summaryrefslogtreecommitdiff
path: root/usr.bin
diff options
context:
space:
mode:
Diffstat (limited to 'usr.bin')
-rw-r--r--usr.bin/ssh/auth-rsa.c16
-rw-r--r--usr.bin/ssh/auth.c30
-rw-r--r--usr.bin/ssh/auth.h10
-rw-r--r--usr.bin/ssh/auth1.c35
-rw-r--r--usr.bin/ssh/auth2.c4
-rw-r--r--usr.bin/ssh/key.c4
-rw-r--r--usr.bin/ssh/key.h4
-rw-r--r--usr.bin/ssh/monitor.c9
8 files changed, 67 insertions, 45 deletions
diff --git a/usr.bin/ssh/auth-rsa.c b/usr.bin/ssh/auth-rsa.c
index 80b1a01d822..9c96eada8d9 100644
--- a/usr.bin/ssh/auth-rsa.c
+++ b/usr.bin/ssh/auth-rsa.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth-rsa.c,v 1.82 2013/05/17 00:13:13 djm Exp $ */
+/* $OpenBSD: auth-rsa.c,v 1.83 2013/05/19 02:42:42 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo@cs.hut.fi>
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -161,7 +161,7 @@ static int
rsa_key_allowed_in_file(struct passwd *pw, char *file,
const BIGNUM *client_n, Key **rkey)
{
- char line[SSH_MAX_PUBKEY_BYTES];
+ char *fp, line[SSH_MAX_PUBKEY_BYTES];
int allowed = 0;
u_int bits;
FILE *f;
@@ -229,6 +229,11 @@ rsa_key_allowed_in_file(struct passwd *pw, char *file,
"actual %d vs. announced %d.",
file, linenum, BN_num_bits(key->rsa->n), bits);
+ fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+ debug("matching key found: file %s, line %lu %s %s",
+ file, linenum, key_type(key), fp);
+ free(fp);
+
/* Never accept a revoked key */
if (auth_key_is_revoked(key))
break;
@@ -295,7 +300,6 @@ int
auth_rsa(Authctxt *authctxt, BIGNUM *client_n)
{
Key *key;
- char *fp;
struct passwd *pw = authctxt->pw;
/* no user given */
@@ -325,11 +329,7 @@ auth_rsa(Authctxt *authctxt, BIGNUM *client_n)
* options; this will be reset if the options cause the
* authentication to be rejected.
*/
- fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
- verbose("Found matching %s key: %s",
- key_type(key), fp);
- free(fp);
- key_free(key);
+ pubkey_auth_info(authctxt, key);
packet_send_debug("RSA authentication accepted.");
return (1);
diff --git a/usr.bin/ssh/auth.c b/usr.bin/ssh/auth.c
index 5f50f7ab3b1..70fc44f26de 100644
--- a/usr.bin/ssh/auth.c
+++ b/usr.bin/ssh/auth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth.c,v 1.102 2013/05/17 00:13:13 djm Exp $ */
+/* $OpenBSD: auth.c,v 1.103 2013/05/19 02:42:42 djm Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
*
@@ -58,6 +58,7 @@
#include "authfile.h"
#include "monitor_wrap.h"
#include "krl.h"
+#include "compat.h"
/* import */
extern ServerOptions options;
@@ -180,8 +181,25 @@ allowed_user(struct passwd * pw)
}
void
+auth_info(Authctxt *authctxt, const char *fmt, ...)
