1 /* $OpenBSD: sshd-auth.c,v 1.16 2026/06/14 03:59:34 djm Exp $ */ 2 /* 3 * SSH2 implementation: 4 * Privilege Separation: 5 * 6 * Copyright (c) 2000, 2001, 2002 Markus Friedl. All rights reserved. 7 * Copyright (c) 2002 Niels Provos. All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 18 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 19 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 20 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 21 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 22 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 23 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 24 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 25 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 28 */ 29 30 #include "includes.h" 31 32 #include <sys/types.h> 33 #include <sys/ioctl.h> 34 #include <sys/wait.h> 35 #include <sys/tree.h> 36 #include <sys/stat.h> 37 #include <sys/socket.h> 38 #include <sys/time.h> 39 #include <sys/queue.h> 40 41 #include <errno.h> 42 #include <fcntl.h> 43 #include <netdb.h> 44 #include <paths.h> 45 #include <pwd.h> 46 #include <grp.h> 47 #include <signal.h> 48 #include <stdio.h> 49 #include <stdlib.h> 50 #include <string.h> 51 #include <stdarg.h> 52 #include <unistd.h> 53 #include <limits.h> 54 55 #ifdef WITH_OPENSSL 56 #include <openssl/bn.h> 57 #include <openssl/evp.h> 58 #endif 59 60 #include "xmalloc.h" 61 #include "ssh.h" 62 #include "ssh2.h" 63 #include "sshpty.h" 64 #include "packet.h" 65 #include "log.h" 66 #include "sshbuf.h" 67 #include "misc.h" 68 #include "match.h" 69 #include "servconf.h" 70 #include "uidswap.h" 71 #include "compat.h" 72 #include "cipher.h" 73 #include "digest.h" 74 #include "sshkey.h" 75 #include "kex.h" 76 #include "authfile.h" 77 #include "pathnames.h" 78 #include "atomicio.h" 79 #include "canohost.h" 80 #include "hostfile.h" 81 #include "auth.h" 82 #include "authfd.h" 83 #include "msg.h" 84 #include "dispatch.h" 85 #include "channels.h" 86 #include "session.h" 87 #include "monitor.h" 88 #ifdef GSSAPI 89 #include "ssh-gss.h" 90 #endif 91 #include "monitor_wrap.h" 92 #include "auth-options.h" 93 #include "version.h" 94 #include "ssherr.h" 95 #include "sk-api.h" 96 #include "srclimit.h" 97 #include "ssh-sandbox.h" 98 #include "dh.h" 99 #include "blocklist_client.h" 100 101 /* Privsep fds */ 102 #define PRIVSEP_MONITOR_FD (STDERR_FILENO + 1) 103 #define PRIVSEP_LOG_FD (STDERR_FILENO + 2) 104 #define PRIVSEP_MIN_FREE_FD (STDERR_FILENO + 3) 105 106 extern char *__progname; 107 108 /* Server configuration options. */ 109 ServerOptions options; 110 111 /* Name of the server configuration file. */ 112 char *config_file_name = _PATH_SERVER_CONFIG_FILE; 113 114 /* 115 * Debug mode flag. This can be set on the command line. If debug 116 * mode is enabled, extra debugging output will be sent to the system 117 * log, the daemon will not go to background, and will exit after processing 118 * the first connection. 