xref: /titanic_50/usr/src/cmd/ssh/sshd/altprivsep.c (revision 10d63b7db37a83b39c7f511cf9426c9d03ea0760)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  *
21  * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
22  */
23 
24 #include <fcntl.h>
25 #include <sys/types.h>
26 #include <sys/types.h>
27 #include <sys/stat.h>
28 #include <sys/socket.h>
29 
30 #include <pwd.h>
31 
32 #include "includes.h"
33 #include "atomicio.h"
34 #include "auth.h"
35 #include "bufaux.h"
36 #include "buffer.h"
37 #include "cipher.h"
38 #include "compat.h"
39 #include "dispatch.h"
40 #include "getput.h"
41 #include "kex.h"
42 #include "log.h"
43 #include "mac.h"
44 #include "packet.h"
45 #include "uidswap.h"
46 #include "ssh2.h"
47 #include "sshlogin.h"
48 #include "xmalloc.h"
49 #include "altprivsep.h"
50 #include "canohost.h"
51 #include "engine.h"
52 #include "servconf.h"
53 
54 #ifdef HAVE_BSM
55 #include "bsmaudit.h"
56 adt_session_data_t *ah = NULL;
57 #endif /* HAVE_BSM */
58 
59 #ifdef GSSAPI
60 #include "ssh-gss.h"
61 extern Gssctxt *xxx_gssctxt;
62 #endif /* GSSAPI */
63 
64 extern Kex *xxx_kex;
65 extern u_char *session_id2;
66 extern int session_id2_len;
67 
68 static Buffer to_monitor;
69 static Buffer from_monitor;
70 
71 /*
72  * Sun's Alternative Privilege Separation basics:
73  *
74  * Abstract
75  * --------
76  *
77  * sshd(1M) fork()s and drops privs in the child while retaining privs
78  * in the parent (a.k.a., the monitor).  The unprivileged sshd and the
79  * monitor talk over a pipe using a simple protocol.
80  *
81  * The monitor protocol is all about having the monitor carry out the
82  * only operations that require privileges OR access to privileged
83  * resources.  These are: utmpx/wtmpx record keeping, auditing, and
84  * SSHv2 re-keying.
85  *
86  * Re-Keying
87  * ---------
88  *
89  * Re-keying is the only protocol version specific aspect of sshd in
90  * which the monitor gets involved.
91  *
92  * The monitor processes all SSHv2 re-key protocol packets, but the
93  * unprivileged sshd process does the transport layer crypto for those
94  * packets.
95  *
96  * The monitor and its unprivileged sshd child process treat
97  * SSH_MSG_NEWKEYS SSH2 messages specially: a) the monitor does not call
98  * set_newkeys(), but b) the child asks the monitor for the set of
99  * negotiated algorithms, key, IV and what not for the relevant
100  * transport direction and then calls set_newkeys().
101  *
102  * Monitor Protocol
103  * ----------------
104  *
105  * Monitor IPC message formats are similar to SSHv2 messages, minus
106  * compression, encryption, padding and MACs:
107  *
108  *  - 4 octet message length
109  *  - message data
110  *     - 1 octet message type
111  *     - message data
112  *
113  * In broad strokes:
114  *
115  *  - IPC: pipe, exit(2)/wait4(2)
116  *
117  *  - threads: the monitor and child are single-threaded
118  *
119  *  - monitor main loop: a variant of server_loop2(), for re-keying only
120  *  - unpriv child main loop: server_loop2(), as usual
121  *
122  *  - protocol:
123  *     - key exchange packets are always forwarded as is to the monitor
124  *     - newkeys, record_login(), record_logout() are special packets
125  *     using the packet type range reserved for local extensions
126  *
127  *  - the child drops privs and runs like a normal sshd, except that it
128  *  sets dispatch handlers for key exchange packets that forward the
129  *  packets to the monitor
130  *
131  * Event loops:
132  *
133  *  - all monitor protocols are synchronous: because the SSHv2 rekey
134  *  protocols are synchronous and because the other monitor operations
135  *  are synchronous (or have no replies),
136  *
137  *  - server_loop2() is modified to check the monitor pipe for rekey
138  *  packets to forward to the client
139  *
140  *  - and dispatch handlers are set, upon receipt of KEXINIT (and reset
141  *  when NEWKEYS is sent out) to forward incoming rekey packets to the
142  *  monitor.
