upstream: delay bailout for invalid authentic

=?UTF-8?q?ating=20user=20until=20after=20the=20packet=20containing=20the?=
=?UTF-8?q?=20request=20has=20been=20fully=20parsed.=20Reported=20by=20Dar?=
=?UTF-8?q?iusz=20Tytko=20and=20Micha=C5=82=20Sajdak;=20ok=20deraadt?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

OpenBSD-Commit-ID: b4891882fbe413f230fe8ac8a37349b03bd0b70d

1 files changed, 7 insertions, 4 deletions

diff --git a/auth2-gss.c b/auth2-gss.c
index 47308c5ce..9351e0428 100644
--- a/auth2-gss.c
+++ b/auth2-gss.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-gss.c,v 1.28 2018/07/10 09:13:30 djm Exp $ */
+/* $OpenBSD: auth2-gss.c,v 1.29 2018/07/31 03:10:27 djm Exp $ */
 
 /*
  * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
@@ -70,9 +70,6 @@ userauth_gssapi(struct ssh *ssh)
         size_t len;
         u_char *doid = NULL;
 
-        if (!authctxt->valid || authctxt->user == NULL)
-                return (0);
-
         if ((r = sshpkt_get_u32(ssh, &mechs)) != 0)
                 fatal("%s: %s", __func__, ssh_err(r));
 
@@ -106,6 +103,12 @@ userauth_gssapi(struct ssh *ssh)
                 return (0);
         }
 
+        if (!authctxt->valid || authctxt->user == NULL) {
+                debug2("%s: disabled because of invalid user", __func__);
+                free(doid);
+                return (0);
+        }
+
         if (GSS_ERROR(PRIVSEP(ssh_gssapi_server_ctx(&ctxt, &goid)))) {
                 if (ctxt != NULL)
                         ssh_gssapi_delete_ctx(&ctxt);