[buildpkg.sh.in] Last minute fix didn't make it in the .in file. :-(

[openssh.git] / auth1.c

diff --git a/auth1.c b/auth1.c
index 877e2e62d2420046c846a3c4305e39d400f65352..471f271726b124913f0a4e3f65c216e2cb0d9aa1 100644 (file)
--- a/auth1.c
+++ b/auth1.c
@@ -10,14 +10,13 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: auth1.c,v 1.49 2003/07/22 13:35:22 markus Exp $");
+RCSID("$OpenBSD: auth1.c,v 1.57 2004/05/23 23:59:53 dtucker Exp $");
 
 #include "xmalloc.h"
 #include "rsa.h"
 #include "ssh1.h"
 #include "packet.h"
 #include "buffer.h"
-#include "mpaux.h"
 #include "log.h"
 #include "servconf.h"
 #include "compat.h"
@@ -49,10 +48,6 @@ get_authname(int type)
        case SSH_CMSG_AUTH_TIS:
        case SSH_CMSG_AUTH_TIS_RESPONSE:
                return "challenge-response";
-#ifdef KRB5
-       case SSH_CMSG_AUTH_KERBEROS:
-               return "kerberos";
-#endif
        }
        snprintf(buf, sizeof buf, "bad-auth-msg-%d", type);
        return buf;
@@ -119,67 +114,6 @@ do_authloop(Authctxt *authctxt)
 
                /* Process the packet. */
                switch (type) {
-
-#ifdef KRB5
-               case SSH_CMSG_AUTH_KERBEROS:
-                       if (!options.kerberos_authentication) {
-                               verbose("Kerberos authentication disabled.");
-                       } else {
-                               char *kdata = packet_get_string(&dlen);
-                               packet_check_eom();
-
-                               if (kdata[0] != 4) { /* KRB_PROT_VERSION */
-                                       krb5_data tkt, reply;
-                                       tkt.length = dlen;
-                                       tkt.data = kdata;
-
-                                       if (PRIVSEP(auth_krb5(authctxt, &tkt,
-                                           &client_user, &reply))) {
-                                               authenticated = 1;
-                                               snprintf(info, sizeof(info),
-                                                   " tktuser %.100s",
-                                                   client_user);
-
-                                               /* Send response to client */
-                                               packet_start(
-                                                   SSH_SMSG_AUTH_KERBEROS_RESPONSE);
-                                               packet_put_string((char *)
-                                                   reply.data, reply.length);
-                                               packet_send();
-                                               packet_write_wait();
-
-                                               if (reply.length)
-                                                       xfree(reply.data);
-                                       }
-                               }
-                               xfree(kdata);
-                       }
-                       break;
-               case SSH_CMSG_HAVE_KERBEROS_TGT:
-                       packet_send_debug("Kerberos TGT passing disabled before authentication.");
-                       break;
-#endif
-
-               case SSH_CMSG_AUTH_RHOSTS:
-                       if (!options.rhosts_authentication) {
-                               verbose("Rhosts authentication disabled.");
-                               break;
-                       }
-                       /*
-                        * Get client user name.  Note that we just have to
-                        * trust the client; this is one reason why rhosts
-                        * authentication is insecure. (Another is
-                        * IP-spoofing on a local network.)
-                        */
-                       client_user = packet_get_string(&ulen);
-                       packet_check_eom();
-
-                       /* Try to authenticate using /etc/hosts.equiv and .rhosts. */
-                       authenticated = auth_rhosts(pw, client_user);
-
-                       snprintf(info, sizeof info, " ruser %.100s", client_user);
-                       break;
-
                case SSH_CMSG_AUTH_RHOSTS_RSA:
                        if (!options.rhosts_rsa_authentication) {
                                verbose("Rhosts with RSA authentication disabled.");
@@ -204,7 +138,7 @@ do_authloop(Authctxt *authctxt)
                                    BN_num_bits(client_host_key->rsa->n), bits);
                        packet_check_eom();
 
-                       authenticated = auth_rhosts_rsa(pw, client_user,
+                       authenticated = auth_rhosts_rsa(authctxt, client_user,
                            client_host_key);
                        key_free(client_host_key);
 
@@ -221,7 +155,7 @@ do_authloop(Authctxt *authctxt)
                                fatal("do_authloop: BN_new failed");
                        packet_get_bignum(n);
                        packet_check_eom();
-                       authenticated = auth_rsa(pw, n);
+                       authenticated = auth_rsa(authctxt, n);
                        BN_clear_free(n);
                        break;
 
@@ -300,7 +234,7 @@ do_authloop(Authctxt *authctxt)
                if (authenticated &&
                    !check_nt_auth(type == SSH_CMSG_AUTH_PASSWORD, pw)) {
                        packet_disconnect("Authentication rejected for uid %d.",
-                       pw == NULL ? -1 : pw->pw_uid);
+                           pw == NULL ? -1 : pw->pw_uid);
                        authenticated = 0;
                }
 #else
@@ -310,6 +244,12 @@ do_authloop(Authctxt *authctxt)
                        authenticated = 0;
 #endif
 
+#ifdef USE_PAM
+               if (options.use_pam && authenticated &&
+                   !PRIVSEP(do_pam_account()))
+                       authenticated = 0;
+#endif
+
                /* Log before sending the reply */
                auth_log(authctxt, authenticated, get_authname(type), info);
 
@@ -321,7 +261,7 @@ do_authloop(Authctxt *authctxt)
                if (authenticated)
                        return;
 
-               if (authctxt->failures++ > AUTH_FAIL_MAX)
+               if (authctxt->failures++ > options.max_authtries)
                        packet_disconnect(AUTH_FAIL_MSG, authctxt->user);
 
                packet_start(SSH_SMSG_FAILURE);
@@ -334,10 +274,9 @@ do_authloop(Authctxt *authctxt)
  * Performs authentication of an incoming connection.  Session key has already
  * been exchanged and encryption is enabled.
  */
-Authctxt *
-do_authentication(void)
+void
+do_authentication(Authctxt *authctxt)
 {
-       Authctxt *authctxt;
        u_int ulen;
        char *user, *style = NULL;
 
@@ -351,32 +290,23 @@ do_authentication(void)
        if ((style = strchr(user, ':')) != NULL)
                *style++ = '\0';
 
-#ifdef KRB5
-       /* XXX - SSH.com Kerberos v5 braindeath. */
-       if ((datafellows & SSH_BUG_K5USER) &&
-           options.kerberos_authentication) {
-               char *p;
-               if ((p = strchr(user, '@')) != NULL)
-                       *p = '\0';
-       }
-#endif
-
-       authctxt = authctxt_new();
        authctxt->user = user;
        authctxt->style = style;
 
        /* Verify that the user is a valid user. */
        if ((authctxt->pw = PRIVSEP(getpwnamallow(user))) != NULL)
                authctxt->valid = 1;
-       else
+       else {
                debug("do_authentication: illegal user %s", user);
+               authctxt->pw = fakepw();
+       }
 
        setproctitle("%s%s", authctxt->pw ? user : "unknown",
            use_privsep ? " [net]" : "");
 
 #ifdef USE_PAM
        if (options.use_pam)
-               PRIVSEP(start_pam(user));
+               PRIVSEP(start_pam(authctxt));
 #endif
 
        /*
@@ -399,6 +329,4 @@ do_authentication(void)
        packet_start(SSH_SMSG_SUCCESS);
        packet_send();
        packet_write_wait();
-
-       return (authctxt);
 }