diff options
181 files changed, 10929 insertions, 3348 deletions
| @@ -1,3 +1,1529 @@ | |||
| 1 | 20080721 | ||
| 2 | - (djm) OpenBSD CVS Sync | ||
| 3 | - jmc@cvs.openbsd.org 2008/07/18 22:51:01 | ||
| 4 | [sftp-server.8] | ||
| 5 | no need for .Pp before or after .Sh; | ||
| 6 | - djm@cvs.openbsd.org 2008/07/21 08:19:07 | ||
| 7 | [version.h] | ||
| 8 | openssh-5.1 | ||
| 9 | - (djm) [README contrib/caldera/openssh.spec contrib/redhat/openssh.spec] | ||
| 10 | [contrib/suse/openssh.spec] Update version number in README and RPM specs | ||
| 11 | - (djm) Release OpenSSH-5.1 | ||
| 12 | |||
| 13 | 20080717 | ||
| 14 | - (djm) OpenBSD CVS Sync | ||
| 15 | - djm@cvs.openbsd.org 2008/07/17 08:48:00 | ||
| 16 | [sshconnect2.c] | ||
| 17 | strnvis preauth banner; pointed out by mpf@ ok markus@ | ||
| 18 | - djm@cvs.openbsd.org 2008/07/17 08:51:07 | ||
| 19 | [auth2-hostbased.c] | ||
| 20 | strip trailing '.' from hostname when HostbasedUsesNameFromPacketOnly=yes | ||
| 21 | report and patch from res AT qoxp.net (bz#1200); ok markus@ | ||
| 22 | - (dtucker) [openbsd-compat/bsd-cygwin_util.c] Remove long-unneeded compat | ||
| 23 | code, replace with equivalent cygwin library call. Patch from vinschen | ||
| 24 | at redhat.com, ok djm@. | ||
| 25 | - (djm) [sshconnect2.c] vis.h isn't available everywhere | ||
| 26 | |||
| 27 | 20080716 | ||
| 28 | - OpenBSD CVS Sync | ||
| 29 | - djm@cvs.openbsd.org 2008/07/15 02:23:14 | ||
| 30 | [sftp.1] | ||
| 31 | number of pipelined requests is now 64; | ||
| 32 | prodded by Iain.Morgan AT nasa.gov | ||
| 33 | - djm@cvs.openbsd.org 2008/07/16 11:51:14 | ||
| 34 | [clientloop.c] | ||
| 35 | rename variable first_gc -> last_gc (since it is actually the last | ||
| 36 | in the list). | ||
| 37 | - djm@cvs.openbsd.org 2008/07/16 11:52:19 | ||
| 38 | [channels.c] | ||
| 39 | this loop index should be automatic, not static | ||
| 40 | |||
| 41 | 20080714 | ||
| 42 | - (djm) OpenBSD CVS Sync | ||
| 43 | - sthen@cvs.openbsd.org 2008/07/13 21:22:52 | ||
| 44 | [ssh-keygen.c] | ||
| 45 | Change "ssh-keygen -F [host] -l" to not display random art unless | ||
| 46 | -v is also specified, making it consistent with the manual and other | ||
| 47 | uses of -l. | ||
| 48 | ok grunk@ | ||
| 49 | - djm@cvs.openbsd.org 2008/07/13 22:13:07 | ||
| 50 | [channels.c] | ||
| 51 | use struct sockaddr_storage instead of struct sockaddr for accept(2) | ||
| 52 | address argument. from visibilis AT yahoo.com in bz#1485; ok markus@ | ||
| 53 | - djm@cvs.openbsd.org 2008/07/13 22:16:03 | ||
| 54 | [sftp.c] | ||
| 55 | increase number of piplelined requests so they properly fill the | ||
| 56 | (recently increased) channel window. prompted by rapier AT psc.edu; | ||
| 57 | ok markus@ | ||
| 58 | - djm@cvs.openbsd.org 2008/07/14 01:55:56 | ||
| 59 | [sftp-server.8] | ||
| 60 | mention requirement for /dev/log inside chroot when using sftp-server | ||
| 61 | with ChrootDirectory | ||
| 62 | - (djm) [openbsd-compat/bindresvport.c] Rename variables s/sin/in/ to | ||
| 63 | avoid clash with sin(3) function; reported by | ||
| 64 | cristian.ionescu-idbohrn AT axis.com | ||
| 65 | - (djm) [openbsd-compat/rresvport.c] Add unistd.h for missing close() | ||
| 66 | prototype; reported by cristian.ionescu-idbohrn AT axis.com | ||
| 67 | - (djm) [umac.c] Rename variable s/buffer_ptr/bufp/ to avoid clash; | ||
| 68 | reported by cristian.ionescu-idbohrn AT axis.com | ||
| 69 | - (djm) [contrib/cygwin/Makefile contrib/cygwin/ssh-host-config] | ||
| 70 | [contrib/cygwin/ssh-user-config contrib/cygwin/sshd-inetd] | ||
| 71 | Revamped and simplified Cygwin ssh-host-config script that uses | ||
| 72 | unified csih configuration tool. Requires recent Cygwin. | ||
| 73 | Patch from vinschen AT redhat.com | ||
| 74 | |||
| 75 | 20080712 | ||
| 76 | - (djm) OpenBSD CVS Sync | ||
| 77 | - djm@cvs.openbsd.org 2008/07/12 04:52:50 | ||
| 78 | [channels.c] | ||
| 79 | unbreak; move clearing of cctx struct to before first use | ||
| 80 | reported by dkrause@ | ||
| 81 | - djm@cvs.openbsd.org 2008/07/12 05:33:41 | ||
| 82 | [scp.1] | ||
| 83 | better description for -i flag: | ||
| 84 | s/RSA authentication/public key authentication/ | ||
| 85 | - (djm) [openbsd-compat/fake-rfc2553.c openbsd-compat/fake-rfc2553.h] | ||
| 86 | return EAI_FAMILY when trying to lookup unsupported address family; | ||
| 87 | from vinschen AT redhat.com | ||
| 88 | |||
| 89 | 20080711 | ||
| 90 | - (djm) OpenBSD CVS Sync | ||
| 91 | - stevesk@cvs.openbsd.org 2008/07/07 00:31:41 | ||
| 92 | [ttymodes.c] | ||
| 93 | we don't need arg after the debug3() was removed. from lint. | ||
| 94 | ok djm@ | ||
| 95 | - stevesk@cvs.openbsd.org 2008/07/07 23:32:51 | ||
| 96 | [key.c] | ||
| 97 | /*NOTREACHED*/ for lint warning: | ||
| 98 | warning: function key_equal falls off bottom without returning value | ||
| 99 | ok djm@ | ||
| 100 | - markus@cvs.openbsd.org 2008/07/10 18:05:58 | ||
| 101 | [channels.c] | ||
| 102 | missing bzero; from mickey; ok djm@ | ||
| 103 | - markus@cvs.openbsd.org 2008/07/10 18:08:11 | ||
| 104 | [clientloop.c monitor.c monitor_wrap.c packet.c packet.h sshd.c] | ||
| 105 | sync v1 and v2 traffic accounting; add it to sshd, too; | ||
| 106 | ok djm@, dtucker@ | ||
| 107 | |||
| 108 | 20080709 | ||
| 109 | - (djm) [Makefile.in] Print "all tests passed" when all regress tests pass | ||
| 110 | - (djm) [auth1.c] Fix format string vulnerability in protocol 1 PAM | ||
| 111 | account check failure path. The vulnerable format buffer is supplied | ||
| 112 | from PAM and should not contain attacker-supplied data. | ||
| 113 | - (djm) [auth.c] Missing unistd.h for close() | ||
| 114 | - (djm) [configure.ac] Add -Wformat-security to CFLAGS for gcc 3.x and 4.x | ||
| 115 | |||
| 116 | 20080705 | ||
| 117 | - (djm) [auth.c] Fixed test for locked account on HP/UX with shadowed | ||
| 118 | passwords disabled. bz#1083 report & patch from senthilkumar_sen AT | ||
| 119 | hotpop.com, w/ dtucker@ | ||
| 120 | - (djm) [atomicio.c configure.ac] Disable poll() fallback in atomiciov for | ||
| 121 | Tru64. readv doesn't seem to be a comparable object there. | ||
| 122 | bz#1386, patch from dtucker@ ok me | ||
| 123 | - (djm) [Makefile.in] Pass though pass to conch for interop tests | ||
| 124 | - (djm) [configure.ac] unbreak: remove extra closing brace | ||
| 125 | - (djm) OpenBSD CVS Sync | ||
| 126 | - djm@cvs.openbsd.org 2008/07/04 23:08:25 | ||
| 127 | [packet.c] | ||
| 128 | handle EINTR in packet_write_poll()l ok dtucker@ | ||
| 129 | - djm@cvs.openbsd.org 2008/07/04 23:30:16 | ||
| 130 | [auth1.c auth2.c] | ||
| 131 | Make protocol 1 MaxAuthTries logic match protocol 2's. | ||
| 132 | Do not treat the first protocol 2 authentication attempt as | ||
| 133 | a failure IFF it is for method "none". | ||
| 134 | Makes MaxAuthTries' user-visible behaviour identical for | ||
| 135 | protocol 1 vs 2. | ||
| 136 | ok dtucker@ | ||
| 137 | - djm@cvs.openbsd.org 2008/07/05 05:16:01 | ||
| 138 | [PROTOCOL] | ||
| 139 | grammar | ||
| 140 | |||
| 141 | 20080704 | ||
| 142 | - (dtucker) OpenBSD CVS Sync | ||
| 143 | - djm@cvs.openbsd.org 2008/07/02 13:30:34 | ||
| 144 | [auth2.c] | ||
| 145 | really really remove the freebie "none" auth try for protocol 2 | ||
| 146 | - djm@cvs.openbsd.org 2008/07/02 13:47:39 | ||
| 147 | [ssh.1 ssh.c] | ||
| 148 | When forking after authentication ("ssh -f") with ExitOnForwardFailure | ||
| 149 | enabled, delay the fork until after replies for any -R forwards have | ||
| 150 | been seen. Allows for robust detection of -R forward failure when | ||
| 151 | using -f (similar to bz#92); ok dtucker@ | ||
| 152 | - otto@cvs.openbsd.org 2008/07/03 21:46:58 | ||
| 153 | [auth2-pubkey.c] | ||
| 154 | avoid nasty double free; ok dtucker@ djm@ | ||
| 155 | - djm@cvs.openbsd.org 2008/07/04 03:44:59 | ||
| 156 | [servconf.c groupaccess.h groupaccess.c] | ||
| 157 | support negation of groups in "Match group" block (bz#1315); ok dtucker@ | ||
| 158 | - dtucker@cvs.openbsd.org 2008/07/04 03:47:02 | ||
| 159 | [monitor.c] | ||
| 160 | Make debug a little clearer. ok djm@ | ||
| 161 | - djm@cvs.openbsd.org 2008/06/30 08:07:34 | ||
| 162 | [regress/key-options.sh] | ||
| 163 | shell portability: use "=" instead of "==" in test(1) expressions, | ||
| 164 | double-quote string with backslash escaped / | ||
| 165 | - djm@cvs.openbsd.org 2008/06/30 10:31:11 | ||
| 166 | [regress/{putty-transfer,putty-kex,putty-ciphers}.sh] | ||
| 167 | remove "set -e" left over from debugging | ||
| 168 | - djm@cvs.openbsd.org 2008/06/30 10:43:03 | ||
| 169 | [regress/conch-ciphers.sh] | ||
| 170 | explicitly disable conch options that could interfere with the test | ||
| 171 | - (dtucker) [sftp-server.c] Bug #1447: fall back to racy rename if link | ||
| 172 | returns EXDEV. Patch from Mike Garrison, ok djm@ | ||
| 173 | - (djm) [atomicio.c channels.c clientloop.c defines.h includes.h] | ||
| 174 | [packet.c scp.c serverloop.c sftp-client.c ssh-agent.c ssh-keyscan.c] | ||
| 175 | [sshd.c] Explicitly handle EWOULDBLOCK wherever we handle EAGAIN, on | ||
| 176 | some platforms (HP nonstop) it is a distinct errno; | ||
| 177 | bz#1467 reported by sconeu AT yahoo.com; ok dtucker@ | ||
| 178 | |||
| 179 | 20080702 | ||
| 180 | - (dtucker) OpenBSD CVS Sync | ||
| 181 | - djm@cvs.openbsd.org 2008/06/30 08:05:59 | ||
| 182 | [PROTOCOL.agent] | ||
| 183 | typo: s/constraint_date/constraint_data/ | ||
| 184 | - djm@cvs.openbsd.org 2008/06/30 12:15:39 | ||
| 185 | [serverloop.c] | ||
| 186 | only pass channel requests on session channels through to the session | ||
| 187 | channel handler, avoiding spurious log messages; ok! markus@ | ||
| 188 | - djm@cvs.openbsd.org 2008/06/30 12:16:02 | ||
| 189 | [nchan.c] | ||
| 190 | only send eow@openssh.com notifications for session channels; ok! markus@ | ||
