xref: /freebsd/crypto/openssh/sshd.c (revision c0b9f4fe659b6839541970eb5675e57f4d814969)
1 /*
2  * Author: Tatu Ylonen <ylo@cs.hut.fi>
3  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4  *                    All rights reserved
5  * This program is the ssh daemon.  It listens for connections from clients,
6  * and performs authentication, executes use commands or shell, and forwards
7  * information to/from the application to the user client over an encrypted
8  * connection.  This can also handle forwarding of X11, TCP/IP, and
9  * authentication agent connections.
10  *
11  * As far as I am concerned, the code I have written for this software
12  * can be used freely for any purpose.  Any derived versions of this
13  * software must be clearly marked as such, and if the derived work is
14  * incompatible with the protocol description in the RFC file, it must be
15  * called by a name other than "ssh" or "Secure Shell".
16  *
17  * SSH2 implementation:
18  * Privilege Separation:
19  *
20  * Copyright (c) 2000, 2001, 2002 Markus Friedl.  All rights reserved.
21  * Copyright (c) 2002 Niels Provos.  All rights reserved.
22  *
23  * Redistribution and use in source and binary forms, with or without
24  * modification, are permitted provided that the following conditions
25  * are met:
26  * 1. Redistributions of source code must retain the above copyright
27  *    notice, this list of conditions and the following disclaimer.
28  * 2. Redistributions in binary form must reproduce the above copyright
29  *    notice, this list of conditions and the following disclaimer in the
30  *    documentation and/or other materials provided with the distribution.
31  *
32  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
33  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
34  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
35  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
36  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
37  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
38  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
39  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
40  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
41  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
42  */
43 
44 #include "includes.h"
45 RCSID("$OpenBSD: sshd.c,v 1.312 2005/07/25 11:59:40 markus Exp $");
46 RCSID("$FreeBSD$");
47 
48 #include <openssl/dh.h>
49 #include <openssl/bn.h>
50 #include <openssl/md5.h>
51 #include <openssl/rand.h>
52 #ifdef HAVE_SECUREWARE
53 #include <sys/security.h>
54 #include <prot.h>
55 #endif
56 
57 #ifdef __FreeBSD__
58 #include <resolv.h>
59 #ifdef GSSAPI
60 #include <gssapi/gssapi.h>
61 #endif
62 #endif
63 
64 #include "ssh.h"
65 #include "ssh1.h"
66 #include "ssh2.h"
67 #include "xmalloc.h"
68 #include "rsa.h"
69 #include "sshpty.h"
70 #include "packet.h"
71 #include "log.h"
72 #include "servconf.h"
73 #include "uidswap.h"
74 #include "compat.h"
75 #include "buffer.h"
76 #include "bufaux.h"
77 #include "cipher.h"
78 #include "kex.h"
79 #include "key.h"
80 #include "dh.h"
81 #include "myproposal.h"
82 #include "authfile.h"
83 #include "pathnames.h"
84 #include "atomicio.h"
85 #include "canohost.h"
86 #include "auth.h"
87 #include "misc.h"
88 #include "msg.h"
89 #include "dispatch.h"
90 #include "channels.h"
91 #include "session.h"
92 #include "monitor_mm.h"
93 #include "monitor.h"
94 #include "monitor_wrap.h"
95 #include "monitor_fdpass.h"
96 
97 #ifdef LIBWRAP
98 #include <tcpd.h>
99 #include <syslog.h>
100 int allow_severity = LOG_INFO;
101 int deny_severity = LOG_WARNING;
102 #endif /* LIBWRAP */
103 
104 #ifndef O_NOCTTY
105 #define O_NOCTTY	0
106 #endif
107 
108 /* Re-exec fds */
109 #define REEXEC_DEVCRYPTO_RESERVED_FD	(STDERR_FILENO + 1)
110 #define REEXEC_STARTUP_PIPE_FD		(STDERR_FILENO + 2)
111 #define REEXEC_CONFIG_PASS_FD		(STDERR_FILENO + 3)
112 #define REEXEC_MIN_FREE_FD		(STDERR_FILENO + 4)
113 
114 extern char *__progname;
115 
116 /* Server configuration options. */
117 ServerOptions options;
118 
119 /* Name of the server configuration file. */
120 char *config_file_name = _PATH_SERVER_CONFIG_FILE;
121 
122 /*
123  * Debug mode flag.  This can be set on the command line.  If debug
124  * mode is enabled, extra debugging output will be sent to the system
125  * log, the daemon will not go to background, and will exit after processing
126  * the first connection.
127  */
128 int debug_flag = 0;
129 
130 /* Flag indicating that the daemon should only test the configuration and keys. */
131 int test_flag = 0;
132 
133 /* Flag indicating that the daemon is being started from inetd. */
134 int inetd_flag = 0;
135 
136 /* Flag indicating that sshd should not detach and become a daemon. */
137 int no_daemon_flag = 0;
138 
139 /* debug goes to stderr unless inetd_flag is set */
140 int log_stderr = 0;
141 
142 /* Saved arguments to main(). */
143 char **saved_argv;
144 int saved_argc;
145 
146 /* re-exec */
147 int rexeced_flag = 0;
148 int rexec_flag = 1;
149 int rexec_argc = 0;
150 char **rexec_argv;
151 
152 /*
153  * The sockets that the server is listening; this is used in the SIGHUP
154  * signal handler.
155  */
156 #define	MAX_LISTEN_SOCKS	16
157 int listen_socks[MAX_LISTEN_SOCKS];
158 int num_listen_socks = 0;
159 
160 /*
161  * the client's version string, passed by sshd2 in compat mode. if != NULL,
162  * sshd will skip the version-number exchange
163  */
164 char *client_version_string = NULL;
165 char *server_version_string = NULL;
166 
167 /* for rekeying XXX fixme */
168 Kex *xxx_kex;
169 
170 /*
171  * Any really sensitive data in the application is contained in this
172  * structure. The idea is that this structure could be locked into memory so
173  * that the pages do not get written into swap.  However, there are some
174  * problems. The private key contains BIGNUMs, and we do not (in principle)
175  * have access to the internals of them, and locking just the structure is
176  * not very useful.  Currently, memory locking is not implemented.
177  */
178 struct {
179 	Key	*server_key;		/* ephemeral server key */
180 	Key	*ssh1_host_key;		/* ssh1 host key */
181 	Key	**host_keys;		/* all private host keys */
182 	int	have_ssh1_key;
183 	int	have_ssh2_key;
184 	u_char	ssh1_cookie[SSH_SESSION_KEY_LENGTH];
185 } sensitive_data;
186 
187 /*
188  * Flag indicating whether the RSA server key needs to be regenerated.
189  * Is set in the SIGALRM handler and cleared when the key is regenerated.
190  */
191 static volatile sig_atomic_t key_do_regen = 0;
192 
193 /* This is set to true when a signal is received. */
194 static volatile sig_atomic_t received_sighup = 0;
195 static volatile sig_atomic_t received_sigterm = 0;
196 
197 /* session identifier, used by RSA-auth */
198 u_char session_id[16];
199 
200 /* same for ssh2 */
201 u_char *session_id2 = NULL;
202 u_int session_id2_len = 0;
203 
204 /* record remote hostname or ip */
205 u_int utmp_len = MAXHOSTNAMELEN;
206 
207 /* options.max_startup sized array of fd ints */
208 int *startup_pipes = NULL;
209 int startup_pipe;		/* in child */
210 
211 /* variables used for privilege separation */
212 int use_privsep;
213 struct monitor *pmonitor = NULL;
214 
215 /* global authentication context */
216 Authctxt *the_authctxt = NULL;
217 
218 /* message to be displayed after login */
219 Buffer loginmsg;
220 
221 /* Prototypes for various functions defined later in this file. */
222 void destroy_sensitive_data(void);
223 void demote_sensitive_data(void);
224 
225 static void do_ssh1_kex(void);
226 static void do_ssh2_kex(void);
227 
228 /*
229  * Close all listening sockets
230  */
231 static void
232 close_listen_socks(void)
233 {
234 	int i;
235 
236 	for (i = 0; i < num_listen_socks; i++)
237 		close(listen_socks[i]);
238 	num_listen_socks = -1;
239 }
240 
241 static void
242 close_startup_pipes(void)
243 {
244 	int i;
245 
246 	if (startup_pipes)
247 		for (i = 0; i < options.max_startups; i++)
248 			if (startup_pipes[i] != -1)
249 				close(startup_pipes[i]);
250 }
251 
252 /*
253  * Signal handler for SIGHUP.  Sshd execs itself when it receives SIGHUP;
254  * the effect is to reread the configuration file (and to regenerate
255  * the server key).
256  */
257 static void
258 sighup_handler(int sig)
259 {
260 	int save_errno = errno;
261 
262 	received_sighup = 1;
263 	signal(SIGHUP, sighup_handler);
264 	errno = save_errno;
265 }
266 
267 /*
268  * Called from the main program after receiving SIGHUP.
269  * Restarts the server.
270  */
271 static void
272 sighup_restart(void)
273 {
274 	logit("Received SIGHUP; restarting.");
275 	close_listen_socks();
276 	close_startup_pipes();
277 	execv(saved_argv[0], saved_argv);
278 	logit("RESTART FAILED: av[0]='%.100s', error: %.100s.", saved_argv[0],
279 	    strerror(errno));
280 	exit(1);
281 }
282 
283 /*
284  * Generic signal handler for terminating signals in the master daemon.
285  */
286 static void
287 sigterm_handler(int sig)
288 {
289 	received_sigterm = sig;
290 }
291 
292 /*
293  * SIGCHLD handler.  This is called whenever a child dies.  This will then
294  * reap any zombies left by exited children.
295  */
296 static void
297 main_sigchld_handler(int sig)
298 {
299 	int save_errno = errno;
300 	pid_t pid;
301 	int status;
302 
303 	while ((pid = waitpid(-1, &status, WNOHANG)) > 0 ||
304 	    (pid < 0 && errno == EINTR))
305 		;
306 
307 	signal(SIGCHLD, main_sigchld_handler);
308 	errno = save_errno;
309 }
310 
311 /*
312  * Signal handler for the alarm after the login grace period has expired.
