Attachment 681 Details for Bug 892 – Collect PAM auth messages and send with SSH2_BANNER

[patch] Collect PAM auth messages and send with SSH2_BANNER

openssh-pam-banner.patch (text/plain), 8.16 KB, created by Darren Tucker on 2004-07-05 17:25:44 AEST

(hide)

Description:

Filename:

MIME Type:

Creator: Darren Tucker

Created: 2004-07-05 17:25:44 AEST

Size: 8.16 KB

patch

obsolete

>Index: auth-pam.c
>===================================================================
>RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/auth-pam.c,v
>retrieving revision 1.110
>diff -u -p -r1.110 auth-pam.c
>--- auth-pam.c	1 Jul 2004 04:00:15 -0000	1.110
>+++ auth-pam.c	5 Jul 2004 00:05:12 -0000
>@@ -461,6 +461,51 @@ sshpam_null_conv(int n, struct pam_messa
> 
> static struct pam_conv null_conv = { sshpam_null_conv, NULL };
> 
>+static int
>+sshpam_store_conv(int n, struct pam_message **msg,
>+    struct pam_response **resp, void *data)
>+{
>+	struct pam_response *reply;
>+	int i;
>+	size_t len;
>+
>+	debug3("PAM: %s called with %d messages", __func__, n);
>+	*resp = NULL;
>+
>+	if (n <= 0 || n > PAM_MAX_NUM_MSG)
>+		return (PAM_CONV_ERR);
>+
>+	if ((reply = malloc(n * sizeof(*reply))) == NULL)
>+		return (PAM_CONV_ERR);
>+	memset(reply, 0, n * sizeof(*reply));
>+
>+	for (i = 0; i < n; ++i) {
>+		switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
>+		case PAM_ERROR_MSG:
>+		case PAM_TEXT_INFO:
>+			len = strlen(PAM_MSG_MEMBER(msg, i, msg));
>+			buffer_append(&loginmsg, PAM_MSG_MEMBER(msg, i, msg), len);
>+			buffer_append(&loginmsg, "\n", 1 );
>+			reply[i].resp_retcode = PAM_SUCCESS;
>+			break;
>+		default:
>+			goto fail;
>+		}
>+	}
>+	*resp = reply;
>+	return (PAM_SUCCESS);
>+
>+ fail:
>+	for(i = 0; i < n; i++) {
>+		if (reply[i].resp != NULL)
>+			xfree(reply[i].resp);
>+	}
>+	xfree(reply);
>+	return (PAM_CONV_ERR);
>+}
>+
>+static struct pam_conv store_conv = { sshpam_store_conv, NULL };
>+
> void
> sshpam_cleanup(void)
> {
>@@ -498,7 +543,7 @@ sshpam_init(Authctxt *authctxt)
> 	}
> 	debug("PAM: initializing for \"%s\"", user);
> 	sshpam_err =
>-	    pam_start(SSHD_PAM_SERVICE, user, &null_conv, &sshpam_handle);
>+	    pam_start(SSHD_PAM_SERVICE, user, &store_conv, &sshpam_handle);
> 	sshpam_authctxt = authctxt;
> 
> 	if (sshpam_err != PAM_SUCCESS) {
>@@ -730,11 +775,13 @@ finish_pam(void)
> u_int
> do_pam_account(void)
> {
>+	debug("%s: called", __func__);
> 	if (sshpam_account_status != -1)
> 		return (sshpam_account_status);
> 
> 	sshpam_err = pam_acct_mgmt(sshpam_handle, 0);
>-	debug3("PAM: %s pam_acct_mgmt = %d", __func__, sshpam_err);
>+	debug3("PAM: %s pam_acct_mgmt = %d (%s)", __func__, sshpam_err,
>+	    pam_strerror(sshpam_handle, sshpam_err));
> 	
> 	if (sshpam_err != PAM_SUCCESS && sshpam_err != PAM_NEW_AUTHTOK_REQD) {
> 		sshpam_account_status = 0;
>@@ -764,7 +811,7 @@ void
> do_pam_setcred(int init)
> {
> 	sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
>-	    (const void *)&null_conv);
>+	    (const void *)&store_conv);
> 	if (sshpam_err != PAM_SUCCESS)
