*/
#include "includes.h"
-RCSID("$OpenBSD: sshd.c,v 1.205 2001/10/01 21:38:53 markus Exp $");
+RCSID("$OpenBSD: sshd.c,v 1.215 2001/12/06 13:30:06 markus Exp $");
#include <openssl/dh.h>
#include <openssl/bn.h>
#include "auth.h"
#include "misc.h"
#include "dispatch.h"
+#include "channels.h"
#ifdef LIBWRAP
#include <tcpd.h>
* Flag indicating whether the RSA server key needs to be regenerated.
* Is set in the SIGALRM handler and cleared when the key is regenerated.
*/
-int key_do_regen = 0;
+static volatile sig_atomic_t key_do_regen = 0;
/* This is set to true when a signal is received. */
-int received_sighup = 0;
-int received_sigterm = 0;
+static volatile sig_atomic_t received_sighup = 0;
+static volatile sig_atomic_t received_sigterm = 0;
/* session identifier, used by RSA-auth */
u_char session_id[16];
/* record remote hostname or ip */
u_int utmp_len = MAXHOSTNAMELEN;
+/* options.max_startup sized array of fd ints */
+int *startup_pipes = NULL;
+int startup_pipe; /* in child */
+
/* Prototypes for various functions defined later in this file. */
void destroy_sensitive_data(void);
num_listen_socks = -1;
}
+static void
+close_startup_pipes(void)
+{
+ int i;
+ if (startup_pipes)
+ for (i = 0; i < options.max_startups; i++)
+ if (startup_pipes[i] != -1)
+ close(startup_pipes[i]);
+}
+
/*
* Signal handler for SIGHUP. Sshd execs itself when it receives SIGHUP;
* the effect is to reread the configuration file (and to regenerate
static void
sighup_handler(int sig)
{
+ int save_errno = errno;
+
received_sighup = 1;
signal(SIGHUP, sighup_handler);
+ errno = save_errno;
}
/*
{
log("Received SIGHUP; restarting.");
close_listen_socks();
+ close_startup_pipes();
execv(saved_argv[0], saved_argv);
log("RESTART FAILED: av[0]='%.100s', error: %.100s.", saved_argv[0], strerror(errno));
exit(1);
/* Send our protocol version identification. */
if (atomicio(write, sock_out, server_version_string, strlen(server_version_string))
!= strlen(server_version_string)) {
- log("Could not write ident string to %s.", get_remote_ipaddr());
+ log("Could not write ident string to %s", get_remote_ipaddr());
fatal_cleanup();
}
memset(buf, 0, sizeof(buf));
for (i = 0; i < sizeof(buf) - 1; i++) {
if (atomicio(read, sock_in, &buf[i], 1) != 1) {
- log("Did not receive identification string from %s.",
+ log("Did not receive identification string from %s",
get_remote_ipaddr());
fatal_cleanup();
}
}
mismatch = 0;
- switch(remote_major) {
+ switch (remote_major) {
case 1:
if (remote_minor == 99) {
if (options.protocol & SSH_PROTO_2)
Key *key = sensitive_data.host_keys[i];
if (key == NULL)
continue;
- switch(key->type) {
+ switch (key->type) {
case KEY_RSA:
case KEY_DSA:
strlcat(buf, key_ssh_name(key), sizeof buf);
return (r < p) ? 1 : 0;
}
-int *startup_pipes = NULL; /* options.max_startup sized array of fd ints */
-int startup_pipe; /* in child */
+static void
+usage(void)
+{
+ fprintf(stderr, "sshd version %s\n", SSH_VERSION);
+ fprintf(stderr, "Usage: %s [options]\n", __progname);
+ fprintf(stderr, "Options:\n");
+ fprintf(stderr, " -f file Configuration file (default %s)\n", _PATH_SERVER_CONFIG_FILE);
+ fprintf(stderr, " -d Debugging mode (multiple -d means more debugging)\n");
+ fprintf(stderr, " -i Started from inetd\n");
+ fprintf(stderr, " -D Do not fork into daemon mode\n");
+ fprintf(stderr, " -t Only test configuration file and keys\n");
+ fprintf(stderr, " -q Quiet (no logging)\n");
+ fprintf(stderr, " -p port Listen on the specified port (default: 22)\n");
+ fprintf(stderr, " -k seconds Regenerate server key every this many seconds (default: 3600)\n");
+ fprintf(stderr, " -g seconds Grace period for authentication (default: 600)\n");
+ fprintf(stderr, " -b bits Size of server RSA key (default: 768 bits)\n");
+ fprintf(stderr, " -h file File from which to read host key (default: %s)\n",
+ _PATH_HOST_KEY_FILE);
+ fprintf(stderr, " -u len Maximum hostname length for utmp recording\n");
+ fprintf(stderr, " -4 Use IPv4 only\n");
+ fprintf(stderr, " -6 Use IPv6 only\n");
+ fprintf(stderr, " -o option Process the option as if it was read from a configuration file.\n");
+ exit(1);
+}
/*
* Main program for the daemon.
