diff options
author | Colin Watson <cjwatson@debian.org> | 2013-09-14 23:42:11 +0100 |
---|---|---|
committer | Colin Watson <cjwatson@debian.org> | 2013-09-14 23:42:11 +0100 |
commit | 327155e6824b3ee13837bdde04e4eb47e147ff46 (patch) | |
tree | 8f8743122403c7a2e6ed919156711fb1520c657f /monitor.c | |
parent | 0334ce32304e9ba2a10ee5ca49ca6e8ff3ba6cf4 (diff) | |
parent | 74e339b8f8936bc0d985e053a076d0c9b5e9ea51 (diff) |
* New upstream release (http://www.openssh.com/txt/release-6.3).
- sftp(1): add support for resuming partial downloads using the "reget"
command and on the sftp commandline or on the "get" commandline using
the "-a" (append) option (closes: #158590).
- ssh(1): add an "IgnoreUnknown" configuration option to selectively
suppress errors arising from unknown configuration directives (closes:
#436052).
- sftp(1): update progressmeter when data is acknowledged, not when it's
sent (partially addresses #708372).
- ssh(1): do not fatally exit when attempting to cleanup multiplexing-
created channels that are incompletely opened (closes: #651357).
Diffstat (limited to 'monitor.c')
-rw-r--r-- | monitor.c | 233 |
1 files changed, 126 insertions, 107 deletions
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: monitor.c,v 1.120 2012/12/11 22:16:21 markus Exp $ */ | 1 | /* $OpenBSD: monitor.c,v 1.127 2013/07/19 07:37:48 markus Exp $ */ |
2 | /* | 2 | /* |
3 | * Copyright 2002 Niels Provos <provos@citi.umich.edu> | 3 | * Copyright 2002 Niels Provos <provos@citi.umich.edu> |
4 | * Copyright 2002 Markus Friedl <markus@openbsd.org> | 4 | * Copyright 2002 Markus Friedl <markus@openbsd.org> |
@@ -97,6 +97,7 @@ | |||
97 | #include "ssh2.h" | 97 | #include "ssh2.h" |
98 | #include "jpake.h" | 98 | #include "jpake.h" |
99 | #include "roaming.h" | 99 | #include "roaming.h" |
100 | #include "authfd.h" | ||
100 | #ifdef USE_CONSOLEKIT | 101 | #ifdef USE_CONSOLEKIT |
101 | #include "consolekit.h" | 102 | #include "consolekit.h" |
102 | #endif | 103 | #endif |
@@ -420,7 +421,7 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor) | |||
420 | "with SSH protocol 1"); | 421 | "with SSH protocol 1"); |
421 | if (authenticated && | 422 | if (authenticated && |
422 | !auth2_update_methods_lists(authctxt, | 423 | !auth2_update_methods_lists(authctxt, |
423 | auth_method)) { | 424 | auth_method, auth_submethod)) { |
424 | debug3("%s: method %s: partial", __func__, | 425 | debug3("%s: method %s: partial", __func__, |
425 | auth_method); | 426 | auth_method); |
426 | authenticated = 0; | 427 | authenticated = 0; |
@@ -450,8 +451,7 @@ monitor_child_preauth(Authctxt *_authctxt, struct monitor *pmonitor) | |||
450 | } | 451 | } |
451 | if (ent->flags & (MON_AUTHDECIDE|MON_ALOG)) { | 452 | if (ent->flags & (MON_AUTHDECIDE|MON_ALOG)) { |
452 | auth_log(authctxt, authenticated, partial, | 453 | auth_log(authctxt, authenticated, partial, |
453 | auth_method, auth_submethod, | 454 | auth_method, auth_submethod); |
454 | compat20 ? " ssh2" : ""); | ||
455 | if (!authenticated) | 455 | if (!authenticated) |
456 | authctxt->failures++; | 456 | authctxt->failures++; |
457 | } | 457 | } |
@@ -586,7 +586,7 @@ monitor_read_log(struct monitor *pmonitor) | |||
586 | do_log2(level, "%s [preauth]", msg); | 586 | do_log2(level, "%s [preauth]", msg); |
587 | 587 | ||
588 | buffer_free(&logmsg); | 588 | buffer_free(&logmsg); |
589 | xfree(msg); | 589 | free(msg); |
590 | 590 | ||
591 | return 0; | 591 | return 0; |
592 | } | 592 | } |
@@ -677,12 +677,9 @@ static void | |||
677 | monitor_reset_key_state(void) | 677 | monitor_reset_key_state(void) |
678 | { | 678 | { |
679 | /* reset state */ | 679 | /* reset state */ |
680 | if (key_blob != NULL) | 680 | free(key_blob); |
681 | xfree(key_blob); | 681 | free(hostbased_cuser); |
682 | if (hostbased_cuser != NULL) | 682 | free(hostbased_chost); |
683 | xfree(hostbased_cuser); | ||
684 | if (hostbased_chost != NULL) | ||
685 | xfree(hostbased_chost); | ||
686 | key_blob = NULL; | 683 | key_blob = NULL; |
687 | key_bloblen = 0; | 684 | key_bloblen = 0; |
688 | key_blobtype = MM_NOKEY; | 685 | key_blobtype = MM_NOKEY; |
@@ -725,6 +722,8 @@ mm_answer_moduli(int sock, Buffer *m) | |||
725 | return (0); | 722 | return (0); |
726 | } | 723 | } |
727 | 724 | ||
725 | extern AuthenticationConnection *auth_conn; | ||
726 | |||
728 | int | 727 | int |
729 | mm_answer_sign(int sock, Buffer *m) | 728 | mm_answer_sign(int sock, Buffer *m) |
730 | { | 729 | { |
@@ -753,18 +752,24 @@ mm_answer_sign(int sock, Buffer *m) | |||
