Use new smartauthmon C++ program instead of the old bash script for smartcard authentication

This plugs several possible security holes


git-svn-id: svn://anonsvn.kde.org/home/kde/branches/trinity/applications/smartcardauth@1254687 283d02a7-25f6-0310-bc7c-ecb5cbfe19da

1 files changed, 55 insertions, 26 deletions

diff --git a/src/smartauthmon.cpp b/src/smartauthmon.cpp
index 5b8d029..cb21f21 100644
--- a/src/smartauthmon.cpp
+++ b/src/smartauthmon.cpp
@@ -40,9 +40,19 @@
 // The [secure] temporary directory for authentication
 #define SECURE_DIRECTORY_PATH "/tmp/smartauth"
 
+// The Trinity binary directory
+#define TRINITY_BIN_PREFIX "/opt/trinity/bin/"
+
 // Some internal constants
 #define CREATE_LIFE_CYCLE "01"
 
+#define tqarg arg
+
+// In ckpass.o
+extern "C" {
+    int check_password(const char* username, const char* password);
+}
+
 static TQString secure_directory;
 static TQString command_mode;
 static TQString select_file;
@@ -251,6 +261,7 @@ int main (int argc, char *argv[])
 {
 	TQString smartcard_username;
 	TQString oldsmartcard_username;
+	TQString smartcard_password;
 	TQString smartcard_slave;
 	TQString lverify;
 	TQString cverify;
@@ -295,6 +306,18 @@ int main (int argc, char *argv[])
 		return 1;
 	}
 
+	// Read hexidecimal_key from the system crypto files
+	FILE* fpkey = fopen("/etc/smartauth/smartauthmon.key", "rb");
+	if (fpkey == NULL) {
+		printf("Smart card login has been disabled.  Exiting...\n\r");
+		return 1;
+	}
+	else {
+		fclose(fpkey);
+	}
+	hexidecimal_key = readfile("/etc/smartauth/smartauthmon.key");
+	hexidecimal_key.replace('\n', "");
+
 	oldsmartcard_username="";
 	printf("[DEBUG 400.0] Ready...\n\r");
 	while (1) {
@@ -371,9 +394,7 @@ int main (int argc, char *argv[])
 			// Now DES encrypt the challenge
 			// Later, change the initialization vector to random if possible
 
-			// Read hexidecimal_key from the system crypto files and create the response from the challenge
-			hexidecimal_key = readfile("/etc/smartauth/smartauthmon.key");
-			hexidecimal_key.replace('\n', "");
+			// Create the response from the challenge
 			systemexec((TQString("openssl des-ecb -in %1/challenge -out %2/response -K %3 -iv 1").tqarg(secure_directory).tqarg(secure_directory).tqarg(hexidecimal_key)).ascii());
 	
