From 0a80ca190a39943029719facf7edb990def7ae62 Mon Sep 17 00:00:00 2001 From: Damien Miller Date: Sat, 27 Feb 2010 07:55:05 +1100 Subject: - OpenBSD CVS Sync - djm@cvs.openbsd.org 2010/02/26 20:29:54 [PROTOCOL PROTOCOL.agent PROTOCOL.certkeys addrmatch.c auth-options.c] [auth-options.h auth.h auth2-pubkey.c authfd.c dns.c dns.h hostfile.c] [hostfile.h kex.h kexdhs.c kexgexs.c key.c key.h match.h monitor.c] [myproposal.h servconf.c servconf.h ssh-add.c ssh-agent.c ssh-dss.c] [ssh-keygen.1 ssh-keygen.c ssh-rsa.c ssh.1 ssh.c ssh2.h sshconnect.c] [sshconnect2.c sshd.8 sshd.c sshd_config.5] Add support for certificate key types for users and hosts. OpenSSH certificate key types are not X.509 certificates, but a much simpler format that encodes a public key, identity information and some validity constraints and signs it with a CA key. CA keys are regular SSH keys. This certificate style avoids the attack surface of X.509 certificates and is very easy to deploy. Certified host keys allow automatic acceptance of new host keys when a CA certificate is marked as sh/known_hosts. see VERIFYING HOST KEYS in ssh(1) for details. Certified user keys allow authentication of users when the signing CA key is marked as trusted in authorized_keys. See "AUTHORIZED_KEYS FILE FORMAT" in sshd(8) for details. Certificates are minted using ssh-keygen(1), documentation is in the "CERTIFICATES" section of that manpage. Documentation on the format of certificates is in the file PROTOCOL.certkeys feedback and ok markus@ --- auth-options.c | 150 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 149 insertions(+), 1 deletion(-) (limited to 'auth-options.c') diff --git a/auth-options.c b/auth-options.c index ab085c233..396bda62f 100644 --- a/auth-options.c +++ b/auth-options.c @@ -1,4 +1,4 @@ -/* $OpenBSD: auth-options.c,v 1.44 2009/01/22 10:09:16 djm Exp $ */ +/* $OpenBSD: auth-options.c,v 1.45 2010/02/26 20:29:54 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -44,6 +44,7 @@ int no_agent_forwarding_flag = 0; int no_x11_forwarding_flag = 0; int no_pty_flag = 0; int no_user_rc = 0; +int key_is_cert_authority = 0; /* "command=" option. */ char *forced_command = NULL; @@ -64,6 +65,7 @@ auth_clear_options(void) no_pty_flag = 0; no_x11_forwarding_flag = 0; no_user_rc = 0; + key_is_cert_authority = 0; while (custom_environment) { struct envstring *ce = custom_environment; custom_environment = ce->next; @@ -96,6 +98,12 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum) return 1; while (*opts && *opts != ' ' && *opts != '\t') { + cp = "cert-authority"; + if (strncasecmp(opts, cp, strlen(cp)) == 0) { + key_is_cert_authority = 1; + opts += strlen(cp); + goto next_option; + } cp = "no-port-forwarding"; if (strncasecmp(opts, cp, strlen(cp)) == 0) { auth_debug_add("Port forwarding disabled."); @@ -374,3 +382,143 @@ bad_option: /* deny access */ return 0; } + +/* + * Set options from certificate constraints. These supersede user key options + * so this must be called after auth_parse_options(). + */ +int +auth_cert_constraints(Buffer *c_orig, struct passwd *pw) +{ + u_char *name = NULL, *data_blob = NULL; + u_int len; + Buffer c, data; + int ret = -1; + + int