- djm@cvs.openbsd.org 2012/12/02 20:34:10

     [auth.c auth.h auth1.c auth2-chall.c auth2-gss.c auth2-jpake.c auth2.c]
     [monitor.c monitor.h]
     Fixes logging of partial authentication when privsep is enabled
     Previously, we recorded "Failed xxx" since we reset authenticated before
     calling auth_log() in auth2.c. This adds an explcit "Partial" state.

     Add a "submethod" to auth_log() to report which submethod is used
     for keyboard-interactive.

     Fix multiple authentication when one of the methods is
     keyboard-interactive.

     ok markus@

1 files changed, 17 insertions, 8 deletions

diff --git a/monitor.c b/monitor.c
index 0adbf3a65..1cfc48757 100644
--- a/monitor.c
+++ b/monitor.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor.c,v 1.118 2012/11/04 11:09:15 djm Exp $ */
+/* $OpenBSD: monitor.c,v 1.119 2012/12/02 20:34:10 djm Exp $ */
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -199,6 +199,7 @@ static int key_blobtype = MM_NOKEY;
 static char *hostbased_cuser = NULL;
 static char *hostbased_chost = NULL;
 static char *auth_method = "unknown";
+static char *auth_submethod = NULL;
 static u_int session_id2_len = 0;
 static u_char *session_id2 = NULL;
 static pid_t monitor_child_pid;
@@ -352,7 +353,7 @@ void
 monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
 {
         struct mon_table *ent;
-        int authenticated = 0;
+        int authenticated = 0, partial = 0;
 
         debug3("preauth child monitor started");
 
@@ -379,7 +380,9 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
 
         /* The first few requests do not require asynchronous access */
         while (!authenticated) {
+                partial = 0;
                 auth_method = "unknown";
+                auth_submethod = NULL;
                 authenticated = (monitor_read(pmonitor, mon_dispatch, &ent) == 1);
 
                 /* Special handling for multiple required authentications */
@@ -393,6 +396,7 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
                                 debug3("%s: method %s: partial", __func__,
                                     auth_method);
                                 authenticated = 0;
+                                partial = 1;
                         }
                 }
 
@@ -417,7 +421,8 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
 #endif
                 }
                 if (ent->flags & (MON_AUTHDECIDE|MON_ALOG)) {
-                        auth_log(authctxt, authenticated, auth_method,
+                        auth_log(authctxt, authenticated, partial,
+                            auth_method, auth_submethod,
                             compat20 ? " ssh2" : "");
                         if (!authenticated)
                                 authctxt->failures++;
@@ -943,7 +948,7 @@ mm_answer_bsdauthrespond(int sock, Buffer *m)
         mm_request_send(sock, MONITOR_ANS_BSDAUTHRESPOND, m);
 
         if (compat20)
-                auth_method = "keyboard-interactive";
+                auth_method = "keyboard-interactive"; /* XXX auth_submethod */
         else
                 auth_method = "bsdauth";
 
@@ -1084,7 +1089,8 @@ mm_answer_pam_query(int sock, Buffer *m)
                 xfree(prompts);
         if (echo_on != NULL)
                 xfree(echo_on);
-        auth_method = "keyboard-interactive/pam";
+        auth_method = "keyboard-interactive";
+        auth_submethod = "pam";
         mm_request_send(sock, MONITOR_ANS_PAM_QUERY, m);
         return (0);
 }
@@ -1113,7 +1119,8 @@ mm_answer_pam_respond(int sock, Buffer *m)
         buffer_clear(m);
         buffer_put_int(m, ret);
         mm_request_send(sock, MONITOR_ANS_PAM_RESPOND, m);
-        auth_method = "keyboard-interactive/pam";
+        auth_method = "keyboard-interactive";
+        auth_submethod = "pam";
         if (ret == 0)
                 sshpam_authok = sshpam_ctxt;
         return (0);
@@ -1127,7 +1134,8 @@ mm_answer_pam_free_ctx(int sock, Buffer *m)
         (sshpam_device.free_ctx)(sshpam_ctxt);
         buffer_clear(m);
         mm_request_send(sock, MONITOR_ANS_PAM_FREE_CTX, m);
-        auth_method = "keyboard-interactive/pam";
+        auth_method = "keyboard-interactive";
+        auth_submethod = "pam";
         return (sshpam_authok == sshpam_ctxt);
 }
 #endif
@@ -1201,7 +1209,8 @@ mm_answer_keyallowed(int sock, Buffer *m)
                 hostbased_chost = chost;
         } else {
                 /* Log failed attempt */
-                auth_log(authctxt, 0, auth_method, compat20 ? " ssh2" : "");
+                auth_log(authctxt, 0, 0, auth_method, NULL,
+                    compat20 ? " ssh2" : "");
                 xfree(blob);
                 xfree(cuser);
                 xfree(chost);