| 191 | - djm@cvs.openbsd.org 2008/06/30 12:18:34 | ||
| 192 | [PROTOCOL] | ||
| 193 | clarify that eow@openssh.com is only sent on session channels | ||
| 194 | - dtucker@cvs.openbsd.org 2008/07/01 07:20:52 | ||
| 195 | [sshconnect.c] | ||
| 196 | Check ExitOnForwardFailure if forwardings are disabled due to a failed | ||
| 197 | host key check. ok djm@ | ||
| 198 | - dtucker@cvs.openbsd.org 2008/07/01 07:24:22 | ||
| 199 | [sshconnect.c sshd.c] | ||
| 200 | Send CR LF during protocol banner exchanges, but only for Protocol 2 only, | ||
| 201 | in order to comply with RFC 4253. bz #1443, ok djm@ | ||
| 202 | - stevesk@cvs.openbsd.org 2008/07/01 23:12:47 | ||
| 203 | [PROTOCOL.agent] | ||
| 204 | fix some typos; ok djm@ | ||
| 205 | - djm@cvs.openbsd.org 2008/07/02 02:24:18 | ||
| 206 | [sshd_config sshd_config.5 sshd.8 servconf.c] | ||
| 207 | increase default size of ssh protocol 1 ephemeral key from 768 to 1024 | ||
| 208 | bits; prodded by & ok dtucker@ ok deraadt@ | ||
| 209 | - dtucker@cvs.openbsd.org 2008/07/02 12:03:51 | ||
| 210 | [auth-rsa.c auth.c auth2-pubkey.c auth.h] | ||
| 211 | Merge duplicate host key file checks, based in part on a patch from Rob | ||
| 212 | Holland via bz #1348 . Also checks for non-regular files during protocol | ||
| 213 | 1 RSA auth. ok djm@ | ||
| 214 | - djm@cvs.openbsd.org 2008/07/02 12:36:39 | ||
| 215 | [auth2-none.c auth2.c] | ||
| 216 | Make protocol 2 MaxAuthTries behaviour a little more sensible: | ||
| 217 | Check whether client has exceeded MaxAuthTries before running | ||
| 218 | an authentication method and skip it if they have, previously it | ||
| 219 | would always allow one try (for "none" auth). | ||
| 220 | Preincrement failure count before post-auth test - previously this | ||
| 221 | checked and postincremented, also to allow one "none" try. | ||
| 222 | Together, these two changes always count the "none" auth method | ||
| 223 | which could be skipped by a malicious client (e.g. an SSH worm) | ||
| 224 | to get an extra attempt at a real auth method. They also make | ||
| 225 | MaxAuthTries=0 a useful way to block users entirely (esp. in a | ||
| 226 | sshd_config Match block). | ||
| 227 | Also, move sending of any preauth banner from "none" auth method | ||
| 228 | to the first call to input_userauth_request(), so worms that skip | ||
| 229 | the "none" method get to see it too. | ||
| 230 | |||
| 231 | 20080630 | ||
| 232 | - (djm) OpenBSD CVS Sync | ||
| 233 | - dtucker@cvs.openbsd.org 2008/06/10 23:13:43 | ||
| 234 | [regress/Makefile regress/key-options.sh] | ||
| 235 | Add regress test for key options. ok djm@ | ||
| 236 | - dtucker@cvs.openbsd.org 2008/06/11 23:11:40 | ||
| 237 | [regress/Makefile] | ||
| 238 | Don't run cipher-speed test by default; mistakenly enabled by me | ||
| 239 | - djm@cvs.openbsd.org 2008/06/28 13:57:25 | ||
| 240 | [regress/Makefile regress/test-exec.sh regress/conch-ciphers.sh] | ||
| 241 | very basic regress test against Twisted Conch in "make interop" | ||
| 242 | target (conch is available in ports/devel/py-twisted/conch); | ||
| 243 | ok markus@ | ||
| 244 | - (djm) [regress/Makefile] search for conch by path, like we do putty | ||
| 245 | |||
| 246 | 20080629 | ||
| 247 | - (djm) OpenBSD CVS Sync | ||
| 248 | - martynas@cvs.openbsd.org 2008/06/21 07:46:46 | ||
| 249 | [sftp.c] | ||
| 250 | use optopt to get invalid flag, instead of return value of getopt, | ||
| 251 | which is always '?'; ok djm@ | ||
| 252 | - otto@cvs.openbsd.org 2008/06/25 11:13:43 | ||
| 253 | [key.c] | ||
| 254 | add key length to visual fingerprint; zap magical constants; | ||
| 255 | ok grunk@ djm@ | ||
| 256 | - djm@cvs.openbsd.org 2008/06/26 06:10:09 | ||
| 257 | [sftp-client.c sftp-server.c] | ||
| 258 | allow the sftp chmod(2)-equivalent operation to set set[ug]id/sticky | ||
| 259 | bits. Note that this only affects explicit setting of modes (e.g. via | ||
| 260 | sftp(1)'s chmod command) and not file transfers. (bz#1310) | ||
| 261 | ok deraadt@ at c2k8 | ||
| 262 | - djm@cvs.openbsd.org 2008/06/26 09:19:40 | ||
| 263 | [dh.c dh.h moduli.c] | ||
| 264 | when loading moduli from /etc/moduli in sshd(8), check that they | ||
| 265 | are of the expected "safe prime" structure and have had | ||
| 266 | appropriate primality tests performed; | ||
| 267 | feedback and ok dtucker@ | ||
| 268 | - grunk@cvs.openbsd.org 2008/06/26 11:46:31 | ||
| 269 | [readconf.c readconf.h ssh.1 ssh_config.5 sshconnect.c] | ||
| 270 | Move SSH Fingerprint Visualization away from sharing the config option | ||
| 271 | CheckHostIP to an own config option named VisualHostKey. | ||
| 272 | While there, fix the behaviour that ssh would draw a random art picture | ||
| 273 | on every newly seen host even when the option was not enabled. | ||
| 274 | prodded by deraadt@, discussions, | ||
| 275 | help and ok markus@ djm@ dtucker@ | ||
| 276 | - jmc@cvs.openbsd.org 2008/06/26 21:11:46 | ||
| 277 | [ssh.1] | ||
| 278 | add VisualHostKey to the list of options listed in -o; | ||
| 279 | - djm@cvs.openbsd.org 2008/06/28 07:25:07 | ||
| 280 | [PROTOCOL] | ||
| 281 | spelling fixes | ||
| 282 | - djm@cvs.openbsd.org 2008/06/28 13:58:23 | ||
| 283 | [ssh-agent.c] | ||
| 284 | refuse to add a key that has unknown constraints specified; | ||
| 285 | ok markus | ||
| 286 | - djm@cvs.openbsd.org 2008/06/28 14:05:15 | ||
| 287 | [ssh-agent.c] | ||
| 288 | reset global compat flag after processing a protocol 2 signature | ||
| 289 | request with the legacy DSA encoding flag set; ok markus | ||
| 290 | - djm@cvs.openbsd.org 2008/06/28 14:08:30 | ||
| 291 | [PROTOCOL PROTOCOL.agent] | ||
| 292 | document the protocol used by ssh-agent; "looks ok" markus@ | ||
| 293 | |||
| 294 | 20080628 | ||
| 295 | - (djm) [RFC.nroff contrib/cygwin/Makefile contrib/suse/openssh.spec] | ||
| 296 | RFC.nroff lacks a license, remove it (it is long gone in OpenBSD). | ||
| 297 | |||
| 298 | 20080626 | ||
| 299 | - (djm) [Makefile.in moduli.5] Include moduli(5) manpage from OpenBSD. | ||
| 300 | (bz#1372) | ||
| 301 | - (djm) [ contrib/caldera/openssh.spec contrib/redhat/openssh.spec] | ||
| 302 | [contrib/suse/openssh.spec] Include moduli.5 in RPM spec files. | ||
| 303 | |||
| 304 | 20080616 | ||
| 305 | - (dtucker) OpenBSD CVS Sync | ||
| 306 | - dtucker@cvs.openbsd.org 2008/06/16 13:22:53 | ||
| 307 | [session.c channels.c] | ||
| 308 | Rename the isatty argument to is_tty so we don't shadow | ||
| 309 | isatty(3). ok markus@ | ||
| 310 | - (dtucker) [channels.c] isatty -> is_tty here too. | ||
| 311 | |||
| 312 | 20080615 | ||
| 313 | - (dtucker) [configure.ac] Enable -fno-builtin-memset when using gcc. | ||
| 314 | - OpenBSD CVS Sync | ||
| 315 | - dtucker@cvs.openbsd.org 2008/06/14 15:49:48 | ||
| 316 | [sshd.c] | ||
| 317 | wrap long line at 80 chars | ||
| 318 | - dtucker@cvs.openbsd.org 2008/06/14 17:07:11 | ||
| 319 | [sshd.c] | ||
| 320 | ensure default umask disallows at least group and world write; ok djm@ | ||
| 321 | - djm@cvs.openbsd.org 2008/06/14 18:33:43 | ||
| 322 | [session.c] | ||
| 323 | suppress the warning message from chdir(homedir) failures | ||
| 324 | when chrooted (bz#1461); ok dtucker | ||
| 325 | - dtucker@cvs.openbsd.org 2008/06/14 19:42:10 | ||
| 326 | [scp.1] | ||
| 327 | Mention that scp follows symlinks during -r. bz #1466, | ||
| 328 | from nectar at apple | ||
| 329 | - dtucker@cvs.openbsd.org 2008/06/15 16:55:38 | ||
| 330 | [sshd_config.5] | ||
| 331 | MaxSessions is allowed in a Match block too | ||
| 332 | - dtucker@cvs.openbsd.org 2008/06/15 16:58:40 | ||
| 333 | [servconf.c sshd_config.5] | ||
| 334 | Allow MaxAuthTries within a Match block. ok djm@ | ||
| 335 | - djm@cvs.openbsd.org 2008/06/15 20:06:26 | ||
| 336 | [channels.c channels.h session.c] | ||
| 337 | don't call isatty() on a pty master, instead pass a flag down to | ||
| 338 | channel_set_fds() indicating that te fds refer to a tty. Fixes a | ||
| 339 | hang on exit on Solaris (bz#1463) in portable but is actually | ||
| 340 | a generic bug; ok dtucker deraadt markus | ||
| 341 | |||
| 342 | 20080614 | ||
| 343 | - (djm) [openbsd-compat/sigact.c] Avoid NULL derefs in ancient sigaction | ||
| 344 | replacement code; patch from ighighi AT gmail.com in bz#1240; | ||
| 345 | ok dtucker | ||
| 346 | |||
| 347 | 20080613 | ||
| 348 | - (dtucker) OpenBSD CVS Sync | ||
| 349 | - deraadt@cvs.openbsd.org 2008/06/13 09:44:36 | ||
| 350 | [packet.c] | ||
| 351 | compile on older gcc; no decl after code | ||
| 352 | - dtucker@cvs.openbsd.org 2008/06/13 13:56:59 | ||
| 353 | [monitor.c] | ||
| 354 | Clear key options in the monitor on failed authentication, prevents | ||
| 355 | applying additional restrictions to non-pubkey authentications in | ||
| 356 | the case where pubkey fails but another method subsequently succeeds. | ||
| 357 | bz #1472, found by Colin Watson, ok markus@ djm@ | ||
| 358 | - dtucker@cvs.openbsd.org 2008/06/13 14:18:51 | ||
| 359 | [auth2-pubkey.c auth-rhosts.c] | ||
| 360 | Include unistd.h for close(), prevents warnings in -portable | ||
| 361 | - dtucker@cvs.openbsd.org 2008/06/13 17:21:20 | ||
| 362 | [mux.c] | ||
| 363 | Friendlier error messages for mux fallback. ok djm@ | ||
| 364 | - dtucker@cvs.openbsd.org 2008/06/13 18:55:22 | ||
| 365 | [scp.c] | ||
| 366 | Prevent -Wsign-compare warnings on LP64 systems. bz #1192, ok deraadt@ | ||
| 367 | - grunk@cvs.openbsd.org 2008/06/13 20:13:26 | ||
| 368 | [ssh.1] | ||
| 369 | Explain the use of SSH fpr visualization using random art, and cite the | ||
| 370 | original scientific paper inspiring that technique. | ||
| 371 | Much help with English and nroff by jmc@, thanks. | ||
| 372 | - (dtucker) [configure.ac] Bug #1276: avoid linking against libgssapi, which | ||