cert_no_port_forwarding_flag = 1; + int cert_no_agent_forwarding_flag = 1; + int cert_no_x11_forwarding_flag = 1; + int cert_no_pty_flag = 1; + int cert_no_user_rc = 1; + char *cert_forced_command = NULL; + int cert_source_address_done = 0; + + buffer_init(&data); + + /* Make copy to avoid altering original */ + buffer_init(&c); + buffer_append(&c, buffer_ptr(c_orig), buffer_len(c_orig)); + + while (buffer_len(&c) > 0) { + if ((name = buffer_get_string_ret(&c, NULL)) == NULL || + (data_blob = buffer_get_string_ret(&c, &len)) == NULL) { + error("Certificate constraints corrupt"); + goto out; + } + buffer_append(&data, data_blob, len); + debug3("found certificate constraint \"%.100s\" len %u", + name, len); + if (strcmp(name, "permit-X11-forwarding") == 0) + cert_no_x11_forwarding_flag = 0; + else if (strcmp(name, "permit-agent-forwarding") == 0) + cert_no_agent_forwarding_flag = 0; + else if (strcmp(name, "permit-port-forwarding") == 0) + cert_no_port_forwarding_flag = 0; + else if (strcmp(name, "permit-pty") == 0) + cert_no_pty_flag = 0; + else if (strcmp(name, "permit-user-rc") == 0) + cert_no_user_rc = 0; + else if (strcmp(name, "force-command") == 0) { + char *command = buffer_get_string_ret(&data, NULL); + + if (command == NULL) { + error("Certificate constraint \"%s\" corrupt", + name); + goto out; + } + if (cert_forced_command != NULL) { + error("Certificate has multiple " + "forced-command constraints"); + xfree(command); + goto out; + } + cert_forced_command = command; + } else if (strcmp(name, "source-address") == 0) { + char *allowed = buffer_get_string_ret(&data, NULL); + const char *remote_ip = get_remote_ipaddr(); + + if (allowed == NULL) { + error("Certificate constraint \"%s\" corrupt", + name); + goto out; + } + if (cert_source_address_done++) { + error("Certificate has multiple " + "source-address constraints"); + xfree(allowed); + goto out; + } + switch (addr_match_cidr_list(remote_ip, allowed)) { + case 1: + /* accepted */ + xfree(allowed); + break; + case 0: + /* no match */ + logit("Authentication tried for %.100s with " + "valid certificate but not from a " + "permitted host (ip=%.200s).", + pw->pw_name, remote_ip); + auth_debug_add("Your address '%.200s' is not " + "permitted to use this certificate for " + "login.", remote_ip); + xfree(allowed); + goto out; + case -1: + error("Certificate source-address contents " + "invalid"); + xfree(allowed); + goto out; + } + } else { + error("Certificate constraint \"%s\" is not supported", + name); + goto out; + } + + if (buffer_len(&data) != 0) { + error("Certificate constraint \"%s\" corrupt " + "(extra data)", name); + goto out; + } + buffer_clear(&data); + xfree(name); + xfree(data_blob); + name = data_blob = NULL; + } + + /* successfully parsed all constraints */ + ret = 0; + + no_port_forwarding_flag |= cert_no_port_forwarding_flag; + no_agent_forwarding_flag |= cert_no_agent_forwarding_flag; + no_x11_forwarding_flag |= cert_no_x11_forwarding_flag; + no_pty_flag |= cert_no_pty_flag; + no_user_rc |= cert_no_user_rc; + /* CA-specified forced command supersedes key option */ + if (cert_forced_command != NULL) { + if (forced_command != NULL) + xfree(forced_command); + forced_command = cert_forced_command; + } + + out: + if (name != NULL) + xfree(name); + if (data_blob != NULL) + xfree(data_blob); + buffer_free(&data); + buffer_free(&c); + return ret; +} + -- cgit v1.2.3 From 41396573afc94d64973d9eb824ca510d39260b3e Mon Sep 17 00:00:00 2001 From: Damien Miller Date: Thu, 4 Mar 2010 21:51:11 +1100 Subject: - OpenBSD CVS Sync - djm@cvs.openbsd.org 2010/03/03 01:44:36 [auth-options.c key.c] reject strings with embedded ASCII nul chars in certificate key IDs, principal names and constraints --- ChangeLog | 5 +++++ auth-options.c | 28 ++++++++++++++++++++-------- key.c | 36 +++++++++++++++++++++++------------- 3 files changed, 48 insertions(+), 21 deletions(-) (limited to 'auth-options.c') diff --git a/ChangeLog b/ChangeLog index 248fdfa91..36ef5c911 100644 --- a/ChangeLog +++ b/ChangeLog @@ -6,6 +6,11 @@ imorgan AT nas.nasa.gov in bz#1731 - (djm) [.cvsignore] Ignore ssh-pkcs11-helper - (djm) [regress/Makefile] Cleanup sshd_proxy_orig + - OpenBSD CVS Sync + - djm@cvs.openbsd.org 2010/03/03 01:44:36 + [auth-options.c key.c] + reject strings with embedded ASCII nul chars in certificate key IDs, + principal names and constraints 20100303 - (djm) [PROTOCOL.certkeys] Add RCS Ident diff --git a/auth-options.c b/auth-options.c index 396bda62f..d14624bf4 100644 --- a/auth-options.c +++ b/auth-options.c @@ -1,4 +1,4 @@ -/* $OpenBSD: auth-options.c,v 1.45 2010/02/26 20:29:54 djm Exp $ */ +/* $OpenBSD: auth-options.c,v 1.46 2010/03/03 01:44:36 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -391,7 +391,7 @@ int auth_cert_constraints(Buffer *c_orig, struct passwd *pw) { u_char *name = NULL, *data_blob = NULL; - u_int len; + u_int nlen, dlen, clen; Buffer c, data; int ret = -1; @@ -410,14 +410,18 @@ auth_cert_constraints(Buffer *c_orig, struct passwd *pw) buffer_append(&c, buffer_ptr(c_orig), buffer_len(c_orig)); while (buffer_len(&c) > 0) { - if ((name = buffer_get_string_ret(&c, NULL)) == NULL || - (data_blob = buffer_get_string_ret(&c, &len)) == NULL) { + if ((name = buffer_get_string_ret(&c, &nlen)) == NULL || + (data_blob = buffer_get_string_ret(&c, &dlen)) == NULL) { error("Certificate constraints corrupt"); goto out; } - buffer_append(&data, data_blob, len); + buffer_append(&data, data_blob, dlen); debug3("found certificate constraint \"%.100s\" len %u", - name, len); + name, dlen); + if (strlen(name) != nlen) { + error("Certificate constraint name contains \\0"); + goto out; + } if (strcmp(name, "permit-X11-forwarding") == 0) cert_no_x11_forwarding_flag = 0; else if (strcmp(name, "permit-agent-forwarding") == 0) @@ -429,13 +433,17 @@ auth_cert_constraints(Buffer *c_orig, struct passwd *pw) else if (strcmp(name, "permit-user-rc") == 0) cert_no_user_rc = 0; else if (strcmp(name, "force-command") == 0) { - char *command = buffer_get_string_ret(&data, NULL); + char *command = buffer_get_string_ret(&data, &clen); if (command == NULL) { error("Certificate constraint \"%s\" corrupt", name); goto out; } + if (strlen(command) != clen) { + error("force-command constrain contains \\0"); + goto out; + } if (cert_forced_command != NULL) { error("Certificate has multiple " "forced-command