1 /* 2 * Author: Tatu Ylonen <ylo@cs.hut.fi> 3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland 4 * All rights reserved 5 * This program is the ssh daemon. It listens for connections from clients, 6 * and performs authentication, executes use commands or shell, and forwards 7 * information to/from the application to the user client over an encrypted 8 * connection. This can also handle forwarding of X11, TCP/IP, and 9 * authentication agent connections. 10 * 11 * As far as I am concerned, the code I have written for this software 12 * can be used freely for any purpose. Any derived versions of this 13 * software must be clearly marked as such, and if the derived work is 14 * incompatible with the protocol description in the RFC file, it must be 15 * called by a name other than "ssh" or "Secure Shell". 16 * 17 * SSH2 implementation: 18 * Privilege Separation: 19 * 20 * Copyright (c) 2000, 2001, 2002 Markus Friedl. All rights reserved. 21 * Copyright (c) 2002 Niels Provos. All rights reserved. 22 * 23 * Redistribution and use in source and binary forms, with or without 24 * modification, are permitted provided that the following conditions 25 * are met: 26 * 1. Redistributions of source code must retain the above copyright 27 * notice, this list of conditions and the following disclaimer. 28 * 2. Redistributions in binary form must reproduce the above copyright 29 * notice, this list of conditions and the following disclaimer in the 30 * documentation and/or other materials provided with the distribution. 31 * 32 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 33 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 34 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 35 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 36 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 37 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 38 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 39 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 40 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 41 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 42 */ 43 44 #include "includes.h" 45 RCSID("$OpenBSD: sshd.c,v 1.312 2005/07/25 11:59:40 markus Exp $"); 46 RCSID("$FreeBSD$"); 47 48 #include <openssl/dh.h> 49 #include <openssl/bn.h> 50 #include <openssl/md5.h> 51 #include <openssl/rand.h> 52 #ifdef HAVE_SECUREWARE 53 #include <sys/security.h> 54 #include <prot.h> 55 #endif 56 57 #ifdef __FreeBSD__ 58 #include <resolv.h> 59 #ifdef GSSAPI 60 #include <gssapi/gssapi.h> 61 #endif 62 #endif 63 64 #include "ssh.h" 65 #include "ssh1.h" 66 #include "ssh2.h" 67 #include "xmalloc.h" 68 #include "rsa.h" 69 #include "sshpty.h" 70 #include "packet.h" 71 #include "log.h" 72 #include "servconf.h" 73 #include "uidswap.h" 74 #include "compat.h" 75 #include "buffer.h" 76 #include "bufaux.h" 77 #include "cipher.h" 78 #include "kex.h" 79 #include "key.h" 80 #include "dh.h" 81 #include "myproposal.h" 82 #include "authfile.h" 83 #include "pathnames.h" 84 #include "atomicio.h" 85 #include "canohost.h" 86 #include "auth.h" 87 #include "misc.h" 88 #include "msg.h" 89 #include "dispatch.h" 90 #include "channels.h" 91 #include "session.h" 92 #include "monitor_mm.h" 93 #include "monitor.h" 94 #include "monitor_wrap.h" 95 #include "monitor_fdpass.h" 96 97 #ifdef LIBWRAP 98 #include <tcpd.h> 99 #include <syslog.h> 100 int allow_severity = LOG_INFO; 101 int deny_severity = LOG_WARNING; 102 #endif /* LIBWRAP */ 103 104 #ifndef O_NOCTTY 105 #define O_NOCTTY 0 106 #endif 107 108 /* Re-exec fds */ 109 #define REEXEC_DEVCRYPTO_RESERVED_FD (STDERR_FILENO + 1) 110 #define REEXEC_STARTUP_PIPE_FD (STDERR_FILENO + 2) 111 #define REEXEC_CONFIG_PASS_FD (STDERR_FILENO + 3) 112 #define REEXEC_MIN_FREE_FD (STDERR_FILENO + 4) 113 114 extern char *__progname; 115 116 /* Server configuration options. */ 117 ServerOptions options; 118 119 /* Name of the server configuration file. */ 120 char *config_file_name = _PATH_SERVER_CONFIG_FILE; 121 122 /* 123 * Debug mode flag. This can be set on the command line. If debug 124 * mode is enabled, extra debugging output will be sent to the system 125 * log, the daemon will not go to background, and will exit after processing 126 * the first connection. 127 */ 128 int debug_flag = 0; 129 130 /* Flag indicating that the daemon should only test the configuration and keys. */ 131 int test_flag = 0; 132 133 /* Flag indicating that the daemon is being started from inetd. */ 134 int inetd_flag = 0; 135 136 /* Flag indicating that sshd should not detach and become a daemon. */ 137 int no_daemon_flag = 0; 138 139 /* debug goes to stderr unless inetd_flag is set */ 140 int log_stderr = 0; 141 142 /* Saved arguments to main(). */ 143 char **saved_argv; 144 int saved_argc; 145 146 /* re-exec */ 147 int rexeced_flag = 0; 148 int rexec_flag = 1; 149 int rexec_argc = 0; 150 char **rexec_argv; 151 152 /* 153 * The sockets that the server is listening; this is used in the SIGHUP 154 * signal handler. 155 */ 156 #define MAX_LISTEN_SOCKS 16 157 int listen_socks[MAX_LISTEN_SOCKS]; 158 int num_listen_socks = 0; 159 160 /* 161 * the client's version string, passed by sshd2 in compat mode. if != NULL, 162 * sshd will skip the version-number exchange 163 */ 164 char *client_version_string = NULL; 165 char *server_version_string = NULL; 166 167 /* for rekeying XXX fixme */ 168 Kex *xxx_kex; 169 170 /* 171 * Any really sensitive data in the application is contained in this 172 * structure. The idea is that this structure could be locked into memory so 173 * that the pages do not get written into swap. However, there are some 174 * problems. The private key contains BIGNUMs, and we do not (in principle) 175 * have access to the internals of them, and locking just the structure is 176 * not very useful. Currently, memory locking is not implemented. 177 */ 178 struct { 179 Key *server_key; /* ephemeral server key */ 180 Key *ssh1_host_key; /* ssh1 host key */ 181 Key **host_keys; /* all private host keys */ 182 int have_ssh1_key; 183 int have_ssh2_key; 184 u_char ssh1_cookie[SSH_SESSION_KEY_LENGTH]; 185 } sensitive_data; 186 187 /* 188 * Flag indicating whether the RSA server key needs to be regenerated. 189 * Is set in the SIGALRM handler and cleared when the key is regenerated. 190 */ 191 static volatile sig_atomic_t key_do_regen = 0; 192 193 /* This is set to true when a signal is received. */ 194 static volatile sig_atomic_t received_sighup = 0; 195 static volatile sig_atomic_t received_sigterm = 0; 196 197 /* session identifier, used by RSA-auth */ 198 u_char session_id[16]; 199 200 /* same for ssh2 */ 201 u_char *session_id2 = NULL; 202 u_int session_id2_len = 0; 203 204 /* record remote hostname or ip */ 205 u_int utmp_len = MAXHOSTNAMELEN; 206 207 /* options.max_startup sized array of fd ints */ 208 int *startup_pipes = NULL; 209 int startup_pipe; /* in child */ 210 211 /* variables used for privilege separation */ 212 int use_privsep; 213 struct monitor *pmonitor = NULL; 214 215 /* global authentication context */ 216 Authctxt *the_authctxt = NULL; 217 218 /* message to be displayed after login */ 219 Buffer loginmsg; 220 221 /* Prototypes for various functions defined later in this file. */ 222 void destroy_sensitive_data(void); 223 void demote_sensitive_data(void); 224 225 static void do_ssh1_kex(void); 226 static void do_ssh2_kex(void); 227 228 /* 229 * Close all listening sockets 230 */ 231 static void 232 close_listen_socks(void) 233 { 234 int i; 235 236 for (i = 0; i < num_listen_socks; i++) 237 close(listen_socks[i]); 238 num_listen_socks = -1; 239 } 240 241 static void 242 close_startup_pipes(void) 243 { 244 int i; 245 246 if (startup_pipes) 247 for (i = 0; i < options.max_startups; i++) 248 if (startup_pipes[i] != -1) 249 close(startup_pipes[i]); 250 } 251 252 /* 253 * Signal handler for SIGHUP. Sshd execs itself when it receives SIGHUP; 254 * the effect is to reread the configuration file (and to regenerate 255 * the server key). 