313  */
314 static void
315 grace_alarm_handler(int sig)
316 {
317 	/* XXX no idea how fix this signal handler */
318 
319 	if (use_privsep && pmonitor != NULL && pmonitor->m_pid > 0)
320 		kill(pmonitor->m_pid, SIGALRM);
321 
322 	/* Log error and exit. */
323 	fatal("Timeout before authentication for %s", get_remote_ipaddr());
324 }
325 
326 /*
327  * Signal handler for the key regeneration alarm.  Note that this
328  * alarm only occurs in the daemon waiting for connections, and it does not
329  * do anything with the private key or random state before forking.
330  * Thus there should be no concurrency control/asynchronous execution
331  * problems.
332  */
333 static void
334 generate_ephemeral_server_key(void)
335 {
336 	u_int32_t rnd = 0;
337 	int i;
338 
339 	verbose("Generating %s%d bit RSA key.",
340 	    sensitive_data.server_key ? "new " : "", options.server_key_bits);
341 	if (sensitive_data.server_key != NULL)
342 		key_free(sensitive_data.server_key);
343 	sensitive_data.server_key = key_generate(KEY_RSA1,
344 	    options.server_key_bits);
345 	verbose("RSA key generation complete.");
346 
347 	for (i = 0; i < SSH_SESSION_KEY_LENGTH; i++) {
348 		if (i % 4 == 0)
349 			rnd = arc4random();
350 		sensitive_data.ssh1_cookie[i] = rnd & 0xff;
351 		rnd >>= 8;
352 	}
353 	arc4random_stir();
354 }
355 
356 static void
357 key_regeneration_alarm(int sig)
358 {
359 	int save_errno = errno;
360 
361 	signal(SIGALRM, SIG_DFL);
362 	errno = save_errno;
363 	key_do_regen = 1;
364 }
365 
366 static void
367 sshd_exchange_identification(int sock_in, int sock_out)
368 {
369 	u_int i;
370 	int mismatch;
371 	int remote_major, remote_minor;
372 	int major, minor;
373 	char *s;
374 	char buf[256];			/* Must not be larger than remote_version. */
375 	char remote_version[256];	/* Must be at least as big as buf. */
376 
377 	if ((options.protocol & SSH_PROTO_1) &&
378 	    (options.protocol & SSH_PROTO_2)) {
379 		major = PROTOCOL_MAJOR_1;
380 		minor = 99;
381 	} else if (options.protocol & SSH_PROTO_2) {
382 		major = PROTOCOL_MAJOR_2;
383 		minor = PROTOCOL_MINOR_2;
384 	} else {
385 		major = PROTOCOL_MAJOR_1;
386 		minor = PROTOCOL_MINOR_1;
387 	}
388 	snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s\n", major, minor, SSH_VERSION);
389 	server_version_string = xstrdup(buf);
390 
391 	/* Send our protocol version identification. */
392 	if (atomicio(vwrite, sock_out, server_version_string,
393 	    strlen(server_version_string))
394 	    != strlen(server_version_string)) {
395 		logit("Could not write ident string to %s", get_remote_ipaddr());
396 		cleanup_exit(255);
397 	}
398 
399 	/* Read other sides version identification. */
400 	memset(buf, 0, sizeof(buf));
401 	for (i = 0; i < sizeof(buf) - 1; i++) {
402 		if (atomicio(read, sock_in, &buf[i], 1) != 1) {
403 			logit("Did not receive identification string from %s",
404 			    get_remote_ipaddr());
405 			cleanup_exit(255);
406 		}
407 		if (buf[i] == '\r') {
408 			buf[i] = 0;
409 			/* Kludge for F-Secure Macintosh < 1.0.2 */
410 			if (i == 12 &&
411 			    strncmp(buf, "SSH-1.5-W1.0", 12) == 0)
412 				break;
413 			continue;
414 		}
415 		if (buf[i] == '\n') {
416 			buf[i] = 0;
417 			break;
418 		}
419 	}
420 	buf[sizeof(buf) - 1] = 0;
421 	client_version_string = xstrdup(buf);
422 
423 	/*
424 	 * Check that the versions match.  In future this might accept
425 	 * several versions and set appropriate flags to handle them.
426 	 */
427 	if (sscanf(client_version_string, "SSH-%d.%d-%[^\n]\n",
428 	    &remote_major, &remote_minor, remote_version) != 3) {
429 		s = "Protocol mismatch.\n";
430 		(void) atomicio(vwrite, sock_out, s, strlen(s));
431 		close(sock_in);
432 		close(sock_out);
433 		logit("Bad protocol version identification '%.100s' from %s",
434 		    client_version_string, get_remote_ipaddr());
435 		cleanup_exit(255);
436 	}
437 	debug("Client protocol version %d.%d; client software version %.100s",
438 	    remote_major, remote_minor, remote_version);
439 
440 	compat_datafellows(remote_version);
441 
442 	if (datafellows & SSH_BUG_PROBE) {
443 		logit("probed from %s with %s.  Don't panic.",
444 		    get_remote_ipaddr(), client_version_string);
445 		cleanup_exit(255);
446 	}
447 
448 	if (datafellows & SSH_BUG_SCANNER) {
449 		logit("scanned from %s with %s.  Don't panic.",
450 		    get_remote_ipaddr(), client_version_string);
451 		cleanup_exit(255);
452 	}
453 
454 	mismatch = 0;
455 	switch (remote_major) {
456 	case 1:
457 		if (remote_minor == 99) {
458 			if (options.protocol & SSH_PROTO_2)
459 				enable_compat20();
460 			else
461 				mismatch = 1;
462 			break;
463 		}
464 		if (!(options.protocol & SSH_PROTO_1)) {
465 			mismatch = 1;
466 			break;
467 		}
468 		if (remote_minor < 3) {
469 			packet_disconnect("Your ssh version is too old and "
470 			    "is no longer supported.  Please install a newer version.");
471 		} else if (remote_minor == 3) {
472 			/* note that this disables agent-forwarding */
473 			enable_compat13();
474 		}
475 		break;
476 	case 2:
477 		if (options.protocol & SSH_PROTO_2) {
478 			enable_compat20();
479 			break;
480 		}
481 		/* FALLTHROUGH */
482 	default:
483 		mismatch = 1;
484 		break;
485 	}
486 	chop(server_version_string);
487 	debug("Local version string %.200s", server_version_string);
488 
489 	if (mismatch) {
490 		s = "Protocol major versions differ.\n";
491 		(void) atomicio(vwrite, sock_out, s, strlen(s));
492 		close(sock_in);
493 		close(sock_out);
494 		logit("Protocol major versions differ for %s: %.200s vs. %.200s",
495 		    get_remote_ipaddr(),
496 		    server_version_string, client_version_string);
497 		cleanup_exit(255);
498 	}
499 }
500 
501 /* Destroy the host and server keys.  They will no longer be needed. */
502 void
503 destroy_sensitive_data(void)
504 {
505 	int i;
506 
507 	if (sensitive_data.server_key) {
508 		key_free(sensitive_data.server_key);
509 		sensitive_data.server_key = NULL;
510 	}
511 	for (i = 0; i < options.num_host_key_files; i++) {
512 		if (sensitive_data.host_keys[i]) {
513 			key_free(sensitive_data.host_keys[i]);
514 			sensitive_data.host_keys[i] = NULL;
515 		}
516 	}
517 	sensitive_data.ssh1_host_key = NULL;
518 	memset(sensitive_data.ssh1_cookie, 0, SSH_SESSION_KEY_LENGTH);
519 }
520 
521 /* Demote private to public keys for network child */
522 void
523 demote_sensitive_data(void)
524 {
525 	Key *tmp;
526 	int i;
527 
528 	if (sensitive_data.server_key) {
529 		tmp = key_demote(sensitive_data.server_key);
530 		key_free(sensitive_data.server_key);
531 		sensitive_data.server_key = tmp;
532 	}
533 
534 	for (i = 0; i < options.num_host_key_files; i++) {
535 		if (sensitive_data.host_keys[i]) {
536 			tmp = key_demote(sensitive_data.host_keys[i]);
537 			key_free(sensitive_data.host_keys[i]);
538 			sensitive_data.host_keys[i] = tmp;
539 			if (tmp->type == KEY_RSA1)
540 				sensitive_data.ssh1_host_key = tmp;
541 		}
542 	}
543 
544 	/* We do not clear ssh1_host key and cookie.  XXX - Okay Niels? */
545 }
546 
547 static void
548 privsep_preauth_child(void)
549 {
550 	u_int32_t rnd[256];
551 	gid_t gidset[1];
552 	struct passwd *pw;
553 	int i;
554 
555 	/* Enable challenge-response authentication for privilege separation */
556 	privsep_challenge_enable();
557 
558 	for (i = 0; i < 256; i++)
559 		rnd[i] = arc4random();
560 	RAND_seed(rnd, sizeof(rnd));
561 
562 	/* Demote the private keys to public keys. */
563 	demote_sensitive_data();
564 
565 	if ((pw = getpwnam(SSH_PRIVSEP_USER)) == NULL)
566 		fatal("Privilege separation user %s does not exist",
567 		    SSH_PRIVSEP_USER);
568 	memset(pw->pw_passwd, 0, strlen(pw->pw_passwd));
569 	endpwent();
570 
571 	/* Change our root directory */
572 	if (chroot(_PATH_PRIVSEP_CHROOT_DIR) == -1)
573 		fatal("chroot(\"%s\"): %s", _PATH_PRIVSEP_CHROOT_DIR,
574 		    strerror(errno));
575 	if (chdir("/") == -1)
576 		fatal("chdir(\"/\"): %s", strerror(errno));
577 
578 	/* Drop our privileges */
