]> andersk Git - openssh.git/blame - ssh.c
- (tim) [configure.ac] Put back bits mistakenly removed from Rev 1.188
[openssh.git] / ssh.c
CommitLineData
8efc0c15 1/*
5260325f 2 * Author: Tatu Ylonen <ylo@cs.hut.fi>
3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4 * All rights reserved
5260325f 5 * Ssh client program. This program can be used to log into a remote machine.
6 * The software supports strong authentication, encryption, and forwarding
7 * of X11, TCP/IP, and authentication connections.
8 *
bcbf86ec 9 * As far as I am concerned, the code I have written for this software
10 * can be used freely for any purpose. Any derived versions of this
11 * software must be clearly marked as such, and if the derived work is
12 * incompatible with the protocol description in the RFC file, it must be
13 * called by a name other than "ssh" or "Secure Shell".
14 *
15 * Copyright (c) 1999 Niels Provos. All rights reserved.
d73a67d7 16 * Copyright (c) 2000, 2001, 2002, 2003 Markus Friedl. All rights reserved.
bcbf86ec 17 *
18 * Modified to work with SSL by Niels Provos <provos@citi.umich.edu>
19 * in Canada (German citizen).
20 *
21 * Redistribution and use in source and binary forms, with or without
22 * modification, are permitted provided that the following conditions
23 * are met:
24 * 1. Redistributions of source code must retain the above copyright
25 * notice, this list of conditions and the following disclaimer.
26 * 2. Redistributions in binary form must reproduce the above copyright
27 * notice, this list of conditions and the following disclaimer in the
28 * documentation and/or other materials provided with the distribution.
29 *
30 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
31 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
32 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
33 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
34 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
35 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
36 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
37 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
38 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
39 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
5260325f 40 */
8efc0c15 41
42#include "includes.h"
5d8d32a3 43RCSID("$OpenBSD: ssh.c,v 1.206 2003/12/16 15:49:51 markus Exp $");
8efc0c15 44
a306f2dd 45#include <openssl/evp.h>
fa08c86b 46#include <openssl/err.h>
a306f2dd 47
8efc0c15 48#include "ssh.h"
42f11eb2 49#include "ssh1.h"
50#include "ssh2.h"
51#include "compat.h"
52#include "cipher.h"
53#include "xmalloc.h"
8efc0c15 54#include "packet.h"
55#include "buffer.h"
a5efa1bb 56#include "channels.h"
a306f2dd 57#include "key.h"
4c8722d9 58#include "authfd.h"
a306f2dd 59#include "authfile.h"
42f11eb2 60#include "pathnames.h"
b5c334cc 61#include "clientloop.h"
42f11eb2 62#include "log.h"
63#include "readconf.h"
64#include "sshconnect.h"
65#include "tildexpand.h"
1f3bf5aa 66#include "dispatch.h"
42f11eb2 67#include "misc.h"
b2552997 68#include "kex.h"
69#include "mac.h"
30dcc918 70#include "sshtty.h"
8efc0c15 71
383546c4 72#ifdef SMARTCARD
383546c4 73#include "scard.h"
dd2495cb 74#endif
383546c4 75
f601d847 76#ifdef HAVE___PROGNAME
77extern char *__progname;
260d427b 78#else
79char *__progname;
80#endif
f601d847 81
5260325f 82/* Flag indicating whether debug mode is on. This can be set on the command line. */
8efc0c15 83int debug_flag = 0;
84
a8be9f80 85/* Flag indicating whether a tty should be allocated */
8efc0c15 86int tty_flag = 0;
8abcdba4 87int no_tty_flag = 0;
88int force_tty_flag = 0;
8efc0c15 89
8ce64345 90/* don't exec a shell */
91int no_shell_flag = 0;
8ce64345 92
aa3378df 93/*
94 * Flag indicating that nothing should be read from stdin. This can be set
95 * on the command line.
96 */
8efc0c15 97int stdin_null_flag = 0;
98
aa3378df 99/*
100 * Flag indicating that ssh should fork after authentication. This is useful
c242fc96 101 * so that the passphrase can be entered manually, and then ssh goes to the
aa3378df 102 * background.
103 */
8efc0c15 104int fork_after_authentication_flag = 0;
105
aa3378df 106/*
107 * General data structure for command line options and options configurable
108 * in configuration files. See readconf.h.
109 */
8efc0c15 110Options options;
111
e591b98a 112/* optional user configfile */
113char *config = NULL;
114
aa3378df 115/*
116 * Name of the host we are connecting to. This is the name given on the
117 * command line, or the HostName specified for the user-supplied name in a
118 * configuration file.
119 */
8efc0c15 120char *host;
121
122/* socket address the host resolves to */
48e671d5 123struct sockaddr_storage hostaddr;
8efc0c15 124
8002af61 125/* Private host keys. */
39c00dc2 126Sensitive sensitive_data;
8efc0c15 127
128/* Original real UID. */
129uid_t original_real_uid;
3fb156df 130uid_t original_effective_uid;
8efc0c15 131
8ce64345 132/* command to be executed */
133Buffer command;
134
ae810de7 135/* Should we execute a command or invoke a subsystem? */
136int subsystem_flag = 0;
137
e0ae8728 138/* # of replies received for global requests */
139static int client_global_request_id = 0;
140
6939bbd4 141/* pid of proxycommand child process */
142pid_t proxy_command_pid = 0;
143
8efc0c15 144/* Prints a help message to the user. This function never returns. */