753 | memcpy(session_id2, p, session_id2_len); | 752 | memcpy(session_id2, p, session_id2_len); |
754 | } | 753 | } |
755 | 754 | ||
756 | if ((key = get_hostkey_by_index(keyid)) == NULL) | 755 | if ((key = get_hostkey_by_index(keyid)) != NULL) { |
756 | if (key_sign(key, &signature, &siglen, p, datlen) < 0) | ||
757 | fatal("%s: key_sign failed", __func__); | ||
758 | } else if ((key = get_hostkey_public_by_index(keyid)) != NULL && | ||
759 | auth_conn != NULL) { | ||
760 | if (ssh_agent_sign(auth_conn, key, &signature, &siglen, p, | ||
761 | datlen) < 0) | ||
762 | fatal("%s: ssh_agent_sign failed", __func__); | ||
763 | } else | ||
757 | fatal("%s: no hostkey from index %d", __func__, keyid); | 764 | fatal("%s: no hostkey from index %d", __func__, keyid); |
758 | if (key_sign(key, &signature, &siglen, p, datlen) < 0) | ||
759 | fatal("%s: key_sign failed", __func__); | ||
760 | 765 | ||
761 | debug3("%s: signature %p(%u)", __func__, signature, siglen); | 766 | debug3("%s: signature %p(%u)", __func__, signature, siglen); |
762 | 767 | ||
763 | buffer_clear(m); | 768 | buffer_clear(m); |
764 | buffer_put_string(m, signature, siglen); | 769 | buffer_put_string(m, signature, siglen); |
765 | 770 | ||
766 | xfree(p); | 771 | free(p); |
767 | xfree(signature); | 772 | free(signature); |
768 | 773 | ||
769 | mm_request_send(sock, MONITOR_ANS_SIGN, m); | 774 | mm_request_send(sock, MONITOR_ANS_SIGN, m); |
770 | 775 | ||
@@ -795,7 +800,7 @@ mm_answer_pwnamallow(int sock, Buffer *m) | |||
795 | 800 | ||
796 | authctxt->user = xstrdup(username); | 801 | authctxt->user = xstrdup(username); |
797 | setproctitle("%s [priv]", pwent ? username : "unknown"); | 802 | setproctitle("%s [priv]", pwent ? username : "unknown"); |
798 | xfree(username); | 803 | free(username); |
799 | 804 | ||
800 | buffer_clear(m); | 805 | buffer_clear(m); |
801 | 806 | ||
@@ -813,8 +818,10 @@ mm_answer_pwnamallow(int sock, Buffer *m) | |||
813 | buffer_put_string(m, pwent, sizeof(struct passwd)); | 818 | buffer_put_string(m, pwent, sizeof(struct passwd)); |
814 | buffer_put_cstring(m, pwent->pw_name); | 819 | buffer_put_cstring(m, pwent->pw_name); |
815 | buffer_put_cstring(m, "*"); | 820 | buffer_put_cstring(m, "*"); |
821 | #ifdef HAVE_STRUCT_PASSWD_PW_GECOS | ||
816 | buffer_put_cstring(m, pwent->pw_gecos); | 822 | buffer_put_cstring(m, pwent->pw_gecos); |
817 | #ifdef HAVE_PW_CLASS_IN_PASSWD | 823 | #endif |
824 | #ifdef HAVE_STRUCT_PASSWD_PW_CLASS | ||
818 | buffer_put_cstring(m, pwent->pw_class); | 825 | buffer_put_cstring(m, pwent->pw_class); |
819 | #endif | 826 | #endif |
820 | buffer_put_cstring(m, pwent->pw_dir); | 827 | buffer_put_cstring(m, pwent->pw_dir); |
@@ -874,9 +881,7 @@ int mm_answer_auth2_read_banner(int sock, Buffer *m) | |||
874 | banner = auth2_read_banner(); | 881 | banner = auth2_read_banner(); |
875 | buffer_put_cstring(m, banner != NULL ? banner : ""); | 882 | buffer_put_cstring(m, banner != NULL ? banner : ""); |
876 | mm_request_send(sock, MONITOR_ANS_AUTH2_READ_BANNER, m); | 883 | mm_request_send(sock, MONITOR_ANS_AUTH2_READ_BANNER, m); |
877 | 884 | free(banner); | |
878 | if (banner != NULL) | ||
879 | xfree(banner); | ||
880 | 885 | ||
881 | return (0); | 886 | return (0); |
882 | } | 887 | } |
@@ -893,12 +898,12 @@ mm_answer_authserv(int sock, Buffer *m) | |||
893 | __func__, authctxt->service, authctxt->style, authctxt->role); | 898 | __func__, authctxt->service, authctxt->style, authctxt->role); |
894 | 899 | ||
895 | if (strlen(authctxt->style) == 0) { | 900 | if (strlen(authctxt->style) == 0) { |
896 | xfree(authctxt->style); | 901 | free(authctxt->style); |
897 | authctxt->style = NULL; | 902 | authctxt->style = NULL; |
898 | } | 903 | } |
899 | 904 | ||
900 | if (strlen(authctxt->role) == 0) { | 905 | if (strlen(authctxt->role) == 0) { |
901 | xfree(authctxt->role); | 906 | free(authctxt->role); |
902 | authctxt->role = NULL; | 907 | authctxt->role = NULL; |
903 | } | 908 | } |
904 | 909 | ||
@@ -915,7 +920,7 @@ mm_answer_authrole(int sock, Buffer *m) | |||
915 | __func__, authctxt->role); | 920 | __func__, authctxt->role); |
916 | 921 | ||
917 | if (strlen(authctxt->role) == 0) { | 922 | if (strlen(authctxt->role) == 0) { |
918 | xfree(authctxt->role); | 923 | free(authctxt->role); |
919 | authctxt->role = NULL; | 924 | authctxt->role = NULL; |
920 | } | 925 | } |
921 | 926 | ||
@@ -935,7 +940,7 @@ mm_answer_authpassword(int sock, Buffer *m) | |||
