- markus@cvs.openbsd.org 2005/07/25 11:59:40

[openssh.git] / sshd.c

diff --git a/sshd.c b/sshd.c
index 76aec80b0b5a7279c242396c0777d22623490bf4..92aa9bbd21501e3b17657c869d227babf8778696 100644 (file)
--- a/sshd.c
+++ b/sshd.c
@@ -42,7 +42,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: sshd.c,v 1.306 2005/01/17 22:48:39 dtucker Exp $");
+RCSID("$OpenBSD: sshd.c,v 1.312 2005/07/25 11:59:40 markus Exp $");
 
 #include <openssl/dh.h>
 #include <openssl/bn.h>
@@ -358,7 +358,8 @@ key_regeneration_alarm(int sig)
 static void
 sshd_exchange_identification(int sock_in, int sock_out)
 {
-       int i, mismatch;
+       u_int i;
+       int mismatch;
        int remote_major, remote_minor;
        int major, minor;
        char *s;
@@ -670,6 +671,12 @@ privsep_postauth(Authctxt *authctxt)
 
        /* It is safe now to apply the key state */
        monitor_apply_keystate(pmonitor);
+
+       /*
+        * Tell the packet layer that authentication was successful, since
+        * this information is not part of the key state.
+        */
+       packet_set_authenticated();
 }
 
 static char *
@@ -1030,13 +1037,13 @@ main(int ac, char **av)
            SYSLOG_FACILITY_AUTH : options.log_facility,
            log_stderr || !inetd_flag);
 
-#ifdef _AIX
        /*
         * Unset KRB5CCNAME, otherwise the user's session may inherit it from
         * root's environment
-        */ 
-       unsetenv("KRB5CCNAME");
-#endif /* _AIX */
+        */
+       if (getenv("KRB5CCNAME") != NULL)
+               unsetenv("KRB5CCNAME");
+
 #ifdef _UNICOS
        /* Cray can define user privs drop all privs now!
         * Not needed on PRIV_SU systems!
@@ -1268,10 +1275,12 @@ main(int ac, char **av)
                        if (num_listen_socks >= MAX_LISTEN_SOCKS)
                                fatal("Too many listen sockets. "
                                    "Enlarge MAX_LISTEN_SOCKS");
-                       if (getnameinfo(ai->ai_addr, ai->ai_addrlen,
+                       if ((ret = getnameinfo(ai->ai_addr, ai->ai_addrlen,
                            ntop, sizeof(ntop), strport, sizeof(strport),
-                           NI_NUMERICHOST|NI_NUMERICSERV) != 0) {
-                               error("getnameinfo failed");
+                           NI_NUMERICHOST|NI_NUMERICSERV)) != 0) {
+                               error("getnameinfo failed: %.100s",
+                                   (ret != EAI_SYSTEM) ? gai_strerror(ret) :
+                                   strerror(errno));
                                continue;
                        }
                        /* Create socket for listening. */
@@ -1613,21 +1622,27 @@ main(int ac, char **av)
        signal(SIGCHLD, SIG_DFL);
        signal(SIGINT, SIG_DFL);
 
-       /* Set SO_KEEPALIVE if requested. */
-       if (options.tcp_keep_alive &&
-           setsockopt(sock_in, SOL_SOCKET, SO_KEEPALIVE, &on,
-           sizeof(on)) < 0)
-               error("setsockopt SO_KEEPALIVE: %.100s", strerror(errno));
-
        /*
         * Register our connection.  This turns encryption off because we do
         * not have a key.
         */
        packet_set_connection(sock_in, sock_out);
+       packet_set_server();
 
