Import openssh_6.7p1.orig.tar.gz

1 files changed, 53 insertions, 37 deletions

diff --git a/sshd.c b/sshd.c
index 7523de977..481d00155 100644
--- a/sshd.c
+++ b/sshd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshd.c,v 1.420 2014/02/26 21:53:37 markus Exp $ */
+/* $OpenBSD: sshd.c,v 1.428 2014/07/15 15:54:14 millert Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -72,10 +72,12 @@
 #include <string.h>
 #include <unistd.h>
 
+#ifdef WITH_OPENSSL
 #include <openssl/dh.h>
 #include <openssl/bn.h>
 #include <openssl/rand.h>
 #include "openbsd-compat/openssl-compat.h"
+#endif
 
 #ifdef HAVE_SECUREWARE
 #include <sys/security.h>
@@ -91,6 +93,7 @@
 #include "packet.h"
 #include "log.h"
 #include "buffer.h"
+#include "misc.h"
 #include "servconf.h"
 #include "uidswap.h"
 #include "compat.h"
@@ -98,7 +101,6 @@
 #include "digest.h"
 #include "key.h"
 #include "kex.h"
-#include "dh.h"
 #include "myproposal.h"
 #include "authfile.h"
 #include "pathnames.h"
@@ -107,7 +109,6 @@
 #include "hostfile.h"
 #include "auth.h"
 #include "authfd.h"
-#include "misc.h"
 #include "msg.h"
 #include "dispatch.h"
 #include "channels.h"
@@ -122,13 +123,6 @@
 #include "ssh-sandbox.h"
 #include "version.h"
 
-#ifdef LIBWRAP
-#include <tcpd.h>
-#include <syslog.h>
-int allow_severity;
-int deny_severity;
-#endif /* LIBWRAP */
-
 #ifndef O_NOCTTY
 #define O_NOCTTY        0
 #endif
@@ -263,7 +257,9 @@ struct passwd *privsep_pw = NULL;
 void destroy_sensitive_data(void);
 void demote_sensitive_data(void);
 
+#ifdef WITH_SSH1
 static void do_ssh1_kex(void);
+#endif
 static void do_ssh2_kex(void);
 
 /*
@@ -938,7 +934,13 @@ static void
 usage(void)
 {
         fprintf(stderr, "%s, %s\n",
-            SSH_RELEASE, SSLeay_version(SSLEAY_VERSION));
+            SSH_RELEASE,
+#ifdef WITH_OPENSSL
+            SSLeay_version(SSLEAY_VERSION)
+#else
+            "without OpenSSL"
+#endif
+        );
         fprintf(stderr,
 "usage: sshd [-46DdeiqTt] [-b bits] [-C connection_spec] [-c host_cert_file]\n"
 "            [-E log_file] [-f config_file] [-g login_grace_time]\n"
@@ -971,6 +973,7 @@ send_rexec_state(int fd, Buffer *conf)
         buffer_init(&m);
         buffer_put_cstring(&m, buffer_ptr(conf));
 
+#ifdef WITH_SSH1
         if (sensitive_data.server_key != NULL &&
             sensitive_data.server_key->type == KEY_RSA1) {
                 buffer_put_int(&m, 1);
@@ -981,6 +984,7 @@ send_rexec_state(int fd, Buffer *conf)
                 buffer_put_bignum(&m, sensitive_data.server_key->rsa->p);
                 buffer_put_bignum(&m, sensitive_data.server_key->rsa->q);
         } else
+#endif
                 buffer_put_int(&m, 0);
 
 #ifndef OPENSSL_PRNG_ONLY
@@ -1017,6 +1021,7 @@ recv_rexec_state(int fd, Buffer *conf)
         free(cp);
 
         if (buffer_get_int(&m)) {
+#ifdef WITH_SSH1
                 if (sensitive_data.server_key != NULL)
                         key_free(sensitive_data.server_key);
                 sensitive_data.server_key = key_new_private(KEY_RSA1);
@@ -1026,8 +1031,13 @@ recv_rexec_state(int fd, Buffer *conf)
                 buffer_get_bignum(&m, sensitive_data.server_key->rsa->iqmp);
                 buffer_get_bignum(&m, sensitive_data.server_key->rsa->p);
                 buffer_get_bignum(&m, sensitive_data.server_key->rsa->q);
-                rsa_generate_additional_parameters(
-                    sensitive_data.server_key->rsa);
+                if (rsa_generate_additional_parameters(
+                    sensitive_data.server_key->rsa) != 0)
+                        fatal("%s: rsa_generate_additional_parameters "
+                            "error", __func__);
+#else
+                fatal("ssh1 not supported");
+#endif
         }
 
 #ifndef OPENSSL_PRNG_ONLY
@@ -1550,7 +1560,9 @@ main(int ac, char **av)
         else
                 closefrom(REEXEC_DEVCRYPTO_RESERVED_FD);
 
+#ifdef WITH_OPENSSL
         OpenSSL_add_all_algorithms();
+#endif
 
         /* If requested, redirect the logs to the specified logfile. */
         if (logfile != NULL) {
@@ -1655,7 +1667,12 @@ main(int ac, char **av)
         }
 
         debug("sshd version %s, %s", SSH_VERSION,
-            SSLeay_version(SSLEAY_VERSION));
+#ifdef WITH_OPENSSL
+            SSLeay_version(SSLEAY_VERSION)
+#else
+            "without OpenSSL"
+#endif
+        );
 