143  *
144  *  - the monitor runs an event loop not unlike server_loop2() and runs
145  *  key exchanges almost exactly as a pre-altprivsep sshd would
146  *
147  *  - unpriv sshd exit -> monitor cleanup (including audit logout) and exit
148  *
149  *  - fatal() in monitor -> forcibly shutdown() socket and kill/wait for
150  *  child (so that the audit event for the logout better reflects
151  *  reality -- i.e., logged out means logged out, but for bg jobs)
152  *
153  * Message formats:
154  *
155  *  - key exchange packets/replies forwarded "as is"
156  *
157  *  - all other monitor requests are sent as SSH2_PRIV_MSG_ALTPRIVSEP and have a
158  *  sub-type identifier (one octet)
159  *  - private request sub-types include:
160  *     - get new shared secret from last re-key
161  *     - record login  (utmpx/wtmpx), request data contains three arguments:
162  *     pid, ttyname, program name
163  *     - record logout (utmpx/wtmpx), request data contains one argument: pid
164  *
165  * Reply sub-types include:
166  *
167  *  - NOP (for record_login/logout)
168  *  - new shared secret from last re-key
169  */
170 
171 static int aps_started = 0;
172 static int is_monitor = 0;
173 
174 static pid_t monitor_pid, child_pid;
175 static int pipe_fds[2];
176 static int pipe_fd = -1;
177 static Buffer input_pipe, output_pipe; /* for pipe I/O */
178 
179 static Authctxt *xxx_authctxt;
180 
181 /* Monitor functions */
182 extern void aps_monitor_loop(Authctxt *authctxt, pid_t child_pid);
183 static void aps_record_login(void);
184 static void aps_record_logout(void);
185 static void aps_start_rekex(void);
186 Authctxt *aps_read_auth_context(void);
187 
188 /* main functions for handling the monitor */
189 static pid_t	altprivsep_start_monitor(Authctxt **authctxt);
190 static void	altprivsep_do_monitor(Authctxt *authctxt, pid_t child_pid);
191 static int	altprivsep_started(void);
192 static int	altprivsep_is_monitor(void);
193 
194 /* calls _to_ monitor from unprivileged process */
195 static void	altprivsep_get_newkeys(enum kex_modes mode);
196 
197 /* monitor-side fatal_cleanup callbacks */
198 static void	altprivsep_shutdown_sock(void *arg);
199 
200 /* Altprivsep packet utilities for communication with the monitor */
201 static void	altprivsep_packet_start(u_char);
202 static int	altprivsep_packet_send(void);
203 static int	altprivsep_fwd_packet(u_char type);
204 
205 static int	altprivsep_packet_read(void);
206 static void	altprivsep_packet_read_expect(int type);
207 
208 static void	altprivsep_packet_put_char(int ch);
209 static void	altprivsep_packet_put_int(u_int value);
210 static void	altprivsep_packet_put_cstring(const char *str);
211 static void	altprivsep_packet_put_raw(const void *buf, u_int len);
212 
213 static u_int	 altprivsep_packet_get_char(void);
214 static void	*altprivsep_packet_get_raw(u_int *length_ptr);
215 static void	*altprivsep_packet_get_string(u_int *length_ptr);
216 
217 Kex		*prepare_for_ssh2_kex(void);
218 
219 /*
220  * Start monitor from privileged sshd process.
221  *
222  * Return values are like fork(2); the parent is the monitor.  The caller should
223  * fatal() on error.
224  *
225  * Note that the monitor waits until the still privileged child finishes the
226  * authentication. The child drops its privileges after the authentication.
227  */
228 static pid_t
229 altprivsep_start_monitor(Authctxt **authctxt)
230 {
231 	pid_t pid;
232 	int junk;
233 
234 	if (aps_started)
235 		fatal("Monitor startup failed: missing state");
236 
237 	buffer_init(&output_pipe);
238 	buffer_init(&input_pipe);
239 
240 	if (pipe(pipe_fds) != 0) {
241 		error("Monitor startup failure: could not create pipes: %s",
242 			strerror(errno));
243 		return (-1);
244 	}
245 
246 	(void) fcntl(pipe_fds[0], F_SETFD, FD_CLOEXEC);
247 	(void) fcntl(pipe_fds[1], F_SETFD, FD_CLOEXEC);
248 
249 	monitor_pid = getpid();
250 
251 	if ((pid = fork()) > 0) {
252 		/*
253 		 * From now on, all debug messages from monitor will have prefix
254 		 * "monitor "
255 		 */
256 		set_log_txt_prefix("monitor ");
257 		(void) prepare_for_ssh2_kex();
258 		packet_set_server();
259 		/* parent */
260 		child_pid = pid;
261 
262 		debug2("Monitor pid %ld, unprivileged child pid %ld",
263 			monitor_pid, child_pid);
264 
265 		(void) close(pipe_fds[1]);
266 		pipe_fd = pipe_fds[0];
267 
268 		/*
269 		 * Signal readiness of the monitor and then read the
270 		 * authentication context from the child.
271 		 */
272 		(void) write(pipe_fd, &pid, sizeof (pid));
273 		packet_set_monitor(pipe_fd);
274 		xxx_authctxt = *authctxt = aps_read_auth_context();
275 
276 		if (fcntl(pipe_fd, F_SETFL, O_NONBLOCK) < 0)
277 			error("fcntl O_NONBLOCK: %.100s", strerror(errno));
278 
279 		aps_started = 1;
280 		is_monitor = 1;
281 
282 		debug2("Monitor started");
283 
284 		return (pid);
285 	}
286 
287 	if (pid < 0) {
288 		debug2("Monitor startup failure: could not fork unprivileged"
289 			" process:  %s", strerror(errno));
290 		return (pid);
291 	}
292 
293 	/* this is the child that will later drop privileges */
294 
295 	/* note that Solaris has bi-directional pipes so one pipe is enough */
296 	(void) close(pipe_fds[0]);
297 	pipe_fd = pipe_fds[1];
298 
299 	/* wait for monitor to be ready */
300 	debug2("Waiting for monitor");
301 	(void) read(pipe_fd, &junk, sizeof (junk));
302 	debug2("Monitor signalled readiness");
303 
304 	buffer_init(&to_monitor);
305 	buffer_init(&from_monitor);
306 
307 	/* AltPrivSep interfaces are set up */
308 	aps_started = 1;
309 	return (pid);
310 }
311 
312 int
313 altprivsep_get_pipe_fd(void)
314 {
315 	return (pipe_fd);
316 }
317 
318 /*
319  * This function is used in the unprivileged child for all packets in the range
320  * between SSH2_MSG_KEXINIT and SSH2_MSG_TRANSPORT_MAX.