145
396c147e 146static void
5ca51e19 147usage(void)
8efc0c15 148{
1fe6a48f 149 fprintf(stderr, "Usage: %s [options] host [command]\n", __progname);
5260325f 150 fprintf(stderr, "Options:\n");
151 fprintf(stderr, " -l user Log in using this user name.\n");
5ca51e19 152 fprintf(stderr, " -n Redirect input from " _PATH_DEVNULL ".\n");
e591b98a 153 fprintf(stderr, " -F config Config file (default: ~/%s).\n",
154 _PATH_SSH_USER_CONFFILE);
71276795 155 fprintf(stderr, " -A Enable authentication agent forwarding.\n");
63cd7dd0 156 fprintf(stderr, " -a Disable authentication agent forwarding (default).\n");
2b87da3b 157 fprintf(stderr, " -X Enable X11 connection forwarding.\n");
d73a67d7 158 fprintf(stderr, " -Y Enable trusted X11 connection forwarding.\n");
63cd7dd0 159 fprintf(stderr, " -x Disable X11 connection forwarding (default).\n");
a01a5f30 160 fprintf(stderr, " -i file Identity for public key authentication "
161 "(default: ~/.ssh/identity)\n");
315dfb04 162#ifdef SMARTCARD
163 fprintf(stderr, " -I reader Set smartcard reader.\n");
dd2495cb 164#endif
5260325f 165 fprintf(stderr, " -t Tty; allocate a tty even if command is given.\n");
8ce64345 166 fprintf(stderr, " -T Do not allocate a tty.\n");
5260325f 167 fprintf(stderr, " -v Verbose; display verbose debugging messages.\n");
bcbf86ec 168 fprintf(stderr, " Multiple -v increases verbosity.\n");
5260325f 169 fprintf(stderr, " -V Display version number only.\n");
5260325f 170 fprintf(stderr, " -q Quiet; don't display any warning messages.\n");
171 fprintf(stderr, " -f Fork into background after authentication.\n");
172 fprintf(stderr, " -e char Set escape character; ``none'' = disable (default: ~).\n");
173
63cd7dd0 174 fprintf(stderr, " -c cipher Select encryption algorithm\n");
38967add 175 fprintf(stderr, " -m macs Specify MAC algorithms for protocol version 2.\n");
5260325f 176 fprintf(stderr, " -p port Connect to this port. Server must be on the same port.\n");
177 fprintf(stderr, " -L listen-port:host:port Forward local port to remote address\n");
178 fprintf(stderr, " -R listen-port:host:port Forward remote port to local address\n");
1fe6a48f 179 fprintf(stderr, " These cause %s to listen for connections on a port, and\n", __progname);
5260325f 180 fprintf(stderr, " forward them to the other side by connecting to host:port.\n");
4c780c2a 181 fprintf(stderr, " -D port Enable dynamic application-level port forwarding.\n");
5260325f 182 fprintf(stderr, " -C Enable compression.\n");
8ce64345 183 fprintf(stderr, " -N Do not execute a shell or command.\n");
5260325f 184 fprintf(stderr, " -g Allow remote hosts to connect to forwarded ports.\n");
1f3bf5aa 185 fprintf(stderr, " -1 Force protocol version 1.\n");
186 fprintf(stderr, " -2 Force protocol version 2.\n");
48e671d5 187 fprintf(stderr, " -4 Use IPv4 only.\n");
188 fprintf(stderr, " -6 Use IPv6 only.\n");
5260325f 189 fprintf(stderr, " -o 'option' Process the option as if it was read from a configuration file.\n");
ae810de7 190 fprintf(stderr, " -s Invoke command (mandatory) as SSH2 subsystem.\n");
63cd7dd0 191 fprintf(stderr, " -b addr Local IP address.\n");
5260325f 192 exit(1);
8efc0c15 193}
194
396c147e 195static int ssh_session(void);
196static int ssh_session2(void);
197static void load_public_identity_files(void);
8ce64345 198
5260325f 199/*
200 * Main program for the ssh client.
201 */
8efc0c15 202int
203main(int ac, char **av)
204{
b34bec32 205 int i, opt, exit_status;
57112b5a 206 u_short fwd_port, fwd_host_port;
d2e3df16 207 char sfwd_port[6], sfwd_host_port[6];
1aafd17a 208 char *p, *cp, *line, buf[256];
5260325f 209 struct stat st;
3b1a83df 210 struct passwd *pw;
8ce64345 211 int dummy;
57dade33 212 extern int optind, optreset;
1812a662 213 extern char *optarg;
5260325f 214
fda04d7d 215 __progname = ssh_get_progname(av[0]);
264dce47 216 init_rng();
217
aa3378df 218 /*
219 * Save the original real uid. It will be needed later (uid-swapping
220 * may clobber the real uid).
221 */
5260325f 222 original_real_uid = getuid();
223 original_effective_uid = geteuid();
aff51935 224
9f324470 225 /*
226 * Use uid-swapping to give up root privileges for the duration of
227 * option processing. We will re-instantiate the rights when we are
228 * ready to create the privileged port, and will permanently drop
229 * them when the port has been created (actually, when the connection
230 * has been made, as we may need to create the port several times).
231 */
232 PRIV_END;
5260325f 233
7322ef0e 234#ifdef HAVE_SETRLIMIT
5260325f 235 /* If we are installed setuid root be careful to not drop core. */
236 if (original_real_uid != original_effective_uid) {
237 struct rlimit rlim;
238 rlim.rlim_cur = rlim.rlim_max = 0;
239 if (setrlimit(RLIMIT_CORE, &rlim) < 0)
240 fatal("setrlimit failed: %.100s", strerror(errno));
8efc0c15 241 }
3c62e7eb 242#endif
63bd8c36 243 /* Get user data. */
244 pw = getpwuid(original_real_uid);
245 if (!pw) {
bbe88b6d 246 logit("You don't exist, go away!");
63bd8c36 247 exit(1);
248 }
249 /* Take a copy of the returned structure. */
250 pw = pwcopy(pw);
251
aa3378df 252 /*
253 * Set our umask to something reasonable, as some files are created
254 * with the default umask. This will make them world-readable but
255 * writable only by the owner, which is ok for all files for which we
256 * don't set the modes explicitly.