 			if (command_mode == "acos") {
@@ -414,15 +435,20 @@ int main (int argc, char *argv[])
 				// Get username and password
 				TQString response = get_file("10 02", "text");
 				smartcard_username = readfile(response);
+				unlink(response.ascii());
 				response = get_file("10 03", "text");
-				systemexec((TQString("mv %1 %2/password").tqarg(response).tqarg(secure_directory)).ascii());
+				smartcard_password = readfile(response.ascii());
+				unlink(response.ascii());
 				response = get_file("10 04", "text");
 				smartcard_slave = readfile(response);
+				unlink(response.ascii());
 				if (smartcard_slave == "SLAVE") {
 					get_file("10 05", "text");
 					smartcard_minutes_raw = readfile(response);
+					unlink(response.ascii());
 					get_file("10 06", "text");
 					internet_minutes = readfile(response).toInt();
+					unlink(response.ascii());
 				}
 			}
 			else {
@@ -470,8 +496,8 @@ int main (int argc, char *argv[])
 			int errcode=0;
 			int waserror=0;
 			int noactivesessions=0;
-	
-			result = exec("/opt/trinity/bin/kdmctl -g list");
+
+			result = exec(TRINITY_BIN_PREFIX "kdmctl -g list");
 			if (result == "ok") {
 				noactivesessions=1;
 				result="okbutempty";
@@ -510,17 +536,12 @@ int main (int argc, char *argv[])
 						if (darray[index] != "") {
 							printf("[DEBUG 400.a] Found existing session on desktop: %d\n\r", index);
 							foundsession=1;
-							// Check password
-							// FIXME
-							// This might expose the password for an instant
-							// Integrate the password checking from "ckpasswd.c" here instead
-							lverify = exec((TQString("/usr/bin/smartauthckpasswd -u %1 -p $(cat %2/password)").tqarg(darray[index]).tqarg(secure_directory)).ascii());
-							cverify = TQString("User:%1").tqarg(darray[index]);
 							udisplay = TQString(":%1").tqarg(index);
-							if (lverify == cverify) {
-								systemexec((TQString("su %1 -c \"export DISPLAY=%2; /opt/trinity/bin/dcop kdesktop KScreensaverIface quit\"").tqarg(smartcard_username).tqarg(udisplay)).ascii());
-								systemexec((TQString("su %1 -c \"export DISPLAY=%2; /opt/trinity/bin/dcop kdesktop KScreensaverIface enable false\"").tqarg(smartcard_username).tqarg(udisplay)).ascii());
-								systemexec((TQString("/opt/trinity/bin/kdmctl activate %1").tqarg(udisplay)).ascii());
+							// Check password
+							if (check_password(smartcard_username.ascii(), smartcard_password.ascii()) == 0) {
+								systemexec((TQString("su %1 -c \"export DISPLAY=%2; " TRINITY_BIN_PREFIX "dcop kdesktop KScreensaverIface quit\"").tqarg(smartcard_username).tqarg(udisplay)).ascii());
+								systemexec((TQString("su %1 -c \"export DISPLAY=%2; " TRINITY_BIN_PREFIX "dcop kdesktop KScreensaverIface enable false\"").tqarg(smartcard_username).tqarg(udisplay)).ascii());
+								systemexec((TQString(TRINITY_BIN_PREFIX "kdmctl activate %1").tqarg(udisplay)).ascii());
 							}
 							else {
 								systemexec("echo \"EUnauthorized SmartCard Inserted\" > /tmp/ksocket-global/kdesktoplockcontrol &");
@@ -580,10 +601,16 @@ int main (int argc, char *argv[])
 					newdisplay = TQString(":%1").tqarg(newdisplayint);
 					printf("[DEBUG 400.f] The next display to start will be %s\n\r", newdisplay.ascii());
 						
-					systemexec("/opt/trinity/bin/kdmctl -g reserve");
-					systemexec((TQString("/opt/trinity/bin/kdmctl -g login %1 now %2 $(cat %3/password)").tqarg(newdisplay).tqarg(smartcard_username).tqarg(secure_directory)).ascii());
+					systemexec(TRINITY_BIN_PREFIX "kdmctl -g reserve");
+					TQString kdmctl_command = TQString("login\t%1\tnow\t%2\t%3\n").tqarg(newdisplay).tqarg(smartcard_username).tqarg(smartcard_password);
+					FILE* kdmctlpipe = popen(TRINITY_BIN_PREFIX "kdmctl -g -", "w");
+					if (pipe) {
+						fputs(kdmctl_command.ascii(), kdmctlpipe);
+						fflush(kdmctlpipe);
+						pclose(kdmctlpipe);
+					}
 					sleep(2);
-					systemexec((TQString("/opt/trinity/bin/kdmctl -g activate %1").tqarg(newdisplay)).ascii());
+					systemexec((TQString(TRINITY_BIN_PREFIX "kdmctl -g activate %1").tqarg(newdisplay)).ascii());
 					udisplay=newdisplay;
 				}
 	
