam_google_authenticator` module queries the user for both the system password and the verification code in a single prompt. It then forwards the system password to the next PAM module, which will have to be configured with the `use_first_pass` option. In turn, `pam_google_authenticator` module also supports both the standard `use_first_pass` and `try_first_pass` options. But most users would not need to set those on the `pam_google_authenticator`. ### noskewadj If you discover that your TOTP code never works, this is most commonly the result of the clock on your server being different from the one on your Android device. The PAM module makes an attempt to compensate for time skew. You can teach it about the amount of skew that you are experiencing, by trying to log it three times in a row. Make sure you always wait 30s (but not longer), so that you get three distinct TOTP codes. Some administrators prefer that time skew isn't adjusted automatically, as doing so results in a slightly less secure system configuration. If you want to disable it, you can do so on the module command line: ` auth required pam_google_authenticator.so noskewadj` ### no_increment_hotp Don't increment the counter for failed HOTP attempts. This is important if log attempts with failed passwords still get an OTP prompt. ### nullok Allow users to log in without OTP, if they haven't set up OTP yet. ### echo_verification_code By default, the PAM module does not echo the verification code when it is entered by the user. In some situations, the administrator might prefer a different behavior. Pass the `echo_verification_code` option to the module in order to enable echoing. If you would like verification codes that are counter based instead of timebased, use the `google-authenticator` binary to generate a secret key in your home directory with the proper option. In this mode, clock skew is irrelevant and the window size option now applies to how many codes beyond the current one that would be accepted, to reduce synchronization problems. google-authenticator/libpam/totp.html0000644000175000017500000002231712725566215017016 0ustar ocsiocsi TOTP Debugger

TOTP Debugger

Enter secret key in BASE32:            
Account label: 
Interval: 30s 
Time:   
Timestamp:   
TOTP:   



WARNING! This website is a development and debugging tool only. Do not use it to generate security tokens for logging into your account. You should never store, process or otherwise access the secret key on the same machine that you use for accessing your account. Doing so completely defeats the security of two-step verification.

Instead, use one of the mobile phone clients made available by the Google Authenticator project. Or follow the instructions provided by Google.

If you ever entered your real secret key into this website, please immediately reset your secret key.

google-authenticator/libpam/contrib/0000755000175000017500000000000012725566215016575 5ustar ocsiocsigoogle-authenticator/libpam/contrib/rpm.spec.in0000644000175000017500000000264212725566215020660 0ustar ocsiocsiName: @PACKAGE_NAME@ Version: @VERSION@ %if %{?_release:1}0 Release: %{_release}%{?dist} %else Release: 1%{?dist} %endif Summary: One-time passcode support using open standards License: ASL 2.0 URL: https://github.com/google/google-authenticator Source0: %{name}-%{version}.tar.gz BuildRequires: gcc BuildRequires: pam-devel BuildRequires: libtool %description The Google Authenticator package contains a pluggable authentication module (PAM) which allows login using one-time passcodes conforming to the open standards developed by the Initiative for Open Authentication (OATH) (which is unrelated to OAuth). Passcode generators are available (separately) for several mobile platforms. These implementations support the HMAC-Based One-time Password (HOTP) algorithm specified in RFC 4226 and the Time-based One-time Password (TOTP) algorithm specified in RFC 6238. %prep %setup -q %build %configure --libdir=/%{_lib} make %{?