119 */ 120 int debug_flag = 0; 121 122 /* Flag indicating that the daemon is being started from inetd. */ 123 static int inetd_flag = 0; 124 125 /* Saved arguments to main(). */ 126 static char **saved_argv; 127 static int saved_argc; 128 129 130 /* Daemon's agent connection */ 131 int auth_sock = -1; 132 static int have_agent = 0; 133 134 u_int num_hostkeys; 135 struct sshkey **host_pubkeys; /* all public host keys */ 136 struct sshkey **host_certificates; /* all public host certificates */ 137 138 /* record remote hostname or ip */ 139 u_int utmp_len = HOST_NAME_MAX+1; 140 141 /* variables used for privilege separation */ 142 struct monitor *pmonitor = NULL; 143 int privsep_is_preauth = 1; 144 static int privsep_chroot = 1; 145 146 /* global connection state and authentication contexts */ 147 Authctxt *the_authctxt = NULL; 148 struct ssh *the_active_state; 149 150 /* global key/cert auth options. XXX move to permanent ssh->authctxt? */ 151 struct sshauthopt *auth_opts = NULL; 152 153 /* sshd_config buffer */ 154 struct sshbuf *cfg; 155 156 /* Included files from the configuration file */ 157 struct include_list includes = TAILQ_HEAD_INITIALIZER(includes); 158 159 /* message to be displayed after login */ 160 struct sshbuf *loginmsg; 161 162 /* Prototypes for various functions defined later in this file. */ 163 static void do_ssh2_kex(struct ssh *); 164 165 /* Unprivileged user */ 166 struct passwd *privsep_pw = NULL; 167 168 #ifndef HAVE_PLEDGE 169 static struct ssh_sandbox *box; 170 #endif 171 172 /* XXX stub */ 173 int 174 mm_is_monitor(void) 175 { 176 return 0; 177 } 178 179 static void 180 privsep_child_demote(void) 181 { 182 gid_t gidset[1]; 183 184 #ifndef HAVE_PLEDGE 185 if ((box = ssh_sandbox_init(pmonitor)) == NULL) 186 fatal_f("ssh_sandbox_init failed"); 187 #endif 188 /* Demote the child */ 189 if (privsep_chroot) { 190 /* Change our root directory */ 191 if (chroot(_PATH_PRIVSEP_CHROOT_DIR) == -1) 192 fatal("chroot(\"%s\"): %s", _PATH_PRIVSEP_CHROOT_DIR, 193 strerror(errno)); 194 if (chdir("/") == -1) 195 fatal("chdir(\"/\"): %s", strerror(errno)); 196 197 /* 198 * Drop our privileges 199 * NB. Can't use setusercontext() after chroot. 200 */ 201 debug3("privsep user:group %u:%u", (u_int)privsep_pw->pw_uid, 202 (u_int)privsep_pw->pw_gid); 203 gidset[0] = privsep_pw->pw_gid; 204 if (setgroups(1, gidset) == -1) 205 fatal("setgroups: %.100s", strerror(errno)); 206 permanently_set_uid(privsep_pw); 207 } 208 209 /* sandbox ourselves */ 210 #ifdef HAVE_PLEDGE 211 if (pledge("stdio", NULL) == -1) 212 fatal_f("pledge()"); 213 #else 214 ssh_sandbox_child(box); 215 #endif 216 } 217 218 static void 219 append_hostkey_type(struct sshbuf *b, const char *s) 220 { 221 int r; 222 223 if (match_pattern_list(s, options.hostkeyalgorithms, 0) != 1) { 224 debug3_f("%s key not permitted by HostkeyAlgorithms", s); 225 return; 226 } 227 if ((r = sshbuf_putf(b, "%s%s", sshbuf_len(b) > 0 ? "," : "", s)) != 0) 228 fatal_fr(r, "sshbuf_putf"); 229 } 230 231 static char * 232 list_hostkey_types(void) 233 { 234 struct sshbuf *b; 235 struct sshkey *key; 236 char *ret; 237 u_int i; 238 239 if ((b = sshbuf_new()) == NULL) 240 fatal_f("sshbuf_new failed"); 241 for (i = 0; i < options.num_host_key_files; i++) { 242 key = host_pubkeys[i]; 243 if (key == NULL) 244 continue; 245 switch (key->type) { 246 case KEY_RSA: 247 /* for RSA we also support SHA2 signatures */ 248 append_hostkey_type(b, "rsa-sha2-512"); 249 append_hostkey_type(b, "rsa-sha2-256"); 250 /* FALLTHROUGH */ 251 case KEY_ECDSA: 252 case KEY_ED25519: 253 case KEY_MLDSA44_ED25519: 254 case KEY_ECDSA_SK: 255 case