rpms/openssh
3
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

removed dead code and fixed segfault in openssh-5.9p1-required-authentications.patch

Browse Source
This commit is contained in:
Petr Lautrbach 2012-07-27 12:55:06 +02:00
parent e9620308c8
commit 420ff03c91
2 changed files with 99 additions and 98 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

76
openssh-5.9p1-audit4.patch
View File

@ -1,6 +1,6 @@
diff -up openssh-5.9p1/audit-bsm.c.audit4 openssh-5.9p1/audit-bsm.c diff -up openssh-5.9p1/audit-bsm.c.audit4 openssh-5.9p1/audit-bsm.c
--- openssh-5.9p1/audit-bsm.c.audit4 2012-02-06 17:15:01.574908126 +0100 --- openssh-5.9p1/audit-bsm.c.audit4 2012-07-27 14:27:56.149474798 +0200
+++ openssh-5.9p1/audit-bsm.c 2012-02-06 17:15:21.656095559 +0100 +++ openssh-5.9p1/audit-bsm.c 2012-07-27 14:27:56.164474882 +0200
@@ -408,4 +408,10 @@ audit_kex_body(int ctos, char *enc, char @@ -408,4 +408,10 @@ audit_kex_body(int ctos, char *enc, char
{ {
/* not implemented */ /* not implemented */
@ -13,8 +13,8 @@ diff -up openssh-5.9p1/audit-bsm.c.audit4 openssh-5.9p1/audit-bsm.c
+} +}
#endif /* BSM */ #endif /* BSM */
diff -up openssh-5.9p1/audit.c.audit4 openssh-5.9p1/audit.c diff -up openssh-5.9p1/audit.c.audit4 openssh-5.9p1/audit.c
--- openssh-5.9p1/audit.c.audit4 2012-02-06 17:15:01.576787216 +0100 --- openssh-5.9p1/audit.c.audit4 2012-07-27 14:27:56.150474804 +0200
+++ openssh-5.9p1/audit.c 2012-02-06 17:15:21.690032906 +0100 +++ openssh-5.9p1/audit.c 2012-07-27 14:27:56.165474888 +0200
@@ -143,6 +143,12 @@ audit_kex(int ctos, char *enc, char *mac @@ -143,6 +143,12 @@ audit_kex(int ctos, char *enc, char *mac
PRIVSEP(audit_kex_body(ctos, enc, mac, comp, getpid(), getuid())); PRIVSEP(audit_kex_body(ctos, enc, mac, comp, getpid(), getuid()));
} }
@ -45,8 +45,8 @@ diff -up openssh-5.9p1/audit.c.audit4 openssh-5.9p1/audit.c
# endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */ # endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */
#endif /* SSH_AUDIT_EVENTS */ #endif /* SSH_AUDIT_EVENTS */
diff -up openssh-5.9p1/audit.h.audit4 openssh-5.9p1/audit.h diff -up openssh-5.9p1/audit.h.audit4 openssh-5.9p1/audit.h
--- openssh-5.9p1/audit.h.audit4 2012-02-06 17:15:01.576787216 +0100 --- openssh-5.9p1/audit.h.audit4 2012-07-27 14:27:56.151474810 +0200
+++ openssh-5.9p1/audit.h 2012-02-06 17:15:21.690876254 +0100 +++ openssh-5.9p1/audit.h 2012-07-27 14:27:56.165474888 +0200
@@ -62,5 +62,7 @@ void audit_unsupported(int); @@ -62,5 +62,7 @@ void audit_unsupported(int);
void audit_kex(int, char *, char *, char *); void audit_kex(int, char *, char *, char *);
void audit_unsupported_body(int); void audit_unsupported_body(int);
@ -56,8 +56,8 @@ diff -up openssh-5.9p1/audit.h.audit4 openssh-5.9p1/audit.h
#endif /* _SSH_AUDIT_H */ #endif /* _SSH_AUDIT_H */
diff -up openssh-5.9p1/audit-linux.c.audit4 openssh-5.9p1/audit-linux.c diff -up openssh-5.9p1/audit-linux.c.audit4 openssh-5.9p1/audit-linux.c
--- openssh-5.9p1/audit-linux.c.audit4 2012-02-06 17:15:01.575908525 +0100 --- openssh-5.9p1/audit-linux.c.audit4 2012-07-27 14:27:56.149474798 +0200
+++ openssh-5.9p1/audit-linux.c 2012-02-06 17:15:21.682001323 +0100 +++ openssh-5.9p1/audit-linux.c 2012-07-27 14:27:56.166474894 +0200
@@ -294,6 +294,8 @@ audit_unsupported_body(int what) @@ -294,6 +294,8 @@ audit_unsupported_body(int what)
#endif #endif
} }
@ -109,8 +109,8 @@ diff -up openssh-5.9p1/audit-linux.c.audit4 openssh-5.9p1/audit-linux.c
+ +
#endif /* USE_LINUX_AUDIT */ #endif /* USE_LINUX_AUDIT */
diff -up openssh-5.9p1/auditstub.c.audit4 openssh-5.9p1/auditstub.c diff -up openssh-5.9p1/auditstub.c.audit4 openssh-5.9p1/auditstub.c
--- openssh-5.9p1/auditstub.c.audit4 2012-02-06 17:15:01.576787216 +0100 --- openssh-5.9p1/auditstub.c.audit4 2012-07-27 14:27:56.151474810 +0200
+++ openssh-5.9p1/auditstub.c 2012-02-06 17:15:21.690876254 +0100 +++ openssh-5.9p1/auditstub.c 2012-07-27 14:27:56.166474894 +0200
@@ -27,6 +27,8 @@ @@ -27,6 +27,8 @@
* Red Hat author: Jan F. Chadima <jchadima@redhat.com> * Red Hat author: Jan F. Chadima <jchadima@redhat.com>
*/ */
@ -134,8 +134,8 @@ diff -up openssh-5.9p1/auditstub.c.audit4 openssh-5.9p1/auditstub.c
+{ +{
+} +}
diff -up openssh-5.9p1/kex.c.audit4 openssh-5.9p1/kex.c diff -up openssh-5.9p1/kex.c.audit4 openssh-5.9p1/kex.c
--- openssh-5.9p1/kex.c.audit4 2012-02-06 17:15:01.578907640 +0100 --- openssh-5.9p1/kex.c.audit4 2012-07-27 14:27:56.153474822 +0200
+++ openssh-5.9p1/kex.c 2012-02-06 17:15:21.691785656 +0100 +++ openssh-5.9p1/kex.c 2012-07-27 14:27:56.167474900 +0200
@@ -624,3 +624,34 @@ dump_digest(char *msg, u_char *digest, i @@ -624,3 +624,34 @@ dump_digest(char *msg, u_char *digest, i
fprintf(stderr, "\n"); fprintf(stderr, "\n");
} }
@ -173,7 +173,7 @@ diff -up openssh-5.9p1/kex.c.audit4 openssh-5.9p1/kex.c
+ +
diff -up openssh-5.9p1/kex.h.audit4 openssh-5.9p1/kex.h diff -up openssh-5.9p1/kex.h.audit4 openssh-5.9p1/kex.h
--- openssh-5.9p1/kex.h.audit4 2010-09-24 14:11:14.000000000 +0200 --- openssh-5.9p1/kex.h.audit4 2010-09-24 14:11:14.000000000 +0200
+++ openssh-5.9p1/kex.h 2012-02-06 17:15:21.691785656 +0100 +++ openssh-5.9p1/kex.h 2012-07-27 14:27:56.168474905 +0200
@@ -156,6 +156,8 @@ void kexgex_server(Kex *); @@ -156,6 +156,8 @@ void kexgex_server(Kex *);
void kexecdh_client(Kex *); void kexecdh_client(Kex *);
void kexecdh_server(Kex *); void kexecdh_server(Kex *);
@ -185,7 +185,7 @@ diff -up openssh-5.9p1/kex.h.audit4 openssh-5.9p1/kex.h