constraints"); @@ -444,7 +452,7 @@ auth_cert_constraints(Buffer *c_orig, struct passwd *pw) } cert_forced_command = command; } else if (strcmp(name, "source-address") == 0) { - char *allowed = buffer_get_string_ret(&data, NULL); + char *allowed = buffer_get_string_ret(&data, &clen); const char *remote_ip = get_remote_ipaddr(); if (allowed == NULL) { @@ -452,6 +460,10 @@ auth_cert_constraints(Buffer *c_orig, struct passwd *pw) name); goto out; } + if (strlen(allowed) != clen) { + error("source-address constrain contains \\0"); + goto out; + } if (cert_source_address_done++) { error("Certificate has multiple " "source-address constraints"); diff --git a/key.c b/key.c index 387190b53..e6266fa58 100644 --- a/key.c +++ b/key.c @@ -1,4 +1,4 @@ -/* $OpenBSD: key.c,v 1.83 2010/02/26 20:29:54 djm Exp $ */ +/* $OpenBSD: key.c,v 1.84 2010/03/03 01:44:36 djm Exp $ */ /* * read_bignum(): * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -1000,7 +1000,7 @@ static int cert_parse(Buffer *b, Key *key, const u_char *blob, u_int blen) { u_char *principals, *constraints, *sig_key, *sig; - u_int signed_len, plen, clen, sklen, slen; + u_int signed_len, plen, clen, sklen, slen, kidlen; Buffer tmp; char *principal; int ret = -1; @@ -1012,7 +1012,7 @@ cert_parse(Buffer *b, Key *key, const u_char *blob, u_int blen) principals = constraints = sig_key = sig = NULL; if (buffer_get_int_ret(&key->cert->type, b) != 0 || - (key->cert->key_id = buffer_get_string_ret(b, NULL)) == NULL || + (key->cert->key_id = buffer_get_string_ret(b, &kidlen)) == NULL || (principals = buffer_get_string_ret(b, &plen)) == NULL || buffer_get_int64_ret(&key->cert->valid_after, b) != 0 || buffer_get_int64_ret(&key->cert->valid_before, b) != 0 || @@ -1024,6 +1024,11 @@ cert_parse(Buffer *b, Key *key, const u_char *blob, u_int blen) goto out; } + if (kidlen != strlen(key->cert->key_id)) { + error("%s: key ID contains \\0 character", __func__); + goto out; + } + /* Signature is left in the buffer so we can calculate this length */ signed_len = buffer_len(&key->cert->certblob) - buffer_len(b); @@ -1041,11 +1046,16 @@ cert_parse(Buffer *b, Key *key, const u_char *blob, u_int blen) buffer_append(&tmp, principals, plen); while (buffer_len(&tmp) > 0) { if (key->cert->nprincipals >= CERT_MAX_PRINCIPALS) { - error("Too many principals"); + error("%s: Too many principals", __func__); goto out; } - if ((principal = buffer_get_string_ret(&tmp, NULL)) == NULL) { - error("Principals data invalid"); + if ((principal = buffer_get_string_ret(&tmp, &plen)) == NULL) { + error("%s: Principals data invalid", __func__); + goto out; + } + if (strlen(principal) != plen) { + error("%s: Principal contains \\0 character", + __func__); goto out; } key->cert->principals = xrealloc(key->cert->principals, @@ -1061,7 +1071,7 @@ cert_parse(Buffer *b, Key *key, const u_char *blob, u_int blen) while (buffer_len(&tmp) != 0) { if (buffer_get_string_ptr(&tmp, NULL) == NULL || buffer_get_string_ptr(&tmp, NULL) == NULL) { - error("Constraints data invalid"); + error("%s: Constraints data invalid", __func__); goto out; } } @@ -1069,12 +1079,12 @@ cert_parse(Buffer *b, Key *key, const u_char *blob, u_int blen) if ((key->cert->signature_key = key_from_blob(sig_key, sklen)) == NULL) { - error("Signature key invalid"); + error("%s: Signature key invalid", __func__); goto out; } if (key->cert->signature_key->type != KEY_RSA && key->cert->signature_key->type != KEY_DSA) { - error("Invalid signature key type %s (%d)", + error("%s: Invalid signature key type %s (%d)", __func__, key_type(key->cert->signature_key), key->cert->signature_key->type); goto out; @@ -1083,17 +1093,17 @@ cert_parse(Buffer *b, Key *key, const u_char *blob, u_int blen) switch (key_verify(key->cert->signature_key, sig, slen, buffer_ptr(&key->cert->certblob), signed_len)) { case 1: + ret = 0; break; /* Good signature */ case 0: - error("Invalid signature on certificate"); + error("%s: Invalid signature on certificate", __func__); goto out; case -1: - error("Certificate signature verification failed"); + error("%s: Certificate signature verification failed", + __func__); goto out; } - ret = 0; - out: buffer_free(&tmp); if (principals != NULL) -- cgit v1.2.3 From 689b872842ba2e64d2bf52abe0c9b1b1f6a6663f Mon Sep 17 00:00:00 2001 From: Damien Miller Date: Fri, 5 Mar 2010 10:42:24 +1100 Subject: - djm@cvs.openbsd.org 2010/03/04 23:27:25 [auth-options.c ssh-keygen.c] "force-command" is not spelled "forced-command"; spotted by imorgan AT nas.nasa.gov --- ChangeLog | 4 ++++ auth-options.c | 4 ++-- ssh-keygen.c | 4 ++-- 3 files changed, 8 insertions(+), 4 deletions(-) (limited to 'auth-options.c') diff --git a/ChangeLog b/ChangeLog index c441b2013..7b50de5d3 100644 --- a/ChangeLog +++ b/ChangeLog @@ -16,6 +16,10 @@ [ssh.1 sshd.8] move section on CA and revoked keys from ssh.1 to sshd.8's known hosts format section and rework it a bit; requested by jmc@ + - djm@cvs.openbsd.org 2010/03/04 23:27:25 + [auth-options.c ssh-keygen.c] + "force-command" is not spelled "forced-command"; spotted by + imorgan AT nas.nasa.gov - (tim) [ssh-pkcs11.c] Fix "non-constant initializer" errors in older compilers. OK djm@ diff --git a/auth-options.c b/auth-options.c index d14624bf4..bcf5589d7 100644 --- a/auth-options.c +++ b/auth-options.c @@ -1,4 +1,4 @@ -/* $OpenBSD: auth-options.c,v 1.46 2010/03/03 01:44:36 djm Exp $ */ +/* $OpenBSD: auth-options.c,v 1.47 2010/03/04 23:27:25 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -446,7 +446,7 @@ auth_cert_constraints(Buffer *c_orig, struct passwd *pw) } if (cert_forced_command != NULL) { error("Certificate has multiple " - "forced-command constraints"); + "force-command constraints"); xfree(command); goto out; } diff --git a/ssh-keygen.c b/ssh-keygen.c index 492c301d3..fc7ca4b0c 100644 --- a/ssh-keygen.c +++ b/ssh-keygen.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ssh-keygen.c,v 1.182 2010/03/04 20:35:08 djm Exp $ */ +/* $OpenBSD: ssh-keygen.c,v 1.183 2010/03/04 23:27:25 djm Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1994 Tatu Ylonen , Espoo, Finland @@ -1142,7 +1142,7 @@ prepare_constraint_buf(Buffer *c) if ((constraint_flags & CONSTRAINT_USER_RC) != 0) add_flag_constraint(c, "permit-user-rc"); if (constraint_command != NULL) - add_string_constraint(c, "forced-command", constraint_command); + add_string_constraint(c, "force-command", constraint_command); if (constraint_src_addr != NULL) add_string_constraint(c, "source-address", constraint_src_addr); } -- cgit v1.2.3 From cd70e1b8137023539df57b175b733341d8f4d776 Mon Sep 17 00:00:00 2001 From: Darren Tucker Date: Sun, 7 Mar 2010 23:05:17 +1100 Subject: - dtucker@cvs.openbsd.org 2010/03/07 11:57:13 [auth-rhosts.c monitor.c monitor_wrap.c session.c auth-options.c sshd.c] Hold authentication debug messages until after successful authentication. Fixes an info leak of environment variables specified in authorized_keys, reported by Jacob Appelbaum. ok djm@ --- ChangeLog | 6 ++++++ auth-options.c | 9 +-------- auth-rhosts.c | 10 ++-------- monitor.c | 17 +---------------- monitor_wrap.c | 19 +------------------ session.c | 4 +++- sshd.c | 3 ++- 7 files changed, 16 insertions(+), 52 deletions(-) (limited to 'auth-options.c') diff --git a/ChangeLog b/ChangeLog index f80d79aa3..9afd093eb 100644 --- a/ChangeLog +++ b/ChangeLog @@ -7,6 +7,12 @@ by permanently_set_uid. - (dtucker) [session.c] Also initialize creds to NULL for handing to setpcred. + - (dtucker) OpenBSD CVS Sync + - dtucker@cvs.openbsd.org 2010/03/07 11:57:13 + [auth-rhosts.c monitor.c monitor_wrap.c session.c auth-options.c sshd.c] + Hold authentication debug messages until after successful authentication. + Fixes an info leak of environment variables specified in authorized_keys, + reported by Jacob Appelbaum. ok djm@ 20100305 - OpenBSD CVS Sync diff --git a/auth-options.c b/auth-options.c index bcf5589d7..129301765 100644 --- a/auth-options.c +++ b/auth-options.c @@ -1,4 +1,4 @@ -/* $OpenBSD: auth-options.c,v 1.47 2010/03/04 23:27:25 djm Exp $ */ +/* $OpenBSD: auth-options.c,v 1.48 2010/03/07 11:57:13 dtucker Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -78,7 +78,6 @@ auth_clear_options(void) } forced_tun_device = -1; channel_clear_permitted_opens(); - auth_debug_reset(); } /* @@ -364,9 +363,6 @@ next_option: /* Process the next option. */ } - if (!use_privsep) - auth_debug_send(); - /* grant access */ return 1; @@ -376,9 +372,6 @@ bad_option: auth_debug_add("Bad options in %.100s file, line %lu: %.50s", file, linenum, opts); - if (!use_privsep) - auth_debug_send(); - /* deny access */ return 0; } diff --git a/auth-rhosts.c b/auth-rhosts.c index 5c1296701..06ae7f0b9 100644 --- a/auth-rhosts.c +++ b/auth-rhosts.c @@ -1,4 +1,4 @@ -/* $OpenBSD: auth-rhosts.c,v 1.43 2008/06/13 14:18:51 dtucker Exp $ */ +/* $OpenBSD: auth-rhosts.c,v 1.44 2010/03/07 11:57:13 dtucker Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -317,11 +317,5 @@ int auth_rhosts2(struct passwd *pw, const char *client_user, const char *hostname, const char *ipaddr) { - int ret; - - auth_debug_reset(); - ret = auth_rhosts2_raw(pw, client_user, hostname, ipaddr); - if (!use_privsep) - auth_debug_send(); - return ret; + return auth_rhosts2_raw(pw, client_user, hostname, ipaddr); } diff --git a/monitor.c b/monitor.c index f67cb7670..334aedde5 100644 --- a/monitor.c +++ b/monitor.c @@ -1,4 +1,4 @@ -/* $OpenBSD: monitor.c,v 1.105 2010/02/26 20:29:54 djm Exp $ */ +/* $OpenBSD: monitor.c,v 1.106 2010/03/07 11:57:13 dtucker Exp $ */ /* * Copyright 2002 Niels Provos * Copyright 2002 Markus