← Back to branch summary

~ubuntu-branches/debian/stretch/dropbear/stretch

« back to all changes in this revision

Viewing changes to debian/diff/0005-user-disclosure.diff

  • Committer: Package Import Robot
  • Author(s): Gerrit Pape, Matt Johnston, Gerrit Pape
  • Date: 2013-10-25 15:00:48 UTC
  • mfrom: (1.4.6)
  • Revision ID: package-import@ubuntu.com-20131025150048-3jq765x96xayk392
Tags: 2013.60-1
http://bugs.debian.org/692653
[ Matt Johnston ]
* New upstream release.

[ Gerrit Pape ]
* debian/diff/0004-cve-2013-4421.diff, 0005-user-disclosure.diff:
  remove; fixed upstream.
* debian/dropbear.postinst: don't fail if initramfs-tools it not
  installed (closes: #692653).

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/diff/0005-user-disclosure.diff
1
 
# HG changeset patch
2
 
# User Matt Johnston <matt@ucc.asn.au>
3
 
# Date 1369564764 -28800
4
 
# Node ID d7784616409a427f3bc6eb9e0d3f8b942404fe5b
5
 
# Parent  e0084f136cb88f8530928d85378b1d344d41f789
6
 
improve auth failure delays to avoid indicating which users exist
7
 
 
8
 
--- a/svr-auth.c        2013-10-15 23:57:41.935735500 -0400
9
 
+++ b/svr-auth.c        2013-10-16 00:05:10.343719116 -0400
10
 
@@ -110,6 +110,7 @@
11
 
 
12
 
        unsigned char *username = NULL, *servicename = NULL, *methodname = NULL;
13
 
        unsigned int userlen, servicelen, methodlen;
14
 
+       int valid_user = 0;
15
 
 
16
 
        TRACE(("enter recv_msg_userauth_request"))
17
 
 
18
 
@@ -141,6 +142,14 @@
19
 
                dropbear_exit("unknown service in auth");
20
 
        }
21
 
 
22
 
+       /* check username is good before continuing. 
23
 
+       * the 'incrfail' varies depending on the auth method to
24
 
+       * avoid giving away which users exist on the system through
25
 
+       * the time delay. */
26
 
+       if (checkusername(username, userlen) == DROPBEAR_SUCCESS) {
27
 
+               valid_user = 1;
28
 
+       }
29
 
+
30
 
        /* user wants to know what methods are supported */
31
 
        if (methodlen == AUTH_METHOD_NONE_LEN &&
32
 
                        strncmp(methodname, AUTH_METHOD_NONE,
33
 
@@ -149,14 +158,6 @@
34
 
                send_msg_userauth_failure(0, 0);
35
 
                goto out;
36
 
        }
37
 
-       
38
 
-       /* check username is good before continuing */
39
 
-       if (checkusername(username, userlen) == DROPBEAR_FAILURE) {
40
 
-               /* username is invalid/no shell/etc - send failure */
41
 
-               TRACE(("sending checkusername failure"))
42
 
-               send_msg_userauth_failure(0, 1);
43
 
-               goto out;
44
 
-       }
45
 
 
46
 
 #ifdef ENABLE_SVR_PASSWORD_AUTH
47
 
        if (!svr_opts.noauthpass &&
48
 
@@ -165,8 +166,10 @@
49
 
                if (methodlen == AUTH_METHOD_PASSWORD_LEN &&
50
 
                                strncmp(methodname, AUTH_METHOD_PASSWORD,
51
 
                                        AUTH_METHOD_PASSWORD_LEN) == 0) {
52
 
-                       svr_auth_password();
53
 
-                       goto out;
54
 
+                       if (valid_user) {
55
 
+                               svr_auth_password();
56
 
+                               goto out;
57
 
+                       }
58
 
                }
59
 
        }
60
 
 #endif
61
 
@@ -178,8 +181,10 @@
62
 
                if (methodlen == AUTH_METHOD_PASSWORD_LEN &&
63
 
                                strncmp(methodname, AUTH_METHOD_PASSWORD,
64
 
                                        AUTH_METHOD_PASSWORD_LEN) == 0) {
65
 
-                       svr_auth_pam();
66
 
-                       goto out;
67
 
+                       if (valid_user) {
68
 
+                               svr_auth_pam();
69
 
+                               goto out;
70
 
+                       }
71
 
                }
72
 
        }
73
 
 #endif
74
 
@@ -189,12 +194,17 @@
75
 
        if (methodlen == AUTH_METHOD_PUBKEY_LEN &&
76
 
                        strncmp(methodname, AUTH_METHOD_PUBKEY,
77
 
                                AUTH_METHOD_PUBKEY_LEN) == 0) {
78
 
-               svr_auth_pubkey();
79
 
+               if (valid_user) {
80
 
+                       svr_auth_pubkey();
81
 
+               } else {
82
 
+                       /* pubkey has no failure delay */
83
 
+                       send_msg_userauth_failure(0, 0);
84
 
+               }
85
 
                goto out;
86
 
        }
87
 
 #endif
88
 
 
89
 
-       /* nothing matched, we just fail */
90
 
+       /* nothing matched, we just fail with a delay */
91
 
        send_msg_userauth_failure(0, 1);
92
 
 
93
 
 out:
94
 
@@ -237,7 +247,6 @@
95
 
                dropbear_log(LOG_WARNING,
96
 
                                "Login attempt for nonexistent user from %s",
97
 
                                svr_ses.addrstring);
98
 
-               send_msg_userauth_failure(0, 1);
99
 
                return DROPBEAR_FAILURE;
100
 
        }
101
 
 
102
 
@@ -245,7 +254,6 @@
103
 
        if (svr_opts.norootlogin && ses.authstate.pw_uid == 0) {
104
 
                TRACE(("leave checkusername: root login disabled"))
105
 
                dropbear_log(LOG_WARNING, "root login rejected");
106
 
-               send_msg_userauth_failure(0, 1);
107
 
                return DROPBEAR_FAILURE;
108
 
        }
109
 
 
110
 
@@ -274,7 +282,6 @@
111
 
        TRACE(("no matching shell"))
112
 
        dropbear_log(LOG_WARNING, "User '%s' has invalid shell, rejected",
113
 
                                ses.authstate.pw_name);
114
 
-       send_msg_userauth_failure(0, 1);
115
 
        return DROPBEAR_FAILURE;
116
 
        
117
 
 goodshell:
118
 
@@ -284,7 +291,6 @@
119
 
        TRACE(("uid = %d", ses.authstate.pw_uid))
120
 
        TRACE(("leave checkusername"))
121
 
        return DROPBEAR_SUCCESS;
122
 
-
123
 
 }
124
 
 
125
 
 /* Send a failure message to the client, in responds to a userauth_request.
126
 
@@ -331,8 +337,8 @@
127
 
        if (incrfail) {
128
 
                unsigned int delay;
129
 
                genrandom((unsigned char*)&delay, sizeof(delay));
130
 
-               /* We delay for 300ms +- 50ms, 0.1ms granularity */
131
 
-               delay = 250000 + (delay % 1000)*100;
132
 
+               /* We delay for 300ms +- 50ms */
133
 
+               delay = 250000 + (delay % 100000);
134
 
                usleep(delay);
135
 
                ses.authstate.failcount++;
136
 
        }