579 	debug3("privsep user:group %u:%u", (u_int)pw->pw_uid,
580 	    (u_int)pw->pw_gid);
581 #if 0
582 	/* XXX not ready, too heavy after chroot */
583 	do_setusercontext(pw);
584 #else
585 	gidset[0] = pw->pw_gid;
586 	if (setgroups(1, gidset) < 0)
587 		fatal("setgroups: %.100s", strerror(errno));
588 	permanently_set_uid(pw);
589 #endif
590 }
591 
592 static int
593 privsep_preauth(Authctxt *authctxt)
594 {
595 	int status;
596 	pid_t pid;
597 
598 	/* Set up unprivileged child process to deal with network data */
599 	pmonitor = monitor_init();
600 	/* Store a pointer to the kex for later rekeying */
601 	pmonitor->m_pkex = &xxx_kex;
602 
603 	pid = fork();
604 	if (pid == -1) {
605 		fatal("fork of unprivileged child failed");
606 	} else if (pid != 0) {
607 		debug2("Network child is on pid %ld", (long)pid);
608 
609 		close(pmonitor->m_recvfd);
610 		pmonitor->m_pid = pid;
611 		monitor_child_preauth(authctxt, pmonitor);
612 		close(pmonitor->m_sendfd);
613 
614 		/* Sync memory */
615 		monitor_sync(pmonitor);
616 
617 		/* Wait for the child's exit status */
618 		while (waitpid(pid, &status, 0) < 0)
619 			if (errno != EINTR)
620 				break;
621 		return (1);
622 	} else {
623 		/* child */
624 
625 		close(pmonitor->m_sendfd);
626 
627 		/* Demote the child */
628 		if (getuid() == 0 || geteuid() == 0)
629 			privsep_preauth_child();
630 		setproctitle("%s", "[net]");
631 	}
632 	return (0);
633 }
634 
635 static void
636 privsep_postauth(Authctxt *authctxt)
637 {
638 #ifdef DISABLE_FD_PASSING
639 	if (1) {
640 #else
641 	if (authctxt->pw->pw_uid == 0 || options.use_login) {
642 #endif
643 		/* File descriptor passing is broken or root login */
644 		monitor_apply_keystate(pmonitor);
645 		use_privsep = 0;
646 		return;
647 	}
648 
649 	/* Authentication complete */
650 	alarm(0);
651 	if (startup_pipe != -1) {
652 		close(startup_pipe);
653 		startup_pipe = -1;
654 	}
655 
656 	/* New socket pair */
657 	monitor_reinit(pmonitor);
658 
659 	pmonitor->m_pid = fork();
660 	if (pmonitor->m_pid == -1)
661 		fatal("fork of unprivileged child failed");
662 	else if (pmonitor->m_pid != 0) {
663 		debug2("User child is on pid %ld", (long)pmonitor->m_pid);
664 		close(pmonitor->m_recvfd);
665 		buffer_clear(&loginmsg);
666 		monitor_child_postauth(pmonitor);
667 
668 		/* NEVERREACHED */
669 		exit(0);
670 	}
671 
672 	close(pmonitor->m_sendfd);
673 
674 	/* Demote the private keys to public keys. */
675 	demote_sensitive_data();
676 
677 	/* Drop privileges */
678 	do_setusercontext(authctxt->pw);
679 
680 	/* It is safe now to apply the key state */
681 	monitor_apply_keystate(pmonitor);
682 
683 	/*
684 	 * Tell the packet layer that authentication was successful, since
685 	 * this information is not part of the key state.
686 	 */
687 	packet_set_authenticated();
688 }
689 
690 static char *
691 list_hostkey_types(void)
692 {
693 	Buffer b;
694 	const char *p;
695 	char *ret;
696 	int i;
697 
698 	buffer_init(&b);
699 	for (i = 0; i < options.num_host_key_files; i++) {
700 		Key *key = sensitive_data.host_keys[i];
701 		if (key == NULL)
702 			continue;
703 		switch (key->type) {
704 		case KEY_RSA:
705 		case KEY_DSA:
706 			if (buffer_len(&b) > 0)
707 				buffer_append(&b, ",", 1);
708 			p = key_ssh_name(key);
709 			buffer_append(&b, p, strlen(p));
710 			break;
711 		}
712 	}
713 	buffer_append(&b, "\0", 1);
714 	ret = xstrdup(buffer_ptr(&b));
715 	buffer_free(&b);
716 	debug("list_hostkey_types: %s", ret);
717 	return ret;
718 }
719 
720 Key *
721 get_hostkey_by_type(int type)
722 {
723 	int i;
724 
725 	for (i = 0; i < options.num_host_key_files; i++) {
726 		Key *key = sensitive_data.host_keys[i];
727 		if (key != NULL && key->type == type)
728 			return key;
729 	}
730 	return NULL;
731 }
732 
733 Key *
734 get_hostkey_by_index(int ind)
735 {
736 	if (ind < 0 || ind >= options.num_host_key_files)
737 		return (NULL);
738 	return (sensitive_data.host_keys[ind]);
739 }
740 
741 int
742 get_hostkey_index(Key *key)
743 {
744 	int i;
745 
746 	for (i = 0; i < options.num_host_key_files; i++) {
747 		if (key == sensitive_data.host_keys[i])
748 			return (i);
749 	}
750 	return (-1);
751 }
752 
753 /*
754  * returns 1 if connection should be dropped, 0 otherwise.
755  * dropping starts at connection #max_startups_begin with a probability
756  * of (max_startups_rate/100). the probability increases linearly until
757  * all connections are dropped for startups > max_startups
758  */
759 static int
760 drop_connection(int startups)
761 {
762 	int p, r;
763 
764 	if (startups < options.max_startups_begin)
765 		return 0;
766 	if (startups >= options.max_startups)
767 		return 1;
768 	if (options.max_startups_rate == 100)
769 		return 1;
770 
771 	p  = 100 - options.max_startups_rate;
772 	p *= startups - options.max_startups_begin;
773 	p /= options.max_startups - options.max_startups_begin;
774 	p += options.max_startups_rate;
775 	r = arc4random() % 100;
776 
777 	debug("drop_connection: p %d, r %d", p, r);
778 	return (r < p) ? 1 : 0;
779 }
780 
781 static void
782 usage(void)
783 {
784 	fprintf(stderr, "%s, %s\n",
785 	    SSH_RELEASE, SSLeay_version(SSLEAY_VERSION));
786 	fprintf(stderr,
787 "usage: sshd [-46Ddeiqt] [-b bits] [-f config_file] [-g login_grace_time]\n"
788 "            [-h host_key_file] [-k key_gen_time] [-o option] [-p port] [-u len]\n"
789 	);
790 	exit(1);
791 }
792 
793 static void
794 send_rexec_state(int fd, Buffer *conf)
795 {
796 	Buffer m;
797 
798 	debug3("%s: entering fd = %d config len %d", __func__, fd,
799 	    buffer_len(conf));
800 
801 	/*
802 	 * Protocol from reexec master to child:
803 	 *	string	configuration
804 	 *	u_int	ephemeral_key_follows
805 	 *	bignum	e		(only if ephemeral_key_follows == 1)
806 	 *	bignum	n			"
807 	 *	bignum	d			"
808 	 *	bignum	iqmp			"
809 	 *	bignum	p			"
810 	 *	bignum	q			"
811 	 */
812 	buffer_init(&m);
813 	buffer_put_cstring(&m, buffer_ptr(conf));
814 
815 	if (sensitive_data.server_key != NULL &&
816 	    sensitive_data.server_key->type == KEY_RSA1) {
817 		buffer_put_int(&m, 1);
818 		buffer_put_bignum(&m, sensitive_data.server_key->rsa->e);
819 		buffer_put_bignum(&m, sensitive_data.server_key->rsa->n);
820 		buffer_put_bignum(&m, sensitive_data.server_key->rsa->d);
821 		buffer_put_bignum(&m, sensitive_data.server_key->rsa->iqmp);
822 		buffer_put_bignum(&m, sensitive_data.server_key->rsa->p);
823 		buffer_put_bignum(&m, sensitive_data.server_key->rsa->q);
824 	} else
825 		buffer_put_int(&m, 0);
826 
827 	if (ssh_msg_send(fd, 0, &m) == -1)
828 		fatal("%s: ssh_msg_send failed", __func__);
829 
830 	buffer_free(&m);
831 
832 	debug3("%s: done", __func__);
833 }
834 
835 static void
836 recv_rexec_state(int fd, Buffer *conf)
837 {
838 	Buffer m;
839 	char *cp;
840 	u_int len;
841 
842 	debug3("%s: entering fd = %d", __func__, fd);
843 
844 	buffer_init(&m);
845 
846 	if (ssh_msg_recv(fd, &m) == -1)
847 		fatal("%s: ssh_msg_recv failed", __func__);
848 	if (buffer_get_char(&m) != 0)
849 		fatal("%s: rexec version mismatch", __func__);
850 
851 	cp = buffer_get_string(&m, &len);
852 	if (conf != NULL)
853 		buffer_append(conf, cp, len + 1);
854 	xfree(cp);
855 
856 	if (buffer_get_int(&m)) {
857 		if (sensitive_data.server_key != NULL)
858 			key_free(sensitive_data.server_key);
859 		sensitive_data.server_key = key_new_private(KEY_RSA1);
860 		buffer_get_bignum(&m, sensitive_data.server_key->rsa->e);
861 		buffer_get_bignum(&m, sensitive_data.server_key->rsa->n);
862 		buffer_get_bignum(&m, sensitive_data.server_key->rsa->d);
863 		buffer_get_bignum(&m, sensitive_data.server_key->rsa->iqmp);
864 		buffer_get_bignum(&m, sensitive_data.server_key->rsa->p);
865 		buffer_get_bignum(&m, sensitive_data.server_key->rsa->q);
866 		rsa_generate_additional_parameters(
867 		    sensitive_data.server_key->rsa);
868 	}
869 	buffer_free(&m);
870 
871 	debug3("%s: done", __func__);
872 }
873 
874 /*
875  * Main program for the daemon.