321  */
322 void
323 altprivsep_rekey(int type, u_int32_t seq, void *ctxt)
324 {
325 	Kex *kex = (Kex *)ctxt;
326 
327 	if (kex == NULL)
328 		fatal("Missing key exchange context in unprivileged process");
329 
330 	if (type != SSH2_MSG_NEWKEYS) {
331 		debug2("Forwarding re-key packet (%d) to monitor", type);
332 		if (!altprivsep_fwd_packet(type))
333 			fatal("altprivsep_rekey: Monitor not responding");
334 	}
335 
336 	/* tell server_loop2() that we're re-keying */
337 	kex->done = 0;
338 
339 	/* NEWKEYS is special: get the new keys for client->server direction */
340 	if (type == SSH2_MSG_NEWKEYS) {
341 		debug2("received SSH2_MSG_NEWKEYS packet - "
342 		    "getting new inbound keys from the monitor");
343 		altprivsep_get_newkeys(MODE_IN);
344 		kex->done = 1;
345 	}
346 }
347 
348 void
349 altprivsep_process_input(fd_set *rset)
350 {
351 	void	*data;
352 	int	 type;
353 	u_int	 dlen;
354 
355 	if (pipe_fd == -1)
356 		return;
357 
358 	if (!FD_ISSET(pipe_fd, rset))
359 		return;
360 
361 	debug2("reading from pipe to monitor (%d)", pipe_fd);
362 	if ((type = altprivsep_packet_read()) == -1)
363 		fatal("altprivsep_process_input: Monitor not responding");
364 
365 	if (!compat20)
366 		return; /* shouldn't happen! but be safe */
367 
368 	if (type == 0)
369 		return;	/* EOF -- nothing to do here */
370 
371 	if (type >= SSH2_MSG_MAX)
372 		fatal("Received garbage from monitor");
373 
374 	debug2("Read packet type %d from pipe to monitor", (u_int)type);
375 
376 	if (type == SSH2_PRIV_MSG_ALTPRIVSEP)
377 		return; /* shouldn't happen! */
378 
379 	/* NEWKEYS is special: get the new keys for server->client direction */
380 	if (type == SSH2_MSG_NEWKEYS) {
381 		debug2("forwarding SSH2_MSG_NEWKEYS packet we got from monitor to "
382 		    "the client");
383 		packet_start(SSH2_MSG_NEWKEYS);
384 		packet_send();
385 		debug2("getting new outbound keys from the monitor");
386 		altprivsep_get_newkeys(MODE_OUT);
387 		return;
388 	}
389 
390 	data = altprivsep_packet_get_raw(&dlen);
391 
392 	packet_start((u_char)type);
393 
394 	if (data != NULL && dlen > 0)
395 		packet_put_raw(data, dlen);
396 
397 	packet_send();
398 }
399 
400 static void
401 altprivsep_do_monitor(Authctxt *authctxt, pid_t child_pid)
402 {
403 	aps_monitor_loop(authctxt, child_pid);
404 }
405 
406 static int
407 altprivsep_started(void)
408 {
409 	return (aps_started);
410 }
411 
412 static int
413 altprivsep_is_monitor(void)
414 {
415 	return (is_monitor);
416 }
417 
418 /*
419  * A fatal cleanup function to forcibly shutdown the connection socket
420  */
421 static void
422 altprivsep_shutdown_sock(void *arg)
423 {
424 	int sock;
425 
426 	if (arg == NULL)
427 		return;
428 
429 	sock = *(int *)arg;
430 
431 	(void) shutdown(sock, SHUT_RDWR);
432 }
433 
434 /* Calls _to_ monitor from unprivileged process */
435 static int
436 altprivsep_fwd_packet(u_char type)
437 {
438 	u_int len;
439 	void  *data;
440 
441 	altprivsep_packet_start(type);
442 	data = packet_get_raw(&len);
443 	altprivsep_packet_put_raw(data, len);
444 
445 	/* packet_send()s any replies from the monitor to the client */
446 	return (altprivsep_packet_send());
447 }
448 
449 extern Newkeys *current_keys[MODE_MAX];
450 
451 /* To be called from packet.c:set_newkeys() before referencing current_keys */
452 static void
453 altprivsep_get_newkeys(enum kex_modes mode)
454 {
455 	Newkeys	*newkeys;
456 	Comp	*comp;
457 	Enc	*enc;
458 	Mac	*mac;
459 	u_int	 len;
460 
461 	if (!altprivsep_started())
462 		return;
463 
464 	if (altprivsep_is_monitor())
465 		return; /* shouldn't happen */
466 
467 	/* request new keys */
468 	altprivsep_packet_start(SSH2_PRIV_MSG_ALTPRIVSEP);
469 	altprivsep_packet_put_char(APS_MSG_NEWKEYS_REQ);
470 	altprivsep_packet_put_int((u_int)mode);
