ClearML/dropbear
1
0
Fork 0
mirror of https://github.com/clearml/dropbear synced 2025-03-04 02:57:46 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Be a bit more careful about when we want to use CLI_AUTH_IMMEDIATE

Browse Source 
Only use it if we have pubkeys to try, or we have $DROPBEAR_PASSWORD set
This commit is contained in:
Matt Johnston 2013-04-02 00:11:53 +08:00
parent 90b5691183
commit ff2aa20565
3 changed files with 35 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
auth.h
View File

@ -67,7 +67,7 @@ void recv_msg_userauth_pk_ok();
void recv_msg_userauth_info_request(); void recv_msg_userauth_info_request();
void cli_get_user(); void cli_get_user();
void cli_auth_getmethods(); void cli_auth_getmethods();
void cli_auth_try(); int cli_auth_try();
void recv_msg_userauth_banner(); void recv_msg_userauth_banner();
void cli_pubkeyfail(); void cli_pubkeyfail();
void cli_auth_password(); void cli_auth_password();

54
cli-auth.c
View File

@ -42,9 +42,15 @@ void cli_authinitialise() {
void cli_auth_getmethods() { void cli_auth_getmethods() {
TRACE(("enter cli_auth_getmethods")) TRACE(("enter cli_auth_getmethods"))
#ifdef CLI_IMMEDIATE_AUTH #ifdef CLI_IMMEDIATE_AUTH
ses.authstate.authtypes = AUTH_TYPE_PUBKEY | AUTH_TYPE_PASSWORD | AUTH_TYPE_INTERACT; ses.authstate.authtypes = AUTH_TYPE_PUBKEY;
cli_auth_try(); if (getenv(DROPBEAR_PASSWORD_ENV)) {
#else ses.authstate.authtypes |= AUTH_TYPE_PASSWORD | AUTH_TYPE_INTERACT;
}
if (cli_auth_try() == DROPBEAR_SUCCESS) {
TRACE(("skipped initial none auth query"))
return;
}
#endif
CHECKCLEARTOWRITE(); CHECKCLEARTOWRITE();
buf_putbyte(ses.writepayload, SSH_MSG_USERAUTH_REQUEST); buf_putbyte(ses.writepayload, SSH_MSG_USERAUTH_REQUEST);
buf_putstring(ses.writepayload, cli_opts.username, buf_putstring(ses.writepayload, cli_opts.username,
@ -54,7 +60,6 @@ void cli_auth_getmethods() {
buf_putstring(ses.writepayload, "none", 4); /* 'none' method */ buf_putstring(ses.writepayload, "none", 4); /* 'none' method */
encrypt_packet(); encrypt_packet();
#endif
TRACE(("leave cli_auth_getmethods")) TRACE(("leave cli_auth_getmethods"))
} }
@ -241,7 +246,7 @@ void recv_msg_userauth_success() {
#endif #endif
} }
void cli_auth_try() { int cli_auth_try() {
int finished = 0; int finished = 0;
TRACE(("enter cli_auth_try")) TRACE(("enter cli_auth_try"))
@ -258,36 +263,39 @@ void cli_auth_try() {
#endif #endif
#ifdef ENABLE_CLI_PASSWORD_AUTH #ifdef ENABLE_CLI_PASSWORD_AUTH
if (ses.keys->trans.algo_crypt->cipherdesc == NULL) { if (!finished && (ses.authstate.authtypes & AUTH_TYPE_PASSWORD)) {
fprintf(stderr, "Sorry, I won't let you use password auth unencrypted.\n"); if (ses.keys->trans.algo_crypt->cipherdesc == NULL) {
} else if (!finished && ses.authstate.authtypes & AUTH_TYPE_PASSWORD) { fprintf(stderr, "Sorry, I won't let you use password auth unencrypted.\n");
cli_auth_password(); } else {
finished = 1; cli_auth_password();
cli_ses.lastauthtype = AUTH_TYPE_PASSWORD; finished = 1;
cli_ses.lastauthtype = AUTH_TYPE_PASSWORD;
}
} }
#endif #endif
#ifdef ENABLE_CLI_INTERACT_AUTH #ifdef ENABLE_CLI_INTERACT_AUTH
if (ses.keys->trans.algo_crypt->cipherdesc == NULL) { if (!finished && (ses.authstate.authtypes & AUTH_TYPE_INTERACT)) {
fprintf(stderr, "Sorry, I won't let you use interactive auth unencrypted.\n"); if (ses.keys->trans.algo_crypt->cipherdesc == NULL) {
} else if (!finished && ses.authstate.authtypes & AUTH_TYPE_INTERACT) { fprintf(stderr, "Sorry, I won't let you use interactive auth unencrypted.\n");
if (cli_ses.auth_interact_failed) {
finished = 0;
} else { } else {
cli_auth_interactive(); if (!cli_ses.auth_interact_failed) {
cli_ses.lastauthtype = AUTH_TYPE_INTERACT; cli_auth_interactive();
finished = 1; cli_ses.lastauthtype = AUTH_TYPE_INTERACT;
finished = 1;
}
} }
} }
#endif #endif
TRACE(("cli_auth_try lastauthtype %d", cli_ses.lastauthtype)) TRACE(("cli_auth_try lastauthtype %d", cli_ses.lastauthtype))
if (!finished) { if (finished) {
dropbear_exit("No auth methods could be used."); TRACE(("leave cli_auth_try success"))
return DROPBEAR_SUCCESS;
} }
TRACE(("leave cli_auth_try failure"))
TRACE(("leave cli_auth_try")) return DROPBEAR_FAILURE;
} }
/* A helper for getpass() that exits if the user cancels. The returned /* A helper for getpass() that exits if the user cancels. The returned

4
cli-session.c
View File

@ -221,7 +221,9 @@ static void cli_sessionloop() {
return; return;
case USERAUTH_FAIL_RCVD: case USERAUTH_FAIL_RCVD:
cli_auth_try(); if (cli_auth_try() == DROPBEAR_FAILURE) {
dropbear_exit("No auth methods could be used.");
}
cli_ses.state = USERAUTH_REQ_SENT; cli_ses.state = USERAUTH_REQ_SENT;
TRACE(("leave cli_sessionloop: cli_auth_try")) TRACE(("leave cli_sessionloop: cli_auth_try"))
return; return;