---------------------
PatchSet 4210 
Date: 2005/01/20 04:27:39
Author: dtucker
Branch: V_3_9
Tag: (none) 
Log:
   - dtucker@cvs.openbsd.org 2005/01/19 13:11:47
     [auth-bsdauth.c auth2-chall.c]
     Have keyboard-interactive code call the drivers even for responses for
     invalid logins.  This allows the drivers themselves to decide how to
     handle them and prevent leaking information where possible.  Existing
     behaviour for bsdauth is maintained by checking authctxt->valid in the
     bsdauth driver.  Note that any third-party kbdint drivers will now need
     to be able to handle responses for invalid logins.  ok markus@

Members: 
	ChangeLog:1.3517->1.3517.2.3 
	auth-bsdauth.c:1.5->1.5.14.1 
	auth2-chall.c:1.23->1.23.2.1 

Index: openssh_cvs/ChangeLog
diff -u openssh_cvs/ChangeLog:1.3517 openssh_cvs/ChangeLog:1.3517.2.3
--- openssh_cvs/ChangeLog:1.3517	Tue Aug 17 22:50:40 2004
+++ openssh_cvs/ChangeLog	Thu Jan 20 14:27:39 2005
@@ -1,3 +1,23 @@
+20050120
+ - (dtucker) OpenBSD CVS Sync
+   - dtucker@cvs.openbsd.org 2005/01/19 13:11:47
+     [auth-bsdauth.c auth2-chall.c]
+     Have keyboard-interactive code call the drivers even for responses for
+     invalid logins.  This allows the drivers themselves to decide how to
+     handle them and prevent leaking information where possible.  Existing
+     behaviour for bsdauth is maintained by checking authctxt->valid in the
+     bsdauth driver.  Note that any third-party kbdint drivers will now need
+     to be able to handle responses for invalid logins.  ok markus@
+
+20041102
+ - (dtucker) [configure.ac includes.h] Bug #947: Fix compile error on HP-UX
+   10.x by testing for conflicts in shadow.h and undef'ing _INCLUDE__STDC__
+   only if a conflict is detected.
+
+20041019
+ - (dtucker) [uidswap.c] Don't test dropping of gids for the root user or
+   on Cygwin.  Cygwin parts from vinschen at redhat com; ok djm@
+
 20040817
  - (dtucker) [regress/README.regress] Note compatibility issues with GNU head.
  - (djm) OpenBSD CVS Sync
@@ -1654,4 +1674,4 @@
    - (djm) Trim deprecated options from INSTALL. Mention UsePAM
    - (djm) Fix quote handling in sftp; Patch from admorten AT umich.edu
 
-$Id: ChangeLog,v 1.3517 2004/08/17 12:50:40 djm Exp $
+$Id: ChangeLog,v 1.3517.2.3 2005/01/20 03:27:39 dtucker Exp $
Index: openssh_cvs/auth-bsdauth.c
diff -u openssh_cvs/auth-bsdauth.c:1.5 openssh_cvs/auth-bsdauth.c:1.5.14.1
--- openssh_cvs/auth-bsdauth.c:1.5	Thu Jul  4 10:14:18 2002
+++ openssh_cvs/auth-bsdauth.c	Thu Jan 20 14:27:40 2005
@@ -22,7 +22,7 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #include "includes.h"
-RCSID("$OpenBSD: auth-bsdauth.c,v 1.5 2002/06/30 21:59:45 deraadt Exp $");
+RCSID("$OpenBSD: auth-bsdauth.c,v 1.6 2005/01/19 13:11:47 dtucker Exp $");
 
 #ifdef BSD_AUTH
 #include "xmalloc.h"
@@ -83,6 +83,9 @@
 	Authctxt *authctxt = ctx;
 	int authok;
 
+	if (!authctxt->valid)
+		return -1;
+
 	if (authctxt->as == 0)
 		error("bsdauth_respond: no bsd auth session");
 
Index: openssh_cvs/auth2-chall.c
diff -u openssh_cvs/auth2-chall.c:1.23 openssh_cvs/auth2-chall.c:1.23.2.1
--- openssh_cvs/auth2-chall.c:1.23	Tue Jun 15 10:28:25 2004
+++ openssh_cvs/auth2-chall.c	Thu Jan 20 14:27:40 2005
@@ -23,7 +23,7 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 #include "includes.h"
-RCSID("$OpenBSD: auth2-chall.c,v 1.21 2004/06/01 14:20:45 dtucker Exp $");
+RCSID("$OpenBSD: auth2-chall.c,v 1.22 2005/01/19 13:11:47 dtucker Exp $");
 
 #include "ssh2.h"
 #include "auth.h"
@@ -274,12 +274,7 @@
 	}
 	packet_check_eom();
 
-	if (authctxt->valid) {
-		res = kbdintctxt->device->respond(kbdintctxt->ctxt,
-		    nresp, response);
-	} else {
-		res = -1;
-	}
+	res = kbdintctxt->device->respond(kbdintctxt->ctxt, nresp, response);
 
 	for (i = 0; i < nresp; i++) {
 		memset(response[i], 'r', strlen(response[i]));
@@ -291,7 +286,7 @@
 	switch (res) {
 	case 0:
 		/* Success! */
-		authenticated = 1;
+		authenticated = authctxt->valid ? 1 : 0;
 		break;
 	case 1:
 		/* Authentication needs further interaction */
