- (djm) Much KNF on PAM code

- (djm) Revise auth-pam.c conversation function to be a little more readable.
 - (djm) Revise kbd-int PAM conversation function to fold all text messages
   to before first prompt. Fixes hangs if last pam_message did not require
   a reply.
 - (djm) Fix password changing when using PAM kbd-int authentication
This commit is contained in:
Damien Miller 2001-02-07 12:58:33 +11:00
parent 582d3983d2
commit 63dc3e90e5
4 changed files with 170 additions and 166 deletions

View File

@ -1,6 +1,12 @@
20010107 20010107
- (bal) Save the whole path to AR in configure. Some Solaris 2.7 installs - (bal) Save the whole path to AR in configure. Some Solaris 2.7 installs
seem lose track of it while in openbsd-compat/ (two confirmed reports) seem lose track of it while in openbsd-compat/ (two confirmed reports)
- (djm) Much KNF on PAM code
- (djm) Revise auth-pam.c conversation function to be a little more readable.
- (djm) Revise kbd-int PAM conversation function to fold all text messages
to before first prompt. Fixes hangs if last pam_message did not require
a reply.
- (djm) Fix password changing when using PAM kbd-int authentication
20010105 20010105
- (bal) Disable groupaccess by setting NGROUPS_MAX to 0 for platforms - (bal) Disable groupaccess by setting NGROUPS_MAX to 0 for platforms

View File

@ -28,31 +28,29 @@
#include "ssh.h" #include "ssh.h"
#include "xmalloc.h" #include "xmalloc.h"
#include "log.h" #include "log.h"
#include "auth-pam.h"
#include "servconf.h" #include "servconf.h"
#include "canohost.h" #include "canohost.h"
#include "readpass.h" #include "readpass.h"
RCSID("$Id: auth-pam.c,v 1.24 2001/02/05 12:42:17 stevesk Exp $"); RCSID("$Id: auth-pam.c,v 1.25 2001/02/07 01:58:34 djm Exp $");
#define NEW_AUTHTOK_MSG \ #define NEW_AUTHTOK_MSG \
"Warning: Your password has expired, please change it now" "Warning: Your password has expired, please change it now"
/* Callbacks */ static int do_pam_conversation(int num_msg, const struct pam_message **msg,
static int pamconv(int num_msg, const struct pam_message **msg,
struct pam_response **resp, void *appdata_ptr); struct pam_response **resp, void *appdata_ptr);
void pam_cleanup_proc(void *context);
void pam_msg_cat(const char *msg);
/* module-local variables */ /* module-local variables */
static struct pam_conv conv = { static struct pam_conv conv = {
pamconv, do_pam_conversation,
NULL NULL
}; };
static char *pam_msg = NULL;
static pam_handle_t *pamh = NULL; static pam_handle_t *pamh = NULL;
static const char *pampasswd = NULL; static const char *pampasswd = NULL;
static char *pam_msg = NULL;
/* states for pamconv() */ /* states for do_pam_conversation() */
enum { INITIAL_LOGIN, OTHER } pamstate = INITIAL_LOGIN; enum { INITIAL_LOGIN, OTHER } pamstate = INITIAL_LOGIN;
/* remember whether pam_acct_mgmt() returned PAM_NEWAUTHTOK_REQD */ /* remember whether pam_acct_mgmt() returned PAM_NEWAUTHTOK_REQD */
static int password_change_required = 0; static int password_change_required = 0;
@ -80,14 +78,14 @@ int do_pam_authenticate(int flags)
* *
* INITIAL_LOGIN mode simply feeds the password from the client into * INITIAL_LOGIN mode simply feeds the password from the client into
* PAM in response to PAM_PROMPT_ECHO_OFF, and collects output * PAM in response to PAM_PROMPT_ECHO_OFF, and collects output
* messages with pam_msg_cat(). This is used during initial * messages with into pam_msg. This is used during initial
* authentication to bypass the normal PAM password prompt. * authentication to bypass the normal PAM password prompt.
