nhyatt/putty-source
1
0
Fork 0
mirror of https://git.tartarus.org/simon/putty.git synced 2025-05-10 06:02:10 -05:00
Code Issues Projects Releases Wiki Activity

Merge r9226 and r9232 (userauth messaging cleanup, fixing spurious

Browse Source 
"Access denied" from failed GSSAPI).

[originally from svn r9233]
[r9226 == 0b79fe0bcbfd4113e8ed413fe0c8e0bbd34ea5b2]
[r9232 == 363f57396f89c69f50412b7b3a3bdce37454a1d3]
This commit is contained in:
Simon Tatham 2011-07-18 18:10:46 +00:00
parent d9eabbef50
commit f4307eb8e1
1 changed files with 42 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

64
ssh.c
View File

@ -7312,7 +7312,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
AUTH_TYPE_PUBLICKEY_OFFER_LOUD, AUTH_TYPE_PUBLICKEY_OFFER_LOUD,
AUTH_TYPE_PUBLICKEY_OFFER_QUIET, AUTH_TYPE_PUBLICKEY_OFFER_QUIET,
AUTH_TYPE_PASSWORD, AUTH_TYPE_PASSWORD,
AUTH_TYPE_GSSAPI, AUTH_TYPE_GSSAPI, /* always QUIET */
AUTH_TYPE_KEYBOARD_INTERACTIVE, AUTH_TYPE_KEYBOARD_INTERACTIVE,
AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET
} type; } type;
@ -7675,19 +7675,20 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
/* /*
* We have received an unequivocal Access * We have received an unequivocal Access
* Denied. This can translate to a variety of * Denied. This can translate to a variety of
* messages: * messages, or no message at all.
* *
* - if we'd just tried "none" authentication, * For forms of authentication which are attempted
* it's not worth printing anything at all * implicitly, by which I mean without printing
* * anything in the window indicating that we're
* - if we'd just tried a public key _offer_, * trying them, we should never print 'Access
* the message should be "Server refused our * denied'.
* key" (or no message at all if the key *
* came from Pageant) * If we do print a message saying that we're
* * attempting some kind of authentication, it's OK
* - if we'd just tried anything else, the * to print a followup message saying it failed -
* message really should be "Access denied". * but the message may sometimes be more specific
* * than simply 'Access denied'.
*
* Additionally, if we'd just tried password * Additionally, if we'd just tried password
* authentication, we should break out of this * authentication, we should break out of this
* whole loop so as to go back to the username * whole loop so as to go back to the username
@ -7700,14 +7701,31 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
s->type == AUTH_TYPE_PUBLICKEY_OFFER_QUIET) { s->type == AUTH_TYPE_PUBLICKEY_OFFER_QUIET) {
if (s->type == AUTH_TYPE_PUBLICKEY_OFFER_LOUD) if (s->type == AUTH_TYPE_PUBLICKEY_OFFER_LOUD)
c_write_str(ssh, "Server refused our key\r\n"); c_write_str(ssh, "Server refused our key\r\n");
logevent("Server refused public key"); logevent("Server refused our key");
} else if (s->type == AUTH_TYPE_PUBLICKEY) {
/* This _shouldn't_ happen except by a
* protocol bug causing client and server to
* disagree on what is a correct signature. */
c_write_str(ssh, "Server refused public-key signature"
" despite accepting key!\r\n");
logevent("Server refused public-key signature"
" despite accepting key!");
} else if (s->type==AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET) { } else if (s->type==AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET) {
/* server declined keyboard-interactive; ignore */ /* quiet, so no c_write */
} else { logevent("Server refused keyboard-interactive authentication");
} else if (s->type==AUTH_TYPE_GSSAPI) {
/* always quiet, so no c_write */
/* also, the code down in the GSSAPI block has
* already logged this in the Event Log */
} else if (s->type == AUTH_TYPE_KEYBOARD_INTERACTIVE) {
logevent("Keyboard-interactive authentication failed");
c_write_str(ssh, "Access denied\r\n"); c_write_str(ssh, "Access denied\r\n");
logevent("Access denied"); } else {
if (s->type == AUTH_TYPE_PASSWORD && assert(s->type == AUTH_TYPE_PASSWORD);
ssh->cfg.change_username) { logevent("Password authentication failed");
c_write_str(ssh, "Access denied\r\n");
if (ssh->cfg.change_username) {
/* XXX perhaps we should allow /* XXX perhaps we should allow
* keyboard-interactive to do this too? */ * keyboard-interactive to do this too? */
s->we_are_in = FALSE; s->we_are_in = FALSE;
@ -8056,6 +8074,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
sfree(sigdata); sfree(sigdata);
ssh2_pkt_send(ssh, s->pktout); ssh2_pkt_send(ssh, s->pktout);
logevent("Sent public key signature");
s->type = AUTH_TYPE_PUBLICKEY; s->type = AUTH_TYPE_PUBLICKEY;
key->alg->freekey(key->data); key->alg->freekey(key->data);
} }
@ -8107,6 +8126,7 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
ssh2_pkt_addstring(s->pktout, s->username); ssh2_pkt_addstring(s->pktout, s->username);
ssh2_pkt_addstring(s->pktout, "ssh-connection"); ssh2_pkt_addstring(s->pktout, "ssh-connection");
ssh2_pkt_addstring(s->pktout, "gssapi-with-mic"); ssh2_pkt_addstring(s->pktout, "gssapi-with-mic");
logevent("Attempting GSSAPI authentication");
/* add mechanism info */ /* add mechanism info */
s->gsslib->indicate_mech(s->gsslib, &s->gss_buf); s->gsslib->indicate_mech(s->gsslib, &s->gss_buf);
@ -8271,6 +8291,8 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
ssh2_pkt_addstring(s->pktout, ""); /* submethods */ ssh2_pkt_addstring(s->pktout, ""); /* submethods */
ssh2_pkt_send(ssh, s->pktout); ssh2_pkt_send(ssh, s->pktout);
logevent("Attempting keyboard-interactive authentication");
crWaitUntilV(pktin); crWaitUntilV(pktin);
if (pktin->type != SSH2_MSG_USERAUTH_INFO_REQUEST) { if (pktin->type != SSH2_MSG_USERAUTH_INFO_REQUEST) {
/* Server is not willing to do keyboard-interactive /* Server is not willing to do keyboard-interactive
@ -8278,8 +8300,6 @@ static void do_ssh2_authconn(Ssh ssh, unsigned char *in, int inlen,
* user without actually issuing any prompts). * user without actually issuing any prompts).
* Give up on it entirely. */ * Give up on it entirely. */
s->gotit = TRUE; s->gotit = TRUE;
if (pktin->type == SSH2_MSG_USERAUTH_FAILURE)
logevent("Keyboard-interactive authentication refused");
s->type = AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET; s->type = AUTH_TYPE_KEYBOARD_INTERACTIVE_QUIET;
s->kbd_inter_refused = TRUE; /* don't try it again */ s->kbd_inter_refused = TRUE; /* don't try it again */
continue; continue;