_smp_mflags} %install rm -rf $RPM_BUILD_ROOT make install DESTDIR=$RPM_BUILD_ROOT rm $RPM_BUILD_ROOT/%{_lib}/security/pam_google_authenticator.la %files /%{_lib}/security/pam_google_authenticator.so %{_bindir}/%{name} %{_defaultdocdir}/%{name}/README.md %{_defaultdocdir}/%{name}/totp.html %{_defaultdocdir}/%{name}/FILEFORMAT %changelog * Wed Jan 13 2016 Dan Molik - 1.01 - A new and updated build for google-authenticator google-authenticator/libpam/contrib/README.rpm.md0000644000175000017500000000230712725566215020653 0ustar ocsiocsi## Building a Google-Authenticator RPM Please note the RPM does not require QR-Encode as a dependency, As technically the module builds fine without it. But in all likely- hood you will need it in an actual deployment. Building a QR-Encode RPM is outside the scope of this documentation, see the in-repo documentation for instructions. https://github.com/fukuchi/libqrencode If you are using RPMs in your testing a new build number option has been added to the spec file IE: --define '_release #' to where # is a build number. This will generate a RPM in the namespace: google-authenticator-1.01-#.el6.x86_64.rpm where # is your specified build number. If no _release is set the build is defaulted to 1. Example: ``` rpmbuild -ba contrib/rpm.spec --define '_release 8' ``` This will generate an rpm of: ``` google-authenticator-1.01-8.el6.x86_64.rpm ``` ### Requirements * gcc * libtool * autoconf * automake * libpam-devel * rpm-builder * qr-encode (optional) ### Process ```shell git clone https://github.com/google/google-authenticator.git cd google-authenticator/libpam ./autogen.sh ./configure make dist cp google-autheticator-#.##.tar.gz ~/rpmbuild/SOURCES/ rpmbuild -ba contrib/rpm.spec ``` google-authenticator/libpam/bootstrap.sh0000755000175000017500000000003512725566215017507 0ustar ocsiocsi#!/bin/sh exec autoreconf -i google-authenticator/libpam/utc-time/0000755000175000017500000000000012725566215016664 5ustar ocsiocsigoogle-authenticator/libpam/utc-time/utc-time.py0000644000175000017500000000045412725566215020770 0ustar ocsiocsi#!/usr/bin/env python import time t = time.time() u = time.gmtime(t) s = time.strftime('%a, %e %b %Y %T GMT', u) print 'Content-Type: text/javascript' print 'Cache-Control: no-cache' print 'Date: ' + s print 'Expires: ' + s print '' print 'var timeskew = new Date().getTime() - ' + str(t*1000) + ';' google-authenticator/libpam/utc-time/app.yaml0000644000175000017500000000017512725566215020333 0ustar ocsiocsiapplication: utc-time version: 1 runtime: python api_version: 1 handlers: - url: /.* script: utc-time.py secure: always google-authenticator/libpam/tests/0000755000175000017500000000000012725566215016277 5ustar ocsiocsigoogle-authenticator/libpam/tests/pam_google_authenticator_unittest.c0000644000175000017500000005500112725566215025446 0ustar ocsiocsi// Unittest for the PAM module. This is part of the Google Authenticator // project. // // Copyright 2010 Google Inc. // Author: Markus Gutschke // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. #include "config.h" #include #include #include #include #include #include #include #include #include #include #include #include #include "../src/base32.h" #include "../src/hmac.h" #if !defined(PAM_BAD_ITEM) // FreeBSD does not know about PAM_BAD_ITEM. And PAM_SYMBOL_ERR is an "enum", // we can't test for it at compile-time. #define PAM_BAD_ITEM PAM_SYMBOL_ERR #endif static PAM_CONST char pw[] = "0123456789"; static char *response = ""; static void *pam_module; static enum { TWO_PROMPTS, COMBINED_PASSWORD, COMBINED_PROMPT } conv_mode; static int num_prompts_shown = 0; static int conversation(int num_msg, PAM_CONST struct pam_message **msg, struct pam_response **resp, void *appdata_ptr) { // Keep track of how often the conversation callback is executed. ++num_prompts_shown; if (conv_mode == COMBINED_PASSWORD) { return PAM_CONV_ERR; } if (num_msg == 1 && msg[0]->msg_style == PAM_PROMPT_ECHO_OFF) { *resp = malloc(sizeof(struct pam_response)); assert(*resp); (*resp)->resp = conv_mode == TWO_PROMPTS ? strdup(response) : strcat(strcpy(malloc(sizeof(pw) + strlen(response)), pw), response); (*resp)->resp_retcode = 0; return PAM_SUCCESS; } return PAM_CONV_ERR; } int pam_get_user(pam_handle_t *pamh, PAM_CONST char **user, PAM_CONST char *prompt) __attribute__((visibility("default"))); int pam_get_user(pam_handle_t *pamh, PAM_CONST char **user, PAM_CONST char *prompt) { return pam_get_item(pamh, PAM_USER, (void *)user); } int pam_get_item(const pam_handle_t *pamh, int item_type, PAM_CONST void **item) __attribute__((visibility("default"))); int pam_get_item(const pam_handle_t *pamh, int item_type, PAM_CONST void **item) { switch (item_type) { case PAM_SERVICE: { static const char *service = "google_authenticator_unittest"; *item = service; return PAM_SUCCESS; } case PAM_USER: { char *user = getenv("USER"); *item = user; return PAM_SUCCESS; } case PAM_CONV: { static struct pam_conv conv = { .conv = conversation }, *p_conv = &conv; *item = p_conv; return PAM_SUCCESS; } case PAM_AUTHTOK: { static char *authtok = NULL; if (conv_mode == COMBINED_PASSWORD) { authtok = realloc(authtok, sizeof(pw) + strlen(response)); *item = strcat(strcpy(authtok, pw), response); } else { *item = pw; } return PAM_SUCCESS; } default: return PAM_BAD_ITEM; } } int pam_set_item(pam_handle_t *pamh, int item_type, const void *item) __attribute__((visibility("default"))); int pam_set_item(pam_handle_t *pamh, int item_type, const void *item) { switch (item_type) { case PAM_AUTHTOK: if (strcmp((char *)item, pw)) { return PAM_BAD_ITEM; } return PAM_SUCCESS; default: return PAM_BAD_ITEM; } } // Return the last line of the error message. static const char *get_error_msg(void) { const char *(*get_error_msg)(void) = (const char *(*)(void))dlsym(pam_module, "get_error_msg"); const char* msg = get_error_msg ? get_error_msg() : ""; const char* p = strrchr(msg, '\n'); if (p) { msg = p+1; } return msg; } static void print_diagnostics(int signo) { if (*get_error_msg()) { fprintf(stderr, "%s\n", get_error_msg()); } _exit(1); } #define verify_prompts_shown(expected_prompts_shown) do { \ assert(num_prompts_shown == (expected_prompts_shown)); \ num_prompts_shown = 0; /* Reset for the next count. */ \ } while(0) int main(int argc, char *argv[]) { // Testing Base32 encoding puts("Testing base32 encoding"); static const uint8_t dat[] = "Hello world..."; uint8_t enc[((sizeof(dat) + 4)/5)*8 + 1]; assert(base32_encode(dat, sizeof(dat), enc, sizeof(enc)) == sizeof(enc)-1); assert(!strcmp((char *)enc, "JBSWY3DPEB3W64TMMQXC4LQA")); puts("Testing base32 decoding"); uint8_t dec[sizeof(dat)]; assert(base32_decode(enc, dec, sizeof(dec)) == sizeof(dec)); assert(!memcmp(dat, dec, sizeof(dat))); // Testing HMAC_SHA1 puts("Testing HMAC_SHA1"); uint8_t hmac[20]; hmac_sha1((uint8_t *)"\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C" "\x0D\x0E\x0F\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19" "\x1A\x1B\x1C\x1D\x1E\x1F !\"#$%&'()*+,-./0123456789:" ";<=>?", 64, (uint8_t *)"Sample #1", 9, hmac, sizeof(hmac)); assert(!memcmp(hmac, (uint8_t []) { 0x4F, 0x4C, 0xA3, 0xD5, 0xD6, 0x8B, 0xA7, 0xCC, 0x0A, 0x12, 0x08, 0xC9, 0xC6, 0x1E, 0x9C, 0x5D, 0xA0, 0x40, 0x3C, 0x0A }, sizeof(hmac))); hmac_sha1((uint8_t *)"0123456789:;<=>?@ABC", 20, (uint8_t *)"Sample #2", 9, hmac, sizeof(hmac)); assert(!memcmp(hmac, (uint8_t []) { 0x09, 0x22, 0xD3, 0x40, 0x5F, 0xAA, 0x3D, 0x19, 0x4F, 0x82, 0xA4, 0x58, 0x30, 0x73, 0x7D, 0x5C, 0xC6, 0xC7, 0x5D, 0x24 }, sizeof(hmac))); hmac_sha1((uint8_t *)"PQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" "\x7F\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8A" "\x8B\x8C\x8D\x8E\x8F\x90\x91\x92\x93\x94\x95\x96" "\x97\x98\x99\x9A\x9B\x9C\x9D\x9E\x9F\xA0\xA1\xA2" "\xA3\xA4\xA5\xA6\xA7\xA8\xA9\xAA\xAB\xAC\xAD\xAE" "\xAF\xB0\xB1\xB2\xB3", 100, (uint8_t *)"Sample #3", 9, hmac, sizeof(hmac)); assert(!memcmp(hmac, (uint8_t []) { 0xBC, 0xF4, 0x1E, 0xAB, 0x8B, 0xB2, 0xD8, 0x02, 0xF3, 0xD0, 0x5C, 0xAF, 0x7C, 0xB0, 0x92, 0xEC, 0xF8, 0xD1, 0xA3, 0xAA }, sizeof(hmac))); hmac_sha1((uint8_t *)"pqrstuvwxyz{|}~\x7F\x80\x81\x82\x83\x84\x85\x86\x87" "\x88\x89\x8A\x8B\x8C\x8D\x8E\x8F\x90\x91\x92\x93\x94" "\x95\x96\x97\x98\x99\x9A\x9B\x9C\x9D\x9E\x9F\xA0", 49, (uint8_t *)"Sample #4", 9, hmac, sizeof(hmac)); assert(!memcmp(hmac, (uint8_t []) { 0x9E, 0xA8, 0x86, 0xEF, 0xE2, 0x68, 0xDB, 0xEC, 0xCE, 0x42, 0x0C, 0x75, 0x24, 0xDF, 0x32, 0xE0, 0x75, 0x1A, 0x2A, 0x26 }, sizeof(hmac))); // Load the PAM module puts("Loading PAM module"); pam_module = dlopen("./.libs/libpam_google_authenticator_testing.so", RTLD_NOW | RTLD_GLOBAL); if (pam_module == NULL) { fprintf(stderr, "dlopen(): %s\n", dlerror()); exit(1); } signal(SIGABRT, print_diagnostics); // Look up public symbols int (*pam_sm_authenticate)(pam_handle_t *, int, int, const char **) = (int (*)(pam_handle_t *, int, int, const char **)) dlsym(pam_module, "pam_sm_authenticate"); assert(pam_sm_authenticate != NULL); // Look up private test-only API void (*set_time)(time_t t) = (void (*)(time_t))dlsym(pam_module, "set_time"); assert(set_time); int (*compute_code)(uint8_t *, int, unsigned long) = (int (*)(uint8_t*, int, unsigned long))dlsym(pam_module, "compute_code"); assert(compute_code); for (int otp_mode = 0; otp_mode < 8; ++otp_mode) { // Create a