935 | authenticated = options.password_authentication && | 940 | authenticated = options.password_authentication && |
936 | auth_password(authctxt, passwd); | 941 | auth_password(authctxt, passwd); |
937 | memset(passwd, 0, strlen(passwd)); | 942 | memset(passwd, 0, strlen(passwd)); |
938 | xfree(passwd); | 943 | free(passwd); |
939 | 944 | ||
940 | buffer_clear(m); | 945 | buffer_clear(m); |
941 | buffer_put_int(m, authenticated); | 946 | buffer_put_int(m, authenticated); |
@@ -975,10 +980,10 @@ mm_answer_bsdauthquery(int sock, Buffer *m) | |||
975 | mm_request_send(sock, MONITOR_ANS_BSDAUTHQUERY, m); | 980 | mm_request_send(sock, MONITOR_ANS_BSDAUTHQUERY, m); |
976 | 981 | ||
977 | if (success) { | 982 | if (success) { |
978 | xfree(name); | 983 | free(name); |
979 | xfree(infotxt); | 984 | free(infotxt); |
980 | xfree(prompts); | 985 | free(prompts); |
981 | xfree(echo_on); | 986 | free(echo_on); |
982 | } | 987 | } |
983 | 988 | ||
984 | return (0); | 989 | return (0); |
@@ -998,7 +1003,7 @@ mm_answer_bsdauthrespond(int sock, Buffer *m) | |||
998 | auth_userresponse(authctxt->as, response, 0); | 1003 | auth_userresponse(authctxt->as, response, 0); |
999 | authctxt->as = NULL; | 1004 | authctxt->as = NULL; |
1000 | debug3("%s: <%s> = <%d>", __func__, response, authok); | 1005 | debug3("%s: <%s> = <%d>", __func__, response, authok); |
1001 | xfree(response); | 1006 | free(response); |
1002 | 1007 | ||
1003 | buffer_clear(m); | 1008 | buffer_clear(m); |
1004 | buffer_put_int(m, authok); | 1009 | buffer_put_int(m, authok); |
@@ -1006,9 +1011,10 @@ mm_answer_bsdauthrespond(int sock, Buffer *m) | |||
1006 | debug3("%s: sending authenticated: %d", __func__, authok); | 1011 | debug3("%s: sending authenticated: %d", __func__, authok); |
1007 | mm_request_send(sock, MONITOR_ANS_BSDAUTHRESPOND, m); | 1012 | mm_request_send(sock, MONITOR_ANS_BSDAUTHRESPOND, m); |
1008 | 1013 | ||
1009 | if (compat20) | 1014 | if (compat20) { |
1010 | auth_method = "keyboard-interactive"; /* XXX auth_submethod */ | 1015 | auth_method = "keyboard-interactive"; |
1011 | else | 1016 | auth_submethod = "bsdauth"; |
1017 | } else | ||
1012 | auth_method = "bsdauth"; | 1018 | auth_method = "bsdauth"; |
1013 | 1019 | ||
1014 | return (authok != 0); | 1020 | return (authok != 0); |
@@ -1050,7 +1056,7 @@ mm_answer_skeyrespond(int sock, Buffer *m) | |||
1050 | skey_haskey(authctxt->pw->pw_name) == 0 && | 1056 | skey_haskey(authctxt->pw->pw_name) == 0 && |
1051 | skey_passcheck(authctxt->pw->pw_name, response) != -1); | 1057 | skey_passcheck(authctxt->pw->pw_name, response) != -1); |
1052 | 1058 | ||
1053 | xfree(response); | 1059 | free(response); |
1054 | 1060 | ||
1055 | buffer_clear(m); | 1061 | buffer_clear(m); |
1056 | buffer_put_int(m, authok); | 1062 | buffer_put_int(m, authok); |
@@ -1135,19 +1141,17 @@ mm_answer_pam_query(int sock, Buffer *m) | |||
1135 | buffer_clear(m); | 1141 | buffer_clear(m); |
1136 | buffer_put_int(m, ret); | 1142 | buffer_put_int(m, ret); |
1137 | buffer_put_cstring(m, name); | 1143 | buffer_put_cstring(m, name); |
1138 | xfree(name); | 1144 | free(name); |
1139 | buffer_put_cstring(m, info); | 1145 | buffer_put_cstring(m, info); |
1140 | xfree(info); | 1146 | free(info); |
1141 | buffer_put_int(m, num); | 1147 | buffer_put_int(m, num); |
1142 | for (i = 0; i < num; ++i) { | 1148 | for (i = 0; i < num; ++i) { |
1143 | buffer_put_cstring(m, prompts[i]); | 1149 | buffer_put_cstring(m, prompts[i]); |
1144 | xfree(prompts[i]); | 1150 | free(prompts[i]); |
1145 | buffer_put_int(m, echo_on[i]); | 1151 | buffer_put_int(m, echo_on[i]); |
1146 | } | 1152 | } |
1147 | if (prompts != NULL) | 1153 | free(prompts); |
1148 | xfree(prompts); | 1154 | free(echo_on); |
1149 | if (echo_on != NULL) | ||
1150 | xfree(echo_on); | ||
1151 | auth_method = "keyboard-interactive"; | 1155 | auth_method = "keyboard-interactive"; |
1152 | auth_submethod = "pam"; | 1156 | auth_submethod = "pam"; |
1153 | mm_request_send(sock, MONITOR_ANS_PAM_QUERY, m); | 1157 | mm_request_send(sock, MONITOR_ANS_PAM_QUERY, m); |
@@ -1170,8 +1174,8 @@ mm_answer_pam_respond(int sock, Buffer *m) | |||
1170 | resp[i] = buffer_get_string(m, NULL); | 1174 | resp[i] = buffer_get_string(m, NULL); |
1171 | ret = (sshpam_device.respond)(sshpam_ctxt, num, resp); | 1175 | ret = (sshpam_device.respond)(sshpam_ctxt, num, resp); |
1172 | for (i = 0; i < num; ++i) | 1176 | for (i = 0; i < num; ++i) |
1173 | xfree(resp[i]); | 1177 | free(resp[i]); |
1174 | xfree(resp); | 1178 | free(resp); |