* *
* OTHER mode handles PAM_PROMPT_ECHO_OFF with read_passphrase(prompt, 1) * OTHER mode handles PAM_PROMPT_ECHO_OFF with read_passphrase(prompt, 1)
* and outputs messages to stderr. This mode is used if pam_chauthtok() * and outputs messages to stderr. This mode is used if pam_chauthtok()
* is called to update expired passwords. * is called to update expired passwords.
*/ */
static int pamconv(int num_msg, const struct pam_message **msg, static int do_pam_conversation(int num_msg, const struct pam_message **msg,
struct pam_response **resp, void *appdata_ptr) struct pam_response **resp, void *appdata_ptr)
{ {
struct pam_response *reply; struct pam_response *reply;
@ -100,40 +98,28 @@ static int pamconv(int num_msg, const struct pam_message **msg,
return PAM_CONV_ERR; return PAM_CONV_ERR;
for (count = 0; count < num_msg; count++) { for (count = 0; count < num_msg; count++) {
if (pamstate == INITIAL_LOGIN) {
/*
* We can't use stdio yet, queue messages for
* printing later
*/
switch(PAM_MSG_MEMBER(msg, count, msg_style)) { switch(PAM_MSG_MEMBER(msg, count, msg_style)) {
case PAM_PROMPT_ECHO_ON: case PAM_PROMPT_ECHO_ON:
if (pamstate == INITIAL_LOGIN) {
free(reply); free(reply);
return PAM_CONV_ERR; return PAM_CONV_ERR;
} else {
fputs(PAM_MSG_MEMBER(msg, count, msg), stderr);
fgets(buf, sizeof(buf), stdin);
reply[count].resp = xstrdup(buf);
reply[count].resp_retcode = PAM_SUCCESS;
break;
}
case PAM_PROMPT_ECHO_OFF: case PAM_PROMPT_ECHO_OFF:
if (pamstate == INITIAL_LOGIN) {
if (pampasswd == NULL) { if (pampasswd == NULL) {
free(reply); free(reply);
return PAM_CONV_ERR; return PAM_CONV_ERR;
} }
reply[count].resp = xstrdup(pampasswd); reply[count].resp = xstrdup(pampasswd);
} else {
reply[count].resp =
xstrdup(read_passphrase(PAM_MSG_MEMBER(msg, count, msg), 1));
}
reply[count].resp_retcode = PAM_SUCCESS; reply[count].resp_retcode = PAM_SUCCESS;
break; break;
case PAM_ERROR_MSG: case PAM_ERROR_MSG:
case PAM_TEXT_INFO: case PAM_TEXT_INFO:
if ((*msg)[count].msg != NULL) { if ((*msg)[count].msg != NULL) {
if (pamstate == INITIAL_LOGIN) message_cat(&pam_msg,
pam_msg_cat(PAM_MSG_MEMBER(msg, count, msg)); PAM_MSG_MEMBER(msg, count, msg));
else {
fputs(PAM_MSG_MEMBER(msg, count, msg), stderr);
fputs("\n", stderr);
}
} }
reply[count].resp = xstrdup(""); reply[count].resp = xstrdup("");
reply[count].resp_retcode = PAM_SUCCESS; reply[count].resp_retcode = PAM_SUCCESS;
@ -142,6 +128,36 @@ static int pamconv(int num_msg, const struct pam_message **msg,
free(reply); free(reply);
return PAM_CONV_ERR; return PAM_CONV_ERR;
} }
} else {
/*
* stdio is connected, so interact directly
*/
switch(PAM_MSG_MEMBER(msg, count, msg_style)) {
case PAM_PROMPT_ECHO_ON:
fputs(PAM_MSG_MEMBER(msg, count, msg), stderr);
fgets(buf, sizeof(buf), stdin);
reply[count].resp = xstrdup(buf);
reply[count].resp_retcode = PAM_SUCCESS;
break;
case PAM_PROMPT_ECHO_OFF:
reply[count].resp = xstrdup(
read_passphrase(PAM_MSG_MEMBER(msg, count,
msg), 1));
reply[count].resp_retcode = PAM_SUCCESS;
break;
case PAM_ERROR_MSG:
case PAM_TEXT_INFO:
if ((*msg)[count].msg != NULL)
fprintf(stderr, "%s\n",
PAM_MSG_MEMBER(msg, count, msg));