471 	altprivsep_packet_send();
472 	altprivsep_packet_read_expect(SSH2_PRIV_MSG_ALTPRIVSEP);
473 	if (altprivsep_packet_get_char() != APS_MSG_NEWKEYS_REP)
474 		fatal("Received garbage from monitor during re-keying");
475 
476 	newkeys = xmalloc(sizeof (*newkeys));
477 	memset(newkeys, 0, sizeof (*newkeys));
478 
479 	enc = &newkeys->enc;
480 	mac = &newkeys->mac;
481 	comp = &newkeys->comp;
482 
483 	/* Cipher name, key, IV */
484 	enc->name = altprivsep_packet_get_string(NULL);
485 	if ((enc->cipher = cipher_by_name(enc->name)) == NULL)
486 		fatal("Monitor negotiated an unknown cipher during re-key");
487 
488 	enc->key = altprivsep_packet_get_string(&enc->key_len);
489 	enc->iv = altprivsep_packet_get_string(&enc->block_size);
490 
491 	/* MAC name */
492 	mac->name = altprivsep_packet_get_string(NULL);
493 	if (mac_setup(mac, mac->name) < 0)
494 		fatal("Monitor negotiated an unknown MAC algorithm "
495 			"during re-key");
496 
497 	mac->key = altprivsep_packet_get_string(&len);
498 	if (len > mac->key_len)
499 		fatal("%s: bad mac key length: %d > %d", __func__, len,
500 			mac->key_len);
501 
502 	/* Compression algorithm name */
503 	comp->name = altprivsep_packet_get_string(NULL);
504 	if (strcmp(comp->name, "zlib") != 0 && strcmp(comp->name, "none") != 0)
505 		fatal("Monitor negotiated an unknown compression "
506 			"algorithm during re-key");
507 
508 	comp->type = 0;
509 	comp->enabled = 0; /* forces compression re-init, as per-spec */
510 	if (strcmp(comp->name, "zlib") == 0)
511 		comp->type = 1;
512 
513 	/*
514 	 * Now install new keys
515 	 *
516 	 * For now abuse kex.c/packet.c non-interfaces.  Someday, when
517 	 * the many internal interfaces are parametrized, made reentrant
518 	 * and thread-safe, made more consistent, and when necessary-but-
519 	 * currently-missing interfaces are added then this bit of
520 	 * ugliness can be revisited.
521 	 *
522 	 * The ugliness is in the set_newkeys(), its name and the lack
523 	 * of a (Newkeys *) parameter, which forces us to pass the
524 	 * newkeys through current_keys[mode].  But this saves us some
525 	 * lines of code for now, though not comments.
526 	 *
527 	 * Also, we've abused, in the code above, knowledge of what
528 	 * set_newkeys() expects the current_keys[mode] to contain.
529 	 */
530 	current_keys[mode] = newkeys;
531 	set_newkeys(mode);
532 
533 }
534 
535 void
536 altprivsep_record_login(pid_t pid, const char *ttyname)
537 {
538 	altprivsep_packet_start(SSH2_PRIV_MSG_ALTPRIVSEP);
539 	altprivsep_packet_put_char(APS_MSG_RECORD_LOGIN);
540 	altprivsep_packet_put_int(pid);
541 	altprivsep_packet_put_cstring(ttyname);
542 	altprivsep_packet_send();
543 	altprivsep_packet_read_expect(SSH2_PRIV_MSG_ALTPRIVSEP);
544 }
545 
546 void
547 altprivsep_record_logout(pid_t pid)
548 {
549 	altprivsep_packet_start(SSH2_PRIV_MSG_ALTPRIVSEP);
550 	altprivsep_packet_put_char(APS_MSG_RECORD_LOGOUT);
551 	altprivsep_packet_put_int(pid);
552 	altprivsep_packet_send();
553 	altprivsep_packet_read_expect(SSH2_PRIV_MSG_ALTPRIVSEP);
554 }
555 
556 void
557 altprivsep_start_rekex(void)
558 {
559 	altprivsep_packet_start(SSH2_PRIV_MSG_ALTPRIVSEP);
560 	altprivsep_packet_put_char(APS_MSG_START_REKEX);
561 	altprivsep_packet_send();
562 	altprivsep_packet_read_expect(SSH2_PRIV_MSG_ALTPRIVSEP);
563 }
564 
565 /*
566  * The monitor needs some information that its child learns during the
567  * authentication process. Since the child was forked before the key exchange
568  * and authentication started it must send some context to the monitor after the
569  * authentication is finished. Less obvious part - monitor needs the session ID
570  * since it is used in the key generation process after the key (re-)exchange is
571  * finished.