secret file with a well-known test vector char fn[] = "/tmp/.google_authenticator_XXXXXX"; mode_t orig_umask = umask(S_IRWXG|S_IRWXO); // Only for the current user. int fd = mkstemp(fn); (void)umask(orig_umask); assert(fd >= 0); static const uint8_t secret[] = "2SH3V3GDW7ZNMGYE"; assert(write(fd, secret, sizeof(secret)-1) == sizeof(secret)-1); assert(write(fd, "\n\" TOTP_AUTH", 12) == 12); close(fd); uint8_t binary_secret[sizeof(secret)]; size_t binary_secret_len = base32_decode(secret, binary_secret, sizeof(binary_secret)); // Set up test argc/argv parameters to let the PAM module know where to // find our secret file const char *targv[] = { malloc(strlen(fn) + 8), NULL, NULL, NULL, NULL }; strcat(strcpy((char *)targv[0], "secret="), fn); int targc; int expected_good_prompts_shown; int expected_bad_prompts_shown; switch (otp_mode) { case 0: puts("\nRunning tests, querying for verification code"); conv_mode = TWO_PROMPTS; targc = 1; expected_good_prompts_shown = expected_bad_prompts_shown = 1; break; case 1: puts("\nRunning tests, querying for verification code, " "forwarding system pass"); conv_mode = COMBINED_PROMPT; targv[1] = strdup("forward_pass"); targc = 2; expected_good_prompts_shown = expected_bad_prompts_shown = 1; break; case 2: puts("\nRunning tests with use_first_pass"); conv_mode = COMBINED_PASSWORD; targv[1] = strdup("use_first_pass"); targc = 2; expected_good_prompts_shown = expected_bad_prompts_shown = 0; break; case 3: puts("\nRunning tests with use_first_pass, forwarding system pass"); conv_mode = COMBINED_PASSWORD; targv[1] = strdup("use_first_pass"); targv[2] = strdup("forward_pass"); targc = 3; expected_good_prompts_shown = expected_bad_prompts_shown = 0; break; case 4: puts("\nRunning tests with try_first_pass, combining codes"); conv_mode = COMBINED_PASSWORD; targv[1] = strdup("try_first_pass"); targc = 2; expected_good_prompts_shown = 0; expected_bad_prompts_shown = 2; break; case 5: puts("\nRunning tests with try_first_pass, combining codes, " "forwarding system pass"); conv_mode = COMBINED_PASSWORD; targv[1] = strdup("try_first_pass"); targv[2] = strdup("forward_pass"); targc = 3; expected_good_prompts_shown = 0; expected_bad_prompts_shown = 2; break; case 6: puts("\nRunning tests with try_first_pass, querying for codes"); conv_mode = TWO_PROMPTS; targv[1] = strdup("try_first_pass"); targc = 2; expected_good_prompts_shown = expected_bad_prompts_shown = 1; break; default: assert(otp_mode == 7); puts("\nRunning tests with try_first_pass, querying for codes, " "forwarding system pass"); conv_mode = COMBINED_PROMPT; targv[1] = strdup("try_first_pass"); targv[2] = strdup("forward_pass"); targc = 3; expected_good_prompts_shown = expected_bad_prompts_shown = 1; break; } // Make sure num_prompts_shown is still 0. verify_prompts_shown(0); // Set the timestamp that this test vector needs set_time(10000*30); response = "123456"; // Check if we can log in when using an invalid verification code puts("Testing failed login attempt"); assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_AUTH_ERR); verify_prompts_shown(expected_bad_prompts_shown); // Check required number of digits if (conv_mode == TWO_PROMPTS) { puts("Testing required number of digits"); response = "50548"; assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_AUTH_ERR); verify_prompts_shown(expected_bad_prompts_shown); response = "0050548"; assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_AUTH_ERR); verify_prompts_shown(expected_bad_prompts_shown); response = "00050548"; assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_AUTH_ERR); verify_prompts_shown(expected_bad_prompts_shown); } // Test a blank response puts("Testing a blank response"); response = ""; assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_AUTH_ERR); verify_prompts_shown(expected_bad_prompts_shown); // Set the response that we should send back to the authentication module response = "050548"; // Test handling of missing state files puts("Test handling of missing state files"); const char *old_secret = targv[0]; targv[0] = "secret=/NOSUCHFILE"; assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_AUTH_ERR); verify_prompts_shown(0); targv[targc++] = "nullok"; targv[targc] = NULL; assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_SUCCESS); verify_prompts_shown(0); targv[--targc] = NULL; targv[0] = old_secret; // Check if we can log in when using a valid verification code