reply[count].resp = xstrdup("");
reply[count].resp_retcode = PAM_SUCCESS;
break;
default:
free(reply);
return PAM_CONV_ERR;
}
}
} }
*resp = reply; *resp = reply;
@ -154,26 +170,22 @@ void pam_cleanup_proc(void *context)
{ {
int pam_retval; int pam_retval;
if (pamh != NULL) if (pamh) {
{
pam_retval = pam_close_session(pamh, 0); pam_retval = pam_close_session(pamh, 0);
if (pam_retval != PAM_SUCCESS) { if (pam_retval != PAM_SUCCESS)
log("Cannot close PAM session[%d]: %.200s", log("Cannot close PAM session[%d]: %.200s",
pam_retval, PAM_STRERROR(pamh, pam_retval)); pam_retval, PAM_STRERROR(pamh, pam_retval));
}
pam_retval = pam_setcred(pamh, PAM_DELETE_CRED); pam_retval = pam_setcred(pamh, PAM_DELETE_CRED);
if (pam_retval != PAM_SUCCESS) { if (pam_retval != PAM_SUCCESS)
debug("Cannot delete credentials[%d]: %.200s", debug("Cannot delete credentials[%d]: %.200s",
pam_retval, PAM_STRERROR(pamh, pam_retval)); pam_retval, PAM_STRERROR(pamh, pam_retval));
}
pam_retval = pam_end(pamh, pam_retval); pam_retval = pam_end(pamh, pam_retval);
if (pam_retval != PAM_SUCCESS) { if (pam_retval != PAM_SUCCESS)
log("Cannot release PAM authentication[%d]: %.200s", log("Cannot release PAM authentication[%d]: %.200s",
pam_retval, PAM_STRERROR(pamh, pam_retval)); pam_retval, PAM_STRERROR(pamh, pam_retval));
} }
}
} }
/* Attempt password authentation using PAM */ /* Attempt password authentation using PAM */
@ -197,12 +209,13 @@ int auth_pam_password(struct passwd *pw, const char *password)
pamstate = INITIAL_LOGIN; pamstate = INITIAL_LOGIN;
pam_retval = do_pam_authenticate(0); pam_retval = do_pam_authenticate(0);
if (pam_retval == PAM_SUCCESS) { if (pam_retval == PAM_SUCCESS) {
debug("PAM Password authentication accepted for user \"%.100s\"", debug("PAM Password authentication accepted for "
pw->pw_name); "user \"%.100s\"", pw->pw_name);
return 1; return 1;
} else { } else {
debug("PAM Password authentication for \"%.100s\" failed[%d]: %s", debug("PAM Password authentication for \"%.100s\" "
pw->pw_name, pam_retval, PAM_STRERROR(pamh, pam_retval)); "failed[%d]: %s", pw->pw_name, pam_retval,
PAM_STRERROR(pamh, pam_retval));
return 0; return 0;
} }
} }
@ -213,22 +226,21 @@ int do_pam_account(char *username, char *remote_user)
int pam_retval; int pam_retval;
extern ServerOptions options; extern ServerOptions options;
pam_set_conv(&conv);
debug("PAM setting rhost to \"%.200s\"", debug("PAM setting rhost to \"%.200s\"",
get_canonical_hostname(options.reverse_mapping_check)); get_canonical_hostname(options.reverse_mapping_check));
pam_retval = pam_set_item(pamh, PAM_RHOST, pam_retval = pam_set_item(pamh, PAM_RHOST,
get_canonical_hostname(options.reverse_mapping_check)); get_canonical_hostname(options.reverse_mapping_check));
if (pam_retval != PAM_SUCCESS) { if (pam_retval != PAM_SUCCESS)
fatal("PAM set rhost failed[%d]: %.200s", fatal("PAM set rhost failed[%d]: %.200s", pam_retval,
pam_retval, PAM_STRERROR(pamh, pam_retval)); PAM_STRERROR(pamh, pam_retval));
} if (remote_user) {
if (remote_user != NULL) {
debug("PAM setting ruser to \"%.200s\"", remote_user); debug("PAM setting ruser to \"%.200s\"", remote_user);