KEY_ED25519_SK: 256 append_hostkey_type(b, sshkey_ssh_name(key)); 257 break; 258 } 259 /* If the private key has a cert peer, then list that too */ 260 key = host_certificates[i]; 261 if (key == NULL) 262 continue; 263 switch (key->type) { 264 case KEY_RSA_CERT: 265 /* for RSA we also support SHA2 signatures */ 266 append_hostkey_type(b, 267 "rsa-sha2-512-cert-v01@openssh.com"); 268 append_hostkey_type(b, 269 "rsa-sha2-256-cert-v01@openssh.com"); 270 /* FALLTHROUGH */ 271 case KEY_ECDSA_CERT: 272 case KEY_ED25519_CERT: 273 case KEY_MLDSA44_ED25519_CERT: 274 case KEY_ECDSA_SK_CERT: 275 case KEY_ED25519_SK_CERT: 276 append_hostkey_type(b, sshkey_ssh_name(key)); 277 break; 278 } 279 } 280 if ((ret = sshbuf_dup_string(b)) == NULL) 281 fatal_f("sshbuf_dup_string failed"); 282 sshbuf_free(b); 283 debug_f("%s", ret); 284 return ret; 285 } 286 287 struct sshkey * 288 get_hostkey_public_by_type(int type, int nid, struct ssh *ssh) 289 { 290 u_int i; 291 struct sshkey *key; 292 293 for (i = 0; i < options.num_host_key_files; i++) { 294 switch (type) { 295 case KEY_RSA_CERT: 296 case KEY_ECDSA_CERT: 297 case KEY_ED25519_CERT: 298 case KEY_MLDSA44_ED25519_CERT: 299 case KEY_ECDSA_SK_CERT: 300 case KEY_ED25519_SK_CERT: 301 key = host_certificates[i]; 302 break; 303 default: 304 key = host_pubkeys[i]; 305 break; 306 } 307 if (key == NULL || key->type != type) 308 continue; 309 switch (type) { 310 case KEY_ECDSA: 311 case KEY_ECDSA_SK: 312 case KEY_ECDSA_CERT: 313 case KEY_ECDSA_SK_CERT: 314 if (key->ecdsa_nid != nid) 315 continue; 316 /* FALLTHROUGH */ 317 default: 318 return key; 319 } 320 } 321 return NULL; 322 } 323 324 /* XXX remove */ 325 struct sshkey * 326 get_hostkey_private_by_type(int type, int nid, struct ssh *ssh) 327 { 328 return NULL; 329 } 330 331 /* XXX remove */ 332 struct sshkey * 333 get_hostkey_by_index(int ind) 334 { 335 return NULL; 336 } 337 338 struct sshkey * 339 get_hostkey_public_by_index(int ind, struct ssh *ssh) 340 { 341 if (ind < 0 || (u_int)ind >= options.num_host_key_files) 342 return (NULL); 343 return host_pubkeys[ind]; 344 } 345 346 int 347 get_hostkey_index(struct sshkey *key, int compare, struct ssh *ssh) 348 { 349 u_int i; 350 351 for (i = 0; i < options.num_host_key_files; i++) { 352 if (sshkey_is_cert(key)) { 353 if (key == host_certificates[i] || 354 (compare && host_certificates[i] && 355 sshkey_equal(key, host_certificates[i]))) 356 return (i); 357 } else { 358 if (key == host_pubkeys[i] || 359 (compare && host_pubkeys[i] && 360 sshkey_equal(key, host_pubkeys[i]))) 361 return (i); 362 } 363 } 364 return (-1); 365 } 366 367 static void 368 usage(void) 369 { 370 fprintf(stderr, "%s, %s\n", SSH_VERSION, SSH_OPENSSL_VERSION); 371 fprintf(stderr, 372 "usage: sshd [-46DdeGiqTtV] [-C connection_spec] [-c host_cert_file]\n" 373 " [-E log_file] [-f config_file] [-g login_grace_time]\n" 374 " [-h host_key_file] [-o option] [-p port] [-u len]\n" 375 ); 376 exit(1); 377 } 378 379 static void 380 parse_hostkeys(struct sshbuf *hostkeys) 381 { 382 int r; 383 u_int num_keys = 0; 384 struct sshkey *k; 385 const u_char *cp; 386 size_t len; 387 388 while (sshbuf_len(hostkeys) != 0) { 389 if (num_keys > 2048) 390 fatal_f("too many hostkeys"); 391 host_pubkeys = xrecallocarray(host_pubkeys, 392 num_keys, num_keys + 