Skip to content

Commit dbb339f

Browse files
djmdjmdjmdjm
committed
upstream: prepare for multiple names for authmethods
allow authentication methods to have one additional name beyond their primary name. allow lookup by this synonym Use primary name for authentication decisions, e.g. for PermitRootLogin=publickey Pass actual invoked name to the authmethods, so they can tell whether they were requested via the their primary name or synonym. ok markus@ OpenBSD-Commit-ID: 9e613fcb44b8168823195602ed3d09ffd7994559
1 parent 39f00dc commit dbb339f

File tree

8 files changed

+42
-25
lines changed

8 files changed

+42
-25
lines changed

‎auth.h

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* $OpenBSD: auth.h,v 1.101 2020/12/22 00:12:22 djm Exp $ */
1+
/* $OpenBSD: auth.h,v 1.102 2021/12/19 22:12:07 djm Exp $ */
22

33
/*
44
* Copyright (c) 2000 Markus Friedl. All rights reserved.
@@ -104,7 +104,8 @@ struct Authctxt {
104104

105105
struct Authmethod {
106106
char *name;
107-
int (*userauth)(struct ssh *);
107+
char *synonym;
108+
int (*userauth)(struct ssh *, const char *);
108109
int *enabled;
109110
};
110111

‎auth2-gss.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* $OpenBSD: auth2-gss.c,v 1.32 2021/01/27 10:15:08 djm Exp $ */
1+
/* $OpenBSD: auth2-gss.c,v 1.33 2021/12/19 22:12:07 djm Exp $ */
22

33
/*
44
* Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
@@ -60,7 +60,7 @@ static int input_gssapi_errtok(int, u_int32_t, struct ssh *);
6060
* how to check local user kuserok and the like)
6161
*/
6262
static int
63-
userauth_gssapi(struct ssh *ssh)
63+
userauth_gssapi(struct ssh *ssh, const char *method)
6464
{
6565
Authctxt *authctxt = ssh->authctxt;
6666
gss_OID_desc goid = {0, NULL};
@@ -329,6 +329,7 @@ input_gssapi_mic(int type, u_int32_t plen, struct ssh *ssh)
329329

330330
Authmethod method_gssapi = {
331331
"gssapi-with-mic",
332+
NULL,
332333
userauth_gssapi,
333334
&options.gss_authentication
334335
};

‎auth2-hostbased.c

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* $OpenBSD: auth2-hostbased.c,v 1.47 2021/07/23 03:37:52 djm Exp $ */
1+
/* $OpenBSD: auth2-hostbased.c,v 1.48 2021/12/19 22:12:07 djm Exp $ */
22
/*
33
* Copyright (c) 2000 Markus Friedl. All rights reserved.
44
*
@@ -57,7 +57,7 @@
5757
extern ServerOptions options;
5858

5959
static int
60-
userauth_hostbased(struct ssh *ssh)
60+
userauth_hostbased(struct ssh *ssh, const char *method)
6161
{
6262
Authctxt *authctxt = ssh->authctxt;
6363
struct sshbuf *b;
@@ -132,7 +132,7 @@ userauth_hostbased(struct ssh *ssh)
132132
(r = sshbuf_put_u8(b, SSH2_MSG_USERAUTH_REQUEST)) != 0 ||
133133
(r = sshbuf_put_cstring(b, authctxt->user)) != 0 ||
134134
(r = sshbuf_put_cstring(b, authctxt->service)) != 0 ||
135-
(r = sshbuf_put_cstring(b, "hostbased")) != 0 ||
135+
(r = sshbuf_put_cstring(b, method)) != 0 ||
136136
(r = sshbuf_put_string(b, pkalg, alen)) != 0 ||
137137
(r = sshbuf_put_string(b, pkblob, blen)) != 0 ||
138138
(r = sshbuf_put_cstring(b, chost)) != 0 ||
@@ -255,6 +255,7 @@ hostbased_key_allowed(struct ssh *ssh, struct passwd *pw,
255255