         /* Store privilege separation user for later use if required. */
         if ((privsep_pw = getpwnam(SSH_PRIVSEP_USER)) == NULL) {
@@ -1777,6 +1794,8 @@ main(int ac, char **av)
                 debug("host certificate: #%d type %d %s", j, key->type,
                     key_type(key));
         }
+
+#ifdef WITH_SSH1
         /* Check certain values for sanity. */
         if (options.protocol & SSH_PROTO_1) {
                 if (options.server_key_bits < 512 ||
@@ -1801,6 +1820,7 @@ main(int ac, char **av)
                             options.server_key_bits);
                 }
         }
+#endif
 
         if (use_privsep) {
                 struct stat st;
@@ -2034,24 +2054,6 @@ main(int ac, char **av)
 #ifdef SSH_AUDIT_EVENTS
         audit_connection_from(remote_ip, remote_port);
 #endif
-#ifdef LIBWRAP
-        allow_severity = options.log_facility|LOG_INFO;
-        deny_severity = options.log_facility|LOG_WARNING;
-        /* Check whether logins are denied from this host. */
-        if (packet_connection_is_on_socket()) {
-                struct request_info req;
-
-                request_init(&req, RQ_DAEMON, __progname, RQ_FILE, sock_in, 0);
-                fromhost(&req);
-
-                if (!hosts_access(&req)) {
-                        debug("Connection refused by tcp wrapper");
-                        refuse(&req);
-                        /* NOTREACHED */
-                        fatal("libwrap refuse returns");
-                }
-        }
-#endif /* LIBWRAP */
 
         /* Log the connection. */
         verbose("Connection from %s port %d on %s port %d",
@@ -2102,8 +2104,12 @@ main(int ac, char **av)
                 do_ssh2_kex();
                 do_authentication2(authctxt);
         } else {
+#ifdef WITH_SSH1
                 do_ssh1_kex();
                 do_authentication(authctxt);
+#else
+                fatal("ssh1 not supported");
+#endif
         }
         /*
          * If we use privilege separation, the unprivileged child transfers
@@ -2187,6 +2193,7 @@ main(int ac, char **av)
         exit(0);
 }
 
+#ifdef WITH_SSH1
 /*
  * Decrypt session_key_int using our private server key and private host key
  * (key with larger modulus first).
@@ -2210,10 +2217,10 @@ ssh1_session_key(BIGNUM *session_key_int)
                             SSH_KEY_BITS_RESERVED);
                 }
                 if (rsa_private_decrypt(session_key_int, session_key_int,
-                    sensitive_data.server_key->rsa) <= 0)
+                    sensitive_data.server_key->rsa) != 0)
                         rsafail++;
                 if (rsa_private_decrypt(session_key_int, session_key_int,
-                    sensitive_data.ssh1_host_key->rsa) <= 0)
+                    sensitive_data.ssh1_host_key->rsa) != 0)
                         rsafail++;
         } else {
                 /* Host key has bigger modulus (or they are equal). */
@@ -2228,14 +2235,15 @@ ssh1_session_key(BIGNUM *session_key_int)
                             SSH_KEY_BITS_RESERVED);
                 }
                 if (rsa_private_decrypt(session_key_int, session_key_int,
-                    sensitive_data.ssh1_host_key->rsa) < 0)
+                    sensitive_data.ssh1_host_key->rsa) != 0)
                         rsafail++;
                 if (rsa_private_decrypt(session_key_int, session_key_int,
-                    sensitive_data.server_key->rsa) < 0)
+                    sensitive_data.server_key->rsa) != 0)
                         rsafail++;
         }
         return (rsafail);
 }
+
 /*
  * SSH1 key exchange
  */
@@ -2413,6 +2421,7 @@ do_ssh1_kex(void)
         packet_send();
         packet_write_wait();
 }
+#endif
 
 void
 sshd_hostkey_sign(Key *privkey, Key *pubkey, u_char **signature, u_int *slen,
@@ -2437,6 +2446,7 @@ sshd_hostkey_sign(Key *privkey, Key *pubkey, u_char **signature, u_int *slen,
 static void
 do_ssh2_kex(void)
 {
+        char *myproposal[PROPOSAL_MAX] = { KEX_SERVER };
         Kex *kex;
 
         if (options.ciphers != NULL) {
@@ -2462,6 +2472,9 @@ do_ssh2_kex(void)
         if (options.kex_algorithms != NULL)
                 myproposal[PROPOSAL_KEX_ALGS] = options.kex_algorithms;
 
+        myproposal[PROPOSAL_KEX_ALGS] = compat_kex_proposal(
+            myproposal[PROPOSAL_KEX_ALGS]);
+
         if (options.rekey_limit || options.rekey_interval)
                 packet_set_rekey_limits((u_int32_t)options.rekey_limit,
                     (time_t)options.rekey_interval);
@@ -2471,11 +2484,13 @@ do_ssh2_kex(void)
 
         /* start key exchange */
         kex = kex_setup(myproposal);
+#ifdef WITH_OPENSSL
         kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server;
         kex->kex[KEX_DH_GRP14_SHA1] = kexdh_server;
         kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
         kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
         kex->kex[KEX_ECDH_SHA2] = kexecdh_server;
+#endif
         kex->kex[KEX_C25519_SHA256] = kexc25519_server;
         kex->server = 1;
         kex->client_version_string=client_version_string;
@@ -2508,7 +2523,8 @@ cleanup_exit(int i)
 {
         if (the_authctxt) {
                 do_cleanup(the_authctxt);
-                if (use_privsep && privsep_is_preauth && pmonitor->m_pid > 1) {
+                if (use_privsep && privsep_is_preauth &&
+                    pmonitor != NULL && pmonitor->m_pid > 1) {
                         debug("Killing privsep child %d", pmonitor->m_pid);
                         if (kill(pmonitor->m_pid, SIGKILL) != 0 &&
                             errno != ESRCH)