Documentation
¶
Overview ¶
Package authsrv implements declarations and primitive elements for Plan 9's original authentication system, similar to those defined by Plan 9's /sys/include/auth.h, /sys/include/authsrv.h and implemented by /sys/src/libauthsrv. They allow communication with a Plan 9 authentication server, using protocols described in authsrv(6). Specifically, it provides encoding of messages carrying a ticket request, ticket, authenticator or password change request. Like Plan 9's original implementation, it uses DES-based keys and encryption, which is obviously now outdated. The newer scheme provided by 9front remains to be implemented.
Index ¶
Constants ¶
const ( ANAMELEN = 28 // maximum size of name in previous proto AERRLEN = 64 // maximum size of errstr in previous proto DOMLEN = 48 // length of an authentication domain name DESKEYLEN = 7 // length of a des Key for encrypt/decrypt CHALLEN = 8 // length of a plan9 sk1 challenge NETCHLEN = 16 // max network challenge length (used in AS protocol) SECRETLEN = 32 // max length of a Secret MAXMSGLEN = 4096 // more than enough for any of these )
The Plan 9 services use strings and slices that have a maximum length. Strings are converted to NUL-terminated byte arrays, where the length includes the NUL byte.
const AUTHENTLEN = CHALLEN + 4 + 1
AUTHENTLEN is the size in bytes of a packed Authenticator.
const PASSREQLEN = 2*ANAMELEN + 1 + 1 + SECRETLEN
PASSREQLEN is the size in bytes of a packed PasswordReq.
const TICKETLEN = CHALLEN + 2*ANAMELEN + DESKEYLEN + 1
TICKETLEN is the size in bytes of a packed Ticket.
const TICKREQLEN = 3*ANAMELEN + CHALLEN + DOMLEN + 1
TICKREQLEN is the size in bytes of a packed TicketReq.
Variables ¶
var (
ErrSmallBlock = errors.New("data less than block length")
)
Functions ¶
Types ¶
type Authenticator ¶
type Authenticator struct {
Num ReqType // replay protection
Chal []byte // [CHALLEN] server challenge
ID uint32 // authenticator ID , ++'d with each auth
}
Authenicator carries the challenge to another party.
func (*Authenticator) Pack ¶
func (f *Authenticator) Pack(key []byte) []byte
Pack returns the wire form of an authenticator. The optional key is used to encrypt the result first.
type PasswordReq ¶
type PasswordReq struct {
Num ReqType
Old []byte // [ANAMELEN]
New []byte // [ANAMELEN]
ChangeSecret bool
Secret []byte // [SECRETLEN] new secret
}
PasswordReq is a password change request. Old and New are the plaintext versions of the old and new passwords. ChangeSecret is true if another secret stored by the authentication server, the POP3 or Inferno secret, should be changed as well or instead. The server does not store Old or New: instead it converts both using PassToKey and compares or stores the results.
func (*PasswordReq) Pack ¶
func (f *PasswordReq) Pack(key []byte) []byte
Pack returns the wire form of a password request. The optional key is used to encrypt the result first.
type ReqType ¶
type ReqType byte
ReqType gives the source of a request or reply: Plan 9's encryption numberings (anti-replay).
const ( AuthTreq ReqType = 1 // ticket request AuthChal ReqType = 2 // challenge box request AuthPass ReqType = 3 // change password AuthOK ReqType = 4 // fixed length reply follows AuthErr ReqType = 5 // error follows AuthMod ReqType = 6 // modify user AuthApop ReqType = 7 // apop authentication for pop3 AuthOKvar ReqType = 9 // variable length reply follows AuthChap ReqType = 10 // chap authentication for ppp AuthMSchap ReqType = 11 // MS chap authentication for ppp AuthCram ReqType = 12 // CRAM verification for IMAP (RFC2195 & rfc2104) AuthHttp ReqType = 13 // http domain login AuthVNC ReqType = 14 // VNC server login (deprecated) AuthTs ReqType = 64 // ticket encrypted with server's Key AuthTc ReqType = 65 // ticket encrypted with client's Key AuthAs ReqType = 66 // server generated authenticator AuthAc ReqType = 67 // client generated authenticator AuthTp ReqType = 68 // ticket encrypted with client's Key for password change AuthHr ReqType = 69 // http reply )
type Ticket ¶
type Ticket struct {
Num ReqType // replay protection
Chal []byte // [CHALLEN] server challenge
ClientID string // [ANAMELEN] UID on client
ServerID string // [ANAMELEN] UID on server
Key []byte // [DESKEYLEN] nonce DES Key
}
Ticket is the result of a successful ticket request.
func ASGetTicket ¶
ASGetTicket gets a ticket from the authentication server on fd, returning the ticket, and a packed ticket encrypted by the server's key. The error could be more precise but these functions have only ephemeral interest.
type TicketReq ¶
type TicketReq struct {
RType ReqType
AuthID string // [ANAMELEN] server's encryption ID
AuthDom string // [DOMLEN] server's authentication domain
Chal []byte // [CHALLEN] challenge from server
HostID string // [ANAMELEN] host's encryption ID
UID string // [ANAMELEN] UID of requesting user on host
}
TicketReq requests a ticket from the authentication server.
Source Files