257 */
5260325f 258 umask(022);
259
5260325f 260 /* Initialize option structure to indicate that no values have been set. */
261 initialize_options(&options);
262
263 /* Parse command-line arguments. */
264 host = NULL;
265
f5a1a01a 266again:
267 while ((opt = getopt(ac, av,
d73a67d7 268 "1246ab:c:e:fgi:kl:m:no:p:qstvxACD:F:I:L:NPR:TVXY")) != -1) {
5260325f 269 switch (opt) {
1f3bf5aa 270 case '1':
271 options.protocol = SSH_PROTO_1;
272 break;
6ae2364d 273 case '2':
274 options.protocol = SSH_PROTO_2;
275 break;
48e671d5 276 case '4':
1572b90f 277 options.address_family = AF_INET;
48e671d5 278 break;
48e671d5 279 case '6':
1572b90f 280 options.address_family = AF_INET6;
48e671d5 281 break;
5260325f 282 case 'n':
283 stdin_null_flag = 1;
284 break;
5260325f 285 case 'f':
286 fork_after_authentication_flag = 1;
287 stdin_null_flag = 1;
288 break;
5260325f 289 case 'x':
290 options.forward_x11 = 0;
291 break;
5260325f 292 case 'X':
293 options.forward_x11 = 1;
294 break;
d73a67d7 295 case 'Y':
296 options.forward_x11 = 1;
297 options.forward_x11_trusted = 1;
298 break;
5260325f 299 case 'g':
300 options.gateway_ports = 1;
301 break;
e59404d1 302 case 'P': /* deprecated */
5260325f 303 options.use_privileged_port = 0;
304 break;
5260325f 305 case 'a':
306 options.forward_agent = 0;
307 break;
71276795 308 case 'A':
309 options.forward_agent = 1;
310 break;
5260325f 311 case 'k':
f7926e97 312 options.gss_deleg_creds = 0;
5260325f 313 break;
5260325f 314 case 'i':
315 if (stat(optarg, &st) < 0) {
f5a1a01a 316 fprintf(stderr, "Warning: Identity file %s "
317 "does not exist.\n", optarg);
5260325f 318 break;
319 }
f5a1a01a 320 if (options.num_identity_files >=
321 SSH_MAX_IDENTITY_FILES)
322 fatal("Too many identity files specified "
323 "(max %d)", SSH_MAX_IDENTITY_FILES);
324 options.identity_files[options.num_identity_files++] =
325 xstrdup(optarg);
5260325f 326 break;
383546c4 327 case 'I':
328#ifdef SMARTCARD
9ff6f66f 329 options.smartcard_device = xstrdup(optarg);
dd2495cb 330#else
383546c4 331 fprintf(stderr, "no support for smartcards.\n");
dd2495cb 332#endif
383546c4 333 break;
5260325f 334 case 't':
8abcdba4 335 if (tty_flag)
336 force_tty_flag = 1;
5260325f 337 tty_flag = 1;
338 break;
5260325f 339 case 'v':
e053cd2c 340 if (debug_flag == 0) {
bcbf86ec 341 debug_flag = 1;
342 options.log_level = SYSLOG_LEVEL_DEBUG1;
e053cd2c 343 } else {
344 if (options.log_level < SYSLOG_LEVEL_DEBUG3)
345 options.log_level++;
bcbf86ec 346 break;
e053cd2c 347 }
bcbf86ec 348 /* fallthrough */
5260325f 349 case 'V':
e68225b2 350 fprintf(stderr,
c936c243 351 "%s, SSH protocols %d.%d/%d.%d, %s\n",
a8be9f80 352 SSH_VERSION,
353 PROTOCOL_MAJOR_1, PROTOCOL_MINOR_1,
e68225b2 354 PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2,
c936c243 355 SSLeay_version(SSLEAY_VERSION));
5260325f 356 if (opt == 'V')
357 exit(0);
5260325f 358 break;
5260325f 359 case 'q':
360 options.log_level = SYSLOG_LEVEL_QUIET;
361 break;
5260325f 362 case 'e':
363 if (optarg[0] == '^' && optarg[2] == 0 &&
f5a1a01a 364 (u_char) optarg[1] >= 64 &&
365 (u_char) optarg[1] < 128)
1e3b8b07 366 options.escape_char = (u_char) optarg[1] & 31;
5260325f 367 else if (strlen(optarg) == 1)
1e3b8b07 368 options.escape_char = (u_char) optarg[0];
5260325f 369 else if (strcmp(optarg, "none") == 0)
4bf9c10e 370 options.escape_char = SSH_ESCAPECHAR_NONE;
5260325f 371 else {
f5a1a01a 372 fprintf(stderr, "Bad escape character '%s'.\n",
373 optarg);
5260325f 374 exit(1);
375 }
376 break;
5260325f 377 case 'c':
a306f2dd 378 if (ciphers_valid(optarg)) {
379 /* SSH2 only */
380 options.ciphers = xstrdup(optarg);
d0c832f3 381 options.cipher = SSH_CIPHER_ILLEGAL;
a306f2dd 382 } else {
383 /* SSH1 only */
c523303b 384 options.cipher = cipher_number(optarg);
385 if (options.cipher == -1) {
f5a1a01a 386 fprintf(stderr,
387 "Unknown cipher type '%s'\n",
388 optarg);
a306f2dd 389 exit(1);
390 }
f5a1a01a 391 if (options.cipher == SSH_CIPHER_3DES)
c523303b 392 options.ciphers = "3des-cbc";
f5a1a01a 393 else if (options.cipher == SSH_CIPHER_BLOWFISH)
c523303b 394 options.ciphers = "blowfish-cbc";
f5a1a01a 395 else
c523303b 396 options.ciphers = (char *)-1;
5260325f 397 }
398 break;
b2552997 399 case 'm':
400 if (mac_valid(optarg))
401 options.macs = xstrdup(optarg);
402 else {
f5a1a01a 403 fprintf(stderr, "Unknown mac type '%s'\n",
404 optarg);
b2552997 405 exit(1);
406 }
407 break;
5260325f 408 case 'p':
2d2a2c65 409 options.port = a2port(optarg);
410 if (options.port == 0) {
6031af8d 411 fprintf(stderr, "Bad port '%s'\n", optarg);
412 exit(1);
413 }
5260325f 414 break;
5260325f 415 case 'l':
416 options.user = optarg;
417 break;
d2e3df16 418
419 case 'L':
5260325f 420 case 'R':
fa065de2 421 if (sscanf(optarg, "%5[0123456789]:%255[^:]:%5[0123456789]",
d2e3df16 422 sfwd_port, buf, sfwd_host_port) != 3 &&
fa065de2 423 sscanf(optarg, "%5[0123456789]/%255[^/]/%5[0123456789]",
d2e3df16 424 sfwd_port, buf, sfwd_host_port) != 3) {
f5a1a01a 425 fprintf(stderr,
d2e3df16 426 "Bad forwarding specification '%s'\n",
f5a1a01a 427 optarg);
5260325f 428 usage();
429 /* NOTREACHED */
430 }
d2e3df16 431 if ((fwd_port = a2port(sfwd_port)) == 0 ||
762715ce 432 (fwd_host_port = a2port(sfwd_host_port)) == 0) {
f5a1a01a 433 fprintf(stderr,
d2e3df16 434 "Bad forwarding port(s) '%s'\n", optarg);
435 exit(1);
5260325f 436 }
d2e3df16 437 if (opt == 'L')
438 add_local_forward(&options, fwd_port, buf,
439 fwd_host_port);
440 else if (opt == 'R')
441 add_remote_forward(&options, fwd_port, buf,
184eed6a 442 fwd_host_port);
5260325f 443 break;
0490e609 444
445 case 'D':
