[src/OPENSSH]: src/crypto/external/bsd/openssh/dist openssh: Re-import files ...

[rin <rin%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/7b8c557155b9
branches:  OPENSSH
changeset: 378249:7b8c557155b9
user:      rin <rin%NetBSD.org@localhost>
date:      Fri Jul 28 04:07:59 2023 +0000

description:
openssh: Re-import files only exist for portable versions into OPENSSH branch.

diffstat:

 crypto/external/bsd/openssh/dist/auth-pam.c |  1408 +++++++++++++++++++++++++++
 crypto/external/bsd/openssh/dist/auth-pam.h |    47 +
 crypto/external/bsd/openssh/dist/moduli     |   425 ++++++++
 crypto/external/bsd/openssh/dist/moduli.5   |   126 ++
 4 files changed, 2006 insertions(+), 0 deletions(-)

diffs (truncated from 2022 to 300 lines):

diff -r 794cafe09d56 -r 7b8c557155b9 crypto/external/bsd/openssh/dist/auth-pam.c
--- /dev/null   Thu Jan 01 00:00:00 1970 +0000
+++ b/crypto/external/bsd/openssh/dist/auth-pam.c       Fri Jul 28 04:07:59 2023 +0000
@@ -0,0 +1,1408 @@
+/*-
+ * Copyright (c) 2002 Networks Associates Technology, Inc.
+ * All rights reserved.
+ *
+ * This software was developed for the FreeBSD Project by ThinkSec AS and
+ * NAI Labs, the Security Research Division of Network Associates, Inc.
+ * under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
+ * DARPA CHATS research program.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+/*
+ * Copyright (c) 2003,2004 Damien Miller <djm%mindrot.org@localhost>
+ * Copyright (c) 2003,2004 Darren Tucker <dtucker%zip.com.au@localhost>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* Based on FreeBSD: src/crypto/openssh/auth2-pam-freebsd.c,v 1.11 2003/03/31 13:48:18 des */
+
+#include "includes.h"
+
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <sys/wait.h>
+
+#include <errno.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#ifdef USE_PAM
+#if defined(HAVE_SECURITY_PAM_APPL_H)
+#include <security/pam_appl.h>
+#elif defined (HAVE_PAM_PAM_APPL_H)
+#include <pam/pam_appl.h>
+#endif
+
+#if !defined(SSHD_PAM_SERVICE)
+extern char *__progname;
+# define SSHD_PAM_SERVICE              __progname
+#endif
+
+/* OpenGroup RFC86.0 and XSSO specify no "const" on arguments */
+#ifdef PAM_SUN_CODEBASE
+# define sshpam_const          /* Solaris, HP-UX, SunOS */
+#else
+# define sshpam_const  const   /* LinuxPAM, OpenPAM, AIX */
+#endif
+
+/* Ambiguity in spec: is it an array of pointers or a pointer to an array? */
+#ifdef PAM_SUN_CODEBASE
+# define PAM_MSG_MEMBER(msg, n, member) ((*(msg))[(n)].member)
+#else
+# define PAM_MSG_MEMBER(msg, n, member) ((msg)[(n)]->member)
+#endif
+
+#include "xmalloc.h"
+#include "sshbuf.h"
+#include "ssherr.h"
+#include "hostfile.h"
+#include "auth.h"
+#include "auth-pam.h"
+#include "canohost.h"
+#include "log.h"
+#include "msg.h"
+#include "packet.h"
+#include "misc.h"
+#include "servconf.h"
+#include "ssh2.h"
+#include "auth-options.h"
+#include "misc.h"
+#ifdef GSSAPI
+#include "ssh-gss.h"
+#endif
+#include "monitor_wrap.h"
+
+extern ServerOptions options;
+extern struct sshbuf *loginmsg;
+extern u_int utmp_len;
+
+/* so we don't silently change behaviour */
+#ifdef USE_POSIX_THREADS
+# error "USE_POSIX_THREADS replaced by UNSUPPORTED_POSIX_THREADS_HACK"
+#endif
+
+/*
+ * Formerly known as USE_POSIX_THREADS, using this is completely unsupported
+ * and generally a bad idea.  Use at own risk and do not expect support if
+ * this breaks.
+ */
+#ifdef UNSUPPORTED_POSIX_THREADS_HACK
+#include <pthread.h>
+/*
+ * Avoid namespace clash when *not* using pthreads for systems *with*
+ * pthreads, which unconditionally define pthread_t via sys/types.h
+ * (e.g. Linux)
+ */
+typedef pthread_t sp_pthread_t;
+#else
+typedef pid_t sp_pthread_t;
+#define pthread_exit   fake_pthread_exit
+#define pthread_create fake_pthread_create
+#define pthread_cancel fake_pthread_cancel
+#define pthread_join   fake_pthread_join
+#endif
+
+struct pam_ctxt {
+       sp_pthread_t     pam_thread;
+       int              pam_psock;
+       int              pam_csock;
+       int              pam_done;
+};
+
+static void sshpam_free_ctx(void *);
+static struct pam_ctxt *cleanup_ctxt;
+
+#ifndef UNSUPPORTED_POSIX_THREADS_HACK
+/*
+ * Simulate threads with processes.
+ */
+
+static int sshpam_thread_status = -1;
+static sshsig_t sshpam_oldsig;
+
+static void