BIGNUM *, BIGNUM *, BIGNUM *, u_char **, u_int *); BIGNUM *, BIGNUM *, BIGNUM *, u_char **, u_int *);
diff -up openssh-5.9p1/mac.c.audit4 openssh-5.9p1/mac.c diff -up openssh-5.9p1/mac.c.audit4 openssh-5.9p1/mac.c
--- openssh-5.9p1/mac.c.audit4 2011-08-17 02:29:03.000000000 +0200 --- openssh-5.9p1/mac.c.audit4 2011-08-17 02:29:03.000000000 +0200
+++ openssh-5.9p1/mac.c 2012-02-06 17:15:21.692918961 +0100 +++ openssh-5.9p1/mac.c 2012-07-27 14:27:56.168474905 +0200
@@ -168,6 +168,20 @@ mac_clear(Mac *mac) @@ -168,6 +168,20 @@ mac_clear(Mac *mac)
mac->umac_ctx = NULL; mac->umac_ctx = NULL;
} }
@ -209,16 +209,16 @@ diff -up openssh-5.9p1/mac.c.audit4 openssh-5.9p1/mac.c
int int
diff -up openssh-5.9p1/mac.h.audit4 openssh-5.9p1/mac.h diff -up openssh-5.9p1/mac.h.audit4 openssh-5.9p1/mac.h
--- openssh-5.9p1/mac.h.audit4 2007-06-11 06:01:42.000000000 +0200 --- openssh-5.9p1/mac.h.audit4 2007-06-11 06:01:42.000000000 +0200
+++ openssh-5.9p1/mac.h 2012-02-06 17:15:21.692918961 +0100 +++ openssh-5.9p1/mac.h 2012-07-27 14:27:56.169474910 +0200
@@ -28,3 +28,4 @@ int mac_setup(Mac *, char *); @@ -28,3 +28,4 @@ int mac_setup(Mac *, char *);
int mac_init(Mac *); int mac_init(Mac *);
u_char *mac_compute(Mac *, u_int32_t, u_char *, int); u_char *mac_compute(Mac *, u_int32_t, u_char *, int);
void mac_clear(Mac *); void mac_clear(Mac *);
+void mac_destroy(Mac *); +void mac_destroy(Mac *);
diff -up openssh-5.9p1/monitor.c.audit4 openssh-5.9p1/monitor.c diff -up openssh-5.9p1/monitor.c.audit4 openssh-5.9p1/monitor.c
--- openssh-5.9p1/monitor.c.audit4 2012-02-06 17:15:01.579896475 +0100 --- openssh-5.9p1/monitor.c.audit4 2012-07-27 14:27:56.154474827 +0200
+++ openssh-5.9p1/monitor.c 2012-02-06 17:16:32.405783810 +0100 +++ openssh-5.9p1/monitor.c 2012-07-27 14:31:20.311655098 +0200
@@ -189,6 +189,7 @@ int mm_answer_audit_command(int, Buffer @@ -189,6 +189,7 @@ int mm_answer_audit_command(int, Buffer
int mm_answer_audit_end_command(int, Buffer *); int mm_answer_audit_end_command(int, Buffer *);
int mm_answer_audit_unsupported_body(int, Buffer *); int mm_answer_audit_unsupported_body(int, Buffer *);
int mm_answer_audit_kex_body(int, Buffer *); int mm_answer_audit_kex_body(int, Buffer *);
@ -226,7 +226,7 @@ diff -up openssh-5.9p1/monitor.c.audit4 openssh-5.9p1/monitor.c
#endif #endif
static int monitor_read_log(struct monitor *); static int monitor_read_log(struct monitor *);
@@ -242,6 +243,7 @@ struct mon_table mon_dispatch_proto20[] @@ -242,6 +243,7 @@ struct mon_table mon_dispatch_proto20[]
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event}, {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
{MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body}, {MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},
{MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body}, {MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},
@ -242,7 +242,7 @@ diff -up openssh-5.9p1/monitor.c.audit4 openssh-5.9p1/monitor.c
#endif #endif
{0, 0, NULL} {0, 0, NULL}
}; };
@@ -314,6 +317,7 @@ struct mon_table mon_dispatch_proto15[] @@ -314,6 +317,7 @@ struct mon_table mon_dispatch_proto15[]
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event}, {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
{MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body}, {MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},
{MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body}, {MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},
@ -258,8 +258,8 @@ diff -up openssh-5.9p1/monitor.c.audit4 openssh-5.9p1/monitor.c
#endif #endif
{0, 0, NULL} {0, 0, NULL}
}; };
@@ -451,10 +456,6 @@ monitor_child_preauth(Authctxt *_authctx @@ -449,10 +454,6 @@ monitor_child_preauth(Authctxt *_authctx
#endif authenticated = 0;
} }
- /* Drain any buffered messages from the child */ - /* Drain any buffered messages from the child */
@ -269,7 +269,7 @@ diff -up openssh-5.9p1/monitor.c.audit4 openssh-5.9p1/monitor.c
if (!authctxt->valid) if (!authctxt->valid)
fatal("%s: authenticated invalid user", __func__); fatal("%s: authenticated invalid user", __func__);
if (strcmp(auth_method, "unknown") == 0) if (strcmp(auth_method, "unknown") == 0)
@@ -1954,11 +1955,13 @@ mm_get_keystate(struct monitor *pmonitor @@ -1952,11 +1953,13 @@ mm_get_keystate(struct monitor *pmonitor
blob = buffer_get_string(&m, &bloblen); blob = buffer_get_string(&m, &bloblen);
current_keys[MODE_OUT] = mm_newkeys_from_blob(blob, bloblen); current_keys[MODE_OUT] = mm_newkeys_from_blob(blob, bloblen);
@ -283,7 +283,7 @@ diff -up openssh-5.9p1/monitor.c.audit4 openssh-5.9p1/monitor.c
xfree(blob); xfree(blob);
/* Now get sequence numbers for the packets */ /* Now get sequence numbers for the packets */
@@ -2004,6 +2007,21 @@ mm_get_keystate(struct monitor *pmonitor @@ -2002,6 +2005,21 @@ mm_get_keystate(struct monitor *pmonitor
} }
buffer_free(&m); buffer_free(&m);
@ -305,7 +305,7 @@ diff -up openssh-5.9p1/monitor.c.audit4 openssh-5.9p1/monitor.c
} }
@@ -2450,4 +2468,22 @@ mm_answer_audit_kex_body(int sock, Buffe @@ -2448,4 +2466,22 @@ mm_answer_audit_kex_body(int sock, Buffe
return 0; return 0;
} }
@ -329,8 +329,8 @@ diff -up openssh-5.9p1/monitor.c.audit4 openssh-5.9p1/monitor.c
+} +}
#endif /* SSH_AUDIT_EVENTS */ #endif /* SSH_AUDIT_EVENTS */
diff -up openssh-5.9p1/monitor.h.audit4 openssh-5.9p1/monitor.h diff -up openssh-5.9p1/monitor.h.audit4 openssh-5.9p1/monitor.h