puts("Testing successful login"); assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_SUCCESS); verify_prompts_shown(expected_good_prompts_shown); // Test the STEP_SIZE option puts("Testing STEP_SIZE option"); assert(!chmod(fn, 0600)); assert((fd = open(fn, O_APPEND | O_WRONLY)) >= 0); assert(write(fd, "\n\" STEP_SIZE 60\n", 16) == 16); close(fd); for (int *tm = (int []){ 9998, 9999, 10001, 10002, 10000, -1 }, *res = (int []){ PAM_AUTH_ERR, PAM_SUCCESS, PAM_SUCCESS, PAM_AUTH_ERR, PAM_SUCCESS }; *tm >= 0;) { set_time(*tm++ * 60); assert(pam_sm_authenticate(NULL, 0, targc, targv) == *res++); verify_prompts_shown(expected_good_prompts_shown); } // Reset secret file after step size testing. assert(!chmod(fn, 0600)); assert((fd = open(fn, O_TRUNC | O_WRONLY)) >= 0); assert(write(fd, secret, sizeof(secret)-1) == sizeof(secret)-1); assert(write(fd, "\n\" TOTP_AUTH", 12) == 12); close(fd); // Test the WINDOW_SIZE option puts("Testing WINDOW_SIZE option"); for (int *tm = (int []){ 9998, 9999, 10001, 10002, 10000, -1 }, *res = (int []){ PAM_AUTH_ERR, PAM_SUCCESS, PAM_SUCCESS, PAM_AUTH_ERR, PAM_SUCCESS }; *tm >= 0;) { set_time(*tm++ * 30); assert(pam_sm_authenticate(NULL, 0, targc, targv) == *res++); verify_prompts_shown(expected_good_prompts_shown); } assert(!chmod(fn, 0600)); assert((fd = open(fn, O_APPEND | O_WRONLY)) >= 0); assert(write(fd, "\n\" WINDOW_SIZE 6\n", 17) == 17); close(fd); for (int *tm = (int []){ 9996, 9997, 10002, 10003, 10000, -1 }, *res = (int []){ PAM_AUTH_ERR, PAM_SUCCESS, PAM_SUCCESS, PAM_AUTH_ERR, PAM_SUCCESS }; *tm >= 0;) { set_time(*tm++ * 30); assert(pam_sm_authenticate(NULL, 0, targc, targv) == *res++); verify_prompts_shown(expected_good_prompts_shown); } // Test the DISALLOW_REUSE option puts("Testing DISALLOW_REUSE option"); assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_SUCCESS); verify_prompts_shown(expected_good_prompts_shown); assert(!chmod(fn, 0600)); assert((fd = open(fn, O_APPEND | O_WRONLY)) >= 0); assert(write(fd, "\" DISALLOW_REUSE\n", 17) == 17); close(fd); assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_SUCCESS); verify_prompts_shown(expected_good_prompts_shown); assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_AUTH_ERR); verify_prompts_shown(expected_good_prompts_shown); // Test that DISALLOW_REUSE expires old entries from the re-use list char *old_response = response; for (int i = 10001; i < 10008; ++i) { set_time(i * 30); char buf[7]; response = buf; sprintf(response, "%06d", compute_code(binary_secret, binary_secret_len, i)); assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_SUCCESS); verify_prompts_shown(expected_good_prompts_shown); } set_time(10000 * 30); response = old_response; assert((fd = open(fn, O_RDONLY)) >= 0); char state_file_buf[4096] = { 0 }; assert(read(fd, state_file_buf, sizeof(state_file_buf)-1) > 0); close(fd); const char *disallow = strstr(state_file_buf, "\" DISALLOW_REUSE "); assert(disallow); assert(!memcmp(disallow + 17, "10002 10003 10004 10005 10006 10007\n", 36)); // Test the RATE_LIMIT option puts("Testing RATE_LIMIT option"); assert(!chmod(fn, 0600)); assert((fd = open(fn, O_APPEND | O_WRONLY)) >= 0); assert(write(fd, "\" RATE_LIMIT 4 120\n", 19) == 19); close(fd); for (int *tm = (int []){ 20000, 20001, 20002, 20003, 20004, 20006, -1 }, *res = (int []){ PAM_SUCCESS, PAM_SUCCESS, PAM_SUCCESS, PAM_SUCCESS, PAM_AUTH_ERR, PAM_SUCCESS, -1 }; *tm >= 0;) { set_time(*tm * 30); char buf[7]; response = buf; sprintf(response, "%06d", compute_code(binary_secret, binary_secret_len, *tm++)); assert(pam_sm_authenticate(NULL, 0, targc, targv) == *res); verify_prompts_shown( *res != PAM_SUCCESS ? 0 : expected_good_prompts_shown); ++res; } set_time(10000 * 30); response = old_response; assert(!chmod(fn, 0600)); assert((fd = open(fn, O_RDWR)) >= 0); memset(state_file_buf, 0, sizeof(state_file_buf)); assert(read(fd, state_file_buf, sizeof(state_file_buf)-1) > 0); const char *rate_limit = strstr(state_file_buf, "\" RATE_LIMIT "); assert(rate_limit); assert(!memcmp(rate_limit + 13, "4 120 600060 600090 600120 600180\n", 35)); // Test trailing space in RATE_LIMIT. This is considered a file format // error. char *eol = strchr(rate_limit, '\n'); *eol = ' '; assert(!lseek(fd, 0, SEEK_SET)); assert(write(fd, state_file_buf, strlen(state_file_buf)) == strlen(state_file_buf)); close(fd); assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_AUTH_ERR); verify_prompts_shown(0); assert(!strncmp(get_error_msg(), "Invalid