1175 | } else { | 1179 | } else { |
1176 | ret = (sshpam_device.respond)(sshpam_ctxt, num, NULL); | 1180 | ret = (sshpam_device.respond)(sshpam_ctxt, num, NULL); |
1177 | } | 1181 | } |
@@ -1229,6 +1233,7 @@ mm_answer_keyallowed(int sock, Buffer *m) | |||
1229 | case MM_USERKEY: | 1233 | case MM_USERKEY: |
1230 | allowed = options.pubkey_authentication && | 1234 | allowed = options.pubkey_authentication && |
1231 | user_key_allowed(authctxt->pw, key); | 1235 | user_key_allowed(authctxt->pw, key); |
1236 | pubkey_auth_info(authctxt, key, NULL); | ||
1232 | auth_method = "publickey"; | 1237 | auth_method = "publickey"; |
1233 | if (options.pubkey_authentication && allowed != 1) | 1238 | if (options.pubkey_authentication && allowed != 1) |
1234 | auth_clear_options(); | 1239 | auth_clear_options(); |
@@ -1237,6 +1242,9 @@ mm_answer_keyallowed(int sock, Buffer *m) | |||
1237 | allowed = options.hostbased_authentication && | 1242 | allowed = options.hostbased_authentication && |
1238 | hostbased_key_allowed(authctxt->pw, | 1243 | hostbased_key_allowed(authctxt->pw, |
1239 | cuser, chost, key); | 1244 | cuser, chost, key); |
1245 | pubkey_auth_info(authctxt, key, | ||
1246 | "client user \"%.100s\", client host \"%.100s\"", | ||
1247 | cuser, chost); | ||
1240 | auth_method = "hostbased"; | 1248 | auth_method = "hostbased"; |
1241 | break; | 1249 | break; |
1242 | case MM_RSAHOSTKEY: | 1250 | case MM_RSAHOSTKEY: |
@@ -1268,11 +1276,10 @@ mm_answer_keyallowed(int sock, Buffer *m) | |||
1268 | hostbased_chost = chost; | 1276 | hostbased_chost = chost; |
1269 | } else { | 1277 | } else { |
1270 | /* Log failed attempt */ | 1278 | /* Log failed attempt */ |
1271 | auth_log(authctxt, 0, 0, auth_method, NULL, | 1279 | auth_log(authctxt, 0, 0, auth_method, NULL); |
1272 | compat20 ? " ssh2" : ""); | 1280 | free(blob); |
1273 | xfree(blob); | 1281 | free(cuser); |
1274 | xfree(cuser); | 1282 | free(chost); |
1275 | xfree(chost); | ||
1276 | } | 1283 | } |
1277 | 1284 | ||
1278 | debug3("%s: key %p is %s", | 1285 | debug3("%s: key %p is %s", |
@@ -1294,7 +1301,7 @@ static int | |||
1294 | monitor_valid_userblob(u_char *data, u_int datalen) | 1301 | monitor_valid_userblob(u_char *data, u_int datalen) |
1295 | { | 1302 | { |
1296 | Buffer b; | 1303 | Buffer b; |
1297 | char *p; | 1304 | char *p, *userstyle; |
1298 | u_int len; | 1305 | u_int len; |
1299 | int fail = 0; | 1306 | int fail = 0; |
1300 | 1307 | ||
@@ -1315,26 +1322,30 @@ monitor_valid_userblob(u_char *data, u_int datalen) | |||
1315 | (len != session_id2_len) || | 1322 | (len != session_id2_len) || |
1316 | (timingsafe_bcmp(p, session_id2, session_id2_len) != 0)) | 1323 | (timingsafe_bcmp(p, session_id2, session_id2_len) != 0)) |
1317 | fail++; | 1324 | fail++; |
1318 | xfree(p); | 1325 | free(p); |
1319 | } | 1326 | } |
1320 | if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST) | 1327 | if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST) |
1321 | fail++; | 1328 | fail++; |
1322 | p = buffer_get_string(&b, NULL); | 1329 | p = buffer_get_cstring(&b, NULL); |
1323 | if (strcmp(authctxt->user, p) != 0) { | 1330 | xasprintf(&userstyle, "%s%s%s", authctxt->user, |
1331 | authctxt->style ? ":" : "", | ||
1332 | authctxt->style ? authctxt->style : ""); | ||
1333 | if (strcmp(userstyle, p) != 0) { | ||
1324 | logit("wrong user name passed to monitor: expected %s != %.100s", | 1334 | logit("wrong user name passed to monitor: expected %s != %.100s", |
1325 | authctxt->user, p); | 1335 | userstyle, p); |
1326 | fail++; | 1336 | fail++; |
1327 | } | 1337 | } |
1328 | xfree(p); | 1338 | free(userstyle); |
1339 | free(p); | ||
1329 | buffer_skip_string(&b); | 1340 | buffer_skip_string(&b); |
1330 | if (datafellows & SSH_BUG_PKAUTH) { | 1341 | if (datafellows & SSH_BUG_PKAUTH) { |
1331 | if (!buffer_get_char(&b)) | 1342 | if (!buffer_get_char(&b)) |
1332 | fail++; | 1343 | fail++; |
1333 | } else { | 1344 | } else { |
1334 | p = buffer_get_string(&b, NULL); | 1345 | p = buffer_get_cstring(&b, NULL); |
1335 | if (strcmp("publickey", p) != 0) | 1346 | if (strcmp("publickey", p) != 0) |
1336 | fail++; | 1347 | fail++; |
1337 | xfree(p); | 1348 | free(p); |
1338 | if (!buffer_get_char(&b)) | 1349 | if (!buffer_get_char(&b)) |
1339 | fail++; | 1350 | fail++; |
1340 | buffer_skip_string(&b); | 1351 | buffer_skip_string(&b); |
@@ -1351,7 +1362,7 @@ monitor_valid_hostbasedblob(u_char *data, u_int datalen, char *cuser, | |||
1351 | char *chost) | 1362 | char *chost) |
