Stupid djm commits experimental code to head instead of branch

revert

1 files changed, 39 insertions, 80 deletions

diff --git a/auth2.c b/auth2.c
index f661f8d7c..f2a801ecc 100644
--- a/auth2.c
+++ b/auth2.c
@@ -51,13 +51,8 @@ RCSID("$OpenBSD: auth2.c,v 1.85 2002/02/24 19:14:59 markus Exp $");
 #include "hostfile.h"
 #include "canohost.h"
 #include "match.h"
-#include "monitor.h"
-#include "monitor_wrap.h"
 
 /* import */
-extern int use_privsep;
-extern int mm_recvfd;
-
 extern ServerOptions options;
 extern u_char *session_id2;
 extern int session_id2_len;
@@ -80,8 +75,8 @@ static void input_userauth_request(int, u_int32_t, void *);
 /* helper */
 static Authmethod *authmethod_lookup(const char *);
 static char *authmethods_get(void);
-int user_key_allowed(struct passwd *, Key *);
-int hostbased_key_allowed(struct passwd *, const char *, char *, Key *);
+static int user_key_allowed(struct passwd *, Key *);
+static int hostbased_key_allowed(struct passwd *, const char *, char *, Key *);
 
 /* auth */
 static void userauth_banner(void);
@@ -114,7 +109,7 @@ Authmethod authmethods[] = {
  * loop until authctxt->success == TRUE
  */
 
-Authctxt *
+void
 do_authentication2(void)
 {
         Authctxt *authctxt = authctxt_new();
@@ -130,8 +125,7 @@ do_authentication2(void)
         dispatch_init(&dispatch_protocol_error);
         dispatch_set(SSH2_MSG_SERVICE_REQUEST, &input_service_request);
         dispatch_run(DISPATCH_BLOCK, &authctxt->success, authctxt);
-
-        return(authctxt);
+        do_authenticated(authctxt);
 }
 
 static void
@@ -188,15 +182,10 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
                 *style++ = 0;
 
         if (authctxt->attempt++ == 0) {
-                /* setup auth context */
-                int allowed;
+                /* setup auth context */
                 struct passwd *pw = NULL;
-                if (!use_privsep) {
-                        pw = getpwnam(user);
-                        allowed = pw ? allowed_user(pw) : 0;
-                } else
-                        pw = mm_getpwnamallow(mm_recvfd, user, &allowed);
-                if (pw && allowed && strcmp(service, "ssh-connection")==0) {
+                pw = getpwnam(user);
+                if (pw && allowed_user(pw) && strcmp(service, "ssh-connection")==0) {
                         authctxt->pw = pwcopy(pw);
                         authctxt->valid = 1;
                         debug2("input_userauth_request: setting up authctxt for %s", user);
@@ -209,18 +198,10 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
                         start_pam("NOUSER");
 #endif
                 }
-                /* Free memory */
-                if (use_privsep)
-                        pwfree(pw);
-
-                setproctitle("%s%s", use_privsep ? " [net]" : "",
-                    pw ? user : "unknown");
+                setproctitle("%s", pw ? user : "unknown");
                 authctxt->user = xstrdup(user);
                 authctxt->service = xstrdup(service);
                 authctxt->style = style ? xstrdup(style) : NULL;
-
-                if (use_privsep)
-                        mm_inform_authserv(mm_recvfd, service, style);
         } else if (strcmp(user, authctxt->user) != 0 ||
             strcmp(service, authctxt->service) != 0) {
                 packet_disconnect("Change of username or service not allowed: "
@@ -332,8 +313,6 @@ done:
 static int
 userauth_none(Authctxt *authctxt)
 {
-        int res = 0;
-
         /* disable method "none", only allowed one time */
         Authmethod *m = authmethod_lookup("none");
         if (m != NULL)
@@ -343,16 +322,18 @@ userauth_none(Authctxt *authctxt)
 
         if (authctxt->valid == 0)
                 return(0);
-        if (!authctxt->valid)
-                return (0);
-        if (use_privsep)
-#if defined(USE_PAM) || defined(HAVE_OSF_SIA)
-#error NOT IMPLEMENTED FOR PRIVSEP
+
+#ifdef HAVE_CYGWIN
+        if (check_nt_auth(1, authctxt->pw) == 0)
+                return(0);
 #endif
-                res = mm_auth_password(mm_recvfd, "");
-        else
-                res = auth_password(authctxt, "");
-        return (res);
+#ifdef USE_PAM
+        return auth_pam_password(authctxt->pw, "");
+#elif defined(HAVE_OSF_SIA)
+        return 0;
+#else /* !HAVE_OSF_SIA && !USE_PAM */
+        return auth_password(authctxt, "");
+#endif /* USE_PAM */
 }
 