256 */ 257 static void 258 sighup_handler(int sig) 259 { 260 int save_errno = errno; 261 262 received_sighup = 1; 263 signal(SIGHUP, sighup_handler); 264 errno = save_errno; 265 } 266 267 /* 268 * Called from the main program after receiving SIGHUP. 269 * Restarts the server. 270 */ 271 static void 272 sighup_restart(void) 273 { 274 logit("Received SIGHUP; restarting."); 275 close_listen_socks(); 276 close_startup_pipes(); 277 execv(saved_argv[0], saved_argv); 278 logit("RESTART FAILED: av[0]='%.100s', error: %.100s.", saved_argv[0], 279 strerror(errno)); 280 exit(1); 281 } 282 283 /* 284 * Generic signal handler for terminating signals in the master daemon. 285 */ 286 static void 287 sigterm_handler(int sig) 288 { 289 received_sigterm = sig; 290 } 291 292 /* 293 * SIGCHLD handler. This is called whenever a child dies. This will then 294 * reap any zombies left by exited children. 295 */ 296 static void 297 main_sigchld_handler(int sig) 298 { 299 int save_errno = errno; 300 pid_t pid; 301 int status; 302 303 while ((pid = waitpid(-1, &status, WNOHANG)) > 0 || 304 (pid < 0 && errno == EINTR)) 305 ; 306 307 signal(SIGCHLD, main_sigchld_handler); 308 errno = save_errno; 309 } 310 311 /* 312 * Signal handler for the alarm after the login grace period has expired. 313 */ 314 static void 315 grace_alarm_handler(int sig) 316 { 317 /* XXX no idea how fix this signal handler */ 318 319 if (use_privsep && pmonitor != NULL && pmonitor->m_pid > 0) 320 kill(pmonitor->m_pid, SIGALRM); 321 322 /* Log error and exit. */ 323 fatal("Timeout before authentication for %s", get_remote_ipaddr()); 324 } 325 326 /* 327 * Signal handler for the key regeneration alarm. Note that this 328 * alarm only occurs in the daemon waiting for connections, and it does not 329 * do anything with the private key or random state before forking. 330 * Thus there should be no concurrency control/asynchronous execution 331 * problems. 332 */ 333 static void 334 generate_ephemeral_server_key(void) 335 { 336 u_int32_t rnd = 0; 337 int i; 338 339 verbose("Generating %s%d bit RSA key.", 340 sensitive_data.server_key ? "new " : "", options.server_key_bits); 341 if (sensitive_data.server_key != NULL) 342 key_free(sensitive_data.server_key); 343 sensitive_data.server_key = key_generate(KEY_RSA1, 344 options.server_key_bits); 345 verbose("RSA key generation complete."); 346 347 for (i = 0; i < SSH_SESSION_KEY_LENGTH; i++) { 348 if (i % 4 == 0) 349 rnd = arc4random(); 350 sensitive_data.ssh1_cookie[i] = rnd & 0xff; 351 rnd >>= 8; 352 } 353 arc4random_stir(); 354 } 355 356 static void 357 key_regeneration_alarm(int sig) 358 { 359 int save_errno = errno; 360 361 signal(SIGALRM, SIG_DFL); 362 errno = save_errno; 363 key_do_regen = 1; 364 } 365 366 static void 367 sshd_exchange_identification(int sock_in, int sock_out) 368 { 369 u_int i; 370 int mismatch; 371 int remote_major, remote_minor; 372 int major, minor; 373 char *s; 374 char buf[256]; /* Must not be larger than remote_version. */ 375 char remote_version[256]; /* Must be at least as big as buf. */ 376 377 if ((options.protocol & SSH_PROTO_1) && 378 (options.protocol & SSH_PROTO_2)) { 379 major = PROTOCOL_MAJOR_1; 380 minor = 99; 381 } else if (options.protocol & SSH_PROTO_2) { 382 major = PROTOCOL_MAJOR_2; 383 minor = PROTOCOL_MINOR_2; 384 } else { 385 major = PROTOCOL_MAJOR_1; 386 minor = PROTOCOL_MINOR_1; 387 } 388 snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s\n", major, minor, SSH_VERSION); 389 server_version_string = xstrdup(buf); 390 391 /* Send our protocol version identification. */ 392 if (atomicio(vwrite, sock_out, server_version_string, 393 strlen(server_version_string)) 394 != strlen(server_version_string)) { 395 logit("Could not write ident string to %s", get_remote_ipaddr()); 396 cleanup_exit(255); 397 } 398 399 /* Read other sides version identification. */ 400 memset(buf, 0, sizeof(buf)); 401 for (i = 0; i < sizeof(buf) - 1; i++) { 402 if (atomicio(read, sock_in, &buf[i], 1) != 1) { 403 logit("Did not receive identification string from %s", 404 get_remote_ipaddr()); 405 cleanup_exit(255); 406 } 407 if (buf[i] == '\r') { 408 buf[i] = 0; 409 /* Kludge for F-Secure Macintosh < 1.0.2 */ 410 if (i == 12 && 411 strncmp(buf, "SSH-1.5-W1.0", 12) == 0) 412 break; 413 continue; 414 } 415 if (buf[i] == '\n') { 416 buf[i] = 0; 417 break; 418 } 419 } 420 buf[sizeof(buf) - 1] = 0; 421 client_version_string = xstrdup(buf); 422 423 /* 424 * Check that the versions match. In future this might accept 425 * several versions and set appropriate flags to handle them. 426 */ 427 if (sscanf(client_version_string, "SSH-%d.%d-%[^\n]\n", 428 &remote_major, &remote_minor, remote_version) != 3) { 429 s = "Protocol mismatch.\n"; 430 (void) atomicio(vwrite, sock_out, s, strlen(s)); 431 close(sock_in); 432 close(sock_out); 433 logit("Bad protocol version identification '%.100s' from %s", 434 client_version_string, get_remote_ipaddr()); 435 cleanup_exit(255); 436 } 437 debug("Client protocol version %d.%d; client software version %.100s", 438 remote_major, remote_minor, remote_version); 439 440 compat_datafellows(remote_version); 441 442 if (datafellows & SSH_BUG_PROBE) { 443 logit("probed from %s with %s. Don't panic.", 444 get_remote_ipaddr(), client_version_string); 445 cleanup_exit(255); 446 } 447 448 if (datafellows & SSH_BUG_SCANNER) { 449 logit("scanned from %s with %s. Don't panic.", 450 get_remote_ipaddr(), client_version_string); 451 cleanup_exit(255); 452 } 453 454 mismatch = 0; 455 switch (remote_major) { 456 case 1: 457 if (remote_minor == 99) { 458 if (options.protocol & SSH_PROTO_2) 459 enable_compat20(); 460 else 461 mismatch = 1; 462 break; 463 } 464 if (!(options.protocol & SSH_PROTO_1)) { 465 mismatch = 1; 466 break; 467 } 468 if (remote_minor < 3) { 469 packet_disconnect("Your ssh version is too old and " 470 "is no longer supported. Please install a newer version."); 471 } else if (remote_minor == 3) { 472 /* note that this disables agent-forwarding */ 473 enable_compat13(); 474 } 475 break; 476 case 2: 477 if (options.protocol & SSH_PROTO_2) { 478 enable_compat20(); 479 break; 480 } 481 /* FALLTHROUGH */ 482 default: 483 mismatch = 1; 484 break; 485 } 486 chop(server_version_string); 487 debug("Local version string %.200s", server_version_string); 488 489 if (mismatch) { 490 s = "Protocol major versions differ.