- djm@cvs.openbsd.org 2006/03/13 08:16:00

[openssh.git] / sshd.c

diff --git a/sshd.c b/sshd.c
index 40da375139ca14da499a3764e734615817f51dae..19c2d96ada8af6eda34749c8a455f7567dcf5668 100644 (file)
--- a/sshd.c
+++ b/sshd.c
@@ -42,7 +42,17 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: sshd.c,v 1.311 2005/06/17 02:44:33 djm Exp $");
+RCSID("$OpenBSD: sshd.c,v 1.325 2006/03/13 08:16:00 djm Exp $");
+
+#include <sys/types.h>
+#ifdef HAVE_SYS_STAT_H
+# include <sys/stat.h>
+#endif
+#include <sys/ioctl.h>
+#include <sys/wait.h>
+
+#include <paths.h>
+#include <signal.h>
 
 #include <openssl/dh.h>
 #include <openssl/bn.h>
@@ -633,16 +643,8 @@ privsep_postauth(Authctxt *authctxt)
        if (authctxt->pw->pw_uid == 0 || options.use_login) {
 #endif
                /* File descriptor passing is broken or root login */
-               monitor_apply_keystate(pmonitor);
                use_privsep = 0;
-               return;
-       }
-
-       /* Authentication complete */
-       alarm(0);
-       if (startup_pipe != -1) {
-               close(startup_pipe);
-               startup_pipe = -1;
+               goto skip;
        }
 
        /* New socket pair */
@@ -669,8 +671,15 @@ privsep_postauth(Authctxt *authctxt)
        /* Drop privileges */
        do_setusercontext(authctxt->pw);
 
+ skip:
        /* It is safe now to apply the key state */
        monitor_apply_keystate(pmonitor);
+
+       /*
+        * Tell the packet layer that authentication was successful, since
+        * this information is not part of the key state.
+        */
+       packet_set_authenticated();
 }
 
 static char *
@@ -794,6 +803,7 @@ send_rexec_state(int fd, Buffer *conf)
         *      bignum  iqmp                    "
         *      bignum  p                       "
         *      bignum  q                       "
+        *      string rngseed          (only if OpenSSL is not self-seeded)
         */
        buffer_init(&m);
        buffer_put_cstring(&m, buffer_ptr(conf));
@@ -810,6 +820,10 @@ send_rexec_state(int fd, Buffer *conf)
        } else
                buffer_put_int(&m, 0);
 
+#ifndef OPENSSL_PRNG_ONLY
+       rexec_send_rng_seed(&m);
+#endif
+
        if (ssh_msg_send(fd, 0, &m) == -1)
                fatal("%s: ssh_msg_send failed", __func__);
 
@@ -852,6 +866,11 @@ recv_rexec_state(int fd, Buffer *conf)
                rsa_generate_additional_parameters(
                    sensitive_data.server_key->rsa);
        }
+
+#ifndef OPENSSL_PRNG_ONLY
+       rexec_recv_rng_seed(&m);
+#endif
+
        buffer_free(&m);
 
        debug3("%s: done", __func__);
@@ -908,6 +927,9 @@ main(int ac, char **av)
        if (geteuid() == 0 && setgroups(0, NULL) == -1)
                debug("setgroups(): %.200s", strerror(errno));
 
+       /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
+       sanitise_stdfd();
+
        /* Initialize configuration options to their default values. */
        initialize_server_options(&options);
 
@@ -1045,8 +1067,6 @@ main(int ac, char **av)
        drop_cray_privs();
 #endif
 
-       seed_rng();
-
        sensitive_data.server_key = NULL;
        sensitive_data.ssh1_host_key = NULL;
        sensitive_data.have_ssh1_key = 0;
@@ -1065,6 +1085,8 @@ main(int ac, char **av)
        if (!rexec_flag)
                buffer_free(&cfg);
 
+       seed_rng();
+
        /* Fill in default values for those options not explicitly set. */
        fill_default_server_options(&options);
 
@@ -1311,10 +1333,10 @@ main(int ac, char **av)
                        num_listen_socks++;
 
                        /* Start listening on the port. */
-                       logit("Server listening on %s port %s.", ntop, strport);
                        if (listen(listen_sock, SSH_LISTEN_BACKLOG) < 0)
-                               fatal("listen: %.100s", strerror(errno));
-
+                               fatal("listen on [%s]:%s: %.100s",
+                                   ntop, strport, strerror(errno));
+                       logit("Server listening on %s port %s.", ntop, strport);
                }
                freeaddrinfo(options.listen_addrs);
 
@@ -1621,6 +1643,7 @@ main(int ac, char **av)
         * not have a key.
         */
        packet_set_connection(sock_in, sock_out);
+       packet_set_server();
 
        /* Set SO_KEEPALIVE if requested. */
        if (options.tcp_keep_alive && packet_connection_is_on_socket() &&
@@ -1631,7 +1654,12 @@ main(int ac, char **av)
                debug("get_remote_port failed");
                cleanup_exit(255);
        }
-       remote_ip = get_remote_ipaddr();
+
+       /*
+        * We use get_canonical_hostname with usedns = 0 instead of
+        * get_remote_ipaddr here so IP options will be checked.
+        */
+       remote_ip = get_canonical_hostname(0);
 
 #ifdef SSH_AUDIT_EVENTS
        audit_connection_from(remote_ip, remote_port);
@@ -1657,10 +1685,10 @@ main(int ac, char **av)
        verbose("Connection from %.500s port %d", remote_ip, remote_port);
 
        /*
-        * We don\'t want to listen forever unless the other side
+        * We don't want to listen forever unless the other side
         * successfully authenticates itself.  So we set up an alarm which is
         * cleared after successful authentication.  A limit of zero
-        * indicates no limit. Note that we don\'t set the alarm in debugging
+        * indicates no limit. Note that we don't set the alarm in debugging
         * mode; it is just annoying to have the server exit just when you
         * are about to discover the bug.
         */
@@ -1707,6 +1735,17 @@ main(int ac, char **av)
        }
 
  authenticated:
+       /*
+        * Cancel the alarm we set to limit the time taken for
+        * authentication.
+        */
+       alarm(0);
+       signal(SIGALRM, SIG_DFL);
+       if (startup_pipe != -1) {
+               close(startup_pipe);
+               startup_pipe = -1;
+       }
+
 #ifdef SSH_AUDIT_EVENTS
        audit_event(SSH_AUTH_SUCCESS);
 #endif
@@ -1988,10 +2027,14 @@ do_ssh2_kex(void)
                myproposal[PROPOSAL_MAC_ALGS_CTOS] =
                myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
        }
-       if (!options.compression) {
+       if (options.compression == COMP_NONE) {
                myproposal[PROPOSAL_COMP_ALGS_CTOS] =
                myproposal[PROPOSAL_COMP_ALGS_STOC] = "none";
+       } else if (options.compression == COMP_DELAYED) {
+               myproposal[PROPOSAL_COMP_ALGS_CTOS] =
+               myproposal[PROPOSAL_COMP_ALGS_STOC] = "none,zlib@openssh.com";
        }
+       
        myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = list_hostkey_types();
 
        /* start key exchange */