author | Tomas Kuthan <tomas.kuthan@oracle.com> |
Wed, 16 Mar 2016 02:37:08 -0700 | |
changeset 5612 | ece68a956e2f |
child 6930 | 31ef2580c45d |
permissions | -rw-r--r-- |
5612
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
1 |
# |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
2 |
# Make pam_set_data/pam_get_data work with OpenSSH |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
3 |
# |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
4 |
# The way PAM is implemented in OpenSSH makes pam_set_data unusable |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
5 |
# for passing data between PAM stacks. |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
6 |
# |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
7 |
# The problem is, that pam_authenticate and pam_acct_mgmt are called |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
8 |
# in a separate auxiliary process. Any data stored using pam_set_data |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
9 |
# and any other state information stored by those two functions are |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
10 |
# lost when the auxiliary process exits (with exceptions like |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
11 |
# environment variables, which are sent over between the processes). |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
12 |
# |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
13 |
# This patch fixes this by switching the roles of the monitor and the |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
14 |
# auxiliary process when doing PAM authentication. In the new code the |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
15 |
# monitor will be the one calling pam_authenticate and pam_acct_mgmt |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
16 |
# (eventually blocking and calling callbacks), whereas the other |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
17 |
# process (callback child) will be sending messages to the client |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
18 |
# (either directly or through privsep child). |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
19 |
# |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
20 |
# Patch origin: in-house |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
21 |
# |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
22 |
# Reported upstream: |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
23 |
# https://bugzilla.mindrot.org/show_bug.cgi?id=2548 |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
24 |
# |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
25 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
26 |
diff -pur old/auth-pam.c new/auth-pam.c |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
27 |
--- old/auth-pam.c |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
28 |
+++ new/auth-pam.c |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
29 |
@@ -97,6 +97,7 @@ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
30 |
#include "ssh-gss.h" |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
31 |
#endif |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
32 |
#include "monitor_wrap.h" |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
33 |
+#include "ssherr.h" |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
34 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
35 |
extern ServerOptions options; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
36 |
extern Buffer loginmsg; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
37 |
@@ -109,38 +110,26 @@ extern u_int utmp_len; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
38 |
#endif |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
39 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
40 |
/* |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
41 |
- * Formerly known as USE_POSIX_THREADS, using this is completely unsupported |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
42 |
- * and generally a bad idea. Use at own risk and do not expect support if |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
43 |
- * this breaks. |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
44 |
+ * PAM processing model has been rewritten. |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
45 |
+ * Now all the calls to PAM are within the monitor process, |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
46 |
+ * pam_get_data/pam_set_data works as designed and there is no need |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
47 |
+ * for the threads anymore. |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
48 |
*/ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
49 |
#ifdef UNSUPPORTED_POSIX_THREADS_HACK |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
50 |
-#include <pthread.h> |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
51 |
-/* |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
52 |
- * Avoid namespace clash when *not* using pthreads for systems *with* |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
53 |
- * pthreads, which unconditionally define pthread_t via sys/types.h |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
54 |
- * (e.g. Linux) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
55 |
- */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
56 |
-typedef pthread_t sp_pthread_t; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
57 |
-#else |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
58 |
-typedef pid_t sp_pthread_t; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
59 |
+# error "UNSUPPORTED_POSIX_THREADS_HACK no longer supported" |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
60 |
#endif |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
61 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
62 |
struct pam_ctxt { |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
63 |
- sp_pthread_t pam_thread; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
64 |
- int pam_psock; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
65 |
- int pam_csock; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
66 |
- int pam_done; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
67 |
+ pid_t pam_child; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
68 |
+ int pam_psock; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
69 |
+ int pam_csock; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
70 |
+ int pam_done; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
71 |
}; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
72 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
73 |
static void sshpam_free_ctx(void *); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
74 |
static struct pam_ctxt *cleanup_ctxt; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
75 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
76 |
-#ifndef UNSUPPORTED_POSIX_THREADS_HACK |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
77 |
-/* |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
78 |
- * Simulate threads with processes. |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
79 |
- */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
80 |
- |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
81 |
-static int sshpam_thread_status = -1; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
82 |
+static int sshpam_child_status = -1; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
83 |
static mysig_t sshpam_oldsig; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
84 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
85 |
static void |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
86 |
@@ -149,78 +138,22 @@ sshpam_sigchld_handler(int sig) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
87 |