\n"; 491 (void) atomicio(vwrite, sock_out, s, strlen(s)); 492 close(sock_in); 493 close(sock_out); 494 logit("Protocol major versions differ for %s: %.200s vs. %.200s", 495 get_remote_ipaddr(), 496 server_version_string, client_version_string); 497 cleanup_exit(255); 498 } 499 } 500 501 /* Destroy the host and server keys. They will no longer be needed. */ 502 void 503 destroy_sensitive_data(void) 504 { 505 int i; 506 507 if (sensitive_data.server_key) { 508 key_free(sensitive_data.server_key); 509 sensitive_data.server_key = NULL; 510 } 511 for (i = 0; i < options.num_host_key_files; i++) { 512 if (sensitive_data.host_keys[i]) { 513 key_free(sensitive_data.host_keys[i]); 514 sensitive_data.host_keys[i] = NULL; 515 } 516 } 517 sensitive_data.ssh1_host_key = NULL; 518 memset(sensitive_data.ssh1_cookie, 0, SSH_SESSION_KEY_LENGTH); 519 } 520 521 /* Demote private to public keys for network child */ 522 void 523 demote_sensitive_data(void) 524 { 525 Key *tmp; 526 int i; 527 528 if (sensitive_data.server_key) { 529 tmp = key_demote(sensitive_data.server_key); 530 key_free(sensitive_data.server_key); 531 sensitive_data.server_key = tmp; 532 } 533 534 for (i = 0; i < options.num_host_key_files; i++) { 535 if (sensitive_data.host_keys[i]) { 536 tmp = key_demote(sensitive_data.host_keys[i]); 537 key_free(sensitive_data.host_keys[i]); 538 sensitive_data.host_keys[i] = tmp; 539 if (tmp->type == KEY_RSA1) 540 sensitive_data.ssh1_host_key = tmp; 541 } 542 } 543 544 /* We do not clear ssh1_host key and cookie. XXX - Okay Niels? */ 545 } 546 547 static void 548 privsep_preauth_child(void) 549 { 550 u_int32_t rnd[256]; 551 gid_t gidset[1]; 552 struct passwd *pw; 553 int i; 554 555 /* Enable challenge-response authentication for privilege separation */ 556 privsep_challenge_enable(); 557 558 for (i = 0; i < 256; i++) 559 rnd[i] = arc4random(); 560 RAND_seed(rnd, sizeof(rnd)); 561 562 /* Demote the private keys to public keys. */ 563 demote_sensitive_data(); 564 565 if ((pw = getpwnam(SSH_PRIVSEP_USER)) == NULL) 566 fatal("Privilege separation user %s does not exist", 567 SSH_PRIVSEP_USER); 568 memset(pw->pw_passwd, 0, strlen(pw->pw_passwd)); 569 endpwent(); 570 571 /* Change our root directory */ 572 if (chroot(_PATH_PRIVSEP_CHROOT_DIR) == -1) 573 fatal("chroot(\"%s\"): %s", _PATH_PRIVSEP_CHROOT_DIR, 574 strerror(errno)); 575 if (chdir("/") == -1) 576 fatal("chdir(\"/\"): %s", strerror(errno)); 577 578 /* Drop our privileges */ 579 debug3("privsep user:group %u:%u", (u_int)pw->pw_uid, 580 (u_int)pw->pw_gid); 581 #if 0 582 /* XXX not ready, too heavy after chroot */ 583 do_setusercontext(pw); 584 #else 585 gidset[0] = pw->pw_gid; 586 if (setgroups(1, gidset) < 0) 587 fatal("setgroups: %.100s", strerror(errno)); 588 permanently_set_uid(pw); 589 #endif 590 } 591 592 static int 593 privsep_preauth(Authctxt *authctxt) 594 { 595 int status; 596 pid_t pid; 597 598 /* Set up unprivileged child process to deal with network data */ 599 pmonitor = monitor_init(); 600 /* Store a pointer to the kex for later rekeying */ 601 pmonitor->m_pkex = &xxx_kex; 602 603 pid = fork(); 604 if (pid == -1) { 605 fatal("fork of unprivileged child failed"); 606 } else if (pid != 0) { 607 debug2("Network child is on pid %ld", (long)pid); 608 609 close(pmonitor->m_recvfd); 610 pmonitor->m_pid = pid; 611 monitor_child_preauth(authctxt, pmonitor); 612 close(pmonitor->m_sendfd); 613 614 /* Sync memory */ 615 monitor_sync(pmonitor); 616 617 /* Wait for the child's exit status */ 618 while (waitpid(pid, &status, 0) < 0) 619 if (errno != EINTR) 620 break; 621 return (1); 622 } else { 623 /* child */ 624 625 close(pmonitor->m_sendfd); 626 627 /* Demote the child */ 628 if (getuid() == 0 || geteuid() == 0) 629 privsep_preauth_child(); 630 setproctitle("%s", "[net]"); 631 } 632 return (0); 633 } 634 635 static void 636 privsep_postauth(Authctxt *authctxt) 637 { 638 #ifdef DISABLE_FD_PASSING 639 if (1) { 640 #else 641 if (authctxt->pw->pw_uid == 0 || options.use_login) { 642 #endif 643 /* File descriptor passing is broken or root login */ 644 monitor_apply_keystate(pmonitor); 645 use_privsep = 0; 646 return; 647 } 648 649 /* Authentication complete */ 650 alarm(0); 651 if (startup_pipe != -1) { 652 close(startup_pipe); 653 startup_pipe = -1; 654 } 655 656 /* New socket pair */ 657 monitor_reinit(pmonitor); 658 659 pmonitor->m_pid = fork(); 660 if (pmonitor->m_pid == -1) 661 fatal("fork of unprivileged child failed"); 662 else if (pmonitor->m_pid != 0) { 663 debug2("User child is on pid %ld", (long)pmonitor->m_pid); 664 close(pmonitor->m_recvfd); 665 buffer_clear(&loginmsg); 666 monitor_child_postauth(pmonitor); 667 668 /* NEVERREACHED */ 669 exit(0); 670 } 671 672 close(pmonitor->m_sendfd); 673 674 /* Demote the private keys to public keys. */ 675 demote_sensitive_data(); 676 677 /* Drop privileges */ 678 do_setusercontext(authctxt->pw); 679 680 /* It is safe now to apply the key state */ 681 monitor_apply_keystate(pmonitor); 682 683 /* 684 * Tell the packet layer that authentication was successful, since 685 * this information is not part of the key state. 686 */ 687 packet_set_authenticated(); 688 } 689 690 static char * 691 list_hostkey_types(void) 692 { 693 Buffer b; 694 const char *p; 695 char *ret; 696 int i; 697 698 buffer_init(&b); 699 for (i = 0; i < options.num_host_key_files; i++) { 700 Key *key = sensitive_data.host_keys[i]; 701 if (key == NULL) 702 continue; 703 switch (key->type) { 704 case KEY_RSA: 705 case KEY_DSA: 706 if (buffer_len(&b) > 0) 707 buffer_append(&b, ",", 1); 708 p = key_ssh_name(key); 709 buffer_append(&b, p, strlen(p)); 710 break; 711 } 712 } 713 buffer_append(&b, "\0", 1); 714 ret = xstrdup(buffer_ptr(&b)); 715 buffer_free(&b); 716 debug("list_hostkey_types: %s", ret); 717 return ret; 718 } 719 720 Key * 721 get_hostkey_by_type(int type) 722 { 723 int i; 724 725 for (i = 0; i < options.num_host_key_files; i++) { 726 Key *key = sensitive_data.host_keys[i]; 727 if (key != NULL && key->type == type) 728 return key; 729 } 730 return NULL; 731 } 732 733 Key * 734 get_hostkey_by_index(int ind) 735 { 736 if (ind < 0 || ind >= options.num_host_key_files) 737 return (NULL); 738 return (sensitive_data.host_keys[ind]); 739 } 740 741 int 742 get_hostkey_index(Key *key) 743 { 744 int i; 745 746 for (i = 0; i < options.num_host_key_files; i++) { 747 if (key == sensitive_data.host_keys[i]) 748 return (i); 749 } 750 return (-1); 751 } 752 753 /* 754 * returns 1 if connection should be dropped, 0 otherwise. 755 * dropping starts at connection #max_startups_begin with a probability 756 * of (max_startups_rate/100). the probability increases linearly until 757 * all connections are dropped for startups > max_startups 758 */ 759 static int 760 drop_connection(int startups) 761 { 762 int p, r; 763 764 if (startups < options.max_startups_begin) 765 return 0; 766 if (startups >= options.max_startups) 767 return 1; 768 if (options.max_startups_rate == 100) 769 return 1; 770 771 p = 100 - options.max_startups_rate; 772 p *= startups - options.max_startups_begin; 773 p /= options.max_startups - options.max_startups_begin; 774 p += options.max_startups_rate; 775 r = arc4random() % 100; 776 777 debug("drop_connection: p %d, r %d", p, r); 778 return (r < p) ? 1 : 0; 779 } 780 781 static void 782 usage(void) 783 { 784 fprintf(stderr, "%s, %s\n", 785 SSH_RELEASE, SSLeay_version(SSLEAY_VERSION)); 786 fprintf(stderr, 787 "usage: sshd [-46Ddeiqt] [-b bits] [-f config_file] [-g login_grace_time]\n" 788 " [-h host_key_file] [-k key_gen_time] [-o option] [-p port] [-u len]\n" 789 ); 790 exit(1); 791 } 792 793 static void 794 send_rexec_state(int fd, Buffer *conf) 795 { 796 Buffer m; 797 798 debug3("%s: entering fd = %d config len %d", __func__, fd, 799 buffer_len(conf)); 800 801 /* 802 * Protocol from reexec master to child: 803 * string configuration 804 * u_int ephemeral_key_follows 805 * bignum e (only if ephemeral_key_follows == 1) 806 * bignum n " 807 * bignum d " 808 * bignum iqmp " 809 * bignum p " 810 * bignum q " 811 */ 812 buffer_init(&m); 813 buffer_put_cstring(&m, buffer_ptr(conf)); 814 815 if (sensitive_data.server_key != NULL && 816 sensitive_data.server_key->type == KEY_RSA1) { 817 buffer_put_int(&m, 1); 818 buffer_put_bignum(&m, sensitive_data.server_key->rsa->e); 819 buffer_put_bignum(&m, sensitive_data.server_key->rsa->n); 820 buffer_put_bignum(&m, sensitive_data.server_key->rsa->d); 821 buffer_put_bignum(&m, sensitive_data.server_key->rsa->iqmp); 822 buffer_put_bignum(&m, sensitive_data.server_key->rsa->p); 823 buffer_put_bignum(&m, sensitive_data.server_key->rsa->q); 824 } else 825 