- markus@cvs.openbsd.org 2003/05/11 20:30:25

[openssh.git] / auth1.c

diff --git a/auth1.c b/auth1.c
index 55dbf78facb513253b87b73f887c89bc18a51d8a..7fe363156e8c3c3d8f7c5d968b9a47bbb02c9976 100644 (file)
--- a/auth1.c
+++ b/auth1.c
@@ -10,7 +10,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: auth1.c,v 1.39 2002/03/19 14:27:39 markus Exp $");
+RCSID("$OpenBSD: auth1.c,v 1.48 2003/04/08 20:21:28 itojun Exp $");
 
 #include "xmalloc.h"
 #include "rsa.h"
@@ -73,7 +73,7 @@ do_authloop(Authctxt *authctxt)
        char info[1024];
        u_int dlen;
        u_int ulen;
-       int type = 0;
+       int prev, type = 0;
        struct passwd *pw = authctxt->pw;
 
        debug("Attempting authentication for %s%.100s.",
@@ -103,8 +103,20 @@ do_authloop(Authctxt *authctxt)
                info[0] = '\0';
 
                /* Get a packet from the client. */
+               prev = type;
                type = packet_read();
 
+               /*
+                * If we started challenge-response authentication but the
+                * next packet is not a response to our challenge, release
+                * the resources allocated by get_challenge() (which would
+                * normally have been released by verify_response() had we
+                * received such a response)
+                */
+               if (prev == SSH_CMSG_AUTH_TIS &&
+                   type != SSH_CMSG_AUTH_TIS_RESPONSE)
+                       abandon_challenge_response(authctxt);
+
                /* Process the packet. */
                switch (type) {
 
@@ -118,30 +130,49 @@ do_authloop(Authctxt *authctxt)
 
                                if (kdata[0] == 4) { /* KRB_PROT_VERSION */
 #ifdef KRB4
-                                       KTEXT_ST tkt;
-
+                                       KTEXT_ST tkt, reply;
                                        tkt.length = dlen;
                                        if (tkt.length < MAX_KTXT_LEN)
                                                memcpy(tkt.dat, kdata, tkt.length);
 
-                                       if (auth_krb4(authctxt, &tkt, &client_user)) {
+                                       if (PRIVSEP(auth_krb4(authctxt, &tkt,
+                                           &client_user, &reply))) {
                                                authenticated = 1;
                                                snprintf(info, sizeof(info),
                                                    " tktuser %.100s",
                                                    client_user);
+
+                                               packet_start(
+                                                   SSH_SMSG_AUTH_KERBEROS_RESPONSE);
+                                               packet_put_string((char *)
+                                                   reply.dat, reply.length);
+                                               packet_send();
+                                               packet_write_wait();
                                        }
 #endif /* KRB4 */
                                } else {
 #ifdef KRB5
-                                       krb5_data tkt;
+                                       krb5_data tkt, reply;
                                        tkt.length = dlen;
                                        tkt.data = kdata;
 
-                                       if (auth_krb5(authctxt, &tkt, &client_user)) {
+                                       if (PRIVSEP(auth_krb5(authctxt, &tkt,
+                                           &client_user, &reply))) {
                                                authenticated = 1;
                                                snprintf(info, sizeof(info),
                                                    " tktuser %.100s",
                                                    client_user);
+
+                                               /* Send response to client */
+                                               packet_start(
+                                                   SSH_SMSG_AUTH_KERBEROS_RESPONSE);
+                                               packet_put_string((char *)
+                                                   reply.data, reply.length);
+                                               packet_send();
+                                               packet_write_wait();
+
+                                               if (reply.length)
+                                                       xfree(reply.data);
                                        }
 #endif /* KRB5 */
                                }
@@ -203,7 +234,7 @@ do_authloop(Authctxt *authctxt)
                        if (bits != BN_num_bits(client_host_key->rsa->n))
                                verbose("Warning: keysize mismatch for client_host_key: "
                                    "actual %d, announced %d",
-                                    BN_num_bits(client_host_key->rsa->n), bits);
+                                   BN_num_bits(client_host_key->rsa->n), bits);
                        packet_check_eom();
 