signal(SIGCHLD, SIG_DFL); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
88 |
if (cleanup_ctxt == NULL) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
89 |
return; /* handler called after PAM cleanup, shouldn't happen */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
90 |
- if (waitpid(cleanup_ctxt->pam_thread, &sshpam_thread_status, WNOHANG) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
91 |
+ if (waitpid(cleanup_ctxt->pam_child, &sshpam_child_status, WNOHANG) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
92 |
<= 0) { |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
93 |
- /* PAM thread has not exitted, privsep slave must have */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
94 |
- kill(cleanup_ctxt->pam_thread, SIGTERM); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
95 |
- if (waitpid(cleanup_ctxt->pam_thread, &sshpam_thread_status, 0) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
96 |
+ /* callback child has not exited, privsep slave must have */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
97 |
+ kill(cleanup_ctxt->pam_child, SIGTERM); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
98 |
+ if (waitpid(cleanup_ctxt->pam_child, &sshpam_child_status, 0) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
99 |
<= 0) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
100 |
return; /* could not wait */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
101 |
} |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
102 |
- if (WIFSIGNALED(sshpam_thread_status) && |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
103 |
- WTERMSIG(sshpam_thread_status) == SIGTERM) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
104 |
- return; /* terminated by pthread_cancel */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
105 |
- if (!WIFEXITED(sshpam_thread_status)) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
106 |
- sigdie("PAM: authentication thread exited unexpectedly"); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
107 |
- if (WEXITSTATUS(sshpam_thread_status) != 0) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
108 |
- sigdie("PAM: authentication thread exited uncleanly"); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
109 |
-} |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
110 |
- |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
111 |
-/* ARGSUSED */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
112 |
-static void |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
113 |
-pthread_exit(void *value) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
114 |
-{ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
115 |
- _exit(0); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
116 |
-} |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
117 |
- |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
118 |
-/* ARGSUSED */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
119 |
-static int |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
120 |
-pthread_create(sp_pthread_t *thread, const void *attr, |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
121 |
- void *(*thread_start)(void *), void *arg) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
122 |
-{ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
123 |
- pid_t pid; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
124 |
- struct pam_ctxt *ctx = arg; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
125 |
- |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
126 |
- sshpam_thread_status = -1; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
127 |
- switch ((pid = fork())) { |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
128 |
- case -1: |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
129 |
- error("fork(): %s", strerror(errno)); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
130 |
- return (-1); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
131 |
- case 0: |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
132 |
- close(ctx->pam_psock); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
133 |
- ctx->pam_psock = -1; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
134 |
- thread_start(arg); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
135 |
- _exit(1); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
136 |
- default: |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
137 |
- *thread = pid; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
138 |
- close(ctx->pam_csock); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
139 |
- ctx->pam_csock = -1; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
140 |
- sshpam_oldsig = signal(SIGCHLD, sshpam_sigchld_handler); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
141 |
- return (0); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
142 |
- } |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
143 |
-} |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
144 |
- |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
145 |
-static int |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
146 |
-pthread_cancel(sp_pthread_t thread) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
147 |
-{ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
148 |
- signal(SIGCHLD, sshpam_oldsig); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
149 |
- return (kill(thread, SIGTERM)); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
150 |
-} |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
151 |
- |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
152 |
-/* ARGSUSED */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
153 |
-static int |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
154 |
-pthread_join(sp_pthread_t thread, void **value) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
155 |
-{ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
156 |
- int status; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
157 |
- |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
158 |
- if (sshpam_thread_status != -1) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
159 |
- return (sshpam_thread_status); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
160 |
- signal(SIGCHLD, sshpam_oldsig); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
161 |
- waitpid(thread, &status, 0); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
162 |
- return (status); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
163 |
+ if (WIFSIGNALED(sshpam_child_status) && |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
164 |
+ WTERMSIG(sshpam_child_status) == SIGTERM) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
165 |
+ return; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
166 |
+ if (!WIFEXITED(sshpam_child_status)) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
167 |
+ sigdie("PAM: callback child exited unexpectedly"); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
168 |
+ if (WEXITSTATUS(sshpam_child_status) != 0) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
169 |
+ sigdie("PAM: callback child exited uncleanly"); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
170 |
} |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
171 |
-#endif |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
172 |
- |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
173 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
174 |
static pam_handle_t *sshpam_handle = NULL; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
175 |
static int sshpam_err = 0; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
176 |
@@ -290,55 +223,11 @@ sshpam_password_change_required(int reqd |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
177 |
} |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
178 |
} |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