buffer_put_int(&m, 0); 826 827 if (ssh_msg_send(fd, 0, &m) == -1) 828 fatal("%s: ssh_msg_send failed", __func__); 829 830 buffer_free(&m); 831 832 debug3("%s: done", __func__); 833 } 834 835 static void 836 recv_rexec_state(int fd, Buffer *conf) 837 { 838 Buffer m; 839 char *cp; 840 u_int len; 841 842 debug3("%s: entering fd = %d", __func__, fd); 843 844 buffer_init(&m); 845 846 if (ssh_msg_recv(fd, &m) == -1) 847 fatal("%s: ssh_msg_recv failed", __func__); 848 if (buffer_get_char(&m) != 0) 849 fatal("%s: rexec version mismatch", __func__); 850 851 cp = buffer_get_string(&m, &len); 852 if (conf != NULL) 853 buffer_append(conf, cp, len + 1); 854 xfree(cp); 855 856 if (buffer_get_int(&m)) { 857 if (sensitive_data.server_key != NULL) 858 key_free(sensitive_data.server_key); 859 sensitive_data.server_key = key_new_private(KEY_RSA1); 860 buffer_get_bignum(&m, sensitive_data.server_key->rsa->e); 861 buffer_get_bignum(&m, sensitive_data.server_key->rsa->n); 862 buffer_get_bignum(&m, sensitive_data.server_key->rsa->d); 863 buffer_get_bignum(&m, sensitive_data.server_key->rsa->iqmp); 864 buffer_get_bignum(&m, sensitive_data.server_key->rsa->p); 865 buffer_get_bignum(&m, sensitive_data.server_key->rsa->q); 866 rsa_generate_additional_parameters( 867 sensitive_data.server_key->rsa); 868 } 869 buffer_free(&m); 870 871 debug3("%s: done", __func__); 872 } 873 874 /* 875 * Main program for the daemon. 876 */ 877 int 878 main(int ac, char **av) 879 { 880 extern char *optarg; 881 extern int optind; 882 int opt, j, i, fdsetsz, on = 1; 883 int sock_in = -1, sock_out = -1, newsock = -1; 884 pid_t pid; 885 socklen_t fromlen; 886 fd_set *fdset; 887 struct sockaddr_storage from; 888 const char *remote_ip; 889 int remote_port; 890 FILE *f; 891 struct addrinfo *ai; 892 char ntop[NI_MAXHOST], strport[NI_MAXSERV]; 893 char *line; 894 int listen_sock, maxfd; 895 int startup_p[2] = { -1 , -1 }, config_s[2] = { -1 , -1 }; 896 int startups = 0; 897 Key *key; 898 Authctxt *authctxt; 899 int ret, key_used = 0; 900 Buffer cfg; 901 902 #ifdef HAVE_SECUREWARE 903 (void)set_auth_parameters(ac, av); 904 #endif 905 __progname = ssh_get_progname(av[0]); 906 init_rng(); 907 908 /* Save argv. Duplicate so setproctitle emulation doesn't clobber it */ 909 saved_argc = ac; 910 rexec_argc = ac; 911 saved_argv = xmalloc(sizeof(*saved_argv) * (ac + 1)); 912 for (i = 0; i < ac; i++) 913 saved_argv[i] = xstrdup(av[i]); 914 saved_argv[i] = NULL; 915 916 #ifndef HAVE_SETPROCTITLE 917 /* Prepare for later setproctitle emulation */ 918 compat_init_setproctitle(ac, av); 919 av = saved_argv; 920 #endif 921 922 if (geteuid() == 0 && setgroups(0, NULL) == -1) 923 debug("setgroups(): %.200s", strerror(errno)); 924 925 /* Initialize configuration options to their default values. */ 926 initialize_server_options(&options); 927 928 /* Parse command-line arguments. */ 929 while ((opt = getopt(ac, av, "f:p:b:k:h:g:u:o:dDeiqrtQR46")) != -1) { 930 switch (opt) { 931 case '4': 932 options.address_family = AF_INET; 933 break; 934 case '6': 935 options.address_family = AF_INET6; 936 break; 937 case 'f': 938 config_file_name = optarg; 939 break; 940 case 'd': 941 if (debug_flag == 0) { 942 debug_flag = 1; 943 options.log_level = SYSLOG_LEVEL_DEBUG1; 944 } else if (options.log_level < SYSLOG_LEVEL_DEBUG3) 945 options.log_level++; 946 break; 947 case 'D': 948 no_daemon_flag = 1; 949 break; 950 case 'e': 951 log_stderr = 1; 952 break; 953 case 'i': 954 inetd_flag = 1; 955 break; 956 case 'r': 957 rexec_flag = 0; 958 break; 959 case 'R': 960 rexeced_flag = 1; 961 inetd_flag = 1; 962 break; 963 case 'Q': 964 /* ignored */ 965 break; 966 case 'q': 967 options.log_level = SYSLOG_LEVEL_QUIET; 968 break; 969 case 'b': 970 options.server_key_bits = atoi(optarg); 971 break; 972 case 'p': 973 options.ports_from_cmdline = 1; 974 if (options.num_ports >= MAX_PORTS) { 975 fprintf(stderr, "too many ports.\n"); 976 exit(1); 977 } 978 options.ports[options.num_ports++] = a2port(optarg); 979 if (options.ports[options.num_ports-1] == 0) { 980 fprintf(stderr, "Bad port number.\n"); 981 exit(1); 982 } 983 break; 984 case 'g': 985 if ((options.login_grace_time = convtime(optarg)) == -1) { 986 fprintf(stderr, "Invalid login grace time.\n"); 987 exit(1); 988 } 989 break; 990 case 'k': 991 if ((options.key_regeneration_time = convtime(optarg)) == -1) { 992 fprintf(stderr, "Invalid key regeneration interval.\n"); 993 exit(1); 994 } 995 break; 996 case 'h': 997 if (options.num_host_key_files >= MAX_HOSTKEYS) { 998 fprintf(stderr, "too many host keys.\n"); 999 exit(1); 1000 } 1001 options.host_key_files[options.num_host_key_files++] = optarg; 1002 break; 1003 case 't': 1004 test_flag = 1; 1005 break; 1006 case 'u': 1007 utmp_len = atoi(optarg); 1008 if (utmp_len > MAXHOSTNAMELEN) { 1009 fprintf(stderr, "Invalid utmp length.\n"); 1010 exit(1); 1011 } 1012 break; 1013 case 'o': 1014 line = xstrdup(optarg); 1015 if (process_server_config_line(&options, line, 1016 "command-line", 0) != 0) 1017 exit(1); 1018 xfree(line); 1019 break; 1020 case '?': 1021 default: 1022 usage(); 1023 break; 1024 } 1025 } 1026 if (rexeced_flag || inetd_flag) 1027 rexec_flag = 0; 1028 if (rexec_flag && (av[0] == NULL || *av[0] != '/')) 1029 fatal("sshd re-exec requires execution with an absolute path"); 1030 if (rexeced_flag) 1031 closefrom(REEXEC_MIN_FREE_FD); 1032 else 1033 closefrom(REEXEC_DEVCRYPTO_RESERVED_FD); 1034 1035 SSLeay_add_all_algorithms(); 1036 1037 /* 1038 * Force logging to stderr until we have loaded the private host 1039 * key (unless started from inetd) 1040 */ 1041 log_init(__progname, 1042 options.log_level == SYSLOG_LEVEL_NOT_SET ? 1043 SYSLOG_LEVEL_INFO : options.log_level, 1044 options.log_facility == SYSLOG_FACILITY_NOT_SET ? 1045 SYSLOG_FACILITY_AUTH : options.log_facility, 1046 log_stderr || !inetd_flag); 1047 1048 /* 1049 * Unset KRB5CCNAME, otherwise the user's session may inherit it from 1050 * root's environment 1051 */ 1052 if (getenv("KRB5CCNAME") != NULL) 1053 unsetenv("KRB5CCNAME"); 1054 1055 #ifdef _UNICOS 1056 /* Cray can define user privs drop all privs now! 1057 * Not needed on PRIV_SU systems! 1058 */ 1059 drop_cray_privs(); 1060 #endif 1061 1062 seed_rng(); 1063 1064 sensitive_data.server_key = NULL; 1065 sensitive_data.ssh1_host_key = NULL; 1066 sensitive_data.have_ssh1_key = 0; 1067 sensitive_data.have_ssh2_key = 0; 1068 1069 /* Fetch our configuration */ 1070 buffer_init(&cfg); 1071 if (rexeced_flag) 1072 recv_rexec_state(REEXEC_CONFIG_PASS_FD, &cfg); 1073 else 1074 load_server_config(config_file_name, &cfg); 1075 1076 parse_server_config(&options, 1077 rexeced_flag ? "rexec" : config_file_name, &cfg); 1078 1079 if (!rexec_flag) 1080 buffer_free(&cfg); 1081 1082 /* Fill in default values for those options not explicitly set. */ 1083 fill_default_server_options(&options); 1084 1085 /* set default channel AF */ 1086 channel_set_af(options.address_family); 1087 1088 /* Check that there are no remaining arguments. */ 1089 if (optind < ac) { 1090 fprintf(stderr, "Extra argument %s.