572  */
573 void
574 altprivsep_send_auth_context(Authctxt *authctxt)
575 {
576 	debug("sending auth context to the monitor");
577 	altprivsep_packet_start(SSH2_PRIV_MSG_ALTPRIVSEP);
578 	altprivsep_packet_put_char(APS_MSG_AUTH_CONTEXT);
579 	altprivsep_packet_put_int(authctxt->pw->pw_uid);
580 	altprivsep_packet_put_int(authctxt->pw->pw_gid);
581 	altprivsep_packet_put_cstring(authctxt->pw->pw_name);
582 	altprivsep_packet_put_raw(session_id2, session_id2_len);
583 	debug("will send %d bytes of auth context to the monitor",
584 	    buffer_len(&to_monitor));
585 	altprivsep_packet_send();
586 	altprivsep_packet_read_expect(SSH2_PRIV_MSG_ALTPRIVSEP);
587 }
588 
589 static void aps_send_newkeys(void);
590 
591 /* Monitor side dispatch handler for SSH2_PRIV_MSG_ALTPRIVSEP */
592 /* ARGSUSED */
593 void
594 aps_input_altpriv_msg(int type, u_int32_t seq, void *ctxt)
595 {
596 	u_char req_type;
597 
598 	req_type = packet_get_char();
599 
600 	switch (req_type) {
601 	case APS_MSG_NEWKEYS_REQ:
602 		aps_send_newkeys();
603 		break;
604 	case APS_MSG_RECORD_LOGIN:
605 		aps_record_login();
606 		break;
607 	case APS_MSG_RECORD_LOGOUT:
608 		aps_record_logout();
609 		break;
610 	case APS_MSG_START_REKEX:
611 		aps_start_rekex();
612 		break;
613 	default:
614 		break;
615 	}
616 }
617 
618 /* Monitor-side handlers for APS_MSG_* */
619 static
620 void
621 aps_send_newkeys(void)
622 {
623 	Newkeys *newkeys;
624 	Enc *enc;
625 	Mac *mac;
626 	Comp *comp;
627 	enum kex_modes mode;
628 
629 	/* get direction for which newkeys are wanted */
630 	mode = (enum kex_modes) packet_get_int();
631 	packet_check_eom();
632 
633 	/* get those newkeys */
634 	newkeys = kex_get_newkeys(mode);
635 	enc = &newkeys->enc;
636 	mac = &newkeys->mac;
637 	comp = &newkeys->comp;
638 
639 	/*
640 	 * Negotiated algorithms, client->server and server->client, for
641 	 * cipher, mac and compression.
642 	 */
643 	packet_start(SSH2_PRIV_MSG_ALTPRIVSEP);
644 	packet_put_char(APS_MSG_NEWKEYS_REP);
645 	packet_put_cstring(enc->name);
646 	packet_put_string(enc->key, enc->key_len);
647 	packet_put_string(enc->iv, enc->block_size);
648 	packet_put_cstring(mac->name);
649 	packet_put_string(mac->key, mac->key_len);
650 	packet_put_cstring(comp->name);
651 
652 	packet_send();
653 	free_keys(newkeys);
654 }
655 
656 struct _aps_login_rec {
657 	pid_t			lr_pid;
658 	char			*lr_tty;
659 	struct _aps_login_rec	*next;
660 };
661 
662 typedef struct _aps_login_rec aps_login_rec;
663 
664 static aps_login_rec *aps_login_list = NULL;
665 
666 static
667 void
668 aps_record_login(void)
669 {
670 	aps_login_rec	*new_rec;
671 	struct stat	 sbuf;
672 	size_t		 proc_path_len;
673 	char		*proc_path;
674 
675 	new_rec = xmalloc(sizeof (aps_login_rec));
676 	memset(new_rec, 0, sizeof (aps_login_rec));
677 
678 	new_rec->lr_pid = packet_get_int();
679 	new_rec->lr_tty = packet_get_string(NULL);
680 
681 	proc_path_len = snprintf(NULL, 0, "/proc/%d", new_rec->lr_pid);
682 	proc_path = xmalloc(proc_path_len + 1);
683 	(void) snprintf(proc_path, proc_path_len + 1, "/proc/%d",
684 			new_rec->lr_pid);
685 
686 	if (stat(proc_path, &sbuf) ||
687 	    sbuf.st_uid != xxx_authctxt->pw->pw_uid ||
688 	    stat(new_rec->lr_tty, &sbuf) < 0 ||
689 	    sbuf.st_uid != xxx_authctxt->pw->pw_uid) {
690 		debug2("Spurious record_login request from unprivileged sshd");
691 		xfree(proc_path);
692 		xfree(new_rec->lr_tty);
693 		xfree(new_rec);
694 		return;
695 	}
696 
697 	/* Insert new record on list */
698 	new_rec->next = aps_login_list;
699 	aps_login_list = new_rec;
700 
701 	record_login(new_rec->lr_pid, new_rec->lr_tty, NULL,
702 		xxx_authctxt->user);
703 
704 	packet_start(SSH2_PRIV_MSG_ALTPRIVSEP);
705 	packet_send();
706 
707 	xfree(proc_path);
708 }
709 
710 static
711 void
712 aps_record_logout(void)
713 {
714 	aps_login_rec	**p, *q;
715 	pid_t		 pid;
716 
717 	pid = packet_get_int();
718 	packet_check_eom();
719 
720 	for (p = &aps_login_list; *p != NULL; p = &q->next) {
721 		q = *p;
722 		if (q->lr_pid == pid) {
723 			record_logout(q->lr_pid, q->lr_tty, NULL,
724 				xxx_authctxt->user);
725 
726 			/* dequeue */
727 			*p = q->next;
728 			xfree(q->lr_tty);
729 			xfree(q);
730 			break;
731 		}
732 	}
733 
734 	packet_start(SSH2_PRIV_MSG_ALTPRIVSEP);
735 	packet_send();
736 }
737 
738 static
739 void
740 aps_start_rekex(void)
741 {
742 	/*
743 	 * Send confirmation. We could implement it without that but it doesn't
744 	 * bring any harm to do that and we are consistent with other subtypes
745 	 * of our private SSH2_PRIV_MSG_ALTPRIVSEP message type.