179 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
180 |
-/* Import regular and PAM environment from subprocess */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
181 |
-static void |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
182 |
-import_environments(Buffer *b) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
183 |
-{ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
184 |
- char *env; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
185 |
- u_int i, num_env; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
186 |
- int err; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
187 |
- |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
188 |
- debug3("PAM: %s entering", __func__); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
189 |
- |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
190 |
-#ifndef UNSUPPORTED_POSIX_THREADS_HACK |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
191 |
- /* Import variables set by do_pam_account */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
192 |
- sshpam_account_status = buffer_get_int(b); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
193 |
- sshpam_password_change_required(buffer_get_int(b)); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
194 |
- |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
195 |
- /* Import environment from subprocess */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
196 |
- num_env = buffer_get_int(b); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
197 |
- if (num_env > 1024) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
198 |
- fatal("%s: received %u environment variables, expected <= 1024", |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
199 |
- __func__, num_env); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
200 |
- sshpam_env = xcalloc(num_env + 1, sizeof(*sshpam_env)); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
201 |
- debug3("PAM: num env strings %d", num_env); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
202 |
- for(i = 0; i < num_env; i++) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
203 |
- sshpam_env[i] = buffer_get_string(b, NULL); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
204 |
- |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
205 |
- sshpam_env[num_env] = NULL; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
206 |
- |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
207 |
- /* Import PAM environment from subprocess */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
208 |
- num_env = buffer_get_int(b); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
209 |
- debug("PAM: num PAM env strings %d", num_env); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
210 |
- for(i = 0; i < num_env; i++) { |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
211 |
- env = buffer_get_string(b, NULL); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
212 |
- |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
213 |
-#ifdef HAVE_PAM_PUTENV |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
214 |
- /* Errors are not fatal here */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
215 |
- if ((err = pam_putenv(sshpam_handle, env)) != PAM_SUCCESS) { |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
216 |
- error("PAM: pam_putenv: %s", |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
217 |
- pam_strerror(sshpam_handle, sshpam_err)); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
218 |
- } |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
219 |
-#endif |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
220 |
- } |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
221 |
-#endif |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
222 |
-} |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
223 |
- |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
224 |
/* |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
225 |
- * Conversation function for authentication thread. |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
226 |
+ * Conversation function for keyboard-interactive authentication. |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
227 |
*/ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
228 |
static int |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
229 |
-sshpam_thread_conv(int n, sshpam_const struct pam_message **msg, |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
230 |
+sshpam_child_conv(int n, sshpam_const struct pam_message **msg, |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
231 |
struct pam_response **resp, void *data) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
232 |
{ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
233 |
Buffer buffer; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
234 |
@@ -420,48 +309,84 @@ sshpam_thread_conv(int n, sshpam_const s |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
235 |
} |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
236 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
237 |
/* |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
238 |
- * Authentication thread. |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
239 |
+ * Terminates the call back child. |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
240 |
+ * |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
241 |
+ * Sends a message of type PAM_SUCCESS or PAM_AUTH_ERR to the child. |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
242 |
+ * In response receives a message with remaining PAM prompts. |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
243 |
+ * When not using privilege separation, receives serialized packet state too. |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
244 |
+ * |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
245 |
+ * After that, the child exits. |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
246 |
*/ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
247 |
-static void * |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
248 |
-sshpam_thread(void *ctxtp) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
249 |
+void |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
250 |
+relieve_from_duty(struct pam_ctxt *ctxt) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
251 |
{ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
252 |
- struct pam_ctxt *ctxt = ctxtp; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
253 |
Buffer buffer; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
254 |
- struct pam_conv sshpam_conv; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
255 |
- int flags = (options.permit_empty_passwd == 0 ? |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
256 |
- PAM_DISALLOW_NULL_AUTHTOK : 0); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
257 |
-#ifndef UNSUPPORTED_POSIX_THREADS_HACK |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
258 |
- extern char **environ; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
259 |
- char **env_from_pam; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
260 |
- u_int i; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
261 |
- const char *pam_user; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
262 |
- const char **ptr_pam_user = &pam_user; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
263 |
- char *tz = getenv("TZ"); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
264 |
+ struct ssh *ssh = active_state; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
265 |
+ int r; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
266 |
+ u_char type; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
267 |
+ char *msg; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
268 |
+ u_int len; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