2d2a2c65 446 fwd_port = a2port(optarg);
447 if (fwd_port == 0) {
f5a1a01a 448 fprintf(stderr, "Bad dynamic port '%s'\n",
449 optarg);
6031af8d 450 exit(1);
451 }
37ba5172 452 add_local_forward(&options, fwd_port, "socks", 0);
0490e609 453 break;
454
5260325f 455 case 'C':
456 options.compression = 1;
457 break;
8ce64345 458 case 'N':
459 no_shell_flag = 1;
460 no_tty_flag = 1;
461 break;
8ce64345 462 case 'T':
463 no_tty_flag = 1;
464 break;
5260325f 465 case 'o':
466 dummy = 1;
1aafd17a 467 line = xstrdup(optarg);
f5a1a01a 468 if (process_config_line(&options, host ? host : "",
1aafd17a 469 line, "command-line", 0, &dummy) != 0)
5260325f 470 exit(1);
1aafd17a 471 xfree(line);
5260325f 472 break;
ae810de7 473 case 's':
474 subsystem_flag = 1;
475 break;
3435f5a6 476 case 'b':
477 options.bind_address = optarg;
478 break;
e591b98a 479 case 'F':
480 config = optarg;
481 break;
5260325f 482 default:
483 usage();
484 }
485 }
486
f5a1a01a 487 ac -= optind;
488 av += optind;
489
490 if (ac > 0 && !host && **av != '-') {
15748b4d 491 if (strrchr(*av, '@')) {
f5a1a01a 492 p = xstrdup(*av);
15748b4d 493 cp = strrchr(p, '@');
f5a1a01a 494 if (cp == NULL || cp == p)
495 usage();
496 options.user = p;
497 *cp = '\0';
498 host = ++cp;
499 } else
500 host = *av;
978ebf99 501 if (ac > 1) {
502 optind = optreset = 1;
f5a1a01a 503 goto again;
504 }
978ebf99 505 ac--, av++;
f5a1a01a 506 }
507
5260325f 508 /* Check that we got a host name. */
509 if (!host)
8efc0c15 510 usage();
5260325f 511
22d89d24 512 SSLeay_add_all_algorithms();
fa08c86b 513 ERR_load_crypto_strings();
22d89d24 514
5260325f 515 /* Initialize the command to execute on remote host. */
516 buffer_init(&command);
517
aa3378df 518 /*
519 * Save the command to execute on the remote host in a buffer. There
520 * is no limit on the length of the command, except by the maximum
521 * packet size. Also sets the tty flag if there is no command.
522 */
f5a1a01a 523 if (!ac) {
5260325f 524 /* No command specified - execute shell on a tty. */
525 tty_flag = 1;
ae810de7 526 if (subsystem_flag) {
f5a1a01a 527 fprintf(stderr,
528 "You must specify a subsystem to invoke.\n");
ae810de7 529 usage();
530 }
5260325f 531 } else {
f5a1a01a 532 /* A command has been specified. Store it into the buffer. */
533 for (i = 0; i < ac; i++) {
534 if (i)
5260325f 535 buffer_append(&command, " ", 1);
536 buffer_append(&command, av[i], strlen(av[i]));
537 }
8efc0c15 538 }
5260325f 539
540 /* Cannot fork to background if no command. */
14a9a859 541 if (fork_after_authentication_flag && buffer_len(&command) == 0 && !no_shell_flag)
5260325f 542 fatal("Cannot fork into background without a command to execute.");
543
544 /* Allocate a tty by default if no command specified. */
545 if (buffer_len(&command) == 0)
546 tty_flag = 1;
547
343288b8 548 /* Force no tty */
0b6fbf03 549 if (no_tty_flag)
550 tty_flag = 0;
5260325f 551 /* Do not allocate a tty if stdin is not a tty. */
8abcdba4 552 if (!isatty(fileno(stdin)) && !force_tty_flag) {
5260325f 553 if (tty_flag)
bbe88b6d 554 logit("Pseudo-terminal will not be allocated because stdin is not a terminal.");
5260325f 555 tty_flag = 0;
556 }
8ce64345 557
20244695 558 /*
559 * Initialize "log" output. Since we are the client all output
560 * actually goes to stderr.
561 */
cc44f691 562 log_init(av[0], options.log_level == -1 ? SYSLOG_LEVEL_INFO : options.log_level,
563 SYSLOG_FACILITY_USER, 1);
5260325f 564
e591b98a 565 /*
566 * Read per-user configuration file. Ignore the system wide config
567 * file if the user specifies a config file on the command line.
568 */
569 if (config != NULL) {
93111dfa 570 if (!read_config_file(config, host, &options))
571 fatal("Can't open user config file %.100s: "
572 "%.100s", config, strerror(errno));
e591b98a 573 } else {
574 snprintf(buf, sizeof buf, "%.100s/%.100s", pw->pw_dir,
575 _PATH_SSH_USER_CONFFILE);
f67792f2 576 (void)read_config_file(buf, host, &options);
e591b98a 577
f67792f2 578 /* Read systemwide configuration file after use config. */
93111dfa 579 (void)read_config_file(_PATH_HOST_CONFIG_FILE, host, &options);
e591b98a 580 }
5260325f 581
582 /* Fill configuration defaults. */
583 fill_default_options(&options);
584
1572b90f 585 channel_set_af(options.address_family);
586
5260325f 587 /* reinit */
20244695 588 log_init(av[0], options.log_level, SYSLOG_FACILITY_USER, 1);
5260325f 589
e339aa53 590 seed_rng();
591
5260325f 592 if (options.user == NULL)
593 options.user = xstrdup(pw->pw_name);
594
595 if (options.hostname != NULL)
596 host = options.hostname;
597
03c82656 598 /* force lowercase for hostkey matching */
599 if (options.host_key_alias != NULL) {
600 for (p = options.host_key_alias; *p; p++)
601 if (isupper(*p))
602 *p = tolower(*p);
603 }
604
f78bde70 605 if (options.proxy_command != NULL &&
606 strcmp(options.proxy_command, "none") == 0)
607 options.proxy_command = NULL;
608
6ffc9c88 609 /* Open a connection to the remote host. */
1572b90f 610 if (ssh_connect(host, &hostaddr, options.port,
611 options.address_family, options.connection_attempts,
d514c907 612#ifdef HAVE_CYGWIN
613 options.use_privileged_port,
614#else
3fb156df 615 original_effective_uid == 0 && options.use_privileged_port,
d514c907 616#endif
de60473e 617 options.proxy_command) != 0)
b34bec32 618 exit(1);
5260325f 619
aa3378df 620 /*
621 * If we successfully made the connection, load the host private key
622 * in case we will need it later for combined rsa-rhosts
623 * authentication. This must be done before releasing extra
624 * privileges, because the file is only readable by root.