256256
Authmethod method_hostbased = {
257257
"hostbased",
258+
NULL,
258259
userauth_hostbased,
259260
&options.hostbased_authentication
260261
};

‎auth2-kbdint.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* $OpenBSD: auth2-kbdint.c,v 1.13 2021/07/02 05:11:20 dtucker Exp $ */
1+
/* $OpenBSD: auth2-kbdint.c,v 1.14 2021/12/19 22:12:07 djm Exp $ */
22
/*
33
* Copyright (c) 2000 Markus Friedl. All rights reserved.
44
*
@@ -44,7 +44,7 @@
4444
extern ServerOptions options;
4545

4646
static int
47-
userauth_kbdint(struct ssh *ssh)
47+
userauth_kbdint(struct ssh *ssh, const char *method)
4848
{
4949
int r, authenticated = 0;
5050
char *lang, *devs;
@@ -66,6 +66,7 @@ userauth_kbdint(struct ssh *ssh)
6666

6767
Authmethod method_kbdint = {
6868
"keyboard-interactive",
69+
NULL,
6970
userauth_kbdint,
7071
&options.kbd_interactive_authentication
7172
};

‎auth2-none.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* $OpenBSD: auth2-none.c,v 1.23 2020/10/18 11:32:01 djm Exp $ */
1+
/* $OpenBSD: auth2-none.c,v 1.24 2021/12/19 22:12:07 djm Exp $ */
22
/*
33
* Copyright (c) 2000 Markus Friedl. All rights reserved.
44
*
@@ -59,7 +59,7 @@ extern ServerOptions options;
5959
static int none_enabled = 1;
6060

6161
static int
62-
userauth_none(struct ssh *ssh)
62+
userauth_none(struct ssh *ssh, const char *method)
6363
{
6464
int r;
6565

@@ -73,6 +73,7 @@ userauth_none(struct ssh *ssh)
7373

7474
Authmethod method_none = {
7575
"none",
76+
NULL,
7677
userauth_none,
7778
&none_enabled
7879
};

‎auth2-passwd.c

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* $OpenBSD: auth2-passwd.c,v 1.19 2020/10/18 11:32:01 djm Exp $ */
1+
/* $OpenBSD: auth2-passwd.c,v 1.20 2021/12/19 22:12:07 djm Exp $ */
22
/*
33
* Copyright (c) 2000 Markus Friedl. All rights reserved.
44
*
@@ -49,7 +49,7 @@
4949
extern ServerOptions options;
5050

5151
static int
52-
userauth_passwd(struct ssh *ssh)
52+
userauth_passwd(struct ssh *ssh, const char *method)
5353
{
5454
char *password;
5555
int authenticated = 0, r;
@@ -72,6 +72,7 @@ userauth_passwd(struct ssh *ssh)
7272

7373
Authmethod method_passwd = {
7474
"password",
75+
NULL,
7576
userauth_passwd,
7677
&options.password_authentication
7778
};

‎auth2-pubkey.c

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* $OpenBSD: auth2-pubkey.c,v 1.110 2021/09/29 01:33:32 djm Exp $ */
1+
/* $OpenBSD: auth2-pubkey.c,v 1.111 2021/12/19 22:12:07 djm Exp $ */
22
/*
33
* Copyright (c) 2000 Markus Friedl. All rights reserved.
44
*
@@ -86,7 +86,7 @@ format_key(const struct sshkey *key)
8686
}
8787