@@ -603,8 +630,8 @@ int main (int argc, char *argv[])
 					
 					while (output == 0) {
 						sleep(1);
-						systemexec((TQString("su %1 -c \"export DISPLAY=%2; /opt/trinity/bin/dcop kdesktop KScreensaverIface quit\"").tqarg(smartcard_username).tqarg(udisplay)).ascii());
-						systemexec((TQString("su %1 -c \"export DISPLAY=%2; /opt/trinity/bin/dcop kdesktop KScreensaverIface enable false\"").tqarg(smartcard_username).tqarg(udisplay)).ascii());
+						systemexec((TQString("su %1 -c \"export DISPLAY=%2; " TRINITY_BIN_PREFIX "dcop kdesktop KScreensaverIface quit\"").tqarg(smartcard_username).tqarg(udisplay)).ascii());
+						systemexec((TQString("su %1 -c \"export DISPLAY=%2; " TRINITY_BIN_PREFIX "dcop kdesktop KScreensaverIface enable false\"").tqarg(smartcard_username).tqarg(udisplay)).ascii());
 						output = systemexec("echo \"exit\" | scriptor 2>/dev/null 1>/dev/null");
 						if (smartcard_slave == "SLAVE") {
 							timer--;
@@ -649,7 +676,7 @@ int main (int argc, char *argv[])
 					result="ok";
 					timeout=0;
 					errcode=0;
-					result = exec("/opt/trinity/bin/kdmctl -g list");
+					result = exec(TRINITY_BIN_PREFIX "kdmctl -g list");
 					if (result == "ok") {
 						noactivesessions=1;
 						result="okbutempty";
@@ -684,14 +711,16 @@ int main (int argc, char *argv[])
 								timeout=0;
 								blankresult="";
 								while (blankresult != "true") {
-									systemexec((TQString("/opt/trinity/bin/kdmctl -g activate %1").tqarg(udisplay)).ascii());
-									systemexec((TQString("su %1 -c \"export DISPLAY=%2; /opt/trinity/bin/dcop kdesktop KScreensaverIface enable true\"").tqarg(smartcard_username).tqarg(udisplay)).ascii());
-									systemexec((TQString("su %1 -c \"export DISPLAY=%2; /opt/trinity/bin/dcop kdesktop KScreensaverIface lock\"").tqarg(smartcard_username).tqarg(udisplay)).ascii());
+									systemexec((TQString(TRINITY_BIN_PREFIX "kdmctl -g activate %1").tqarg(udisplay)).ascii());
+									systemexec((TQString("su %1 -c \"export DISPLAY=%2; " TRINITY_BIN_PREFIX "dcop kdesktop KScreensaverIface enable true\"").tqarg(smartcard_username).tqarg(udisplay)).ascii());
+									systemexec((TQString("su %1 -c \"export DISPLAY=%2; " TRINITY_BIN_PREFIX "dcop kdesktop KScreensaverIface lock\"").tqarg(smartcard_username).tqarg(udisplay)).ascii());
 									int retcode;
-									blankresult = execret(TQString("su %1 -c \"export DISPLAY=%2; /opt/trinity/bin/dcop kdesktop KScreensaverIface isBlanked\"").tqarg(smartcard_username).tqarg(udisplay).ascii(), &retcode);
+									blankresult = execret(TQString("su %1 -c \"export DISPLAY=%2; " TRINITY_BIN_PREFIX "dcop kdesktop KScreensaverIface isBlanked\"").tqarg(smartcard_username).tqarg(udisplay).ascii(), &retcode);
 									if (retcode != 0) {
 										blankresult="true";
 									}
+									blankresult = blankresult.replace('\n', "");
+
 									logouttest = exec((TQString("echo %1 | grep 'target display has no VT assigned'").tqarg(blankresult)).ascii());
 									if (logouttest != "") {
 										printf("[DEBUG 401.6] User has logged out\n\r");