269 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
270 |
- sshpam_err = pam_get_item(sshpam_handle, PAM_USER, |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
271 |
- (sshpam_const void **)ptr_pam_user); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
272 |
- if (sshpam_err != PAM_SUCCESS) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
273 |
- goto auth_fail; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
274 |
+ buffer_init(&buffer); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
275 |
+ buffer_put_cstring(&buffer, "OK"); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
276 |
+ type = (ctxt->pam_done == 1) ? PAM_SUCCESS : PAM_AUTH_ERR; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
277 |
+ if (ssh_msg_send(ctxt->pam_csock, type, &buffer) == -1) { |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
278 |
+ buffer_free(&buffer); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
279 |
+ fatal("%s: cannnot terminate callback child (send)", __func__); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
280 |
+ } |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
281 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
282 |
- environ[0] = NULL; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
283 |
- if (tz != NULL) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
284 |
- if (setenv("TZ", tz, 1) == -1) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
285 |
- error("PAM: could not set TZ environment: %s", |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
286 |
- strerror(errno)); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
287 |
- |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
288 |
- if (sshpam_authctxt != NULL) { |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
289 |
- setproctitle("%s [pam]", |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
290 |
- sshpam_authctxt->valid ? pam_user : "unknown"); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
291 |
+ buffer_clear(&buffer); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
292 |
+ if (ssh_msg_recv(ctxt->pam_csock, &buffer) == -1) { |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
293 |
+ buffer_free(&buffer); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
294 |
+ fatal("%s: cannnot terminate callback child (receive)", |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
295 |
+ __func__); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
296 |
} |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
297 |
-#endif |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
298 |
+ type = buffer_get_char(&buffer); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
299 |
+ msg = buffer_get_cstring(&buffer, &len); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
300 |
+ if (len) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
301 |
+ buffer_append(&loginmsg, msg, len); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
302 |
+ /* if not using privsep child, sync packet state from callback child */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
303 |
+ if (!use_privsep) { |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
304 |
+ if ((r = ssh_packet_set_state(ssh, &buffer)) != 0) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
305 |
+ fatal("%s: set_state failed: %s", |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
306 |
+ __func__, ssh_err(r)); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
307 |
+ } |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
308 |
+ free(msg); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
309 |
+ buffer_free(&buffer); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
310 |
+ close(ctxt->pam_csock); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
311 |
+ ctxt->pam_csock = -1; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
312 |
+} |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
313 |
+ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
314 |
+int |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
315 |
+get_pam_done(void *ctxt) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
316 |
+{ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
317 |
+ struct pam_ctxt *pctxt = (struct pam_ctxt *)ctxt; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
318 |
+ return (pctxt->pam_done); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
319 |
+} |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
320 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
321 |
- sshpam_conv.conv = sshpam_thread_conv; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
322 |
+/* |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
323 |
+ * Perform PAM authentication. |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
324 |
+ * |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
325 |
+ * PAM APIs (pam_authenticate, pam_acct_mgmt, ...) block and call the |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
326 |
+ * provided callback conversation function (sshpam_conv). The conversation |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
327 |
+ * function sends messages to the callback child (pam_ctxt.pam_child), which |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
328 |
+ * communicates with the client directly, or indirectly through privsep child. |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
329 |
+ */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
330 |
+void |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
331 |
+do_pam_auth(struct pam_ctxt *ctxt) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
332 |
+{ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
333 |
+ struct pam_conv sshpam_conv; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
334 |
+ int flags = (options.permit_empty_passwd == 0 ? |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
335 |
+ PAM_DISALLOW_NULL_AUTHTOK : 0); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
336 |
+ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
337 |
+ sshpam_conv.conv = sshpam_child_conv; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
338 |
sshpam_conv.appdata_ptr = ctxt; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
339 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
340 |
+ ctxt->pam_done = -1; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
341 |
+ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
342 |
if (sshpam_authctxt == NULL) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
343 |
fatal("%s: PAM authctxt not initialized", __func__); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
344 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
345 |
- buffer_init(&buffer); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
346 |
sshpam_err = pam_set_item(sshpam_handle, PAM_CONV, |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
347 |
(const void *)&sshpam_conv); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
348 |
if (sshpam_err != PAM_SUCCESS) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
349 |
@@ -484,60 +409,34 @@ sshpam_thread(void *ctxtp) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
350 |
} |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
351 |
} |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
352 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
353 |
- buffer_put_cstring(&buffer, "OK"); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
354 |
- |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
355 |
-#ifndef UNSUPPORTED_POSIX_THREADS_HACK |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
356 |
- /* Export variables set by do_pam_account */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
357 |
- buffer_put_int(&buffer, sshpam_account_status); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
358 |