1, sizeof(*host_pubkeys)); 393 host_certificates = xrecallocarray(host_certificates, 394 num_keys, num_keys + 1, sizeof(*host_certificates)); 395 /* public key */ 396 k = NULL; 397 if ((r = sshbuf_get_string_direct(hostkeys, &cp, &len)) != 0) 398 fatal_fr(r, "extract pubkey"); 399 if (len != 0 && (r = sshkey_from_blob(cp, len, &k)) != 0) 400 fatal_fr(r, "parse pubkey"); 401 host_pubkeys[num_keys] = k; 402 if (k) 403 debug2_f("key %u: %s", num_keys, sshkey_ssh_name(k)); 404 /* certificate */ 405 k = NULL; 406 if ((r = sshbuf_get_string_direct(hostkeys, &cp, &len)) != 0) 407 fatal_fr(r, "extract pubkey"); 408 if (len != 0 && (r = sshkey_from_blob(cp, len, &k)) != 0) 409 fatal_fr(r, "parse pubkey"); 410 host_certificates[num_keys] = k; 411 if (k) 412 debug2_f("cert %u: %s", num_keys, sshkey_ssh_name(k)); 413 num_keys++; 414 } 415 num_hostkeys = num_keys; 416 } 417 418 static void 419 recv_privsep_state(struct ssh *ssh, ServerOptions *o, uint64_t *timing_secretp) 420 { 421 struct sshbuf *hostkeys; 422 423 debug3_f("begin"); 424 425 mm_get_state(ssh, o, NULL, timing_secretp, 426 &hostkeys, NULL, NULL, NULL, NULL); 427 parse_hostkeys(hostkeys); 428 429 sshbuf_free(hostkeys); 430 431 debug3_f("done"); 432 } 433 434 /* 435 * Main program for the daemon. 436 */ 437 int 438 main(int ac, char **av) 439 { 440 struct ssh *ssh = NULL; 441 extern char *optarg; 442 extern int optind; 443 int r, opt, have_key = 0; 444 int sock_in = -1, sock_out = -1, rexeced_flag = 0; 445 u_int i; 446 mode_t new_umask; 447 Authctxt *authctxt; 448 sigset_t sigmask; 449 uint64_t timing_secret = 0; 450 451 closefrom(PRIVSEP_MIN_FREE_FD); 452 sigemptyset(&sigmask); 453 sigprocmask(SIG_SETMASK, &sigmask, NULL); 454 455 #ifdef HAVE_SECUREWARE 456 (void)set_auth_parameters(ac, av); 457 #endif 458 __progname = ssh_get_progname(av[0]); 459 460 /* Save argv. Duplicate so setproctitle emulation doesn't clobber it */ 461 saved_argc = ac; 462 saved_argv = xcalloc(ac + 1, sizeof(*saved_argv)); 463 for (i = 0; (int)i < ac; i++) 464 saved_argv[i] = xstrdup(av[i]); 465 saved_argv[i] = NULL; 466 467 seed_rng(); 468 469 #ifndef HAVE_SETPROCTITLE 470 /* Prepare for later setproctitle emulation */ 471 compat_init_setproctitle(ac, av); 472 av = saved_argv; 473 #endif 474 475 /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */ 476 sanitise_stdfd(); 477 478 /* Initialize configuration options to their default values. */ 479 initialize_server_options(&options); 480 481 /* Parse command-line arguments. */ 482 while ((opt = getopt(ac, av, 483 "C:E:b:c:f:g:h:k:o:p:u:46DGQRTdeiqrtV")) != -1) { 484 switch (opt) { 485 case '4': 486 /* ignore */ 487 break; 488 case '6': 489 /* ignore */ 490 break; 491 case 'f': 492 /* ignore */ 493 break; 494 case 'c': 495 /* ignore */ 496 break; 497 case 'd': 498 if (debug_flag == 0) { 499 debug_flag = 1; 500 options.log_level = SYSLOG_LEVEL_DEBUG1; 501 } else if (options.log_level < SYSLOG_LEVEL_DEBUG3) 502 options.log_level++; 503 break; 504 case 'D': 505 case 'E': 506 case 'e': 507 /* ignore */ 508 break; 509 case 'i': 510 inetd_flag = 1; 511 break; 512 case 'r': 513 /* ignore */ 514 break; 515 case 'R': 516 rexeced_flag = 1; 517 break; 518 case 'Q': 519 /* ignored */ 520 break; 521 case 'q': 522 /* ignored */ 523 break; 524 case 'b': 525 /* protocol 1, ignored */ 526 break; 527 case 'p': 528 /* ignored */ 529 break; 530 case 'g': 531 /* ignored */ 532 break; 533 case 'k': 534 /* protocol 1, ignored */ 535 break; 536 case 'h': 537 /* ignored */ 538 break; 539 case 't': 540 case 'T': 541 case 'G': 542 case 'C': 543 fatal("test/dump modes not supported"); 544 break; 545 case 'u': 546 utmp_len = (u_int)strtonum(optarg, 0, HOST_NAME_MAX+1+1, NULL); 547 if (utmp_len > HOST_NAME_MAX+1) { 548 fprintf(stderr, "Invalid utmp length.