pam_retval = pam_set_item(pamh, PAM_RUSER, remote_user); pam_retval = pam_set_item(pamh, PAM_RUSER, remote_user);
if (pam_retval != PAM_SUCCESS) { if (pam_retval != PAM_SUCCESS)
fatal("PAM set ruser failed[%d]: %.200s", fatal("PAM set ruser failed[%d]: %.200s", pam_retval,
pam_retval, PAM_STRERROR(pamh, pam_retval)); PAM_STRERROR(pamh, pam_retval));
}
} }
pam_retval = pam_acct_mgmt(pamh, 0); pam_retval = pam_acct_mgmt(pamh, 0);
@ -237,13 +249,14 @@ int do_pam_account(char *username, char *remote_user)
/* This is what we want */ /* This is what we want */
break; break;
case PAM_NEW_AUTHTOK_REQD: case PAM_NEW_AUTHTOK_REQD:
pam_msg_cat(NEW_AUTHTOK_MSG); message_cat(&pam_msg, NEW_AUTHTOK_MSG);
/* flag that password change is necessary */ /* flag that password change is necessary */
password_change_required = 1; password_change_required = 1;
break; break;
default: default:
log("PAM rejected by account configuration[%d]: %.200s", log("PAM rejected by account configuration[%d]: "
pam_retval, PAM_STRERROR(pamh, pam_retval)); "%.200s", pam_retval, PAM_STRERROR(pamh,
pam_retval));
return(0); return(0);
} }
@ -258,17 +271,15 @@ void do_pam_session(char *username, const char *ttyname)
if (ttyname != NULL) { if (ttyname != NULL) {
debug("PAM setting tty to \"%.200s\"", ttyname); debug("PAM setting tty to \"%.200s\"", ttyname);
pam_retval = pam_set_item(pamh, PAM_TTY, ttyname); pam_retval = pam_set_item(pamh, PAM_TTY, ttyname);
if (pam_retval != PAM_SUCCESS) { if (pam_retval != PAM_SUCCESS)
fatal("PAM set tty failed[%d]: %.200s", fatal("PAM set tty failed[%d]: %.200s",
pam_retval, PAM_STRERROR(pamh, pam_retval)); pam_retval, PAM_STRERROR(pamh, pam_retval));
} }
}
pam_retval = pam_open_session(pamh, 0); pam_retval = pam_open_session(pamh, 0);
if (pam_retval != PAM_SUCCESS) { if (pam_retval != PAM_SUCCESS)
fatal("PAM session setup failed[%d]: %.200s", fatal("PAM session setup failed[%d]: %.200s",
pam_retval, PAM_STRERROR(pamh, pam_retval)); pam_retval, PAM_STRERROR(pamh, pam_retval));
}
} }
/* Set PAM credentials */ /* Set PAM credentials */
@ -279,14 +290,13 @@ void do_pam_setcred(void)
debug("PAM establishing creds"); debug("PAM establishing creds");
pam_retval = pam_setcred(pamh, PAM_ESTABLISH_CRED); pam_retval = pam_setcred(pamh, PAM_ESTABLISH_CRED);
if (pam_retval != PAM_SUCCESS) { if (pam_retval != PAM_SUCCESS) {
if(was_authenticated) { if (was_authenticated)
fatal("PAM setcred failed[%d]: %.200s", fatal("PAM setcred failed[%d]: %.200s",
pam_retval, PAM_STRERROR(pamh, pam_retval)); pam_retval, PAM_STRERROR(pamh, pam_retval));
} else { else
debug("PAM setcred failed[%d]: %.200s", debug("PAM setcred failed[%d]: %.200s",
pam_retval, PAM_STRERROR(pamh, pam_retval)); pam_retval, PAM_STRERROR(pamh, pam_retval));
} }
}
} }
/* accessor function for file scope static variable */ /* accessor function for file scope static variable */
@ -307,15 +317,13 @@ void do_pam_chauthtok(void)
if (password_change_required) { if (password_change_required) {
pamstate = OTHER; pamstate = OTHER;
/* /* XXX: should we really loop forever? */
* XXX: should we really loop forever?