- buffer_put_int(&buffer, sshpam_authctxt->force_pwchange); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
359 |
- |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
360 |
- /* Export any environment strings set in child */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
361 |
- for(i = 0; environ[i] != NULL; i++) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
362 |
- ; /* Count */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
363 |
- buffer_put_int(&buffer, i); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
364 |
- for(i = 0; environ[i] != NULL; i++) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
365 |
- buffer_put_cstring(&buffer, environ[i]); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
366 |
- |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
367 |
- /* Export any environment strings set by PAM in child */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
368 |
- env_from_pam = pam_getenvlist(sshpam_handle); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
369 |
- for(i = 0; env_from_pam != NULL && env_from_pam[i] != NULL; i++) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
370 |
- ; /* Count */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
371 |
- buffer_put_int(&buffer, i); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
372 |
- for(i = 0; env_from_pam != NULL && env_from_pam[i] != NULL; i++) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
373 |
- buffer_put_cstring(&buffer, env_from_pam[i]); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
374 |
-#endif /* UNSUPPORTED_POSIX_THREADS_HACK */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
375 |
- |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
376 |
- /* XXX - can't do much about an error here */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
377 |
- ssh_msg_send(ctxt->pam_csock, sshpam_err, &buffer); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
378 |
- buffer_free(&buffer); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
379 |
- pthread_exit(NULL); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
380 |
+ ctxt->pam_done = 1; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
381 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
382 |
auth_fail: |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
383 |
- buffer_put_cstring(&buffer, |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
384 |
- pam_strerror(sshpam_handle, sshpam_err)); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
385 |
- /* XXX - can't do much about an error here */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
386 |
- if (sshpam_err == PAM_ACCT_EXPIRED) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
387 |
- ssh_msg_send(ctxt->pam_csock, PAM_ACCT_EXPIRED, &buffer); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
388 |
- else |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
389 |
- ssh_msg_send(ctxt->pam_csock, PAM_AUTH_ERR, &buffer); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
390 |
- buffer_free(&buffer); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
391 |
- pthread_exit(NULL); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
392 |
- |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
393 |
- return (NULL); /* Avoid warning for non-pthread case */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
394 |
+ if (sshpam_err != PAM_SUCCESS) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
395 |
+ error("PAM: %s for %s%.100s from %.100s", |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
396 |
+ pam_strerror(sshpam_handle, sshpam_err), |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
397 |
+ sshpam_authctxt->valid ? "" : "illegal user ", |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
398 |
+ sshpam_authctxt->user, |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
399 |
+ get_remote_name_or_ip(utmp_len, options.use_dns)); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
400 |
+ relieve_from_duty(ctxt); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
401 |
} |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
402 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
403 |
void |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
404 |
-sshpam_thread_cleanup(void) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
405 |
+sshpam_child_cleanup(void) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
406 |
{ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
407 |
struct pam_ctxt *ctxt = cleanup_ctxt; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
408 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
409 |
debug3("PAM: %s entering", __func__); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
410 |
- if (ctxt != NULL && ctxt->pam_thread != 0) { |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
411 |
- pthread_cancel(ctxt->pam_thread); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
412 |
- pthread_join(ctxt->pam_thread, NULL); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
413 |
- close(ctxt->pam_psock); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
414 |
- close(ctxt->pam_csock); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
415 |
- memset(ctxt, 0, sizeof(*ctxt)); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
416 |
+ if (ctxt != NULL && ctxt->pam_child != 0) { |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
417 |
+ signal(SIGCHLD, sshpam_oldsig); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
418 |
+ /* callback child should have had exited by now */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
419 |
+ kill(ctxt->pam_child, SIGTERM); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
420 |
+ if (ctxt->pam_psock != -1) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
421 |
+ close(ctxt->pam_psock); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
422 |
+ if (ctxt->pam_csock != -1) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
423 |
+ close(ctxt->pam_csock); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
424 |
+ if (sshpam_child_status == -1) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
425 |
+ waitpid(ctxt->pam_child, &sshpam_child_status, 0); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
426 |
cleanup_ctxt = NULL; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
427 |
} |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
428 |
} |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
429 |
@@ -686,7 +585,6 @@ derive_pam_service_name(Authctxt *authct |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
430 |
static int |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
431 |
sshpam_init(Authctxt *authctxt) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
432 |
{ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
433 |
- extern char *__progname; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
434 |
const char *pam_rhost, *pam_user, *user = authctxt->user; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
435 |
const char **ptr_pam_user = &pam_user; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
436 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
437 |
@@ -792,6 +690,7 @@ sshpam_init_ctx(Authctxt *authctxt) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
438 |
{ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
439 |
struct pam_ctxt *ctxt; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
440 |
int socks[2]; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
441 |
+ pid_t pid; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
442 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
443 |
debug3("PAM: %s entering", __func__); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
444 |
/* |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
445 |
@@ -809,7 +708,7 @@ sshpam_init_ctx(Authctxt *authctxt) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