78660ed4 625 * If we cannot access the private keys, load the public keys
626 * instead and try to execute the ssh-keysign helper instead.
aa3378df 627 */
8002af61 628 sensitive_data.nkeys = 0;
629 sensitive_data.keys = NULL;
39c00dc2 630 sensitive_data.external_keysign = 0;
b34bec32 631 if (options.rhosts_rsa_authentication ||
632 options.hostbased_authentication) {
8002af61 633 sensitive_data.nkeys = 3;
343288b8 634 sensitive_data.keys = xmalloc(sensitive_data.nkeys *
635 sizeof(Key));
3fb156df 636
637 PRIV_START;
8002af61 638 sensitive_data.keys[0] = key_load_private_type(KEY_RSA1,
aeaa3d9e 639 _PATH_HOST_KEY_FILE, "", NULL);
8002af61 640 sensitive_data.keys[1] = key_load_private_type(KEY_DSA,
641 _PATH_HOST_DSA_KEY_FILE, "", NULL);
642 sensitive_data.keys[2] = key_load_private_type(KEY_RSA,
643 _PATH_HOST_RSA_KEY_FILE, "", NULL);
3fb156df 644 PRIV_END;
39c00dc2 645
60cd0a97 646 if (options.hostbased_authentication == 1 &&
647 sensitive_data.keys[0] == NULL &&
39c00dc2 648 sensitive_data.keys[1] == NULL &&
649 sensitive_data.keys[2] == NULL) {
650 sensitive_data.keys[1] = key_load_public(
651 _PATH_HOST_DSA_KEY_FILE, NULL);
652 sensitive_data.keys[2] = key_load_public(
653 _PATH_HOST_RSA_KEY_FILE, NULL);
654 sensitive_data.external_keysign = 1;
655 }
5260325f 656 }
aa3378df 657 /*
658 * Get rid of any extra privileges that we may have. We will no
659 * longer need them. Also, extra privileges could make it very hard
660 * to read identity files and other non-world-readable files from the
661 * user's home directory if it happens to be on a NFS volume where
662 * root is mapped to nobody.
663 */
3fb156df 664 seteuid(original_real_uid);
665 setuid(original_real_uid);
5260325f 666
aa3378df 667 /*
668 * Now that we are back to our own permissions, create ~/.ssh
669 * directory if it doesn\'t already exist.
670 */
c3abff07 671 snprintf(buf, sizeof buf, "%.100s%s%.100s", pw->pw_dir, strcmp(pw->pw_dir, "/") ? "/" : "", _PATH_SSH_USER_DIR);
5260325f 672 if (stat(buf, &st) < 0)
704b1659 673 if (mkdir(buf, 0700) < 0)
5260325f 674 error("Could not create directory '%.200s'.", buf);
675
fee56204 676 /* load options.identity_files */
677 load_public_identity_files();
678
679 /* Expand ~ in known host file names. */
680 /* XXX mem-leaks: */
fa08c86b 681 options.system_hostfile =
682 tilde_expand_filename(options.system_hostfile, original_real_uid);
683 options.user_hostfile =
684 tilde_expand_filename(options.user_hostfile, original_real_uid);
685 options.system_hostfile2 =
686 tilde_expand_filename(options.system_hostfile2, original_real_uid);
687 options.user_hostfile2 =
688 tilde_expand_filename(options.user_hostfile2, original_real_uid);
5260325f 689
67b75437 690 signal(SIGPIPE, SIG_IGN); /* ignore SIGPIPE early */
691
5260325f 692 /* Log into the remote system. This never returns if the login fails. */
39c00dc2 693 ssh_login(&sensitive_data, host, (struct sockaddr *)&hostaddr, pw);
8002af61 694
695 /* We no longer need the private host keys. Clear them now. */
696 if (sensitive_data.nkeys != 0) {
697 for (i = 0; i < sensitive_data.nkeys; i++) {
698 if (sensitive_data.keys[i] != NULL) {
699 /* Destroys contents safely */
700 debug3("clear hostkey %d", i);
701 key_free(sensitive_data.keys[i]);
702 sensitive_data.keys[i] = NULL;
703 }
704 }
705 xfree(sensitive_data.keys);
706 }
05b7537a 707 for (i = 0; i < options.num_identity_files; i++) {
708 if (options.identity_files[i]) {
709 xfree(options.identity_files[i]);
710 options.identity_files[i] = NULL;
711 }
712 if (options.identity_keys[i]) {
713 key_free(options.identity_keys[i]);
714 options.identity_keys[i] = NULL;
715 }
716 }
5260325f 717
8ce64345 718 exit_status = compat20 ? ssh_session2() : ssh_session();
719 packet_close();
6939bbd4 720
721 /*
aff51935 722 * Send SIGHUP to proxy command if used. We don't wait() in
6939bbd4 723 * case it hangs and instead rely on init to reap the child
724 */
725 if (proxy_command_pid > 1)
726 kill(proxy_command_pid, SIGHUP);
727
8ce64345 728 return exit_status;
729}
730
d73a67d7 731#define SSH_X11_PROTO "MIT-MAGIC-COOKIE-1"
732
396c147e 733static void
b48eeb07 734x11_get_proto(char **_proto, char **_data)
0b242b12 735{
d73a67d7 736 char cmd[1024];
0b242b12 737 char line[512];
d73a67d7 738 char xdisplay[512];
b48eeb07 739 static char proto[512], data[512];
0b242b12 740 FILE *f;
d73a67d7 741 int got_data = 0, generated = 0, do_unlink = 0, i;
742 char *display, *xauthdir, *xauthfile;
5d185586 743 struct stat st;
0b242b12 744
d73a67d7 745 xauthdir = xauthfile = NULL;
b48eeb07 746 *_proto = proto;
747 *_data = data;
748 proto[0] = data[0] = '\0';
d73a67d7 749
5d185586 750 if (!options.xauth_location ||
751 (stat(options.xauth_location, &st) == -1)) {
752 debug("No xauth program.");
753 } else {
754 if ((display = getenv("DISPLAY")) == NULL) {
755 debug("x11_get_proto: DISPLAY not set");
756 return;
757 }
d73a67d7 758 /*
759 * Handle FamilyLocal case where $DISPLAY does
760 * not match an authorization entry. For this we
761 * just try "xauth list unix:displaynum.screennum".
762 * XXX: "localhost" match to determine FamilyLocal
763 * is not perfect.