--- openssh-5.9p1/monitor.h.audit4 2012-02-06 17:15:01.580908188 +0100 --- openssh-5.9p1/monitor.h.audit4 2012-07-27 14:27:56.155474832 +0200
+++ openssh-5.9p1/monitor.h 2012-02-06 17:15:21.695033617 +0100 +++ openssh-5.9p1/monitor.h 2012-07-27 14:27:56.171474920 +0200
@@ -63,6 +63,7 @@ enum monitor_reqtype { @@ -63,6 +63,7 @@ enum monitor_reqtype {
MONITOR_ANS_AUDIT_COMMAND, MONITOR_REQ_AUDIT_END_COMMAND, MONITOR_ANS_AUDIT_COMMAND, MONITOR_REQ_AUDIT_END_COMMAND,
MONITOR_REQ_AUDIT_UNSUPPORTED, MONITOR_ANS_AUDIT_UNSUPPORTED, MONITOR_REQ_AUDIT_UNSUPPORTED, MONITOR_ANS_AUDIT_UNSUPPORTED,
@ -340,8 +340,8 @@ diff -up openssh-5.9p1/monitor.h.audit4 openssh-5.9p1/monitor.h
MONITOR_REQ_JPAKE_STEP1, MONITOR_ANS_JPAKE_STEP1, MONITOR_REQ_JPAKE_STEP1, MONITOR_ANS_JPAKE_STEP1,
MONITOR_REQ_JPAKE_GET_PWDATA, MONITOR_ANS_JPAKE_GET_PWDATA, MONITOR_REQ_JPAKE_GET_PWDATA, MONITOR_ANS_JPAKE_GET_PWDATA,
diff -up openssh-5.9p1/monitor_wrap.c.audit4 openssh-5.9p1/monitor_wrap.c diff -up openssh-5.9p1/monitor_wrap.c.audit4 openssh-5.9p1/monitor_wrap.c
--- openssh-5.9p1/monitor_wrap.c.audit4 2012-02-06 17:15:01.581802928 +0100 --- openssh-5.9p1/monitor_wrap.c.audit4 2012-07-27 14:27:56.156474837 +0200
+++ openssh-5.9p1/monitor_wrap.c 2012-02-06 17:15:21.696033353 +0100 +++ openssh-5.9p1/monitor_wrap.c 2012-07-27 14:27:56.172474926 +0200
@@ -653,12 +653,14 @@ mm_send_keystate(struct monitor *monitor @@ -653,12 +653,14 @@ mm_send_keystate(struct monitor *monitor
fatal("%s: conversion of newkeys failed", __func__); fatal("%s: conversion of newkeys failed", __func__);
@ -378,8 +378,8 @@ diff -up openssh-5.9p1/monitor_wrap.c.audit4 openssh-5.9p1/monitor_wrap.c
+} +}
#endif /* SSH_AUDIT_EVENTS */ #endif /* SSH_AUDIT_EVENTS */
diff -up openssh-5.9p1/monitor_wrap.h.audit4 openssh-5.9p1/monitor_wrap.h diff -up openssh-5.9p1/monitor_wrap.h.audit4 openssh-5.9p1/monitor_wrap.h
--- openssh-5.9p1/monitor_wrap.h.audit4 2012-02-06 17:15:01.582908343 +0100 --- openssh-5.9p1/monitor_wrap.h.audit4 2012-07-27 14:27:56.157474843 +0200
+++ openssh-5.9p1/monitor_wrap.h 2012-02-06 17:15:21.696033353 +0100 +++ openssh-5.9p1/monitor_wrap.h 2012-07-27 14:27:56.173474932 +0200
@@ -79,6 +79,7 @@ int mm_audit_run_command(const char *); @@ -79,6 +79,7 @@ int mm_audit_run_command(const char *);
void mm_audit_end_command(int, const char *); void mm_audit_end_command(int, const char *);
void mm_audit_unsupported_body(int); void mm_audit_unsupported_body(int);
@ -389,8 +389,8 @@ diff -up openssh-5.9p1/monitor_wrap.h.audit4 openssh-5.9p1/monitor_wrap.h
struct Session; struct Session;
diff -up openssh-5.9p1/packet.c.audit4 openssh-5.9p1/packet.c diff -up openssh-5.9p1/packet.c.audit4 openssh-5.9p1/packet.c
--- openssh-5.9p1/packet.c.audit4 2012-02-06 17:15:01.545908387 +0100 --- openssh-5.9p1/packet.c.audit4 2012-07-27 14:27:56.099474520 +0200
+++ openssh-5.9p1/packet.c 2012-02-06 17:15:21.696886524 +0100 +++ openssh-5.9p1/packet.c 2012-07-27 14:27:56.174474938 +0200
@@ -60,6 +60,7 @@ @@ -60,6 +60,7 @@
#include <signal.h> #include <signal.h>
@ -584,7 +584,7 @@ diff -up openssh-5.9p1/packet.c.audit4 openssh-5.9p1/packet.c
+ +
diff -up openssh-5.9p1/packet.h.audit4 openssh-5.9p1/packet.h diff -up openssh-5.9p1/packet.h.audit4 openssh-5.9p1/packet.h
--- openssh-5.9p1/packet.h.audit4 2011-05-15 00:43:13.000000000 +0200 --- openssh-5.9p1/packet.h.audit4 2011-05-15 00:43:13.000000000 +0200
+++ openssh-5.9p1/packet.h 2012-02-06 17:15:21.697874825 +0100 +++ openssh-5.9p1/packet.h 2012-07-27 14:27:56.175474944 +0200
@@ -124,4 +124,5 @@ void packet_restore_state(void); @@ -124,4 +124,5 @@ void packet_restore_state(void);
void *packet_get_input(void); void *packet_get_input(void);
void *packet_get_output(void); void *packet_get_output(void);
@ -592,8 +592,8 @@ diff -up openssh-5.9p1/packet.h.audit4 openssh-5.9p1/packet.h
+void packet_destroy_all(int, int); +void packet_destroy_all(int, int);
#endif /* PACKET_H */ #endif /* PACKET_H */
diff -up openssh-5.9p1/session.c.audit4 openssh-5.9p1/session.c diff -up openssh-5.9p1/session.c.audit4 openssh-5.9p1/session.c
--- openssh-5.9p1/session.c.audit4 2012-02-06 17:15:01.562908533 +0100 --- openssh-5.9p1/session.c.audit4 2012-07-27 14:27:56.130474693 +0200
+++ openssh-5.9p1/session.c 2012-02-06 17:15:21.697874825 +0100 +++ openssh-5.9p1/session.c 2012-07-27 14:27:56.176474950 +0200
@@ -1634,6 +1634,9 @@ do_child(Session *s, const char *command @@ -1634,6 +1634,9 @@ do_child(Session *s, const char *command
/* remove hostkey from the child's memory */ /* remove hostkey from the child's memory */
@ -605,8 +605,8 @@ diff -up openssh-5.9p1/session.c.audit4 openssh-5.9p1/session.c
/* Force a password change */ /* Force a password change */
if (s->authctxt->force_pwchange) { if (s->authctxt->force_pwchange) {
diff -up openssh-5.9p1/sshd.c.audit4 openssh-5.9p1/sshd.c diff -up openssh-5.9p1/sshd.c.audit4 openssh-5.9p1/sshd.c
--- openssh-5.9p1/sshd.c.audit4 2012-02-06 17:15:01.583866459 +0100 --- openssh-5.9p1/sshd.c.audit4 2012-07-27 14:27:56.159474855 +0200
+++ openssh-5.9p1/sshd.c 2012-02-06 17:15:21.699033720 +0100 +++ openssh-5.9p1/sshd.c 2012-07-27 14:27:56.178474961 +0200
@@ -686,6 +686,8 @@ privsep_preauth(Authctxt *authctxt) @@ -686,6 +686,8 @@ privsep_preauth(Authctxt *authctxt)
} }
} }

121
openssh-5.9p1-required-authentications.patch
View File

@ -1,6 +1,6 @@
diff -up openssh-5.9p1/auth.c.required-authentication openssh-5.9p1/auth.c diff -up openssh-5.9p1/auth.c.required-authentication openssh-5.9p1/auth.c