list of timestamps in RATE_LIMIT", 40)); *eol = '\n'; assert(!chmod(fn, 0600)); assert((fd = open(fn, O_WRONLY)) >= 0); assert(write(fd, state_file_buf, strlen(state_file_buf)) == strlen(state_file_buf)); close(fd); // Test TIME_SKEW option puts("Testing TIME_SKEW"); for (int i = 0; i < 4; ++i) { set_time((12000 + i)*30); char buf[7]; response = buf; sprintf(response, "%06d", compute_code(binary_secret, binary_secret_len, 11000 + i)); assert(pam_sm_authenticate(NULL, 0, targc, targv) == (i >= 2 ? PAM_SUCCESS : PAM_AUTH_ERR)); verify_prompts_shown(expected_good_prompts_shown); } set_time(12010 * 30); char buf[7]; response = buf; sprintf(response, "%06d", compute_code(binary_secret, binary_secret_len, 11010)); assert(pam_sm_authenticate(NULL, 0, 1, (const char *[]){ "noskewadj", 0 }) == PAM_AUTH_ERR); verify_prompts_shown(0); set_time(10000*30); // Test scratch codes puts("Testing scratch codes"); response = "12345678"; assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_AUTH_ERR); verify_prompts_shown(expected_bad_prompts_shown); assert(!chmod(fn, 0600)); assert((fd = open(fn, O_APPEND | O_WRONLY)) >= 0); assert(write(fd, "12345678\n", 9) == 9); close(fd); assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_SUCCESS); verify_prompts_shown(expected_good_prompts_shown); assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_AUTH_ERR); verify_prompts_shown(expected_bad_prompts_shown); // Set up secret file for counter-based codes. assert(!chmod(fn, 0600)); assert((fd = open(fn, O_TRUNC | O_WRONLY)) >= 0); assert(write(fd, secret, sizeof(secret)-1) == sizeof(secret)-1); assert(write(fd, "\n\" HOTP_COUNTER 1\n", 18) == 18); close(fd); response = "293240"; // Check if we can log in when using a valid verification code puts("Testing successful counter-based login"); assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_SUCCESS); verify_prompts_shown(expected_good_prompts_shown); // Verify that the hotp counter incremented assert((fd = open(fn, O_RDONLY)) >= 0); memset(state_file_buf, 0, sizeof(state_file_buf)); assert(read(fd, state_file_buf, sizeof(state_file_buf)-1) > 0); close(fd); const char *hotp_counter = strstr(state_file_buf, "\" HOTP_COUNTER "); assert(hotp_counter); assert(!memcmp(hotp_counter + 15, "2\n", 2)); // Check if we can log in when using an invalid verification code // (including the same code a second time) puts("Testing failed counter-based login attempt"); assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_AUTH_ERR); verify_prompts_shown(expected_bad_prompts_shown); // Verify that the hotp counter incremented assert((fd = open(fn, O_RDONLY)) >= 0); memset(state_file_buf, 0, sizeof(state_file_buf)); assert(read(fd, state_file_buf, sizeof(state_file_buf)-1) > 0); close(fd); hotp_counter = strstr(state_file_buf, "\" HOTP_COUNTER "); assert(hotp_counter); assert(!memcmp(hotp_counter + 15, "3\n", 2)); response = "932068"; // Check if we can log in using a future valid verification code (using // default window_size of 3) puts("Testing successful future counter-based login"); assert(pam_sm_authenticate(NULL, 0, targc, targv) == PAM_SUCCESS); verify_prompts_shown(expected_good_prompts_shown); // Verify that the hotp counter incremented assert((fd = open(fn, O_RDONLY)) >= 0); memset(state_file_buf, 0, sizeof(state_file_buf)); assert(read(fd, state_file_buf, sizeof(state_file_buf)-1) > 0); close(fd); hotp_counter = strstr(state_file_buf, "\" HOTP_COUNTER "); assert(hotp_counter); assert(!memcmp(hotp_counter + 15, "6\n", 2)); // Remove the temporarily created secret file unlink(fn); // Release memory for the test arguments for (int i = 0; i < targc; ++i) { free((void *)targv[i]); } } // Unload the PAM module dlclose(pam_module); puts("DONE"); return 0; } google-authenticator/libpam/src/0000755000175000017500000000000012725566215015724 5ustar ocsiocsigoogle-authenticator/libpam/src/google-authenticator.c0000644000175000017500000006452712725566215022232 0ustar ocsiocsi// Helper program to generate a new secret for use in two-factor // authentication. // // Copyright 2010 Google Inc. // Author: Markus Gutschke // // Licensed under the Apache License, Version 2.0 (the "License"); // you may not use this file except in compliance with the License. // You may obtain a copy of the License at // // http://www.apache.org/licenses/LICENSE-2.0 // // Unless required by applicable law or agreed to in