X-Git-Url: http://andersk.mit.edu/gitweb/openssh.git/blobdiff_plain/022487ce01e98352740bbf211fc36604a7743c71..b1f0c61269f2e5121405d51d9554777735c8f2bd:/auth-passwd.c

diff --git a/auth-passwd.c b/auth-passwd.c
index 2e5fbc73..6e6d0d76 100644
--- a/auth-passwd.c
+++ b/auth-passwd.c
@@ -36,7 +36,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: auth-passwd.c,v 1.32 2005/01/21 08:32:02 otto Exp $");
+RCSID("$OpenBSD: auth-passwd.c,v 1.34 2005/07/19 15:32:26 otto Exp $");
 
 #include "packet.h"
 #include "buffer.h"
@@ -47,7 +47,6 @@ RCSID("$OpenBSD: auth-passwd.c,v 1.32 2005/01/21 08:32:02 otto Exp $");
 
 extern Buffer loginmsg;
 extern ServerOptions options;
-int sys_auth_passwd(Authctxt *, const char *);
 
 #ifdef HAVE_LOGIN_CAP
 extern login_cap_t *lc;
@@ -73,7 +72,7 @@ int
 auth_password(Authctxt *authctxt, const char *password)
 {
 	struct passwd * pw = authctxt->pw;
-	int ok = authctxt->valid;
+	int result, ok = authctxt->valid;
 #if defined(USE_SHADOW) && defined(HAS_SHADOW_EXPIRE)
 	static int expire_checked = 0;
 #endif
@@ -110,14 +109,14 @@ auth_password(Authctxt *authctxt, const char *password)
 #if defined(USE_SHADOW) && defined(HAS_SHADOW_EXPIRE)
 	if (!expire_checked) {
 		expire_checked = 1;
-		if (auth_shadow_pwexpired(authctxt)) {
-			disable_forwarding();
+		if (auth_shadow_pwexpired(authctxt))
 			authctxt->force_pwchange = 1;
-		}
 	}
 #endif
-		
-	return (sys_auth_passwd(authctxt, password) && ok);
+	result = sys_auth_passwd(authctxt, password);
+	if (authctxt->force_pwchange)
+		disable_forwarding();
+	return (result && ok);
 }
 
 #ifdef BSD_AUTH
@@ -131,7 +130,7 @@ warn_expiry(Authctxt *authctxt, auth_session_t *as)
 
 	pwtimeleft = auth_check_change(as);
 	actimeleft = auth_check_expire(as);
-#if HAVE_LOGIN_CAP
+#ifdef HAVE_LOGIN_CAP
 	if (authctxt->valid) {
 		pwwarntime = login_getcaptime(lc, "password-warn", TWO_WEEKS,
 		    TWO_WEEKS);
@@ -164,6 +163,8 @@ sys_auth_passwd(Authctxt *authctxt, const char *password)
 
 	as = auth_usercheck(pw->pw_name, authctxt->style, "auth-ssh",
 	    (char *)password);
+	if (as == NULL)
+		return (0);
 	if (auth_getstate(as) & AUTH_PWEXPIRED) {
 		auth_close(as);
 		disable_forwarding();