- (dtucker) Bug #536: Test for and work around openpty/controlling tty

[openssh.git] / monitor.c

diff --git a/monitor.c b/monitor.c
index 69a51fc98a1f29620e2dda52cd801058ad79b59d..99b4d56ec5bb656ce0c7fb373b0a3af4047d0475 100644 (file)
--- a/monitor.c
+++ b/monitor.c
@@ -25,7 +25,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: monitor.c,v 1.27 2002/09/23 22:11:05 markus Exp $");
+RCSID("$OpenBSD: monitor.c,v 1.37 2003/04/02 09:48:07 markus Exp $");
 
 #include <openssl/dh.h>
 
@@ -120,6 +120,9 @@ int mm_answer_sessid(int, Buffer *);
 int mm_answer_pam_start(int, Buffer *);
 #endif
 
+#ifdef KRB4
+int mm_answer_krb4(int, Buffer *);
+#endif
 #ifdef KRB5
 int mm_answer_krb5(int, Buffer *);
 #endif
@@ -203,6 +206,9 @@ struct mon_table mon_dispatch_proto15[] = {
 #ifdef USE_PAM
     {MONITOR_REQ_PAM_START, MON_ONCE, mm_answer_pam_start},
 #endif
+#ifdef KRB4
+    {MONITOR_REQ_KRB4, MON_ONCE|MON_AUTH, mm_answer_krb4},
+#endif
 #ifdef KRB5
     {MONITOR_REQ_KRB5, MON_ONCE|MON_AUTH, mm_answer_krb5},
 #endif
@@ -600,7 +606,7 @@ mm_answer_authpassword(int socket, Buffer *m)
        passwd = buffer_get_string(m, &plen);
        /* Only authenticate if the context is valid */
        authenticated = options.password_authentication &&
-           authctxt->valid && auth_password(authctxt, passwd);
+           auth_password(authctxt, passwd) && authctxt->valid;
        memset(passwd, 0, strlen(passwd));
        xfree(passwd);
 
@@ -628,20 +634,20 @@ mm_answer_bsdauthquery(int socket, Buffer *m)
        u_int numprompts;
        u_int *echo_on;
        char **prompts;
-       int res;
+       u_int success;
 
-       res = bsdauth_query(authctxt, &name, &infotxt, &numprompts,
-           &prompts, &echo_on);
+       success = bsdauth_query(authctxt, &name, &infotxt, &numprompts,
+           &prompts, &echo_on) < 0 ? 0 : 1;
 
        buffer_clear(m);
-       buffer_put_int(m, res);
-       if (res != -1)
+       buffer_put_int(m, success);
+       if (success)
                buffer_put_cstring(m, prompts[0]);
 
-       debug3("%s: sending challenge res: %d", __func__, res);
+       debug3("%s: sending challenge success: %u", __func__, success);
        mm_request_send(socket, MONITOR_ANS_BSDAUTHQUERY, m);
 
-       if (res != -1) {
+       if (success) {
                xfree(name);
                xfree(infotxt);
                xfree(prompts);
@@ -685,16 +691,16 @@ mm_answer_skeyquery(int socket, Buffer *m)
 {
        struct skey skey;
        char challenge[1024];
-       int res;
+       u_int success;
 
-       res = skeychallenge(&skey, authctxt->user, challenge);
+       success = skeychallenge(&skey, authctxt->user, challenge) < 0 ? 0 : 1;
 
        buffer_clear(m);
-       buffer_put_int(m, res);
-       if (res != -1)
+       buffer_put_int(m, success);
+       if (success)
                buffer_put_cstring(m, challenge);
 
-       debug3("%s: sending challenge res: %d", __func__, res);
+       debug3("%s: sending challenge success: %u", __func__, success);
        mm_request_send(socket, MONITOR_ANS_SKEYQUERY, m);
 
        return (0);
@@ -800,8 +806,9 @@ mm_answer_keyallowed(int socket, Buffer *m)
                        fatal("%s: unknown key type %d", __func__, type);
                        break;
                }
-               key_free(key);
        }
+       if (key != NULL)
+               key_free(key);
 
        /* clear temporarily storage (used by verify) */
        monitor_reset_key_state();
@@ -820,6 +827,7 @@ mm_answer_keyallowed(int socket, Buffer *m)
 
        buffer_clear(m);
        buffer_put_int(m, allowed);
+       buffer_put_int(m, forced_command != NULL);
 
        mm_append_debug(m);
 
@@ -862,7 +870,7 @@ monitor_valid_userblob(u_char *data, u_int datalen)
                fail++;
        p = buffer_get_string(&b, NULL);
        if (strcmp(authctxt->user, p) != 0) {
-               log("wrong user name passed to monitor: expected %s != %.100s",
+               logit("wrong user name passed to monitor: expected %s != %.100s",
                    authctxt->user, p);
                fail++;
        }
@@ -910,7 +918,7 @@ monitor_valid_hostbasedblob(u_char *data, u_int datalen, char *cuser,
                fail++;
        p = buffer_get_string(&b, NULL);
        if (strcmp(authctxt->user, p) != 0) {
-               log("wrong user name passed to monitor: expected %s != %.100s",
+               logit("wrong user name passed to monitor: expected %s != %.100s",
                    authctxt->user, p);
                fail++;
        }
@@ -1182,6 +1190,7 @@ mm_answer_rsa_keyallowed(int socket, Buffer *m)
        }
        buffer_clear(m);
        buffer_put_int(m, allowed);
+       buffer_put_int(m, forced_command != NULL);
 