--- openssh-5.9p1/auth.c.required-authentication 2012-03-30 18:37:59.990184619 +0200 --- openssh-5.9p1/auth.c.required-authentication 2012-07-27 12:21:41.181601972 +0200
+++ openssh-5.9p1/auth.c 2012-03-30 18:38:00.003189876 +0200 +++ openssh-5.9p1/auth.c 2012-07-27 12:21:41.203602020 +0200
@@ -251,7 +251,8 @@ allowed_user(struct passwd * pw) @@ -251,7 +251,8 @@ allowed_user(struct passwd * pw)
} }
@ -92,7 +92,7 @@ diff -up openssh-5.9p1/auth.c.required-authentication openssh-5.9p1/auth.c
+} +}
diff -up openssh-5.9p1/auth.h.required-authentication openssh-5.9p1/auth.h diff -up openssh-5.9p1/auth.h.required-authentication openssh-5.9p1/auth.h
--- openssh-5.9p1/auth.h.required-authentication 2011-05-29 13:39:38.000000000 +0200 --- openssh-5.9p1/auth.h.required-authentication 2011-05-29 13:39:38.000000000 +0200
+++ openssh-5.9p1/auth.h 2012-03-30 18:38:00.003189876 +0200 +++ openssh-5.9p1/auth.h 2012-07-27 12:21:41.204602022 +0200
@@ -142,10 +142,11 @@ void disable_forwarding(void); @@ -142,10 +142,11 @@ void disable_forwarding(void);
void do_authentication(Authctxt *); void do_authentication(Authctxt *);
void do_authentication2(Authctxt *); void do_authentication2(Authctxt *);
@ -122,8 +122,8 @@ diff -up openssh-5.9p1/auth.h.required-authentication openssh-5.9p1/auth.h
diff -up openssh-5.9p1/auth1.c.required-authentication openssh-5.9p1/auth1.c diff -up openssh-5.9p1/auth1.c.required-authentication openssh-5.9p1/auth1.c
--- openssh-5.9p1/auth1.c.required-authentication 2010-08-31 14:36:39.000000000 +0200 --- openssh-5.9p1/auth1.c.required-authentication 2010-08-31 14:36:39.000000000 +0200
+++ openssh-5.9p1/auth1.c 2012-03-30 18:38:00.004189905 +0200 +++ openssh-5.9p1/auth1.c 2012-07-27 12:50:50.708706675 +0200
@@ -98,6 +98,54 @@ static const struct AuthMethod1 @@ -98,6 +98,55 @@ static const struct AuthMethod1
return (NULL); return (NULL);
} }
@ -160,6 +160,7 @@ diff -up openssh-5.9p1/auth1.c.required-authentication openssh-5.9p1/auth1.c
+ debug("auth1_check_required: unknown method " + debug("auth1_check_required: unknown method "
+ "\"%s\"", cp); + "\"%s\"", cp);
+ ret = -1; + ret = -1;
+ break;
+ } + }
+ if (*(m->enabled) == 0) { + if (*(m->enabled) == 0) {
+ debug("auth1_check_required: method %s explicitly " + debug("auth1_check_required: method %s explicitly "
@ -178,7 +179,7 @@ diff -up openssh-5.9p1/auth1.c.required-authentication openssh-5.9p1/auth1.c
static char * static char *
get_authname(int type) get_authname(int type)
{ {
@@ -237,6 +285,7 @@ do_authloop(Authctxt *authctxt) @@ -237,6 +286,7 @@ do_authloop(Authctxt *authctxt)
{ {
int authenticated = 0; int authenticated = 0;
char info[1024]; char info[1024];
@ -186,7 +187,7 @@ diff -up openssh-5.9p1/auth1.c.required-authentication openssh-5.9p1/auth1.c
int prev = 0, type = 0; int prev = 0, type = 0;
const struct AuthMethod1 *meth; const struct AuthMethod1 *meth;
@@ -244,7 +293,7 @@ do_authloop(Authctxt *authctxt) @@ -244,7 +294,7 @@ do_authloop(Authctxt *authctxt)
authctxt->valid ? "" : "invalid user ", authctxt->user); authctxt->valid ? "" : "invalid user ", authctxt->user);
/* If the user has no password, accept authentication immediately. */ /* If the user has no password, accept authentication immediately. */
@ -195,7 +196,7 @@ diff -up openssh-5.9p1/auth1.c.required-authentication openssh-5.9p1/auth1.c
#ifdef KRB5 #ifdef KRB5
(!options.kerberos_authentication || options.kerberos_or_local_passwd) && (!options.kerberos_authentication || options.kerberos_or_local_passwd) &&
#endif #endif
@@ -253,7 +302,7 @@ do_authloop(Authctxt *authctxt) @@ -253,7 +303,7 @@ do_authloop(Authctxt *authctxt)
if (options.use_pam && (PRIVSEP(do_pam_account()))) if (options.use_pam && (PRIVSEP(do_pam_account())))
#endif #endif
{ {
@ -204,7 +205,7 @@ diff -up openssh-5.9p1/auth1.c.required-authentication openssh-5.9p1/auth1.c
return; return;
} }
} }
@@ -272,6 +321,7 @@ do_authloop(Authctxt *authctxt) @@ -272,6 +322,7 @@ do_authloop(Authctxt *authctxt)
/* Get a packet from the client. */ /* Get a packet from the client. */
prev = type; prev = type;
type = packet_read(); type = packet_read();
@ -212,7 +213,7 @@ diff -up openssh-5.9p1/auth1.c.required-authentication openssh-5.9p1/auth1.c
/* /*
* If we started challenge-response authentication but the * If we started challenge-response authentication but the
@@ -287,8 +337,8 @@ do_authloop(Authctxt *authctxt) @@ -287,8 +338,8 @@ do_authloop(Authctxt *authctxt)
if (authctxt->failures >= options.max_authtries) if (authctxt->failures >= options.max_authtries)
goto skip; goto skip;
if ((meth = lookup_authmethod1(type)) == NULL) { if ((meth = lookup_authmethod1(type)) == NULL) {
@ -223,7 +224,7 @@ diff -up openssh-5.9p1/auth1.c.required-authentication openssh-5.9p1/auth1.c
goto skip; goto skip;
} }
@@ -297,6 +347,17 @@ do_authloop(Authctxt *authctxt) @@ -297,6 +348,17 @@ do_authloop(Authctxt *authctxt)
goto skip; goto skip;
} }
@ -241,7 +242,7 @@ diff -up openssh-5.9p1/auth1.c.required-authentication openssh-5.9p1/auth1.c
authenticated = meth->method(authctxt, info, sizeof(info)); authenticated = meth->method(authctxt, info, sizeof(info));
if (authenticated == -1) if (authenticated == -1)
continue; /* "postponed" */ continue; /* "postponed" */
@@ -352,7 +413,29 @@ do_authloop(Authctxt *authctxt) @@ -352,7 +414,29 @@ do_authloop(Authctxt *authctxt)
skip: skip:
/* Log before sending the reply */ /* Log before sending the reply */