446 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
447 |
ctxt = xcalloc(1, sizeof *ctxt); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
448 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
449 |
- /* Start the authentication thread */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
450 |
+ /* Fork the callback child and start PAM authentication */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
451 |
if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, socks) == -1) { |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
452 |
error("PAM: failed create sockets: %s", strerror(errno)); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
453 |
free(ctxt); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
454 |
@@ -817,15 +716,29 @@ sshpam_init_ctx(Authctxt *authctxt) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
455 |
} |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
456 |
ctxt->pam_psock = socks[0]; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
457 |
ctxt->pam_csock = socks[1]; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
458 |
- if (pthread_create(&ctxt->pam_thread, NULL, sshpam_thread, ctxt) == -1) { |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
459 |
- error("PAM: failed to start authentication thread: %s", |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
460 |
- strerror(errno)); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
461 |
+ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
462 |
+ sshpam_child_status = -1; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
463 |
+ switch ((pid = fork())) { |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
464 |
+ case -1: |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
465 |
+ error("fork(): %s", strerror(errno)); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
466 |
close(socks[0]); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
467 |
close(socks[1]); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
468 |
free(ctxt); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
469 |
return (NULL); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
470 |
+ case 0: |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
471 |
+ /* child processes query & respond for kbdint */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
472 |
+ close(ctxt->pam_csock); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
473 |
+ ctxt->pam_csock = -1; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
474 |
+ break; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
475 |
+ default: |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
476 |
+ /* parent does PAM */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
477 |
+ ctxt->pam_child = pid; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
478 |
+ close(ctxt->pam_psock); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
479 |
+ ctxt->pam_psock = -1; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
480 |
+ sshpam_oldsig = signal(SIGCHLD, sshpam_sigchld_handler); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
481 |
+ cleanup_ctxt = ctxt; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
482 |
+ do_pam_auth(ctxt); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
483 |
} |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
484 |
- cleanup_ctxt = ctxt; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
485 |
return (ctxt); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
486 |
} |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
487 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
488 |
@@ -839,8 +752,11 @@ sshpam_query(void *ctx, char **name, cha |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
489 |
u_char type; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
490 |
char *msg; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
491 |
size_t len, mlen; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
492 |
+ struct ssh *ssh; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
493 |
+ int r; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
494 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
495 |
debug3("PAM: %s entering", __func__); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
496 |
+ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
497 |
buffer_init(&buffer); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
498 |
*name = xstrdup(""); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
499 |
*info = xstrdup(""); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
500 |
@@ -848,6 +764,17 @@ sshpam_query(void *ctx, char **name, cha |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
501 |
**prompts = NULL; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
502 |
plen = 0; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
503 |
*echo_on = xmalloc(sizeof(u_int)); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
504 |
+ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
505 |
+ /* in case PAM was already done in callback child */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
506 |
+ switch (ctxt->pam_done) { |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
507 |
+ case 1: |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
508 |
+ return (0); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
509 |
+ case 0: |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
510 |
+ break; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
511 |
+ default: |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
512 |
+ return (-1); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
513 |
+ } |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
514 |
+ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
515 |
while (ssh_msg_recv(ctxt->pam_psock, &buffer) == 0) { |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
516 |
type = buffer_get_char(&buffer); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
517 |
msg = buffer_get_string(&buffer, NULL); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
518 |
@@ -879,15 +806,6 @@ sshpam_query(void *ctx, char **name, cha |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
519 |
/* FALLTHROUGH */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
520 |
case PAM_AUTH_ERR: |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
521 |
debug3("PAM: %s", pam_strerror(sshpam_handle, type)); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
522 |
- if (**prompts != NULL && strlen(**prompts) != 0) { |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
523 |
- *info = **prompts; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
524 |
- **prompts = NULL; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
525 |
- *num = 0; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
526 |
- **echo_on = 0; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
527 |
- ctxt->pam_done = -1; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
528 |
- free(msg); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
529 |
- return 0; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
530 |
- } |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
531 |
/* FALLTHROUGH */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
532 |
case PAM_SUCCESS: |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
533 |
if (**prompts != NULL) { |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
534 |
@@ -898,25 +816,21 @@ sshpam_query(void *ctx, char **name, cha |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
535 |
free(**prompts); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
536 |
**prompts = NULL; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
537 |
} |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
538 |
- if (type == PAM_SUCCESS) { |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
539 |
- if (!sshpam_authctxt->valid || |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
