*/
#include "includes.h"
-RCSID("$OpenBSD: sshd.c,v 1.199 2001/06/04 23:07:21 markus Exp $");
+RCSID("$OpenBSD: sshd.c,v 1.208 2001/11/09 19:08:35 markus Exp $");
#include <openssl/dh.h>
#include <openssl/bn.h>
#include "auth.h"
#include "misc.h"
#include "dispatch.h"
+#include "channels.h"
#ifdef LIBWRAP
#include <tcpd.h>
*/
int debug_flag = 0;
+/* Flag indicating that the daemon should only test the configuration and keys. */
+int test_flag = 0;
+
/* Flag indicating that the daemon is being started from inetd. */
int inetd_flag = 0;
u_int utmp_len = MAXHOSTNAMELEN;
/* Prototypes for various functions defined later in this file. */
-void do_ssh1_kex(void);
-void do_ssh2_kex(void);
+void destroy_sensitive_data(void);
-void ssh_dh1_server(Kex *, Buffer *_kexinit, Buffer *);
-void ssh_dhgex_server(Kex *, Buffer *_kexinit, Buffer *);
+static void do_ssh1_kex(void);
+static void do_ssh2_kex(void);
/*
* Close all listening sockets
*/
-void
+static void
close_listen_socks(void)
{
int i;
* the effect is to reread the configuration file (and to regenerate
* the server key).
*/
-void
+static void
sighup_handler(int sig)
{
received_sighup = 1;
* Called from the main program after receiving SIGHUP.
* Restarts the server.
*/
-void
+static void
sighup_restart(void)
{
log("Received SIGHUP; restarting.");
/*
* Generic signal handler for terminating signals in the master daemon.
*/
-void
+static void
sigterm_handler(int sig)
{
received_sigterm = sig;
* SIGCHLD handler. This is called whenever a child dies. This will then
* reap any zombies left by exited children.
*/
-void
+static void
main_sigchld_handler(int sig)
{
int save_errno = errno;
/*
* Signal handler for the alarm after the login grace period has expired.
*/
-void
+static void
grace_alarm_handler(int sig)
{
/* XXX no idea how fix this signal handler */
* Thus there should be no concurrency control/asynchronous execution
* problems.
*/
-void
+static void
generate_ephemeral_server_key(void)
{
u_int32_t rand = 0;
arc4random_stir();
}
-void
+static void
key_regeneration_alarm(int sig)
{
int save_errno = errno;
key_do_regen = 1;
}
-void
+static void
sshd_exchange_identification(int sock_in, int sock_out)
{
int i, mismatch;
/* Send our protocol version identification. */
if (atomicio(write, sock_out, server_version_string, strlen(server_version_string))
!= strlen(server_version_string)) {
- log("Could not write ident string to %s.", get_remote_ipaddr());
+ log("Could not write ident string to %s", get_remote_ipaddr());
fatal_cleanup();
}
memset(buf, 0, sizeof(buf));
for (i = 0; i < sizeof(buf) - 1; i++) {
if (atomicio(read, sock_in, &buf[i], 1) != 1) {
- log("Did not receive identification string from %s.",
+ log("Did not receive identification string from %s",
get_remote_ipaddr());
fatal_cleanup();
}
memset(sensitive_data.ssh1_cookie, 0, SSH_SESSION_KEY_LENGTH);
}
-char *
+static char *
list_hostkey_types(void)
{
static char buf[1024];
return buf;
}
-Key *
+static Key *
get_hostkey_by_type(int type)
{
int i;
* of (max_startups_rate/100). the probability increases linearly until
* all connections are dropped for startups > max_startups
*/
-int
+static int
drop_connection(int startups)
{
double p, r;
initialize_server_options(&options);
/* Parse command-line arguments. */
- while ((opt = getopt(ac, av, "f:p:b:k:h:g:V:u:dDeiqQ46")) != -1) {
+ while ((opt = getopt(ac, av, "f:p:b:k:h:g:V:u:dDeiqtQ46")) != -1) {
switch (opt) {
case '4':
IPv4or6 = AF_INET;
/* only makes sense with inetd_flag, i.e. no listen() */
inetd_flag = 1;
break;
+ case 't':
+ test_flag = 1;
+ break;
case 'u':
utmp_len = atoi(optarg);
break;
fprintf(stderr, " -d Debugging mode (multiple -d means more debugging)\n");
fprintf(stderr, " -i Started from inetd\n");
fprintf(stderr, " -D Do not fork into daemon mode\n");
+ fprintf(stderr, " -t Only test configuration file and keys\n");
fprintf(stderr, " -q Quiet (no logging)\n");
fprintf(stderr, " -p port Listen on the specified port (default: 22)\n");
fprintf(stderr, " -k seconds Regenerate server key every this many seconds (default: 3600)\n");
}
}
SSLeay_add_all_algorithms();
+ channel_set_af(IPv4or6);
/*
* Force logging to stderr until we have loaded the private host
options.log_facility == -1 ? SYSLOG_FACILITY_AUTH : options.log_facility,
!inetd_flag);
+#ifdef _CRAY
+ /* Cray can define user privs drop all prives now!