\n"); 549 exit(1); 550 } 551 break; 552 case 'o': 553 /* ignored */ 554 break; 555 case 'V': 556 fprintf(stderr, "%s, %s\n", 557 SSH_VERSION, SSH_OPENSSL_VERSION); 558 exit(0); 559 default: 560 usage(); 561 break; 562 } 563 } 564 565 if (!rexeced_flag) 566 fatal("sshd-auth should not be executed directly"); 567 568 log_init(__progname, 569 options.log_level == SYSLOG_LEVEL_NOT_SET ? 570 SYSLOG_LEVEL_INFO : options.log_level, 571 options.log_facility == SYSLOG_FACILITY_NOT_SET ? 572 SYSLOG_FACILITY_AUTH : options.log_facility, 1); 573 574 /* XXX can't use monitor_init(); it makes fds */ 575 pmonitor = xcalloc(1, sizeof(*pmonitor)); 576 pmonitor->m_sendfd = pmonitor->m_log_recvfd = -1; 577 pmonitor->m_recvfd = PRIVSEP_MONITOR_FD; 578 pmonitor->m_log_sendfd = PRIVSEP_LOG_FD; 579 set_log_handler(mm_log_handler, pmonitor); 580 581 /* Check that there are no remaining arguments. */ 582 if (optind < ac) { 583 fprintf(stderr, "Extra argument %s.\n", av[optind]); 584 exit(1); 585 } 586 587 /* Connection passed by stdin/out */ 588 if (inetd_flag) { 589 /* 590 * NB. must be different fd numbers for the !socket case, 591 * as packet_connection_is_on_socket() depends on this. 592 */ 593 sock_in = dup(STDIN_FILENO); 594 sock_out = dup(STDOUT_FILENO); 595 } else { 596 /* rexec case; accept()ed socket in ancestor listener */ 597 sock_in = sock_out = dup(STDIN_FILENO); 598 } 599 600 if (stdfd_devnull(1, 1, 0) == -1) 601 error("stdfd_devnull failed"); 602 debug("network sockets: %d, %d", sock_in, sock_out); 603 604 /* 605 * Register our connection. This turns encryption off because we do 606 * not have a key. 607 */ 608 if ((ssh = ssh_packet_set_connection(NULL, sock_in, sock_out)) == NULL) 609 fatal("Unable to create connection"); 610 the_active_state = ssh; 611 ssh_packet_set_server(ssh); 612 pmonitor->m_pkex = &ssh->kex; 613 614 /* Fetch our configuration */ 615 if ((cfg = sshbuf_new()) == NULL) 616 fatal("sshbuf_new config buf failed"); 617 setproctitle("%s", "[session-auth early]"); 618 recv_privsep_state(ssh, &options, &timing_secret); 619 options.timing_secret = timing_secret; /* XXX eliminate from unpriv */ 620 ssh_packet_set_qos(ssh, options.ip_qos_interactive, 621 options.ip_qos_bulk); 622 623 /* Reinit logging in case config set Level, Facility or Verbose. */ 624 log_init(__progname, options.log_level, options.log_facility, 1); 625 set_log_handler(mm_log_handler, pmonitor); 626 627 debug("sshd-auth version %s, %s", SSH_VERSION, SSH_OPENSSL_VERSION); 628 629 /* Store privilege separation user for later use if required. */ 630 privsep_chroot = (getuid() == 0 || geteuid() == 0); 631 if ((privsep_pw = getpwnam(SSH_PRIVSEP_USER)) == NULL) { 632 if (privsep_chroot || options.kerberos_authentication) 633 fatal("Privilege separation user %s does not exist", 634 SSH_PRIVSEP_USER); 