- markus@cvs.openbsd.org 2001/11/09 19:08:35

[openssh.git] / sshd.c

diff --git a/sshd.c b/sshd.c
index dd5d7ab2ca61db2327b28eb22fe3499f0a8d5a41..22ea8990e868fb66a2e1d859ed9fced590e246b9 100644 (file)
--- a/sshd.c
+++ b/sshd.c
@@ -40,7 +40,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: sshd.c,v 1.202 2001/06/26 16:15:25 dugsong Exp $");
+RCSID("$OpenBSD: sshd.c,v 1.208 2001/11/09 19:08:35 markus Exp $");
 
 #include <openssl/dh.h>
 #include <openssl/bn.h>
@@ -71,6 +71,7 @@ RCSID("$OpenBSD: sshd.c,v 1.202 2001/06/26 16:15:25 dugsong Exp $");
 #include "auth.h"
 #include "misc.h"
 #include "dispatch.h"
+#include "channels.h"
 
 #ifdef LIBWRAP
 #include <tcpd.h>
@@ -113,6 +114,9 @@ int IPv4or6 = AF_UNSPEC;
  */
 int debug_flag = 0;
 
+/* Flag indicating that the daemon should only test the configuration and keys. */
+int test_flag = 0;
+
 /* Flag indicating that the daemon is being started from inetd. */
 int inetd_flag = 0;
 
@@ -333,7 +337,7 @@ sshd_exchange_identification(int sock_in, int sock_out)
                /* Send our protocol version identification. */
                if (atomicio(write, sock_out, server_version_string, strlen(server_version_string))
                    != strlen(server_version_string)) {
-                       log("Could not write ident string to %s.", get_remote_ipaddr());
+                       log("Could not write ident string to %s", get_remote_ipaddr());
                        fatal_cleanup();
                }
 
@@ -341,7 +345,7 @@ sshd_exchange_identification(int sock_in, int sock_out)
                memset(buf, 0, sizeof(buf));
                for (i = 0; i < sizeof(buf) - 1; i++) {
                        if (atomicio(read, sock_in, &buf[i], 1) != 1) {
-                               log("Did not receive identification string from %s.",
+                               log("Did not receive identification string from %s",
                                    get_remote_ipaddr());
                                fatal_cleanup();
                        }
@@ -560,7 +564,7 @@ main(int ac, char **av)
        initialize_server_options(&options);
 
        /* Parse command-line arguments. */
-       while ((opt = getopt(ac, av, "f:p:b:k:h:g:V:u:dDeiqQ46")) != -1) {
+       while ((opt = getopt(ac, av, "f:p:b:k:h:g:V:u:dDeiqtQ46")) != -1) {
                switch (opt) {
                case '4':
                        IPv4or6 = AF_INET;
@@ -636,6 +640,9 @@ main(int ac, char **av)
                        /* only makes sense with inetd_flag, i.e. no listen() */
                        inetd_flag = 1;
                        break;
+               case 't':
+                       test_flag = 1;
+                       break;
                case 'u':
                        utmp_len = atoi(optarg);
                        break;
@@ -648,6 +655,7 @@ main(int ac, char **av)
                        fprintf(stderr, "  -d         Debugging mode (multiple -d means more debugging)\n");
                        fprintf(stderr, "  -i         Started from inetd\n");
                        fprintf(stderr, "  -D         Do not fork into daemon mode\n");
+                       fprintf(stderr, "  -t         Only test configuration file and keys\n");
                        fprintf(stderr, "  -q         Quiet (no logging)\n");
                        fprintf(stderr, "  -p port    Listen on the specified port (default: 22)\n");
                        fprintf(stderr, "  -k seconds Regenerate server key every this many seconds (default: 3600)\n");
@@ -662,6 +670,7 @@ main(int ac, char **av)
                }
        }
        SSLeay_add_all_algorithms();
+       channel_set_af(IPv4or6);
 
        /*
         * Force logging to stderr until we have loaded the private host
@@ -672,6 +681,13 @@ main(int ac, char **av)
            options.log_facility == -1 ? SYSLOG_FACILITY_AUTH : options.log_facility,
            !inetd_flag);
 
+#ifdef _CRAY
+       /* Cray can define user privs drop all prives now!
+        * Not needed on PRIV_SU systems!
+        */
+       drop_cray_privs();
+#endif
+
        seed_rng();
 
        /* Read server configuration options from the configuration file. */
@@ -755,6 +771,10 @@ main(int ac, char **av)
                }
        }
 
+       /* Configuration looks good, so exit if in test mode. */
+       if (test_flag)
+               exit(0);
+
 #ifdef HAVE_SCO_PROTECTED_PW
        (void) set_auth_parameters(ac, av);
 #endif
@@ -1120,7 +1140,7 @@ main(int ac, char **av)
        {
                struct request_info req;
 
-               request_init(&req, RQ_DAEMON, __progname, RQ_FILE, sock_in, NULL);
+               request_init(&req, RQ_DAEMON, __progname, RQ_FILE, sock_in, 0);
                fromhost(&req);
 
                if (!hosts_access(&req)) {
@@ -1157,7 +1177,7 @@ main(int ac, char **av)
        if (remote_port >= IPPORT_RESERVED ||
            remote_port < IPPORT_RESERVED / 2) {
                debug("Rhosts Authentication disabled, "
-                   "originating port not trusted.");
+                   "originating port %d not trusted.", remote_port);
                options.rhosts_authentication = 0;
        }
 #if defined(KRB4) && !defined(KRB5)