+ * Not needed on PRIV_SU systems!
+ */
+ drop_cray_privs();
+#endif
+
seed_rng();
/* Read server configuration options from the configuration file. */
}
}
+ /* Configuration looks good, so exit if in test mode. */
+ if (test_flag)
+ exit(0);
+
#ifdef HAVE_SCO_PROTECTED_PW
(void) set_auth_parameters(ac, av);
#endif
if (!num_listen_socks)
fatal("Cannot bind any address.");
+ if (options.protocol & SSH_PROTO_1)
+ generate_ephemeral_server_key();
+
+ /*
+ * Arrange to restart on SIGHUP. The handler needs
+ * listen_sock.
+ */
+ signal(SIGHUP, sighup_handler);
+
+ signal(SIGTERM, sigterm_handler);
+ signal(SIGQUIT, sigterm_handler);
+
+ /* Arrange SIGCHLD to be caught. */
+ signal(SIGCHLD, main_sigchld_handler);
+
+ /* Write out the pid file after the sigterm handler is setup */
if (!debug_flag) {
/*
* Record our pid in /var/run/sshd.pid to make it
fclose(f);
}
}
- if (options.protocol & SSH_PROTO_1)
- generate_ephemeral_server_key();
-
- /* Arrange to restart on SIGHUP. The handler needs listen_sock. */
- signal(SIGHUP, sighup_handler);
-
- signal(SIGTERM, sigterm_handler);
- signal(SIGQUIT, sigterm_handler);
-
- /* Arrange SIGCHLD to be caught. */
- signal(SIGCHLD, main_sigchld_handler);
/* setup fd set for listen */
fdset = NULL;
{
struct request_info req;
- request_init(&req, RQ_DAEMON, __progname, RQ_FILE, sock_in, NULL);
+ request_init(&req, RQ_DAEMON, __progname, RQ_FILE, sock_in, 0);
fromhost(&req);
if (!hosts_access(&req)) {
if (remote_port >= IPPORT_RESERVED ||
remote_port < IPPORT_RESERVED / 2) {
debug("Rhosts Authentication disabled, "
- "originating port not trusted.");
+ "originating port %d not trusted.", remote_port);
options.rhosts_authentication = 0;
}
-#ifdef KRB4
+#if defined(KRB4) && !defined(KRB5)
if (!packet_connection_is_ipv4() &&
options.kerberos_authentication) {
debug("Kerberos Authentication disabled, only available for IPv4.");
options.kerberos_authentication = 0;
}
-#endif /* KRB4 */
+#endif /* KRB4 && !KRB5 */
#ifdef AFS
/* If machine has AFS, set process authentication group. */
if (k_hasafs()) {
do_ssh1_kex();
do_authentication();
}
-
-#ifdef KRB4
- /* Cleanup user's ticket cache file. */
- if (options.kerberos_ticket_cleanup)
- (void) dest_tkt();
-#endif /* KRB4 */
-
/* The connection has been terminated. */
verbose("Closing connection to %.100s", remote_ip);
/*
* SSH1 key exchange
*/
-void
+static void
do_ssh1_kex(void)
{
int i, len;
auth_mask |= 1 << SSH_AUTH_RHOSTS_RSA;
if (options.rsa_authentication)
auth_mask |= 1 << SSH_AUTH_RSA;
-#ifdef KRB4
+#if defined(KRB4) || defined(KRB5)
if (options.kerberos_authentication)
auth_mask |= 1 << SSH_AUTH_KERBEROS;
#endif
-#ifdef AFS
+#if defined(AFS) || defined(KRB5)
if (options.kerberos_tgt_passing)
auth_mask |= 1 << SSH_PASS_KERBEROS_TGT;
+#endif
+#ifdef AFS
if (options.afs_token_passing)
auth_mask |= 1 << SSH_PASS_AFS_TOKEN;
#endif
/*
* SSH2 key exchange: diffie-hellman-group1-sha1
*/
-void
+static void
do_ssh2_kex(void)
{
Kex *kex;