876  */
877 int
878 main(int ac, char **av)
879 {
880 	extern char *optarg;
881 	extern int optind;
882 	int opt, j, i, fdsetsz, on = 1;
883 	int sock_in = -1, sock_out = -1, newsock = -1;
884 	pid_t pid;
885 	socklen_t fromlen;
886 	fd_set *fdset;
887 	struct sockaddr_storage from;
888 	const char *remote_ip;
889 	int remote_port;
890 	FILE *f;
891 	struct addrinfo *ai;
892 	char ntop[NI_MAXHOST], strport[NI_MAXSERV];
893 	char *line;
894 	int listen_sock, maxfd;
895 	int startup_p[2] = { -1 , -1 }, config_s[2] = { -1 , -1 };
896 	int startups = 0;
897 	Key *key;
898 	Authctxt *authctxt;
899 	int ret, key_used = 0;
900 	Buffer cfg;
901 
902 #ifdef HAVE_SECUREWARE
903 	(void)set_auth_parameters(ac, av);
904 #endif
905 	__progname = ssh_get_progname(av[0]);
906 	init_rng();
907 
908 	/* Save argv. Duplicate so setproctitle emulation doesn't clobber it */
909 	saved_argc = ac;
910 	rexec_argc = ac;
911 	saved_argv = xmalloc(sizeof(*saved_argv) * (ac + 1));
912 	for (i = 0; i < ac; i++)
913 		saved_argv[i] = xstrdup(av[i]);
914 	saved_argv[i] = NULL;
915 
916 #ifndef HAVE_SETPROCTITLE
917 	/* Prepare for later setproctitle emulation */
918 	compat_init_setproctitle(ac, av);
919 	av = saved_argv;
920 #endif
921 
922 	if (geteuid() == 0 && setgroups(0, NULL) == -1)
923 		debug("setgroups(): %.200s", strerror(errno));
924 
925 	/* Initialize configuration options to their default values. */
926 	initialize_server_options(&options);
927 
928 	/* Parse command-line arguments. */
929 	while ((opt = getopt(ac, av, "f:p:b:k:h:g:u:o:dDeiqrtQR46")) != -1) {
930 		switch (opt) {
931 		case '4':
932 			options.address_family = AF_INET;
933 			break;
934 		case '6':
935 			options.address_family = AF_INET6;
936 			break;
937 		case 'f':
938 			config_file_name = optarg;
939 			break;
940 		case 'd':
941 			if (debug_flag == 0) {
942 				debug_flag = 1;
943 				options.log_level = SYSLOG_LEVEL_DEBUG1;
944 			} else if (options.log_level < SYSLOG_LEVEL_DEBUG3)
945 				options.log_level++;
946 			break;
947 		case 'D':
948 			no_daemon_flag = 1;
949 			break;
950 		case 'e':
951 			log_stderr = 1;
952 			break;
953 		case 'i':
954 			inetd_flag = 1;
955 			break;
956 		case 'r':
957 			rexec_flag = 0;
958 			break;
959 		case 'R':
960 			rexeced_flag = 1;
961 			inetd_flag = 1;
962 			break;
963 		case 'Q':
964 			/* ignored */
965 			break;
966 		case 'q':
967 			options.log_level = SYSLOG_LEVEL_QUIET;
968 			break;
969 		case 'b':
970 			options.server_key_bits = atoi(optarg);
971 			break;
972 		case 'p':
973 			options.ports_from_cmdline = 1;
974 			if (options.num_ports >= MAX_PORTS) {
975 				fprintf(stderr, "too many ports.\n");
976 				exit(1);
977 			}
978 			options.ports[options.num_ports++] = a2port(optarg);
979 			if (options.ports[options.num_ports-1] == 0) {
980 				fprintf(stderr, "Bad port number.\n");
981 				exit(1);
982 			}
983 			break;
984 		case 'g':
985 			if ((options.login_grace_time = convtime(optarg)) == -1) {
986 				fprintf(stderr, "Invalid login grace time.\n");
987 				exit(1);
988 			}
989 			break;
990 		case 'k':
991 			if ((options.key_regeneration_time = convtime(optarg)) == -1) {
992 				fprintf(stderr, "Invalid key regeneration interval.\n");
993 				exit(1);
994 			}
995 			break;
996 		case 'h':
997 			if (options.num_host_key_files >= MAX_HOSTKEYS) {
998 				fprintf(stderr, "too many host keys.\n");
999 				exit(1);
1000 			}
1001 			options.host_key_files[options.num_host_key_files++] = optarg;
1002 			break;
1003 		case 't':
1004 			test_flag = 1;
1005 			break;
1006 		case 'u':
1007 			utmp_len = atoi(optarg);
1008 			if (utmp_len > MAXHOSTNAMELEN) {
1009 				fprintf(stderr, "Invalid utmp length.\n");
1010 				exit(1);
1011 			}
1012 			break;
1013 		case 'o':
1014 			line = xstrdup(optarg);
1015 			if (process_server_config_line(&options, line,
1016 			    "command-line", 0) != 0)
1017 				exit(1);
1018 			xfree(line);
1019 			break;
1020 		case '?':
1021 		default:
1022 			usage();
1023 			break;
1024 		}
1025 	}
1026 	if (rexeced_flag || inetd_flag)
1027 		rexec_flag = 0;
1028 	if (rexec_flag && (av[0] == NULL || *av[0] != '/'))
1029 		fatal("sshd re-exec requires execution with an absolute path");
1030 	if (rexeced_flag)
1031 		closefrom(REEXEC_MIN_FREE_FD);
1032 	else
1033 		closefrom(REEXEC_DEVCRYPTO_RESERVED_FD);
1034 
1035 	SSLeay_add_all_algorithms();
1036 
1037 	/*
1038 	 * Force logging to stderr until we have loaded the private host
1039 	 * key (unless started from inetd)
1040 	 */
1041 	log_init(__progname,
1042 	    options.log_level == SYSLOG_LEVEL_NOT_SET ?
1043 	    SYSLOG_LEVEL_INFO : options.log_level,
1044 	    options.log_facility == SYSLOG_FACILITY_NOT_SET ?
1045 	    SYSLOG_FACILITY_AUTH : options.log_facility,
1046 	    log_stderr || !inetd_flag);
1047 
1048 	/*
1049 	 * Unset KRB5CCNAME, otherwise the user's session may inherit it from
1050 	 * root's environment
1051 	 */
1052 	if (getenv("KRB5CCNAME") != NULL)
1053 		unsetenv("KRB5CCNAME");
1054 
1055 #ifdef _UNICOS
1056 	/* Cray can define user privs drop all privs now!
1057 	 * Not needed on PRIV_SU systems!
1058 	 */
1059 	drop_cray_privs();
1060 #endif
1061 
1062 	seed_rng();
1063 
1064 	sensitive_data.server_key = NULL;
1065 	sensitive_data.ssh1_host_key = NULL;
1066 	sensitive_data.have_ssh1_key = 0;
1067 	sensitive_data.have_ssh2_key = 0;
1068 
1069 	/* Fetch our configuration */
1070 	buffer_init(&cfg);
1071 	if (rexeced_flag)
1072 		recv_rexec_state(REEXEC_CONFIG_PASS_FD, &cfg);
1073 	else
1074 		load_server_config(config_file_name, &cfg);
1075 
1076 	parse_server_config(&options,
1077 	    rexeced_flag ? "rexec" : config_file_name, &cfg);
1078 
1079 	if (!rexec_flag)
1080 		buffer_free(&cfg);
1081 
1082 	/* Fill in default values for those options not explicitly set. */
1083 	fill_default_server_options(&options);
1084 
1085 	/* set default channel AF */
1086 	channel_set_af(options.address_family);
1087 
1088 	/* Check that there are no remaining arguments. */
1089 	if (optind < ac) {
1090 		fprintf(stderr, "Extra argument %s.\n", av[optind]);
1091 		exit(1);
1092 	}
1093 
1094 	debug("sshd version %.100s", SSH_RELEASE);
1095 
1096 	/* load private host keys */
1097 	sensitive_data.host_keys = xmalloc(options.num_host_key_files *
1098 	    sizeof(Key *));
1099 	for (i = 0; i < options.num_host_key_files; i++)
1100 		sensitive_data.host_keys[i] = NULL;
1101 
1102 	for (i = 0; i < options.num_host_key_files; i++) {
1103 		key = key_load_private(options.host_key_files[i], "", NULL);
1104 		sensitive_data.host_keys[i] = key;
1105 		if (key == NULL) {
1106 			error("Could not load host key: %s",
1107 			    options.host_key_files[i]);
1108 			sensitive_data.host_keys[i] = NULL;
1109 			continue;
1110 		}
1111 		switch (key->type) {
1112 		case KEY_RSA1:
1113 			sensitive_data.ssh1_host_key = key;
1114 			sensitive_data.have_ssh1_key = 1;
1115 			break;
1116 		case KEY_RSA:
1117 		case KEY_DSA:
1118 			sensitive_data.have_ssh2_key = 1;
1119 			break;
1120 		}
1121 		debug("private host key: #%d type %d %s", i, key->type,
1122 		    key_type(key));
1123 	}
1124 	if ((options.protocol & SSH_PROTO_1) && !sensitive_data.have_ssh1_key) {
1125 		logit("Disabling protocol version 1. Could not load host key");
1126 		options.protocol &= ~SSH_PROTO_1;
1127 	}
1128 	if ((options.protocol & SSH_PROTO_2) && !sensitive_data.have_ssh2_key) {
1129 		logit("Disabling protocol version 2. Could not load host key");
1130 		options.protocol &= ~SSH_PROTO_2;
1131 	}
1132 	if (!(options.protocol & (SSH_PROTO_1|SSH_PROTO_2))) {
1133 		logit("sshd: no hostkeys available -- exiting.");
1134 		exit(1);
1135 	}
1136 
1137 	/* Check certain values for sanity. */
1138 	if (options.protocol & SSH_PROTO_1) {
1139 		if (options.server_key_bits < 512 ||
1140 		    options.server_key_bits > 32768) {
1141 			fprintf(stderr, "Bad server key size.\n");
1142 			exit(1);
1143 		}
1144 		/*
1145 		 * Check that server and host key lengths differ sufficiently. This
1146 		 * is necessary to make double encryption work with rsaref. Oh, I
1147 		 * hate software patents. I dont know if this can go? Niels
1148 		 */
1149 		if (options.server_key_bits >
1150 		    BN_num_bits(sensitive_data.ssh1_host_key->rsa->n) -
1151 		    SSH_KEY_BITS_RESERVED && options.server_key_bits <
1152 		    BN_num_bits(sensitive_data.ssh1_host_key->rsa->n) +
1153 		    SSH_KEY_BITS_RESERVED) {
1154 			options.server_key_bits =
1155 			    BN_num_bits(sensitive_data.ssh1_host_key->rsa->n) +
1156 			    SSH_KEY_BITS_RESERVED;
1157 			debug("Forcing server key to %d bits to make it differ from host key.",
1158 			    options.server_key_bits);
1159 		}
1160 	}
1161 
1162 	if (use_privsep) {
1163 		struct passwd *pw;
1164 		struct stat st;
1165 
1166 		if ((pw = getpwnam(SSH_PRIVSEP_USER)) == NULL)
1167 			fatal("Privilege separation user %s does not exist",
1168 			    SSH_PRIVSEP_USER);
1169 		if ((stat(_PATH_PRIVSEP_CHROOT_DIR, &st) == -1) ||
1170 		    (S_ISDIR(st.st_mode) == 0))
1171 			fatal("Missing privilege separation directory: %s",
1172 			    _PATH_PRIVSEP_CHROOT_DIR);
1173 
1174 #ifdef HAVE_CYGWIN
1175 		if (check_ntsec(_PATH_PRIVSEP_CHROOT_DIR) &&
1176 		    (st.st_uid != getuid () ||
1177 		    (st.st_mode & (S_IWGRP|S_IWOTH)) != 0))
1178 #else
1179 		if (st.st_uid != 0 || (st.st_mode & (S_IWGRP|S_IWOTH)) != 0)
1180 #endif
1181 			fatal("%s must be owned by root and not group or "
1182 			    "world-writable.", _PATH_PRIVSEP_CHROOT_DIR);
1183 	}
1184 
1185 	/* Configuration looks good, so exit if in test mode. */
1186 	if (test_flag)
1187 		exit(0);
1188 
1189 	/*
1190 	 * Clear out any supplemental groups we may have inherited.  This
1191 	 * prevents inadvertent creation of files with bad modes (in the
1192 	 * portable version at least, it's certainly possible for PAM
1193 	 * to create a file, and we can't control the code in every
1194 	 * module which might be used).
