diff options
-rw-r--r-- | ChangeLog | 3 | ||||
-rw-r--r-- | auth.h | 4 | ||||
-rw-r--r-- | auth2.c | 43 | ||||
-rw-r--r-- | monitor.c | 23 | ||||
-rw-r--r-- | monitor.h | 3 | ||||
-rw-r--r-- | monitor_wrap.c | 20 | ||||
-rw-r--r-- | monitor_wrap.h | 3 |
7 files changed, 80 insertions, 19 deletions
@@ -1,6 +1,7 @@ | |||
1 | 20020513 | 1 | 20020513 |
2 | - (djm) Add --with-superuser-path=xxx configure option to specify what $PATH | 2 | - (djm) Add --with-superuser-path=xxx configure option to specify what $PATH |
3 | the superuser receives. | 3 | the superuser receives. |
4 | - (djm) Bug #231: UsePrivilegeSeparation turns off Banner. | ||
4 | 5 | ||
5 | 20020511 | 6 | 20020511 |
6 | - (tim) [configure.ac] applied a rework of djm's OpenSSL search cleanup patch. | 7 | - (tim) [configure.ac] applied a rework of djm's OpenSSL search cleanup patch. |
@@ -571,4 +572,4 @@ | |||
571 | - (stevesk) entropy.c: typo in debug message | 572 | - (stevesk) entropy.c: typo in debug message |
572 | - (djm) ssh-keygen -i needs seeded RNG; report from markus@ | 573 | - (djm) ssh-keygen -i needs seeded RNG; report from markus@ |
573 | 574 | ||
574 | $Id: ChangeLog,v 1.2107 2002/05/13 00:48:57 djm Exp $ | 575 | $Id: ChangeLog,v 1.2108 2002/05/13 01:07:41 djm Exp $ |
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: auth.h,v 1.35 2002/03/19 10:35:39 markus Exp $ */ | 1 | /* $OpenBSD: auth.h,v 1.36 2002/05/12 23:53:45 djm Exp $ */ |
2 | 2 | ||
3 | /* | 3 | /* |
4 | * Copyright (c) 2000 Markus Friedl. All rights reserved. | 4 | * Copyright (c) 2000 Markus Friedl. All rights reserved. |
@@ -136,6 +136,8 @@ void auth_log(Authctxt *, int, char *, char *); | |||
136 | void userauth_finish(Authctxt *, int, char *); | 136 | void userauth_finish(Authctxt *, int, char *); |
137 | int auth_root_allowed(char *); | 137 | int auth_root_allowed(char *); |
138 | 138 | ||
139 | char *auth2_read_banner(void); | ||
140 | |||
139 | void privsep_challenge_enable(void); | 141 | void privsep_challenge_enable(void); |
140 | 142 | ||
141 | int auth2_challenge(Authctxt *, char *); | 143 | int auth2_challenge(Authctxt *, char *); |
@@ -23,7 +23,7 @@ | |||
23 | */ | 23 | */ |
24 | 24 | ||
25 | #include "includes.h" | 25 | #include "includes.h" |
26 | RCSID("$OpenBSD: auth2.c,v 1.89 2002/03/19 14:27:39 markus Exp $"); | 26 | RCSID("$OpenBSD: auth2.c,v 1.90 2002/05/12 23:53:45 djm Exp $"); |
27 | 27 | ||
28 | #include <openssl/evp.h> | 28 | #include <openssl/evp.h> |
29 | 29 | ||
@@ -283,25 +283,45 @@ userauth_finish(Authctxt *authctxt, int authenticated, char *method) | |||
283 | } | 283 | } |
284 | } | 284 | } |
285 | 285 | ||
286 | static void | 286 | char * |
287 | userauth_banner(void) | 287 | auth2_read_banner(void) |
288 | { | 288 | { |
289 | struct stat st; | 289 | struct stat st; |
290 | char *banner = NULL; | 290 | char *banner = NULL; |
291 | off_t len, n; | 291 | off_t len, n; |
292 | int fd; | 292 | int fd; |
293 | 293 | ||