+sshpam_sigchld_handler(int sig)
+{
+       ssh_signal(SIGCHLD, SIG_DFL);
+       if (cleanup_ctxt == NULL)
+               return; /* handler called after PAM cleanup, shouldn't happen */
+       if (waitpid(cleanup_ctxt->pam_thread, &sshpam_thread_status, WNOHANG)
+           <= 0) {
+               /* PAM thread has not exitted, privsep slave must have */
+               kill(cleanup_ctxt->pam_thread, SIGTERM);
+               while (waitpid(cleanup_ctxt->pam_thread,
+                   &sshpam_thread_status, 0) == -1) {
+                       if (errno == EINTR)
+                               continue;
+                       return;
+               }
+       }
+       if (WIFSIGNALED(sshpam_thread_status) &&
+           WTERMSIG(sshpam_thread_status) == SIGTERM)
+               return; /* terminated by pthread_cancel */
+       if (!WIFEXITED(sshpam_thread_status))
+               sigdie("PAM: authentication thread exited unexpectedly");
+       if (WEXITSTATUS(sshpam_thread_status) != 0)
+               sigdie("PAM: authentication thread exited uncleanly");
+}
+
+/* ARGSUSED */
+static void
+pthread_exit(void *value)
+{
+       _exit(0);
+}
+
+/* ARGSUSED */
+static int
+pthread_create(sp_pthread_t *thread, const void *attr,
+    void *(*thread_start)(void *), void *arg)
+{
+       pid_t pid;
+       struct pam_ctxt *ctx = arg;
+
+       sshpam_thread_status = -1;
+       switch ((pid = fork())) {
+       case -1:
+               error("fork(): %s", strerror(errno));
+               return errno;
+       case 0:
+               close(ctx->pam_psock);
+               ctx->pam_psock = -1;
+               thread_start(arg);
+               _exit(1);
+       default:
+               *thread = pid;
+               close(ctx->pam_csock);
+               ctx->pam_csock = -1;
+               sshpam_oldsig = ssh_signal(SIGCHLD, sshpam_sigchld_handler);
+               return (0);
+       }
+}
+
+static int
+pthread_cancel(sp_pthread_t thread)
+{
+       ssh_signal(SIGCHLD, sshpam_oldsig);
+       return (kill(thread, SIGTERM));
+}
+
+/* ARGSUSED */
+static int
+pthread_join(sp_pthread_t thread, void **value)
+{
+       int status;
+
+       if (sshpam_thread_status != -1)
+               return (sshpam_thread_status);
+       ssh_signal(SIGCHLD, sshpam_oldsig);
+       while (waitpid(thread, &status, 0) == -1) {
+               if (errno == EINTR)
+                       continue;
+               fatal("%s: waitpid: %s", __func__, strerror(errno));
+       }
+       return (status);
+}
+#endif
+
+
+static pam_handle_t *sshpam_handle = NULL;
+static int sshpam_err = 0;
+static int sshpam_authenticated = 0;
+static int sshpam_session_open = 0;
+static int sshpam_cred_established = 0;
+static int sshpam_account_status = -1;
+static int sshpam_maxtries_reached = 0;
+static char **sshpam_env = NULL;
+static Authctxt *sshpam_authctxt = NULL;
+static const char *sshpam_password = NULL;
+static char *sshpam_rhost = NULL;
+static char *sshpam_laddr = NULL;
+
+/* Some PAM implementations don't implement this */
+#ifndef HAVE_PAM_GETENVLIST
+static char **
+pam_getenvlist(pam_handle_t *pamh)
+{
+       /*
+        * XXX - If necessary, we can still support environment passing
+        * for platforms without pam_getenvlist by searching for known
+        * env vars (e.g. KRB5CCNAME) from the PAM environment.
+        */
+        return NULL;
+}
+#endif
+
+#ifndef HAVE_PAM_PUTENV
+static int
+pam_putenv(pam_handle_t *pamh, const char *name_value)
+{
+       return PAM_SUCCESS;
+}
+#endif /* HAVE_PAM_PUTENV */
+
+/*
+ * Some platforms, notably Solaris, do not enforce password complexity
+ * rules during pam_chauthtok() if the real uid of the calling process
+ * is 0, on the assumption that it's being called by "passwd" run by root.
+ * This wraps pam_chauthtok and sets/restore the real uid so PAM will do
+ * the right thing.
+ */
+#ifdef SSHPAM_CHAUTHTOK_NEEDS_RUID
+static int
+sshpam_chauthtok_ruid(pam_handle_t *pamh, int flags)
+{
+       int result;
+
+       if (sshpam_authctxt == NULL)
+               fatal("PAM: sshpam_authctxt not initialized");
+       if (setreuid(sshpam_authctxt->pw->pw_uid, -1) == -1)
+               fatal("%s: setreuid failed: %s", __func__, strerror(errno));
+       result = pam_chauthtok(pamh, flags);
+       if (setreuid(0, -1) == -1)