- (bal) Missed two files in major resync. auth-bsdauth.c and auth-skey.c

[openssh.git] / sshd.c

diff --git a/sshd.c b/sshd.c
index c54675962188c30316dc40c62c2e3d097a01e4ff..1dfcac0d7fb75ea75bbe7e6a982338902e8c06a9 100644 (file)
--- a/sshd.c
+++ b/sshd.c
@@ -40,7 +40,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: sshd.c,v 1.186 2001/04/03 19:53:29 markus Exp $");
+RCSID("$OpenBSD: sshd.c,v 1.199 2001/06/04 23:07:21 markus Exp $");
 
 #include <openssl/dh.h>
 #include <openssl/bn.h>
@@ -141,6 +141,9 @@ int num_listen_socks = 0;
 char *client_version_string = NULL;
 char *server_version_string = NULL;
 
+/* for rekeying XXX fixme */
+Kex *xxx_kex;
+
 /*
  * Any really sensitive data in the application is contained in this
  * structure. The idea is that this structure could be locked into memory so
@@ -164,8 +167,9 @@ struct {
  */
 int key_do_regen = 0;
 
-/* This is set to true when SIGHUP is received. */
+/* This is set to true when a signal is received. */
 int received_sighup = 0;
+int received_sigterm = 0;
 
 /* session identifier, used by RSA-auth */
 u_char session_id[16];
@@ -224,21 +228,16 @@ sighup_restart(void)
 
 /*
  * Generic signal handler for terminating signals in the master daemon.
- * These close the listen socket; not closing it seems to cause "Address
- * already in use" problems on some machines, which is inconvenient.
  */
 void
 sigterm_handler(int sig)
 {
-       log("Received signal %d; terminating.", sig);
-       close_listen_socks();
-       unlink(options.pid_file);
-       exit(255);
+       received_sigterm = sig;
 }
 
 /*
  * SIGCHLD handler.  This is called whenever a child dies.  This will then
- * reap any zombies left by exited c.
+ * reap any zombies left by exited children.
  */
 void
 main_sigchld_handler(int sig)
@@ -259,6 +258,8 @@ main_sigchld_handler(int sig)
 void
 grace_alarm_handler(int sig)
 {
+       /* XXX no idea how fix this signal handler */
+
        /* Close the connection. */
        packet_close();
 
@@ -279,11 +280,11 @@ generate_ephemeral_server_key(void)
        u_int32_t rand = 0;
        int i;
 
-       verbose("Generating %s%d bit RSA key.", 
+       verbose("Generating %s%d bit RSA key.",
            sensitive_data.server_key ? "new " : "", options.server_key_bits);
        if (sensitive_data.server_key != NULL)
                key_free(sensitive_data.server_key);
-       sensitive_data.server_key = key_generate(KEY_RSA1, 
+       sensitive_data.server_key = key_generate(KEY_RSA1,
            options.server_key_bits);
        verbose("RSA key generation complete.");
 
@@ -338,7 +339,7 @@ sshd_exchange_identification(int sock_in, int sock_out)
                }
 
                /* Read other side's version identification. */
-               memset(buf, 0, sizeof(buf)); 
+               memset(buf, 0, sizeof(buf));
                for (i = 0; i < sizeof(buf) - 1; i++) {
                        if (atomicio(read, sock_in, &buf[i], 1) != 1) {
                                log("Did not receive identification string from %s.",
@@ -432,8 +433,6 @@ sshd_exchange_identification(int sock_in, int sock_out)
                    server_version_string, client_version_string);
                fatal_cleanup();
        }
-       if (compat20)
-               packet_set_ssh2_format();
 }
 
 
@@ -562,7 +561,7 @@ main(int ac, char **av)
        initialize_server_options(&options);
 
