- (dtucker) [auth-pam.c] Bug #1028: send final non-query messages from

   PAM via keyboard-interactive.  Patch tested by the folks at Vintela.

2 files changed, 15 insertions, 3 deletions

diff --git a/ChangeLog b/ChangeLog
index 2c238370a..cdde2e048 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,7 @@
 20050928
  - (dtucker) [entropy.c] Use u_char for receiving RNG seed for consistency.
+ - (dtucker) [auth-pam.c] Bug #1028: send final non-query messages from
+   PAM via keyboard-interactive.  Patch tested by the folks at Vintela.
 
 20050927
  - (dtucker) [entropy.c] Remove unnecessary tests for getuid and geteuid
@@ -3023,4 +3025,4 @@
    - (djm) Trim deprecated options from INSTALL. Mention UsePAM
    - (djm) Fix quote handling in sftp; Patch from admorten AT umich.edu
 
-$Id: ChangeLog,v 1.3897 2005/09/27 22:26:30 dtucker Exp $
+$Id: ChangeLog,v 1.3898 2005/09/28 12:33:27 dtucker Exp $
diff --git a/auth-pam.c b/auth-pam.c
index 0446cd559..787aad1d0 100644
--- a/auth-pam.c
+++ b/auth-pam.c
@@ -47,7 +47,7 @@
 
 /* Based on $FreeBSD: src/crypto/openssh/auth2-pam-freebsd.c,v 1.11 2003/03/31 13:48:18 des Exp $ */
 #include "includes.h"
-RCSID("$Id: auth-pam.c,v 1.126 2005/07/17 07:18:50 djm Exp $");
+RCSID("$Id: auth-pam.c,v 1.127 2005/09/28 12:33:27 dtucker Exp $");
 
 #ifdef USE_PAM
 #if defined(HAVE_SECURITY_PAM_APPL_H)
@@ -716,8 +716,18 @@ sshpam_query(void *ctx, char **name, char **info,
                         plen++;
                         xfree(msg);
                         break;
-                case PAM_SUCCESS:
                 case PAM_AUTH_ERR:
+                        debug3("PAM: PAM_AUTH_ERR");
+                        if (**prompts != NULL && strlen(**prompts) != 0) {
+                                *info = **prompts;
+                                **prompts = NULL;
+                                *num = 0;
+                                **echo_on = 0;
+                                ctxt->pam_done = -1;
+                                return 0;
+                        }
+                        /* FALLTHROUGH */
+                case PAM_SUCCESS:
                         if (**prompts != NULL) {
                                 /* drain any accumulated messages */
                                 debug("PAM: %s", **prompts);