writing, software // distributed under the License is distributed on an "AS IS" BASIS, // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. // See the License for the specific language governing permissions and // limitations under the License. #include "config.h" #include #include #include #include #include #include #include #include #include #include #include #include #include "base32.h" #include "hmac.h" #include "sha1.h" #define SECRET "/.google_authenticator" #define SECRET_BITS 128 // Must be divisible by eight #define VERIFICATION_CODE_MODULUS (1000*1000) // Six digits #define SCRATCHCODES 5 // Number of initial scratchcodes #define SCRATCHCODE_LENGTH 8 // Eight digits per scratchcode #define BYTES_PER_SCRATCHCODE 4 // 32bit of randomness is enough #define BITS_PER_BASE32_CHAR 5 // Base32 expands space by 8/5 static enum { QR_UNSET=0, QR_NONE, QR_ANSI, QR_UTF8 } qr_mode = QR_UNSET; static int generateCode(const char *key, unsigned long tm) { uint8_t challenge[8]; for (int i = 8; i--; tm >>= 8) { challenge[i] = tm; } // Estimated number of bytes needed to represent the decoded secret. Because // of white-space and separators, this is an upper bound of the real number, // which we later get as a return-value from base32_decode() int secretLen = (strlen(key) + 7)/8*BITS_PER_BASE32_CHAR; // Sanity check, that our secret will fixed into a reasonably-sized static // array. if (secretLen <= 0 || secretLen > 100) { return -1; } // Decode secret from Base32 to a binary representation, and check that we // have at least one byte's worth of secret data. uint8_t secret[100]; if ((secretLen = base32_decode((const uint8_t *)key, secret, secretLen))<1) { return -1; } // Compute the HMAC_SHA1 of the secret and the challenge. uint8_t hash[SHA1_DIGEST_LENGTH]; hmac_sha1(secret, secretLen, challenge, 8, hash, SHA1_DIGEST_LENGTH); // Pick the offset where to sample our hash value for the actual verification // code. int offset = hash[SHA1_DIGEST_LENGTH - 1] & 0xF; // Compute the truncated hash in a byte-order independent loop. unsigned int truncatedHash = 0; for (int i = 0; i < 4; ++i) { truncatedHash <<= 8; truncatedHash |= hash[offset + i]; } // Truncate to a smaller number of digits. truncatedHash &= 0x7FFFFFFF; truncatedHash %= VERIFICATION_CODE_MODULUS; return truncatedHash; } static const char *getUserName(uid_t uid) { struct passwd pwbuf, *pw; char *buf; #ifdef _SC_GETPW_R_SIZE_MAX int len = sysconf(_SC_GETPW_R_SIZE_MAX); if (len <= 0) { len = 4096; } #else int len = 4096; #endif buf = malloc(len); char *user; if (getpwuid_r(uid, &pwbuf, buf, len, &pw) || !pw) { user = malloc(32); snprintf(user, 32, "%d", uid); } else { user = strdup(pw->pw_name); if (!user) { perror("malloc()"); _exit(1); } } free(buf); return user; } static const char *urlEncode(const char *s) { char *ret = malloc(3*strlen(s) + 1); char *d = ret; do { switch (*s) { case '%': case '&': case '?': case '=': encode: sprintf(d, "%%%02X", (unsigned char)*s); d += 3; break; default: if ((*s && *s <= ' ') || *s >= '\x7F') { goto encode; } *d++ = *s; break; } } while (*s++); ret = realloc(ret, strlen(ret) + 1); return ret; } static const char *getURL(const char *secret, const char *label, char **encoderURL, const int use_totp, const char *issuer) { const char *encodedLabel = urlEncode(label); char *url; char totp = use_totp ? 't' : 'h'; if (asprintf(&url, "otpauth://%cotp/%s?secret=%s", totp, encodedLabel, secret) < 0) { fprintf(stderr, "String allocation failed, probably running out of memory.\n"); _exit(1); } if (issuer != NULL && strlen(issuer) > 0) { // Append to URL &issuer= const char *encodedIssuer = urlEncode(issuer); char *newUrl; if (asprintf(&newUrl, "%s&issuer=%s", url, encodedIssuer) < 0) { fprintf(stderr, "String allocation failed, probably running out of memory.