initialize_server_options(&options);
/* Parse command-line arguments. */
- while ((opt = getopt(ac, av, "f:p:b:k:h:g:V:u:dDeiqtQ46")) != -1) {
+ while ((opt = getopt(ac, av, "f:p:b:k:h:g:V:u:o:dDeiqtQ46")) != -1) {
switch (opt) {
case '4':
IPv4or6 = AF_INET;
case 'u':
utmp_len = atoi(optarg);
break;
+ case 'o':
+ if (process_server_config_line(&options, optarg,
+ "command-line", 0) != 0)
+ exit(1);
+ break;
case '?':
default:
- fprintf(stderr, "sshd version %s\n", SSH_VERSION);
- fprintf(stderr, "Usage: %s [options]\n", __progname);
- fprintf(stderr, "Options:\n");
- fprintf(stderr, " -f file Configuration file (default %s)\n", _PATH_SERVER_CONFIG_FILE);
- fprintf(stderr, " -d Debugging mode (multiple -d means more debugging)\n");
- fprintf(stderr, " -i Started from inetd\n");
- fprintf(stderr, " -D Do not fork into daemon mode\n");
- fprintf(stderr, " -t Only test configuration file and keys\n");
- fprintf(stderr, " -q Quiet (no logging)\n");
- fprintf(stderr, " -p port Listen on the specified port (default: 22)\n");
- fprintf(stderr, " -k seconds Regenerate server key every this many seconds (default: 3600)\n");
- fprintf(stderr, " -g seconds Grace period for authentication (default: 600)\n");
- fprintf(stderr, " -b bits Size of server RSA key (default: 768 bits)\n");
- fprintf(stderr, " -h file File from which to read host key (default: %s)\n",
- _PATH_HOST_KEY_FILE);
- fprintf(stderr, " -u len Maximum hostname length for utmp recording\n");
- fprintf(stderr, " -4 Use IPv4 only\n");
- fprintf(stderr, " -6 Use IPv6 only\n");
- exit(1);
+ usage();
+ break;
}
}
SSLeay_add_all_algorithms();
sensitive_data.host_keys[i] = NULL;
continue;
}
- switch(key->type){
+ switch (key->type) {
case KEY_RSA1:
sensitive_data.ssh1_host_key = key;
sensitive_data.have_ssh1_key = 1;
error("select: %.100s", strerror(errno));
if (received_sigterm) {
log("Received signal %d; terminating.",
- received_sigterm);
+ (int) received_sigterm);
close_listen_socks();
unlink(options.pid_file);
exit(255);
* the connection.
*/
startup_pipe = startup_p[1];
- for (j = 0; j < options.max_startups; j++)
- if (startup_pipes[j] != -1)
- close(startup_pipes[j]);
+ close_startup_pipes();
close_listen_socks();
sock_in = newsock;
sock_out = newsock;
remote_port = get_remote_port();
remote_ip = get_remote_ipaddr();
- /* Check whether logins are denied from this host. */
#ifdef LIBWRAP
- /* XXX LIBWRAP noes not know about IPv6 */
+ /* Check whether logins are denied from this host. */
{
struct request_info req;
fromhost(&req);
if (!hosts_access(&req)) {
+ debug("Connection refused by tcp wrapper");
refuse(&req);
- close(sock_in);
- close(sock_out);
+ /* NOTREACHED */
+ fatal("libwrap refuse returns");
}
-/*XXX IPv6 verbose("Connection from %.500s port %d", eval_client(&req), remote_port); */
}
#endif /* LIBWRAP */
+
/* Log the connection. */
verbose("Connection from %.500s port %d", remote_ip, remote_port);
if (remote_port >= IPPORT_RESERVED ||
remote_port < IPPORT_RESERVED / 2) {
debug("Rhosts Authentication disabled, "
- "originating port not trusted.");
+ "originating port %d not trusted.", remote_port);
options.rhosts_authentication = 0;
}
#if defined(KRB4) && !defined(KRB5)
andersk / openssh.git / blobdiff