| 373 | despite its name doesn't seem to implement all of GSSAPI. Patch from | ||
| 374 | Jan Engelhardt, sanity checked by Simon Wilkinson. | ||
| 375 | |||
| 376 | 20080612 | ||
| 377 | - (dtucker) OpenBSD CVS Sync | ||
| 378 | - jmc@cvs.openbsd.org 2008/06/11 07:30:37 | ||
| 379 | [sshd.8] | ||
| 380 | kill trailing whitespace; | ||
| 381 | - grunk@cvs.openbsd.org 2008/06/11 21:01:35 | ||
| 382 | [ssh_config.5 key.h readconf.c readconf.h ssh-keygen.1 ssh-keygen.c key.c | ||
| 383 | sshconnect.c] | ||
| 384 | Introduce SSH Fingerprint ASCII Visualization, a technique inspired by the | ||
| 385 | graphical hash visualization schemes known as "random art", and by | ||
| 386 | Dan Kaminsky's musings on the subject during a BlackOp talk at the | ||
| 387 | 23C3 in Berlin. | ||
| 388 | Scientific publication (original paper): | ||
| 389 | "Hash Visualization: a New Technique to improve Real-World Security", | ||
| 390 | Perrig A. and Song D., 1999, International Workshop on Cryptographic | ||
| 391 | Techniques and E-Commerce (CrypTEC '99) | ||
| 392 | http://sparrow.ece.cmu.edu/~adrian/projects/validation/validation.pdf | ||
| 393 | The algorithm used here is a worm crawling over a discrete plane, | ||
| 394 | leaving a trace (augmenting the field) everywhere it goes. | ||
| 395 | Movement is taken from dgst_raw 2bit-wise. Bumping into walls | ||
| 396 | makes the respective movement vector be ignored for this turn, | ||
| 397 | thus switching to the other color of the chessboard. | ||
| 398 | Graphs are not unambiguous for now, because circles in graphs can be | ||
| 399 | walked in either direction. | ||
| 400 | discussions with several people, | ||
| 401 | help, corrections and ok markus@ djm@ | ||
| 402 | - grunk@cvs.openbsd.org 2008/06/11 21:38:25 | ||
| 403 | [ssh-keygen.c] | ||
| 404 | ssh-keygen -lv -f /etc/ssh/ssh_host_rsa_key.pub | ||
| 405 | would not display you the random art as intended, spotted by canacar@ | ||
| 406 | - grunk@cvs.openbsd.org 2008/06/11 22:20:46 | ||
| 407 | [ssh-keygen.c ssh-keygen.1] | ||
| 408 | ssh-keygen would write fingerprints to STDOUT, and random art to STDERR, | ||
| 409 | that is not how it was envisioned. | ||
| 410 | Also correct manpage saying that -v is needed along with -l for it to work. | ||
| 411 | spotted by naddy@ | ||
| 412 | - otto@cvs.openbsd.org 2008/06/11 23:02:22 | ||
| 413 | [key.c] | ||
| 414 | simpler way of computing the augmentations; ok grunk@ | ||
| 415 | - grunk@cvs.openbsd.org 2008/06/11 23:03:56 | ||
| 416 | [ssh_config.5] | ||
| 417 | CheckHostIP set to ``fingerprint'' will display both hex and random art | ||
| 418 | spotted by naddy@ | ||
| 419 | - grunk@cvs.openbsd.org 2008/06/11 23:51:57 | ||
| 420 | [key.c] | ||
| 421 | #define statements that are not atoms need braces around them, else they | ||
| 422 | will cause trouble in some cases. | ||
| 423 | Also do a computation of -1 once, and not in a loop several times. | ||
| 424 | spotted by otto@ | ||
| 425 | - dtucker@cvs.openbsd.org 2008/06/12 00:03:49 | ||
| 426 | [dns.c canohost.c sshconnect.c] | ||
| 427 | Do not pass "0" strings as ports to getaddrinfo because the lookups | ||
| 428 | can slow things down and we never use the service info anyway. bz | ||
| 429 | #859, patch from YOSHIFUJI Hideaki and John Devitofranceschi. ok | ||
| 430 | deraadt@ djm@ | ||
| 431 | djm belives that the reason for the "0" strings is to ensure that | ||
| 432 | it's not possible to call getaddrinfo with both host and port being | ||
| 433 | NULL. In the case of canohost.c host is a local array. In the | ||
| 434 | case of sshconnect.c, it's checked for null immediately before use. | ||
| 435 | In dns.c it ultimately comes from ssh.c:main() and is guaranteed to | ||
| 436 | be non-null but it's not obvious, so I added a warning message in | ||
| 437 | case it is ever passed a null. | ||
| 438 | - grunk@cvs.openbsd.org 2008/06/12 00:13:55 | ||
| 439 | [sshconnect.c] | ||
| 440 | Make ssh print the random art also when ssh'ing to a host using IP only. | ||
| 441 | spotted by naddy@, ok and help djm@ dtucker@ | ||
| 442 | - otto@cvs.openbsd.org 2008/06/12 00:13:13 | ||
| 443 | [key.c] | ||
| 444 | use an odd number of rows and columns and a separate start marker, looks | ||
| 445 | better; ok grunk@ | ||
| 446 | - djm@cvs.openbsd.org 2008/06/12 03:40:52 | ||
| 447 | [clientloop.h mux.c channels.c clientloop.c channels.h] | ||
| 448 | Enable ~ escapes for multiplex slave sessions; give each channel | ||
| 449 | its own escape state and hook the escape filters up to muxed | ||
| 450 | channels. bz #1331 | ||
| 451 | Mux slaves do not currently support the ~^Z and ~& escapes. | ||
| 452 | NB. this change cranks the mux protocol version, so a new ssh | ||
| 453 | mux client will not be able to connect to a running old ssh | ||
| 454 | mux master. | ||
| 455 | ok dtucker@ | ||
| 456 | - djm@cvs.openbsd.org 2008/06/12 04:06:00 | ||
| 457 | [clientloop.h ssh.c clientloop.c] | ||
| 458 | maintain an ordered queue of outstanding global requests that we | ||
| 459 | expect replies to, similar to the per-channel confirmation queue. | ||
| 460 | Use this queue to verify success or failure for remote forward | ||
| 461 | establishment in a race free way. | ||
| 462 | ok dtucker@ | ||
| 463 | - djm@cvs.openbsd.org 2008/06/12 04:17:47 | ||
| 464 | [clientloop.c] | ||
| 465 | thall shalt not code past the eightieth column | ||
| 466 | - djm@cvs.openbsd.org 2008/06/12 04:24:06 | ||
| 467 | [ssh.c] | ||
| 468 | thal shalt not code past the eightieth column | ||
| 469 | - djm@cvs.openbsd.org 2008/06/12 05:15:41 | ||
| 470 | [PROTOCOL] | ||
| 471 | document tun@openssh.com forwarding method | ||
| 472 | - djm@cvs.openbsd.org 2008/06/12 05:32:30 | ||
| 473 | [mux.c] | ||
| 474 | some more TODO for me | ||
| 475 | - grunk@cvs.openbsd.org 2008/06/12 05:42:46 | ||
| 476 | [key.c] | ||
| 477 | supply the key type (rsa1, rsa, dsa) as a caption in the frame of the | ||
| 478 | random art. while there, stress the fact that the field base should at | ||
| 479 | least be 8 characters for the pictures to make sense. | ||
| 480 | comment and ok djm@ | ||
| 481 | - grunk@cvs.openbsd.org 2008/06/12 06:32:59 | ||
| 482 | [key.c] | ||
| 483 | We already mark the start of the worm, now also mark the end of the worm | ||
| 484 | in our random art drawings. | ||
| 485 | ok djm@ | ||
| 486 | - djm@cvs.openbsd.org 2008/06/12 15:19:17 | ||
| 487 | [clientloop.h channels.h clientloop.c channels.c mux.c] | ||
| 488 | The multiplexing escape char handler commit last night introduced a | ||
| 489 | small memory leak per session; plug it. | ||
| 490 | - dtucker@cvs.openbsd.org 2008/06/12 16:35:31 | ||
| 491 | [ssh_config.5 ssh.c] | ||
| 492 | keyword expansion for localcommand. ok djm@ | ||
| 493 | - jmc@cvs.openbsd.org 2008/06/12 19:10:09 | ||
| 494 | [ssh_config.5 ssh-keygen.1] | ||
| 495 | tweak the ascii art text; ok grunk | ||
| 496 | - dtucker@cvs.openbsd.org 2008/06/12 20:38:28 | ||
| 497 | [sshd.c sshconnect.c packet.h misc.c misc.h packet.c] | ||
| 498 | Make keepalive timeouts apply while waiting for a packet, particularly | ||
| 499 | during key renegotiation (bz #1363). With djm and Matt Day, ok djm@ | ||
| 500 | - djm@cvs.openbsd.org 2008/06/12 20:47:04 | ||
| 501 | [sftp-client.c] | ||
| 502 | print extension revisions for extensions that we understand | ||
| 503 | - djm@cvs.openbsd.org 2008/06/12 21:06:25 | ||
| 504 | [clientloop.c] | ||
| 505 | I was coalescing expected global request confirmation replies at | ||
| 506 | the wrong end of the queue - fix; prompted by markus@ | ||
| 507 | - grunk@cvs.openbsd.org 2008/06/12 21:14:46 | ||
| 508 | [ssh-keygen.c] | ||
| 509 | make ssh-keygen -lf show the key type just as ssh-add -l would do it | ||
| 510 | ok djm@ markus@ | ||
| 511 | - grunk@cvs.openbsd.org 2008/06/12 22:03:36 | ||
| 512 | [key.c] | ||
| 513 | add my copyright, ok djm@ | ||
| 514 | - ian@cvs.openbsd.org 2008/06/12 23:24:58 | ||
| 515 | [sshconnect.c] | ||
| 516 | tweak wording in message, ok deraadt@ jmc@ | ||
| 517 | - dtucker@cvs.openbsd.org 2008/06/13 00:12:02 | ||
| 518 | [sftp.h log.h] | ||
| 519 | replace __dead with __attribute__((noreturn)), makes things | ||
| 520 | a little easier to port. Also, add it to sigdie(). ok djm@ | ||
| 521 | - djm@cvs.openbsd.org 2008/06/13 00:16:49 | ||
| 522 | [mux.c] | ||
| 523 | fall back to creating a new TCP connection on most multiplexing errors | ||
| 524 | (socket connect fail, invalid version, refused permittion, corrupted | ||
| 525 | messages, etc.); bz #1329 ok dtucker@ | ||
| 526 | - dtucker@cvs.openbsd.org 2008/06/13 00:47:53 | ||
| 527 | [mux.c] | ||
| 528 | upcast size_t to u_long to match format arg; ok djm@ | ||
| 529 | - dtucker@cvs.openbsd.org 2008/06/13 00:51:47 | ||
| 530 | [mac.c] | ||
| 531 | upcast another size_t to u_long to match format | ||
| 532 | - dtucker@cvs.openbsd.org 2008/06/13 01:38:23 | ||
| 533 | [misc.c] | ||
| 534 | upcast uid to long with matching %ld, prevents warnings in portable | ||
| 535 | - djm@cvs.openbsd.org 2008/06/13 04:40:22 | ||
| 536 | [auth2-pubkey.c auth-rhosts.c] | ||
| 537 | refuse to read ~/.shosts or ~/.ssh/authorized_keys that are not | ||
| 538 | regular files; report from Solar Designer via Colin Watson in bz#1471 | ||
| 539 | ok dtucker@ deraadt | ||
| 540 | - (dtucker) [clientloop.c serverloop.c] channel_register_filter now | ||
| 541 | takes 2 more args. with djm@ | ||
| 542 | - (dtucker) [defines.h] Bug #1112: __dead is, well dead. Based on a patch | ||
| 543 | from Todd Vierling. | ||
| 544 | - (dtucker) [auth-sia.c] Bug #1241: support password expiry on Tru64 SIA | ||
| 545 | systems. Patch from R. Scott Bailey. | ||
| 546 | - (dtucker) [umac.c] STORE_UINT32_REVERSED and endian_convert are never used | ||
| 547 | on big endian machines, so ifdef them for little-endian only to prevent | ||