@ -251,7 +252,7 @@ diff -up openssh-5.9p1/auth1.c.required-authentication openssh-5.9p1/auth1.c
+ /* Loop until the required authmethods are done */ + /* Loop until the required authmethods are done */
+ if (authenticated && options.required_auth1 != NULL) { + if (authenticated && options.required_auth1 != NULL) {
+ if (auth_remove_from_list(&options.required_auth1, + if (auth_remove_from_list(&options.required_auth1,
+ meth_name) != 1) + meth_name) == 0)
+ fatal("INTERNAL ERROR: authenticated method " + fatal("INTERNAL ERROR: authenticated method "
+ "\"%s\" not in required list \"%s\"", + "\"%s\" not in required list \"%s\"",
+ meth_name, options.required_auth1); + meth_name, options.required_auth1);
@ -272,7 +273,7 @@ diff -up openssh-5.9p1/auth1.c.required-authentication openssh-5.9p1/auth1.c
if (client_user != NULL) { if (client_user != NULL) {
xfree(client_user); xfree(client_user);
@@ -368,6 +451,7 @@ do_authloop(Authctxt *authctxt) @@ -368,6 +452,7 @@ do_authloop(Authctxt *authctxt)
#endif #endif
packet_disconnect(AUTH_FAIL_MSG, authctxt->user); packet_disconnect(AUTH_FAIL_MSG, authctxt->user);
} }
@ -282,7 +283,7 @@ diff -up openssh-5.9p1/auth1.c.required-authentication openssh-5.9p1/auth1.c
packet_send(); packet_send();
diff -up openssh-5.9p1/auth2.c.required-authentication openssh-5.9p1/auth2.c diff -up openssh-5.9p1/auth2.c.required-authentication openssh-5.9p1/auth2.c
--- openssh-5.9p1/auth2.c.required-authentication 2011-05-05 06:04:11.000000000 +0200 --- openssh-5.9p1/auth2.c.required-authentication 2011-05-05 06:04:11.000000000 +0200
+++ openssh-5.9p1/auth2.c 2012-03-30 18:38:04.560122485 +0200 +++ openssh-5.9p1/auth2.c 2012-07-27 12:51:59.048241612 +0200
@@ -215,7 +215,7 @@ input_userauth_request(int type, u_int32 @@ -215,7 +215,7 @@ input_userauth_request(int type, u_int32
{ {
Authctxt *authctxt = ctxt; Authctxt *authctxt = ctxt;
@ -331,7 +332,7 @@ diff -up openssh-5.9p1/auth2.c.required-authentication openssh-5.9p1/auth2.c
if (!authctxt->valid && authenticated) if (!authctxt->valid && authenticated)
fatal("INTERNAL ERROR: authenticated invalid user %s", fatal("INTERNAL ERROR: authenticated invalid user %s",
@@ -330,12 +339,42 @@ userauth_finish(Authctxt *authctxt, int @@ -330,12 +339,42 @@ userauth_finish(Authctxt *authctxt, int
#endif /* _UNICOS */ #endif /* _UNICOS */
/* Log before sending the reply */ /* Log before sending the reply */
@ -347,7 +348,7 @@ diff -up openssh-5.9p1/auth2.c.required-authentication openssh-5.9p1/auth2.c
+ if ((m = authmethod_lookup(method)) == NULL) + if ((m = authmethod_lookup(method)) == NULL)
+ fatal("INTERNAL ERROR: authenticated method " + fatal("INTERNAL ERROR: authenticated method "
+ "\"%s\" unknown", method); + "\"%s\" unknown", method);
+ if (auth_remove_from_list(&options.required_auth2, method) != 1) + if (auth_remove_from_list(&options.required_auth2, method) == 0)
+ fatal("INTERNAL ERROR: authenticated method " + fatal("INTERNAL ERROR: authenticated method "
+ "\"%s\" not in required list \"%s\"", + "\"%s\" not in required list \"%s\"",
+ method, options.required_auth2); + method, options.required_auth2);
@ -376,7 +377,7 @@ diff -up openssh-5.9p1/auth2.c.required-authentication openssh-5.9p1/auth2.c
if (authenticated == 1) { if (authenticated == 1) {
/* turn off userauth */ /* turn off userauth */
dispatch_set(SSH2_MSG_USERAUTH_REQUEST, &dispatch_protocol_ignore); dispatch_set(SSH2_MSG_USERAUTH_REQUEST, &dispatch_protocol_ignore);
@@ -345,7 +384,6 @@ userauth_finish(Authctxt *authctxt, int @@ -345,7 +384,6 @@ userauth_finish(Authctxt *authctxt, int
/* now we can break out */ /* now we can break out */
authctxt->success = 1; authctxt->success = 1;
} else { } else {
@ -384,7 +385,7 @@ diff -up openssh-5.9p1/auth2.c.required-authentication openssh-5.9p1/auth2.c
/* Allow initial try of "none" auth without failure penalty */ /* Allow initial try of "none" auth without failure penalty */
if (!authctxt->server_caused_failure && if (!authctxt->server_caused_failure &&
(authctxt->attempt > 1 || strcmp(method, "none") != 0)) (authctxt->attempt > 1 || strcmp(method, "none") != 0))
@@ -356,10 +394,11 @@ userauth_finish(Authctxt *authctxt, int @@ -356,10 +394,11 @@ userauth_finish(Authctxt *authctxt, int
#endif #endif
packet_disconnect(AUTH_FAIL_MSG, authctxt->user); packet_disconnect(AUTH_FAIL_MSG, authctxt->user);
} }
@ -453,7 +454,7 @@ diff -up openssh-5.9p1/auth2.c.required-authentication openssh-5.9p1/auth2.c
+ +
diff -up openssh-5.9p1/auth2-gss.c.required-authentication openssh-5.9p1/auth2-gss.c diff -up openssh-5.9p1/auth2-gss.c.required-authentication openssh-5.9p1/auth2-gss.c
--- openssh-5.9p1/auth2-gss.c.required-authentication 2011-05-05 06:04:11.000000000 +0200 --- openssh-5.9p1/auth2-gss.c.required-authentication 2011-05-05 06:04:11.000000000 +0200
+++ openssh-5.9p1/auth2-gss.c 2012-03-30 18:38:00.005184630 +0200 +++ openssh-5.9p1/auth2-gss.c 2012-07-27 12:21:41.206602026 +0200
@@ -163,7 +163,7 @@ input_gssapi_token(int type, u_int32_t p @@ -163,7 +163,7 @@ input_gssapi_token(int type, u_int32_t p
} }
authctxt->postponed = 0; authctxt->postponed = 0;
@ -483,7 +484,7 @@ diff -up openssh-5.9p1/auth2-gss.c.required-authentication openssh-5.9p1/auth2-g
Authmethod method_gssapi = { Authmethod method_gssapi = {
diff -up openssh-5.9p1/auth2-chall.c.required-authentication openssh-5.9p1/auth2-chall.c diff -up openssh-5.9p1/auth2-chall.c.required-authentication openssh-5.9p1/auth2-chall.c