1352 | { | 1363 | { |
1353 | Buffer b; | 1364 | Buffer b; |
1354 | char *p; | 1365 | char *p, *userstyle; |
1355 | u_int len; | 1366 | u_int len; |
1356 | int fail = 0; | 1367 | int fail = 0; |
1357 | 1368 | ||
@@ -1363,22 +1374,26 @@ monitor_valid_hostbasedblob(u_char *data, u_int datalen, char *cuser, | |||
1363 | (len != session_id2_len) || | 1374 | (len != session_id2_len) || |
1364 | (timingsafe_bcmp(p, session_id2, session_id2_len) != 0)) | 1375 | (timingsafe_bcmp(p, session_id2, session_id2_len) != 0)) |
1365 | fail++; | 1376 | fail++; |
1366 | xfree(p); | 1377 | free(p); |
1367 | 1378 | ||
1368 | if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST) | 1379 | if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST) |
1369 | fail++; | 1380 | fail++; |
1370 | p = buffer_get_string(&b, NULL); | 1381 | p = buffer_get_cstring(&b, NULL); |
1371 | if (strcmp(authctxt->user, p) != 0) { | 1382 | xasprintf(&userstyle, "%s%s%s", authctxt->user, |
1383 | authctxt->style ? ":" : "", | ||
1384 | authctxt->style ? authctxt->style : ""); | ||
1385 | if (strcmp(userstyle, p) != 0) { | ||
1372 | logit("wrong user name passed to monitor: expected %s != %.100s", | 1386 | logit("wrong user name passed to monitor: expected %s != %.100s", |
1373 | authctxt->user, p); | 1387 | userstyle, p); |
1374 | fail++; | 1388 | fail++; |
1375 | } | 1389 | } |
1376 | xfree(p); | 1390 | free(userstyle); |
1391 | free(p); | ||
1377 | buffer_skip_string(&b); /* service */ | 1392 | buffer_skip_string(&b); /* service */ |
1378 | p = buffer_get_string(&b, NULL); | 1393 | p = buffer_get_cstring(&b, NULL); |
1379 | if (strcmp(p, "hostbased") != 0) | 1394 | if (strcmp(p, "hostbased") != 0) |
1380 | fail++; | 1395 | fail++; |
1381 | xfree(p); | 1396 | free(p); |
1382 | buffer_skip_string(&b); /* pkalg */ | 1397 | buffer_skip_string(&b); /* pkalg */ |
1383 | buffer_skip_string(&b); /* pkblob */ | 1398 | buffer_skip_string(&b); /* pkblob */ |
1384 | 1399 | ||
@@ -1388,13 +1403,13 @@ monitor_valid_hostbasedblob(u_char *data, u_int datalen, char *cuser, | |||
1388 | p[len - 1] = '\0'; | 1403 | p[len - 1] = '\0'; |
1389 | if (strcmp(p, chost) != 0) | 1404 | if (strcmp(p, chost) != 0) |
1390 | fail++; | 1405 | fail++; |
1391 | xfree(p); | 1406 | free(p); |
1392 | 1407 | ||
1393 | /* verify client user */ | 1408 | /* verify client user */ |
1394 | p = buffer_get_string(&b, NULL); | 1409 | p = buffer_get_string(&b, NULL); |
1395 | if (strcmp(p, cuser) != 0) | 1410 | if (strcmp(p, cuser) != 0) |
1396 | fail++; | 1411 | fail++; |
1397 | xfree(p); | 1412 | free(p); |
1398 | 1413 | ||
1399 | if (buffer_len(&b) != 0) | 1414 | if (buffer_len(&b) != 0) |
1400 | fail++; | 1415 | fail++; |
@@ -1443,9 +1458,9 @@ mm_answer_keyverify(int sock, Buffer *m) | |||
1443 | __func__, key, (verified == 1) ? "verified" : "unverified"); | 1458 | __func__, key, (verified == 1) ? "verified" : "unverified"); |
1444 | 1459 | ||
1445 | key_free(key); | 1460 | key_free(key); |
1446 | xfree(blob); | 1461 | free(blob); |
1447 | xfree(signature); | 1462 | free(signature); |
1448 | xfree(data); | 1463 | free(data); |
1449 | 1464 | ||
1450 | auth_method = key_blobtype == MM_USERKEY ? "publickey" : "hostbased"; | 1465 | auth_method = key_blobtype == MM_USERKEY ? "publickey" : "hostbased"; |
1451 | 1466 | ||
@@ -1573,7 +1588,7 @@ mm_answer_pty_cleanup(int sock, Buffer *m) | |||
1573 | if ((s = session_by_tty(tty)) != NULL) | 1588 | if ((s = session_by_tty(tty)) != NULL) |
1574 | mm_session_close(s); | 1589 | mm_session_close(s); |
1575 | buffer_clear(m); | 1590 | buffer_clear(m); |
1576 | xfree(tty); | 1591 | free(tty); |
1577 | return (0); | 1592 | return (0); |
1578 | } | 1593 | } |
1579 | 1594 | ||
@@ -1705,7 +1720,7 @@ mm_answer_rsa_challenge(int sock, Buffer *m) | |||
1705 | 1720 | ||
1706 | monitor_permit(mon_dispatch, MONITOR_REQ_RSARESPONSE, 1); | 1721 | monitor_permit(mon_dispatch, MONITOR_REQ_RSARESPONSE, 1); |
1707 | 1722 | ||
1708 | xfree(blob); | 1723 | free(blob); |
1709 | key_free(key); | 1724 | key_free(key); |
1710 | return (0); | 1725 | return (0); |
1711 | } | 1726 | } |
@@ -1737,9 +1752,9 @@ mm_answer_rsa_response(int sock, Buffer *m) | |||
1737 | fatal("%s: received bad response to challenge", __func__); | 1752 | fatal("%s: received bad response to challenge", __func__); |
1738 | success = auth_rsa_verify_response(key, ssh1_challenge, response); | 1753 | success = auth_rsa_verify_response(key, ssh1_challenge, response); |
1739 | 1754 | ||