635 } else { 636 privsep_pw = pwcopy(privsep_pw); 637 freezero(privsep_pw->pw_passwd, strlen(privsep_pw->pw_passwd)); 638 privsep_pw->pw_passwd = xstrdup("*"); 639 } 640 endpwent(); 641 642 #ifdef WITH_OPENSSL 643 if (options.moduli_file != NULL) 644 dh_set_moduli_file(options.moduli_file); 645 #endif 646 647 if (options.host_key_agent) { 648 if (strcmp(options.host_key_agent, SSH_AUTHSOCKET_ENV_NAME)) 649 setenv(SSH_AUTHSOCKET_ENV_NAME, 650 options.host_key_agent, 1); 651 if ((r = ssh_get_authentication_socket(NULL)) == 0) 652 have_agent = 1; 653 else 654 error_r(r, "Could not connect to agent \"%s\"", 655 options.host_key_agent); 656 } 657 658 if (options.num_host_key_files != num_hostkeys) { 659 fatal("internal error: hostkeys confused (config %u recvd %u)", 660 options.num_host_key_files, num_hostkeys); 661 } 662 663 for (i = 0; i < options.num_host_key_files; i++) { 664 if (host_pubkeys[i] != NULL) { 665 have_key = 1; 666 break; 667 } 668 } 669 if (!have_key) 670 fatal("internal error: received no hostkeys"); 671 672 /* Ensure that umask disallows at least group and world write */ 673 new_umask = umask(0077) | 0022; 674 (void) umask(new_umask); 675 676 /* Initialize the log (it is reinitialized below in case we forked). */ 677 log_init(__progname, options.log_level, options.log_facility, 1); 678 set_log_handler(mm_log_handler, pmonitor); 679 for (i = 0; i < options.num_log_verbose; i++) 680 log_verbose_add(options.log_verbose[i]); 681 682 /* 683 * Chdir to the root directory so that the current disk can be 684 * unmounted if desired. 685 */ 686 if (chdir("/") == -1) 687 error("chdir(\"/\"): %s", strerror(errno)); 688 689 /* This is the child authenticating a new connection. */ 690 setproctitle("%s", "[session-auth]"); 691 692 /* Executed child processes don't need these. */ 693 FD_CLOSEONEXEC(sock_out); 694 FD_CLOSEONEXEC(sock_in); 695 696 ssh_signal(SIGPIPE, SIG_IGN); 697 ssh_signal(SIGALRM, SIG_DFL); 698 ssh_signal(SIGHUP, SIG_DFL); 699 ssh_signal(SIGTERM, SIG_DFL); 700 ssh_signal(SIGQUIT, SIG_DFL); 701 ssh_signal(SIGCHLD, SIG_DFL); 702 703 /* Prepare the channels layer */ 704 channel_init_channels(ssh); 705 channel_set_af(ssh, options.address_family); 706 server_process_channel_timeouts(ssh); 707 server_process_permitopen(ssh); 708 709 ssh_packet_set_nonblocking(ssh); 710 711 /* allocate authentication context */ 712 authctxt = xcalloc(1, sizeof(*authctxt)); 713 ssh->authctxt = authctxt; 714 715 /* XXX global for cleanup, access from other modules */ 716 the_authctxt = authctxt; 717 718 /* Set default key authentication options */ 719 if ((auth_opts = sshauthopt_new_with_keys_defaults()) == NULL) 720 fatal("allocation failed"); 721 722 /* prepare buffer to collect messages to display to user after login */ 723 if ((loginmsg = sshbuf_new()) == NULL) 724 fatal("sshbuf_new loginmsg failed"); 725 auth_debug_reset(); 726 727 #ifdef GSSAPI 728 /* Cache supported mechanism OIDs for later use */ 729 ssh_gssapi_prepare_supported_oids(); 730 #endif 731 732 privsep_child_demote(); 733 734 /* perform the key exchange */ 735 /* authenticate user and start session */ 736 do_ssh2_kex(ssh); 737 do_authentication2(ssh); 738 739 /* 740 * The unprivileged child now transfers the current keystate and exits. 