*/
do { do {
pam_retval = pam_chauthtok(pamh, PAM_CHANGE_EXPIRED_AUTHTOK); pam_retval = pam_chauthtok(pamh,
if (pam_retval != PAM_SUCCESS) { PAM_CHANGE_EXPIRED_AUTHTOK);
if (pam_retval != PAM_SUCCESS)
log("PAM pam_chauthtok failed[%d]: %.200s", log("PAM pam_chauthtok failed[%d]: %.200s",
pam_retval, PAM_STRERROR(pamh, pam_retval)); pam_retval, PAM_STRERROR(pamh, pam_retval));
}
} while (pam_retval != PAM_SUCCESS); } while (pam_retval != PAM_SUCCESS);
} }
} }
@ -336,11 +344,9 @@ void start_pam(const char *user)
pam_retval = pam_start(SSHD_PAM_SERVICE, user, &conv, &pamh); pam_retval = pam_start(SSHD_PAM_SERVICE, user, &conv, &pamh);
if (pam_retval != PAM_SUCCESS) { if (pam_retval != PAM_SUCCESS)
fatal("PAM initialisation failed[%d]: %.200s", fatal("PAM initialisation failed[%d]: %.200s",
pam_retval, PAM_STRERROR(pamh, pam_retval)); pam_retval, PAM_STRERROR(pamh, pam_retval));
}
#ifdef PAM_TTY_KLUDGE #ifdef PAM_TTY_KLUDGE
/* /*
* Some PAM modules (e.g. pam_time) require a TTY to operate, * Some PAM modules (e.g. pam_time) require a TTY to operate,
@ -350,10 +356,9 @@ void start_pam(const char *user)
* Kludge: Set a fake PAM_TTY * Kludge: Set a fake PAM_TTY
*/ */
pam_retval = pam_set_item(pamh, PAM_TTY, "ssh"); pam_retval = pam_set_item(pamh, PAM_TTY, "ssh");
if (pam_retval != PAM_SUCCESS) { if (pam_retval != PAM_SUCCESS)
fatal("PAM set tty failed[%d]: %.200s", fatal("PAM set tty failed[%d]: %.200s",
pam_retval, PAM_STRERROR(pamh, pam_retval)); pam_retval, PAM_STRERROR(pamh, pam_retval));
}
#endif /* PAM_TTY_KLUDGE */ #endif /* PAM_TTY_KLUDGE */
fatal_add_cleanup(&pam_cleanup_proc, NULL); fatal_add_cleanup(&pam_cleanup_proc, NULL);
@ -377,26 +382,25 @@ void print_pam_messages(void)
fputs(pam_msg, stderr); fputs(pam_msg, stderr);
} }
/* Append a message to the PAM message buffer */ /* Append a message to buffer */
void pam_msg_cat(const char *msg) void message_cat(char **p, const char *a)
{ {
char *p; char *cp;
size_t new_msg_len; size_t new_len;
size_t pam_msg_len;
new_msg_len = strlen(msg); new_len = strlen(a);
if (pam_msg) { if (*p) {
pam_msg_len = strlen(pam_msg); size_t len = strlen(*p);
pam_msg = xrealloc(pam_msg, new_msg_len + pam_msg_len + 2);
p = pam_msg + pam_msg_len;
} else {
pam_msg = p = xmalloc(new_msg_len + 2);
}
memcpy(p, msg, new_msg_len); *p = xrealloc(*p, new_len + len + 2);
p[new_msg_len] = '\n'; cp = *p + len;
p[new_msg_len + 1] = '\0'; } else
*p = cp = xmalloc(new_len + 2);
memcpy(cp, a, new_len);
cp[new_len] = '\n';
cp[new_len + 1] = '\0';
} }
#endif /* USE_PAM */ #endif /* USE_PAM */

View File

@ -15,5 +15,6 @@ void print_pam_messages(void);
int pam_password_change_required(void); int pam_password_change_required(void);
void do_pam_chauthtok(void); void do_pam_chauthtok(void);
void pam_set_conv(struct pam_conv *); void pam_set_conv(struct pam_conv *);
void message_cat(char **p, const char *a);
#endif /* USE_PAM */ #endif /* USE_PAM */

View File

@ -1,5 +1,5 @@
#include "includes.h" #include "includes.h"