746 	 */
747 	packet_start(SSH2_PRIV_MSG_ALTPRIVSEP);
748 	packet_send();
749 
750 	/*
751 	 * KEX_INIT message could be the one that reached the limit. In that
752 	 * case, it was already forwarded to us from the unnprivileged child,
753 	 * and maybe even acted upon. Obviously we must not send another
754 	 * KEX_INIT message.
755 	 */
756 	if (!(xxx_kex->flags & KEX_INIT_SENT))
757 		kex_send_kexinit(xxx_kex);
758 	else
759 		debug2("rekeying already in progress");
760 }
761 
762 /*
763  * This is the monitor side of altprivsep_send_auth_context().
764  */
765 Authctxt *
766 aps_read_auth_context(void)
767 {
768 	unsigned char *tmp;
769 	Authctxt *authctxt;
770 
771 	/*
772 	 * After the successful authentication we get the context. Getting
773 	 * end-of-file means that authentication failed and we can exit as well.
774 	 */
775 	debug("reading the context from the child");
776 	packet_read_expect(SSH2_PRIV_MSG_ALTPRIVSEP);
777 	debug3("got SSH2_PRIV_MSG_ALTPRIVSEP");
778 	if (packet_get_char() != APS_MSG_AUTH_CONTEXT) {
779 		fatal("APS_MSG_AUTH_CONTEXT message subtype expected.");
780 	}
781 
782 	authctxt = xcalloc(1, sizeof(Authctxt));
783 	authctxt->pw = xcalloc(1, sizeof(struct passwd));
784 
785 	/* uid_t and gid_t are integers (UNIX spec) */
786 	authctxt->pw->pw_uid = packet_get_int();
787 	authctxt->pw->pw_gid = packet_get_int();
788 	authctxt->pw->pw_name = packet_get_string(NULL);
789 	authctxt->user = xstrdup(authctxt->pw->pw_name);
790 	debug3("uid/gid/username %d/%d/%s", authctxt->pw->pw_uid,
791 	    authctxt->pw->pw_gid, authctxt->user);
792 	session_id2 = (unsigned char *)packet_get_raw((unsigned int*)&session_id2_len);
793 
794 	/* we don't have this for SSH1. In that case, session_id2_len is 0. */
795 	if (session_id2_len > 0) {
796 		tmp = (unsigned char *)xmalloc(session_id2_len);
797 		memcpy(tmp, session_id2, session_id2_len);
798 		session_id2 = tmp;
799 		debug3("read session ID (%d B)", session_id2_len);
800 		xxx_kex->session_id = tmp;
801 		xxx_kex->session_id_len = session_id2_len;
802 	}
803 	debug("finished reading the context");
804 
805 	/* send confirmation */
806 	packet_start(SSH2_PRIV_MSG_ALTPRIVSEP);
807 	packet_send();
808 
809 	return (authctxt);
810 }
811 
812 
813 /* Utilities for communication with the monitor */
814 static void
815 altprivsep_packet_start(u_char type)
816 {
817 	buffer_clear(&to_monitor);
818 	buffer_put_char(&to_monitor, type);
819 }
820 
821 static void
822 altprivsep_packet_put_char(int ch)
823 {
824 	buffer_put_char(&to_monitor, ch);
825 }
826 
827 static void
828 altprivsep_packet_put_int(u_int value)
829 {
830 	buffer_put_int(&to_monitor, value);
831 }
832 
833 static void
834 altprivsep_packet_put_cstring(const char *str)
835 {
836 	buffer_put_cstring(&to_monitor, str);
837 }
838 
839 static void
840 altprivsep_packet_put_raw(const void *buf, u_int len)
841 {
842 	buffer_append(&to_monitor, buf, len);
843 }
844 
845 /*
846  * Send a monitor packet to the monitor.  This function is blocking.
847  *
848  * Returns -1 if the monitor pipe has been closed earlier, fatal()s if
849  * there's any other problems.
850  */
851 static int
852 altprivsep_packet_send(void)
853 {
854 	ssize_t len;
855 	u_int32_t plen;	/* packet length */
856 	u_char	plen_buf[sizeof (plen)];
857 	u_char padlen;	/* padding length */
858 	fd_set *setp;
859 	int err;
860 
861 	if (pipe_fd == -1)
862 		return (-1);
863 
864 	if ((plen = buffer_len(&to_monitor)) == 0)
865 		return (0);
866 
867 	/*
868 	 * We talk the SSHv2 binary packet protocol to the monitor,
869 	 * using the none cipher, mac and compression algorithms.
870 	 *
871 	 * But, interestingly, the none cipher has a block size of 8
872 	 * bytes, thus we must pad the packet.
873 	 *
874 	 * Also, encryption includes the packet length, so the padding
875 	 * must account for that field.  I.e., (sizeof (packet length) +
876 	 * sizeof (padding length) + packet length + padding length) %
877 	 * block_size must == 0.
878 	 *
879 	 * Also, there must be at least four (4) bytes of padding.
