upstream commit

use ssh_packet_set_log_preamble() to include connection
username in packet log messages, e.g.

Connection closed by invalid user foo 10.1.1.1 port 44056 [preauth]

ok markus@ bz#113

Upstream-ID: 3591b88bdb5416d6066fb3d49d8fff2375bf1a15

diff --git a/auth2.c b/auth2.c
index 9108b8612bea215c3f22a7c275803e5760b922a4..97dd2ef0a4ffa7dd72ad6eaac71f73c57fb269ba 100644 (file)
--- a/auth2.c
+++ b/auth2.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2.c,v 1.136 2016/05/02 08:49:03 djm Exp $ */
+/* $OpenBSD: auth2.c,v 1.137 2017/02/03 23:05:57 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -212,6 +212,7 @@ input_service_request(int type, u_int32_t seq, void *ctxt)
 static int
 input_userauth_request(int type, u_int32_t seq, void *ctxt)
 {
+       struct ssh *ssh = active_state; /* XXX */
        Authctxt *authctxt = ctxt;
        Authmethod *m = NULL;
        char *user, *service, *method, *style = NULL;
@@ -235,9 +236,10 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
                authctxt->user = xstrdup(user);
                if (authctxt->pw && strcmp(service, "ssh-connection")==0) {
                        authctxt->valid = 1;
-                       debug2("input_userauth_request: setting up authctxt for %s", user);
+                       debug2("%s: setting up authctxt for %s",
+                           __func__, user);
                } else {
-                       logit("input_userauth_request: invalid user %s", user);
+                       /* Invalid user, fake password information */
                        authctxt->pw = fakepw();
 #ifdef SSH_AUDIT_EVENTS
                        PRIVSEP(audit_event(SSH_INVALID_USER));
@@ -247,6 +249,8 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
                if (options.use_pam)
                        PRIVSEP(start_pam(authctxt));
 #endif
+               ssh_packet_set_log_preamble(ssh, "%suser %s",
+                   authctxt->valid ? "authenticating " : "invalid ", user);
                setproctitle("%s%s", authctxt->valid ? user : "unknown",
                    use_privsep ? " [net]" : "");
                authctxt->service = xstrdup(service);
@@ -292,6 +296,7 @@ void
 userauth_finish(Authctxt *authctxt, int authenticated, const char *method,
     const char *submethod)
 {
+       struct ssh *ssh = active_state; /* XXX */
        char *methods;
        int partial = 0;
 
@@ -353,6 +358,7 @@ userauth_finish(Authctxt *authctxt, int authenticated, const char *method,
                packet_write_wait();
                /* now we can break out */
                authctxt->success = 1;
+               ssh_packet_set_log_preamble(ssh, "user %s", authctxt->user);
        } else {
 
                /* Allow initial try of "none" auth without failure penalty */

diff --git a/monitor.c b/monitor.c
index 43f484709b8b73763c491e592f65cc2d81123e19..96d22b7e40e9890387a26a266b6204d3c5446232 100644 (file)
--- a/monitor.c
+++ b/monitor.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor.c,v 1.166 2016/09/28 16:33:06 djm Exp $ */
+/* $OpenBSD: monitor.c,v 1.167 2017/02/03 23:05:57 djm Exp $ */
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -283,6 +283,7 @@ monitor_permit_authentications(int permit)
 void
 monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
 {
+       struct ssh *ssh = active_state; /* XXX */
        struct mon_table *ent;
        int authenticated = 0, partial = 0;
 
@@ -356,6 +357,7 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor)
 
        debug("%s: %s has been authenticated by privileged process",
            __func__, authctxt->user);
+       ssh_packet_set_log_preamble(ssh, "user %s", authctxt->user);
 
        mm_get_keystate(pmonitor);
 
@@ -695,6 +697,7 @@ mm_answer_sign(int sock, Buffer *m)
 int
 mm_answer_pwnamallow(int sock, Buffer *m)
 {
+       struct ssh *ssh = active_state; /* XXX */
        char *username;
        struct passwd *pwent;
        int allowed = 0;
@@ -739,6 +742,8 @@ mm_answer_pwnamallow(int sock, Buffer *m)
        buffer_put_cstring(m, pwent->pw_shell);
 
  out:
+       ssh_packet_set_log_preamble(ssh, "%suser %s",
+           authctxt->valid ? "authenticating" : "invalid ", authctxt->user);
        buffer_put_string(m, &options, sizeof(options));
 
 #define M_CP_STROPT(x) do { \