741 */ 742 mm_send_keystate(ssh, pmonitor); 743 sshauthopt_free(auth_opts); 744 ssh_packet_clear_keys(ssh); 745 exit(0); 746 } 747 748 int 749 sshd_hostkey_sign(struct ssh *ssh, struct sshkey *privkey, 750 struct sshkey *pubkey, u_char **signature, size_t *slenp, 751 const u_char *data, size_t dlen, const char *alg) 752 { 753 if (privkey) { 754 if (mm_sshkey_sign(ssh, privkey, signature, slenp, 755 data, dlen, alg, options.sk_provider, NULL, 756 ssh->compat) < 0) 757 fatal_f("privkey sign failed"); 758 } else { 759 if (mm_sshkey_sign(ssh, pubkey, signature, slenp, 760 data, dlen, alg, options.sk_provider, NULL, 761 ssh->compat) < 0) 762 fatal_f("pubkey sign failed"); 763 } 764 return 0; 765 } 766 767 /* SSH2 key exchange */ 768 static void 769 do_ssh2_kex(struct ssh *ssh) 770 { 771 char *hkalgs = NULL, *myproposal[PROPOSAL_MAX]; 772 const char *compression = NULL; 773 struct kex *kex; 774 int r; 775 776 if (options.rekey_limit || options.rekey_interval) 777 ssh_packet_set_rekey_limits(ssh, options.rekey_limit, 778 options.rekey_interval); 779 780 if (options.compression == COMP_NONE) 781 compression = "none"; 782 hkalgs = list_hostkey_types(); 783 784 kex_proposal_populate_entries(ssh, myproposal, options.kex_algorithms, 785 options.ciphers, options.macs, compression, hkalgs); 786 787 free(hkalgs); 788 789 if ((r = kex_exchange_identification(ssh, -1, 790 options.version_addendum)) != 0) { 791 BLOCKLIST_NOTIFY(ssh, BLOCKLIST_AUTH_FAIL, "Banner exchange"); 792 sshpkt_fatal(ssh, r, "banner exchange"); 793 } 794 mm_sshkey_setcompat(ssh); /* tell monitor */ 795 796 if ((ssh->compat & SSH_BUG_NOREKEY)) 797 debug("client does not support rekeying"); 798 799 /* start key exchange */ 800 if ((r = kex_setup(ssh, myproposal)) != 0) 801 fatal_r(r, "kex_setup"); 802 kex_set_server_sig_algs(ssh, options.pubkey_accepted_algos); 803 kex = ssh->kex; 804 805 #ifdef WITH_OPENSSL 806 kex->kex[KEX_DH_GRP1_SHA1] = kex_gen_server; 807 kex->kex[KEX_DH_GRP14_SHA1] = kex_gen_server; 808 kex->kex[KEX_DH_GRP14_SHA256] = kex_gen_server; 809 kex->kex[KEX_DH_GRP16_SHA512] = kex_gen_server; 810 kex->kex[KEX_DH_GRP18_SHA512] = kex_gen_server; 811 kex->kex[KEX_DH_GEX_SHA1] = kexgex_server; 812 kex->kex[KEX_DH_GEX_SHA256] = kexgex_server; 813 # ifdef OPENSSL_HAS_ECC 814 kex->kex[KEX_ECDH_SHA2] = kex_gen_server; 815 # endif /* OPENSSL_HAS_ECC */ 816 #endif /* WITH_OPENSSL */ 817 kex->kex[KEX_C25519_SHA256] = kex_gen_server; 818 kex->kex[KEX_KEM_SNTRUP761X25519_SHA512] = kex_gen_server; 819 kex->kex[KEX_KEM_MLKEM768X25519_SHA256] = kex_gen_server; 820 kex->load_host_public_key=&get_hostkey_public_by_type; 821 kex->load_host_private_key=&get_hostkey_private_by_type; 822 kex->host_key_index=&get_hostkey_index; 823 kex->sign = sshd_hostkey_sign; 824 825 ssh_dispatch_run_fatal(ssh, DISPATCH_BLOCK, &kex->done); 826 kex_proposal_free_entries(myproposal); 827 828 #ifdef DEBUG_KEXDH 829 /* send 1st encrypted/maced/compressed message */ 830 if ((r = sshpkt_start(ssh, SSH2_MSG_IGNORE)) != 0 || 831 (r = sshpkt_put_cstring(ssh, "markus")) != 0 || 832 (r = sshpkt_send(ssh)) != 0 || 833 (r = ssh_packet_write_wait(ssh)) != 0) 834 fatal_fr(r, "send test"); 835 #endif 836 debug("KEX done"); 837 } 838 839 /* server specific fatal cleanup */ 840 void 841 cleanup_exit(int i) 842 { 843 _exit(i); 844 } 845