\n", av[optind]); 1091 exit(1); 1092 } 1093 1094 debug("sshd version %.100s", SSH_RELEASE); 1095 1096 /* load private host keys */ 1097 sensitive_data.host_keys = xmalloc(options.num_host_key_files * 1098 sizeof(Key *)); 1099 for (i = 0; i < options.num_host_key_files; i++) 1100 sensitive_data.host_keys[i] = NULL; 1101 1102 for (i = 0; i < options.num_host_key_files; i++) { 1103 key = key_load_private(options.host_key_files[i], "", NULL); 1104 sensitive_data.host_keys[i] = key; 1105 if (key == NULL) { 1106 error("Could not load host key: %s", 1107 options.host_key_files[i]); 1108 sensitive_data.host_keys[i] = NULL; 1109 continue; 1110 } 1111 switch (key->type) { 1112 case KEY_RSA1: 1113 sensitive_data.ssh1_host_key = key; 1114 sensitive_data.have_ssh1_key = 1; 1115 break; 1116 case KEY_RSA: 1117 case KEY_DSA: 1118 sensitive_data.have_ssh2_key = 1; 1119 break; 1120 } 1121 debug("private host key: #%d type %d %s", i, key->type, 1122 key_type(key)); 1123 } 1124 if ((options.protocol & SSH_PROTO_1) && !sensitive_data.have_ssh1_key) { 1125 logit("Disabling protocol version 1. Could not load host key"); 1126 options.protocol &= ~SSH_PROTO_1; 1127 } 1128 if ((options.protocol & SSH_PROTO_2) && !sensitive_data.have_ssh2_key) { 1129 logit("Disabling protocol version 2. Could not load host key"); 1130 options.protocol &= ~SSH_PROTO_2; 1131 } 1132 if (!(options.protocol & (SSH_PROTO_1|SSH_PROTO_2))) { 1133 logit("sshd: no hostkeys available -- exiting."); 1134 exit(1); 1135 } 1136 1137 /* Check certain values for sanity. */ 1138 if (options.protocol & SSH_PROTO_1) { 1139 if (options.server_key_bits < 512 || 1140 options.server_key_bits > 32768) { 1141 fprintf(stderr, "Bad server key size.\n"); 1142 exit(1); 1143 } 1144 /* 1145 * Check that server and host key lengths differ sufficiently. This 1146 * is necessary to make double encryption work with rsaref. Oh, I 1147 * hate software patents. I dont know if this can go? Niels 1148 */ 1149 if (options.server_key_bits > 1150 BN_num_bits(sensitive_data.ssh1_host_key->rsa->n) - 1151 SSH_KEY_BITS_RESERVED && options.server_key_bits < 1152 BN_num_bits(sensitive_data.ssh1_host_key->rsa->n) + 1153 SSH_KEY_BITS_RESERVED) { 1154 options.server_key_bits = 1155 BN_num_bits(sensitive_data.ssh1_host_key->rsa->n) + 1156 SSH_KEY_BITS_RESERVED; 1157 debug("Forcing server key to %d bits to make it differ from host key.", 1158 options.server_key_bits); 1159 } 1160 } 1161 1162 if (use_privsep) { 1163 struct passwd *pw; 1164 struct stat st; 1165 1166 if ((pw = getpwnam(SSH_PRIVSEP_USER)) == NULL) 1167 fatal("Privilege separation user %s does not exist", 1168 SSH_PRIVSEP_USER); 1169 if ((stat(_PATH_PRIVSEP_CHROOT_DIR, &st) == -1) || 1170 (S_ISDIR(st.st_mode) == 0)) 1171 fatal("Missing privilege separation directory: %s", 1172 _PATH_PRIVSEP_CHROOT_DIR); 1173 1174 #ifdef HAVE_CYGWIN 1175 if (check_ntsec(_PATH_PRIVSEP_CHROOT_DIR) && 1176 (st.st_uid != getuid () || 1177 (st.st_mode & (S_IWGRP|S_IWOTH)) != 0)) 1178 #else 1179 if (st.st_uid != 0 || (st.st_mode & (S_IWGRP|S_IWOTH)) != 0) 1180 #endif 1181 fatal("%s must be owned by root and not group or " 1182 "world-writable.", _PATH_PRIVSEP_CHROOT_DIR); 1183 } 1184 1185 /* Configuration looks good, so exit if in test mode. */ 1186 if (test_flag) 1187 exit(0); 1188 1189 /* 1190 * Clear out any supplemental groups we may have inherited. This 1191 * prevents inadvertent creation of files with bad modes (in the 1192 * portable version at least, it's certainly possible for PAM 1193 * to create a file, and we can't control the code in every 1194 * module which might be used). 1195 */ 1196 if (setgroups(0, NULL) < 0) 1197 debug("setgroups() failed: %.200s", strerror(errno)); 1198 1199 if (rexec_flag) { 1200 rexec_argv = xmalloc(sizeof(char *) * (rexec_argc + 2)); 1201 for (i = 0; i < rexec_argc; i++) { 1202 debug("rexec_argv[%d]='%s'", i, saved_argv[i]); 1203 rexec_argv[i] = saved_argv[i]; 1204 } 1205 rexec_argv[rexec_argc] = "-R"; 1206 rexec_argv[rexec_argc + 1] = NULL; 1207 } 1208 1209 /* Initialize the log (it is reinitialized below in case we forked). */ 1210 if (debug_flag && (!inetd_flag || rexeced_flag)) 1211 log_stderr = 1; 1212 log_init(__progname, options.log_level, options.log_facility, log_stderr); 1213 1214 /* 1215 * If not in debugging mode, and not started from inetd, disconnect 1216 * from the controlling terminal, and fork. The original process 1217 * exits. 1218 */ 1219 if (!(debug_flag || inetd_flag || no_daemon_flag)) { 1220 #ifdef TIOCNOTTY 1221 int fd; 1222 #endif /* TIOCNOTTY */ 1223 if (daemon(0, 0) < 0) 1224 fatal("daemon() failed: %.200s", strerror(errno)); 1225 1226 /* Disconnect from the controlling tty. */ 1227 #ifdef TIOCNOTTY 1228 fd = open(_PATH_TTY, O_RDWR | O_NOCTTY); 1229 if (fd >= 0) { 1230 (void) ioctl(fd, TIOCNOTTY, NULL); 1231 close(fd); 1232 } 1233 #endif /* TIOCNOTTY */ 1234 } 1235 /* Reinitialize the log (because of the fork above). */ 1236 log_init(__progname, options.log_level, options.log_facility, log_stderr); 1237 1238 /* Initialize the random number generator. */ 1239 arc4random_stir(); 1240 1241 /* Chdir to the root directory so that the current disk can be 1242 unmounted if desired. */ 1243 chdir("/"); 1244 1245 /* ignore SIGPIPE */ 1246 signal(SIGPIPE, SIG_IGN); 1247 1248 /* Start listening for a socket, unless started from inetd. */ 1249 if (inetd_flag) { 1250 int fd; 1251 1252 startup_pipe = -1; 1253 if (rexeced_flag) { 1254 close(REEXEC_CONFIG_PASS_FD); 1255 sock_in = sock_out = dup(STDIN_FILENO); 1256 if (!debug_flag) { 1257 startup_pipe = dup(REEXEC_STARTUP_PIPE_FD); 1258 close(REEXEC_STARTUP_PIPE_FD); 1259 } 1260 } else { 1261 sock_in = dup(STDIN_FILENO); 1262 sock_out = dup(STDOUT_FILENO); 1263 } 1264 /* 1265 * We intentionally do not close the descriptors 0, 1, and 2 1266 * as our code for setting the descriptors won't work if 1267 * ttyfd happens to be one of those. 1268 */ 1269 if ((fd = open(_PATH_DEVNULL, O_RDWR, 0)) != -1) { 1270 dup2(fd, STDIN_FILENO); 1271 dup2(fd, STDOUT_FILENO); 1272 if (fd > STDOUT_FILENO) 1273 close(fd); 1274 } 1275 debug("inetd sockets after dupping: %d, %d", sock_in, sock_out); 1276 if ((options.protocol & SSH_PROTO_1) && 1277 sensitive_data.server_key == NULL) 1278 generate_ephemeral_server_key(); 1279 } else { 1280 for (ai = options.listen_addrs; ai; ai = ai->ai_next) { 1281 if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6) 1282 continue; 1283 if (num_listen_socks >= MAX_LISTEN_SOCKS) 1284 fatal("Too many listen sockets. " 1285 "Enlarge MAX_LISTEN_SOCKS"); 1286 if ((ret = getnameinfo(ai->ai_addr, ai->ai_addrlen, 1287 ntop, sizeof(ntop), strport, sizeof(strport), 1288 NI_NUMERICHOST|NI_NUMERICSERV)) != 0) { 1289 error("getnameinfo failed: %.100s", 1290 (ret != EAI_SYSTEM) ? gai_strerror(ret) : 1291 strerror(errno)); 1292 continue; 1293 } 1294 /* Create socket for listening. */ 1295 listen_sock = socket(ai->ai_family, ai->ai_socktype, 1296 ai->ai_protocol); 1297 if (listen_sock < 0) { 1298 /* kernel may not support ipv6 */ 1299 verbose("socket: %.100s", strerror(errno)); 1300 continue; 1301 } 1302 if (set_nonblock(listen_sock) == -1) { 1303 close(listen_sock); 1304 continue; 1305 } 1306 /* 1307 * Set socket options. 