| 548 | unused function warnings on big-endians. | ||
| 549 | - (dtucker) [openbsd-compat/setenv.c] Make offsets size_t to prevent | ||
| 550 | compiler warnings on some platforms. Based on a discussion with otto@ | ||
| 551 | |||
| 552 | 20080611 | ||
| 553 | - (djm) [channels.c configure.ac] | ||
| 554 | Do not set SO_REUSEADDR on wildcard X11 listeners (X11UseLocalhost=no) | ||
| 555 | bz#1464; ok dtucker | ||
| 556 | |||
| 557 | 20080610 | ||
| 558 | - (dtucker) OpenBSD CVS Sync | ||
| 559 | - djm@cvs.openbsd.org 2008/06/10 03:57:27 | ||
| 560 | [servconf.c match.h sshd_config.5] | ||
| 561 | support CIDR address matching in sshd_config "Match address" blocks, with | ||
| 562 | full support for negation and fall-back to classic wildcard matching. | ||
| 563 | For example: | ||
| 564 | Match address 192.0.2.0/24,3ffe:ffff::/32,!10.* | ||
| 565 | PasswordAuthentication yes | ||
| 566 | addrmatch.c code mostly lifted from flowd's addr.c | ||
| 567 | feedback and ok dtucker@ | ||
| 568 | - djm@cvs.openbsd.org 2008/06/10 04:17:46 | ||
| 569 | [sshd_config.5] | ||
| 570 | better reference for pattern-list | ||
| 571 | - dtucker@cvs.openbsd.org 2008/06/10 04:50:25 | ||
| 572 | [sshd.c channels.h channels.c log.c servconf.c log.h servconf.h sshd.8] | ||
| 573 | Add extended test mode (-T) and connection parameters for test mode (-C). | ||
| 574 | -T causes sshd to write its effective configuration to stdout and exit. | ||
| 575 | -C causes any relevant Match rules to be applied before output. The | ||
| 576 | combination allows tesing of the parser and config files. ok deraadt djm | ||
| 577 | - jmc@cvs.openbsd.org 2008/06/10 07:12:00 | ||
| 578 | [sshd_config.5] | ||
| 579 | tweak previous; | ||
| 580 | - jmc@cvs.openbsd.org 2008/06/10 08:17:40 | ||
| 581 | [sshd.8 sshd.c] | ||
| 582 | - update usage() | ||
| 583 | - fix SYNOPSIS, and sort options | ||
| 584 | - some minor additional fixes | ||
| 585 | - dtucker@cvs.openbsd.org 2008/06/09 18:06:32 | ||
| 586 | [regress/test-exec.sh] | ||
| 587 | Don't generate putty keys if we're not going to use them. ok djm | ||
| 588 | - dtucker@cvs.openbsd.org 2008/06/10 05:23:32 | ||
| 589 | [regress/addrmatch.sh regress/Makefile] | ||
| 590 | Regress test for Match CIDR rules. ok djm@ | ||
| 591 | - dtucker@cvs.openbsd.org 2008/06/10 15:21:41 | ||
| 592 | [test-exec.sh] | ||
| 593 | Use a more portable construct for checking if we're running a putty test | ||
| 594 | - dtucker@cvs.openbsd.org 2008/06/10 15:28:49 | ||
| 595 | [test-exec.sh] | ||
| 596 | Add quotes | ||
| 597 | - dtucker@cvs.openbsd.org 2008/06/10 18:21:24 | ||
| 598 | [ssh_config.5] | ||
| 599 | clarify that Host patterns are space-separated. ok deraadt | ||
| 600 | - djm@cvs.openbsd.org 2008/06/10 22:15:23 | ||
| 601 | [PROTOCOL ssh.c serverloop.c] | ||
| 602 | Add a no-more-sessions@openssh.com global request extension that the | ||
| 603 | client sends when it knows that it will never request another session | ||
| 604 | (i.e. when session multiplexing is disabled). This allows a server to | ||
| 605 | disallow further session requests and terminate the session. | ||
| 606 | Why would a non-multiplexing client ever issue additional session | ||
| 607 | requests? It could have been attacked with something like SSH'jack: | ||
| 608 | http://www.storm.net.nz/projects/7 | ||
| 609 | feedback & ok markus | ||
| 610 | - djm@cvs.openbsd.org 2008/06/10 23:06:19 | ||
| 611 | [auth-options.c match.c servconf.c addrmatch.c sshd.8] | ||
| 612 | support CIDR address matching in .ssh/authorized_keys from="..." stanzas | ||
| 613 | ok and extensive testing dtucker@ | ||
| 614 | - dtucker@cvs.openbsd.org 2008/06/10 23:21:34 | ||
| 615 | [bufaux.c] | ||
| 616 | Use '\0' for a nul byte rather than unadorned 0. ok djm@ | ||
| 617 | - dtucker@cvs.openbsd.org 2008/06/10 23:13:43 | ||
| 618 | [Makefile regress/key-options.sh] | ||
| 619 | Add regress test for key options. ok djm@ | ||
| 620 | - (dtucker) [openbsd-compat/fake-rfc2553.h] Add sin6_scope_id to sockaddr_in6 | ||
| 621 | since the new CIDR code in addmatch.c references it. | ||
| 622 | - (dtucker) [Makefile.in configure.ac regress/addrmatch.sh] Skip IPv6 | ||
| 623 | specific tests on platforms that don't do IPv6. | ||
| 624 | - (dtucker) [Makefile.in] Define TEST_SSH_IPV6 in make's arguments as well | ||
| 625 | as environment. | ||
| 626 | - (dtucker) [Makefile.in] Move addrmatch.o to libssh.a where it's needed now. | ||
| 627 | |||
| 628 | 20080609 | ||
| 629 | - (dtucker) OpenBSD CVS Sync | ||
| 630 | - dtucker@cvs.openbsd.org 2008/06/08 17:04:41 | ||
| 631 | [sftp-server.c] | ||
| 632 | Add case for ENOSYS in errno_to_portable; ok deraadt | ||
| 633 | - dtucker@cvs.openbsd.org 2008/06/08 20:15:29 | ||
| 634 | [sftp.c sftp-client.c sftp-client.h] | ||
| 635 | Have the sftp client store the statvfs replies in wire format, | ||
| 636 | which prevents problems when the server's native sizes exceed the | ||
| 637 | client's. | ||
| 638 | Also extends the sizes of the remaining 32bit wire format to 64bit, | ||
| 639 | they're specified as unsigned long in the standard. | ||
| 640 | - dtucker@cvs.openbsd.org 2008/06/09 13:02:39 | ||
| 641 | [sftp-server.c] | ||
| 642 | Extend 32bit -> 64bit values for statvfs extension missed in previous | ||
| 643 | commit. | ||
| 644 | - dtucker@cvs.openbsd.org 2008/06/09 13:38:46 | ||
| 645 | [PROTOCOL] | ||
| 646 | Use a $OpenBSD tag so our scripts will sync changes. | ||
| 647 | |||
| 648 | 20080608 | ||
| 649 | - (dtucker) [configure.ac defines.h sftp-client.c sftp-server.c sftp.c | ||
| 650 | openbsd-compat/Makefile.in openbsd-compat/openbsd-compat.h | ||
| 651 | openbsd-compat/bsd-statvfs.{c,h}] Add a null implementation of statvfs and | ||
| 652 | fstatvfs and remove #defines around statvfs code. ok djm@ | ||
| 653 | - (dtucker) [configure.ac defines.h sftp-client.c M sftp-server.c] Add a | ||
| 654 | macro to convert fsid to unsigned long for platforms where fsid is a | ||
| 655 | 2-member array. | ||
| 656 | |||
| 657 | 20080607 | ||
| 658 | - (dtucker) [mux.c] Include paths.h inside ifdef HAVE_PATHS_H. | ||
| 659 | - (dtucker) [configure.ac defines.h sftp-client.c sftp-server.c sftp.c] | ||
| 660 | Do not enable statvfs extensions on platforms that do not have statvfs. | ||
| 661 | - (dtucker) OpenBSD CVS Sync | ||
| 662 | - djm@cvs.openbsd.org 2008/05/19 06:14:02 | ||
| 663 | [packet.c] unbreak protocol keepalive timeouts bz#1465; ok dtucker@ | ||
| 664 | - djm@cvs.openbsd.org 2008/05/19 15:45:07 | ||
| 665 | [sshtty.c ttymodes.c sshpty.h] | ||
| 666 | Fix sending tty modes when stdin is not a tty (bz#1199). Previously | ||
| 667 | we would send the modes corresponding to a zeroed struct termios, | ||
| 668 | whereas we should have been sending an empty list of modes. | ||
| 669 | Based on patch from daniel.ritz AT alcatel.ch; ok dtucker@ markus@ | ||
| 670 | - djm@cvs.openbsd.org 2008/05/19 15:46:31 | ||
| 671 | [ssh-keygen.c] | ||
| 672 | support -l (print fingerprint) in combination with -F (find host) to | ||
| 673 | search for a host in ~/.ssh/known_hosts and display its fingerprint; | ||
| 674 | ok markus@ | ||
| 675 | - djm@cvs.openbsd.org 2008/05/19 20:53:52 | ||
| 676 | [clientloop.c] | ||
| 677 | unbreak tree by committing this bit that I missed from: | ||
| 678 | Fix sending tty modes when stdin is not a tty (bz#1199). Previously | ||
| 679 | we would send the modes corresponding to a zeroed struct termios, | ||
| 680 | whereas we should have been sending an empty list of modes. | ||
| 681 | Based on patch from daniel.ritz AT alcatel.ch; ok dtucker@ markus@ | ||
| 682 | |||
| 683 | 20080604 | ||
| 684 | - (djm) [openbsd-compat/bsd-arc4random.c] Fix math bug that caused bias | ||
| 685 | in arc4random_uniform with upper_bound in (2^30,2*31). Note that | ||
| 686 | OpenSSH did not make requests with upper bounds in this range. | ||
| 687 | |||
| 688 | 20080519 | ||
| 689 | - (djm) [configure.ac mux.c sftp.c openbsd-compat/Makefile.in] | ||
| 690 | [openbsd-compat/fmt_scaled.c openbsd-compat/openbsd-compat.h] | ||
| 691 | Fix compilation on Linux, including pulling in fmt_scaled(3) | ||
| 692 | implementation from OpenBSD's libutil. | ||
| 693 | |||
| 694 | 20080518 | ||
| 695 | - (djm) OpenBSD CVS Sync | ||
| 696 | - djm@cvs.openbsd.org 2008/04/04 05:14:38 | ||
| 697 | [sshd_config.5] | ||
| 698 | ChrootDirectory is supported in Match blocks (in fact, it is most useful | ||
| 699 | there). Spotted by Minstrel AT minstrel.org.uk | ||
| 700 | - djm@cvs.openbsd.org 2008/04/04 06:44:26 | ||
| 701 | [sshd_config.5] | ||
| 702 | oops, some unrelated stuff crept into that commit - backout. | ||
| 703 | spotted by jmc@ | ||
| 704 | - djm@cvs.openbsd.org 2008/04/05 02:46:02 | ||
| 705 | [sshd_config.5] | ||
| 706 | HostbasedAuthentication is supported under Match too | ||
| 707 | - (djm) [openbsd-compat/bsd-arc4random.c openbsd-compat/openbsd-compat.c] | ||
| 708 | [configure.ac] Implement arc4random_buf(), import implementation of | ||
| 709 | arc4random_uniform() from OpenBSD | ||
| 710 | - (djm) [openbsd-compat/bsd-arc4random.c] Warning fixes | ||
| 711 | - (djm) [openbsd-compat/port-tun.c] needs sys/queue.h | ||
| 712 | - (djm) OpenBSD CVS Sync | ||
| 713 | - djm@cvs.openbsd.org 2008/04/13 00:22:17 | ||
| 714 | [dh.c sshd.c] | ||
| 715 | Use arc4random_buf() when requesting more than a single word of output | ||
| 716 | Use arc4random_uniform() when the desired random number upper bound | ||
| 717 | is not a power of two | ||
| 718 | ok deraadt@ millert@ | ||
| 719 | - djm@cvs.openbsd.org 2008/04/18 12:32:11 | ||
| 720 | [sftp-client.c sftp-client.h sftp-server.c sftp.1 sftp.c sftp.h] | ||
| 721 | introduce sftp extension methods statvfs@openssh.com and | ||