540 |
- (sshpam_authctxt->pw->pw_uid == 0 && |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
541 |
- options.permit_root_login != PERMIT_YES)) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
542 |
- fatal("Internal error: PAM auth " |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
543 |
- "succeeded when it should have " |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
544 |
- "failed"); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
545 |
- import_environments(&buffer); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
546 |
- *num = 0; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
547 |
- **echo_on = 0; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
548 |
- ctxt->pam_done = 1; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
549 |
- free(msg); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
550 |
- return (0); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
551 |
+ /* send accumulated messages to parent */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
552 |
+ buffer_clear(&buffer); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
553 |
+ buffer_put_cstring(&buffer, buffer_ptr(&loginmsg)); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
554 |
+ if (!use_privsep) { |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
555 |
+ /* sync packet state with parrent */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
556 |
+ ssh = active_state; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
557 |
+ r = ssh_packet_get_state(ssh, &buffer); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
558 |
+ if (r != 0) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
559 |
+ fatal("%s: get_state failed: %s", |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
560 |
+ __func__, ssh_err(r)); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
561 |
} |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
562 |
- error("PAM: %s for %s%.100s from %.100s", msg, |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
563 |
- sshpam_authctxt->valid ? "" : "illegal user ", |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
564 |
- sshpam_authctxt->user, |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
565 |
- get_remote_name_or_ip(utmp_len, options.use_dns)); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
566 |
- /* FALLTHROUGH */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
567 |
+ ssh_msg_send(ctxt->pam_psock, type, &buffer); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
568 |
+ /* callback child ends here */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
569 |
+ close(ctxt->pam_psock); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
570 |
+ exit(0); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
571 |
default: |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
572 |
*num = 0; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
573 |
**echo_on = 0; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
574 |
@@ -970,7 +884,7 @@ sshpam_free_ctx(void *ctxtp) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
575 |
struct pam_ctxt *ctxt = ctxtp; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
576 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
577 |
debug3("PAM: %s entering", __func__); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
578 |
- sshpam_thread_cleanup(); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
579 |
+ sshpam_child_cleanup(); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
580 |
free(ctxt); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
581 |
/* |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
582 |
* We don't call sshpam_cleanup() here because we may need the PAM |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
583 |
diff -pur old/auth-pam.h new/auth-pam.h |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
584 |
--- old/auth-pam.h |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
585 |
+++ new/auth-pam.h |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
586 |
@@ -45,9 +45,10 @@ int do_pam_putenv(char *, char *); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
587 |
char ** fetch_pam_environment(void); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
588 |
char ** fetch_pam_child_environment(void); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
589 |
void free_pam_environment(char **); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
590 |
-void sshpam_thread_cleanup(void); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
591 |
+void sshpam_child_cleanup(void); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
592 |
void sshpam_cleanup(void); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
593 |
int sshpam_auth_passwd(Authctxt *, const char *); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
594 |
int is_pam_session_open(void); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
595 |
+int get_pam_done(void *); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
596 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
597 |
#endif /* USE_PAM */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
598 |
diff -pur old/monitor.c new/monitor.c |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
599 |
--- old/monitor.c |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
600 |
+++ new/monitor.c |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
601 |
@@ -1179,12 +1179,38 @@ mm_answer_pam_init_ctx(int sock, Buffer |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
602 |
sshpam_ctxt = (sshpam_device.init_ctx)(authctxt); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
603 |
sshpam_authok = NULL; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
604 |
buffer_clear(m); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
605 |
+ int pam_done = 0; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
606 |
if (sshpam_ctxt != NULL) { |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
607 |
monitor_permit(mon_dispatch, MONITOR_REQ_PAM_FREE_CTX, 1); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
608 |
buffer_put_int(m, 1); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
609 |
} else { |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
610 |
buffer_put_int(m, 0); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
611 |
} |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
612 |
+ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
613 |
+ /* pam conversation successfully finished in child process */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
614 |
+ if (sshpam_ctxt != NULL && |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
615 |
+ (pam_done = get_pam_done(sshpam_ctxt)) != 0) { |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
616 |
+ auth_method = "keyboard-interactive"; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
617 |
+ auth_submethod = "pam"; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
618 |
+ /* |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
619 |
+ * ANS_PAM_INIT_CTX already sent by callback child. |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
620 |
+ * Privsep child now expects ANS_PAM_QUERY. |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
621 |
+ */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
622 |
+ buffer_clear(m); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
623 |
+ buffer_put_int(m, 0); /* ret */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
624 |
+ buffer_put_cstring(m, ""); /* name */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
625 |
+ if (pam_done == 1) { /* info */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
626 |
+ buffer_put_cstring(m, ""); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
627 |
+ } else { |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
628 |