1740 | xfree(blob); | 1755 | free(blob); |
1741 | key_free(key); | 1756 | key_free(key); |
1742 | xfree(response); | 1757 | free(response); |
1743 | 1758 | ||
1744 | auth_method = key_blobtype == MM_RSAUSERKEY ? "rsa" : "rhosts-rsa"; | 1759 | auth_method = key_blobtype == MM_RSAUSERKEY ? "rsa" : "rhosts-rsa"; |
1745 | 1760 | ||
@@ -1818,7 +1833,7 @@ mm_answer_audit_command(int socket, Buffer *m) | |||
1818 | cmd = buffer_get_string(m, &len); | 1833 | cmd = buffer_get_string(m, &len); |
1819 | /* sanity check command, if so how? */ | 1834 | /* sanity check command, if so how? */ |
1820 | audit_run_command(cmd); | 1835 | audit_run_command(cmd); |
1821 | xfree(cmd); | 1836 | free(cmd); |
1822 | return (0); | 1837 | return (0); |
1823 | } | 1838 | } |
1824 | #endif /* SSH_AUDIT_EVENTS */ | 1839 | #endif /* SSH_AUDIT_EVENTS */ |
@@ -1833,20 +1848,20 @@ monitor_apply_keystate(struct monitor *pmonitor) | |||
1833 | packet_set_protocol_flags(child_state.ssh1protoflags); | 1848 | packet_set_protocol_flags(child_state.ssh1protoflags); |
1834 | packet_set_encryption_key(child_state.ssh1key, | 1849 | packet_set_encryption_key(child_state.ssh1key, |
1835 | child_state.ssh1keylen, child_state.ssh1cipher); | 1850 | child_state.ssh1keylen, child_state.ssh1cipher); |
1836 | xfree(child_state.ssh1key); | 1851 | free(child_state.ssh1key); |
1837 | } | 1852 | } |
1838 | 1853 | ||
1839 | /* for rc4 and other stateful ciphers */ | 1854 | /* for rc4 and other stateful ciphers */ |
1840 | packet_set_keycontext(MODE_OUT, child_state.keyout); | 1855 | packet_set_keycontext(MODE_OUT, child_state.keyout); |
1841 | xfree(child_state.keyout); | 1856 | free(child_state.keyout); |
1842 | packet_set_keycontext(MODE_IN, child_state.keyin); | 1857 | packet_set_keycontext(MODE_IN, child_state.keyin); |
1843 | xfree(child_state.keyin); | 1858 | free(child_state.keyin); |
1844 | 1859 | ||
1845 | if (!compat20) { | 1860 | if (!compat20) { |
1846 | packet_set_iv(MODE_OUT, child_state.ivout); | 1861 | packet_set_iv(MODE_OUT, child_state.ivout); |
1847 | xfree(child_state.ivout); | 1862 | free(child_state.ivout); |
1848 | packet_set_iv(MODE_IN, child_state.ivin); | 1863 | packet_set_iv(MODE_IN, child_state.ivin); |
1849 | xfree(child_state.ivin); | 1864 | free(child_state.ivin); |
1850 | } | 1865 | } |
1851 | 1866 | ||
1852 | memcpy(&incoming_stream, &child_state.incoming, | 1867 | memcpy(&incoming_stream, &child_state.incoming, |
@@ -1858,18 +1873,22 @@ monitor_apply_keystate(struct monitor *pmonitor) | |||
1858 | if (options.compression) | 1873 | if (options.compression) |
1859 | mm_init_compression(pmonitor->m_zlib); | 1874 | mm_init_compression(pmonitor->m_zlib); |
1860 | 1875 | ||
1876 | if (options.rekey_limit || options.rekey_interval) | ||
1877 | packet_set_rekey_limits((u_int32_t)options.rekey_limit, | ||
1878 | (time_t)options.rekey_interval); | ||
1879 | |||
1861 | /* Network I/O buffers */ | 1880 | /* Network I/O buffers */ |
1862 | /* XXX inefficient for large buffers, need: buffer_init_from_string */ | 1881 | /* XXX inefficient for large buffers, need: buffer_init_from_string */ |
1863 | buffer_clear(packet_get_input()); | 1882 | buffer_clear(packet_get_input()); |
1864 | buffer_append(packet_get_input(), child_state.input, child_state.ilen); | 1883 | buffer_append(packet_get_input(), child_state.input, child_state.ilen); |
1865 | memset(child_state.input, 0, child_state.ilen); | 1884 | memset(child_state.input, 0, child_state.ilen); |
1866 | xfree(child_state.input); | 1885 | free(child_state.input); |
1867 | 1886 | ||
1868 | buffer_clear(packet_get_output()); | 1887 | buffer_clear(packet_get_output()); |
1869 | buffer_append(packet_get_output(), child_state.output, | 1888 | buffer_append(packet_get_output(), child_state.output, |
1870 | child_state.olen); | 1889 | child_state.olen); |
1871 | memset(child_state.output, 0, child_state.olen); | 1890 | memset(child_state.output, 0, child_state.olen); |
1872 | xfree(child_state.output); | 1891 | free(child_state.output); |
1873 | 1892 | ||
1874 | /* Roaming */ | 1893 | /* Roaming */ |
1875 | if (compat20) | 1894 | if (compat20) |
@@ -1908,11 +1927,11 @@ mm_get_kex(Buffer *m) | |||
1908 | blob = buffer_get_string(m, &bloblen); | 1927 | blob = buffer_get_string(m, &bloblen); |
1909 | buffer_init(&kex->my); | 1928 | buffer_init(&kex->my); |
1910 | buffer_append(&kex->my, blob, bloblen); | 1929 | buffer_append(&kex->my, blob, bloblen); |
1911 | xfree(blob); | 1930 | free(blob); |
