d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

If an ssh1 client initiated challenge-response authentication but did

Browse Source 
not respond to challenge, and later successfully authenticated itself
using another method, the kbdint context would never be released,
leaving the PAM child process behind even after the connection ended.

Fix this by automatically releasing the kbdint context if a packet of
type SSH_CMSG_AUTH_TIS is follwed by anything but a packet of type
SSH_CMSG_AUTH_TIS_RESPONSE.

MFC after:	1 week
This commit is contained in:
Dag-Erling Smørgrav 2003-03-31 13:45:36 +00:00
parent effd19ed24
commit fc0824d97d
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=112870
3 changed files with 22 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
crypto/openssh/auth-chall.c
View File

@ -99,3 +99,11 @@ verify_response(Authctxt *authctxt, const char *response)
authctxt->kbdintctxt = NULL;
return res ? 0 : 1;
}
void
abandon_challenge_response(Authctxt *authctxt)
{
if (authctxt->kbdintctxt != NULL) {
device->free_ctx(authctxt->kbdintctxt);
authctxt->kbdintctxt = NULL;
}
}

1
crypto/openssh/auth.h
View File

@ -160,6 +160,7 @@ struct passwd * getpwnamallow(const char *user);
char *get_challenge(Authctxt *);
int verify_response(Authctxt *, const char *);
void abandon_challenge_response(Authctxt *);
struct passwd * auth_get_user(void);

14
crypto/openssh/auth1.c
View File

@ -74,7 +74,7 @@ do_authloop(Authctxt *authctxt)
char info[1024];
u_int dlen;
u_int ulen;
int type = 0;
int prev, type = 0;
struct passwd *pw = authctxt->pw;
debug("Attempting authentication for %s%.100s.",
@ -104,8 +104,20 @@ do_authloop(Authctxt *authctxt)
info[0] = '\0';
/* Get a packet from the client. */
prev = type;
type = packet_read();
/*
* If we started challenge-response authentication but the
* next packet is not a response to our challenge, release
* the resources allocated by get_challenge() (which would
* normally have been released by verify_response() had we
* received such a response)
*/
if (prev == SSH_CMSG_AUTH_TIS &&
type != SSH_CMSG_AUTH_TIS_RESPONSE)
abandon_challenge_response(authctxt);
/* Process the packet. */
switch (type) {