+ buffer_put_string(m, buffer_ptr(&loginmsg), |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
629 |
+ buffer_len(&loginmsg)); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
630 |
+ buffer_clear(&loginmsg); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
631 |
+ } |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
632 |
+ buffer_put_int(m, 0); /* num */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
633 |
+ mm_request_send(sock, MONITOR_ANS_PAM_QUERY, m); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
634 |
+ return (0); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
635 |
+ } |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
636 |
+ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
637 |
mm_request_send(sock, MONITOR_ANS_PAM_INIT_CTX, m); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
638 |
return (0); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
639 |
} |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
640 |
@@ -1938,7 +1964,8 @@ monitor_apply_keystate(struct monitor *p |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
641 |
int r; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
642 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
643 |
debug3("%s: packet_set_state", __func__); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
644 |
- if ((r = ssh_packet_set_state(ssh, child_state)) != 0) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
645 |
+ if ((r = ssh_packet_set_state(ssh, child_state)) != 0 || |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
646 |
+ (r = ssh_packet_set_postauth(ssh)) != 0) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
647 |
fatal("%s: packet_set_state: %s", __func__, ssh_err(r)); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
648 |
sshbuf_free(child_state); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
649 |
child_state = NULL; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
650 |
diff -pur old/packet.c new/packet.c |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
651 |
--- old/packet.c |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
652 |
+++ new/packet.c |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
653 |
@@ -2345,7 +2345,7 @@ ssh_packet_restore_state(struct ssh *ssh |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
654 |
} |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
655 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
656 |
/* Reset after_authentication and reset compression in post-auth privsep */ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
657 |
-static int |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
658 |
+int |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
659 |
ssh_packet_set_postauth(struct ssh *ssh) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
660 |
{ |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
661 |
struct sshcomp *comp; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
662 |
@@ -2682,8 +2682,7 @@ ssh_packet_set_state(struct ssh *ssh, st |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
663 |
cipher_set_keycontext(&state->send_context, keyout); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
664 |
cipher_set_keycontext(&state->receive_context, keyin); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
665 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
666 |
- if ((r = ssh_packet_set_compress_state(ssh, m)) != 0 || |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
667 |
- (r = ssh_packet_set_postauth(ssh)) != 0) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
668 |
+ if ((r = ssh_packet_set_compress_state(ssh, m)) != 0) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
669 |
return r; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
670 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
671 |
sshbuf_reset(state->input); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
672 |
diff -pur old/packet.h new/packet.h |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
673 |
--- old/packet.h |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
674 |
+++ new/packet.h |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
675 |
@@ -141,6 +141,7 @@ u_int ssh_packet_get_maxsize(struct ssh |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
676 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
677 |
int ssh_packet_get_state(struct ssh *, struct sshbuf *); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
678 |
int ssh_packet_set_state(struct ssh *, struct sshbuf *); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
679 |
+int ssh_packet_set_postauth(struct ssh *ssh); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
680 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
681 |
const char *ssh_remote_ipaddr(struct ssh *); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
682 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
683 |
diff -pur old/servconf.c new/servconf.c |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
684 |
--- old/servconf.c |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
685 |
+++ new/servconf.c |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
686 |
@@ -433,6 +433,18 @@ fill_default_server_options(ServerOption |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
687 |
options->compression = 0; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
688 |
} |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
689 |
#endif |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
690 |
+#ifdef USE_PAM |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
691 |
+ if (!use_privsep && options->compression == COMP_ZLIB && |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
692 |
+ options->use_pam && |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
693 |
+ (options->kbd_interactive_authentication || |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
694 |
+ options->challenge_response_authentication)) { |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
695 |
+ error("Compression algorithm 'zlib' is not supported for " |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
696 |
+ "PAM authentication when privilege separation is off"); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
697 |
+ error("Limmiting compression algorithms to " |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
698 |
+ "'none,[email protected]'"); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
699 |
+ options->compression = COMP_DELAYED; |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
700 |
+ } |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
701 |
+#endif |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
702 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
703 |
} |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
704 |
|
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
705 |
diff -pur old/session.c new/session.c |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
706 |
--- old/session.c |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
707 |
+++ new/session.c |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
708 |
@@ -2850,7 +2850,7 @@ do_cleanup(Authctxt *authctxt) |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
709 |
#ifdef USE_PAM |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
710 |
if (options.use_pam) { |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
711 |
sshpam_cleanup(); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
712 |
- sshpam_thread_cleanup(); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
713 |
+ sshpam_child_cleanup(); |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
714 |
} |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
715 |
#endif |
ece68a956e2f
21937600 pam_set_data doesn't work in OpenSSH PAM implementation
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
716 |