| 722 | fstatvfs@openssh.com that implement statvfs(2)-like operations, | ||
| 723 | based on a patch from miklos AT szeredi.hu (bz#1399) | ||
| 724 | also add a "df" command to the sftp client that uses the | ||
| 725 | statvfs@openssh.com to produce a df(1)-like display of filesystem | ||
| 726 | space and inode utilisation | ||
| 727 | ok markus@ | ||
| 728 | - jmc@cvs.openbsd.org 2008/04/18 17:15:47 | ||
| 729 | [sftp.1] | ||
| 730 | macro fixage; | ||
| 731 | - djm@cvs.openbsd.org 2008/04/18 22:01:33 | ||
| 732 | [session.c] | ||
| 733 | remove unneccessary parentheses | ||
| 734 | - otto@cvs.openbsd.org 2008/04/29 11:20:31 | ||
| 735 | [monitor_mm.h] | ||
| 736 | garbage collect two unused fields in struct mm_master; ok markus@ | ||
| 737 | - djm@cvs.openbsd.org 2008/04/30 10:14:03 | ||
| 738 | [ssh-keyscan.1 ssh-keyscan.c] | ||
| 739 | default to rsa (protocol 2) keys, instead of rsa1 keys; spotted by | ||
| 740 | larsnooden AT openoffice.org | ||
| 741 | - pyr@cvs.openbsd.org 2008/05/07 05:49:37 | ||
| 742 | [servconf.c servconf.h session.c sshd_config.5] | ||
| 743 | Enable the AllowAgentForwarding option in sshd_config (global and match | ||
| 744 | context), to specify if agents should be permitted on the server. | ||
| 745 | As the man page states: | ||
| 746 | ``Note that disabling Agent forwarding does not improve security | ||
| 747 | unless users are also denied shell access, as they can always install | ||
| 748 | their own forwarders.'' | ||
| 749 | ok djm@, ok and a mild frown markus@ | ||
| 750 | - pyr@cvs.openbsd.org 2008/05/07 06:43:35 | ||
| 751 | [sshd_config] | ||
| 752 | push the sshd_config bits in, spotted by ajacoutot@ | ||
| 753 | - jmc@cvs.openbsd.org 2008/05/07 08:00:14 | ||
| 754 | [sshd_config.5] | ||
| 755 | sort; | ||
| 756 | - markus@cvs.openbsd.org 2008/05/08 06:59:01 | ||
| 757 | [bufaux.c buffer.h channels.c packet.c packet.h] | ||
| 758 | avoid extra malloc/copy/free when receiving data over the net; | ||
| 759 | ~10% speedup for localhost-scp; ok djm@ | ||
| 760 | - djm@cvs.openbsd.org 2008/05/08 12:02:23 | ||
| 761 | [auth-options.c auth1.c channels.c channels.h clientloop.c gss-serv.c] | ||
| 762 | [monitor.c monitor_wrap.c nchan.c servconf.c serverloop.c session.c] | ||
| 763 | [ssh.c sshd.c] | ||
| 764 | Implement a channel success/failure status confirmation callback | ||
| 765 | mechanism. Each channel maintains a queue of callbacks, which will | ||
| 766 | be drained in order (RFC4253 guarantees confirm messages are not | ||
| 767 | reordered within an channel). | ||
| 768 | Also includes a abandonment callback to clean up if a channel is | ||
| 769 | closed without sending confirmation messages. This probably | ||
| 770 | shouldn't happen in compliant implementations, but it could be | ||
| 771 | abused to leak memory. | ||
| 772 | ok markus@ (as part of a larger diff) | ||
| 773 | - djm@cvs.openbsd.org 2008/05/08 12:21:16 | ||
| 774 | [monitor.c monitor_wrap.c session.h servconf.c servconf.h session.c] | ||
| 775 | [sshd_config sshd_config.5] | ||
| 776 | Make the maximum number of sessions run-time controllable via | ||
| 777 | a sshd_config MaxSessions knob. This is useful for disabling | ||
| 778 | login/shell/subsystem access while leaving port-forwarding working | ||
| 779 | (MaxSessions 0), disabling connection multiplexing (MaxSessions 1) or | ||
| 780 | simply increasing the number of allows multiplexed sessions. | ||
| 781 | Because some bozos are sure to configure MaxSessions in excess of the | ||
| 782 | number of available file descriptors in sshd (which, at peak, might be | ||
| 783 | as many as 9*MaxSessions), audit sshd to ensure that it doesn't leak fds | ||
| 784 | on error paths, and make it fail gracefully on out-of-fd conditions - | ||
| 785 | sending channel errors instead of than exiting with fatal(). | ||
| 786 | bz#1090; MaxSessions config bits and manpage from junyer AT gmail.com | ||
| 787 | ok markus@ | ||
| 788 | - djm@cvs.openbsd.org 2008/05/08 13:06:11 | ||
| 789 | [clientloop.c clientloop.h ssh.c] | ||
| 790 | Use new channel status confirmation callback system to properly deal | ||
| 791 | with "important" channel requests that fail, in particular command exec, | ||
| 792 | shell and subsystem requests. Previously we would optimistically assume | ||
| 793 | that the requests would always succeed, which could cause hangs if they | ||
| 794 | did not (e.g. when the server runs out of fds) or were unimplemented by | ||
| 795 | the server (bz #1384) | ||
| 796 | Also, properly report failing multiplex channel requests via the mux | ||
| 797 | client stderr (subject to LogLevel in the mux master) - better than | ||
| 798 | silently failing. | ||
| 799 | most bits ok markus@ (as part of a larger diff) | ||
| 800 | - djm@cvs.openbsd.org 2008/05/09 04:55:56 | ||
| 801 | [channels.c channels.h clientloop.c serverloop.c] | ||
| 802 | Try additional addresses when connecting to a port forward destination | ||
| 803 | whose DNS name resolves to more than one address. The previous behaviour | ||
| 804 | was to try the first address and give up. | ||
| 805 | Reported by stig AT venaas.com in bz#343 | ||
| 806 | great feedback and ok markus@ | ||
| 807 | - djm@cvs.openbsd.org 2008/05/09 14:18:44 | ||
| 808 | [clientloop.c clientloop.h ssh.c mux.c] | ||
| 809 | tidy up session multiplexing code, moving it into its own file and | ||
| 810 | making the function names more consistent - making ssh.c and | ||
| 811 | clientloop.c a fair bit more readable. | ||
| 812 | ok markus@ | ||
| 813 | - djm@cvs.openbsd.org 2008/05/09 14:26:08 | ||
| 814 | [ssh.c] | ||
| 815 | dingo stole my diff hunk | ||
| 816 | - markus@cvs.openbsd.org 2008/05/09 16:16:06 | ||
| 817 | [session.c] | ||
| 818 | re-add the USE_PIPES code and enable it. | ||
| 819 | without pipes shutdown-read from the sshd does not trigger | ||
| 820 | a SIGPIPE when the forked program does a write. | ||
| 821 | ok djm@ | ||
| 822 | (Id sync only, USE_PIPES never left portable OpenSSH) | ||
| 823 | - markus@cvs.openbsd.org 2008/05/09 16:17:51 | ||
| 824 | [channels.c] | ||
| 825 | error-fd race: don't enable the error fd in the select bitmask | ||
| 826 | for channels with both in- and output closed, since the channel | ||
| 827 | will go away before we call select(); | ||
| 828 | report, lots of debugging help and ok djm@ | ||
| 829 | - markus@cvs.openbsd.org 2008/05/09 16:21:13 | ||
| 830 | [channels.h clientloop.c nchan.c serverloop.c] | ||
| 831 | unbreak | ||
| 832 | ssh -2 localhost od /bin/ls | true | ||
| 833 | ignoring SIGPIPE by adding a new channel message (EOW) that signals | ||
| 834 | the peer that we're not interested in any data it might send. | ||
| 835 | fixes bz #85; discussion, debugging and ok djm@ | ||
| 836 | - pvalchev@cvs.openbsd.org 2008/05/12 20:52:20 | ||
| 837 | [umac.c] | ||
| 838 | Ensure nh_result lies on a 64-bit boundary (fixes warnings observed | ||
| 839 | on Itanium on Linux); from Dale Talcott (bug #1462); ok djm@ | ||
| 840 | - djm@cvs.openbsd.org 2008/05/15 23:52:24 | ||
| 841 | [nchan2.ms] | ||
| 842 | document eow message in ssh protocol 2 channel state machine; | ||
| 843 | feedback and ok markus@ | ||
| 844 | - djm@cvs.openbsd.org 2008/05/18 21:29:05 | ||
| 845 | [sftp-server.c] | ||
| 846 | comment extension announcement | ||
| 847 | - djm@cvs.openbsd.org 2008/05/16 08:30:42 | ||
| 848 | [PROTOCOL] | ||
| 849 | document our protocol extensions and deviations; ok markus@ | ||
| 850 | - djm@cvs.openbsd.org 2008/05/17 01:31:56 | ||
| 851 | [PROTOCOL] | ||
| 852 | grammar and correctness fixes from stevesk@ | ||
| 853 | |||
| 854 | 20080403 | ||
| 855 | - (djm) [openbsd-compat/bsd-poll.c] Include stdlib.h to avoid compile- | ||
| 856 | time warnings on LynxOS. Patch from ops AT iki.fi | ||
| 857 | - (djm) Force string arguments to replacement setproctitle() though | ||
| 858 | strnvis first. Ok dtucker@ | ||
| 859 | |||
| 860 | 20080403 | ||
| 861 | - (djm) OpenBSD CVS sync: | ||
| 862 | - markus@cvs.openbsd.org 2008/04/02 15:36:51 | ||
| 863 | [channels.c] | ||
| 864 | avoid possible hijacking of x11-forwarded connections (back out 1.183) | ||
| 865 | CVE-2008-1483; ok djm@ | ||
| 866 | - jmc@cvs.openbsd.org 2008/03/27 22:37:57 | ||
| 867 | [sshd.8] | ||
| 868 | remove trailing whitespace; | ||
| 869 | - djm@cvs.openbsd.org 2008/04/03 09:50:14 | ||
| 870 | [version.h] | ||
| 871 | openssh-5.0 | ||
| 872 | - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec] | ||
| 873 | [contrib/suse/openssh.spec] Crank version numbers in RPM spec files | ||
| 874 | - (djm) [README] Update link to release notes | ||
| 875 | - (djm) Release 5.0p1 | ||
| 876 | |||
| 877 | 20080315 | ||
| 878 | - (djm) [regress/test-exec.sh] Quote putty-related variables in case they are | ||
| 879 | empty; report and patch from Peter Stuge | ||
| 880 | - (djm) [regress/test-exec.sh] Silence noise from detection of putty | ||
| 881 | commands; report from Peter Stuge | ||
| 882 | - (djm) [session.c] Relocate incorrectly-placed closefrom() that was causing | ||
| 883 | crashes when used with ChrootDirectory | ||
| 884 | |||
| 885 | |||
| 886 | 20080327 | ||
| 887 | - (dtucker) Cache selinux status earlier so we know if it's enabled after a | ||
| 888 | chroot. Allows ChrootDirectory to work with selinux support compiled in | ||
| 889 | but not enabled. Using it with selinux enabled will require some selinux | ||
| 890 | support inside the chroot. "looks sane" djm@ | ||
| 891 | - (djm) Fix RCS ident in sftp-server-main.c | ||
| 892 | - (djm) OpenBSD CVS sync: | ||
| 893 | - jmc@cvs.openbsd.org 2008/02/11 07:58:28 | ||
| 894 | [ssh.1 sshd.8 sshd_config.5] | ||
| 895 | bump Mdocdate for pages committed in "febuary", necessary because | ||
| 896 | of a typo in rcs.c; | ||
| 897 | - deraadt@cvs.openbsd.org 2008/03/13 01:49:53 | ||