        /* Parse command-line arguments. */
-       while ((opt = getopt(ac, av, "f:p:b:k:h:g:V:u:dDiqQ46")) != -1) {
+       while ((opt = getopt(ac, av, "f:p:b:k:h:g:V:u:dDeiqQ46")) != -1) {
                switch (opt) {
                case '4':
                        IPv4or6 = AF_INET;
@@ -587,6 +586,9 @@ main(int ac, char **av)
                case 'D':
                        no_daemon_flag = 1;
                        break;
+               case 'e':
+                       log_stderr = 1;
+                       break;
                case 'i':
                        inetd_flag = 1;
                        break;
@@ -605,13 +607,23 @@ main(int ac, char **av)
                                fprintf(stderr, "too many ports.\n");
                                exit(1);
                        }
-                       options.ports[options.num_ports++] = atoi(optarg);
+                       options.ports[options.num_ports++] = a2port(optarg);
+                       if (options.ports[options.num_ports-1] == 0) {
+                               fprintf(stderr, "Bad port number.\n");
+                               exit(1);
+                       }
                        break;
                case 'g':
-                       options.login_grace_time = atoi(optarg);
+                       if ((options.login_grace_time = convtime(optarg)) == -1) {
+                               fprintf(stderr, "Invalid login grace time.\n");
+                               exit(1);
+                       }
                        break;
                case 'k':
-                       options.key_regeneration_time = atoi(optarg);
+                       if ((options.key_regeneration_time = convtime(optarg)) == -1) {
+                               fprintf(stderr, "Invalid key regeneration interval.\n");
+                               exit(1);
+                       }
                        break;
                case 'h':
                        if (options.num_host_key_files >= MAX_HOSTKEYS) {
@@ -690,8 +702,8 @@ main(int ac, char **av)
                key = key_load_private(options.host_key_files[i], "", NULL);
                sensitive_data.host_keys[i] = key;
                if (key == NULL) {
-                       error("Could not load host key: %.200s: %.100s",
-                           options.host_key_files[i], strerror(errno));
+                       error("Could not load host key: %s",
+                           options.host_key_files[i]);
                        sensitive_data.host_keys[i] = NULL;
                        continue;
                }
@@ -789,9 +801,9 @@ main(int ac, char **av)
 
        /* Start listening for a socket, unless started from inetd. */
        if (inetd_flag) {
-               int s1, s2;
+               int s1;
                s1 = dup(0);    /* Make sure descriptors 0, 1, and 2 are in use. */
-               s2 = dup(s1);
+               dup(s1);
                sock_in = dup(0);
                sock_out = dup(1);
                startup_pipe = -1;
@@ -925,6 +937,13 @@ main(int ac, char **av)
                        ret = select(maxfd+1, fdset, NULL, NULL, NULL);
                        if (ret < 0 && errno != EINTR)
                                error("select: %.100s", strerror(errno));
+                       if (received_sigterm) {
+                               log("Received signal %d; terminating.",
+                                   received_sigterm);
+                               close_listen_socks();
+                               unlink(options.pid_file);
+                               exit(255);
+                       }
                        if (key_used && key_do_regen) {
                                generate_ephemeral_server_key();
                                key_used = 0;
@@ -1255,7 +1274,7 @@ do_ssh1_kex(void)
        if (options.afs_token_passing)
                auth_mask |= 1 << SSH_PASS_AFS_TOKEN;
 #endif
-       if (options.challenge_reponse_authentication == 1)
+       if (options.challenge_response_authentication == 1)
                auth_mask |= 1 << SSH_AUTH_TIS;
        if (options.password_authentication)
                auth_mask |= 1 << SSH_AUTH_PASSWORD;
@@ -1425,14 +1444,19 @@ do_ssh2_kex(void)
        }
        myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = list_hostkey_types();
 
-       kex = kex_start(myproposal);
+       /* start key exchange */
+       kex = kex_setup(myproposal);
        kex->server = 1;
        kex->client_version_string=client_version_string;
        kex->server_version_string=server_version_string;
        kex->load_host_key=&get_hostkey_by_type;
 
-       /* start key exchange */
-       dispatch_run(DISPATCH_BLOCK, &kex->newkeys, kex);
+       xxx_kex = kex;
+
+       dispatch_run(DISPATCH_BLOCK, &kex->done, kex);
+
+       session_id2 = kex->session_id;
+       session_id2_len = kex->session_id_len;
 
 #ifdef DEBUG_KEXDH
        /* send 1st encrypted/maced/compressed message */