- stevesk@cvs.openbsd.org 2006/02/08 13:15:44

[openssh.git] / monitor.c

diff --git a/monitor.c b/monitor.c
index ce7784aa153cc6606cc51f71760bb15f45762a27..4ba78db9c0de03bd100774b68f9fe3b3f109d784 100644 (file)
--- a/monitor.c
+++ b/monitor.c
@@ -25,14 +25,16 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: monitor.c,v 1.61 2004/07/17 05:31:41 dtucker Exp $");
+RCSID("$OpenBSD: monitor.c,v 1.66 2006/02/08 13:15:44 stevesk Exp $");
 
-#include <openssl/dh.h>
+#include <paths.h>
 
 #ifdef SKEY
 #include <skey.h>
 #endif
 
+#include <openssl/dh.h>
+
 #include "ssh.h"
 #include "auth.h"
 #include "kex.h"
@@ -143,7 +145,7 @@ int mm_answer_gss_userok(int, Buffer *);
 int mm_answer_gss_checkmic(int, Buffer *);
 #endif
 
-#ifdef AUDIT_EVENTS
+#ifdef SSH_AUDIT_EVENTS
 int mm_answer_audit_event(int, Buffer *);
 int mm_answer_audit_command(int, Buffer *);
 #endif
@@ -191,12 +193,12 @@ struct mon_table mon_dispatch_proto20[] = {
     {MONITOR_REQ_PAM_RESPOND, MON_ISAUTH, mm_answer_pam_respond},
     {MONITOR_REQ_PAM_FREE_CTX, MON_ONCE|MON_AUTHDECIDE, mm_answer_pam_free_ctx},
 #endif
-#ifdef AUDIT_EVENTS
-    {MONITOR_REQ_AUDIT_EVENT, 0, mm_answer_audit_event},
+#ifdef SSH_AUDIT_EVENTS
+    {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
 #endif
 #ifdef BSD_AUTH
     {MONITOR_REQ_BSDAUTHQUERY, MON_ISAUTH, mm_answer_bsdauthquery},
-    {MONITOR_REQ_BSDAUTHRESPOND, MON_AUTH,mm_answer_bsdauthrespond},
+    {MONITOR_REQ_BSDAUTHRESPOND, MON_AUTH, mm_answer_bsdauthrespond},
 #endif
 #ifdef SKEY
     {MONITOR_REQ_SKEYQUERY, MON_ISAUTH, mm_answer_skeyquery},
@@ -219,7 +221,7 @@ struct mon_table mon_dispatch_postauth20[] = {
     {MONITOR_REQ_PTY, 0, mm_answer_pty},
     {MONITOR_REQ_PTYCLEANUP, 0, mm_answer_pty_cleanup},
     {MONITOR_REQ_TERM, 0, mm_answer_term},
-#ifdef AUDIT_EVENTS
+#ifdef SSH_AUDIT_EVENTS
     {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
     {MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT, mm_answer_audit_command},
 #endif
@@ -237,7 +239,7 @@ struct mon_table mon_dispatch_proto15[] = {
     {MONITOR_REQ_RSARESPONSE, MON_ONCE|MON_AUTHDECIDE, mm_answer_rsa_response},
 #ifdef BSD_AUTH
     {MONITOR_REQ_BSDAUTHQUERY, MON_ISAUTH, mm_answer_bsdauthquery},
-    {MONITOR_REQ_BSDAUTHRESPOND, MON_AUTH,mm_answer_bsdauthrespond},
+    {MONITOR_REQ_BSDAUTHRESPOND, MON_AUTH, mm_answer_bsdauthrespond},
 #endif
 #ifdef SKEY
     {MONITOR_REQ_SKEYQUERY, MON_ISAUTH, mm_answer_skeyquery},
@@ -251,8 +253,8 @@ struct mon_table mon_dispatch_proto15[] = {
     {MONITOR_REQ_PAM_RESPOND, MON_ISAUTH, mm_answer_pam_respond},
     {MONITOR_REQ_PAM_FREE_CTX, MON_ONCE|MON_AUTHDECIDE, mm_answer_pam_free_ctx},
 #endif
-#ifdef AUDIT_EVENTS
-    {MONITOR_REQ_AUDIT_EVENT, 0, mm_answer_audit_event},
+#ifdef SSH_AUDIT_EVENTS
+    {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
 #endif
     {0, 0, NULL}
 };
@@ -261,9 +263,9 @@ struct mon_table mon_dispatch_postauth15[] = {
     {MONITOR_REQ_PTY, MON_ONCE, mm_answer_pty},
     {MONITOR_REQ_PTYCLEANUP, MON_ONCE, mm_answer_pty_cleanup},
     {MONITOR_REQ_TERM, 0, mm_answer_term},
-#ifdef AUDIT_EVENTS
+#ifdef SSH_AUDIT_EVENTS
     {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
-    {MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT|MON_ONCE, mm_answer_audit_command},
+    {MONITOR_REQ_AUDIT_COMMAND, MON_ONCE, mm_answer_audit_command},
 #endif
     {0, 0, NULL}
 };
@@ -310,6 +312,8 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
        authctxt = _authctxt;
        memset(authctxt, 0, sizeof(*authctxt));
 
+       authctxt->loginmsg = &loginmsg;
+
        if (compat20) {
                mon_dispatch = mon_dispatch_proto20;
 