| 898 | [monitor_fdpass.c] | ||
| 899 | Correct CMSG_SPACE and CMSG_LEN usage everywhere in the tree. Due to | ||
| 900 | an extensive discussion with otto, kettenis, millert, and hshoexer | ||
| 901 | - deraadt@cvs.openbsd.org 2008/03/15 16:19:02 | ||
| 902 | [monitor_fdpass.c] | ||
| 903 | Repair the simple cases for msg_controllen where it should just be | ||
| 904 | CMSG_SIZE(sizeof(int)), not sizeof(buffer) which may be larger because | ||
| 905 | of alignment; ok kettenis hshoexer | ||
| 906 | - djm@cvs.openbsd.org 2008/03/23 12:54:01 | ||
| 907 | [sftp-client.c] | ||
| 908 | prefer POSIX-style file renaming over filexfer rename behaviour if the | ||
| 909 | server supports the posix-rename@openssh.com extension. | ||
| 910 | Note that the old (filexfer) behaviour would refuse to clobber an | ||
| 911 | existing file. Users who depended on this should adjust their sftp(1) | ||
| 912 | usage. | ||
| 913 | ok deraadt@ markus@ | ||
| 914 | - deraadt@cvs.openbsd.org 2008/03/24 16:11:07 | ||
| 915 | [monitor_fdpass.c] | ||
| 916 | msg_controllen has to be CMSG_SPACE so that the kernel can account for | ||
| 917 | each cmsg_len (ie. msg_controllen = sum of CMSG_ALIGN(cmsg_len). This | ||
| 918 | works now that kernel fd passing has been fixed to accept a bit of | ||
| 919 | sloppiness because of this ABI repair. | ||
| 920 | lots of discussion with kettenis | ||
| 921 | - djm@cvs.openbsd.org 2008/03/25 11:58:02 | ||
| 922 | [session.c sshd_config.5] | ||
| 923 | ignore ~/.ssh/rc if a sshd_config ForceCommand is specified; | ||
| 924 | from dtucker@ ok deraadt@ djm@ | ||
| 925 | - djm@cvs.openbsd.org 2008/03/25 23:01:41 | ||
| 926 | [session.c] | ||
| 927 | last patch had backwards test; spotted by termim AT gmail.com | ||
| 928 | - djm@cvs.openbsd.org 2008/03/26 21:28:14 | ||
| 929 | [auth-options.c auth-options.h session.c sshd.8] | ||
| 930 | add no-user-rc authorized_keys option to disable execution of ~/.ssh/rc | ||
| 931 | - djm@cvs.openbsd.org 2008/03/27 00:16:49 | ||
| 932 | [version.h] | ||
| 933 | openssh-4.9 | ||
| 934 | - djm@cvs.openbsd.org 2008/03/24 21:46:54 | ||
| 935 | [regress/sftp-badcmds.sh] | ||
| 936 | disable no-replace rename test now that we prefer a POSIX rename; spotted | ||
| 937 | by dkrause@ | ||
| 938 | - (djm) [configure.ac] fix alignment of --without-stackprotect description | ||
| 939 | - (djm) [configure.ac] --with-selinux too | ||
| 940 | - (djm) [regress/Makefile] cleanup PuTTY interop test droppings | ||
| 941 | - (djm) [README] Update link to release notes | ||
| 942 | - (djm) [contrib/caldera/openssh.spec contrib/redhat/openssh.spec] | ||
| 943 | [contrib/suse/openssh.spec] Crank version numbers in RPM spec files | ||
| 944 | - (djm) Release 4.9p1 | ||
| 945 | |||
| 946 | 20080315 | ||
| 947 | - (djm) [regress/test-exec.sh] Quote putty-related variables in case they are | ||
| 948 | empty; report and patch from Peter Stuge | ||
| 949 | - (djm) [regress/test-exec.sh] Silence noise from detection of putty | ||
| 950 | commands; report from Peter Stuge | ||
| 951 | - (djm) [session.c] Relocate incorrectly-placed closefrom() that was causing | ||
| 952 | crashes when used with ChrootDirectory | ||
| 953 | |||
| 954 | 20080314 | ||
| 955 | - (tim) [regress/sftp-cmds.sh] s/cd/lcd/ in lls test. Reported by | ||
| 956 | vinschen at redhat.com. Add () to put echo commands in subshell for lls test | ||
| 957 | I mistakenly left out of last commit. | ||
| 958 | - (tim) [regress/localcommand.sh] Shell portability fix. Reported by imorgan at | ||
| 959 | nas.nasa.gov | ||
| 960 | |||
| 961 | 20080313 | ||
| 962 | - (djm) [Makefile.in regress/Makefile] Fix interop-tests target (note to | ||
| 963 | self: make changes to Makefile.in next time, not the generated Makefile). | ||
| 964 | - (djm) [Makefile.in regress/test-exec.sh] Find installed plink(1) and | ||
| 965 | puttygen(1) by $PATH | ||
| 966 | - (tim) [scp.c] Use poll.h if available, fall back to sys/poll.h if not. Patch | ||
| 967 | by vinschen at redhat.com. | ||
| 968 | - (tim) [regress/sftp-cmds.sh regress/ssh2putty.sh] Shell portability fixes | ||
| 969 | from vinschen at redhat.com and imorgan at nas.nasa.gov | ||
| 970 | |||
| 971 | 20080312 | ||
| 972 | - (djm) OpenBSD CVS Sync | ||
| 973 | - dtucker@cvs.openbsd.org 2007/10/29 06:57:13 | ||
| 974 | [regress/Makefile regress/localcommand.sh] | ||
| 975 | Add simple regress test for LocalCommand; ok djm@ | ||
| 976 | - jmc@cvs.openbsd.org 2007/11/25 15:35:09 | ||
| 977 | [regress/agent-getpeereid.sh regress/agent.sh] | ||
| 978 | more existant -> existent, from Martynas Venckus; | ||
| 979 | pfctl changes: ok henning | ||
| 980 | ssh changes: ok deraadt | ||
| 981 | - djm@cvs.openbsd.org 2007/12/12 05:04:03 | ||
| 982 | [regress/sftp-cmds.sh] | ||
| 983 | unbreak lls command and add a regress test that would have caught the | ||
| 984 | breakage; spotted by mouring@ | ||
| 985 | NB. sftp code change already committed. | ||
| 986 | - djm@cvs.openbsd.org 2007/12/21 04:13:53 | ||
| 987 | [regress/Makefile regress/test-exec.sh regress/putty-ciphers.sh] | ||
| 988 | [regress/putty-kex.sh regress/putty-transfer.sh regress/ssh2putty.sh] | ||
| 989 | basic (crypto, kex and transfer) interop regression tests against putty | ||
| 990 | To run these, install putty and run "make interop-tests" from the build | ||
| 991 | directory - the tests aren't run by default yet. | ||
| 992 | |||
| 993 | 20080311 | ||
| 994 | - (dtucker) [auth-pam.c monitor.c session.c sshd.c] Bug #926: Move | ||
| 995 | pam_open_session and pam_close_session into the privsep monitor, which | ||
| 996 | will ensure that pam_session_close is called as root. Patch from Tomas | ||
| 997 | Mraz. | ||
| 998 | |||
| 999 | 20080309 | ||
| 1000 | - (dtucker) [configure.ac] It turns out gcc's -fstack-protector-all doesn't | ||
| 1001 | always work for all platforms and versions, so test what we can and | ||
| 1002 | add a configure flag to turn it of if needed. ok djm@ | ||
| 1003 | - (dtucker) [openbsd-compat/port-aix.{c,h}] Remove AIX specific initgroups | ||
| 1004 | implementation. It's not needed to fix bug #1081 and breaks the build | ||
| 1005 | on some AIX configurations. | ||
| 1006 | - (dtucker) [openbsd-compat/regress/strtonumtest.c] Bug #1347: Use platform's | ||
| 1007 | equivalent of LLONG_MAX for the compat regression tests, which makes them | ||
| 1008 | run on AIX and HP-UX. Patch from David Leonard. | ||
| 1009 | - (dtucker) [configure.ac] Run stack-protector tests with -Werror to catch | ||
| 1010 | platforms where gcc understands the option but it's not supported (and | ||
| 1011 | thus generates a warning). | ||
| 1012 | |||
| 1013 | 20080307 | ||
| 1014 | - (djm) OpenBSD CVS Sync | ||
| 1015 | - jmc@cvs.openbsd.org 2008/02/11 07:58:28 | ||
| 1016 | [ssh.1 sshd.8 sshd_config.5] | ||
| 1017 | bump Mdocdate for pages committed in "febuary", necessary because | ||
| 1018 | of a typo in rcs.c; | ||
| 1019 | - djm@cvs.openbsd.org 2008/02/13 22:38:17 | ||
| 1020 | [servconf.h session.c sshd.c] | ||
| 1021 | rekey arc4random and OpenSSL RNG in postauth child | ||
| 1022 | closefrom fds > 2 before shell/command execution | ||
| 1023 | ok markus@ | ||
| 1024 | - mbalmer@cvs.openbsd.org 2008/02/14 13:10:31 | ||
| 1025 | [sshd.c] | ||
| 1026 | When started in configuration test mode (-t) do not check that sshd is | ||
| 1027 | being started with an absolute path. | ||
| 1028 | ok djm | ||
| 1029 | - markus@cvs.openbsd.org 2008/02/20 15:25:26 | ||
| 1030 | [session.c] | ||
| 1031 | correct boolean encoding for coredump; der Mouse via dugsong | ||
| 1032 | - djm@cvs.openbsd.org 2008/02/22 05:58:56 | ||
| 1033 | [session.c] | ||
| 1034 | closefrom() call was too early, delay it until just before we execute | ||
| 1035 | the user's rc files (if any). | ||
| 1036 | - dtucker@cvs.openbsd.org 2008/02/22 20:44:02 | ||
| 1037 | [clientloop.c packet.c packet.h serverloop.c] | ||
| 1038 | Allow all SSH2 packet types, including UNIMPLEMENTED to reset the | ||
| 1039 | keepalive timer (bz #1307). ok markus@ | ||
| 1040 | - djm@cvs.openbsd.org 2008/02/27 20:21:15 | ||
| 1041 | [sftp-server.c] | ||
| 1042 | add an extension method "posix-rename@openssh.com" to perform POSIX atomic | ||
| 1043 | rename() operations. based on patch from miklos AT szeredi.hu in bz#1400; | ||
| 1044 | ok dtucker@ markus@ | ||
| 1045 | - deraadt@cvs.openbsd.org 2008/03/02 18:19:35 | ||
| 1046 | [monitor_fdpass.c] | ||
| 1047 | use a union to ensure alignment of the cmsg (pay attention: various other | ||
| 1048 | parts of the tree need this treatment too); ok djm | ||
| 1049 | - deraadt@cvs.openbsd.org 2008/03/04 21:15:42 | ||
| 1050 | [version.h] | ||
| 1051 | crank version; from djm | ||
| 1052 | - (tim) [regress/sftp-glob.sh] Shell portability fix. | ||
| 1053 | |||
| 1054 | 20080302 | ||
| 1055 | - (dtucker) [configure.ac] FreeBSD's glob() doesn't behave the way we expect | ||
| 1056 | either, so use our own. | ||
| 1057 | |||
| 1058 | 20080229 | ||
| 1059 | - (dtucker) [openbsd-compat/bsd-poll.c] We don't check for select(2) in | ||
| 1060 | configure (and there's not much point, as openssh won't work without it) | ||
| 1061 | so HAVE_SELECT is not defined and the poll(2) compat code doesn't get | ||
| 1062 | built in. Remove HAVE_SELECT so we can build on platforms without poll. | ||
| 1063 | - (dtucker) [scp.c] Include sys/poll.h inside HAVE_SYS_POLL_H. | ||
| 1064 | - (djm) [contrib/gnome-ssh-askpass2.h] Keep askpass windown on top. From | ||
| 1065 | Debian patch via bernd AT openbsd.org | ||
| 1066 | |||
| 1067 | 20080228 | ||
| 1068 | - (dtucker) [configure.ac] Add -fstack-protector to LDFLAGS too, fixes | ||
| 1069 | linking problems on AIX with gcc 4.1.x. | ||
| 1070 | - (dtucker) [includes.h ssh-add.c ssh-agent.c ssh-keygen.c ssh.c sshd.c | ||
