- (tim) [configure.ac sshd.8] Enable locked account check (a "*LK*" string)

[openssh.git] / auth-pam.c

diff --git a/auth-pam.c b/auth-pam.c
index 29dd2c974df1a8c0b2d8d8a75485aad2d4ff6912..3defe5851727c8d4009c91e6f10252bf7762f76d 100644 (file)
--- a/auth-pam.c
+++ b/auth-pam.c
@@ -123,14 +123,14 @@ static struct pam_ctxt *cleanup_ctxt;
 static int sshpam_thread_status = -1;
 static mysig_t sshpam_oldsig;
 
-static void 
+static void
 sshpam_sigchld_handler(int sig)
 {
        signal(SIGCHLD, SIG_DFL);
        if (cleanup_ctxt == NULL)
                return; /* handler called after PAM cleanup, shouldn't happen */
        if (waitpid(cleanup_ctxt->pam_thread, &sshpam_thread_status, WNOHANG)
-            <= 0) {
+           <= 0) {
                /* PAM thread has not exitted, privsep slave must have */
                kill(cleanup_ctxt->pam_thread, SIGTERM);
                if (waitpid(cleanup_ctxt->pam_thread, &sshpam_thread_status, 0)
@@ -716,8 +716,18 @@ sshpam_query(void *ctx, char **name, char **info,
                        plen++;
                        xfree(msg);
                        break;
-               case PAM_SUCCESS:
                case PAM_AUTH_ERR:
+                       debug3("PAM: PAM_AUTH_ERR");
+                       if (**prompts != NULL && strlen(**prompts) != 0) {
+                               *info = **prompts;
+                               **prompts = NULL;
+                               *num = 0;
+                               **echo_on = 0;
+                               ctxt->pam_done = -1;
+                               return 0;
+                       }
+                       /* FALLTHROUGH */
+               case PAM_SUCCESS:
                        if (**prompts != NULL) {
                                /* drain any accumulated messages */
                                debug("PAM: %s", **prompts);
@@ -780,7 +790,7 @@ sshpam_respond(void *ctx, u_int num, char **resp)
        buffer_init(&buffer);
        if (sshpam_authctxt->valid &&
            (sshpam_authctxt->pw->pw_uid != 0 ||
-            options.permit_root_login == PERMIT_YES))
+           options.permit_root_login == PERMIT_YES))
                buffer_put_cstring(&buffer, *resp);
        else
                buffer_put_cstring(&buffer, badpw);
@@ -853,7 +863,7 @@ do_pam_account(void)
        sshpam_err = pam_acct_mgmt(sshpam_handle, 0);
        debug3("PAM: %s pam_acct_mgmt = %d (%s)", __func__, sshpam_err,
            pam_strerror(sshpam_handle, sshpam_err));
-       
+
        if (sshpam_err != PAM_SUCCESS && sshpam_err != PAM_NEW_AUTHTOK_REQD) {
                sshpam_account_status = 0;
                return (sshpam_account_status);
@@ -1111,7 +1121,7 @@ sshpam_passwd_conv(int n, sshpam_const struct pam_message **msg,
        *resp = reply;
        return (PAM_SUCCESS);
 
- fail: 
+ fail:
        for(i = 0; i < n; i++) {
                if (reply[i].resp != NULL)
                        xfree(reply[i].resp);
@@ -1144,7 +1154,7 @@ sshpam_auth_passwd(Authctxt *authctxt, const char *password)
         * information via timing (eg if the PAM config has a delay on fail).
         */
        if (!authctxt->valid || (authctxt->pw->pw_uid == 0 &&
-            options.permit_root_login != PERMIT_YES))
+           options.permit_root_login != PERMIT_YES))
                sshpam_password = badpw;
 
        sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
@@ -1158,7 +1168,7 @@ sshpam_auth_passwd(Authctxt *authctxt, const char *password)
        if (sshpam_err == PAM_SUCCESS && authctxt->valid) {
                debug("PAM: password authentication accepted for %.100s",
                    authctxt->user);
-               return 1;
+               return 1;
        } else {
                debug("PAM: password authentication failed for %.100s: %s",
                    authctxt->valid ? authctxt->user : "an illegal user",