--- openssh-5.9p1/auth2-chall.c.required-authentication 2009-01-28 06:13:39.000000000 +0100 --- openssh-5.9p1/auth2-chall.c.required-authentication 2009-01-28 06:13:39.000000000 +0100
+++ openssh-5.9p1/auth2-chall.c 2012-03-30 19:25:49.049897712 +0200 +++ openssh-5.9p1/auth2-chall.c 2012-07-27 12:21:41.206602026 +0200
@@ -341,7 +341,8 @@ input_userauth_info_response(int type, u @@ -341,7 +341,8 @@ input_userauth_info_response(int type, u
auth2_challenge_start(authctxt); auth2_challenge_start(authctxt);
} }
@ -496,7 +497,7 @@ diff -up openssh-5.9p1/auth2-chall.c.required-authentication openssh-5.9p1/auth2
diff -up openssh-5.9p1/auth2-none.c.required-authentication openssh-5.9p1/auth2-none.c diff -up openssh-5.9p1/auth2-none.c.required-authentication openssh-5.9p1/auth2-none.c
--- openssh-5.9p1/auth2-none.c.required-authentication 2010-06-26 02:01:33.000000000 +0200 --- openssh-5.9p1/auth2-none.c.required-authentication 2010-06-26 02:01:33.000000000 +0200
+++ openssh-5.9p1/auth2-none.c 2012-03-30 18:38:00.006184515 +0200 +++ openssh-5.9p1/auth2-none.c 2012-07-27 12:21:41.207602028 +0200
@@ -61,7 +61,7 @@ userauth_none(Authctxt *authctxt) @@ -61,7 +61,7 @@ userauth_none(Authctxt *authctxt)
{ {
none_enabled = 0; none_enabled = 0;
@ -507,8 +508,8 @@ diff -up openssh-5.9p1/auth2-none.c.required-authentication openssh-5.9p1/auth2-
return (0); return (0);
} }
diff -up openssh-5.9p1/monitor.c.required-authentication openssh-5.9p1/monitor.c diff -up openssh-5.9p1/monitor.c.required-authentication openssh-5.9p1/monitor.c
--- openssh-5.9p1/monitor.c.required-authentication 2012-03-30 18:37:59.976189954 +0200 --- openssh-5.9p1/monitor.c.required-authentication 2012-07-27 12:21:41.161601930 +0200
+++ openssh-5.9p1/monitor.c 2012-03-30 18:38:04.555127442 +0200 +++ openssh-5.9p1/monitor.c 2012-07-27 12:51:18.884927066 +0200
@@ -199,6 +199,7 @@ static int key_blobtype = MM_NOKEY; @@ -199,6 +199,7 @@ static int key_blobtype = MM_NOKEY;
static char *hostbased_cuser = NULL; static char *hostbased_cuser = NULL;
static char *hostbased_chost = NULL; static char *hostbased_chost = NULL;
@ -517,12 +518,10 @@ diff -up openssh-5.9p1/monitor.c.required-authentication openssh-5.9p1/monitor.c
static u_int session_id2_len = 0; static u_int session_id2_len = 0;
static u_char *session_id2 = NULL; static u_char *session_id2 = NULL;
static pid_t monitor_child_pid; static pid_t monitor_child_pid;
@@ -352,7 +353,8 @@ void @@ -353,6 +354,7 @@ monitor_child_preauth(Authctxt *_authctx
monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
{ {
struct mon_table *ent; struct mon_table *ent;
- int authenticated = 0; int authenticated = 0;
+ int no_increment, authenticated = 0;
+ char **req_auth; + char **req_auth;
debug3("preauth child monitor started"); debug3("preauth child monitor started");
@ -542,43 +541,45 @@ diff -up openssh-5.9p1/monitor.c.required-authentication openssh-5.9p1/monitor.c
monitor_permit(mon_dispatch, MONITOR_REQ_SESSKEY, 1); monitor_permit(mon_dispatch, MONITOR_REQ_SESSKEY, 1);
} }
@@ -380,6 +384,8 @@ monitor_child_preauth(Authctxt *_authctx @@ -380,6 +384,7 @@ monitor_child_preauth(Authctxt *_authctx
/* The first few requests do not require asynchronous access */ /* The first few requests do not require asynchronous access */
while (!authenticated) { while (!authenticated) {
auth_method = "unknown"; auth_method = "unknown";
+ auth_submethod = NULL; + auth_submethod = NULL;
+ no_increment = 1;
authenticated = (monitor_read(pmonitor, mon_dispatch, &ent) == 1); authenticated = (monitor_read(pmonitor, mon_dispatch, &ent) == 1);
if (authenticated) { if (authenticated) {
if (!(ent->flags & MON_AUTHDECIDE)) if (!(ent->flags & MON_AUTHDECIDE))
@@ -401,11 +407,24 @@ monitor_child_preauth(Authctxt *_authctx @@ -401,10 +406,19 @@ monitor_child_preauth(Authctxt *_authctx
} }
#endif #endif
} }
+ /* Loop until the required authmethods are done */ + /* Loop until the required authmethods are done */
+ if (authenticated && *req_auth != NULL) { + if (authenticated && *req_auth != NULL) {
+ if (auth_remove_from_list(req_auth, auth_method) != 1) + if (auth_remove_from_list(req_auth, auth_method) == 0)
+ fatal("INTERNAL ERROR: authenticated method " + fatal("INTERNAL ERROR: authenticated method "
+ "\"%s\" not in required list \"%s\"", + "\"%s\" not in required list \"%s\"",
+ auth_method, *req_auth); + auth_method, *req_auth);
+ debug2("monitor_child_preauth: required list now: %s", + debug2("monitor_child_preauth: required list now: %s",
+ *req_auth == NULL ? "DONE" : *req_auth); + *req_auth == NULL ? "DONE" : *req_auth);
+ if (*req_auth != NULL) {
+ authenticated = 0;
+ no_increment = 1;
+ }
+ } + }
if (ent->flags & (MON_AUTHDECIDE|MON_ALOG)) { if (ent->flags & (MON_AUTHDECIDE|MON_ALOG)) {
auth_log(authctxt, authenticated, auth_method, auth_log(authctxt, authenticated, auth_method,
- compat20 ? " ssh2" : ""); - compat20 ? " ssh2" : "");
- if (!authenticated)
+ auth_submethod, compat20 ? " ssh2" : ""); + auth_submethod, compat20 ? " ssh2" : "");
+ if (!authenticated && !no_increment) if (!authenticated)
authctxt->failures++; authctxt->failures++;
} }
#ifdef JPAKE @@ -417,6 +431,8 @@ monitor_child_preauth(Authctxt *_authctx
@@ -862,6 +881,7 @@ mm_answer_authpassword(int sock, Buffer }
}
#endif
+ if (*req_auth != NULL)
+ authenticated = 0;
}
/* Drain any buffered messages from the child */
@@ -862,6 +878,7 @@ mm_answer_authpassword(int sock, Buffer
auth_method = "none"; auth_method = "none";
else else