8888
static int
89-
userauth_pubkey(struct ssh *ssh)
89+
userauth_pubkey(struct ssh *ssh, const char *method)
9090
{
9191
Authctxt *authctxt = ssh->authctxt;
9292
struct passwd *pw = authctxt->pw;
@@ -192,7 +192,7 @@ userauth_pubkey(struct ssh *ssh)
192192
if ((r = sshbuf_put_u8(b, SSH2_MSG_USERAUTH_REQUEST)) != 0 ||
193193
(r = sshbuf_put_cstring(b, userstyle)) != 0 ||
194194
(r = sshbuf_put_cstring(b, authctxt->service)) != 0 ||
195-
(r = sshbuf_put_cstring(b, "publickey")) != 0 ||
195+
(r = sshbuf_put_cstring(b, method)) != 0 ||
196196
(r = sshbuf_put_u8(b, have_sig)) != 0 ||
197197
(r = sshbuf_put_cstring(b, pkalg)) != 0 ||
198198
(r = sshbuf_put_string(b, pkblob, blen)) != 0)
@@ -1067,6 +1067,7 @@ user_key_allowed(struct ssh *ssh, struct passwd *pw, struct sshkey *key,
10671067

10681068
Authmethod method_pubkey = {
10691069
"publickey",
1070+
NULL,
10701071
userauth_pubkey,
10711072
&options.pubkey_authentication
10721073
};

‎auth2.c

Lines changed: 19 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* $OpenBSD: auth2.c,v 1.161 2021/04/03 06:18:40 djm Exp $ */
1+
/* $OpenBSD: auth2.c,v 1.162 2021/12/19 22:12:07 djm Exp $ */
22
/*
33
* Copyright (c) 2000 Markus Friedl. All rights reserved.
44
*
@@ -331,7 +331,7 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh)
331331
m = authmethod_lookup(authctxt, method);
332332
if (m != NULL && authctxt->failures < options.max_authtries) {
333333
debug2("input_userauth_request: try method %s", method);
334-
authenticated = m->userauth(ssh);
334+
authenticated = m->userauth(ssh, method);
335335
}
336336
if (!authctxt->authenticated)
337337
ensure_minimum_time_since(tstart,
@@ -346,18 +346,26 @@ input_userauth_request(int type, u_int32_t seq, struct ssh *ssh)
346346
}
347347

348348
void
349-
userauth_finish(struct ssh *ssh, int authenticated, const char *method,
349+
userauth_finish(struct ssh *ssh, int authenticated, const char *packet_method,
350350
const char *submethod)
351351
{
352352
Authctxt *authctxt = ssh->authctxt;
353+
Authmethod *m = NULL;
354+
const char *method = packet_method;
353355
char *methods;
354356
int r, partial = 0;
355357

356-
if (!authctxt->valid && authenticated)
357-
fatal("INTERNAL ERROR: authenticated invalid user %s",
358-
authctxt->user);
359-
if (authenticated && authctxt->postponed)
360-
fatal("INTERNAL ERROR: authenticated and postponed");
358+
if (authenticated) {
359+
if (!authctxt->valid) {
360+
fatal("INTERNAL ERROR: authenticated invalid user %s",
361+
authctxt->user);
362+
}
363+
if (authctxt->postponed)
364+
fatal("INTERNAL ERROR: authenticated and postponed");
365+
if ((m = authmethod_lookup(authctxt, method)) == NULL)
366+
fatal("INTERNAL ERROR: bad method %s", method);
367+
method = m->name; /* prefer primary name to possible synonym */
368+
}
361369

362370
/* Special handling for root */
363371
if (authenticated && authctxt->pw->pw_uid == 0 &&
@@ -504,7 +512,9 @@ authmethod_lookup(Authctxt *authctxt, const char *name)
504512
for (i = 0; authmethods[i] != NULL; i++)
505513
if (authmethods[i]->enabled != NULL &&
506514
*(authmethods[i]->enabled) != 0 &&
507-
strcmp(name, authmethods[i]->name) == 0 &&
515+
(strcmp(name, authmethods[i]->name) == 0 ||
516+
(authmethods[i]->synonym != NULL &&
517+
strcmp(name, authmethods[i]->synonym) == 0)) &&
508518
auth2_method_allowed(authctxt,
509519
authmethods[i]->name, NULL))
510520
return authmethods[i];

0 commit comments

Comments
 (0)