Friedl @@ -997,17 +997,6 @@ mm_answer_pam_free_ctx(int sock, Buffer *m) } #endif -static void -mm_append_debug(Buffer *m) -{ - if (auth_debug_init && buffer_len(&auth_debug)) { - debug3("%s: Appending debug messages for child", __func__); - buffer_append(m, buffer_ptr(&auth_debug), - buffer_len(&auth_debug)); - buffer_clear(&auth_debug); - } -} - int mm_answer_keyallowed(int sock, Buffer *m) { @@ -1090,8 +1079,6 @@ mm_answer_keyallowed(int sock, Buffer *m) buffer_put_int(m, allowed); buffer_put_int(m, forced_command != NULL); - mm_append_debug(m); - mm_request_send(sock, MONITOR_ANS_KEYALLOWED, m); if (type == MM_RSAHOSTKEY) @@ -1475,8 +1462,6 @@ mm_answer_rsa_keyallowed(int sock, Buffer *m) if (key != NULL) key_free(key); - mm_append_debug(m); - mm_request_send(sock, MONITOR_ANS_RSAKEYALLOWED, m); monitor_permit(mon_dispatch, MONITOR_REQ_RSACHALLENGE, allowed); diff --git a/monitor_wrap.c b/monitor_wrap.c index b8e8710f7..faeb02cfa 100644 --- a/monitor_wrap.c +++ b/monitor_wrap.c @@ -1,4 +1,4 @@ -/* $OpenBSD: monitor_wrap.c,v 1.68 2009/06/22 05:39:28 dtucker Exp $ */ +/* $OpenBSD: monitor_wrap.c,v 1.69 2010/03/07 11:57:13 dtucker Exp $ */ /* * Copyright 2002 Niels Provos * Copyright 2002 Markus Friedl @@ -347,19 +347,6 @@ mm_auth_rhosts_rsa_key_allowed(struct passwd *pw, char *user, return (ret); } -static void -mm_send_debug(Buffer *m) -{ - char *msg; - - while (buffer_len(m)) { - msg = buffer_get_string(m, NULL); - debug3("%s: Sending debug: %s", __func__, msg); - packet_send_debug("%s", msg); - xfree(msg); - } -} - int mm_key_allowed(enum mm_keytype type, char *user, char *host, Key *key) { @@ -393,9 +380,6 @@ mm_key_allowed(enum mm_keytype type, char *user, char *host, Key *key) have_forced = buffer_get_int(&m); forced_command = have_forced ? xstrdup("true") : NULL; - /* Send potential debug messages */ - mm_send_debug(&m); - buffer_free(&m); return (allowed); @@ -1085,7 +1069,6 @@ mm_auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey) *rkey = key; xfree(blob); } - mm_send_debug(&m); buffer_free(&m); return (allowed); diff --git a/session.c b/session.c index b384b7d86..639405fec 100644 --- a/session.c +++ b/session.c @@ -1,4 +1,4 @@ -/* $OpenBSD: session.c,v 1.251 2010/01/12 08:33:17 dtucker Exp $ */ +/* $OpenBSD: session.c,v 1.252 2010/03/07 11:57:13 dtucker Exp $ */ /* * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland * All rights reserved @@ -271,6 +271,8 @@ do_authenticated(Authctxt *authctxt) if (!no_port_forwarding_flag && options.allow_tcp_forwarding) channel_permit_all_opens(); + auth_debug_send(); + if (compat20) do_authenticated2(authctxt); else diff --git a/sshd.c b/sshd.c index 0c3c04e4e..bc0d2753f 100644 --- a/sshd.c +++ b/sshd.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshd.c,v 1.373 2010/02/26 20:29:54 djm Exp $ */ +/* $OpenBSD: sshd.c,v 1.374 2010/03/07 11:57:13 dtucker Exp $ */ /* * Author: Tatu Ylonen * Copyright (c) 1995 Tatu Ylonen , Espoo, Finland @@ -1939,6 +1939,7 @@ main(int ac, char **av) /* prepare buffer to collect messages to display to user after login */ buffer_init(&loginmsg); + auth_debug_reset(); if (use_privsep) if (privsep_preauth(authctxt) == 1) -- cgit v1.2.3