        /* clear temporarily storage (used by generate challenge) */
        monitor_reset_key_state();
@@ -1196,8 +1205,9 @@ mm_answer_rsa_keyallowed(int socket, Buffer *m)
                key_blob = blob;
                key_bloblen = blen;
                key_blobtype = MM_RSAUSERKEY;
-               key_free(key);
        }
+       if (key != NULL)
+               key_free(key);
 
        mm_append_debug(m);
 
@@ -1238,6 +1248,9 @@ mm_answer_rsa_challenge(int socket, Buffer *m)
        mm_request_send(socket, MONITOR_ANS_RSACHALLENGE, m);
 
        monitor_permit(mon_dispatch, MONITOR_REQ_RSARESPONSE, 1);
+
+       xfree(blob);
+       key_free(key);
        return (0);
 }
 
@@ -1268,6 +1281,7 @@ mm_answer_rsa_response(int socket, Buffer *m)
                fatal("%s: received bad response to challenge", __func__);
        success = auth_rsa_verify_response(key, ssh1_challenge, response);
 
+       xfree(blob);
        key_free(key);
        xfree(response);
 
@@ -1285,6 +1299,51 @@ mm_answer_rsa_response(int socket, Buffer *m)
        return (success);
 }
 
+#ifdef KRB4
+int
+mm_answer_krb4(int socket, Buffer *m)
+{
+       KTEXT_ST auth, reply;
+       char  *client, *p;
+       int success;
+       u_int alen;
+
+       reply.length = auth.length = 0;
+ 
+       p = buffer_get_string(m, &alen);
+       if (alen >=  MAX_KTXT_LEN)
+                fatal("%s: auth too large", __func__);
+       memcpy(auth.dat, p, alen);
+       auth.length = alen;
+       memset(p, 0, alen);
+       xfree(p);
+
+       success = options.kerberos_authentication &&
+           authctxt->valid &&
+           auth_krb4(authctxt, &auth, &client, &reply);
+
+       memset(auth.dat, 0, alen);
+       buffer_clear(m);
+       buffer_put_int(m, success);
+
+       if (success) {
+               buffer_put_cstring(m, client);
+               buffer_put_string(m, reply.dat, reply.length);
+               if (client)
+                       xfree(client);
+               if (reply.length)
+                       memset(reply.dat, 0, reply.length);
+       }
+
+       debug3("%s: sending result %d", __func__, success);
+       mm_request_send(socket, MONITOR_ANS_KRB4, m);
+
+       auth_method = "kerberos";
+
+       /* Causes monitor loop to terminate if authenticated */
+       return (success);
+}
+#endif
 
 #ifdef KRB5
 int
@@ -1299,7 +1358,8 @@ mm_answer_krb5(int socket, Buffer *m)
        tkt.data = buffer_get_string(m, &len);
        tkt.length = len;
 
-       success = (options.kerberos_authentication == 1) &&
+       success = options.kerberos_authentication &&
+           authctxt->valid &&
            auth_krb5(authctxt, &tkt, &client_user, &reply);
 
        if (tkt.length)
@@ -1406,6 +1466,8 @@ mm_get_kex(Buffer *m)
            (memcmp(kex->session_id, session_id2, session_id2_len) != 0))
                fatal("mm_get_get: internal error: bad session id");
        kex->we_need = buffer_get_int(m);
+       kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server;
+       kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
        kex->server = 1;
        kex->hostkey_type = buffer_get_int(m);
        kex->kex_type = buffer_get_int(m);
@@ -1435,6 +1497,8 @@ mm_get_keystate(struct monitor *pmonitor)
        Buffer m;
        u_char *blob, *p;
        u_int bloblen, plen;
+       u_int32_t seqnr, packets;
+       u_int64_t blocks;
 
        debug3("%s: Waiting for new keys", __func__);
 
@@ -1464,8 +1528,14 @@ mm_get_keystate(struct monitor *pmonitor)
        xfree(blob);
 
        /* Now get sequence numbers for the packets */
-       packet_set_seqnr(MODE_OUT, buffer_get_int(&m));
-       packet_set_seqnr(MODE_IN, buffer_get_int(&m));
+       seqnr = buffer_get_int(&m);
+       blocks = buffer_get_int64(&m);
+       packets = buffer_get_int(&m);
+       packet_set_state(MODE_OUT, seqnr, blocks, packets);
+       seqnr = buffer_get_int(&m);
+       blocks = buffer_get_int64(&m);
+       packets = buffer_get_int(&m);
+       packet_set_state(MODE_IN, seqnr, blocks, packets);
 
  skip:
        /* Get the key context */
@@ -1499,7 +1569,7 @@ mm_get_keystate(struct monitor *pmonitor)
 void *
 mm_zalloc(struct mm_master *mm, u_int ncount, u_int size)
 {
-       size_t len = size * ncount;
+       size_t len = (size_t) size * ncount;
        void *address;
 
        if (len == 0 || ncount > SIZE_T_MAX / size)