\n"); _exit(1); } free((void *)encodedIssuer); free(url); url = newUrl; } if (encoderURL) { // Show a QR code. const char *encoder = "https://www.google.com/chart?chs=200x200&" "chld=M|0&cht=qr&chl="; const char *encodedURL = urlEncode(url); *encoderURL = strcat(strcpy(malloc(strlen(encoder) + strlen(encodedURL) + 1), encoder), encodedURL); free((void *)encodedURL); } free((void *)encodedLabel); return url; } #define ANSI_RESET "\x1B[0m" #define ANSI_BLACKONGREY "\x1B[30;47;27m" #define ANSI_WHITE "\x1B[27m" #define ANSI_BLACK "\x1B[7m" #define UTF8_BOTH "\xE2\x96\x88" #define UTF8_TOPHALF "\xE2\x96\x80" #define UTF8_BOTTOMHALF "\xE2\x96\x84" static void displayQRCode(const char *secret, const char *label, const int use_totp, const char *issuer) { if (qr_mode == QR_NONE) { return; } char *encoderURL; const char *url = getURL(secret, label, &encoderURL, use_totp, issuer); puts(encoderURL); // Only newer systems have support for libqrencode. So, instead of requiring // it at build-time, we look for it at run-time. If it cannot be found, the // user can still type the code in manually, or he can copy the URL into // his browser. if (isatty(1)) { void *qrencode = dlopen("libqrencode.so.2", RTLD_NOW | RTLD_LOCAL); if (!qrencode) { qrencode = dlopen("libqrencode.so.3", RTLD_NOW | RTLD_LOCAL); } if (!qrencode) { qrencode = dlopen("libqrencode.dylib.3", RTLD_NOW | RTLD_LOCAL); } if (qrencode) { typedef struct { int version; int width; unsigned char *data; } QRcode; QRcode *(*QRcode_encodeString8bit)(const char *, int, int) = (QRcode *(*)(const char *, int, int)) dlsym(qrencode, "QRcode_encodeString8bit"); void (*QRcode_free)(QRcode *qrcode) = (void (*)(QRcode *))dlsym(qrencode, "QRcode_free"); if (QRcode_encodeString8bit && QRcode_free) { QRcode *qrcode = QRcode_encodeString8bit(url, 0, 1); char *ptr = (char *)qrcode->data; // Output QRCode using ANSI colors. Instead of black on white, we // output black on grey, as that works independently of whether the // user runs his terminals in a black on white or white on black color // scheme. // But this requires that we print a border around the entire QR Code. // Otherwise, readers won't be able to recognize it. if (qr_mode != QR_UTF8) { for (int i = 0; i < 2; ++i) { printf(ANSI_BLACKONGREY); for (int x = 0; x < qrcode->width + 4; ++x) printf(" "); puts(ANSI_RESET); } for (int y = 0; y < qrcode->width; ++y) { printf(ANSI_BLACKONGREY" "); int isBlack = 0; for (int x = 0; x < qrcode->width; ++x) { if (*ptr++ & 1) { if (!isBlack) { printf(ANSI_BLACK); } isBlack = 1; } else { if (isBlack) { printf(ANSI_WHITE); } isBlack = 0; } printf(" "); } if (isBlack) { printf(ANSI_WHITE); } puts(" "ANSI_RESET); } for (int i = 0; i < 2; ++i) { printf(ANSI_BLACKONGREY); for (int x = 0; x < qrcode->width + 4; ++x) printf(" "); puts(ANSI_RESET); } } else { // Drawing the QRCode with Unicode block elements is desirable as // it makes the code much smaller, which is often easier to scan. // Unfortunately, many terminal emulators do not display these // Unicode characters properly. printf(ANSI_BLACKONGREY); for (int i = 0; i < qrcode->width + 4; ++i) { printf(" "); } puts(ANSI_RESET); for (int y = 0; y < qrcode->width; y += 2) { printf(ANSI_BLACKONGREY" "); for (int x = 0; x < qrcode->width; ++x) { int top = qrcode->data[y*qrcode->width + x] & 1; int bottom = 0; if (y+1 < qrcode->width) { bottom = qrcode->data[(y+1)*qrcode->width + x] & 1; } if (top) { if (bottom) { printf(UTF8_BOTH); } else { printf(UTF8_TOPHALF); } } else { if (bottom) { printf(UTF8_BOTTOMHALF); } else { printf(" "); } } } puts(" "ANSI_RESET); } printf(ANSI_BLACKONGREY); for (int i = 0; i < qrcode->width + 4; ++i) { printf(" "); } puts(ANSI_RESET); } QRcode_free(qrcode); } dlclose(qrencode); } } free((char *)url); free(encoderURL); } static int maybe(const char *msg) { printf("\n"); for (;;) { char line[128]; printf("%s (y/n) ", msg); fflush(stdout); line[sizeof(line)-1] = 0; if (NULL == fgets(line, sizeof(line), stdin)) { if (errno == 0) { printf("\n"); } else { perror("getline()"); } exit(1); } switch (line[0]) { case 'Y': case 'y': return 1; case 'N': case 'n': return 0; } } } static char *addOption(char *buf, size_t nbuf, const char *option) { assert(strlen(buf) + strlen(option) < nbuf); char *scratchCodes = strchr(buf, '\n'); assert(scratchCodes); scratchCodes++; memmove(scratchCodes + strlen(option), scratchCodes, strlen(scratchCodes) + 1); memcpy(scratchCodes, option, strlen(option)); return buf; } static char *maybeAddOption(const char *msg, char *buf, size_t nbuf, const char *option) { if (maybe(msg)) { buf = addOption(buf, nbuf, option); } return buf; } static void usage(void) { puts( "google-authenticator []\n" " -h, --help Print this message\n" " -c, --counter-based Set up counter-based (HOTP) verification\n" " -t, --time-based Set up time-based (TOTP) verification\n" " -d, --disallow-reuse Disallow reuse of previously used TOTP tokens\n" " -D, --allow-reuse Allow reuse of previously used TOTP tokens\n" " -f, --force Write file without first confirming with user\n" " -l, --label=