* New upstream release (http://www.openssh.com/txt/release-6.2).

  - Add support for multiple required authentication in SSH protocol 2 via
    an AuthenticationMethods option (closes: #195716).
  - Fix Sophie Germain formula in moduli(5) (closes: #698612).
  - Update ssh-copy-id to Phil Hands' greatly revised version (closes:
    #99785, #322228, #620428; LP: #518883, #835901, #1074798).

1 files changed, 50 insertions, 14 deletions

diff --git a/monitor.c b/monitor.c
index a5d1c5ba1..9b08020ca 100644
--- a/monitor.c
+++ b/monitor.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor.c,v 1.117 2012/06/22 12:30:26 dtucker Exp $ */
+/* $OpenBSD: monitor.c,v 1.120 2012/12/11 22:16:21 markus Exp $ */
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -209,6 +209,7 @@ static int key_blobtype = MM_NOKEY;
 static char *hostbased_cuser = NULL;
 static char *hostbased_chost = NULL;
 static char *auth_method = "unknown";
+static char *auth_submethod = NULL;
 static u_int session_id2_len = 0;
 static u_char *session_id2 = NULL;
 static pid_t monitor_child_pid;
@@ -376,7 +377,7 @@ void
 monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
 {
         struct mon_table *ent;
-        int authenticated = 0;
+        int authenticated = 0, partial = 0;
 
         debug3("preauth child monitor started");
 
@@ -407,8 +408,26 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
 
         /* The first few requests do not require asynchronous access */
         while (!authenticated) {
+                partial = 0;
                 auth_method = "unknown";
+                auth_submethod = NULL;
                 authenticated = (monitor_read(pmonitor, mon_dispatch, &ent) == 1);
+
+                /* Special handling for multiple required authentications */
+                if (options.num_auth_methods != 0) {
+                        if (!compat20)
+                                fatal("AuthenticationMethods is not supported"
+                                    "with SSH protocol 1");
+                        if (authenticated &&
+                            !auth2_update_methods_lists(authctxt,
+                            auth_method)) {
+                                debug3("%s: method %s: partial", __func__,
+                                    auth_method);
+                                authenticated = 0;
+                                partial = 1;
+                        }
+                }
+
                 if (authenticated) {
                         if (!(ent->flags & MON_AUTHDECIDE))
                                 fatal("%s: unexpected authentication from %d",
@@ -429,9 +448,9 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
                         }
 #endif
                 }
-
                 if (ent->flags & (MON_AUTHDECIDE|MON_ALOG)) {
-                        auth_log(authctxt, authenticated, auth_method,
+                        auth_log(authctxt, authenticated, partial,
+                            auth_method, auth_submethod,
                             compat20 ? " ssh2" : "");
                         if (!authenticated)
                                 authctxt->failures++;
@@ -447,10 +466,6 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
 #endif
         }
 
-        /* Drain any buffered messages from the child */
-        while (pmonitor->m_log_recvfd != -1 && monitor_read_log(pmonitor) == 0)
-                ;
-
         if (!authctxt->valid)
                 fatal("%s: authenticated invalid user", __func__);
         if (strcmp(auth_method, "unknown") == 0)
@@ -461,6 +476,10 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
 
         mm_get_keystate(pmonitor);
 
+        /* Drain any buffered messages from the child */
+        while (pmonitor->m_log_recvfd != -1 && monitor_read_log(pmonitor) == 0)
+                ;
+
         close(pmonitor->m_sendfd);
         close(pmonitor->m_log_recvfd);
         pmonitor->m_sendfd = pmonitor->m_log_recvfd = -1;
@@ -816,7 +835,17 @@ mm_answer_pwnamallow(int sock, Buffer *m)
         COPY_MATCH_STRING_OPTS();
 #undef M_CP_STROPT
 #undef M_CP_STRARRAYOPT
-        
+
+        /* Create valid auth method lists */
+        if (compat20 && auth2_setup_methods_lists(authctxt) != 0) {
+                /*
+                 * The monitor will continue long enough to let the child
+                 * run to it's packet_disconnect(), but it must not allow any
+                 * authentication to succeed.
+                 */
+                debug("%s: no valid authentication method lists", __func__);
+        }
+
         debug3("%s: sending MONITOR_ANS_PWNAM: %d", __func__, allowed);
         mm_request_send(sock, MONITOR_ANS_PWNAM, m);
 
@@ -977,7 +1006,10 @@ mm_answer_bsdauthrespond(int sock, Buffer *m)
         debug3("%s: sending authenticated: %d", __func__, authok);
         mm_request_send(sock, MONITOR_ANS_BSDAUTHRESPOND, m);
 
-        auth_method = "bsdauth";
+        if (compat20)
+                auth_method = "keyboard-interactive"; /* XXX auth_submethod */
+        else
+                auth_method = "bsdauth";
 
         return (authok != 0);
 }
@@ -1116,7 +1148,8 @@ mm_answer_pam_query(int sock, Buffer *m)
                 xfree(prompts);
         if (echo_on != NULL)
                 xfree(echo_on);
-        auth_method = "keyboard-interactive/pam";
+        auth_method = "keyboard-interactive";
+        auth_submethod = "pam";
         mm_request_send(sock, MONITOR_ANS_PAM_QUERY, m);
         return (0);
 }
@@ -1145,7 +1178,8 @@ mm_answer_pam_respond(int sock, Buffer *m)
         buffer_clear(m);
         buffer_put_int(m, ret);
         mm_request_send(sock, MONITOR_ANS_PAM_RESPOND, m);
-        auth_method = "keyboard-interactive/pam";
+        auth_method = "keyboard-interactive";
+        auth_submethod = "pam";
         if (ret == 0)
                 sshpam_authok = sshpam_ctxt;
         return (0);
@@ -1159,7 +1193,8 @@ mm_answer_pam_free_ctx(int sock, Buffer *m)
         (sshpam_device.free_ctx)(sshpam_ctxt);
         buffer_clear(m);
         mm_request_send(sock, MONITOR_ANS_PAM_FREE_CTX, m);
-        auth_method = "keyboard-interactive/pam";
+        auth_method = "keyboard-interactive";
+        auth_submethod = "pam";
         return (sshpam_authok == sshpam_ctxt);
 }
 #endif
@@ -1233,7 +1268,8 @@ mm_answer_keyallowed(int sock, Buffer *m)
                 hostbased_chost = chost;
         } else {
                 /* Log failed attempt */
-                auth_log(authctxt, 0, auth_method, compat20 ? " ssh2" : "");
+                auth_log(authctxt, 0, 0, auth_method, NULL,
+                    compat20 ? " ssh2" : "");
                 xfree(blob);
                 xfree(cuser);
                 xfree(chost);