1912 | blob = buffer_get_string(m, &bloblen); | 1931 | blob = buffer_get_string(m, &bloblen); |
1913 | buffer_init(&kex->peer); | 1932 | buffer_init(&kex->peer); |
1914 | buffer_append(&kex->peer, blob, bloblen); | 1933 | buffer_append(&kex->peer, blob, bloblen); |
1915 | xfree(blob); | 1934 | free(blob); |
1916 | kex->done = 1; | 1935 | kex->done = 1; |
1917 | kex->flags = buffer_get_int(m); | 1936 | kex->flags = buffer_get_int(m); |
1918 | kex->client_version_string = buffer_get_string(m, NULL); | 1937 | kex->client_version_string = buffer_get_string(m, NULL); |
@@ -1920,6 +1939,7 @@ mm_get_kex(Buffer *m) | |||
1920 | kex->load_host_public_key=&get_hostkey_public_by_type; | 1939 | kex->load_host_public_key=&get_hostkey_public_by_type; |
1921 | kex->load_host_private_key=&get_hostkey_private_by_type; | 1940 | kex->load_host_private_key=&get_hostkey_private_by_type; |
1922 | kex->host_key_index=&get_hostkey_index; | 1941 | kex->host_key_index=&get_hostkey_index; |
1942 | kex->sign = sshd_hostkey_sign; | ||
1923 | 1943 | ||
1924 | return (kex); | 1944 | return (kex); |
1925 | } | 1945 | } |
@@ -1955,12 +1975,12 @@ mm_get_keystate(struct monitor *pmonitor) | |||
1955 | 1975 | ||
1956 | blob = buffer_get_string(&m, &bloblen); | 1976 | blob = buffer_get_string(&m, &bloblen); |
1957 | current_keys[MODE_OUT] = mm_newkeys_from_blob(blob, bloblen); | 1977 | current_keys[MODE_OUT] = mm_newkeys_from_blob(blob, bloblen); |
1958 | xfree(blob); | 1978 | free(blob); |
1959 | 1979 | ||
1960 | debug3("%s: Waiting for second key", __func__); | 1980 | debug3("%s: Waiting for second key", __func__); |
1961 | blob = buffer_get_string(&m, &bloblen); | 1981 | blob = buffer_get_string(&m, &bloblen); |
1962 | current_keys[MODE_IN] = mm_newkeys_from_blob(blob, bloblen); | 1982 | current_keys[MODE_IN] = mm_newkeys_from_blob(blob, bloblen); |
1963 | xfree(blob); | 1983 | free(blob); |
1964 | 1984 | ||
1965 | /* Now get sequence numbers for the packets */ | 1985 | /* Now get sequence numbers for the packets */ |
1966 | seqnr = buffer_get_int(&m); | 1986 | seqnr = buffer_get_int(&m); |
@@ -1985,13 +2005,13 @@ mm_get_keystate(struct monitor *pmonitor) | |||
1985 | if (plen != sizeof(child_state.outgoing)) | 2005 | if (plen != sizeof(child_state.outgoing)) |
1986 | fatal("%s: bad request size", __func__); | 2006 | fatal("%s: bad request size", __func__); |
1987 | memcpy(&child_state.outgoing, p, sizeof(child_state.outgoing)); | 2007 | memcpy(&child_state.outgoing, p, sizeof(child_state.outgoing)); |
1988 | xfree(p); | 2008 | free(p); |
1989 | 2009 | ||
1990 | p = buffer_get_string(&m, &plen); | 2010 | p = buffer_get_string(&m, &plen); |
1991 | if (plen != sizeof(child_state.incoming)) | 2011 | if (plen != sizeof(child_state.incoming)) |
1992 | fatal("%s: bad request size", __func__); | 2012 | fatal("%s: bad request size", __func__); |
1993 | memcpy(&child_state.incoming, p, sizeof(child_state.incoming)); | 2013 | memcpy(&child_state.incoming, p, sizeof(child_state.incoming)); |
1994 | xfree(p); | 2014 | free(p); |
1995 | 2015 | ||
1996 | /* Network I/O buffers */ | 2016 | /* Network I/O buffers */ |
1997 | debug3("%s: Getting Network I/O buffers", __func__); | 2017 | debug3("%s: Getting Network I/O buffers", __func__); |
@@ -2116,7 +2136,7 @@ mm_answer_gss_setup_ctx(int sock, Buffer *m) | |||
2116 | 2136 | ||
2117 | major = ssh_gssapi_server_ctx(&gsscontext, &goid); | 2137 | major = ssh_gssapi_server_ctx(&gsscontext, &goid); |
2118 | 2138 | ||
2119 | xfree(goid.elements); | 2139 | free(goid.elements); |
2120 | 2140 | ||
2121 | buffer_clear(m); | 2141 | buffer_clear(m); |
2122 | buffer_put_int(m, major); | 2142 | buffer_put_int(m, major); |
@@ -2144,7 +2164,7 @@ mm_answer_gss_accept_ctx(int sock, Buffer *m) | |||
2144 | in.value = buffer_get_string(m, &len); | 2164 | in.value = buffer_get_string(m, &len); |
2145 | in.length = len; | 2165 | in.length = len; |
2146 | major = ssh_gssapi_accept_ctx(gsscontext, &in, &out, &flags); | 2166 | major = ssh_gssapi_accept_ctx(gsscontext, &in, &out, &flags); |
2147 | xfree(in.value); | 2167 | free(in.value); |
2148 | 2168 | ||
2149 | buffer_clear(m); | 2169 | buffer_clear(m); |
2150 | buffer_put_int(m, major); | 2170 | buffer_put_int(m, major); |
@@ -2180,8 +2200,8 @@ mm_answer_gss_checkmic(int sock, Buffer *m) | |||
2180 | 2200 | ||
2181 | ret = ssh_gssapi_checkmic(gsscontext, &gssbuf, &mic); | 2201 | ret = ssh_gssapi_checkmic(gsscontext, &gssbuf, &mic); |
2182 | 2202 | ||
2183 | xfree(gssbuf.value); | 2203 | free(gssbuf.value); |