@@ -628,8 +632,8 @@ mm_answer_pwnamallow(int sock, Buffer *m)
        if (options.use_pam)
                monitor_permit(mon_dispatch, MONITOR_REQ_PAM_START, 1);
 #endif
-#ifdef AUDIT_EVENTS
-       monitor_permit(mon_dispatch, MONITOR_REQ_AUDIT_EVENT, 1);
+#ifdef SSH_AUDIT_EVENTS
+       monitor_permit(mon_dispatch, MONITOR_REQ_AUDIT_COMMAND, 1);
 #endif
 
        return (0);
@@ -832,9 +836,7 @@ mm_answer_pam_account(int sock, Buffer *m)
        ret = do_pam_account();
 
        buffer_put_int(m, ret);
-       buffer_append(&loginmsg, "\0", 1);
-       buffer_put_cstring(m, buffer_ptr(&loginmsg));
-       buffer_clear(&loginmsg);
+       buffer_put_string(m, buffer_ptr(&loginmsg), buffer_len(&loginmsg));
 
        mm_request_send(sock, MONITOR_ANS_PAM_ACCOUNT, m);
 
@@ -867,8 +869,8 @@ int
 mm_answer_pam_query(int sock, Buffer *m)
 {
        char *name, *info, **prompts;
-       u_int num, *echo_on;
-       int i, ret;
+       u_int i, num, *echo_on;
+       int ret;
 
        debug3("%s", __func__);
        sshpam_authok = NULL;
@@ -901,8 +903,8 @@ int
 mm_answer_pam_respond(int sock, Buffer *m)
 {
        char **resp;
-       u_int num;
-       int i, ret;
+       u_int i, num;
+       int ret;
 
        debug3("%s", __func__);
        sshpam_authok = NULL;
@@ -976,7 +978,7 @@ mm_answer_keyallowed(int sock, Buffer *m)
        debug3("%s: key_from_blob: %p", __func__, key);
 
        if (key != NULL && authctxt->valid) {
-               switch(type) {
+               switch (type) {
                case MM_USERKEY:
                        allowed = options.pubkey_authentication &&
                            user_key_allowed(authctxt->pw, key);
@@ -1322,7 +1324,7 @@ mm_answer_sesskey(int sock, Buffer *m)
        int rsafail;
 
        /* Turn off permissions */
-       monitor_permit(mon_dispatch, MONITOR_REQ_SESSKEY, 1);
+       monitor_permit(mon_dispatch, MONITOR_REQ_SESSKEY, 0);
 
        if ((p = BN_new()) == NULL)
                fatal("%s: BN_new", __func__);
@@ -1513,7 +1515,7 @@ mm_answer_term(int sock, Buffer *req)
        exit(res);
 }
 
-#ifdef AUDIT_EVENTS
+#ifdef SSH_AUDIT_EVENTS
 /* Report that an audit event occurred */
 int
 mm_answer_audit_event(int socket, Buffer *m)
@@ -1523,14 +1525,14 @@ mm_answer_audit_event(int socket, Buffer *m)
        debug3("%s entering", __func__);
 
        event = buffer_get_int(m);
-       buffer_free(m);
        switch(event) {
-       case AUTH_FAIL_PUBKEY:
-       case AUTH_FAIL_HOSTBASED:
-       case AUTH_FAIL_GSSAPI:
-       case LOGIN_EXCEED_MAXTRIES:
-       case LOGIN_ROOT_DENIED:
-       case CONNECTION_CLOSE:
+       case SSH_AUTH_FAIL_PUBKEY:
+       case SSH_AUTH_FAIL_HOSTBASED:
+       case SSH_AUTH_FAIL_GSSAPI:
+       case SSH_LOGIN_EXCEED_MAXTRIES:
+       case SSH_LOGIN_ROOT_DENIED:
+       case SSH_CONNECTION_CLOSE:
+       case SSH_INVALID_USER:
                audit_event(event);
                break;
        default:
@@ -1551,10 +1553,9 @@ mm_answer_audit_command(int socket, Buffer *m)
        /* sanity check command, if so how? */
        audit_run_command(cmd);
        xfree(cmd);
-       buffer_free(m);
        return (0);
 }
-#endif /* AUDIT_EVENTS */
+#endif /* SSH_AUDIT_EVENTS */
 
 void
 monitor_apply_keystate(struct monitor *pmonitor)
@@ -1830,7 +1831,7 @@ mm_answer_gss_setup_ctx(int sock, Buffer *m)
        buffer_clear(m);
        buffer_put_int(m, major);
 
-       mm_request_send(sock,MONITOR_ANS_GSSSETUP, m);
+       mm_request_send(sock, MONITOR_ANS_GSSSETUP, m);
 
        /* Now we have a context, enable the step */
        monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 1);
@@ -1843,7 +1844,7 @@ mm_answer_gss_accept_ctx(int sock, Buffer *m)
 {
        gss_buffer_desc in;
        gss_buffer_desc out = GSS_C_EMPTY_BUFFER;
-       OM_uint32 major,minor;
+       OM_uint32 major, minor;
        OM_uint32 flags = 0; /* GSI needs this */
        u_int len;
 
@@ -1860,7 +1861,7 @@ mm_answer_gss_accept_ctx(int sock, Buffer *m)
 
        gss_release_buffer(&minor, &out);
 
-       if (major==GSS_S_COMPLETE) {
+       if (major == GSS_S_COMPLETE) {
                monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 0);
                monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1);
                monitor_permit(mon_dispatch, MONITOR_REQ_GSSCHECKMIC, 1);
@@ -1909,7 +1910,7 @@ mm_answer_gss_userok(int sock, Buffer *m)
        debug3("%s: sending result %d", __func__, authenticated);
        mm_request_send(sock, MONITOR_ANS_GSSUSEROK, m);
 
-       auth_method="gssapi-with-mic";
+       auth_method = "gssapi-with-mic";
 
        /* Monitor loop will terminate if authenticated */
        return (authenticated);