-       remote_port = get_remote_port();
+       /* Set SO_KEEPALIVE if requested. */
+       if (options.tcp_keep_alive && packet_connection_is_on_socket() &&
+           setsockopt(sock_in, SOL_SOCKET, SO_KEEPALIVE, &on, sizeof(on)) < 0)
+               error("setsockopt SO_KEEPALIVE: %.100s", strerror(errno));
+
+       if ((remote_port = get_remote_port()) < 0) {
+               debug("get_remote_port failed");
+               cleanup_exit(255);
+       }
        remote_ip = get_remote_ipaddr();
 
+#ifdef SSH_AUDIT_EVENTS
+       audit_connection_from(remote_ip, remote_port);
+#endif
 #ifdef LIBWRAP
        /* Check whether logins are denied from this host. */
        if (packet_connection_is_on_socket()) {
@@ -1664,23 +1679,22 @@ main(int ac, char **av)
 
        packet_set_nonblocking();
 
-       /* prepare buffers to collect authentication messages */
-       buffer_init(&loginmsg);
-
        /* allocate authentication context */
        authctxt = xmalloc(sizeof(*authctxt));
        memset(authctxt, 0, sizeof(*authctxt));
 
+       authctxt->loginmsg = &loginmsg;
+
        /* XXX global for cleanup, access from other modules */
        the_authctxt = authctxt;
 
+       /* prepare buffer to collect messages to display to user after login */
+       buffer_init(&loginmsg);
+
        if (use_privsep)
                if (privsep_preauth(authctxt) == 1)
                        goto authenticated;
 
-       /* prepare buffer to collect messages to display to user after login */
-       buffer_init(&loginmsg);
-
        /* perform the key exchange */
        /* authenticate user and start session */
        if (compat20) {
@@ -1700,6 +1714,10 @@ main(int ac, char **av)
        }
 
  authenticated:
+#ifdef SSH_AUDIT_EVENTS
+       audit_event(SSH_AUTH_SUCCESS);
+#endif
+
        /*
         * In privilege separation, we fork another child and prepare
         * file descriptor passing.
@@ -1722,6 +1740,10 @@ main(int ac, char **av)
                finish_pam();
 #endif /* USE_PAM */
 
+#ifdef SSH_AUDIT_EVENTS
+       PRIVSEP(audit_event(SSH_CONNECTION_CLOSE));
+#endif
+
        packet_close();
 
        if (use_privsep)
@@ -1886,7 +1908,7 @@ do_ssh1_kex(void)
        if (!rsafail) {
                BN_mask_bits(session_key_int, sizeof(session_key) * 8);
                len = BN_num_bytes(session_key_int);
-               if (len < 0 || len > sizeof(session_key)) {
+               if (len < 0 || (u_int)len > sizeof(session_key)) {
                        error("do_connection: bad session key len from %s: "
                            "session_key_int %d > sizeof(session_key) %lu",
                            get_remote_ipaddr(), len, (u_long)sizeof(session_key));
@@ -1973,10 +1995,14 @@ do_ssh2_kex(void)
                myproposal[PROPOSAL_MAC_ALGS_CTOS] =
                myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
        }
-       if (!options.compression) {
+       if (options.compression == COMP_NONE) {
                myproposal[PROPOSAL_COMP_ALGS_CTOS] =
                myproposal[PROPOSAL_COMP_ALGS_STOC] = "none";
+       } else if (options.compression == COMP_DELAYED) {
+               myproposal[PROPOSAL_COMP_ALGS_CTOS] =
+               myproposal[PROPOSAL_COMP_ALGS_STOC] = "none,zlib@openssh.com";
        }
+       
        myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = list_hostkey_types();
 
        /* start key exchange */
@@ -2013,5 +2039,10 @@ cleanup_exit(int i)
 {
        if (the_authctxt)
                do_cleanup(the_authctxt);
+#ifdef SSH_AUDIT_EVENTS
+       /* done after do_cleanup so it can cancel the PAM auth 'thread' */
+       if (!use_privsep || mm_is_monitor())
+               audit_event(SSH_CONNECTION_ABANDON);
+#endif
        _exit(i);
 }