294 | if (options.banner == NULL || (datafellows & SSH_BUG_BANNER)) | 294 | if ((fd = open(options.banner, O_RDONLY)) == -1) |
295 | return; | 295 | return (NULL); |
296 | if ((fd = open(options.banner, O_RDONLY)) < 0) | 296 | if (fstat(fd, &st) == -1) { |
297 | return; | 297 | close(fd); |
298 | if (fstat(fd, &st) < 0) | 298 | return (NULL); |
299 | goto done; | 299 | } |
300 | len = st.st_size; | 300 | len = st.st_size; |
301 | banner = xmalloc(len + 1); | 301 | banner = xmalloc(len + 1); |
302 | if ((n = read(fd, banner, len)) < 0) | 302 | n = atomicio(read, fd, banner, len); |
303 | goto done; | 303 | close(fd); |
304 | |||
305 | if (n != len) { | ||
306 | free(banner); | ||
307 | return (NULL); | ||
308 | } | ||
304 | banner[n] = '\0'; | 309 | banner[n] = '\0'; |
310 | |||
311 | return (banner); | ||
312 | } | ||
313 | |||
314 | static void | ||
315 | userauth_banner(void) | ||
316 | { | ||
317 | char *banner = NULL; | ||
318 | |||
319 | if (options.banner == NULL || (datafellows & SSH_BUG_BANNER)) | ||
320 | return; | ||
321 | |||
322 | if ((banner = PRIVSEP(auth2_read_banner())) == NULL) | ||
323 | goto done; | ||
324 | |||
305 | packet_start(SSH2_MSG_USERAUTH_BANNER); | 325 | packet_start(SSH2_MSG_USERAUTH_BANNER); |
306 | packet_put_cstring(banner); | 326 | packet_put_cstring(banner); |
307 | packet_put_cstring(""); /* language, unused */ | 327 | packet_put_cstring(""); /* language, unused */ |
@@ -310,7 +330,6 @@ userauth_banner(void) | |||
310 | done: | 330 | done: |
311 | if (banner) | 331 | if (banner) |
312 | xfree(banner); | 332 | xfree(banner); |
313 | close(fd); | ||
314 | return; | 333 | return; |
315 | } | 334 | } |
316 | 335 | ||
@@ -25,7 +25,7 @@ | |||
25 | */ | 25 | */ |
26 | 26 | ||
27 | #include "includes.h" | 27 | #include "includes.h" |
28 | RCSID("$OpenBSD: monitor.c,v 1.9 2002/03/30 18:51:15 markus Exp $"); | 28 | RCSID("$OpenBSD: monitor.c,v 1.10 2002/05/12 23:53:45 djm Exp $"); |
29 | 29 | ||
30 | #include <openssl/dh.h> | 30 | #include <openssl/dh.h> |
31 | 31 | ||
@@ -96,6 +96,7 @@ struct { | |||
96 | int mm_answer_moduli(int, Buffer *); | 96 | int mm_answer_moduli(int, Buffer *); |
97 | int mm_answer_sign(int, Buffer *); | 97 | int mm_answer_sign(int, Buffer *); |
98 | int mm_answer_pwnamallow(int, Buffer *); | 98 | int mm_answer_pwnamallow(int, Buffer *); |
99 | int mm_answer_auth2_read_banner(int, Buffer *); | ||
99 | int mm_answer_authserv(int, Buffer *); | 100 | int mm_answer_authserv(int, Buffer *); |
100 | int mm_answer_authpassword(int, Buffer *); | 101 | int mm_answer_authpassword(int, Buffer *); |
101 | int mm_answer_bsdauthquery(int, Buffer *); | 102 | int mm_answer_bsdauthquery(int, Buffer *); |
@@ -147,6 +148,7 @@ struct mon_table mon_dispatch_proto20[] = { | |||
147 | {MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign}, | 148 | {MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign}, |
148 | {MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow}, | 149 | {MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow}, |