1195 	 */
1196 	if (setgroups(0, NULL) < 0)
1197 		debug("setgroups() failed: %.200s", strerror(errno));
1198 
1199 	if (rexec_flag) {
1200 		rexec_argv = xmalloc(sizeof(char *) * (rexec_argc + 2));
1201 		for (i = 0; i < rexec_argc; i++) {
1202 			debug("rexec_argv[%d]='%s'", i, saved_argv[i]);
1203 			rexec_argv[i] = saved_argv[i];
1204 		}
1205 		rexec_argv[rexec_argc] = "-R";
1206 		rexec_argv[rexec_argc + 1] = NULL;
1207 	}
1208 
1209 	/* Initialize the log (it is reinitialized below in case we forked). */
1210 	if (debug_flag && (!inetd_flag || rexeced_flag))
1211 		log_stderr = 1;
1212 	log_init(__progname, options.log_level, options.log_facility, log_stderr);
1213 
1214 	/*
1215 	 * If not in debugging mode, and not started from inetd, disconnect
1216 	 * from the controlling terminal, and fork.  The original process
1217 	 * exits.
1218 	 */
1219 	if (!(debug_flag || inetd_flag || no_daemon_flag)) {
1220 #ifdef TIOCNOTTY
1221 		int fd;
1222 #endif /* TIOCNOTTY */
1223 		if (daemon(0, 0) < 0)
1224 			fatal("daemon() failed: %.200s", strerror(errno));
1225 
1226 		/* Disconnect from the controlling tty. */
1227 #ifdef TIOCNOTTY
1228 		fd = open(_PATH_TTY, O_RDWR | O_NOCTTY);
1229 		if (fd >= 0) {
1230 			(void) ioctl(fd, TIOCNOTTY, NULL);
1231 			close(fd);
1232 		}
1233 #endif /* TIOCNOTTY */
1234 	}
1235 	/* Reinitialize the log (because of the fork above). */
1236 	log_init(__progname, options.log_level, options.log_facility, log_stderr);
1237 
1238 	/* Initialize the random number generator. */
1239 	arc4random_stir();
1240 
1241 	/* Chdir to the root directory so that the current disk can be
1242 	   unmounted if desired. */
1243 	chdir("/");
1244 
1245 	/* ignore SIGPIPE */
1246 	signal(SIGPIPE, SIG_IGN);
1247 
1248 	/* Start listening for a socket, unless started from inetd. */
1249 	if (inetd_flag) {
1250 		int fd;
1251 
1252 		startup_pipe = -1;
1253 		if (rexeced_flag) {
1254 			close(REEXEC_CONFIG_PASS_FD);
1255 			sock_in = sock_out = dup(STDIN_FILENO);
1256 			if (!debug_flag) {
1257 				startup_pipe = dup(REEXEC_STARTUP_PIPE_FD);
1258 				close(REEXEC_STARTUP_PIPE_FD);
1259 			}
1260 		} else {
1261 			sock_in = dup(STDIN_FILENO);
1262 			sock_out = dup(STDOUT_FILENO);
1263 		}
1264 		/*
1265 		 * We intentionally do not close the descriptors 0, 1, and 2
1266 		 * as our code for setting the descriptors won't work if
1267 		 * ttyfd happens to be one of those.
1268 		 */
1269 		if ((fd = open(_PATH_DEVNULL, O_RDWR, 0)) != -1) {
1270 			dup2(fd, STDIN_FILENO);
1271 			dup2(fd, STDOUT_FILENO);
1272 			if (fd > STDOUT_FILENO)
1273 				close(fd);
1274 		}
1275 		debug("inetd sockets after dupping: %d, %d", sock_in, sock_out);
1276 		if ((options.protocol & SSH_PROTO_1) &&
1277 		    sensitive_data.server_key == NULL)
1278 			generate_ephemeral_server_key();
1279 	} else {
1280 		for (ai = options.listen_addrs; ai; ai = ai->ai_next) {
1281 			if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6)
1282 				continue;
1283 			if (num_listen_socks >= MAX_LISTEN_SOCKS)
1284 				fatal("Too many listen sockets. "
1285 				    "Enlarge MAX_LISTEN_SOCKS");
1286 			if ((ret = getnameinfo(ai->ai_addr, ai->ai_addrlen,
1287 			    ntop, sizeof(ntop), strport, sizeof(strport),
1288 			    NI_NUMERICHOST|NI_NUMERICSERV)) != 0) {
1289 				error("getnameinfo failed: %.100s",
1290 				    (ret != EAI_SYSTEM) ? gai_strerror(ret) :
1291 				    strerror(errno));
1292 				continue;
1293 			}
1294 			/* Create socket for listening. */
1295 			listen_sock = socket(ai->ai_family, ai->ai_socktype,
1296 			    ai->ai_protocol);
1297 			if (listen_sock < 0) {
1298 				/* kernel may not support ipv6 */
1299 				verbose("socket: %.100s", strerror(errno));
1300 				continue;
1301 			}
1302 			if (set_nonblock(listen_sock) == -1) {
1303 				close(listen_sock);
1304 				continue;
1305 			}
1306 			/*
1307 			 * Set socket options.
1308 			 * Allow local port reuse in TIME_WAIT.
1309 			 */
1310 			if (setsockopt(listen_sock, SOL_SOCKET, SO_REUSEADDR,
1311 			    &on, sizeof(on)) == -1)
1312 				error("setsockopt SO_REUSEADDR: %s", strerror(errno));
1313 
1314 			debug("Bind to port %s on %s.", strport, ntop);
1315 
1316 			/* Bind the socket to the desired port. */
1317 			if (bind(listen_sock, ai->ai_addr, ai->ai_addrlen) < 0) {
1318 				if (!ai->ai_next)
1319 				    error("Bind to port %s on %s failed: %.200s.",
1320 					    strport, ntop, strerror(errno));
1321 				close(listen_sock);
1322 				continue;
1323 			}
1324 			listen_socks[num_listen_socks] = listen_sock;
1325 			num_listen_socks++;
1326 
1327 			/* Start listening on the port. */
1328 			logit("Server listening on %s port %s.", ntop, strport);
1329 			if (listen(listen_sock, SSH_LISTEN_BACKLOG) < 0)
1330 				fatal("listen: %.100s", strerror(errno));
1331 
1332 		}
1333 		freeaddrinfo(options.listen_addrs);
1334 
1335 		if (!num_listen_socks)
1336 			fatal("Cannot bind any address.");
1337 
1338 		if (options.protocol & SSH_PROTO_1)
1339 			generate_ephemeral_server_key();
1340 
1341 		/*
1342 		 * Arrange to restart on SIGHUP.  The handler needs
1343 		 * listen_sock.
1344 		 */
1345 		signal(SIGHUP, sighup_handler);
1346 
1347 		signal(SIGTERM, sigterm_handler);
1348 		signal(SIGQUIT, sigterm_handler);
1349 
1350 		/* Arrange SIGCHLD to be caught. */
1351 		signal(SIGCHLD, main_sigchld_handler);
1352 
1353 		/* Write out the pid file after the sigterm handler is setup */
1354 		if (!debug_flag) {
1355 			/*
1356 			 * Record our pid in /var/run/sshd.pid to make it
1357 			 * easier to kill the correct sshd.  We don't want to
1358 			 * do this before the bind above because the bind will
1359 			 * fail if there already is a daemon, and this will
1360 			 * overwrite any old pid in the file.