 static int
@@ -367,16 +348,18 @@ userauth_passwd(Authctxt *authctxt)
                 log("password change not supported");
         password = packet_get_string(&len);
         packet_check_eom();
-
-#if defined(HAVE_CYGWIN) || defined(USE_PAM) || defined(HAVE_OSF_SIA)
-#error NOT IMPLEMENTED FOR PRIVSEP
+        if (authctxt->valid &&
+#ifdef HAVE_CYGWIN
+            check_nt_auth(1, authctxt->pw) &&
 #endif
-        if (authctxt->valid) {
-                if (use_privsep)
-                        authenticated = mm_auth_password(mm_recvfd, password);
-                else
-                        authenticated = auth_password(authctxt, password);
-        }
+#ifdef USE_PAM
+            auth_pam_password(authctxt->pw, password) == 1)
+#elif defined(HAVE_OSF_SIA)
+            auth_sia_password(authctxt->user, password) == 1)
+#else /* !USE_PAM && !HAVE_OSF_SIA */
+            auth_password(authctxt, password) == 1)
+#endif /* USE_PAM */
+                authenticated = 1;
         memset(password, 0, len);
         xfree(password);
         return authenticated;
@@ -484,23 +467,12 @@ userauth_pubkey(Authctxt *authctxt)
                 buffer_dump(&b);
 #endif
                 /* test for correct signature */
-                authenticated = 0;
-                if (use_privsep) {
-                        if (mm_user_key_allowed(mm_recvfd, key) &&
-                            mm_key_verify(mm_recvfd,
-                                MM_USERKEY, NULL, NULL, key, sig, slen,
-                                buffer_ptr(&b), buffer_len(&b)) == 1)
-                                authenticated = 1;
-                } else {
-                        if (user_key_allowed(authctxt->pw, key) &&
-                            key_verify(key, sig, slen, buffer_ptr(&b),
-                                buffer_len(&b)) == 1)
-                                authenticated = 1;
-                }
+                if (user_key_allowed(authctxt->pw, key) &&
+                    key_verify(key, sig, slen, buffer_ptr(&b), buffer_len(&b)) == 1)
+                        authenticated = 1;
                 buffer_clear(&b);
                 xfree(sig);
         } else {
-                int res = 0;
                 debug("test whether pkalg/pkblob are acceptable");
                 packet_check_eom();
 
@@ -512,11 +484,7 @@ userauth_pubkey(Authctxt *authctxt)
                  * if a user is not allowed to login. is this an
                  * issue? -markus
                  */
-                if (use_privsep)
-                        res = mm_user_key_allowed(mm_recvfd, key);
-                else
-                        res = user_key_allowed(authctxt->pw, key);
-                if (res) {
+                if (user_key_allowed(authctxt->pw, key)) {
                         packet_start(SSH2_MSG_USERAUTH_PK_OK);
                         packet_put_string(pkalg, alen);
                         packet_put_string(pkblob, blen);
@@ -604,18 +572,9 @@ userauth_hostbased(Authctxt *authctxt)
         buffer_dump(&b);
 #endif
         /* test for allowed key and correct signature */
-        authenticated = 0;
-        if (use_privsep) {
-                if (mm_hostbased_key_allowed(mm_recvfd, cuser, chost, key) &&
-                    mm_key_verify(mm_recvfd, MM_HOSTKEY, cuser, chost, key,
-                        sig, slen, buffer_ptr(&b), buffer_len(&b)) == 1)
-                        authenticated = 1;
-        } else {
-                if (hostbased_key_allowed(authctxt->pw, cuser, chost, key) &&
-                    key_verify(key, sig, slen, buffer_ptr(&b),
-                        buffer_len(&b)) == 1)
-                        authenticated = 1;
-        }
+        if (hostbased_key_allowed(authctxt->pw, cuser, chost, key) &&
+            key_verify(key, sig, slen, buffer_ptr(&b), buffer_len(&b)) == 1)
+                authenticated = 1;
 
         buffer_clear(&b);
 done:
@@ -771,7 +730,7 @@ user_key_allowed2(struct passwd *pw, Key *key, char *file)
 }
 
 /* check whether given key is in .ssh/authorized_keys* */
-int
+static int
 user_key_allowed(struct passwd *pw, Key *key)
 {
         int success;
@@ -791,7 +750,7 @@ user_key_allowed(struct passwd *pw, Key *key)
 }
 
 /* return 1 if given hostkey is allowed */
-int
+static int
 hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost,
     Key *key)
 {