149 | {MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv}, | 150 | {MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv}, |
151 | {MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner}, | ||
150 | {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword}, | 152 | {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword}, |
151 | #ifdef USE_PAM | 153 | #ifdef USE_PAM |
152 | {MONITOR_REQ_PAM_START, MON_ONCE, mm_answer_pam_start}, | 154 | {MONITOR_REQ_PAM_START, MON_ONCE, mm_answer_pam_start}, |
@@ -524,9 +526,11 @@ mm_answer_pwnamallow(int socket, Buffer *m) | |||
524 | /* For SSHv1 allow authentication now */ | 526 | /* For SSHv1 allow authentication now */ |
525 | if (!compat20) | 527 | if (!compat20) |
526 | monitor_permit_authentications(1); | 528 | monitor_permit_authentications(1); |
527 | else | 529 | else { |
528 | /* Allow service/style information on the auth context */ | 530 | /* Allow service/style information on the auth context */ |
529 | monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1); | 531 | monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1); |
532 | monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1); | ||
533 | } | ||
530 | 534 | ||
531 | #ifdef USE_PAM | 535 | #ifdef USE_PAM |
532 | monitor_permit(mon_dispatch, MONITOR_REQ_PAM_START, 1); | 536 | monitor_permit(mon_dispatch, MONITOR_REQ_PAM_START, 1); |
@@ -535,6 +539,21 @@ mm_answer_pwnamallow(int socket, Buffer *m) | |||
535 | return (0); | 539 | return (0); |
536 | } | 540 | } |
537 | 541 | ||
542 | int mm_answer_auth2_read_banner(int socket, Buffer *m) | ||
543 | { | ||
544 | char *banner; | ||
545 | |||
546 | buffer_clear(m); | ||
547 | banner = auth2_read_banner(); | ||
548 | buffer_put_cstring(m, banner != NULL ? banner : ""); | ||
549 | mm_request_send(socket, MONITOR_ANS_AUTH2_READ_BANNER, m); | ||
550 | |||
551 | if (banner != NULL) | ||
552 | free(banner); | ||
553 | |||
554 | return (0); | ||
555 | } | ||
556 | |||
538 | int | 557 | int |
539 | mm_answer_authserv(int socket, Buffer *m) | 558 | mm_answer_authserv(int socket, Buffer *m) |
540 | { | 559 | { |
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: monitor.h,v 1.3 2002/03/26 03:24:01 stevesk Exp $ */ | 1 | /* $OpenBSD: monitor.h,v 1.4 2002/05/12 23:53:45 djm Exp $ */ |
2 | 2 | ||
3 | /* | 3 | /* |
4 | * Copyright 2002 Niels Provos <provos@citi.umich.edu> | 4 | * Copyright 2002 Niels Provos <provos@citi.umich.edu> |
@@ -33,6 +33,7 @@ enum monitor_reqtype { | |||
33 | MONITOR_REQ_FREE, MONITOR_REQ_AUTHSERV, | 33 | MONITOR_REQ_FREE, MONITOR_REQ_AUTHSERV, |
34 | MONITOR_REQ_SIGN, MONITOR_ANS_SIGN, | 34 | MONITOR_REQ_SIGN, MONITOR_ANS_SIGN, |
35 | MONITOR_REQ_PWNAM, MONITOR_ANS_PWNAM, | 35 | MONITOR_REQ_PWNAM, MONITOR_ANS_PWNAM, |
36 | MONITOR_REQ_AUTH2_READ_BANNER, MONITOR_ANS_AUTH2_READ_BANNER, | ||
36 | MONITOR_REQ_AUTHPASSWORD, MONITOR_ANS_AUTHPASSWORD, | 37 | MONITOR_REQ_AUTHPASSWORD, MONITOR_ANS_AUTHPASSWORD, |