1361 			 */
1362 			f = fopen(options.pid_file, "wb");
1363 			if (f == NULL) {
1364 				error("Couldn't create pid file \"%s\": %s",
1365 				    options.pid_file, strerror(errno));
1366 			} else {
1367 				fprintf(f, "%ld\n", (long) getpid());
1368 				fclose(f);
1369 			}
1370 		}
1371 
1372 		/* setup fd set for listen */
1373 		fdset = NULL;
1374 		maxfd = 0;
1375 		for (i = 0; i < num_listen_socks; i++)
1376 			if (listen_socks[i] > maxfd)
1377 				maxfd = listen_socks[i];
1378 		/* pipes connected to unauthenticated childs */
1379 		startup_pipes = xmalloc(options.max_startups * sizeof(int));
1380 		for (i = 0; i < options.max_startups; i++)
1381 			startup_pipes[i] = -1;
1382 
1383 		/*
1384 		 * Stay listening for connections until the system crashes or
1385 		 * the daemon is killed with a signal.
1386 		 */
1387 		for (;;) {
1388 			if (received_sighup)
1389 				sighup_restart();
1390 			if (fdset != NULL)
1391 				xfree(fdset);
1392 			fdsetsz = howmany(maxfd+1, NFDBITS) * sizeof(fd_mask);
1393 			fdset = (fd_set *)xmalloc(fdsetsz);
1394 			memset(fdset, 0, fdsetsz);
1395 
1396 			for (i = 0; i < num_listen_socks; i++)
1397 				FD_SET(listen_socks[i], fdset);
1398 			for (i = 0; i < options.max_startups; i++)
1399 				if (startup_pipes[i] != -1)
1400 					FD_SET(startup_pipes[i], fdset);
1401 
1402 			/* Wait in select until there is a connection. */
1403 			ret = select(maxfd+1, fdset, NULL, NULL, NULL);
1404 			if (ret < 0 && errno != EINTR)
1405 				error("select: %.100s", strerror(errno));
1406 			if (received_sigterm) {
1407 				logit("Received signal %d; terminating.",
1408 				    (int) received_sigterm);
1409 				close_listen_socks();
1410 				unlink(options.pid_file);
1411 				exit(255);
1412 			}
1413 			if (key_used && key_do_regen) {
1414 				generate_ephemeral_server_key();
1415 				key_used = 0;
1416 				key_do_regen = 0;
1417 			}
1418 			if (ret < 0)
1419 				continue;
1420 
1421 			for (i = 0; i < options.max_startups; i++)
1422 				if (startup_pipes[i] != -1 &&
1423 				    FD_ISSET(startup_pipes[i], fdset)) {
1424 					/*
1425 					 * the read end of the pipe is ready
1426 					 * if the child has closed the pipe
1427 					 * after successful authentication
1428 					 * or if the child has died
1429 					 */
1430 					close(startup_pipes[i]);
1431 					startup_pipes[i] = -1;
1432 					startups--;
1433 				}
1434 			for (i = 0; i < num_listen_socks; i++) {
1435 				if (!FD_ISSET(listen_socks[i], fdset))
1436 					continue;
1437 				fromlen = sizeof(from);
1438 				newsock = accept(listen_socks[i], (struct sockaddr *)&from,
1439 				    &fromlen);
1440 				if (newsock < 0) {
1441 					if (errno != EINTR && errno != EWOULDBLOCK)
1442 						error("accept: %.100s", strerror(errno));
1443 					continue;
1444 				}
1445 				if (unset_nonblock(newsock) == -1) {
1446 					close(newsock);
1447 					continue;
1448 				}
1449 				if (drop_connection(startups) == 1) {
1450 					debug("drop connection #%d", startups);
1451 					close(newsock);
1452 					continue;
1453 				}
1454 				if (pipe(startup_p) == -1) {
1455 					close(newsock);
1456 					continue;
1457 				}
1458 
1459 				if (rexec_flag && socketpair(AF_UNIX,
1460 				    SOCK_STREAM, 0, config_s) == -1) {
1461 					error("reexec socketpair: %s",
1462 					    strerror(errno));
1463 					close(newsock);
1464 					close(startup_p[0]);
1465 					close(startup_p[1]);
1466 					continue;
1467 				}
1468 
1469 				for (j = 0; j < options.max_startups; j++)
1470 					if (startup_pipes[j] == -1) {
1471 						startup_pipes[j] = startup_p[0];
1472 						if (maxfd < startup_p[0])
1473 							maxfd = startup_p[0];
1474 						startups++;
1475 						break;
1476 					}
1477 
1478 				/*
1479 				 * Got connection.  Fork a child to handle it, unless
1480 				 * we are in debugging mode.
1481 				 */
1482 				if (debug_flag) {
1483 					/*
1484 					 * In debugging mode.  Close the listening
1485 					 * socket, and start processing the
1486 					 * connection without forking.
1487 					 */
1488 					debug("Server will not fork when running in debugging mode.");
1489 					close_listen_socks();
1490 					sock_in = newsock;
1491 					sock_out = newsock;
1492 					close(startup_p[0]);
1493 					close(startup_p[1]);
1494 					startup_pipe = -1;
1495 					pid = getpid();
1496 					if (rexec_flag) {
1497 						send_rexec_state(config_s[0],
1498 						    &cfg);
1499 						close(config_s[0]);
1500 					}
1501 					break;
1502 				} else {
1503 					/*
1504 					 * Normal production daemon.  Fork, and have
1505 					 * the child process the connection. The
1506 					 * parent continues listening.
1507 					 */
1508 					if ((pid = fork()) == 0) {
1509 						/*
1510 						 * Child.  Close the listening and max_startup
1511 						 * sockets.  Start using the accepted socket.
1512 						 * Reinitialize logging (since our pid has
1513 						 * changed).  We break out of the loop to handle
1514 						 * the connection.
1515 						 */
1516 						startup_pipe = startup_p[1];
1517 						close_startup_pipes();
1518 						close_listen_socks();
1519 						sock_in = newsock;
1520 						sock_out = newsock;
1521 						log_init(__progname, options.log_level, options.log_facility, log_stderr);
1522 						if (rexec_flag)
1523 							close(config_s[0]);
1524 						break;
1525 					}
1526 				}
1527 
1528 				/* Parent.  Stay in the loop. */
1529 				if (pid < 0)
1530 					error("fork: %.100s", strerror(errno));
1531 				else
1532 					debug("Forked child %ld.", (long)pid);
1533 
1534 				close(startup_p[1]);
1535 
1536 				if (rexec_flag) {
1537 					send_rexec_state(config_s[0], &cfg);
1538 					close(config_s[0]);
1539 					close(config_s[1]);
1540 				}
1541 
1542 				/* Mark that the key has been used (it was "given" to the child). */
1543 				if ((options.protocol & SSH_PROTO_1) &&
1544 				    key_used == 0) {
1545 					/* Schedule server key regeneration alarm. */
1546 					signal(SIGALRM, key_regeneration_alarm);
1547 					alarm(options.key_regeneration_time);
1548 					key_used = 1;
1549 				}
1550 
1551 				arc4random_stir();
1552 
1553 				/* Close the new socket (the child is now taking care of it). */
1554 				close(newsock);
1555 			}
1556 			/* child process check (or debug mode) */
1557 			if (num_listen_socks < 0)
1558 				break;
1559 		}
1560 	}
1561 
1562 	/* This is the child processing a new connection. */
1563 	setproctitle("%s", "[accepted]");
1564 
1565 	/*
1566 	 * Create a new session and process group since the 4.4BSD
1567 	 * setlogin() affects the entire process group.  We don't
1568 	 * want the child to be able to affect the parent.
1569 	 */
1570 #if !defined(SSHD_ACQUIRES_CTTY)
1571 	/*
1572 	 * If setsid is called, on some platforms sshd will later acquire a
1573 	 * controlling terminal which will result in "could not set
1574 	 * controlling tty" errors.
1575 	 */
1576 	if (!debug_flag && !inetd_flag && setsid() < 0)
1577 		error("setsid: %.100s", strerror(errno));
1578 #endif
1579 
1580 	if (rexec_flag) {
1581 		int fd;
1582 
1583 		debug("rexec start in %d out %d newsock %d pipe %d sock %d",
1584 		    sock_in, sock_out, newsock, startup_pipe, config_s[0]);
1585 		dup2(newsock, STDIN_FILENO);
1586 		dup2(STDIN_FILENO, STDOUT_FILENO);
1587 		if (startup_pipe == -1)
1588 			close(REEXEC_STARTUP_PIPE_FD);
1589 		else
1590 			dup2(startup_pipe, REEXEC_STARTUP_PIPE_FD);
1591 
1592 		dup2(config_s[1], REEXEC_CONFIG_PASS_FD);
1593 		close(config_s[1]);
1594 		if (startup_pipe != -1)
1595 			close(startup_pipe);
1596 
1597 		execv(rexec_argv[0], rexec_argv);
1598 
1599 		/* Reexec has failed, fall back and continue */
1600 		error("rexec of %s failed: %s", rexec_argv[0], strerror(errno));
1601 		recv_rexec_state(REEXEC_CONFIG_PASS_FD, NULL);
1602 		log_init(__progname, options.log_level,
1603 		    options.log_facility, log_stderr);
1604 
1605 		/* Clean up fds */
1606 		startup_pipe = REEXEC_STARTUP_PIPE_FD;
1607 		close(config_s[1]);
1608 		close(REEXEC_CONFIG_PASS_FD);
1609 		newsock = sock_out = sock_in = dup(STDIN_FILENO);
1610 		if ((fd = open(_PATH_DEVNULL, O_RDWR, 0)) != -1) {
1611 			dup2(fd, STDIN_FILENO);
1612 			dup2(fd, STDOUT_FILENO);
1613 			if (fd > STDERR_FILENO)
1614 				close(fd);
1615 		}
1616 		debug("rexec cleanup in %d out %d newsock %d pipe %d sock %d",
1617 		    sock_in, sock_out, newsock, startup_pipe, config_s[0]);
1618 	}
1619 
1620 	/*
1621 	 * Disable the key regeneration alarm.  We will not regenerate the
1622 	 * key since we are no longer in a position to give it to anyone. We
1623 	 * will not restart on SIGHUP since it no longer makes sense.