+{
+ va_list ap;
+ int i;
+
+ free(authctxt->info);
+ authctxt->info = NULL;
+
+ va_start(ap, fmt);
+ i = vasprintf(&authctxt->info, fmt, ap);
+ va_end(ap);
+
+ if (i < 0 || authctxt->info == NULL)
+ fatal("vasprintf failed");
+}
+
+void
auth_log(Authctxt *authctxt, int authenticated, int partial,
- const char *method, const char *submethod, const char *info)
+ const char *method, const char *submethod)
{
void (*authlog) (const char *fmt,...) = verbose;
char *authmsg;
@@ -203,7 +221,7 @@ auth_log(Authctxt *authctxt, int authenticated, int partial,
else
authmsg = authenticated ? "Accepted" : "Failed";
- authlog("%s %s%s%s for %s%.100s from %.200s port %d%s",
+ authlog("%s %s%s%s for %s%.100s from %.200s port %d %s%s%s",
authmsg,
method,
submethod != NULL ? "/" : "", submethod == NULL ? "" : submethod,
@@ -211,7 +229,11 @@ auth_log(Authctxt *authctxt, int authenticated, int partial,
authctxt->user,
get_remote_ipaddr(),
get_remote_port(),
- info);
+ compat20 ? "ssh2" : "ssh1",
+ authctxt->info != NULL ? ": " : "",
+ authctxt->info != NULL ? authctxt->info : "");
+ free(authctxt->info);
+ authctxt->info = NULL;
}
/*
diff --git a/usr.bin/ssh/auth.h b/usr.bin/ssh/auth.h
index d110f84de8e..e79cf2c4605 100644
--- a/usr.bin/ssh/auth.h
+++ b/usr.bin/ssh/auth.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth.h,v 1.73 2013/03/07 19:27:25 markus Exp $ */
+/* $OpenBSD: auth.h,v 1.74 2013/05/19 02:42:42 djm Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
@@ -55,6 +55,7 @@ struct Authctxt {
struct passwd *pw; /* set if 'valid' */
char *style;
void *kbdintctxt;
+ char *info; /* Extra info for next auth_log */
void *jpake_ctx;
auth_session_t *as;
char **auth_methods; /* modified from server config */
@@ -112,6 +113,7 @@ int auth_rsa_key_allowed(struct passwd *, BIGNUM *, Key **);
int auth_rhosts_rsa_key_allowed(struct passwd *, char *, char *, Key *);
int hostbased_key_allowed(struct passwd *, const char *, char *, Key *);
int user_key_allowed(struct passwd *, Key *);
+void pubkey_auth_info(Authctxt *, const Key *);
struct stat;
int auth_secure_path(const char *, struct stat *, const char *, uid_t,
@@ -127,8 +129,10 @@ void krb5_cleanup_proc(Authctxt *authctxt);
void do_authentication(Authctxt *);
void do_authentication2(Authctxt *);
-void auth_log(Authctxt *, int, int, const char *, const char *,
- const char *);
+void auth_info(Authctxt *authctxt, const char *, ...)
+ __attribute__((__format__ (printf, 2, 3)))
+ __attribute__((__nonnull__ (2)));
+void auth_log(Authctxt *, int, int, const char *, const char *);
void userauth_finish(Authctxt *, int, const char *, const char *);
int auth_root_allowed(const char *);
diff --git a/usr.bin/ssh/auth1.c b/usr.bin/ssh/auth1.c
index 98142886e39..eac5ad7a91d 100644
--- a/usr.bin/ssh/auth1.c
+++ b/usr.bin/ssh/auth1.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth1.c,v 1.78 2013/05/17 00:13:13 djm Exp $ */
+/* $OpenBSD: auth1.c,v 1.79 2013/05/19 02:42:42 djm Exp $ */
/*
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
* All rights reserved
@@ -40,17 +40,17 @@
/* import */
extern ServerOptions options;
-static int auth1_process_password(Authctxt *, char *, size_t);
-static int auth1_process_rsa(Authctxt *, char *, size_t);
-static int auth1_process_rhosts_rsa(Authctxt *, char *, size_t);
-static int auth1_process_tis_challenge(Authctxt *, char *, size_t);
-static int auth1_process_tis_response(Authctxt *, char *, size_t);
+static int auth1_process_password(Authctxt *);