auth_method = "password"; auth_method = "password";
@ -586,7 +587,7 @@ diff -up openssh-5.9p1/monitor.c.required-authentication openssh-5.9p1/monitor.c
/* Causes monitor loop to terminate if authenticated */ /* Causes monitor loop to terminate if authenticated */
return (authenticated); return (authenticated);
@@ -921,6 +941,7 @@ mm_answer_bsdauthrespond(int sock, Buffe @@ -921,6 +938,7 @@ mm_answer_bsdauthrespond(int sock, Buffe
mm_request_send(sock, MONITOR_ANS_BSDAUTHRESPOND, m); mm_request_send(sock, MONITOR_ANS_BSDAUTHRESPOND, m);
auth_method = "bsdauth"; auth_method = "bsdauth";
@ -594,7 +595,7 @@ diff -up openssh-5.9p1/monitor.c.required-authentication openssh-5.9p1/monitor.c
return (authok != 0); return (authok != 0);
} }
@@ -970,6 +991,7 @@ mm_answer_skeyrespond(int sock, Buffer * @@ -970,6 +988,7 @@ mm_answer_skeyrespond(int sock, Buffer *
mm_request_send(sock, MONITOR_ANS_SKEYRESPOND, m); mm_request_send(sock, MONITOR_ANS_SKEYRESPOND, m);
auth_method = "skey"; auth_method = "skey";
@ -602,7 +603,7 @@ diff -up openssh-5.9p1/monitor.c.required-authentication openssh-5.9p1/monitor.c
return (authok != 0); return (authok != 0);
} }
@@ -1059,7 +1081,8 @@ mm_answer_pam_query(int sock, Buffer *m) @@ -1059,7 +1078,8 @@ mm_answer_pam_query(int sock, Buffer *m)
xfree(prompts); xfree(prompts);
if (echo_on != NULL) if (echo_on != NULL)
xfree(echo_on); xfree(echo_on);
@ -612,7 +613,7 @@ diff -up openssh-5.9p1/monitor.c.required-authentication openssh-5.9p1/monitor.c
mm_request_send(sock, MONITOR_ANS_PAM_QUERY, m); mm_request_send(sock, MONITOR_ANS_PAM_QUERY, m);
return (0); return (0);
} }
@@ -1088,7 +1111,8 @@ mm_answer_pam_respond(int sock, Buffer * @@ -1088,7 +1108,8 @@ mm_answer_pam_respond(int sock, Buffer *
buffer_clear(m); buffer_clear(m);
buffer_put_int(m, ret); buffer_put_int(m, ret);
mm_request_send(sock, MONITOR_ANS_PAM_RESPOND, m); mm_request_send(sock, MONITOR_ANS_PAM_RESPOND, m);
@ -622,7 +623,7 @@ diff -up openssh-5.9p1/monitor.c.required-authentication openssh-5.9p1/monitor.c
if (ret == 0) if (ret == 0)
sshpam_authok = sshpam_ctxt; sshpam_authok = sshpam_ctxt;
return (0); return (0);
@@ -1102,7 +1126,8 @@ mm_answer_pam_free_ctx(int sock, Buffer @@ -1102,7 +1123,8 @@ mm_answer_pam_free_ctx(int sock, Buffer
(sshpam_device.free_ctx)(sshpam_ctxt); (sshpam_device.free_ctx)(sshpam_ctxt);
buffer_clear(m); buffer_clear(m);
mm_request_send(sock, MONITOR_ANS_PAM_FREE_CTX, m); mm_request_send(sock, MONITOR_ANS_PAM_FREE_CTX, m);
@ -632,7 +633,7 @@ diff -up openssh-5.9p1/monitor.c.required-authentication openssh-5.9p1/monitor.c
return (sshpam_authok == sshpam_ctxt); return (sshpam_authok == sshpam_ctxt);
} }
#endif #endif
@@ -1138,6 +1163,7 @@ mm_answer_keyallowed(int sock, Buffer *m @@ -1138,6 +1160,7 @@ mm_answer_keyallowed(int sock, Buffer *m
allowed = options.pubkey_authentication && allowed = options.pubkey_authentication &&
user_key_allowed(authctxt->pw, key); user_key_allowed(authctxt->pw, key);
auth_method = "publickey"; auth_method = "publickey";
@ -640,7 +641,7 @@ diff -up openssh-5.9p1/monitor.c.required-authentication openssh-5.9p1/monitor.c
if (options.pubkey_authentication && allowed != 1) if (options.pubkey_authentication && allowed != 1)
auth_clear_options(); auth_clear_options();
break; break;
@@ -1146,6 +1172,7 @@ mm_answer_keyallowed(int sock, Buffer *m @@ -1146,6 +1169,7 @@ mm_answer_keyallowed(int sock, Buffer *m
hostbased_key_allowed(authctxt->pw, hostbased_key_allowed(authctxt->pw,
cuser, chost, key); cuser, chost, key);
auth_method = "hostbased"; auth_method = "hostbased";
@ -648,7 +649,7 @@ diff -up openssh-5.9p1/monitor.c.required-authentication openssh-5.9p1/monitor.c
break; break;
case MM_RSAHOSTKEY: case MM_RSAHOSTKEY:
key->type = KEY_RSA1; /* XXX */ key->type = KEY_RSA1; /* XXX */
@@ -1155,6 +1182,7 @@ mm_answer_keyallowed(int sock, Buffer *m @@ -1155,6 +1179,7 @@ mm_answer_keyallowed(int sock, Buffer *m
if (options.rhosts_rsa_authentication && allowed != 1) if (options.rhosts_rsa_authentication && allowed != 1)
auth_clear_options(); auth_clear_options();
auth_method = "rsa"; auth_method = "rsa";
@ -656,7 +657,7 @@ diff -up openssh-5.9p1/monitor.c.required-authentication openssh-5.9p1/monitor.c
break; break;
default: default:
fatal("%s: unknown key type %d", __func__, type); fatal("%s: unknown key type %d", __func__, type);
@@ -1180,7 +1208,8 @@ mm_answer_keyallowed(int sock, Buffer *m @@ -1180,7 +1205,8 @@ mm_answer_keyallowed(int sock, Buffer *m
hostbased_chost = chost; hostbased_chost = chost;
} else { } else {
/* Log failed attempt */ /* Log failed attempt */
@ -666,7 +667,7 @@ diff -up openssh-5.9p1/monitor.c.required-authentication openssh-5.9p1/monitor.c
xfree(blob); xfree(blob);
xfree(cuser); xfree(cuser);
xfree(chost); xfree(chost);
@@ -1356,6 +1385,7 @@ mm_answer_keyverify(int sock, Buffer *m) @@ -1356,6 +1382,7 @@ mm_answer_keyverify(int sock, Buffer *m)
xfree(data); xfree(data);
auth_method = key_blobtype == MM_USERKEY ? "publickey" : "hostbased"; auth_method = key_blobtype == MM_USERKEY ? "publickey" : "hostbased";
@ -674,7 +675,7 @@ diff -up openssh-5.9p1/monitor.c.required-authentication openssh-5.9p1/monitor.c
monitor_reset_key_state(); monitor_reset_key_state();
@@ -1545,6 +1575,7 @@ mm_answer_rsa_keyallowed(int sock, Buffe @@ -1545,6 +1572,7 @@ mm_answer_rsa_keyallowed(int sock, Buffe
debug3("%s entering", __func__); debug3("%s entering", __func__);
auth_method = "rsa"; auth_method = "rsa";