764 */
765 if (strncmp(display, "localhost:", 10) == 0) {
766 snprintf(xdisplay, sizeof(xdisplay), "unix:%s",
767 display + 10);
768 display = xdisplay;
769 }
770 if (options.forward_x11_trusted == 0) {
771 xauthdir = xmalloc(MAXPATHLEN);
772 xauthfile = xmalloc(MAXPATHLEN);
773 strlcpy(xauthdir, "/tmp/ssh-XXXXXXXXXX", MAXPATHLEN);
774 if (mkdtemp(xauthdir) != NULL) {
775 do_unlink = 1;
776 snprintf(xauthfile, MAXPATHLEN, "%s/xauthfile",
777 xauthdir);
778 snprintf(cmd, sizeof(cmd),
779 "%s -f %s generate %s " SSH_X11_PROTO
780 " untrusted timeout 120 2>" _PATH_DEVNULL,
781 options.xauth_location, xauthfile, display);
782 debug2("x11_get_proto: %s", cmd);
783 if (system(cmd) == 0)
784 generated = 1;
785 }
786 }
787 snprintf(cmd, sizeof(cmd),
788 "%s %s%s list %s . 2>" _PATH_DEVNULL,
789 options.xauth_location,
790 generated ? "-f " : "" ,
791 generated ? xauthfile : "",
792 display);
793 debug2("x11_get_proto: %s", cmd);
794 f = popen(cmd, "r");
fa649821 795 if (f && fgets(line, sizeof(line), f) &&
b48eeb07 796 sscanf(line, "%*s %511s %511s", proto, data) == 2)
fa649821 797 got_data = 1;
798 if (f)
799 pclose(f);
800 }
d73a67d7 801
802 if (do_unlink) {
803 unlink(xauthfile);
804 rmdir(xauthdir);
805 }
806 if (xauthdir)
807 xfree(xauthdir);
808 if (xauthfile)
809 xfree(xauthfile);
810
0b242b12 811 /*
812 * If we didn't get authentication data, just make up some
813 * data. The forwarding code will check the validity of the
814 * response anyway, and substitute this data. The X11
815 * server, however, will ignore this fake data and use
816 * whatever authentication mechanisms it was using otherwise
817 * for the local connection.
818 */
819 if (!got_data) {
820 u_int32_t rand = 0;
821
d73a67d7 822 logit("Warning: No xauth data; "
823 "using fake authentication data for X11 forwarding.");
824 strlcpy(proto, SSH_X11_PROTO, sizeof proto);
0b242b12 825 for (i = 0; i < 16; i++) {
826 if (i % 4 == 0)
827 rand = arc4random();
d73a67d7 828 snprintf(data + 2 * i, sizeof data - 2 * i, "%02x",
829 rand & 0xff);
0b242b12 830 rand >>= 8;
831 }
832 }
833}
834
396c147e 835static void
fa08c86b 836ssh_init_forwarding(void)
837{
02a024dd 838 int success = 0;
fa08c86b 839 int i;
02a024dd 840
fa08c86b 841 /* Initiate local TCP/IP port forwardings. */
842 for (i = 0; i < options.num_local_forwards; i++) {
843 debug("Connections to local port %d forwarded to remote address %.200s:%d",
844 options.local_forwards[i].port,
845 options.local_forwards[i].host,
846 options.local_forwards[i].host_port);
5641aefa 847 success += channel_setup_local_fwd_listener(
fa08c86b 848 options.local_forwards[i].port,
849 options.local_forwards[i].host,
850 options.local_forwards[i].host_port,
851 options.gateway_ports);
852 }
02a024dd 853 if (i > 0 && success == 0)
854 error("Could not request local forwarding.");
fa08c86b 855
856 /* Initiate remote TCP/IP port forwardings. */
857 for (i = 0; i < options.num_remote_forwards; i++) {
858 debug("Connections to remote port %d forwarded to local address %.200s:%d",
859 options.remote_forwards[i].port,
860 options.remote_forwards[i].host,
861 options.remote_forwards[i].host_port);
862 channel_request_remote_forwarding(
863 options.remote_forwards[i].port,
864 options.remote_forwards[i].host,
865 options.remote_forwards[i].host_port);
866 }
867}
868
396c147e 869static void
fa08c86b 870check_agent_present(void)
871{
872 if (options.forward_agent) {
873 /* Clear agent forwarding if we don\'t have an agent. */
8b10e20e 874 if (!ssh_agent_present())
fa08c86b 875 options.forward_agent = 0;
fa08c86b 876 }
877}
878
396c147e 879static int
8ce64345 880ssh_session(void)
881{
882 int type;
8ce64345 883 int interactive = 0;
884 int have_tty = 0;
885 struct winsize ws;
8ce64345 886 char *cp;
887
5260325f 888 /* Enable compression if requested. */
889 if (options.compression) {
890 debug("Requesting compression at level %d.", options.compression_level);
891
892 if (options.compression_level < 1 || options.compression_level > 9)
893 fatal("Compression level must be from 1 (fast) to 9 (slow, best).");
894
895 /* Send the request. */
896 packet_start(SSH_CMSG_REQUEST_COMPRESSION);
897 packet_put_int(options.compression_level);
898 packet_send();
899 packet_write_wait();
54a5250f 900 type = packet_read();
5260325f 901 if (type == SSH_SMSG_SUCCESS)
902 packet_start_compression(options.compression_level);
903 else if (type == SSH_SMSG_FAILURE)
bbe88b6d 904 logit("Warning: Remote host refused compression.");
5260325f 905 else
906 packet_disconnect("Protocol error waiting for compression response.");
907 }
908 /* Allocate a pseudo tty if appropriate. */
909 if (tty_flag) {
910 debug("Requesting pty.");
911
912 /* Start the packet. */
913 packet_start(SSH_CMSG_REQUEST_PTY);
914
915 /* Store TERM in the packet. There is no limit on the
916 length of the string. */
917 cp = getenv("TERM");
918 if (!cp)
919 cp = "";
449c5ba5 920 packet_put_cstring(cp);
5260325f 921
922 /* Store window size in the packet. */
923 if (ioctl(fileno(stdin), TIOCGWINSZ, &ws) < 0)
924 memset(&ws, 0, sizeof(ws));
925 packet_put_int(ws.ws_row);
926 packet_put_int(ws.ws_col);
927 packet_put_int(ws.ws_xpixel);
928 packet_put_int(ws.ws_ypixel);
929
930 /* Store tty modes in the packet. */
30dcc918 931 tty_make_modes(fileno(stdin), NULL);
5260325f 932
