From 1153b38f4612d93ca7f8dfa6756d6ed64338b281 Mon Sep 17 00:00:00 2001 From: Colin Watson Date: Sun, 28 Nov 2004 17:59:30 +0000 Subject: Merge from HEAD: Fix timing information leak allowing discovery of invalid usernames in PAM keyboard-interactive authentication (backported from a patch by Darren Tucker; closes: #281595). --- auth2-chall.c | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) (limited to 'auth2-chall.c') diff --git a/auth2-chall.c b/auth2-chall.c index aacbf0bcc..0f08b05c6 100644 --- a/auth2-chall.c +++ b/auth2-chall.c @@ -275,12 +275,9 @@ input_userauth_info_response(int type, u_int32_t seq, void *ctxt) } packet_check_eom(); - if (authctxt->valid) { - res = kbdintctxt->device->respond(kbdintctxt->ctxt, - nresp, response); - } else { - res = -1; - } + res = kbdintctxt->device->respond(kbdintctxt->ctxt, nresp, response); + if (!authctxt->valid) + res = 1; /* keep going if login invalid */ for (i = 0; i < nresp; i++) { memset(response[i], 'r', strlen(response[i])); @@ -292,7 +289,7 @@ input_userauth_info_response(int type, u_int32_t seq, void *ctxt) switch (res) { case 0: /* Success! */ - authenticated = 1; + authenticated = authctxt->valid ? 1 : 0; break; case 1: /* Authentication needs further interaction */ -- cgit v1.2.3