| 1071 | openbsd-compat/openssl-compat.{c,h}] Bug #1437 Move the OpenSSL compat | ||
| 1072 | header to after OpenSSL headers, since some versions of OpenSSL have | ||
| 1073 | SSLeay_add_all_algorithms as a macro already. | ||
| 1074 | - (dtucker) [key.c defines.h openbsd-compat/openssl-compat.h] Move old OpenSSL | ||
| 1075 | compat glue into openssl-compat.h. | ||
| 1076 | - (dtucker) [configure.ac openbsd-compat/port-aix.{c,h}] Bug #1081: Implement | ||
| 1077 | getgrouplist via getgrset on AIX, rather than iterating over getgrent. | ||
| 1078 | This allows, eg, Match and AllowGroups directives to work with NIS and | ||
| 1079 | LDAP groups. | ||
| 1080 | - (dtucker) [sshd.c] Bug #1042: make log messages for tcpwrappers use the | ||
| 1081 | same SyslogFacility as the rest of sshd. Patch from William Knox, | ||
| 1082 | ok djm@. | ||
| 1083 | |||
| 1084 | 20080225 | ||
| 1085 | - (dtucker) [openbsd-compat/fake-rfc2553.h] rename ssh_gai_strerror hack | ||
| 1086 | since it now conflicts with the helper function in misc.c. From | ||
| 1087 | vinschen AT redhat.com. | ||
| 1088 | - (dtucker) [configure.ac audit-bsm.c] Bug #1420: Add a local implementation | ||
| 1089 | of aug_get_machine for systems that don't have their own (eg OS X, FreeBSD). | ||
| 1090 | Help and testing from csjp at FreeBSD org, vgiffin at apple com. ok djm@ | ||
| 1091 | - (dtucker) [includes.h openbsd-compat/openssl-compat.c] Bug #1437: reshuffle | ||
| 1092 | headers so ./configure --with-ssl-engine actually works. Patch from | ||
| 1093 | Ian Lister. | ||
| 1094 | |||
| 1095 | 20080224 | ||
| 1096 | - (tim) [contrib/cygwin/ssh-host-config] | ||
| 1097 | Grammar changes on SYSCONFDIR LOCALSTATEDIR messages. | ||
| 1098 | Check more thoroughly that it's possible to create the /var/empty directory. | ||
| 1099 | Patch by vinschen AT redhat.com | ||
| 1100 | |||
| 1101 | 20080210 | ||
| 1102 | - OpenBSD CVS Sync | ||
| 1103 | - chl@cvs.openbsd.org 2008/01/11 07:22:28 | ||
| 1104 | [sftp-client.c sftp-client.h] | ||
| 1105 | disable unused functions | ||
| 1106 | initially from tobias@, but disabled them by placing them in | ||
| 1107 | "#ifdef notyet" which was asked by djm@ | ||
| 1108 | ok djm@ tobias@ | ||
| 1109 | - djm@cvs.openbsd.org 2008/01/19 19:13:28 | ||
| 1110 | [ssh.1] | ||
| 1111 | satisfy the pedants: -q does not suppress all diagnostic messages (e.g. | ||
| 1112 | some commandline parsing warnings go unconditionally to stdout). | ||
| 1113 | - djm@cvs.openbsd.org 2008/01/19 20:48:53 | ||
| 1114 | [clientloop.c] | ||
| 1115 | fd leak on session multiplexing error path. Report and patch from | ||
| 1116 | gregory_shively AT fanniemae.com | ||
| 1117 | - djm@cvs.openbsd.org 2008/01/19 20:51:26 | ||
| 1118 | [ssh.c] | ||
| 1119 | ignore SIGPIPE in multiplex client mode - we can receive this if the | ||
| 1120 | server runs out of fds on us midway. Report and patch from | ||
| 1121 | gregory_shively AT fanniemae.com | ||
| 1122 | - djm@cvs.openbsd.org 2008/01/19 22:04:57 | ||
| 1123 | [sftp-client.c] | ||
| 1124 | fix remote handle leak in do_download() local file open error path; | ||
| 1125 | report and fix from sworley AT chkno.net | ||
| 1126 | - djm@cvs.openbsd.org 2008/01/19 22:22:58 | ||
| 1127 | [ssh-keygen.c] | ||
| 1128 | when hashing individual hosts (ssh-keygen -Hf hostname), make sure we | ||
| 1129 | hash just the specified hostname and not the entire hostspec from the | ||
| 1130 | keyfile. It may be of the form "hostname,ipaddr", which would lead to | ||
| 1131 | a hash that never matches. report and fix from jp AT devnull.cz | ||
| 1132 | - djm@cvs.openbsd.org 2008/01/19 22:37:19 | ||
| 1133 | [ssh-keygen.c] | ||
| 1134 | unbreak line numbering (broken in revision 1.164), fix error message | ||
| 1135 | - djm@cvs.openbsd.org 2008/01/19 23:02:40 | ||
| 1136 | [channels.c] | ||
| 1137 | When we added support for specified bind addresses for port forwards, we | ||
| 1138 | added a quirk SSH_OLD_FORWARD_ADDR. There is a bug in our handling of | ||
| 1139 | this for -L port forwards that causes the client to listen on both v4 | ||
| 1140 | and v6 addresses when connected to a server with this quirk, despite | ||
| 1141 | having set 0.0.0.0 as a bind_address. | ||
| 1142 | report and patch from Jan.Pechanec AT Sun.COM; ok dtucker@ | ||
| 1143 | - djm@cvs.openbsd.org 2008/01/19 23:09:49 | ||
| 1144 | [readconf.c readconf.h sshconnect2.c] | ||
| 1145 | promote rekeylimit to a int64 so it can hold the maximum useful limit | ||
| 1146 | of 2^32; report and patch from Jan.Pechanec AT Sun.COM, ok dtucker@ | ||
| 1147 | - djm@cvs.openbsd.org 2008/01/20 00:38:30 | ||
| 1148 | [sftp.c] | ||
| 1149 | When uploading, correctly handle the case of an unquoted filename with | ||
| 1150 | glob metacharacters that match a file exactly but not as a glob, e.g. a | ||
| 1151 | file called "[abcd]". report and test cases from duncan2nd AT gmx.de | ||
| 1152 | - djm@cvs.openbsd.org 2008/01/21 17:24:30 | ||
| 1153 | [sftp-server.c] | ||
| 1154 | Remove the fixed 100 handle limit in sftp-server and allocate as many | ||
| 1155 | as we have available file descriptors. Patch from miklos AT szeredi.hu; | ||
| 1156 | ok dtucker@ markus@ | ||
| 1157 | - djm@cvs.openbsd.org 2008/01/21 19:20:17 | ||
| 1158 | [sftp-client.c] | ||
| 1159 | when a remote write error occurs during an upload, ensure that ACKs for | ||
| 1160 | all issued requests are properly drained. patch from t8m AT centrum.cz | ||
| 1161 | - dtucker@cvs.openbsd.org 2008/01/23 01:56:54 | ||
| 1162 | [clientloop.c packet.c serverloop.c] | ||
| 1163 | Revert the change for bz #1307 as it causes connection aborts if an IGNORE | ||
| 1164 | packet arrives while we're waiting in packet_read_expect (and possibly | ||
| 1165 | elsewhere). | ||
| 1166 | - jmc@cvs.openbsd.org 2008/01/31 20:06:50 | ||
| 1167 | [scp.1] | ||
| 1168 | explain how to handle local file names containing colons; | ||
| 1169 | requested by Tamas TEVESZ | ||
| 1170 | ok dtucker | ||
| 1171 | - markus@cvs.openbsd.org 2008/02/04 21:53:00 | ||
| 1172 | [session.c sftp-server.c sftp.h] | ||
| 1173 | link sftp-server into sshd; feedback and ok djm@ | ||
| 1174 | - mcbride@cvs.openbsd.org 2008/02/09 12:15:43 | ||
| 1175 | [ssh.1 sshd.8] | ||
| 1176 | Document the correct permissions for the ~/.ssh/ directory. | ||
| 1177 | ok jmc | ||
| 1178 | - djm@cvs.openbsd.org 2008/02/10 09:55:37 | ||
| 1179 | [sshd_config.5] | ||
| 1180 | mantion that "internal-sftp" is useful with ForceCommand too | ||
| 1181 | - djm@cvs.openbsd.org 2008/02/10 10:54:29 | ||
| 1182 | [servconf.c session.c] | ||
| 1183 | delay ~ expansion for ChrootDirectory so it expands to the logged-in user's | ||
| 1184 | home, rather than the user who starts sshd (probably root) | ||
| 1185 | |||
| 1186 | 20080119 | ||
| 1187 | - (djm) Silence noice from expr in ssh-copy-id; patch from | ||
| 1188 | mikel AT mikelward.com | ||
| 1189 | - (djm) Only listen for IPv6 connections on AF_INET6 sockets; patch from | ||
| 1190 | tsr2600 AT gmail.com | ||
| 1191 | |||
| 1192 | 20080102 | ||
| 1193 | - (dtucker) [configure.ac] Fix message for -fstack-protector-all test. | ||
| 1194 | |||
| 1195 | 20080101 | ||
| 1196 | - (dtucker) OpenBSD CVS Sync | ||
| 1197 | - dtucker@cvs.openbsd.org 2007/12/31 10:41:31 | ||
| 1198 | [readconf.c servconf.c] | ||
| 1199 | Prevent strict-aliasing warnings on newer gcc versions. bz #1355, patch | ||
| 1200 | from Dmitry V. Levin, ok djm@ | ||
| 1201 | - dtucker@cvs.openbsd.org 2007/12/31 15:27:04 | ||
| 1202 | [sshd.c] | ||
| 1203 | When in inetd mode, have sshd generate a Protocol 1 ephemeral server | ||
| 1204 | key only for connections where the client chooses Protocol 1 as opposed | ||
| 1205 | to when it's enabled in the server's config. Speeds up Protocol 2 | ||
| 1206 | connections to inetd-mode servers that also allow Protocol 1. bz #440, | ||
| 1207 | based on a patch from bruno at wolff.to, ok markus@ | ||
| 1208 | - dtucker@cvs.openbsd.org 2008/01/01 08:47:04 | ||
| 1209 | [misc.c] | ||
| 1210 | spaces -> tabs from my previous commit | ||
| 1211 | - dtucker@cvs.openbsd.org 2008/01/01 09:06:39 | ||
| 1212 | [scp.c] | ||
| 1213 | If scp -p encounters a pre-epoch timestamp, use the epoch which is | ||
| 1214 | as close as we can get given that it's used unsigned. Add a little | ||
| 1215 | debugging while there. bz #828, ok djm@ | ||
| 1216 | - dtucker@cvs.openbsd.org 2008/01/01 09:27:33 | ||
| 1217 | [sshd_config.5 servconf.c] | ||
| 1218 | Allow PermitRootLogin in a Match block. Allows for, eg, permitting root | ||
| 1219 | only from the local network. ok markus@, man page bit ok jmc@ | ||
| 1220 | - dtucker@cvs.openbsd.org 2008/01/01 08:51:20 | ||
| 1221 | [moduli] | ||
| 1222 | Updated moduli file; ok djm@ | ||
| 1223 | |||
| 1224 | 20071231 | ||
| 1225 | - (dtucker) [configure.ac openbsd-compat/glob.{c,h}] Bug #1407: force use of | ||
| 1226 | builtin glob implementation on Mac OS X. Based on a patch from | ||
| 1227 | vgiffin at apple. | ||
| 1228 | |||
| 1229 | 20071229 | ||
| 1230 | - (dtucker) OpenBSD CVS Sync | ||
| 1231 | - djm@cvs.openbsd.org 2007/12/12 05:04:03 | ||
| 1232 | [sftp.c] | ||
| 1233 | unbreak lls command and add a regress test that would have caught the | ||
| 1234 | breakage; spotted by mouring@ | ||
| 1235 | - dtucker@cvs.openbsd.org 2007/12/27 14:22:08 | ||
| 1236 | [servconf.c canohost.c misc.c channels.c sshconnect.c misc.h ssh-keyscan.c | ||
| 1237 | sshd.c] | ||
| 1238 | Add a small helper function to consistently handle the EAI_SYSTEM error | ||
| 1239 | code of getaddrinfo. Prompted by vgiffin at apple com via bz #1417. | ||
| 1240 | ok markus@ stevesk@ | ||
| 1241 | - dtucker@cvs.openbsd.org 2007/12/28 15:32:24 | ||
| 1242 | [clientloop.c serverloop.c packet.c] | ||