+static int auth1_process_rsa(Authctxt *);
+static int auth1_process_rhosts_rsa(Authctxt *);
+static int auth1_process_tis_challenge(Authctxt *);
+static int auth1_process_tis_response(Authctxt *);
struct AuthMethod1 {
int type;
char *name;
int *enabled;
- int (*method)(Authctxt *, char *, size_t);
+ int (*method)(Authctxt *);
};
const struct AuthMethod1 auth1_methods[] = {
@@ -105,7 +105,7 @@ get_authname(int type)
/*ARGSUSED*/
static int
-auth1_process_password(Authctxt *authctxt, char *info, size_t infolen)
+auth1_process_password(Authctxt *authctxt)
{
int authenticated = 0;
char *password;
@@ -130,7 +130,7 @@ auth1_process_password(Authctxt *authctxt, char *info, size_t infolen)
/*ARGSUSED*/
static int
-auth1_process_rsa(Authctxt *authctxt, char *info, size_t infolen)
+auth1_process_rsa(Authctxt *authctxt)
{
int authenticated = 0;
BIGNUM *n;
@@ -148,7 +148,7 @@ auth1_process_rsa(Authctxt *authctxt, char *info, size_t infolen)
/*ARGSUSED*/
static int
-auth1_process_rhosts_rsa(Authctxt *authctxt, char *info, size_t infolen)
+auth1_process_rhosts_rsa(Authctxt *authctxt)
{
int keybits, authenticated = 0;
u_int bits;
@@ -181,7 +181,7 @@ auth1_process_rhosts_rsa(Authctxt *authctxt, char *info, size_t infolen)
client_host_key);
key_free(client_host_key);
- snprintf(info, infolen, " ruser %.100s", client_user);
+ auth_info(authctxt, "ruser %.100s", client_user);
free(client_user);
return (authenticated);
@@ -189,7 +189,7 @@ auth1_process_rhosts_rsa(Authctxt *authctxt, char *info, size_t infolen)
/*ARGSUSED*/
static int
-auth1_process_tis_challenge(Authctxt *authctxt, char *info, size_t infolen)
+auth1_process_tis_challenge(Authctxt *authctxt)
{
char *challenge;
@@ -208,7 +208,7 @@ auth1_process_tis_challenge(Authctxt *authctxt, char *info, size_t infolen)
/*ARGSUSED*/
static int
-auth1_process_tis_response(Authctxt *authctxt, char *info, size_t infolen)
+auth1_process_tis_response(Authctxt *authctxt)
{
int authenticated = 0;
char *response;
@@ -231,7 +231,6 @@ static void
do_authloop(Authctxt *authctxt)
{
int authenticated = 0;
- char info[1024];
int type = 0;
const struct AuthMethod1 *meth;
@@ -244,7 +243,7 @@ do_authloop(Authctxt *authctxt)
(!options.kerberos_authentication || options.kerberos_or_local_passwd) &&
#endif
PRIVSEP(auth_password(authctxt, ""))) {
- auth_log(authctxt, 1, 0, "without authentication", NULL, "");
+ auth_log(authctxt, 1, 0, "without authentication", NULL);
return;
}
@@ -257,7 +256,6 @@ do_authloop(Authctxt *authctxt)
/* default to fail */
authenticated = 0;
- info[0] = '\0';
/* Get a packet from the client. */
type = packet_read();
@@ -274,7 +272,7 @@ do_authloop(Authctxt *authctxt)
goto skip;
}
- authenticated = meth->method(authctxt, info, sizeof(info));
+ authenticated = meth->method(authctxt);
if (authenticated == -1)
continue; /* "postponed" */
@@ -293,8 +291,7 @@ do_authloop(Authctxt *authctxt)
skip:
/* Log before sending the reply */
- auth_log(authctxt, authenticated, 0, get_authname(type),
- NULL, info);
+ auth_log(authctxt, authenticated, 0, get_authname(type), NULL);
if (authenticated)
return;
diff --git a/usr.bin/ssh/auth2.c b/usr.bin/ssh/auth2.c
index c94728f4b7d..ef336d87273 100644
--- a/usr.bin/ssh/auth2.c
+++ b/usr.bin/ssh/auth2.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2.c,v 1.128 2013/05/17 00:13:13 djm Exp $ */
+/* $OpenBSD: auth2.c,v 1.129 2013/05/19 02:42:42 djm Exp $ */
/*
* Copyright (c) 2000 Markus Friedl. All rights reserved.
