- (stevesk) [auth-pam.c auth-pam.h auth-passwd.c auth-sia.c auth-sia.h

    auth1.c auth2.c] PAM, OSF_SIA password auth cleanup; from djm.

diff --git a/ChangeLog b/ChangeLog
index 5494f016eb4b136823fa1b7f6cea833e3e4ef9bf..cc1db7c4ce58c26258d8fe33342889528236d541 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,7 @@
+20020404
+ - (stevesk) [auth-pam.c auth-pam.h auth-passwd.c auth-sia.c auth-sia.h
+    auth1.c auth2.c] PAM, OSF_SIA password auth cleanup; from djm.
+
 20020402
  - (bal) Hand Sync of scp.c (reverted to upstream code)
    - deraadt@cvs.openbsd.org 2002/03/30 17:45:46

diff --git a/auth-pam.c b/auth-pam.c
index 687c95ccd0cbfea5e484159e9829e1046adf46fb..0740fcef22139953bfacbc36dcd10845c7b7e155 100644 (file)
--- a/auth-pam.c
+++ b/auth-pam.c
@@ -28,6 +28,7 @@
 #include "ssh.h"
 #include "xmalloc.h"
 #include "log.h"
+#include "auth.h"
 #include "auth-pam.h"
 #include "servconf.h"
 #include "canohost.h"
@@ -199,10 +200,11 @@ void do_pam_cleanup_proc(void *context)
 }
 
 /* Attempt password authentation using PAM */
-int auth_pam_password(struct passwd *pw, const char *password)
+int auth_pam_password(Authctxt *authctxt, const char *password)
 {
        extern ServerOptions options;
        int pam_retval;
+       struct passwd *pw = authctxt->pw;
 
        do_pam_set_conv(&conv);
 

diff --git a/auth-pam.h b/auth-pam.h
index 30e4df51081077b7ae1a30827589a054981e8a7d..fabd3d04288f2e8c9b8ef74549aa8eff42ea0a2a 100644 (file)
--- a/auth-pam.h
+++ b/auth-pam.h
@@ -7,7 +7,7 @@
 
 void start_pam(const char *user);
 void finish_pam(void);
-int auth_pam_password(struct passwd *pw, const char *password);
+int auth_pam_password(Authctxt *authctxt, const char *password);
 char **fetch_pam_environment(void);
 int do_pam_authenticate(int flags);
 int do_pam_account(char *username, char *remote_user);

diff --git a/auth-passwd.c b/auth-passwd.c
index 095b9ba27c9b43e7eba6c5bd2c9de28cbb10b704..7f307383968d58924200e7475991956bbc75e4fb 100644 (file)
--- a/auth-passwd.c
+++ b/auth-passwd.c
@@ -38,47 +38,47 @@
 #include "includes.h"
 RCSID("$OpenBSD: auth-passwd.c,v 1.24 2002/03/04 12:43:06 markus Exp $");
 
-#if !defined(USE_PAM) && !defined(HAVE_OSF_SIA)
-
 #include "packet.h"
 #include "log.h"
 #include "servconf.h"
 #include "auth.h"
 
-#ifdef HAVE_CRYPT_H
-# include <crypt.h>
-#endif
-#ifdef WITH_AIXAUTHENTICATE
-# include <login.h>
-#endif
-#ifdef __hpux
-# include <hpsecurity.h>
-# include <prot.h>
-#endif
-#ifdef HAVE_SCO_PROTECTED_PW
-# include <sys/security.h>
-# include <sys/audit.h>
-# include <prot.h>
-#endif /* HAVE_SCO_PROTECTED_PW */
-#if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
-# include <shadow.h>
-#endif
-#if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW)
-# include <sys/label.h>
-# include <sys/audit.h>
-# include <pwdadj.h>
-#endif
-#if defined(HAVE_MD5_PASSWORDS) && !defined(HAVE_MD5_CRYPT)
-# include "md5crypt.h"
-#endif /* defined(HAVE_MD5_PASSWORDS) && !defined(HAVE_MD5_CRYPT) */
-
-#ifdef HAVE_CYGWIN
-#undef ERROR
-#include <windows.h>
-#include <sys/cygwin.h>
-#define is_winnt       (GetVersion() < 0x80000000)
-#endif
-
+#if !defined(USE_PAM) && !defined(HAVE_OSF_SIA)
+/* Don't need any of these headers for the PAM or SIA cases */
+# ifdef HAVE_CRYPT_H
+#  include <crypt.h>
+# endif
+# ifdef WITH_AIXAUTHENTICATE
+#  include <login.h>
+# endif
+# ifdef __hpux
+#  include <hpsecurity.h>
+#  include <prot.h>
+# endif
+# ifdef HAVE_SCO_PROTECTED_PW
+#  include <sys/security.h>
+#  include <sys/audit.h>
+#  include <prot.h>
+# endif /* HAVE_SCO_PROTECTED_PW */
+# if defined(HAVE_SHADOW_H) && !defined(DISABLE_SHADOW)
+#  include <shadow.h>
+# endif
+# if defined(HAVE_GETPWANAM) && !defined(DISABLE_SHADOW)
+#  include <sys/label.h>
+#  include <sys/audit.h>
+#  include <pwdadj.h>
+# endif
+# if defined(HAVE_MD5_PASSWORDS) && !defined(HAVE_MD5_CRYPT)
+#  include "md5crypt.h"
+# endif /* defined(HAVE_MD5_PASSWORDS) && !defined(HAVE_MD5_CRYPT) */
+
+# ifdef HAVE_CYGWIN
+#  undef ERROR
+#  include <windows.h>
+#  include <sys/cygwin.h>
+#  define is_winnt       (GetVersion() < 0x80000000)
+# endif
+#endif /* !USE_PAM && !HAVE_OSF_SIA */
 
 extern ServerOptions options;
 