1624 	 */
1625 	alarm(0);
1626 	signal(SIGALRM, SIG_DFL);
1627 	signal(SIGHUP, SIG_DFL);
1628 	signal(SIGTERM, SIG_DFL);
1629 	signal(SIGQUIT, SIG_DFL);
1630 	signal(SIGCHLD, SIG_DFL);
1631 	signal(SIGINT, SIG_DFL);
1632 
1633 #ifdef __FreeBSD__
1634 	/*
1635 	 * Initialize the resolver.  This may not happen automatically
1636 	 * before privsep chroot().
1637 	 */
1638 	if ((_res.options & RES_INIT) == 0) {
1639 		debug("res_init()");
1640 		res_init();
1641 	}
1642 #ifdef GSSAPI
1643 	/*
1644 	 * Force GSS-API to parse its configuration and load any
1645 	 * mechanism plugins.
1646 	 */
1647 	{
1648 		gss_OID_set mechs;
1649 		OM_uint32 minor_status;
1650 		gss_indicate_mechs(&minor_status, &mechs);
1651 		gss_release_oid_set(&minor_status, &mechs);
1652 	}
1653 #endif
1654 #endif
1655 
1656 	/*
1657 	 * Register our connection.  This turns encryption off because we do
1658 	 * not have a key.
1659 	 */
1660 	packet_set_connection(sock_in, sock_out);
1661 	packet_set_server();
1662 
1663 	/* Set SO_KEEPALIVE if requested. */
1664 	if (options.tcp_keep_alive && packet_connection_is_on_socket() &&
1665 	    setsockopt(sock_in, SOL_SOCKET, SO_KEEPALIVE, &on, sizeof(on)) < 0)
1666 		error("setsockopt SO_KEEPALIVE: %.100s", strerror(errno));
1667 
1668 	if ((remote_port = get_remote_port()) < 0) {
1669 		debug("get_remote_port failed");
1670 		cleanup_exit(255);
1671 	}
1672 	remote_ip = get_remote_ipaddr();
1673 
1674 #ifdef SSH_AUDIT_EVENTS
1675 	audit_connection_from(remote_ip, remote_port);
1676 #endif
1677 #ifdef LIBWRAP
1678 	/* Check whether logins are denied from this host. */
1679 	if (packet_connection_is_on_socket()) {
1680 		struct request_info req;
1681 
1682 		request_init(&req, RQ_DAEMON, __progname, RQ_FILE, sock_in, 0);
1683 		fromhost(&req);
1684 
1685 		if (!hosts_access(&req)) {
1686 			debug("Connection refused by tcp wrapper");
1687 			refuse(&req);
1688 			/* NOTREACHED */
1689 			fatal("libwrap refuse returns");
1690 		}
1691 	}
1692 #endif /* LIBWRAP */
1693 
1694 	/* Log the connection. */
1695 	verbose("Connection from %.500s port %d", remote_ip, remote_port);
1696 
1697 	/*
1698 	 * We don\'t want to listen forever unless the other side
1699 	 * successfully authenticates itself.  So we set up an alarm which is
1700 	 * cleared after successful authentication.  A limit of zero
1701 	 * indicates no limit. Note that we don\'t set the alarm in debugging
1702 	 * mode; it is just annoying to have the server exit just when you
1703 	 * are about to discover the bug.
1704 	 */
1705 	signal(SIGALRM, grace_alarm_handler);
1706 	if (!debug_flag)
1707 		alarm(options.login_grace_time);
1708 
1709 	sshd_exchange_identification(sock_in, sock_out);
1710 
1711 	packet_set_nonblocking();
1712 
1713 	/* allocate authentication context */
1714 	authctxt = xmalloc(sizeof(*authctxt));
1715 	memset(authctxt, 0, sizeof(*authctxt));
1716 
1717 	authctxt->loginmsg = &loginmsg;
1718 
1719 	/* XXX global for cleanup, access from other modules */
1720 	the_authctxt = authctxt;
1721 
1722 	/* prepare buffer to collect messages to display to user after login */
1723 	buffer_init(&loginmsg);
1724 
1725 	if (use_privsep)
1726 		if (privsep_preauth(authctxt) == 1)
1727 			goto authenticated;
1728 
1729 	/* perform the key exchange */
1730 	/* authenticate user and start session */
1731 	if (compat20) {
1732 		do_ssh2_kex();
1733 		do_authentication2(authctxt);
1734 	} else {
1735 		do_ssh1_kex();
1736 		do_authentication(authctxt);
1737 	}
1738 	/*
1739 	 * If we use privilege separation, the unprivileged child transfers
1740 	 * the current keystate and exits
1741 	 */
1742 	if (use_privsep) {
1743 		mm_send_keystate(pmonitor);
1744 		exit(0);
1745 	}
1746 
1747  authenticated:
1748 #ifdef SSH_AUDIT_EVENTS
1749 	audit_event(SSH_AUTH_SUCCESS);
1750 #endif
1751 
1752 	/*
1753 	 * In privilege separation, we fork another child and prepare
1754 	 * file descriptor passing.
1755 	 */
1756 	if (use_privsep) {
1757 		privsep_postauth(authctxt);
1758 		/* the monitor process [priv] will not return */
1759 		if (!compat20)
1760 			destroy_sensitive_data();
1761 	}
1762 
1763 	/* Start session. */
1764 	do_authenticated(authctxt);
1765 
1766 	/* The connection has been terminated. */
1767 	verbose("Closing connection to %.100s", remote_ip);
1768 
1769 #ifdef USE_PAM
1770 	if (options.use_pam)
1771 		finish_pam();
1772 #endif /* USE_PAM */
1773 
1774 #ifdef SSH_AUDIT_EVENTS
1775 	PRIVSEP(audit_event(SSH_CONNECTION_CLOSE));
1776 #endif
1777 
1778 	packet_close();
1779 
1780 	if (use_privsep)
1781 		mm_terminate();
1782 
1783 	exit(0);
1784 }
1785 
1786 /*
1787  * Decrypt session_key_int using our private server key and private host key
1788  * (key with larger modulus first).
1789  */
1790 int
1791 ssh1_session_key(BIGNUM *session_key_int)
1792 {
1793 	int rsafail = 0;
1794 
1795 	if (BN_cmp(sensitive_data.server_key->rsa->n, sensitive_data.ssh1_host_key->rsa->n) > 0) {
1796 		/* Server key has bigger modulus. */
1797 		if (BN_num_bits(sensitive_data.server_key->rsa->n) <
1798 		    BN_num_bits(sensitive_data.ssh1_host_key->rsa->n) + SSH_KEY_BITS_RESERVED) {
1799 			fatal("do_connection: %s: server_key %d < host_key %d + SSH_KEY_BITS_RESERVED %d",
1800 			    get_remote_ipaddr(),
1801 			    BN_num_bits(sensitive_data.server_key->rsa->n),
1802 			    BN_num_bits(sensitive_data.ssh1_host_key->rsa->n),
1803 			    SSH_KEY_BITS_RESERVED);
1804 		}
1805 		if (rsa_private_decrypt(session_key_int, session_key_int,
1806 		    sensitive_data.server_key->rsa) <= 0)
1807 			rsafail++;
1808 		if (rsa_private_decrypt(session_key_int, session_key_int,
1809 		    sensitive_data.ssh1_host_key->rsa) <= 0)
1810 			rsafail++;
1811 	} else {
1812 		/* Host key has bigger modulus (or they are equal). */
1813 		if (BN_num_bits(sensitive_data.ssh1_host_key->rsa->n) <
1814 		    BN_num_bits(sensitive_data.server_key->rsa->n) + SSH_KEY_BITS_RESERVED) {
1815 			fatal("do_connection: %s: host_key %d < server_key %d + SSH_KEY_BITS_RESERVED %d",
1816 			    get_remote_ipaddr(),
1817 			    BN_num_bits(sensitive_data.ssh1_host_key->rsa->n),
1818 			    BN_num_bits(sensitive_data.server_key->rsa->n),
1819 			    SSH_KEY_BITS_RESERVED);
1820 		}
1821 		if (rsa_private_decrypt(session_key_int, session_key_int,
1822 		    sensitive_data.ssh1_host_key->rsa) < 0)
1823 			rsafail++;
1824 		if (rsa_private_decrypt(session_key_int, session_key_int,
1825 		    sensitive_data.server_key->rsa) < 0)
1826 			rsafail++;
1827 	}
1828 	return (rsafail);
1829 }
1830 /*
1831  * SSH1 key exchange
1832  */
1833 static void
1834 do_ssh1_kex(void)
1835 {
1836 	int i, len;
1837 	int rsafail = 0;
1838 	BIGNUM *session_key_int;
1839 	u_char session_key[SSH_SESSION_KEY_LENGTH];
1840 	u_char cookie[8];
1841 	u_int cipher_type, auth_mask, protocol_flags;
1842 	u_int32_t rnd = 0;
1843 
1844 	/*
1845 	 * Generate check bytes that the client must send back in the user
1846 	 * packet in order for it to be accepted; this is used to defy ip
1847 	 * spoofing attacks.  Note that this only works against somebody
1848 	 * doing IP spoofing from a remote machine; any machine on the local
1849 	 * network can still see outgoing packets and catch the random
1850 	 * cookie.  This only affects rhosts authentication, and this is one
1851 	 * of the reasons why it is inherently insecure.