                        authenticated = auth_rhosts_rsa(pw, client_user,
@@ -266,7 +297,6 @@ do_authloop(Authctxt *authctxt)
                        debug("rcvd SSH_CMSG_AUTH_TIS_RESPONSE");
                        if (options.challenge_response_authentication == 1) {
                                char *response = packet_get_string(&dlen);
-                               debug("got response '%s'", response);
                                packet_check_eom();
                                authenticated = verify_response(authctxt, response);
                                memset(response, 'r', dlen);
@@ -279,7 +309,7 @@ do_authloop(Authctxt *authctxt)
                         * Any unknown messages will be ignored (and failure
                         * returned) during authentication.
                         */
-                       log("Unknown message during authentication: type %d", type);
+                       logit("Unknown message during authentication: type %d", type);
                        break;
                }
 #ifdef BSD_AUTH
@@ -292,6 +322,13 @@ do_authloop(Authctxt *authctxt)
                        fatal("INTERNAL ERROR: authenticated invalid user %s",
                            authctxt->user);
 
+#ifdef _UNICOS
+               if (authenticated && cray_access_denied(authctxt->user)) {
+                       authenticated = 0;
+                       fatal("Access denied for user %s.",authctxt->user);
+               }
+#endif /* _UNICOS */
+
 #ifdef HAVE_CYGWIN
                if (authenticated &&
                    !check_nt_auth(type == SSH_CMSG_AUTH_PASSWORD, pw)) {
@@ -306,7 +343,8 @@ do_authloop(Authctxt *authctxt)
                        authenticated = 0;
 #endif
 #ifdef USE_PAM
-               if (authenticated && !do_pam_account(pw->pw_name, client_user))
+               if (!use_privsep && authenticated && 
+                   !do_pam_account(pw->pw_name, client_user))
                        authenticated = 0;
 #endif
 
@@ -321,14 +359,8 @@ do_authloop(Authctxt *authctxt)
                if (authenticated)
                        return;
 
-               if (authctxt->failures++ > AUTH_FAIL_MAX) {
-#ifdef WITH_AIXAUTHENTICATE
-                       loginfailed(authctxt->user,
-                           get_canonical_hostname(options.verify_reverse_mapping),
-                           "ssh");
-#endif /* WITH_AIXAUTHENTICATE */
+               if (authctxt->failures++ > AUTH_FAIL_MAX)
                        packet_disconnect(AUTH_FAIL_MSG, authctxt->user);
-               }
 
                packet_start(SSH_SMSG_FAILURE);
                packet_send();
@@ -345,7 +377,7 @@ do_authentication(void)
 {
        Authctxt *authctxt;
        u_int ulen;
-       char *p, *user, *style = NULL;
+       char *user, *style = NULL;
 
        /* Get the name of the user that we wish to log in as. */
        packet_read_expect(SSH_CMSG_USER);
@@ -357,9 +389,15 @@ do_authentication(void)
        if ((style = strchr(user, ':')) != NULL)
                *style++ = '\0';
 
+#ifdef KRB5
        /* XXX - SSH.com Kerberos v5 braindeath. */
-       if ((p = strchr(user, '@')) != NULL)
-               *p = '\0';
+       if ((datafellows & SSH_BUG_K5USER) &&
+           options.kerberos_authentication) {
+               char *p;
+               if ((p = strchr(user, '@')) != NULL)
+                       *p = '\0';
+       }
+#endif
 
        authctxt = authctxt_new();
        authctxt->user = user;
@@ -375,7 +413,7 @@ do_authentication(void)
            use_privsep ? " [net]" : "");
 
 #ifdef USE_PAM
-       start_pam(authctxt->pw == NULL ? "NOUSER" : user);
+       PRIVSEP(start_pam(user));
 #endif
 
        /*