1308 * Allow local port reuse in TIME_WAIT. 1309 */ 1310 if (setsockopt(listen_sock, SOL_SOCKET, SO_REUSEADDR, 1311 &on, sizeof(on)) == -1) 1312 error("setsockopt SO_REUSEADDR: %s", strerror(errno)); 1313 1314 debug("Bind to port %s on %s.", strport, ntop); 1315 1316 /* Bind the socket to the desired port. */ 1317 if (bind(listen_sock, ai->ai_addr, ai->ai_addrlen) < 0) { 1318 if (!ai->ai_next) 1319 error("Bind to port %s on %s failed: %.200s.", 1320 strport, ntop, strerror(errno)); 1321 close(listen_sock); 1322 continue; 1323 } 1324 listen_socks[num_listen_socks] = listen_sock; 1325 num_listen_socks++; 1326 1327 /* Start listening on the port. */ 1328 logit("Server listening on %s port %s.", ntop, strport); 1329 if (listen(listen_sock, SSH_LISTEN_BACKLOG) < 0) 1330 fatal("listen: %.100s", strerror(errno)); 1331 1332 } 1333 freeaddrinfo(options.listen_addrs); 1334 1335 if (!num_listen_socks) 1336 fatal("Cannot bind any address."); 1337 1338 if (options.protocol & SSH_PROTO_1) 1339 generate_ephemeral_server_key(); 1340 1341 /* 1342 * Arrange to restart on SIGHUP. The handler needs 1343 * listen_sock. 1344 */ 1345 signal(SIGHUP, sighup_handler); 1346 1347 signal(SIGTERM, sigterm_handler); 1348 signal(SIGQUIT, sigterm_handler); 1349 1350 /* Arrange SIGCHLD to be caught. */ 1351 signal(SIGCHLD, main_sigchld_handler); 1352 1353 /* Write out the pid file after the sigterm handler is setup */ 1354 if (!debug_flag) { 1355 /* 1356 * Record our pid in /var/run/sshd.pid to make it 1357 * easier to kill the correct sshd. We don't want to 1358 * do this before the bind above because the bind will 1359 * fail if there already is a daemon, and this will 1360 * overwrite any old pid in the file. 1361 */ 1362 f = fopen(options.pid_file, "wb"); 1363 if (f == NULL) { 1364 error("Couldn't create pid file \"%s\": %s", 1365 options.pid_file, strerror(errno)); 1366 } else { 1367 fprintf(f, "%ld\n", (long) getpid()); 1368 fclose(f); 1369 } 1370 } 1371 1372 /* setup fd set for listen */ 1373 fdset = NULL; 1374 maxfd = 0; 1375 for (i = 0; i < num_listen_socks; i++) 1376 if (listen_socks[i] > maxfd) 1377 maxfd = listen_socks[i]; 1378 /* pipes connected to unauthenticated childs */ 1379 startup_pipes = xmalloc(options.max_startups * sizeof(int)); 1380 for (i = 0; i < options.max_startups; i++) 1381 startup_pipes[i] = -1; 1382 1383 /* 1384 * Stay listening for connections until the system crashes or 1385 * the daemon is killed with a signal. 1386 */ 1387 for (;;) { 1388 if (received_sighup) 1389 sighup_restart(); 1390 if (fdset != NULL) 1391 xfree(fdset); 1392 fdsetsz = howmany(maxfd+1, NFDBITS) * sizeof(fd_mask); 1393 fdset = (fd_set *)xmalloc(fdsetsz); 1394 memset(fdset, 0, fdsetsz); 1395 1396 for (i = 0; i < num_listen_socks; i++) 1397 FD_SET(listen_socks[i], fdset); 1398 for (i = 0; i < options.max_startups; i++) 1399 if (startup_pipes[i] != -1) 1400 FD_SET(startup_pipes[i], fdset); 1401 1402 /* Wait in select until there is a connection. */ 1403 ret = select(maxfd+1, fdset, NULL, NULL, NULL); 1404 if (ret < 0 && errno != EINTR) 1405 error("select: %.100s", strerror(errno)); 1406 if (received_sigterm) { 1407 logit("Received signal %d; terminating.", 1408 (int) received_sigterm); 1409 close_listen_socks(); 1410 unlink(options.pid_file); 1411 exit(255); 1412 } 1413 if (key_used && key_do_regen) { 1414 generate_ephemeral_server_key(); 1415 key_used = 0; 1416 key_do_regen = 0; 1417 } 1418 if (ret < 0) 1419 continue; 1420 1421 for (i = 0; i < options.max_startups; i++) 1422 if (startup_pipes[i] != -1 && 1423 FD_ISSET(startup_pipes[i], fdset)) { 1424 /* 1425 * the read end of the pipe is ready 1426 * if the child has closed the pipe 1427 * after successful authentication 1428 * or if the child has died 1429 */ 1430 close(startup_pipes[i]); 1431 startup_pipes[i] = -1; 1432 startups--; 1433 } 1434 for (i = 0; i < num_listen_socks; i++) { 1435 if (!FD_ISSET(listen_socks[i], fdset)) 1436 continue; 1437 fromlen = sizeof(from); 1438 newsock = accept(listen_socks[i], (struct sockaddr *)&from, 1439 &fromlen); 1440 if (newsock < 0) { 1441 if (errno != EINTR && errno != EWOULDBLOCK) 1442 error("accept: %.100s", strerror(errno)); 1443 continue; 1444 } 1445 if (unset_nonblock(newsock) == -1) { 1446 close(newsock); 1447 continue; 1448 } 1449 if (drop_connection(startups) == 1) { 1450 debug("drop connection #%d", startups); 1451 close(newsock); 1452 continue; 1453 } 1454 if (pipe(startup_p) == -1) { 1455 close(newsock); 1456 continue; 1457 } 1458 1459 if (rexec_flag && socketpair(AF_UNIX, 1460 SOCK_STREAM, 0, config_s) == -1) { 1461 error("reexec socketpair: %s", 1462 strerror(errno)); 1463 close(newsock); 1464 close(startup_p[0]); 1465 close(startup_p[1]); 1466 continue; 1467 } 1468 1469 for (j = 0; j < options.max_startups; j++) 1470 if (startup_pipes[j] == -1) { 1471 startup_pipes[j] = startup_p[0]; 1472 if (maxfd < startup_p[0]) 1473 maxfd = startup_p[0]; 1474 startups++; 1475 break; 1476 } 1477 1478 /* 1479 * Got connection. Fork a child to handle it, unless 1480 * we are in debugging mode. 1481 */ 1482 if (debug_flag) { 1483 /* 1484 * In debugging mode. Close the listening 1485 * socket, and start processing the 1486 * connection without forking. 1487 */ 1488 debug("Server will not fork when running in debugging mode."); 1489 close_listen_socks(); 1490 sock_in = newsock; 1491 sock_out = newsock; 1492 close(startup_p[0]); 1493 close(startup_p[1]); 1494 startup_pipe = -1; 1495 pid = getpid(); 1496 if (rexec_flag) { 1497 send_rexec_state(config_s[0], 1498 &cfg); 1499 close(config_s[0]); 1500 } 1501 break; 1502 } else { 1503 /* 1504 * Normal production daemon. Fork, and have 1505 * the child process the connection. The 1506 * parent continues listening. 1507 */ 1508 if ((pid = fork()) == 0) { 1509 /* 1510 * Child. Close the listening and max_startup 1511 * sockets. Start using the accepted socket. 1512 * Reinitialize logging (since our pid has 1513 * changed). We break out of the loop to handle 1514 * the connection. 1515 */ 1516 startup_pipe = startup_p[1]; 1517 close_startup_pipes(); 1518 close_listen_socks(); 1519 sock_in = newsock; 1520 sock_out = newsock; 1521 log_init(__progname, options.log_level, options.log_facility, log_stderr); 1522 if (rexec_flag) 1523 close(config_s[0]); 1524 break; 1525 } 1526 } 1527 1528 /* Parent. Stay in the loop. */ 1529 if (pid < 0) 1530 error("fork: %.100s", strerror(errno)); 1531 else 1532 debug("Forked child %ld.", (long)pid); 1533 1534 close(startup_p[1]); 1535 1536 if (rexec_flag) { 1537 send_rexec_state(config_s[0], &cfg); 1538 close(config_s[0]); 1539 close(config_s[1]); 1540 } 1541 1542 /* Mark that the key has been used (it was "given" to the child). */ 1543 if ((options.protocol & SSH_PROTO_1) && 1544 key_used == 0) { 1545 /* Schedule server key regeneration alarm. */ 1546 signal(SIGALRM, key_regeneration_alarm); 1547 alarm(options.key_regeneration_time); 1548 key_used = 1; 1549 } 1550 1551 arc4random_stir(); 1552 1553 /* Close the new socket (the child is now taking care of it). */ 1554 close(newsock); 1555 } 1556 /* child process check (or debug mode) */ 1557 if (num_listen_socks < 0) 1558 break; 1559 } 1560 } 1561 1562 /* This is the child processing a new connection. */ 1563 setproctitle("%s", "[accepted]"); 1564 1565 /* 1566 * Create a new session and process group since the 4.4BSD 1567 * setlogin() affects the entire process group. We don't 1568 * want the child to be able to affect the parent. 1569 */ 1570 #if !defined(SSHD_ACQUIRES_CTTY) 1571 /* 1572 * If setsid is called, on some platforms sshd will later acquire a 1573 * controlling terminal which will result in "could not set 1574 * controlling tty" errors. 1575 */ 1576 if (!debug_flag && !inetd_flag && setsid() < 0) 1577 error("setsid: %.100s", strerror(errno)); 1578 #endif 1579 1580 if (rexec_flag) { 1581 int fd; 1582 1583 debug("rexec start in %d out %d newsock %d pipe %d sock %d", 1584 sock_in, sock_out, newsock, startup_pipe, config_s[0]); 1585 dup2(newsock, STDIN_FILENO); 1586 dup2(STDIN_FILENO, STDOUT_FILENO); 1587 if (startup_pipe == -1) 1588 close(REEXEC_STARTUP_PIPE_FD); 1589 else 1590 dup2(startup_pipe, REEXEC_STARTUP_PIPE_FD); 1591 1592 dup2(config_s[1], REEXEC_CONFIG_PASS_FD); 1593 close(config_s[1]); 1594 if (startup_pipe != -1) 1595 close(startup_pipe); 1596 1597 execv(rexec_argv[0], rexec_argv); 1598 1599 /* Reexec has failed, fall back and continue */ 1600 error("rexec of %s failed: %s", rexec_argv[0], strerror(errno)); 1601 recv_rexec_state(REEXEC_CONFIG_PASS_FD, NULL); 1602 log_init(__progname, options.log_level, 1603 options.log_facility, log_stderr); 1604 1605 /* Clean up fds */ 1606 startup_pipe = REEXEC_STARTUP_PIPE_FD; 1607 close(config_s[1]); 1608 close(REEXEC_CONFIG_PASS_FD); 1609 newsock = sock_out = sock_in = dup(STDIN_FILENO); 1610 if ((fd = open(_PATH_DEVNULL, O_RDWR, 0)) != -1) { 1611 dup2(fd, STDIN_FILENO); 1612 dup2(fd, STDOUT_FILENO); 1613 if (fd > STDERR_FILENO) 1614 close(fd); 1615 } 1616 debug("rexec cleanup in %d out %d newsock %d pipe %d sock %d", 1617 sock_in, sock_out, newsock, startup_pipe, config_s[0]); 1618 } 1619 1620 /* 1621 * Disable the key regeneration alarm. We will not regenerate the 1622 * key since we are no longer in a position to give it to anyone. We 1623 * will not restart on SIGHUP since it no longer makes sense. 