- dtucker@cvs.openbsd.org 2005/01/19 13:11:47

     [auth-bsdauth.c auth2-chall.c]
     Have keyboard-interactive code call the drivers even for responses for
     invalid logins.  This allows the drivers themselves to decide how to
     handle them and prevent leaking information where possible.  Existing
     behaviour for bsdauth is maintained by checking authctxt->valid in the
     bsdauth driver.  Note that any third-party kbdint drivers will now need
     to be able to handle responses for invalid logins.  ok markus@

diff --git a/ChangeLog b/ChangeLog
index 263f2e282e43b6528dc9606340e05ebee40fd733..569541d603f5e13786b99a8eee82ad3dd8f2dc87 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -22,6 +22,14 @@
    - dtucker@cvs.openbsd.org 2005/01/17 22:48:39
      [sshd.c]
      Make debugging output continue after reexec; ok djm@
+   - dtucker@cvs.openbsd.org 2005/01/19 13:11:47
+     [auth-bsdauth.c auth2-chall.c]
+     Have keyboard-interactive code call the drivers even for responses for
+     invalid logins.  This allows the drivers themselves to decide how to
+     handle them and prevent leaking information where possible.  Existing
+     behaviour for bsdauth is maintained by checking authctxt->valid in the
+     bsdauth driver.  Note that any third-party kbdint drivers will now need
+     to be able to handle responses for invalid logins.  ok markus@
 
 20050118
  - (dtucker) [INSTALL Makefile.in configure.ac survey.sh.in] Implement

diff --git a/auth-bsdauth.c b/auth-bsdauth.c
index 2ac27a7a20e7a0adc097cd5908a8bc0e47d8392e..920c977d85a67a065f6bba1af989e0322b79c3a4 100644 (file)
--- a/auth-bsdauth.c
+++ b/auth-bsdauth.c
@@ -22,7 +22,7 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #include "includes.h"
-RCSID("$OpenBSD: auth-bsdauth.c,v 1.5 2002/06/30 21:59:45 deraadt Exp $");
+RCSID("$OpenBSD: auth-bsdauth.c,v 1.6 2005/01/19 13:11:47 dtucker Exp $");
 
 #ifdef BSD_AUTH
 #include "xmalloc.h"
@@ -83,6 +83,9 @@ bsdauth_respond(void *ctx, u_int numresponses, char **responses)
        Authctxt *authctxt = ctx;
        int authok;
 
+       if (!authctxt->valid)
+               return -1;
+
        if (authctxt->as == 0)
                error("bsdauth_respond: no bsd auth session");
 

diff --git a/auth2-chall.c b/auth2-chall.c
index 486baaaa332e0a7c9b35dd7f261a53d452614ba5..29234439c36121fbd3f39e026d0a773e8d998c21 100644 (file)
--- a/auth2-chall.c
+++ b/auth2-chall.c
@@ -23,7 +23,7 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #include "includes.h"
-RCSID("$OpenBSD: auth2-chall.c,v 1.21 2004/06/01 14:20:45 dtucker Exp $");
+RCSID("$OpenBSD: auth2-chall.c,v 1.22 2005/01/19 13:11:47 dtucker Exp $");
 
 #include "ssh2.h"
 #include "auth.h"
@@ -274,12 +274,7 @@ input_userauth_info_response(int type, u_int32_t seq, void *ctxt)
        }
        packet_check_eom();
 
-       if (authctxt->valid) {
-               res = kbdintctxt->device->respond(kbdintctxt->ctxt,
-                   nresp, response);
-       } else {
-               res = -1;
-       }
+       res = kbdintctxt->device->respond(kbdintctxt->ctxt, nresp, response);
 
        for (i = 0; i < nresp; i++) {
                memset(response[i], 'r', strlen(response[i]));
@@ -291,7 +286,7 @@ input_userauth_info_response(int type, u_int32_t seq, void *ctxt)
        switch (res) {
        case 0:
                /* Success! */
-               authenticated = 1;
+               authenticated = authctxt->valid ? 1 : 0;
                break;
        case 1:
                /* Authentication needs further interaction */