Re-import of OpenSSH 3.7.1p2 (Chase\!)

[gssapi-openssh.git] / openssh / monitor.c

diff --git a/openssh/monitor.c b/openssh/monitor.c
index 46e8d16e60fa1cc56edf83f28f434e899c291f20..e5656470d9d8c95d45cd6c2ea253820832817b47 100644 (file)
--- a/openssh/monitor.c
+++ b/openssh/monitor.c
@@ -25,7 +25,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: monitor.c,v 1.54 2003/11/21 11:57:03 djm Exp $");
+RCSID("$OpenBSD: monitor.c,v 1.49 2003/08/28 12:54:34 markus Exp $");
 
 #include <openssl/dh.h>
 
@@ -134,7 +134,6 @@ int mm_answer_pam_free_ctx(int, Buffer *);
 int mm_answer_gss_setup_ctx(int, Buffer *);
 int mm_answer_gss_accept_ctx(int, Buffer *);
 int mm_answer_gss_userok(int, Buffer *);
-int mm_answer_gss_checkmic(int, Buffer *);
 #endif
 
 static Authctxt *authctxt;
@@ -194,7 +193,6 @@ struct mon_table mon_dispatch_proto20[] = {
     {MONITOR_REQ_GSSSETUP, MON_ISAUTH, mm_answer_gss_setup_ctx},
     {MONITOR_REQ_GSSSTEP, MON_ISAUTH, mm_answer_gss_accept_ctx},
     {MONITOR_REQ_GSSUSEROK, MON_AUTH, mm_answer_gss_userok},
-    {MONITOR_REQ_GSSCHECKMIC, MON_ISAUTH, mm_answer_gss_checkmic},
 #endif
     {0, 0, NULL}
 };
@@ -274,17 +272,14 @@ monitor_permit_authentications(int permit)
        }
 }
 
-void
-monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
+Authctxt *
+monitor_child_preauth(struct monitor *pmonitor)
 {
        struct mon_table *ent;
        int authenticated = 0;
 
        debug3("preauth child monitor started");
 
-       authctxt = _authctxt;
-       memset(authctxt, 0, sizeof(*authctxt));
-
        if (compat20) {
                mon_dispatch = mon_dispatch_proto20;
 
@@ -297,6 +292,8 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
                monitor_permit(mon_dispatch, MONITOR_REQ_SESSKEY, 1);
        }
 
+       authctxt = authctxt_new();
+
        /* The first few requests do not require asynchronous access */
        while (!authenticated) {
                authenticated = monitor_read(pmonitor, mon_dispatch, &ent);
@@ -309,11 +306,11 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
                                authenticated = 0;
 #ifdef USE_PAM
                        /* PAM needs to perform account checks after auth */
-                       if (options.use_pam && authenticated) {
+                       if (options.use_pam) {
                                Buffer m;
 
                                buffer_init(&m);
-                               mm_request_receive_expect(pmonitor->m_sendfd,
+                               mm_request_receive_expect(pmonitor->m_sendfd, 
                                    MONITOR_REQ_PAM_ACCOUNT, &m);
                                authenticated = mm_answer_pam_account(pmonitor->m_sendfd, &m);
                                buffer_free(&m);
@@ -336,6 +333,8 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
            __func__, authctxt->user);
 
        mm_get_keystate(pmonitor);
+
+       return (authctxt);
 }
 
 static void
@@ -567,7 +566,6 @@ mm_answer_pwnamallow(int socket, Buffer *m)
 
        if (pwent == NULL) {
                buffer_put_char(m, 0);
-               authctxt->pw = fakepw();
                goto out;
        }
 
@@ -783,7 +781,7 @@ int
 mm_answer_pam_start(int socket, Buffer *m)
 {
        char *user;
-
+       
        if (!options.use_pam)
                fatal("UsePAM not set, but ended up in %s anyway", __func__);
 
@@ -802,7 +800,7 @@ int
 mm_answer_pam_account(int socket, Buffer *m)
 {
        u_int ret;
-
+       
        if (!options.use_pam)
                fatal("UsePAM not set, but ended up in %s anyway", __func__);
 
@@ -949,7 +947,7 @@ mm_answer_keyallowed(int socket, Buffer *m)
 
        debug3("%s: key_from_blob: %p", __func__, key);
 
-       if (key != NULL && authctxt->valid) {
+       if (key != NULL && authctxt->pw != NULL) {
                switch(type) {
                case MM_USERKEY:
                        allowed = options.pubkey_authentication &&
@@ -1187,7 +1185,7 @@ mm_record_login(Session *s, struct passwd *pw)
                if (getpeername(packet_get_connection_in(),
                        (struct sockaddr *) & from, &fromlen) < 0) {
                        debug("getpeername: %.100s", strerror(errno));
-                       cleanup_exit(255);
+                       fatal_cleanup();
                }
        }
        /* Record that there was a login on that tty from the remote host. */
@@ -1202,6 +1200,7 @@ mm_session_close(Session *s)
        debug3("%s: session %d pid %ld", __func__, s->self, (long)s->pid);
        if (s->ttyfd != -1) {
                debug3("%s: tty %s ptyfd %d",  __func__, s->tty, s->ptyfd);
+               fatal_remove_cleanup(session_pty_cleanup2, (void *)s);
                session_pty_cleanup2(s);
        }
        s->used = 0;
@@ -1226,6 +1225,7 @@ mm_answer_pty(int socket, Buffer *m)
        res = pty_allocate(&s->ptyfd, &s->ttyfd, s->tty, sizeof(s->tty));
        if (res == 0)
                goto error;
+       fatal_add_cleanup(session_pty_cleanup2, (void *)s);
        pty_setowner(authctxt->pw, s->tty);
 
        buffer_put_int(m, 1);
@@ -1784,42 +1784,14 @@ mm_answer_gss_accept_ctx(int socket, Buffer *m)
 
        gss_release_buffer(&minor, &out);
 
+       /* Complete - now we can do signing */
        if (major==GSS_S_COMPLETE) {
                monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 0);
                monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1);
-               monitor_permit(mon_dispatch, MONITOR_REQ_GSSCHECKMIC, 1);
        }
        return (0);
 }
 
-int
-mm_answer_gss_checkmic(int socket, Buffer *m)
-{
-       gss_buffer_desc gssbuf, mic;
-       OM_uint32 ret;
-       u_int len;
-
-       gssbuf.value = buffer_get_string(m, &len);
-       gssbuf.length = len;
-       mic.value = buffer_get_string(m, &len);
-       mic.length = len;
-
-       ret = ssh_gssapi_checkmic(gsscontext, &gssbuf, &mic);
-
-       xfree(gssbuf.value);
-       xfree(mic.value);
-
-       buffer_clear(m);
-       buffer_put_int(m, ret);
-
-       mm_request_send(socket, MONITOR_ANS_GSSCHECKMIC, m);
-
-       if (!GSS_ERROR(ret))
-               monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1);
-
-       return (0);
-}
-
 int
 mm_answer_gss_userok(int socket, Buffer *m)
 {
@@ -1833,7 +1805,7 @@ mm_answer_gss_userok(int socket, Buffer *m)
        debug3("%s: sending result %d", __func__, authenticated);
        mm_request_send(socket, MONITOR_ANS_GSSUSEROK, m);
 
-       auth_method="gssapi-with-mic";
+       auth_method="gssapi";
 
        /* Monitor loop will terminate if authenticated */
        return (authenticated);