dropbear: svr-auth.c comparison

comparison svr-auth.c @ 1539:51df3d53b050

- Don't try to handle changed usernames - Avoid logging repeated failed username messages

author	Matt Johnston <matt@ucc.asn.au>
date	Mon, 26 Feb 2018 22:07:18 +0800
parents	f20038b513a5
children	bb8eaa26bc93 1acbdf64088e

comparison

equal deleted inserted replaced

-:f20038b513a5
+:51df3d53b050
 #include "packet.h"
 #include "auth.h"
 #include "runopts.h"
 #include "dbrandom.h"
-static void authclear(void);
 static int checkusername(const char *username, unsigned int userlen);
 /* initialise the first time for a session, resetting all parameters */
 void svr_authinitialise() {
-	ses.authstate.failcount = 0;
-	ses.authstate.pw_name = NULL;
-	ses.authstate.pw_dir = NULL;
-	ses.authstate.pw_shell = NULL;
-	ses.authstate.pw_passwd = NULL;
-	authclear();
-}
-/* Reset the auth state, but don't reset the failcount. This is for if the
-* user decides to try with a different username etc, and is also invoked
-* on initialisation */
-static void authclear() {
 	memset(&ses.authstate, 0, sizeof(ses.authstate));
 #if DROPBEAR_SVR_PUBKEY_AUTH
 	ses.authstate.authtypes |= AUTH_TYPE_PUBKEY;
 #endif
 #if DROPBEAR_SVR_PASSWORD_AUTH || DROPBEAR_SVR_PAM_AUTH
 	if (!svr_opts.noauthpass) {
 		ses.authstate.authtypes |= AUTH_TYPE_PASSWORD;
 	}
 #endif
-	if (ses.authstate.pw_name) {
-		m_free(ses.authstate.pw_name);
-	}
-	if (ses.authstate.pw_shell) {
-		m_free(ses.authstate.pw_shell);
-	}
-	if (ses.authstate.pw_dir) {
-		m_free(ses.authstate.pw_dir);
-	}
-	if (ses.authstate.pw_passwd) {
-		m_free(ses.authstate.pw_passwd);
-	}
 }
 /* Send a banner message if specified to the client. The client might
 * ignore this, but possibly serves as a legal "no trespassing" sign */
 void send_msg_userauth_banner(const buffer *banner) {
 	TRACE(("enter checkusername"))
 	if (userlen > MAX_USERNAME_LEN) {
 		return DROPBEAR_FAILURE;
 	}
-	/* new user or username has changed */
+	if (strlen(username) != userlen) {
-	if (ses.authstate.username == NULL ||
+		dropbear_exit("Attempted username with a null byte from %s",
-		strcmp(username, ses.authstate.username) != 0) {
+			svr_ses.addrstring);
-			/* the username needs resetting */
+	}
-			if (ses.authstate.username != NULL) {
-				dropbear_log(LOG_WARNING, "Client trying multiple usernames from %s",
+	if (ses.authstate.username == NULL) {
-							svr_ses.addrstring);
+		/* first request */
-				m_free(ses.authstate.username);
+		fill_passwd(username);
-			}
+		ses.authstate.username = m_strdup(username);
-			authclear();
+	} else {
-			fill_passwd(username);
+		/* check username hasn't changed */
-			ses.authstate.username = m_strdup(username);
+		if (strcmp(username, ses.authstate.username) != 0) {
+			dropbear_exit("Client trying multiple usernames from %s",
+				svr_ses.addrstring);
+		}
+	}
+	/* avoids cluttering logs with repeated failure messages from
+	consecutive authentication requests in a sesssion */
+	if (ses.authstate.checkusername_failed) {
+		TRACE(("checkusername: returning cached failure"))
+		return DROPBEAR_FAILURE;
 	}
 	/* check that user exists */
 	if (!ses.authstate.pw_name) {
 		TRACE(("leave checkusername: user '%s' doesn't exist", username))
 		dropbear_log(LOG_WARNING,
 				"Login attempt for nonexistent user from %s",
 				svr_ses.addrstring);
+		ses.authstate.checkusername_failed = 1;
 		return DROPBEAR_FAILURE;
 	}
 	/* check if we are running as non-root, and login user is different from the server */
 	uid = geteuid();
 		TRACE(("running as nonroot, only server uid is allowed"))
 		dropbear_log(LOG_WARNING,
 				"Login attempt with wrong user %s from %s",
 				ses.authstate.pw_name,
 				svr_ses.addrstring);
+		ses.authstate.checkusername_failed = 1;
 		return DROPBEAR_FAILURE;
 	}
 	/* check for non-root if desired */
 	if (svr_opts.norootlogin && ses.authstate.pw_uid == 0) {
 		TRACE(("leave checkusername: root login disabled"))
 		dropbear_log(LOG_WARNING, "root login rejected");
+		ses.authstate.checkusername_failed = 1;
 		return DROPBEAR_FAILURE;
 	}
 	/* check for login restricted to certain group if desired */
 	if (svr_opts.restrict_group) {
 		if (check_group_membership(svr_opts.restrict_group_gid,
 				ses.authstate.pw_name, ses.authstate.pw_gid) == DROPBEAR_FAILURE) {
 			dropbear_log(LOG_WARNING,
 				"Logins are restricted to the group %s but user '%s' is not a member",
 				svr_opts.restrict_group, ses.authstate.pw_name);
+			ses.authstate.checkusername_failed = 1;
 			return DROPBEAR_FAILURE;
 		}
 	}
 	TRACE(("shell is %s", ses.authstate.pw_shell))
 		}
 	}
 	/* no matching shell */
 	endusershell();
 	TRACE(("no matching shell"))
+	ses.authstate.checkusername_failed = 1;
 	dropbear_log(LOG_WARNING, "User '%s' has invalid shell, rejected",
 				ses.authstate.pw_name);
 	return DROPBEAR_FAILURE;
 goodshell:

Mercurial > dropbear

comparison svr-auth.c @ 1539:51df3d53b050