1624 */ 1625 alarm(0); 1626 signal(SIGALRM, SIG_DFL); 1627 signal(SIGHUP, SIG_DFL); 1628 signal(SIGTERM, SIG_DFL); 1629 signal(SIGQUIT, SIG_DFL); 1630 signal(SIGCHLD, SIG_DFL); 1631 signal(SIGINT, SIG_DFL); 1632 1633 #ifdef __FreeBSD__ 1634 /* 1635 * Initialize the resolver. This may not happen automatically 1636 * before privsep chroot(). 1637 */ 1638 if ((_res.options & RES_INIT) == 0) { 1639 debug("res_init()"); 1640 res_init(); 1641 } 1642 #ifdef GSSAPI 1643 /* 1644 * Force GSS-API to parse its configuration and load any 1645 * mechanism plugins. 1646 */ 1647 { 1648 gss_OID_set mechs; 1649 OM_uint32 minor_status; 1650 gss_indicate_mechs(&minor_status, &mechs); 1651 gss_release_oid_set(&minor_status, &mechs); 1652 } 1653 #endif 1654 #endif 1655 1656 /* 1657 * Register our connection. This turns encryption off because we do 1658 * not have a key. 1659 */ 1660 packet_set_connection(sock_in, sock_out); 1661 packet_set_server(); 1662 1663 /* Set SO_KEEPALIVE if requested. */ 1664 if (options.tcp_keep_alive && packet_connection_is_on_socket() && 1665 setsockopt(sock_in, SOL_SOCKET, SO_KEEPALIVE, &on, sizeof(on)) < 0) 1666 error("setsockopt SO_KEEPALIVE: %.100s", strerror(errno)); 1667 1668 if ((remote_port = get_remote_port()) < 0) { 1669 debug("get_remote_port failed"); 1670 cleanup_exit(255); 1671 } 1672 remote_ip = get_remote_ipaddr(); 1673 1674 #ifdef SSH_AUDIT_EVENTS 1675 audit_connection_from(remote_ip, remote_port); 1676 #endif 1677 #ifdef LIBWRAP 1678 /* Check whether logins are denied from this host. */ 1679 if (packet_connection_is_on_socket()) { 1680 struct request_info req; 1681 1682 request_init(&req, RQ_DAEMON, __progname, RQ_FILE, sock_in, 0); 1683 fromhost(&req); 1684 1685 if (!hosts_access(&req)) { 1686 debug("Connection refused by tcp wrapper"); 1687 refuse(&req); 1688 /* NOTREACHED */ 1689 fatal("libwrap refuse returns"); 1690 } 1691 } 1692 #endif /* LIBWRAP */ 1693 1694 /* Log the connection. */ 1695 verbose("Connection from %.500s port %d", remote_ip, remote_port); 1696 1697 /* 1698 * We don\'t want to listen forever unless the other side 1699 * successfully authenticates itself. So we set up an alarm which is 1700 * cleared after successful authentication. A limit of zero 1701 * indicates no limit. Note that we don\'t set the alarm in debugging 1702 * mode; it is just annoying to have the server exit just when you 1703 * are about to discover the bug. 1704 */ 1705 signal(SIGALRM, grace_alarm_handler); 1706 if (!debug_flag) 1707 alarm(options.login_grace_time); 1708 1709 sshd_exchange_identification(sock_in, sock_out); 1710 1711 packet_set_nonblocking(); 1712 1713 /* allocate authentication context */ 1714 authctxt = xmalloc(sizeof(*authctxt)); 1715 memset(authctxt, 0, sizeof(*authctxt)); 1716 1717 authctxt->loginmsg = &loginmsg; 1718 1719 /* XXX global for cleanup, access from other modules */ 1720 the_authctxt = authctxt; 1721 1722 /* prepare buffer to collect messages to display to user after login */ 1723 buffer_init(&loginmsg); 1724 1725 if (use_privsep) 1726 if (privsep_preauth(authctxt) == 1) 1727 goto authenticated; 1728 1729 /* perform the key exchange */ 1730 /* authenticate user and start session */ 1731 if (compat20) { 1732 do_ssh2_kex(); 1733 do_authentication2(authctxt); 1734 } else { 1735 do_ssh1_kex(); 1736 do_authentication(authctxt); 1737 } 1738 /* 1739 * If we use privilege separation, the unprivileged child transfers 1740 * the current keystate and exits 1741 */ 1742 if (use_privsep) { 1743 mm_send_keystate(pmonitor); 1744 exit(0); 1745 } 1746 1747 authenticated: 1748 #ifdef SSH_AUDIT_EVENTS 1749 audit_event(SSH_AUTH_SUCCESS); 1750 #endif 1751 1752 /* 1753 * In privilege separation, we fork another child and prepare 1754 * file descriptor passing. 1755 */ 1756 if (use_privsep) { 1757 privsep_postauth(authctxt); 1758 /* the monitor process [priv] will not return */ 1759 if (!compat20) 1760 destroy_sensitive_data(); 1761 } 1762 1763 /* Start session. */ 1764 do_authenticated(authctxt); 1765 1766 /* The connection has been terminated. */ 1767 verbose("Closing connection to %.100s", remote_ip); 1768 1769 #ifdef USE_PAM 1770 if (options.use_pam) 1771 finish_pam(); 1772 #endif /* USE_PAM */ 1773 1774 #ifdef SSH_AUDIT_EVENTS 1775 PRIVSEP(audit_event(SSH_CONNECTION_CLOSE)); 1776 #endif 1777 1778 packet_close(); 1779 1780 if (use_privsep) 1781 mm_terminate(); 1782 1783 exit(0); 1784 } 1785 1786 /* 1787 * Decrypt session_key_int using our private server key and private host key 1788 * (key with larger modulus first). 1789 */ 1790 int 1791 ssh1_session_key(BIGNUM *session_key_int) 1792 { 1793 int rsafail = 0; 1794 1795 if (BN_cmp(sensitive_data.server_key->rsa->n, sensitive_data.ssh1_host_key->rsa->n) > 0) { 1796 /* Server key has bigger modulus. */ 1797 if (BN_num_bits(sensitive_data.server_key->rsa->n) < 1798 BN_num_bits(sensitive_data.ssh1_host_key->rsa->n) + SSH_KEY_BITS_RESERVED) { 1799 fatal("do_connection: %s: server_key %d < host_key %d + SSH_KEY_BITS_RESERVED %d", 1800 get_remote_ipaddr(), 1801 BN_num_bits(sensitive_data.server_key->rsa->n), 1802 BN_num_bits(sensitive_data.ssh1_host_key->rsa->n), 1803 SSH_KEY_BITS_RESERVED); 1804 } 1805 if (rsa_private_decrypt(session_key_int, session_key_int, 1806 sensitive_data.server_key->rsa) <= 0) 1807 rsafail++; 1808 if (rsa_private_decrypt(session_key_int, session_key_int, 1809 sensitive_data.ssh1_host_key->rsa) <= 0) 1810 rsafail++; 1811 } else { 1812 /* Host key has bigger modulus (or they are equal). */ 1813 if (BN_num_bits(sensitive_data.ssh1_host_key->rsa->n) < 1814 BN_num_bits(sensitive_data.server_key->rsa->n) + SSH_KEY_BITS_RESERVED) { 1815 fatal("do_connection: %s: host_key %d < server_key %d + SSH_KEY_BITS_RESERVED %d", 1816 get_remote_ipaddr(), 1817 BN_num_bits(sensitive_data.ssh1_host_key->rsa->n), 1818 BN_num_bits(sensitive_data.server_key->rsa->n), 1819 SSH_KEY_BITS_RESERVED); 1820 } 1821 if (rsa_private_decrypt(session_key_int, session_key_int, 1822 sensitive_data.ssh1_host_key->rsa) < 0) 1823 rsafail++; 1824 if (rsa_private_decrypt(session_key_int, session_key_int, 1825 sensitive_data.server_key->rsa) < 0) 1826 rsafail++; 1827 } 1828 return (rsafail); 1829 } 1830 /* 1831 * SSH1 key exchange 1832 */ 1833 static void 1834 do_ssh1_kex(void) 1835 { 1836 int i, len; 1837 int rsafail = 0; 1838 BIGNUM *session_key_int; 1839 u_char session_key[SSH_SESSION_KEY_LENGTH]; 1840 u_char cookie[8]; 1841 u_int cipher_type, auth_mask, protocol_flags; 1842 u_int32_t rnd = 0; 1843 1844 /* 1845 * Generate check bytes that the client must send back in the user 1846 * packet in order for it to be accepted; this is used to defy ip 1847 * spoofing attacks. Note that this only works against somebody 1848 * doing IP spoofing from a remote machine; any machine on the local 1849 * network can still see outgoing packets and catch the random 1850 * cookie. This only affects rhosts authentication, and this is one 1851 * of the reasons why it is inherently insecure. 