> 		fatal("PAM: failed to set PAM_CONV: %s",
> 		    pam_strerror(sshpam_handle, sshpam_err));
>@@ -863,51 +910,6 @@ do_pam_chauthtok(void)
> 		fatal("PAM: pam_chauthtok(): %s",
> 		    pam_strerror(sshpam_handle, sshpam_err));
> }
>-
>-static int
>-sshpam_store_conv(int n, struct pam_message **msg,
>-    struct pam_response **resp, void *data)
>-{
>-	struct pam_response *reply;
>-	int i;
>-	size_t len;
>-
>-	debug3("PAM: %s called with %d messages", __func__, n);
>-	*resp = NULL;
>-
>-	if (n <= 0 || n > PAM_MAX_NUM_MSG)
>-		return (PAM_CONV_ERR);
>-
>-	if ((reply = malloc(n * sizeof(*reply))) == NULL)
>-		return (PAM_CONV_ERR);
>-	memset(reply, 0, n * sizeof(*reply));
>-
>-	for (i = 0; i < n; ++i) {
>-		switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
>-		case PAM_ERROR_MSG:
>-		case PAM_TEXT_INFO:
>-			len = strlen(PAM_MSG_MEMBER(msg, i, msg));
>-			buffer_append(&loginmsg, PAM_MSG_MEMBER(msg, i, msg), len);
>-			buffer_append(&loginmsg, "\n", 1 );
>-			reply[i].resp_retcode = PAM_SUCCESS;
>-			break;
>-		default:
>-			goto fail;
>-		}
>-	}
>-	*resp = reply;
>-	return (PAM_SUCCESS);
>-
>- fail:
>-	for(i = 0; i < n; i++) {
>-		if (reply[i].resp != NULL)
>-			xfree(reply[i].resp);
>-	}
>-	xfree(reply);
>-	return (PAM_CONV_ERR);
>-}
>-
>-static struct pam_conv store_conv = { sshpam_store_conv, NULL };
> 
> void
> do_pam_session(void)
>Index: auth.h
>===================================================================
>RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/auth.h,v
>retrieving revision 1.62
>diff -u -p -r1.62 auth.h
>--- auth.h	24 May 2004 00:36:23 -0000	1.62
>+++ auth.h	5 Jul 2004 03:51:48 -0000
>@@ -137,6 +137,7 @@ void	do_authentication2(Authctxt *);
> 
> void	auth_log(Authctxt *, int, char *, char *);
> void	userauth_finish(Authctxt *, int, char *);
>+void	userauth_send_banner(const char *);
> int	auth_root_allowed(char *);
> 
> char	*auth2_read_banner(void);
>Index: auth2-none.c
>===================================================================
>RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/auth2-none.c,v
>retrieving revision 1.7
>diff -u -p -r1.7 auth2-none.c
>--- auth2-none.c	13 May 2004 06:39:33 -0000	1.7
>+++ auth2-none.c	5 Jul 2004 03:56:10 -0000
>@@ -74,6 +74,19 @@ auth2_read_banner(void)
> 	return (banner);
> }
> 
>+void
>+userauth_send_banner(const char *msg)
>+{
>+	if (datafellows & SSH_BUG_BANNER)
>+		return;
>+
>+	packet_start(SSH2_MSG_USERAUTH_BANNER);
>+	packet_put_cstring(msg);
>+	packet_put_cstring("");		/* language, unused */
>+	packet_send();
>+	debug("%s: sent", __func__);
>+}
>+
> static void
> userauth_banner(void)
> {
>@@ -84,12 +97,8 @@ userauth_banner(void)
> 
> 	if ((banner = PRIVSEP(auth2_read_banner())) == NULL)
> 		goto done;
>+	userauth_send_banner(banner);
> 
>-	packet_start(SSH2_MSG_USERAUTH_BANNER);
>-	packet_put_cstring(banner);
>-	packet_put_cstring("");		/* language, unused */
>-	packet_send();
>-	debug("userauth_banner: sent");
> done:
> 	if (banner)
> 		xfree(banner);
>Index: auth2.c
>===================================================================
>RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/auth2.c,v
>retrieving revision 1.128
>diff -u -p -r1.128 auth2.c
>--- auth2.c	24 May 2004 00:36:23 -0000	1.128
>+++ auth2.c	5 Jul 2004 04:05:12 -0000
>@@ -35,6 +35,7 @@ RCSID("$OpenBSD: auth2.c,v 1.105 2004/05
> #include "dispatch.h"
> #include "pathnames.h"
> #include "monitor_wrap.h"
>+#include "buffer.h"
> 
> #ifdef GSSAPI
> #include "ssh-gss.h"
>@@ -44,6 +45,7 @@ RCSID("$OpenBSD: auth2.c,v 1.105 2004/05
> extern ServerOptions options;
> extern u_char *session_id2;
> extern u_int session_id2_len;
>+extern Buffer loginmsg;
> 
> /* methods */
> 
>@@ -216,8 +218,17 @@ userauth_finish(Authctxt *authctxt, int 
> 		authenticated = 0;
> 
> #ifdef USE_PAM
>-	if (options.use_pam && authenticated && !PRIVSEP(do_pam_account()))
>-		authenticated = 0;
>+	if (options.use_pam && authenticated) {
>+		if (!PRIVSEP(do_pam_account())) {
>+			authenticated = 0;
>+			/* if PAM returned a message, send it to the user */
>+			if (buffer_len(&loginmsg) > 0) {
>+				buffer_append(&loginmsg, "\0", 1);
>+				userauth_send_banner(buffer_ptr(&loginmsg));
>+				buffer_clear(&loginmsg);
>+			}
>+		}
>+	}
> #endif
> 
> #ifdef _UNICOS
>Index: monitor.c
>===================================================================
>RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/monitor.c,v
>retrieving revision 1.75
>diff -u -p -r1.75 monitor.c
>--- monitor.c	22 Jun 2004 05:06:46 -0000	1.75
>+++ monitor.c	3 Jul 2004 10:06:41 -0000
>@@ -79,6 +79,7 @@ extern u_char session_id[];
> extern Buffer input, output;
> extern Buffer auth_debug;
> extern int auth_debug_init;
>+extern Buffer loginmsg;
> 
> /* State exported from the child */
> 
>@@ -809,6 +810,9 @@ mm_answer_pam_account(int sock, Buffer *
> 	ret = do_pam_account();
> 
> 	buffer_put_int(m, ret);
>+	buffer_append(&loginmsg, "\0", 1);
>+	buffer_put_cstring(m, buffer_ptr(&loginmsg));
>+	buffer_clear(&loginmsg);
> 
> 	mm_request_send(sock, MONITOR_ANS_PAM_ACCOUNT, m);
> 
>Index: monitor_wrap.c
>===================================================================
>RCS file: /usr/local/src/security/openssh/cvs/openssh_cvs/monitor_wrap.c,v
>retrieving revision 1.46
>diff -u -p -r1.46 monitor_wrap.c
>--- monitor_wrap.c	22 Jun 2004 05:06:46 -0000	1.46
>+++ monitor_wrap.c	5 Jul 2004 03:59:51 -0000
>@@ -71,6 +71,7 @@ extern z_stream outgoing_stream;
> extern struct monitor *pmonitor;
> extern Buffer input, output;
> extern ServerOptions options;
>+extern Buffer loginmsg;
> 
> int
> mm_is_monitor(void)
>@@ -711,6 +712,7 @@ mm_do_pam_account(void)
> {
> 	Buffer m;
> 	u_int ret;
>+	char *msg;
> 
> 	debug3("%s entering", __func__);
> 	if (!options.use_pam)
>@@ -722,6 +724,9 @@ mm_do_pam_account(void)
> 	mm_request_receive_expect(pmonitor->m_recvfd,
> 	    MONITOR_ANS_PAM_ACCOUNT, &m);
> 	ret = buffer_get_int(&m);
>+	msg = buffer_get_string(&m, NULL);
>+	buffer_append(&loginmsg, msg, strlen(msg));
>+	xfree(msg);
> 
> 	buffer_free(&m);
>

Flags:

djm: ok+

Actions: View | Diff

Attachments on bug 892: 681