880 	 */
881 	padlen = (8 - ((plen + sizeof (plen) + sizeof (padlen)) % 8)) % 8;
882 	if (padlen < 4)
883 		padlen += 8;
884 
885 	/* packet length counts padding and padding length field */
886 	plen += padlen + sizeof (padlen);
887 
888 	PUT_32BIT(plen_buf, plen);
889 
890 	setp = xmalloc(howmany(pipe_fd + 1, NFDBITS) * sizeof (fd_mask));
891 	memset(setp, 0, howmany(pipe_fd + 1, NFDBITS) * sizeof (fd_mask));
892 	FD_SET(pipe_fd, setp);
893 
894 	while (select(pipe_fd + 1, NULL, setp, NULL, NULL) == -1) {
895 		if (errno == EAGAIN || errno == EINTR)
896 			continue;
897 		else
898 			goto pipe_gone;
899 	}
900 
901 	xfree(setp);
902 
903 	/* packet length field */
904 	len = atomicio(write, pipe_fd, plen_buf, sizeof (plen));
905 
906 	if (len != sizeof (plen))
907 		goto pipe_gone;
908 
909 	/* padding length field */
910 	len = atomicio(write, pipe_fd, &padlen, sizeof (padlen));
911 
912 	if (len != sizeof (padlen))
913 		goto pipe_gone;
914 
915 	len = atomicio(write, pipe_fd, buffer_ptr(&to_monitor), plen - 1);
916 
917 	if (len != (plen - 1))
918 		goto pipe_gone;
919 
920 	buffer_clear(&to_monitor);
921 
922 	return (1);
923 
924 pipe_gone:
925 
926 	err = errno;
927 
928 	(void) close(pipe_fd);
929 
930 	pipe_fd = -1;
931 
932 	fatal("altprvsep_packet_send: Monitor not responding: %.100s",
933 	    strerror(err));
934 
935 	/* NOTREACHED */
936 	return (0);
937 }
938 
939 /*
940  * Read a monitor packet from the monitor.  This function is blocking.
941  */
942 static int
943 altprivsep_packet_read(void)
944 {
945 	ssize_t len = -1;
946 	u_int32_t plen;
947 	u_char plen_buf[sizeof (plen)];
948 	u_char padlen;
949 	fd_set *setp;
950 	int err;
951 
952 	if (pipe_fd == -1)
953 		return (-1);
954 
955 	setp = xmalloc(howmany(pipe_fd + 1, NFDBITS) * sizeof (fd_mask));
956 	memset(setp, 0, howmany(pipe_fd + 1, NFDBITS) * sizeof (fd_mask));
957 	FD_SET(pipe_fd, setp);
958 
959 	while (select(pipe_fd + 1, setp, NULL, NULL, NULL) == -1) {
960 		if (errno == EAGAIN || errno == EINTR)
961 			continue;
962 		else
963 			goto pipe_gone;
964 	}
965 
966 	xfree(setp);
967 
968 	/* packet length field */
969 	len = atomicio(read, pipe_fd, plen_buf, sizeof (plen));
970 
971 	plen = GET_32BIT(plen_buf);
972 
973 	if (len != sizeof (plen))
974 		goto pipe_gone;
975 
976 	/* padding length field */
977 	len = atomicio(read, pipe_fd, &padlen, sizeof (padlen));
978 
979 	if (len != sizeof (padlen))
980 		goto pipe_gone;
981 
982 	plen -= sizeof (padlen);
983 
984 	buffer_clear(&from_monitor);
985 	buffer_append_space(&from_monitor, plen);
986 
987 	/* packet data + padding */
988 	len = atomicio(read, pipe_fd, buffer_ptr(&from_monitor), plen);
989 
990 	if (len != plen)
991 		goto pipe_gone;
992 
993 	/* remove padding */
994 	if (padlen > 0)
995 		buffer_consume_end(&from_monitor, padlen);
996 
997 	/* packet type */
998 	return (buffer_get_char(&from_monitor));
999 
1000 pipe_gone:
1001 
1002 	err = errno;
1003 
1004 	(void) close(pipe_fd);
1005 
1006 	pipe_fd = -1;
1007 
1008 	if (len < 0)
1009 		fatal("altpriv_packet_read: Monitor not responding %.100s",
1010 		    strerror(err));
1011 
1012 	debug2("Monitor pipe closed by monitor");
1013 	return (0);
1014 }
1015 
1016 static void
1017 altprivsep_packet_read_expect(int expected)
1018 {
1019 	int type;
1020 
1021 	type = altprivsep_packet_read();
1022 
1023 	if (type <= 0)
1024 		fatal("altprivsep_packet_read_expect: Monitor not responding");
1025 
1026 	if (type != expected)
1027 		fatal("Protocol error in privilege separation; expected "
1028 			"packet type %d, got %d", expected, type);
1029 }
1030 
1031 static u_int
1032 altprivsep_packet_get_char(void)
1033 {
1034 	return (buffer_get_char(&from_monitor));
1035 }
1036 void
1037 *altprivsep_packet_get_raw(u_int *length_ptr)
1038 {
1039 	if (length_ptr != NULL)
1040 		*length_ptr = buffer_len(&from_monitor);
1041 
1042 	return (buffer_ptr(&from_monitor));
1043 }
1044 void
1045 *altprivsep_packet_get_string(u_int *length_ptr)
1046 {
1047 	return (buffer_get_string(&from_monitor, length_ptr));
1048 }
1049 
1050 /*
1051  * Start and execute the code for the monitor which never returns from this
1052  * function. The child will return and continue in the caller.
1053  */
1054 void
1055 altprivsep_start_and_do_monitor(int use_engine, int inetd, int newsock,
1056 	int statup_pipe)
1057 {
1058 	pid_t aps_child;
1059 	Authctxt *authctxt;
1060 
1061 	/*
1062 	 * The monitor will packet_close() in packet_set_monitor() called from
1063 	 * altprivsep_start_monitor() below to clean up the socket stuff before
1064 	 * it switches to pipes for communication to the child. The socket fd is
1065 	 * closed there so we must dup it here - monitor needs that socket to
1066 	 * shutdown the connection in case of any problem; see comments below.