RCSID("$Id: auth2-pam.c,v 1.7 2001/01/30 23:50:49 djm Exp $"); RCSID("$Id: auth2-pam.c,v 1.8 2001/02/07 01:58:33 djm Exp $");
#ifdef USE_PAM #ifdef USE_PAM
#include <security/pam_appl.h> #include <security/pam_appl.h>
@ -7,28 +7,28 @@ RCSID("$Id: auth2-pam.c,v 1.7 2001/01/30 23:50:49 djm Exp $");
#include "ssh.h" #include "ssh.h"
#include "ssh2.h" #include "ssh2.h"
#include "auth.h" #include "auth.h"
#include "auth-pam.h"
#include "packet.h" #include "packet.h"
#include "xmalloc.h" #include "xmalloc.h"
#include "dispatch.h" #include "dispatch.h"
#include "log.h" #include "log.h"
static int do_pam_conversation_kbd_int(int num_msg,
const struct pam_message **msg, struct pam_response **resp,
void *appdata_ptr);
void input_userauth_info_response_pam(int type, int plen, void *ctxt);
struct { struct {
int finished, num_received, num_expected; int finished, num_received, num_expected;
int *prompts; int *prompts;
struct pam_response *responses; struct pam_response *responses;
} context_pam2 = {0, 0, 0, NULL}; } context_pam2 = {0, 0, 0, NULL};
static int do_conversation2(int num_msg, const struct pam_message **msg, static struct pam_conv conv2 = {
struct pam_response **resp, void *appdata_ptr); do_pam_conversation_kbd_int,
static struct pam_conv
conv2 = {
do_conversation2,
NULL, NULL,
}; };
void input_userauth_info_response_pam(int type, int plen, void *ctxt);
int int
auth2_pam(Authctxt *authctxt) auth2_pam(Authctxt *authctxt)
{ {
@ -49,11 +49,11 @@ auth2_pam(Authctxt *authctxt)
} }
static int static int
do_conversation2(int num_msg, const struct pam_message **msg, do_pam_conversation_kbd_int(int num_msg, const struct pam_message **msg,
struct pam_response **resp, void *appdata_ptr) struct pam_response **resp, void *appdata_ptr)
{ {
int echo = 0, i = 0, j = 0, done = 0; int i, j, done;
char *tmp = NULL, *text = NULL; char *text;
context_pam2.finished = 0; context_pam2.finished = 0;
context_pam2.num_received = 0; context_pam2.num_received = 0;
@ -62,53 +62,47 @@ do_conversation2(int num_msg, const struct pam_message **msg,
context_pam2.responses = xmalloc(sizeof(struct pam_response) * num_msg); context_pam2.responses = xmalloc(sizeof(struct pam_response) * num_msg);
memset(context_pam2.responses, 0, sizeof(struct pam_response) * num_msg); memset(context_pam2.responses, 0, sizeof(struct pam_response) * num_msg);
text = NULL;
for (i = 0, context_pam2.num_expected = 0; i < num_msg; i++) {
int style = PAM_MSG_MEMBER(msg, i, msg_style);
switch (style) {
case PAM_PROMPT_ECHO_ON:
case PAM_PROMPT_ECHO_OFF:
context_pam2.num_expected++;
break;
case PAM_TEXT_INFO:
case PAM_ERROR_MSG:
default:
/* Capture all these messages to be sent at once */
message_cat(&text, PAM_MSG_MEMBER(msg, i, msg));
break;
}
}
if (context_pam2.num_expected == 0)
return PAM_SUCCESS;
packet_start(SSH2_MSG_USERAUTH_INFO_REQUEST); packet_start(SSH2_MSG_USERAUTH_INFO_REQUEST);
packet_put_cstring(""); /* Name */ packet_put_cstring(""); /* Name */