@ -682,7 +683,7 @@ diff -up openssh-5.9p1/monitor.c.required-authentication openssh-5.9p1/monitor.c
if (options.rsa_authentication && authctxt->valid) { if (options.rsa_authentication && authctxt->valid) {
if ((client_n = BN_new()) == NULL) if ((client_n = BN_new()) == NULL)
fatal("%s: BN_new", __func__); fatal("%s: BN_new", __func__);
@@ -1650,6 +1681,7 @@ mm_answer_rsa_response(int sock, Buffer @@ -1650,6 +1678,7 @@ mm_answer_rsa_response(int sock, Buffer
xfree(response); xfree(response);
auth_method = key_blobtype == MM_RSAUSERKEY ? "rsa" : "rhosts-rsa"; auth_method = key_blobtype == MM_RSAUSERKEY ? "rsa" : "rhosts-rsa";
@ -690,7 +691,7 @@ diff -up openssh-5.9p1/monitor.c.required-authentication openssh-5.9p1/monitor.c
/* reset state */ /* reset state */
BN_clear_free(ssh1_challenge); BN_clear_free(ssh1_challenge);
@@ -2099,6 +2131,7 @@ mm_answer_gss_userok(int sock, Buffer *m @@ -2099,6 +2128,7 @@ mm_answer_gss_userok(int sock, Buffer *m
mm_request_send(sock, MONITOR_ANS_GSSUSEROK, m); mm_request_send(sock, MONITOR_ANS_GSSUSEROK, m);
auth_method = "gssapi-with-mic"; auth_method = "gssapi-with-mic";
@ -698,7 +699,7 @@ diff -up openssh-5.9p1/monitor.c.required-authentication openssh-5.9p1/monitor.c
/* Monitor loop will terminate if authenticated */ /* Monitor loop will terminate if authenticated */
return (authenticated); return (authenticated);
@@ -2303,6 +2336,7 @@ mm_answer_jpake_check_confirm(int sock, @@ -2303,6 +2333,7 @@ mm_answer_jpake_check_confirm(int sock,
monitor_permit(mon_dispatch, MONITOR_REQ_JPAKE_STEP1, 1); monitor_permit(mon_dispatch, MONITOR_REQ_JPAKE_STEP1, 1);
auth_method = "jpake-01@openssh.com"; auth_method = "jpake-01@openssh.com";
@ -707,8 +708,8 @@ diff -up openssh-5.9p1/monitor.c.required-authentication openssh-5.9p1/monitor.c
} }
diff -up openssh-5.9p1/servconf.c.required-authentication openssh-5.9p1/servconf.c diff -up openssh-5.9p1/servconf.c.required-authentication openssh-5.9p1/servconf.c
--- openssh-5.9p1/servconf.c.required-authentication 2012-03-30 18:37:59.981184513 +0200 --- openssh-5.9p1/servconf.c.required-authentication 2012-07-27 12:21:41.167601942 +0200
+++ openssh-5.9p1/servconf.c 2012-03-30 18:38:04.558121635 +0200 +++ openssh-5.9p1/servconf.c 2012-07-27 12:21:41.209602032 +0200
@@ -42,6 +42,8 @@ @@ -42,6 +42,8 @@
#include "key.h" #include "key.h"
#include "kex.h" #include "kex.h"
@ -718,7 +719,7 @@ diff -up openssh-5.9p1/servconf.c.required-authentication openssh-5.9p1/servconf
#include "match.h" #include "match.h"
#include "channels.h" #include "channels.h"
#include "groupaccess.h" #include "groupaccess.h"
@@ -129,6 +131,8 @@ initialize_server_options(ServerOptions @@ -129,6 +131,8 @@ initialize_server_options(ServerOptions
options->num_authkeys_files = 0; options->num_authkeys_files = 0;
options->num_accept_env = 0; options->num_accept_env = 0;
options->permit_tun = -1; options->permit_tun = -1;
@ -780,7 +781,7 @@ diff -up openssh-5.9p1/servconf.c.required-authentication openssh-5.9p1/servconf
goto parse_int; goto parse_int;
diff -up openssh-5.9p1/servconf.h.required-authentication openssh-5.9p1/servconf.h diff -up openssh-5.9p1/servconf.h.required-authentication openssh-5.9p1/servconf.h
--- openssh-5.9p1/servconf.h.required-authentication 2011-06-23 00:30:03.000000000 +0200 --- openssh-5.9p1/servconf.h.required-authentication 2011-06-23 00:30:03.000000000 +0200
+++ openssh-5.9p1/servconf.h 2012-03-30 18:38:00.009184624 +0200 +++ openssh-5.9p1/servconf.h 2012-07-27 12:21:41.210602035 +0200
@@ -154,6 +154,9 @@ typedef struct { @@ -154,6 +154,9 @@ typedef struct {
u_int num_authkeys_files; /* Files containing public keys */ u_int num_authkeys_files; /* Files containing public keys */
char *authorized_keys_files[MAX_AUTHKEYS_FILES]; char *authorized_keys_files[MAX_AUTHKEYS_FILES];
@ -793,7 +794,7 @@ diff -up openssh-5.9p1/servconf.h.required-authentication openssh-5.9p1/servconf
int use_pam; /* Enable auth via PAM */ int use_pam; /* Enable auth via PAM */
diff -up openssh-5.9p1/sshd_config.5.required-authentication openssh-5.9p1/sshd_config.5 diff -up openssh-5.9p1/sshd_config.5.required-authentication openssh-5.9p1/sshd_config.5
--- openssh-5.9p1/sshd_config.5.required-authentication 2011-08-05 22:17:33.000000000 +0200 --- openssh-5.9p1/sshd_config.5.required-authentication 2011-08-05 22:17:33.000000000 +0200
+++ openssh-5.9p1/sshd_config.5 2012-03-30 18:38:00.009184624 +0200 +++ openssh-5.9p1/sshd_config.5 2012-07-27 12:38:47.607222070 +0200
@@ -723,6 +723,8 @@ Available keywords are @@ -723,6 +723,8 @@ Available keywords are
.Cm PermitOpen , .Cm PermitOpen ,
.Cm PermitRootLogin , .Cm PermitRootLogin ,
@ -808,7 +809,7 @@ diff -up openssh-5.9p1/sshd_config.5.required-authentication openssh-5.9p1/sshd_
Note that if this file is not readable, then public key authentication will Note that if this file is not readable, then public key authentication will
be refused for all users. be refused for all users.
+.It Cm RequiredAuthentications[12] +.It Cm RequiredAuthentications[12]
+ Requires two authentication methods to succeed before authorizing the connection. + Specifies required methods of authentications that has to succeed before authorizing the connection.
+ (RequiredAuthentication1 for Protocol version 1, and RequiredAuthentication2 for v2) + (RequiredAuthentication1 for Protocol version 1, and RequiredAuthentication2 for v2)
+ +
+ RequiredAuthentications1 method[,method...] + RequiredAuthentications1 method[,method...]