933 /* Send the packet, and wait for it to leave. */
934 packet_send();
935 packet_write_wait();
936
937 /* Read response from the server. */
54a5250f 938 type = packet_read();
4fe2af09 939 if (type == SSH_SMSG_SUCCESS) {
5260325f 940 interactive = 1;
8ce64345 941 have_tty = 1;
4fe2af09 942 } else if (type == SSH_SMSG_FAILURE)
bbe88b6d 943 logit("Warning: Remote host failed or refused to allocate a pseudo tty.");
5260325f 944 else
945 packet_disconnect("Protocol error waiting for pty request response.");
946 }
947 /* Request X11 forwarding if enabled and DISPLAY is set. */
948 if (options.forward_x11 && getenv("DISPLAY") != NULL) {
b48eeb07 949 char *proto, *data;
0b242b12 950 /* Get reasonable local authentication information. */
b48eeb07 951 x11_get_proto(&proto, &data);
0b242b12 952 /* Request forwarding with authentication spoofing. */
5260325f 953 debug("Requesting X11 forwarding with authentication spoofing.");
0b242b12 954 x11_request_forwarding_with_spoofing(0, proto, data);
5260325f 955
956 /* Read response from the server. */
54a5250f 957 type = packet_read();
5260325f 958 if (type == SSH_SMSG_SUCCESS) {
5260325f 959 interactive = 1;
0b242b12 960 } else if (type == SSH_SMSG_FAILURE) {
bbe88b6d 961 logit("Warning: Remote host denied X11 forwarding.");
0b242b12 962 } else {
5260325f 963 packet_disconnect("Protocol error waiting for X11 forwarding");
0b242b12 964 }
5260325f 965 }
966 /* Tell the packet module whether this is an interactive session. */
b5c334cc 967 packet_set_interactive(interactive);
5260325f 968
969 /* Request authentication agent forwarding if appropriate. */
fa08c86b 970 check_agent_present();
971
5260325f 972 if (options.forward_agent) {
973 debug("Requesting authentication agent forwarding.");
974 auth_request_forwarding();
975
976 /* Read response from the server. */
54a5250f 977 type = packet_read();
95500969 978 packet_check_eom();
5260325f 979 if (type != SSH_SMSG_SUCCESS)
bbe88b6d 980 logit("Warning: Remote host denied authentication agent forwarding.");
5260325f 981 }
8efc0c15 982
fa08c86b 983 /* Initiate port forwardings. */
984 ssh_init_forwarding();
5260325f 985
aa3378df 986 /* If requested, let ssh continue in the background. */
6ae2364d 987 if (fork_after_authentication_flag)
aa3378df 988 if (daemon(1, 1) < 0)
989 fatal("daemon() failed: %.200s", strerror(errno));
990
991 /*
992 * If a command was specified on the command line, execute the
993 * command now. Otherwise request the server to start a shell.
994 */
5260325f 995 if (buffer_len(&command) > 0) {
996 int len = buffer_len(&command);
997 if (len > 900)
998 len = 900;
6c0fa2b1 999 debug("Sending command: %.*s", len, (u_char *)buffer_ptr(&command));
5260325f 1000 packet_start(SSH_CMSG_EXEC_CMD);
1001 packet_put_string(buffer_ptr(&command), buffer_len(&command));
1002 packet_send();
1003 packet_write_wait();
1004 } else {
1005 debug("Requesting shell.");
1006 packet_start(SSH_CMSG_EXEC_SHELL);
1007 packet_send();
1008 packet_write_wait();
1009 }
1010
1011 /* Enter the interactive session. */
4bf9c10e 1012 return client_loop(have_tty, tty_flag ?
1013 options.escape_char : SSH_ESCAPECHAR_NONE, 0);
8ce64345 1014}
5260325f 1015
396c147e 1016static void
7819b5c3 1017client_subsystem_reply(int type, u_int32_t seq, void *ctxt)
1f3bf5aa 1018{
1019 int id, len;
1020
1021 id = packet_get_int();
1022 len = buffer_len(&command);
ce91d6f8 1023 if (len > 900)
1024 len = 900;
95500969 1025 packet_check_eom();
1f3bf5aa 1026 if (type == SSH2_MSG_CHANNEL_FAILURE)
1027 fatal("Request for subsystem '%.*s' failed on channel %d",
6c0fa2b1 1028 len, (u_char *)buffer_ptr(&command), id);
1f3bf5aa 1029}
1030
e0ae8728 1031void
5d8d32a3 1032client_global_request_reply_fwd(int type, u_int32_t seq, void *ctxt)
e0ae8728 1033{
1034 int i;
1035
1036 i = client_global_request_id++;
5d8d32a3 1037 if (i >= options.num_remote_forwards)
e0ae8728 1038 return;
e0ae8728 1039 debug("remote forward %s for: listen %d, connect %s:%d",
1040 type == SSH2_MSG_REQUEST_SUCCESS ? "success" : "failure",
1041 options.remote_forwards[i].port,
1042 options.remote_forwards[i].host,
1043 options.remote_forwards[i].host_port);
1044 if (type == SSH2_MSG_REQUEST_FAILURE)
bbe88b6d 1045 logit("Warning: remote port forwarding failed for listen port %d",
e0ae8728 1046 options.remote_forwards[i].port);
1047}
1048
bcdb96c2 1049/* request pty/x11/agent/tcpfwd/shell for channel */
396c147e 1050static void
bcdb96c2 1051ssh_session2_setup(int id, void *arg)
8ce64345 1052{
1053 int len;
b5c334cc 1054 int interactive = 0;
30dcc918 1055 struct termios tio;
b5c334cc 1056
83bbc162 1057 debug2("ssh_session2_setup: id %d", id);
8ce64345 1058
8ce64345 1059 if (tty_flag) {
1060 struct winsize ws;
1061 char *cp;
1062 cp = getenv("TERM");
1063 if (!cp)
1064 cp = "";
1065 /* Store window size in the packet. */
1066 if (ioctl(fileno(stdin), TIOCGWINSZ, &ws) < 0)
1067 memset(&ws, 0, sizeof(ws));
1068
1069 channel_request_start(id, "pty-req", 0);
1070 packet_put_cstring(cp);
1071 packet_put_int(ws.ws_col);
1072 packet_put_int(ws.ws_row);
1073 packet_put_int(ws.ws_xpixel);
1074 packet_put_int(ws.ws_ypixel);
30dcc918 1075 tio = get_saved_tio();
1076 tty_make_modes(/*ignored*/ 0, &tio);
8ce64345 1077 packet_send();
b5c334cc 1078 interactive = 1;
8ce64345 1079 /* XXX wait for reply */
1080 }
0b242b12 1081 if (options.forward_x11 &&