packet_put_cstring(""); /* Instructions */ packet_put_cstring(""); /* Instructions */
packet_put_cstring(""); /* Language */ packet_put_cstring(""); /* Language */
packet_put_int(context_pam2.num_expected);
for (i = 0, j = 0; i < num_msg; i++) { for (i = 0, j = 0; i < num_msg; i++) {
if((PAM_MSG_MEMBER(msg, i, msg_style) == PAM_PROMPT_ECHO_ON) || int style = PAM_MSG_MEMBER(msg, i, msg_style);
(PAM_MSG_MEMBER(msg, i, msg_style) == PAM_PROMPT_ECHO_OFF) ||
(i == num_msg - 1)) { /* Skip messages which don't need a reply */
j++; if (style != PAM_PROMPT_ECHO_ON && style != PAM_PROMPT_ECHO_OFF)
} continue;
}
packet_put_int(j); /* Number of prompts. */
context_pam2.num_expected = j;
for (i = 0, j = 0; i < num_msg; i++) {
switch(PAM_MSG_MEMBER(msg, i, msg_style)) {
case PAM_PROMPT_ECHO_ON:
echo = 1;
break;
case PAM_PROMPT_ECHO_OFF:
echo = 0;
break;
default:
echo = 0;
break;
}
if(text) {
tmp = xmalloc(strlen(text) + strlen(PAM_MSG_MEMBER(msg, i, msg)) + 2);
strcpy(tmp, text);
strcat(tmp, "\n");
strcat(tmp, PAM_MSG_MEMBER(msg, i, msg));
xfree(text);
text = tmp;
tmp = NULL;
} else {
text = xstrdup(PAM_MSG_MEMBER(msg, i, msg));
}
if((PAM_MSG_MEMBER(msg, i, msg_style) == PAM_PROMPT_ECHO_ON) ||
(PAM_MSG_MEMBER(msg, i, msg_style) == PAM_PROMPT_ECHO_OFF) ||
(i == num_msg - 1)) {
debug("sending prompt ssh-%d(pam-%d) = \"%s\"",
j, i, text);
context_pam2.prompts[j++] = i; context_pam2.prompts[j++] = i;
if (text) {
message_cat(&text, PAM_MSG_MEMBER(msg, i, msg));
packet_put_cstring(text); packet_put_cstring(text);
packet_put_char(echo);
xfree(text);
text = NULL; text = NULL;
} } else
packet_put_cstring(PAM_MSG_MEMBER(msg, i, msg));
packet_put_char(style == PAM_PROMPT_ECHO_ON);
} }
packet_send(); packet_send();
packet_write_wait(); packet_write_wait();
@ -120,17 +114,15 @@ do_conversation2(int num_msg, const struct pam_message **msg,
while(context_pam2.finished == 0) { while(context_pam2.finished == 0) {
done = 1; done = 1;
dispatch_run(DISPATCH_BLOCK, &done, appdata_ptr); dispatch_run(DISPATCH_BLOCK, &done, appdata_ptr);
if(context_pam2.finished == 0) { if(context_pam2.finished == 0)
debug("extra packet during conversation"); debug("extra packet during conversation");
} }
}
if(context_pam2.num_received == context_pam2.num_expected) { if(context_pam2.num_received == context_pam2.num_expected) {
*resp = context_pam2.responses; *resp = context_pam2.responses;
return PAM_SUCCESS; return PAM_SUCCESS;
} else { } else
return PAM_CONV_ERR; return PAM_CONV_ERR;
}
} }
void void
@ -151,6 +143,7 @@ input_userauth_info_response_pam(int type, int plen, void *ctxt)
for (i = 0; i < nresp; i++) { for (i = 0; i < nresp; i++) {
int j = context_pam2.prompts[i]; int j = context_pam2.prompts[i];
resp = packet_get_string(&rlen); resp = packet_get_string(&rlen);
context_pam2.responses[j].resp_retcode = PAM_SUCCESS; context_pam2.responses[j].resp_retcode = PAM_SUCCESS;
context_pam2.responses[j].resp = xstrdup(resp); context_pam2.responses[j].resp = xstrdup(resp);