- provos@cvs.openbsd.org 2000/12/15 10:30:15

[openssh.git] / sshd.c

diff --git a/sshd.c b/sshd.c
index 4bd0cbe88bee3f12c9c5cca0c8bd6a54de4f088d..b5d66acdb7a90d16dc556e033f8a1894e940ca45 100644 (file)
--- a/sshd.c
+++ b/sshd.c
@@ -40,7 +40,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: sshd.c,v 1.136 2000/12/05 16:47:28 todd Exp $");
+RCSID("$OpenBSD: sshd.c,v 1.139 2000/12/15 17:30:14 provos Exp $");
 
 #include "xmalloc.h"
 #include "rsa.h"
@@ -117,9 +117,6 @@ int no_daemon_flag = 0;
 /* debug goes to stderr unless inetd_flag is set */
 int log_stderr = 0;
 
-/* argv[0] without path. */
-char *av0;
-
 /* Saved arguments to main(). */
 char **saved_argv;
 int saved_argc;
@@ -215,7 +212,7 @@ sighup_restart()
        log("Received SIGHUP; restarting.");
        close_listen_socks();
        execv(saved_argv[0], saved_argv);
-       log("RESTART FAILED: av0='%s', error: %s.", av0, strerror(errno));
+       log("RESTART FAILED: av[0]='%.100s', error: %.100s.", saved_argv[0], strerror(errno));
        exit(1);
 }
 
@@ -574,13 +571,9 @@ main(int ac, char **av)
        __progname = get_progname(av[0]);
        init_rng();
 
-       /* Save argv[0]. */
+       /* Save argv. */
        saved_argc = ac;
        saved_argv = av;
-       if (strchr(av[0], '/'))
-               av0 = strrchr(av[0], '/') + 1;
-       else
-               av0 = av[0];
 
        /* Initialize configuration options to their default values. */
        initialize_server_options(&options);
@@ -655,7 +648,7 @@ main(int ac, char **av)
                case '?':
                default:
                        fprintf(stderr, "sshd version %s\n", SSH_VERSION);
-                       fprintf(stderr, "Usage: %s [options]\n", av0);
+                       fprintf(stderr, "Usage: %s [options]\n", __progname);
                        fprintf(stderr, "Options:\n");
                        fprintf(stderr, "  -f file    Configuration file (default %s)\n", SERVER_CONFIG_FILE);
                        fprintf(stderr, "  -d         Debugging mode (multiple -d means more debugging)\n");
@@ -678,7 +671,7 @@ main(int ac, char **av)
         * Force logging to stderr until we have loaded the private host
         * key (unless started from inetd)
         */
-       log_init(av0,
+       log_init(__progname,
            options.log_level == -1 ? SYSLOG_LEVEL_INFO : options.log_level,
            options.log_facility == -1 ? SYSLOG_FACILITY_AUTH : options.log_facility,
            !silent && !inetd_flag);
@@ -768,7 +761,7 @@ main(int ac, char **av)
        /* Initialize the log (it is reinitialized below in case we forked). */
        if (debug_flag && !inetd_flag)
                log_stderr = 1;
-       log_init(av0, options.log_level, options.log_facility, log_stderr);
+       log_init(__progname, options.log_level, options.log_facility, log_stderr);
 
        /*
         * If not in debugging mode, and not started from inetd, disconnect
@@ -792,7 +785,7 @@ main(int ac, char **av)
 #endif /* TIOCNOTTY */
        }
        /* Reinitialize the log (because of the fork above). */
-       log_init(av0, options.log_level, options.log_facility, log_stderr);
+       log_init(__progname, options.log_level, options.log_facility, log_stderr);
 
        /* Initialize the random number generator. */
        arc4random_stir();
@@ -1031,7 +1024,7 @@ main(int ac, char **av)
                                                close_listen_socks();
                                                sock_in = newsock;
                                                sock_out = newsock;
-                                               log_init(av0, options.log_level, options.log_facility, log_stderr);
+                                               log_init(__progname, options.log_level, options.log_facility, log_stderr);
                                                break;
                                        }
                                }
@@ -1098,7 +1091,7 @@ main(int ac, char **av)
        {
                struct request_info req;
 
-               request_init(&req, RQ_DAEMON, av0, RQ_FILE, sock_in, NULL);
+               request_init(&req, RQ_DAEMON, __progname, RQ_FILE, sock_in, NULL);
                fromhost(&req);
 
                if (!hosts_access(&req)) {
@@ -1126,18 +1119,17 @@ main(int ac, char **av)
 
        sshd_exchange_identification(sock_in, sock_out);
        /*
-        * Check that the connection comes from a privileged port.  Rhosts-
-        * and Rhosts-RSA-Authentication only make sense from priviledged
+        * Check that the connection comes from a privileged port.
+        * Rhosts-Authentication only makes sense from priviledged
         * programs.  Of course, if the intruder has root access on his local
         * machine, he can connect from any port.  So do not use these
         * authentication methods from machines that you do not trust.
         */
        if (remote_port >= IPPORT_RESERVED ||
            remote_port < IPPORT_RESERVED / 2) {
-               debug("Rhosts Authentication methods disabled, "
+               debug("Rhosts Authentication disabled, "
                    "originating port not trusted.");
                options.rhosts_authentication = 0;
-               options.rhosts_rsa_authentication = 0;
        }
 #ifdef KRB4
        if (!packet_connection_is_ipv4() &&
@@ -1460,6 +1452,10 @@ ssh_dh1_server(Kex *kex, Buffer *client_kexinit, Buffer *server_kexinit)
                fatal("Unsupported hostkey type %d", kex->hostkey_type);
 
 /* KEXDH */
+       /* generate DH key */
+       dh = dh_new_group1();                   /* XXX depends on 'kex' */
+       dh_gen_key(dh);
+
        debug("Wait SSH2_MSG_KEXDH_INIT.");
        packet_read_expect(&payload_len, SSH2_MSG_KEXDH_INIT);
 
@@ -1476,9 +1472,6 @@ ssh_dh1_server(Kex *kex, Buffer *client_kexinit, Buffer *server_kexinit)
        debug("bits %d", BN_num_bits(dh_client_pub));
 #endif
 
-       /* generate DH key */
-       dh = dh_new_group1();                   /* XXX depends on 'kex' */
-
 #ifdef DEBUG_KEXDH
        fprintf(stderr, "\np= ");
        BN_print_fp(stderr, dh->p);
@@ -1600,6 +1593,10 @@ ssh_dhgex_server(Kex *kex, Buffer *client_kexinit, Buffer *server_kexinit)
        packet_send();
        packet_write_wait();
 
+       /* Compute our exchange value in parallel with the client */
+
+       dh_gen_key(dh);
+
        debug("Wait SSH2_MSG_KEX_DH_GEX_INIT.");
        packet_read_expect(&payload_len, SSH2_MSG_KEX_DH_GEX_INIT);