@@ -89,6 +89,15 @@ extern ServerOptions options;
 int
 auth_password(Authctxt *authctxt, const char *password)
 {
+#if defined(USE_PAM)
+       if (*password == '\0' && options.permit_empty_passwd == 0)
+               return 0;
+       return auth_pam_password(authctxt, password);
+#elif defined(HAVE_OSF_SIA)
+       if (*password == '\0' && options.permit_empty_passwd == 0)
+               return 0;
+       return auth_sia_password(authctxt, password);
+#else
        struct passwd * pw = authctxt->pw;
        char *encrypted_password;
        char *pw_password;
@@ -221,5 +230,5 @@ auth_password(Authctxt *authctxt, const char *password)
 
        /* Authentication is accepted if the encrypted passwords are identical. */
        return (strcmp(encrypted_password, pw_password) == 0);
-}
 #endif /* !USE_PAM && !HAVE_OSF_SIA */
+}

diff --git a/auth-sia.c b/auth-sia.c
index 8585f5d6b6fb4ba541eda0a9d0f4d7a24326ea78..2bace5d474d9c25f0db6e6046a7683c8d0e65cdd 100644 (file)
--- a/auth-sia.c
+++ b/auth-sia.c
@@ -6,6 +6,7 @@
 #include "log.h"
 #include "servconf.h"
 #include "canohost.h"
+#include "auth.h"
 
 #include <sia.h>
 #include <siad.h>
@@ -23,15 +24,16 @@ extern char **saved_argv;
 extern int errno;
 
 int
-auth_sia_password(char *user, char *pass)
+auth_sia_password(Authctxt *authctxt, char *pass)
 {
        int ret;
        SIAENTITY *ent = NULL;
        const char *host;
+       char *user = authctxt->user;
 
        host = get_canonical_hostname(options.verify_reverse_mapping);
 
-       if (!user || !pass)
+       if (!user || !pass || pass[0] == '\0')
                return(0);
 
        if (sia_ses_init(&ent, saved_argc, saved_argv, host, user, NULL, 0,

diff --git a/auth-sia.h b/auth-sia.h
index eaa933322d494019831fd0e91f78b654f89d9781..4ae8d89915a1391ea62d32b3d7bb24fa23f795c7 100644 (file)
--- a/auth-sia.h
+++ b/auth-sia.h
@@ -2,7 +2,7 @@
 
 #ifdef HAVE_OSF_SIA
 
-int    auth_sia_password(char *user, char *pass);
+int    auth_sia_password(Authctxt *authctxt, char *pass);
 void   session_setup_sia(char *user, char *tty);
 
 #endif /* HAVE_OSF_SIA */

diff --git a/auth1.c b/auth1.c
index 89ae47df246133f4f1177737b39df96f2d603556..55dbf78facb513253b87b73f887c89bc18a51d8a 100644 (file)
--- a/auth1.c
+++ b/auth1.c
@@ -84,13 +84,7 @@ do_authloop(Authctxt *authctxt)
 #if defined(KRB4) || defined(KRB5)
            (!options.kerberos_authentication || options.kerberos_or_local_passwd) &&
 #endif
-#ifdef USE_PAM
-           auth_pam_password(pw, "")) {
-#elif defined(HAVE_OSF_SIA)
-           0) {
-#else
            PRIVSEP(auth_password(authctxt, ""))) {
-#endif
                auth_log(authctxt, 1, "without authentication", "");
                return;
        }
@@ -246,17 +240,8 @@ do_authloop(Authctxt *authctxt)
                        password = packet_get_string(&dlen);
                        packet_check_eom();
 
-#ifdef USE_PAM
-                       /* Do PAM auth with password */
-                       authenticated = auth_pam_password(pw, password);
-#elif defined(HAVE_OSF_SIA)
-                       /* Do SIA auth with password */
-                       authenticated = auth_sia_password(authctxt->user, 
-                           password);
-#else /* !USE_PAM && !HAVE_OSF_SIA */
                        /* Try authentication with the password. */
                        authenticated = PRIVSEP(auth_password(authctxt, password));
-#endif /* USE_PAM */
 
                        memset(password, 0, strlen(password));
                        xfree(password);

diff --git a/auth2.c b/auth2.c
index 3377fde8b1b7c2924f2012ea1c65f5ee2eccc081..eadaa7135a0ec86620487a91333a05a0080f9000 100644 (file)
--- a/auth2.c
+++ b/auth2.c
@@ -329,13 +329,7 @@ userauth_none(Authctxt *authctxt)
        if (check_nt_auth(1, authctxt->pw) == 0)
                return(0);
 #endif
-#ifdef USE_PAM
-       return auth_pam_password(authctxt->pw, "");
-#elif defined(HAVE_OSF_SIA)
-       return 0;
-#else /* !HAVE_OSF_SIA && !USE_PAM */
        return PRIVSEP(auth_password(authctxt, ""));
-#endif /* USE_PAM */
 }
 
 static int
@@ -354,13 +348,7 @@ userauth_passwd(Authctxt *authctxt)
 #ifdef HAVE_CYGWIN
            check_nt_auth(1, authctxt->pw) &&
 #endif
-#ifdef USE_PAM
-           auth_pam_password(authctxt->pw, password) == 1)
-#elif defined(HAVE_OSF_SIA)
-           auth_sia_password(authctxt->user, password) == 1)
-#else /* !USE_PAM && !HAVE_OSF_SIA */
            PRIVSEP(auth_password(authctxt, password)) == 1)
-#endif /* USE_PAM */
                authenticated = 1;
        memset(password, 0, len);
        xfree(password);