1852 	 */
1853 	for (i = 0; i < 8; i++) {
1854 		if (i % 4 == 0)
1855 			rnd = arc4random();
1856 		cookie[i] = rnd & 0xff;
1857 		rnd >>= 8;
1858 	}
1859 
1860 	/*
1861 	 * Send our public key.  We include in the packet 64 bits of random
1862 	 * data that must be matched in the reply in order to prevent IP
1863 	 * spoofing.
1864 	 */
1865 	packet_start(SSH_SMSG_PUBLIC_KEY);
1866 	for (i = 0; i < 8; i++)
1867 		packet_put_char(cookie[i]);
1868 
1869 	/* Store our public server RSA key. */
1870 	packet_put_int(BN_num_bits(sensitive_data.server_key->rsa->n));
1871 	packet_put_bignum(sensitive_data.server_key->rsa->e);
1872 	packet_put_bignum(sensitive_data.server_key->rsa->n);
1873 
1874 	/* Store our public host RSA key. */
1875 	packet_put_int(BN_num_bits(sensitive_data.ssh1_host_key->rsa->n));
1876 	packet_put_bignum(sensitive_data.ssh1_host_key->rsa->e);
1877 	packet_put_bignum(sensitive_data.ssh1_host_key->rsa->n);
1878 
1879 	/* Put protocol flags. */
1880 	packet_put_int(SSH_PROTOFLAG_HOST_IN_FWD_OPEN);
1881 
1882 	/* Declare which ciphers we support. */
1883 	packet_put_int(cipher_mask_ssh1(0));
1884 
1885 	/* Declare supported authentication types. */
1886 	auth_mask = 0;
1887 	if (options.rhosts_rsa_authentication)
1888 		auth_mask |= 1 << SSH_AUTH_RHOSTS_RSA;
1889 	if (options.rsa_authentication)
1890 		auth_mask |= 1 << SSH_AUTH_RSA;
1891 	if (options.challenge_response_authentication == 1)
1892 		auth_mask |= 1 << SSH_AUTH_TIS;
1893 	if (options.password_authentication)
1894 		auth_mask |= 1 << SSH_AUTH_PASSWORD;
1895 	packet_put_int(auth_mask);
1896 
1897 	/* Send the packet and wait for it to be sent. */
1898 	packet_send();
1899 	packet_write_wait();
1900 
1901 	debug("Sent %d bit server key and %d bit host key.",
1902 	    BN_num_bits(sensitive_data.server_key->rsa->n),
1903 	    BN_num_bits(sensitive_data.ssh1_host_key->rsa->n));
1904 
1905 	/* Read clients reply (cipher type and session key). */
1906 	packet_read_expect(SSH_CMSG_SESSION_KEY);
1907 
1908 	/* Get cipher type and check whether we accept this. */
1909 	cipher_type = packet_get_char();
1910 
1911 	if (!(cipher_mask_ssh1(0) & (1 << cipher_type)))
1912 		packet_disconnect("Warning: client selects unsupported cipher.");
1913 
1914 	/* Get check bytes from the packet.  These must match those we
1915 	   sent earlier with the public key packet. */
1916 	for (i = 0; i < 8; i++)
1917 		if (cookie[i] != packet_get_char())
1918 			packet_disconnect("IP Spoofing check bytes do not match.");
1919 
1920 	debug("Encryption type: %.200s", cipher_name(cipher_type));
1921 
1922 	/* Get the encrypted integer. */
1923 	if ((session_key_int = BN_new()) == NULL)
1924 		fatal("do_ssh1_kex: BN_new failed");
1925 	packet_get_bignum(session_key_int);
1926 
1927 	protocol_flags = packet_get_int();
1928 	packet_set_protocol_flags(protocol_flags);
1929 	packet_check_eom();
1930 
1931 	/* Decrypt session_key_int using host/server keys */
1932 	rsafail = PRIVSEP(ssh1_session_key(session_key_int));
1933 
1934 	/*
1935 	 * Extract session key from the decrypted integer.  The key is in the
1936 	 * least significant 256 bits of the integer; the first byte of the
1937 	 * key is in the highest bits.
1938 	 */
1939 	if (!rsafail) {
1940 		BN_mask_bits(session_key_int, sizeof(session_key) * 8);
1941 		len = BN_num_bytes(session_key_int);
1942 		if (len < 0 || (u_int)len > sizeof(session_key)) {
1943 			error("do_connection: bad session key len from %s: "
1944 			    "session_key_int %d > sizeof(session_key) %lu",
1945 			    get_remote_ipaddr(), len, (u_long)sizeof(session_key));
1946 			rsafail++;
1947 		} else {
1948 			memset(session_key, 0, sizeof(session_key));
1949 			BN_bn2bin(session_key_int,
1950 			    session_key + sizeof(session_key) - len);
1951 
1952 			derive_ssh1_session_id(
1953 			    sensitive_data.ssh1_host_key->rsa->n,
1954 			    sensitive_data.server_key->rsa->n,
1955 			    cookie, session_id);
1956 			/*
1957 			 * Xor the first 16 bytes of the session key with the
1958 			 * session id.
1959 			 */
1960 			for (i = 0; i < 16; i++)
1961 				session_key[i] ^= session_id[i];
1962 		}
1963 	}
1964 	if (rsafail) {
1965 		int bytes = BN_num_bytes(session_key_int);
1966 		u_char *buf = xmalloc(bytes);
1967 		MD5_CTX md;
1968 
1969 		logit("do_connection: generating a fake encryption key");
1970 		BN_bn2bin(session_key_int, buf);
1971 		MD5_Init(&md);
1972 		MD5_Update(&md, buf, bytes);
1973 		MD5_Update(&md, sensitive_data.ssh1_cookie, SSH_SESSION_KEY_LENGTH);
1974 		MD5_Final(session_key, &md);
1975 		MD5_Init(&md);
1976 		MD5_Update(&md, session_key, 16);
1977 		MD5_Update(&md, buf, bytes);
1978 		MD5_Update(&md, sensitive_data.ssh1_cookie, SSH_SESSION_KEY_LENGTH);
1979 		MD5_Final(session_key + 16, &md);
1980 		memset(buf, 0, bytes);
1981 		xfree(buf);
1982 		for (i = 0; i < 16; i++)
1983 			session_id[i] = session_key[i] ^ session_key[i + 16];
1984 	}
1985 	/* Destroy the private and public keys. No longer. */
1986 	destroy_sensitive_data();
1987 
1988 	if (use_privsep)
1989 		mm_ssh1_session_id(session_id);
1990 
1991 	/* Destroy the decrypted integer.  It is no longer needed. */
1992 	BN_clear_free(session_key_int);
1993 
1994 	/* Set the session key.  From this on all communications will be encrypted. */
1995 	packet_set_encryption_key(session_key, SSH_SESSION_KEY_LENGTH, cipher_type);
1996 
1997 	/* Destroy our copy of the session key.  It is no longer needed. */
1998 	memset(session_key, 0, sizeof(session_key));
1999 
2000 	debug("Received session key; encryption turned on.");
2001 
2002 	/* Send an acknowledgment packet.  Note that this packet is sent encrypted. */
2003 	packet_start(SSH_SMSG_SUCCESS);
2004 	packet_send();
2005 	packet_write_wait();
2006 }
2007 
2008 /*
2009  * SSH2 key exchange: diffie-hellman-group1-sha1
2010  */
2011 static void
2012 do_ssh2_kex(void)
2013 {
2014 	Kex *kex;
2015 
2016 	if (options.ciphers != NULL) {
2017 		myproposal[PROPOSAL_ENC_ALGS_CTOS] =
2018 		myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
2019 	}
2020 	myproposal[PROPOSAL_ENC_ALGS_CTOS] =
2021 	    compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]);
2022 	myproposal[PROPOSAL_ENC_ALGS_STOC] =
2023 	    compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_STOC]);
2024 
2025 	if (options.macs != NULL) {
2026 		myproposal[PROPOSAL_MAC_ALGS_CTOS] =
2027 		myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
2028 	}
2029 	if (options.compression == COMP_NONE) {
2030 		myproposal[PROPOSAL_COMP_ALGS_CTOS] =
2031 		myproposal[PROPOSAL_COMP_ALGS_STOC] = "none";
2032 	} else if (options.compression == COMP_DELAYED) {
2033 		myproposal[PROPOSAL_COMP_ALGS_CTOS] =
2034 		myproposal[PROPOSAL_COMP_ALGS_STOC] = "none,zlib@openssh.com";
2035 	}
2036 
2037 	myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = list_hostkey_types();
2038 
2039 	/* start key exchange */
2040 	kex = kex_setup(myproposal);
2041 	kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server;
2042 	kex->kex[KEX_DH_GRP14_SHA1] = kexdh_server;
2043 	kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
2044 	kex->server = 1;
2045 	kex->client_version_string=client_version_string;
2046 	kex->server_version_string=server_version_string;
2047 	kex->load_host_key=&get_hostkey_by_type;
2048 	kex->host_key_index=&get_hostkey_index;
2049 
2050 	xxx_kex = kex;
2051 
2052 	dispatch_run(DISPATCH_BLOCK, &kex->done, kex);
2053 
2054 	session_id2 = kex->session_id;
2055 	session_id2_len = kex->session_id_len;
2056 
2057 #ifdef DEBUG_KEXDH
2058 	/* send 1st encrypted/maced/compressed message */
2059 	packet_start(SSH2_MSG_IGNORE);
2060 	packet_put_cstring("markus");
2061 	packet_send();
2062 	packet_write_wait();
2063 #endif
2064 	debug("KEX done");
2065 }
2066 
2067 /* server specific fatal cleanup */
2068 void
2069 cleanup_exit(int i)
2070 {
2071 	if (the_authctxt)
2072 		do_cleanup(the_authctxt);
2073 #ifdef SSH_AUDIT_EVENTS
2074 	/* done after do_cleanup so it can cancel the PAM auth 'thread' */
2075 	if (!use_privsep || mm_is_monitor())
2076 		audit_event(SSH_CONNECTION_ABANDON);
2077 #endif
2078 	_exit(i);
2079 }
2080