- deraadt@cvs.openbsd.org 2006/03/19 18:53:12

[openssh.git] / sshd.c

diff --git a/sshd.c b/sshd.c
index e9125a2294f73327e7017b6a72c37523e7914f74..e6b1f5496656aa94d4204f32a693d014be5f24b7 100644 (file)
--- a/sshd.c
+++ b/sshd.c
@@ -42,7 +42,18 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: sshd.c,v 1.312 2005/07/25 11:59:40 markus Exp $");
+
+#include <sys/types.h>
+#ifdef HAVE_SYS_STAT_H
+# include <sys/stat.h>
+#endif
+#include <sys/ioctl.h>
+#include <sys/wait.h>
+
+#ifdef HAVE_PATHS_H
+#include <paths.h>
+#endif
+#include <signal.h>
 
 #include <openssl/dh.h>
 #include <openssl/bn.h>
@@ -633,16 +644,8 @@ privsep_postauth(Authctxt *authctxt)
        if (authctxt->pw->pw_uid == 0 || options.use_login) {
 #endif
                /* File descriptor passing is broken or root login */
-               monitor_apply_keystate(pmonitor);
                use_privsep = 0;
-               return;
-       }
-
-       /* Authentication complete */
-       alarm(0);
-       if (startup_pipe != -1) {
-               close(startup_pipe);
-               startup_pipe = -1;
+               goto skip;
        }
 
        /* New socket pair */
@@ -669,6 +672,7 @@ privsep_postauth(Authctxt *authctxt)
        /* Drop privileges */
        do_setusercontext(authctxt->pw);
 
+ skip:
        /* It is safe now to apply the key state */
        monitor_apply_keystate(pmonitor);
 
@@ -924,6 +928,9 @@ main(int ac, char **av)
        if (geteuid() == 0 && setgroups(0, NULL) == -1)
                debug("setgroups(): %.200s", strerror(errno));
 
+       /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
+       sanitise_stdfd();
+
        /* Initialize configuration options to their default values. */
        initialize_server_options(&options);
 
@@ -1327,10 +1334,10 @@ main(int ac, char **av)
                        num_listen_socks++;
 
                        /* Start listening on the port. */
-                       logit("Server listening on %s port %s.", ntop, strport);
                        if (listen(listen_sock, SSH_LISTEN_BACKLOG) < 0)
-                               fatal("listen: %.100s", strerror(errno));
-
+                               fatal("listen on [%s]:%s: %.100s",
+                                   ntop, strport, strerror(errno));
+                       logit("Server listening on %s port %s.", ntop, strport);
                }
                freeaddrinfo(options.listen_addrs);
 
@@ -1648,7 +1655,12 @@ main(int ac, char **av)
                debug("get_remote_port failed");
                cleanup_exit(255);
        }
-       remote_ip = get_remote_ipaddr();
+
+       /*
+        * We use get_canonical_hostname with usedns = 0 instead of
+        * get_remote_ipaddr here so IP options will be checked.
+        */
+       remote_ip = get_canonical_hostname(0);
 
 #ifdef SSH_AUDIT_EVENTS
        audit_connection_from(remote_ip, remote_port);
@@ -1674,10 +1686,10 @@ main(int ac, char **av)
        verbose("Connection from %.500s port %d", remote_ip, remote_port);
 
        /*
-        * We don\'t want to listen forever unless the other side
+        * We don't want to listen forever unless the other side
         * successfully authenticates itself.  So we set up an alarm which is
         * cleared after successful authentication.  A limit of zero
-        * indicates no limit. Note that we don\'t set the alarm in debugging
+        * indicates no limit. Note that we don't set the alarm in debugging
         * mode; it is just annoying to have the server exit just when you
         * are about to discover the bug.
         */
@@ -1724,6 +1736,17 @@ main(int ac, char **av)
        }
 
  authenticated:
+       /*
+        * Cancel the alarm we set to limit the time taken for
+        * authentication.
+        */
+       alarm(0);
+       signal(SIGALRM, SIG_DFL);
+       if (startup_pipe != -1) {
+               close(startup_pipe);
+               startup_pipe = -1;
+       }
+
 #ifdef SSH_AUDIT_EVENTS
        audit_event(SSH_AUTH_SUCCESS);
 #endif
@@ -2020,6 +2043,7 @@ do_ssh2_kex(void)
        kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server;
        kex->kex[KEX_DH_GRP14_SHA1] = kexdh_server;
        kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
+       kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
        kex->server = 1;
        kex->client_version_string=client_version_string;
        kex->server_version_string=server_version_string;