*
@@ -302,7 +302,7 @@ userauth_finish(Authctxt *authctxt, int authenticated, const char *method,
}
/* Log before sending the reply */
- auth_log(authctxt, authenticated, partial, method, submethod, " ssh2");
+ auth_log(authctxt, authenticated, partial, method, submethod);
if (authctxt->postponed)
return;
diff --git a/usr.bin/ssh/key.c b/usr.bin/ssh/key.c
index a313096dd97..594ca6bd792 100644
--- a/usr.bin/ssh/key.c
+++ b/usr.bin/ssh/key.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: key.c,v 1.103 2013/05/17 00:13:13 djm Exp $ */
+/* $OpenBSD: key.c,v 1.104 2013/05/19 02:42:42 djm Exp $ */
/*
* read_bignum():
* Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -555,7 +555,7 @@ key_fingerprint_randomart(u_char *dgst_raw, u_int dgst_raw_len, const Key *k)
}
char *
-key_fingerprint(Key *k, enum fp_type dgst_type, enum fp_rep dgst_rep)
+key_fingerprint(const Key *k, enum fp_type dgst_type, enum fp_rep dgst_rep)
{
char *retval = NULL;
u_char *dgst_raw;
diff --git a/usr.bin/ssh/key.h b/usr.bin/ssh/key.h
index 9b24f384264..05e7730588c 100644
--- a/usr.bin/ssh/key.h
+++ b/usr.bin/ssh/key.h
@@ -1,4 +1,4 @@
-/* $OpenBSD: key.h,v 1.36 2013/04/19 01:06:50 djm Exp $ */
+/* $OpenBSD: key.h,v 1.37 2013/05/19 02:42:42 djm Exp $ */
/*
* Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
@@ -89,7 +89,7 @@ void key_free(Key *);
Key *key_demote(const Key *);
int key_equal_public(const Key *, const Key *);
int key_equal(const Key *, const Key *);
-char *key_fingerprint(Key *, enum fp_type, enum fp_rep);
+char *key_fingerprint(const Key *, enum fp_type, enum fp_rep);
u_char *key_fingerprint_raw(const Key *, enum fp_type, u_int *);
const char *key_type(const Key *);
const char *key_cert_type(const Key *);
diff --git a/usr.bin/ssh/monitor.c b/usr.bin/ssh/monitor.c
index ccdd7f4bfeb..c0e75e4e1ac 100644
--- a/usr.bin/ssh/monitor.c
+++ b/usr.bin/ssh/monitor.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor.c,v 1.124 2013/05/17 00:13:13 djm Exp $ */
+/* $OpenBSD: monitor.c,v 1.125 2013/05/19 02:42:42 djm Exp $ */
/*
* Copyright 2002 Niels Provos <provos@citi.umich.edu>
* Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -330,8 +330,7 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
}
if (ent->flags & (MON_AUTHDECIDE|MON_ALOG)) {
auth_log(authctxt, authenticated, partial,
- auth_method, auth_submethod,
- compat20 ? " ssh2" : "");
+ auth_method, auth_submethod);
if (!authenticated)
authctxt->failures++;
}
@@ -882,6 +881,7 @@ mm_answer_keyallowed(int sock, Buffer *m)
case MM_USERKEY:
allowed = options.pubkey_authentication &&
user_key_allowed(authctxt->pw, key);
+ pubkey_auth_info(authctxt, key);
auth_method = "publickey";
if (options.pubkey_authentication && allowed != 1)
auth_clear_options();
@@ -921,8 +921,7 @@ mm_answer_keyallowed(int sock, Buffer *m)
hostbased_chost = chost;
} else {
/* Log failed attempt */
- auth_log(authctxt, 0, 0, auth_method, NULL,
- compat20 ? " ssh2" : "");
+ auth_log(authctxt, 0, 0, auth_method, NULL);
free(blob);
free(cuser);
free(chost);
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-27 20:17:27 +0000