1082 getenv("DISPLAY") != NULL) {
b48eeb07 1083 char *proto, *data;
0b242b12 1084 /* Get reasonable local authentication information. */
b48eeb07 1085 x11_get_proto(&proto, &data);
0b242b12 1086 /* Request forwarding with authentication spoofing. */
1087 debug("Requesting X11 forwarding with authentication spoofing.");
1088 x11_request_forwarding_with_spoofing(id, proto, data);
b5c334cc 1089 interactive = 1;
0b242b12 1090 /* XXX wait for reply */
1091 }
1092
fa08c86b 1093 check_agent_present();
1094 if (options.forward_agent) {
1095 debug("Requesting authentication agent forwarding.");
1096 channel_request_start(id, "auth-agent-req@openssh.com", 0);
1097 packet_send();
1098 }
1099
8ce64345 1100 len = buffer_len(&command);
1101 if (len > 0) {
1102 if (len > 900)
1103 len = 900;
ae810de7 1104 if (subsystem_flag) {
6c0fa2b1 1105 debug("Sending subsystem: %.*s", len, (u_char *)buffer_ptr(&command));
1f3bf5aa 1106 channel_request_start(id, "subsystem", /*want reply*/ 1);
1107 /* register callback for reply */
c242fc96 1108 /* XXX we assume that client_loop has already been called */
1f3bf5aa 1109 dispatch_set(SSH2_MSG_CHANNEL_FAILURE, &client_subsystem_reply);
1110 dispatch_set(SSH2_MSG_CHANNEL_SUCCESS, &client_subsystem_reply);
ae810de7 1111 } else {
6c0fa2b1 1112 debug("Sending command: %.*s", len, (u_char *)buffer_ptr(&command));
ae810de7 1113 channel_request_start(id, "exec", 0);
1114 }
ce91d6f8 1115 packet_put_string(buffer_ptr(&command), buffer_len(&command));
8ce64345 1116 packet_send();
1117 } else {
06ee33fb 1118 channel_request_start(id, "shell", 0);
1119 packet_send();
8ce64345 1120 }
1f3bf5aa 1121
b5c334cc 1122 packet_set_interactive(interactive);
8ce64345 1123}
1124
bcdb96c2 1125/* open new channel for a session */
396c147e 1126static int
bcdb96c2 1127ssh_session2_open(void)
8ce64345 1128{
719fc62f 1129 Channel *c;
1130 int window, packetmax, in, out, err;
2e73a022 1131
14a9a859 1132 if (stdin_null_flag) {
5ca51e19 1133 in = open(_PATH_DEVNULL, O_RDONLY);
14a9a859 1134 } else {
1135 in = dup(STDIN_FILENO);
1136 }
2e73a022 1137 out = dup(STDOUT_FILENO);
1138 err = dup(STDERR_FILENO);
8ce64345 1139
1140 if (in < 0 || out < 0 || err < 0)
14a9a859 1141 fatal("dup() in/out/err failed");
8ce64345 1142
a22aff1f 1143 /* enable nonblocking unless tty */
1144 if (!isatty(in))
1145 set_nonblock(in);
1146 if (!isatty(out))
1147 set_nonblock(out);
1148 if (!isatty(err))
1149 set_nonblock(err);
1150
bcbf86ec 1151 window = CHAN_SES_WINDOW_DEFAULT;
1152 packetmax = CHAN_SES_PACKET_DEFAULT;
ea9700ba 1153 if (tty_flag) {
1154 window >>= 1;
1155 packetmax >>= 1;
8ce64345 1156 }
719fc62f 1157 c = channel_new(
8ce64345 1158 "session", SSH_CHANNEL_OPENING, in, out, err,
bcbf86ec 1159 window, packetmax, CHAN_EXTENDED_WRITE,
0d942eff 1160 "client-session", /*nonblock*/0);
8ce64345 1161
bcdb96c2 1162 debug3("ssh_session2_open: channel_new: %d", c->self);
eb0dd41f 1163
36e1f6a1 1164 channel_send_open(c->self);
bcdb96c2 1165 if (!no_shell_flag)
05ca0898 1166 channel_register_confirm(c->self, ssh_session2_setup);
5260325f 1167
719fc62f 1168 return c->self;
eb0dd41f 1169}
1170
396c147e 1171static int
eb0dd41f 1172ssh_session2(void)
1173{
bcdb96c2 1174 int id = -1;
eb0dd41f 1175
1176 /* XXX should be pre-session */
1177 ssh_init_forwarding();
1178
bcdb96c2 1179 if (!no_shell_flag || (datafellows & SSH_BUG_DUMMYCHAN))
1180 id = ssh_session2_open();
eb0dd41f 1181
1182 /* If requested, let ssh continue in the background. */
1183 if (fork_after_authentication_flag)
1184 if (daemon(1, 1) < 0)
1185 fatal("daemon() failed: %.200s", strerror(errno));
1186
4bf9c10e 1187 return client_loop(tty_flag, tty_flag ?
1188 options.escape_char : SSH_ESCAPECHAR_NONE, id);
8efc0c15 1189}
fa08c86b 1190
396c147e 1191static void
fee56204 1192load_public_identity_files(void)
1193{
1194 char *filename;
2e23cde0 1195 int i = 0;
0659cace 1196 Key *public;
383546c4 1197#ifdef SMARTCARD
0659cace 1198 Key **keys;
1199
9ff6f66f 1200 if (options.smartcard_device != NULL &&
0659cace 1201 options.num_identity_files < SSH_MAX_IDENTITY_FILES &&
1202 (keys = sc_get_keys(options.smartcard_device, NULL)) != NULL ) {
1203 int count = 0;
1204 for (i = 0; keys[i] != NULL; i++) {
1205 count++;
0659cace 1206 memmove(&options.identity_files[1], &options.identity_files[0],
1207 sizeof(char *) * (SSH_MAX_IDENTITY_FILES - 1));
1208 memmove(&options.identity_keys[1], &options.identity_keys[0],
1209 sizeof(Key *) * (SSH_MAX_IDENTITY_FILES - 1));
1210 options.num_identity_files++;
1211 options.identity_keys[0] = keys[i];
244e796f 1212 options.identity_files[0] = sc_get_key_label(keys[i]);
0659cace 1213 }
1c2deed1 1214 if (options.num_identity_files > SSH_MAX_IDENTITY_FILES)
1215 options.num_identity_files = SSH_MAX_IDENTITY_FILES;
0659cace 1216 i = count;
1217 xfree(keys);
383546c4 1218 }
3e984472 1219#endif /* SMARTCARD */
2e23cde0 1220 for (; i < options.num_identity_files; i++) {
1221 filename = tilde_expand_filename(options.identity_files[i],
1222 original_real_uid);
1223 public = key_load_public(filename, NULL);
1224 debug("identity file %s type %d", filename,
1225 public ? public->type : -1);
1226 xfree(options.identity_files[i]);
1227 options.identity_files[i] = filename;
1228 options.identity_keys[i] = public;
1229 }
fee56204 1230}
This page took 0.455034 seconds and 5 git commands to generate.