2184 | xfree(mic.value); | 2204 | free(mic.value); |
2185 | 2205 | ||
2186 | buffer_clear(m); | 2206 | buffer_clear(m); |
2187 | buffer_put_int(m, ret); | 2207 | buffer_put_int(m, ret); |
@@ -2242,7 +2262,7 @@ mm_answer_gss_sign(int socket, Buffer *m) | |||
2242 | } | 2262 | } |
2243 | major = ssh_gssapi_sign(gsscontext, &data, &hash); | 2263 | major = ssh_gssapi_sign(gsscontext, &data, &hash); |
2244 | 2264 | ||
2245 | xfree(data.value); | 2265 | free(data.value); |
2246 | 2266 | ||
2247 | buffer_clear(m); | 2267 | buffer_clear(m); |
2248 | buffer_put_int(m, major); | 2268 | buffer_put_int(m, major); |
@@ -2272,9 +2292,9 @@ mm_answer_gss_updatecreds(int socket, Buffer *m) { | |||
2272 | 2292 | ||
2273 | ok = ssh_gssapi_update_creds(&store); | 2293 | ok = ssh_gssapi_update_creds(&store); |
2274 | 2294 | ||
2275 | xfree(store.filename); | 2295 | free(store.filename); |
2276 | xfree(store.envvar); | 2296 | free(store.envvar); |
2277 | xfree(store.envval); | 2297 | free(store.envval); |
2278 | 2298 | ||
2279 | buffer_clear(m); | 2299 | buffer_clear(m); |
2280 | buffer_put_int(m, ok); | 2300 | buffer_put_int(m, ok); |
@@ -2323,8 +2343,8 @@ mm_answer_jpake_step1(int sock, Buffer *m) | |||
2323 | 2343 | ||
2324 | bzero(x3_proof, x3_proof_len); | 2344 | bzero(x3_proof, x3_proof_len); |
2325 | bzero(x4_proof, x4_proof_len); | 2345 | bzero(x4_proof, x4_proof_len); |
2326 | xfree(x3_proof); | 2346 | free(x3_proof); |
2327 | xfree(x4_proof); | 2347 | free(x4_proof); |
2328 | 2348 | ||
2329 | monitor_permit(mon_dispatch, MONITOR_REQ_JPAKE_GET_PWDATA, 1); | 2349 | monitor_permit(mon_dispatch, MONITOR_REQ_JPAKE_GET_PWDATA, 1); |
2330 | monitor_permit(mon_dispatch, MONITOR_REQ_JPAKE_STEP1, 0); | 2350 | monitor_permit(mon_dispatch, MONITOR_REQ_JPAKE_STEP1, 0); |
@@ -2353,8 +2373,8 @@ mm_answer_jpake_get_pwdata(int sock, Buffer *m) | |||
2353 | 2373 | ||
2354 | bzero(hash_scheme, strlen(hash_scheme)); | 2374 | bzero(hash_scheme, strlen(hash_scheme)); |
2355 | bzero(salt, strlen(salt)); | 2375 | bzero(salt, strlen(salt)); |
2356 | xfree(hash_scheme); | 2376 | free(hash_scheme); |
2357 | xfree(salt); | 2377 | free(salt); |
2358 | 2378 | ||
2359 | monitor_permit(mon_dispatch, MONITOR_REQ_JPAKE_STEP2, 1); | 2379 | monitor_permit(mon_dispatch, MONITOR_REQ_JPAKE_STEP2, 1); |
2360 | 2380 | ||
@@ -2393,8 +2413,8 @@ mm_answer_jpake_step2(int sock, Buffer *m) | |||
2393 | 2413 | ||
2394 | bzero(x1_proof, x1_proof_len); | 2414 | bzero(x1_proof, x1_proof_len); |
2395 | bzero(x2_proof, x2_proof_len); | 2415 | bzero(x2_proof, x2_proof_len); |
2396 | xfree(x1_proof); | 2416 | free(x1_proof); |
2397 | xfree(x2_proof); | 2417 | free(x2_proof); |
2398 | 2418 | ||
2399 | buffer_clear(m); | 2419 | buffer_clear(m); |
2400 | 2420 | ||
@@ -2405,7 +2425,7 @@ mm_answer_jpake_step2(int sock, Buffer *m) | |||
2405 | mm_request_send(sock, MONITOR_ANS_JPAKE_STEP2, m); | 2425 | mm_request_send(sock, MONITOR_ANS_JPAKE_STEP2, m); |
2406 | 2426 | ||
2407 | bzero(x4_s_proof, x4_s_proof_len); | 2427 | bzero(x4_s_proof, x4_s_proof_len); |
2408 | xfree(x4_s_proof); | 2428 | free(x4_s_proof); |
2409 | 2429 | ||
2410 | monitor_permit(mon_dispatch, MONITOR_REQ_JPAKE_KEY_CONFIRM, 1); | 2430 | monitor_permit(mon_dispatch, MONITOR_REQ_JPAKE_KEY_CONFIRM, 1); |
2411 | 2431 | ||
@@ -2473,7 +2493,7 @@ mm_answer_jpake_check_confirm(int sock, Buffer *m) | |||
2473 | JPAKE_DEBUG_CTX((pctx, "check_confirm done in %s", __func__)); | 2493 | JPAKE_DEBUG_CTX((pctx, "check_confirm done in %s", __func__)); |
2474 | 2494 | ||
2475 | bzero(peer_confirm_hash, peer_confirm_hash_len); | 2495 | bzero(peer_confirm_hash, peer_confirm_hash_len); |
2476 | xfree(peer_confirm_hash); | 2496 | free(peer_confirm_hash); |
2477 | 2497 | ||
2478 | buffer_clear(m); | 2498 | buffer_clear(m); |
2479 | buffer_put_int(m, authenticated); | 2499 | buffer_put_int(m, authenticated); |
@@ -2508,10 +2528,9 @@ mm_answer_consolekit_register(int sock, Buffer *m) | |||
2508 | buffer_put_cstring(m, cookie != NULL ? cookie : ""); | 2528 | buffer_put_cstring(m, cookie != NULL ? cookie : ""); |
2509 | mm_request_send(sock, MONITOR_ANS_CONSOLEKIT_REGISTER, m); | 2529 | mm_request_send(sock, MONITOR_ANS_CONSOLEKIT_REGISTER, m); |
2510 | 2530 | ||
2511 | if (cookie != NULL) | 2531 | free(cookie); |
2512 | xfree(cookie); | 2532 | free(display); |
2513 | xfree(display); | 2533 | free(tty); |
2514 | xfree(tty); | ||
2515 | 2534 | ||
2516 | return (0); | 2535 | return (0); |
2517 | } | 2536 | } |