1852 */ 1853 for (i = 0; i < 8; i++) { 1854 if (i % 4 == 0) 1855 rnd = arc4random(); 1856 cookie[i] = rnd & 0xff; 1857 rnd >>= 8; 1858 } 1859 1860 /* 1861 * Send our public key. We include in the packet 64 bits of random 1862 * data that must be matched in the reply in order to prevent IP 1863 * spoofing. 1864 */ 1865 packet_start(SSH_SMSG_PUBLIC_KEY); 1866 for (i = 0; i < 8; i++) 1867 packet_put_char(cookie[i]); 1868 1869 /* Store our public server RSA key. */ 1870 packet_put_int(BN_num_bits(sensitive_data.server_key->rsa->n)); 1871 packet_put_bignum(sensitive_data.server_key->rsa->e); 1872 packet_put_bignum(sensitive_data.server_key->rsa->n); 1873 1874 /* Store our public host RSA key. */ 1875 packet_put_int(BN_num_bits(sensitive_data.ssh1_host_key->rsa->n)); 1876 packet_put_bignum(sensitive_data.ssh1_host_key->rsa->e); 1877 packet_put_bignum(sensitive_data.ssh1_host_key->rsa->n); 1878 1879 /* Put protocol flags. */ 1880 packet_put_int(SSH_PROTOFLAG_HOST_IN_FWD_OPEN); 1881 1882 /* Declare which ciphers we support. */ 1883 packet_put_int(cipher_mask_ssh1(0)); 1884 1885 /* Declare supported authentication types. */ 1886 auth_mask = 0; 1887 if (options.rhosts_rsa_authentication) 1888 auth_mask |= 1 << SSH_AUTH_RHOSTS_RSA; 1889 if (options.rsa_authentication) 1890 auth_mask |= 1 << SSH_AUTH_RSA; 1891 if (options.challenge_response_authentication == 1) 1892 auth_mask |= 1 << SSH_AUTH_TIS; 1893 if (options.password_authentication) 1894 auth_mask |= 1 << SSH_AUTH_PASSWORD; 1895 packet_put_int(auth_mask); 1896 1897 /* Send the packet and wait for it to be sent. */ 1898 packet_send(); 1899 packet_write_wait(); 1900 1901 debug("Sent %d bit server key and %d bit host key.", 1902 BN_num_bits(sensitive_data.server_key->rsa->n), 1903 BN_num_bits(sensitive_data.ssh1_host_key->rsa->n)); 1904 1905 /* Read clients reply (cipher type and session key). */ 1906 packet_read_expect(SSH_CMSG_SESSION_KEY); 1907 1908 /* Get cipher type and check whether we accept this. */ 1909 cipher_type = packet_get_char(); 1910 1911 if (!(cipher_mask_ssh1(0) & (1 << cipher_type))) 1912 packet_disconnect("Warning: client selects unsupported cipher."); 1913 1914 /* Get check bytes from the packet. These must match those we 1915 sent earlier with the public key packet. */ 1916 for (i = 0; i < 8; i++) 1917 if (cookie[i] != packet_get_char()) 1918 packet_disconnect("IP Spoofing check bytes do not match."); 1919 1920 debug("Encryption type: %.200s", cipher_name(cipher_type)); 1921 1922 /* Get the encrypted integer. */ 1923 if ((session_key_int = BN_new()) == NULL) 1924 fatal("do_ssh1_kex: BN_new failed"); 1925 packet_get_bignum(session_key_int); 1926 1927 protocol_flags = packet_get_int(); 1928 packet_set_protocol_flags(protocol_flags); 1929 packet_check_eom(); 1930 1931 /* Decrypt session_key_int using host/server keys */ 1932 rsafail = PRIVSEP(ssh1_session_key(session_key_int)); 1933 1934 /* 1935 * Extract session key from the decrypted integer. The key is in the 1936 * least significant 256 bits of the integer; the first byte of the 1937 * key is in the highest bits. 1938 */ 1939 if (!rsafail) { 1940 BN_mask_bits(session_key_int, sizeof(session_key) * 8); 1941 len = BN_num_bytes(session_key_int); 1942 if (len < 0 || (u_int)len > sizeof(session_key)) { 1943 error("do_connection: bad session key len from %s: " 1944 "session_key_int %d > sizeof(session_key) %lu", 1945 get_remote_ipaddr(), len, (u_long)sizeof(session_key)); 1946 rsafail++; 1947 } else { 1948 memset(session_key, 0, sizeof(session_key)); 1949 BN_bn2bin(session_key_int, 1950 session_key + sizeof(session_key) - len); 1951 1952 derive_ssh1_session_id( 1953 sensitive_data.ssh1_host_key->rsa->n, 1954 sensitive_data.server_key->rsa->n, 1955 cookie, session_id); 1956 /* 1957 * Xor the first 16 bytes of the session key with the 1958 * session id. 1959 */ 1960 for (i = 0; i < 16; i++) 1961 session_key[i] ^= session_id[i]; 1962 } 1963 } 1964 if (rsafail) { 1965 int bytes = BN_num_bytes(session_key_int); 1966 u_char *buf = xmalloc(bytes); 1967 MD5_CTX md; 1968 1969 logit("do_connection: generating a fake encryption key"); 1970 BN_bn2bin(session_key_int, buf); 1971 MD5_Init(&md); 1972 MD5_Update(&md, buf, bytes); 1973 MD5_Update(&md, sensitive_data.ssh1_cookie, SSH_SESSION_KEY_LENGTH); 1974 MD5_Final(session_key, &md); 1975 MD5_Init(&md); 1976 MD5_Update(&md, session_key, 16); 1977 MD5_Update(&md, buf, bytes); 1978 MD5_Update(&md, sensitive_data.ssh1_cookie, SSH_SESSION_KEY_LENGTH); 1979 MD5_Final(session_key + 16, &md); 1980 memset(buf, 0, bytes); 1981 xfree(buf); 1982 for (i = 0; i < 16; i++) 1983 session_id[i] = session_key[i] ^ session_key[i + 16]; 1984 } 1985 /* Destroy the private and public keys. No longer. */ 1986 destroy_sensitive_data(); 1987 1988 if (use_privsep) 1989 mm_ssh1_session_id(session_id); 1990 1991 /* Destroy the decrypted integer. It is no longer needed. */ 1992 BN_clear_free(session_key_int); 1993 1994 /* Set the session key. From this on all communications will be encrypted. */ 1995 packet_set_encryption_key(session_key, SSH_SESSION_KEY_LENGTH, cipher_type); 1996 1997 /* Destroy our copy of the session key. It is no longer needed. */ 1998 memset(session_key, 0, sizeof(session_key)); 1999 2000 debug("Received session key; encryption turned on."); 2001 2002 /* Send an acknowledgment packet. Note that this packet is sent encrypted. */ 2003 packet_start(SSH_SMSG_SUCCESS); 2004 packet_send(); 2005 packet_write_wait(); 2006 } 2007 2008 /* 2009 * SSH2 key exchange: diffie-hellman-group1-sha1 2010 */ 2011 static void 2012 do_ssh2_kex(void) 2013 { 2014 Kex *kex; 2015 2016 if (options.ciphers != NULL) { 2017 myproposal[PROPOSAL_ENC_ALGS_CTOS] = 2018 myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers; 2019 } 2020 myproposal[PROPOSAL_ENC_ALGS_CTOS] = 2021 compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]); 2022 myproposal[PROPOSAL_ENC_ALGS_STOC] = 2023 compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_STOC]); 2024 2025 if (options.macs != NULL) { 2026 myproposal[PROPOSAL_MAC_ALGS_CTOS] = 2027 myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs; 2028 } 2029 if (options.compression == COMP_NONE) { 2030 myproposal[PROPOSAL_COMP_ALGS_CTOS] = 2031 myproposal[PROPOSAL_COMP_ALGS_STOC] = "none"; 2032 } else if (options.compression == COMP_DELAYED) { 2033 myproposal[PROPOSAL_COMP_ALGS_CTOS] = 2034 myproposal[PROPOSAL_COMP_ALGS_STOC] = "none,zlib@openssh.com"; 2035 } 2036 2037 myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = list_hostkey_types(); 2038 2039 /* start key exchange */ 2040 kex = kex_setup(myproposal); 2041 kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server; 2042 kex->kex[KEX_DH_GRP14_SHA1] = kexdh_server; 2043 kex->kex[KEX_DH_GEX_SHA1] = kexgex_server; 2044 kex->server = 1; 2045 kex->client_version_string=client_version_string; 2046 kex->server_version_string=server_version_string; 2047 kex->load_host_key=&get_hostkey_by_type; 2048 kex->host_key_index=&get_hostkey_index; 2049 2050 xxx_kex = kex; 2051 2052 dispatch_run(DISPATCH_BLOCK, &kex->done, kex); 2053 2054 session_id2 = kex->session_id; 2055 session_id2_len = kex->session_id_len; 2056 2057 #ifdef DEBUG_KEXDH 2058 /* send 1st encrypted/maced/compressed message */ 2059 packet_start(SSH2_MSG_IGNORE); 2060 packet_put_cstring("markus"); 2061 packet_send(); 2062 packet_write_wait(); 2063 #endif 2064 debug("KEX done"); 2065 } 2066 2067 /* server specific fatal cleanup */ 2068 void 2069 cleanup_exit(int i) 2070 { 2071 if (the_authctxt) 2072 do_cleanup(the_authctxt); 2073 #ifdef SSH_AUDIT_EVENTS 2074 /* done after do_cleanup so it can cancel the PAM auth 'thread' */ 2075 if (!use_privsep || mm_is_monitor()) 2076 audit_event(SSH_CONNECTION_ABANDON); 2077 #endif 2078 _exit(i); 2079 } 2080