1067 	 * Note that current newsock was assigned to connection_(in|out) which
1068 	 * are the variables used in packet_close() to close the communication
1069 	 * socket.
1070 	 */
1071 	newsock = dup(newsock);
1072 
1073 	if ((aps_child = altprivsep_start_monitor(&authctxt)) == -1)
1074 		fatal("Monitor could not be started.");
1075 
1076 	if (aps_child > 0) {
1077 		/* ALTPRIVSEP Monitor */
1078 
1079 		/*
1080 		 * The ALTPRIVSEP monitor here does:
1081 		 *
1082 		 *  - record keeping and auditing
1083 		 *  - PAM cleanup
1084 		 */
1085 
1086 		/* this is for MaxStartups and the child takes care of that */
1087 		(void) close(statup_pipe);
1088 		(void) pkcs11_engine_load(use_engine);
1089 
1090 		/*
1091 		 * If the monitor fatal()s it will audit/record a logout, so
1092 		 * we'd better do something to really mean it: shutdown the
1093 		 * socket but leave the child alone -- it's been disconnected
1094 		 * and we hope it exits, but killing any pid from a privileged
1095 		 * monitor could be dangerous.
1096 		 *
1097 		 * NOTE: Order matters -- these fatal cleanups must come before
1098 		 * the audit logout fatal cleanup as these functions are called
1099 		 * in LIFO.
1100 		 */
1101 		fatal_add_cleanup((void (*)(void *))altprivsep_shutdown_sock,
1102 			(void *)&newsock);
1103 
1104 		if (compat20) {
1105 			debug3("Recording SSHv2 session login in wtmpx");
1106 			/*
1107 			 * record_login() relies on connection_in to be the
1108 			 * socket to get the peer address. The problem is that
1109 			 * connection_in had to be set to the pipe descriptor in
1110 			 * altprivsep_start_monitor(). It's not nice but the
1111 			 * easiest way to get the peer's address is to
1112 			 * temporarily set connection_in to the socket's file
1113 			 * descriptor.
1114 			 */
1115 			packet_set_fds(inetd == 1 ? -1 : newsock, 0);
1116 			record_login(getpid(), NULL, "sshd", authctxt->user);
1117 			packet_set_fds(0, 1);
1118 		}
1119 
1120 #ifdef HAVE_BSM
1121 		/* Initialize the group list, audit sometimes needs it. */
1122 		if (initgroups(authctxt->pw->pw_name,
1123 		    authctxt->pw->pw_gid) < 0) {
1124 			perror("initgroups");
1125 			exit (1);
1126 		}
1127 
1128 		/*
1129 		 * The monitor process fork()ed before the authentication
1130 		 * process started so at this point we have an unaudited
1131 		 * context.  Thus we need to obtain the audit session data
1132 		 * from the authentication process (aps_child) which will
1133 		 * have the correct audit context for the user logging in.
1134 		 * To do so we pass along the process-ID of the aps_child
1135 		 * process so that it is referenced for this audit session
1136 		 * rather than referencing the monitor's unaudited context.
1137 		 */
1138 		audit_sshd_login(&ah, aps_child);
1139 
1140 		fatal_add_cleanup((void (*)(void *))audit_sshd_logout,
1141 		    (void *)&ah);
1142 #endif /* HAVE_BSM */
1143 
1144 #ifdef GSSAPI
1145 		fatal_add_cleanup((void (*)(void *))ssh_gssapi_cleanup_creds,
1146 			(void *)&xxx_gssctxt);
1147 #endif /* GSSAPI */
1148 
1149 		altprivsep_do_monitor(authctxt, aps_child);
1150 
1151 		/* If we got here the connection is dead. */
1152 		fatal_remove_cleanup((void (*)(void *))altprivsep_shutdown_sock,
1153 			(void *)&newsock);
1154 
1155 		if (compat20) {
1156 			debug3("Recording SSHv2 session logout in wtmpx");
1157 			record_logout(getpid(), NULL, "sshd", authctxt->user);
1158 		}
1159 
1160 		/*
1161 		 * Make sure the socket is closed. The monitor can't call
1162 		 * packet_close here as it's done a packet_set_connection()
1163 		 * with the pipe to the child instead of the socket.
1164 		 */
1165 		(void) shutdown(newsock, SHUT_RDWR);
1166 
1167 #ifdef GSSAPI
1168 		fatal_remove_cleanup((void (*)(void *))ssh_gssapi_cleanup_creds,
1169 			&xxx_gssctxt);
1170 		ssh_gssapi_cleanup_creds(xxx_gssctxt);
1171 		ssh_gssapi_server_mechs(NULL); /* release cached mechs list */
1172 #endif /* GSSAPI */
1173 
1174 #ifdef HAVE_BSM
1175 		fatal_remove_cleanup((void (*)(void *))audit_sshd_logout, (void *)&ah);
1176 		audit_sshd_logout(&ah);
1177 #endif /* HAVE_BSM */
1178 
1179 		exit(0);
1180 	} else {
1181 		/*
1182 		 * This is the child, close the dup()ed file descriptor for a
1183 		 * socket. It's not needed in the child.
1184 		 */
1185 		close(newsock);
1186 	}
1187 }
1188