37 | MONITOR_REQ_BSDAUTHQUERY, MONITOR_ANS_BSDAUTHQUERY, | 38 | MONITOR_REQ_BSDAUTHQUERY, MONITOR_ANS_BSDAUTHQUERY, |
38 | MONITOR_REQ_BSDAUTHRESPOND, MONITOR_ANS_BSDAUTHRESPOND, | 39 | MONITOR_REQ_BSDAUTHRESPOND, MONITOR_ANS_BSDAUTHRESPOND, |
diff --git a/monitor_wrap.c b/monitor_wrap.c index 0fe5bc10d..380175828 100644 --- a/monitor_wrap.c +++ b/monitor_wrap.c | |||
@@ -25,7 +25,7 @@ | |||
25 | */ | 25 | */ |
26 | 26 | ||
27 | #include "includes.h" | 27 | #include "includes.h" |
28 | RCSID("$OpenBSD: monitor_wrap.c,v 1.5 2002/03/25 20:12:10 stevesk Exp $"); | 28 | RCSID("$OpenBSD: monitor_wrap.c,v 1.6 2002/05/12 23:53:45 djm Exp $"); |
29 | 29 | ||
30 | #include <openssl/bn.h> | 30 | #include <openssl/bn.h> |
31 | #include <openssl/dh.h> | 31 | #include <openssl/dh.h> |
@@ -207,6 +207,24 @@ mm_getpwnamallow(const char *login) | |||
207 | return (pw); | 207 | return (pw); |
208 | } | 208 | } |
209 | 209 | ||
210 | char* mm_auth2_read_banner(void) | ||
211 | { | ||
212 | Buffer m; | ||
213 | char *banner; | ||
214 | |||
215 | debug3("%s entering", __FUNCTION__); | ||
216 | |||
217 | buffer_init(&m); | ||
218 | mm_request_send(monitor->m_recvfd, MONITOR_REQ_AUTH2_READ_BANNER, &m); | ||
219 | buffer_clear(&m); | ||
220 | |||
221 | mm_request_receive_expect(monitor->m_recvfd, MONITOR_ANS_AUTH2_READ_BANNER, &m); | ||
222 | banner = buffer_get_string(&m, NULL); | ||
223 | buffer_free(&m); | ||
224 | |||
225 | return (banner); | ||
226 | } | ||
227 | |||
210 | /* Inform the privileged process about service and style */ | 228 | /* Inform the privileged process about service and style */ |
211 | 229 | ||
212 | void | 230 | void |
diff --git a/monitor_wrap.h b/monitor_wrap.h index 975ba0549..ce721247b 100644 --- a/monitor_wrap.h +++ b/monitor_wrap.h | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: monitor_wrap.h,v 1.4 2002/03/26 03:24:01 stevesk Exp $ */ | 1 | /* $OpenBSD: monitor_wrap.h,v 1.5 2002/05/12 23:53:45 djm Exp $ */ |
2 | 2 | ||
3 | /* | 3 | /* |
4 | * Copyright 2002 Niels Provos <provos@citi.umich.edu> | 4 | * Copyright 2002 Niels Provos <provos@citi.umich.edu> |
@@ -44,6 +44,7 @@ DH *mm_choose_dh(int, int, int); | |||
44 | int mm_key_sign(Key *, u_char **, u_int *, u_char *, u_int); | 44 | int mm_key_sign(Key *, u_char **, u_int *, u_char *, u_int); |
45 | void mm_inform_authserv(char *, char *); | 45 | void mm_inform_authserv(char *, char *); |
46 | struct passwd *mm_getpwnamallow(const char *); | 46 | struct passwd *mm_getpwnamallow(const char *); |
47 | char* mm_auth2_read_banner(void); | ||
47 | int mm_auth_password(struct Authctxt *, char *); | 48 | int mm_auth_password(struct Authctxt *, char *); |
48 | int mm_key_allowed(enum mm_keytype, char *, char *, Key *); | 49 | int mm_key_allowed(enum mm_keytype, char *, char *, Key *); |
49 | int mm_user_key_allowed(struct passwd *, Key *); | 50 | int mm_user_key_allowed(struct passwd *, Key *); |