| 1243 | Make SSH2_MSG_UNIMPLEMENTED and SSH2_MSG_IGNORE messages reset the | ||
| 1244 | ServerAlive and ClientAlive timers. Prevents dropping a connection | ||
| 1245 | when these are enabled but the peer does not support our keepalives. | ||
| 1246 | bz #1307, ok djm@. | ||
| 1247 | - dtucker@cvs.openbsd.org 2007/12/28 22:34:47 | ||
| 1248 | [clientloop.c] | ||
| 1249 | Use the correct packet maximum sizes for remote port and agent forwarding. | ||
| 1250 | Prevents the server from killing the connection if too much data is queued | ||
| 1251 | and an excessively large packet gets sent. bz #1360, ok djm@. | ||
| 1252 | |||
| 1253 | 20071202 | ||
| 1254 | - (dtucker) [configure.ac] Enable -fstack-protector-all on systems where | ||
| 1255 | gcc supports it. ok djm@ | ||
| 1256 | - (dtucker) [scp.c] Update $OpenBSD tag missing from rev 1.175 and remove | ||
| 1257 | leftover debug code. | ||
| 1258 | - (dtucker) OpenBSD CVS Sync | ||
| 1259 | - dtucker@cvs.openbsd.org 2007/10/29 00:52:45 | ||
| 1260 | [auth2-gss.c] | ||
| 1261 | Allow build without -DGSSAPI; ok deraadt@ | ||
| 1262 | (Id sync only, Portable already has the ifdefs) | ||
| 1263 | - dtucker@cvs.openbsd.org 2007/10/29 01:55:04 | ||
| 1264 | [ssh.c] | ||
| 1265 | Plug tiny mem leaks in ControlPath and ProxyCommand option processing; | ||
| 1266 | ok djm@ | ||
| 1267 | - dtucker@cvs.openbsd.org 2007/10/29 04:08:08 | ||
| 1268 | [monitor_wrap.c monitor.c] | ||
| 1269 | Send config block back to slave for invalid users too so options | ||
| 1270 | set by a Match block (eg Banner) behave the same for non-existent | ||
| 1271 | users. Found by and ok djm@ | ||
| 1272 | - dtucker@cvs.openbsd.org 2007/10/29 06:51:59 | ||
| 1273 | [ssh_config.5] | ||
| 1274 | ProxyCommand and LocalCommand use the user's shell, not /bin/sh; ok djm@ | ||
| 1275 | - dtucker@cvs.openbsd.org 2007/10/29 06:54:50 | ||
| 1276 | [ssh.c] | ||
| 1277 | Make LocalCommand work for Protocol 1 too; ok djm@ | ||
| 1278 | - jmc@cvs.openbsd.org 2007/10/29 07:48:19 | ||
| 1279 | [ssh_config.5] | ||
| 1280 | clean up after previous macro removal; | ||
| 1281 | - djm@cvs.openbsd.org 2007/11/03 00:36:14 | ||
| 1282 | [clientloop.c] | ||
| 1283 | fix memory leak in process_cmdline(), patch from Jan.Pechanec AT Sun.COM; | ||
| 1284 | ok dtucker@ | ||
| 1285 | - deraadt@cvs.openbsd.org 2007/11/03 01:24:06 | ||
| 1286 | [ssh.c] | ||
| 1287 | bz #1377: getpwuid results were being clobbered by another getpw* call | ||
| 1288 | inside tilde_expand_filename(); save the data we need carefully | ||
| 1289 | ok djm | ||
| 1290 | - dtucker@cvs.openbsd.org 2007/11/03 02:00:32 | ||
| 1291 | [ssh.c] | ||
| 1292 | Use xstrdup/xfree when saving pwname and pwdir; ok deraadt@ | ||
| 1293 | - deraadt@cvs.openbsd.org 2007/11/03 02:03:49 | ||
| 1294 | [ssh.c] | ||
| 1295 | avoid errno trashing in signal handler; ok dtucker | ||
| 1296 | |||
| 1297 | 20071030 | ||
| 1298 | - (djm) OpenBSD CVS Sync | ||
| 1299 | - djm@cvs.openbsd.org 2007/10/29 23:49:41 | ||
| 1300 | [openbsd-compat/sys-tree.h] | ||
| 1301 | remove extra backslash at the end of RB_PROTOTYPE, report from | ||
| 1302 | Jan.Pechanec AT Sun.COM; ok deraadt@ | ||
| 1303 | |||
| 1304 | 20071026 | ||
| 1305 | - (djm) OpenBSD CVS Sync | ||
| 1306 | - stevesk@cvs.openbsd.org 2007/09/11 23:49:09 | ||
| 1307 | [sshpty.c] | ||
| 1308 | remove #if defined block not needed; ok markus@ dtucker@ | ||
| 1309 | (NB. RCD ID sync only for portable) | ||
| 1310 | - djm@cvs.openbsd.org 2007/09/21 03:05:23 | ||
| 1311 | [ssh_config.5] | ||
| 1312 | document KbdInteractiveAuthentication in ssh_config.5; | ||
| 1313 | patch from dkg AT fifthhorseman.net | ||
| 1314 | - djm@cvs.openbsd.org 2007/09/21 08:15:29 | ||
| 1315 | [auth-bsdauth.c auth-passwd.c auth.c auth.h auth1.c auth2-chall.c] | ||
| 1316 | [monitor.c monitor_wrap.c] | ||
| 1317 | unifdef -DBSD_AUTH | ||
| 1318 | unifdef -USKEY | ||
| 1319 | These options have been in use for some years; | ||
| 1320 | ok markus@ "no objection" millert@ | ||
| 1321 | (NB. RCD ID sync only for portable) | ||
| 1322 | - canacar@cvs.openbsd.org 2007/09/25 23:48:57 | ||
| 1323 | [ssh-agent.c] | ||
| 1324 | When adding a key that already exists, update the properties | ||
| 1325 | (time, confirm, comment) instead of discarding them. ok djm@ markus@ | ||
| 1326 | - ray@cvs.openbsd.org 2007/09/27 00:15:57 | ||
| 1327 | [dh.c] | ||
| 1328 | Don't return -1 on error in dh_pub_is_valid(), since it evaluates | ||
| 1329 | to true. | ||
| 1330 | Also fix a typo. | ||
| 1331 | Initial diff from Matthew Dempsky, input from djm. | ||
| 1332 | OK djm, markus. | ||
| 1333 | - dtucker@cvs.openbsd.org 2007/09/29 00:25:51 | ||
| 1334 | [auth2.c] | ||
| 1335 | Remove unused prototype. ok djm@ | ||
| 1336 | - chl@cvs.openbsd.org 2007/10/02 17:49:58 | ||
| 1337 | [ssh-keygen.c] | ||
| 1338 | handles zero-sized strings that fgets can return | ||
| 1339 | properly removes trailing newline | ||
| 1340 | removes an unused variable | ||
| 1341 | correctly counts line number | ||
| 1342 | "looks ok" ray@ markus@ | ||
| 1343 | - markus@cvs.openbsd.org 2007/10/22 19:10:24 | ||
| 1344 | [readconf.c] | ||
| 1345 | make sure that both the local and remote port are correct when | ||
| 1346 | parsing -L; Jan Pechanec (bz #1378) | ||
| 1347 | - djm@cvs.openbsd.org 2007/10/24 03:30:02 | ||
| 1348 | [sftp.c] | ||
| 1349 | rework argument splitting and parsing to cope correctly with common | ||
| 1350 | shell escapes and make handling of escaped characters consistent | ||
| 1351 | with sh(1) and between sftp commands (especially between ones that | ||
| 1352 | glob their arguments and ones that don't). | ||
| 1353 | parse command flags using getopt(3) rather than hand-rolled parsers. | ||
| 1354 | ok dtucker@ | ||
| 1355 | - djm@cvs.openbsd.org 2007/10/24 03:44:02 | ||
| 1356 | [scp.c] | ||
| 1357 | factor out network read/write into an atomicio()-like function, and | ||
| 1358 | use it to handle short reads, apply bandwidth limits and update | ||
| 1359 | counters. make network IO non-blocking, so a small trickle of | ||
| 1360 | reads/writes has a chance of updating the progress meter; bz #799 | ||
| 1361 | ok dtucker@ | ||
| 1362 | - djm@cvs.openbsd.org 2006/08/29 09:44:00 | ||
| 1363 | [regress/sftp-cmds.sh] | ||
| 1364 | clean up our mess | ||
| 1365 | - markus@cvs.openbsd.org 2006/11/06 09:27:43 | ||
| 1366 | [regress/cfgmatch.sh] | ||
| 1367 | fix quoting for non-(c)sh login shells. | ||
| 1368 | - dtucker@cvs.openbsd.org 2006/12/13 08:36:36 | ||
| 1369 | [regress/cfgmatch.sh] | ||
| 1370 | Additional test for multiple PermitOpen entries. ok djm@ | ||
| 1371 | - pvalchev@cvs.openbsd.org 2007/06/07 19:41:46 | ||
| 1372 | [regress/cipher-speed.sh regress/try-ciphers.sh] | ||
| 1373 | test umac-64@openssh.com | ||
| 1374 | ok djm@ | ||
| 1375 | - djm@cvs.openbsd.org 2007/10/24 03:32:35 | ||
| 1376 | [regress/sftp-cmds.sh regress/sftp-glob.sh regress/test-exec.sh] | ||
| 1377 | comprehensive tests for sftp escaping its interaction with globbing; | ||
| 1378 | ok dtucker@ | ||
| 1379 | - djm@cvs.openbsd.org 2007/10/26 05:30:01 | ||
| 1380 | [regress/sftp-glob.sh regress/test-exec.sh] | ||
| 1381 | remove "echo -E" crap that I added in last commit and use printf(1) for | ||
| 1382 | cases where we strictly require echo not to reprocess escape characters. | ||
| 1383 | - deraadt@cvs.openbsd.org 2005/11/28 17:50:12 | ||
| 1384 | [openbsd-compat/glob.c] | ||
| 1385 | unused arg in internal static API | ||
| 1386 | - jakob@cvs.openbsd.org 2007/10/11 18:36:41 | ||
| 1387 | [openbsd-compat/getrrsetbyname.c openbsd-compat/getrrsetbyname.h] | ||
| 1388 | use RRSIG instead of SIG for DNSSEC. ok djm@ | ||
| 1389 | - otto@cvs.openbsd.org 2006/10/21 09:55:03 | ||
| 1390 | [openbsd-compat/base64.c] | ||
| 1391 | remove calls to abort(3) that can't happen anyway; from | ||
| 1392 | <bret dot lambert at gmail.com>; ok millert@ deraadt@ | ||
| 1393 | - frantzen@cvs.openbsd.org 2004/04/24 18:11:46 | ||
| 1394 | [openbsd-compat/sys-tree.h] | ||
| 1395 | sync to Niels Provos' version. avoid unused variable warning in | ||
| 1396 | RB_NEXT() | ||
| 1397 | - tdeval@cvs.openbsd.org 2004/11/24 18:10:42 | ||
| 1398 | [openbsd-compat/sys-tree.h] | ||
| 1399 | typo | ||
| 1400 | - grange@cvs.openbsd.org 2004/05/04 16:59:32 | ||
| 1401 | [openbsd-compat/sys-queue.h] | ||
| 1402 | Remove useless ``elm'' argument from the SIMPLEQ_REMOVE_HEAD macro. | ||
| 1403 | This matches our SLIST behaviour and NetBSD's SIMPLEQ as well. | ||
| 1404 | ok millert krw deraadt | ||
| 1405 | - deraadt@cvs.openbsd.org 2005/02/25 13:29:30 | ||
| 1406 | [openbsd-compat/sys-queue.h] | ||
| 1407 | minor white spacing | ||
| 1408 | - otto@cvs.openbsd.org 2005/10/17 20:19:42 | ||
| 1409 | [openbsd-compat/sys-queue.h] | ||
| 1410 | Performing certain operations on queue.h data structurs produced | ||
| 1411 | funny results. An example is calling LIST_REMOVE on the same | ||
| 1412 | element twice. This will not fail, but result in a data structure | ||
| 1413 | referencing who knows what. Prevent these accidents by NULLing some | ||
| 1414 | fields on remove and replace. This way, either a panic or segfault | ||
| 1415 | will be produced on the faulty operation. | ||
| 1416 | - otto@cvs.openbsd.org 2005/10/24 20:25:14 | ||
| 1417 | [openbsd-compat/sys-queue.h] | ||
| 1418 | Partly backout. NOLIST, used in LISTs is probably interfering. | ||
| 1419 | requested by deraadt@ | ||
| 1420 | - otto@cvs.openbsd.org 2005/10/25 06:37:47 | ||
| 1421 | [openbsd-compat/sys-queue.h] | ||
| 1422 | Some uvm problem is being exposed with the more strict macros. | ||
| 1423 | Revert until we've found out what's causing the panics. | ||
| 1424 | - otto@cvs.openbsd.org 2005/11/25 08:06:25 | ||
| 1425 | [openbsd-compat/sys-queue.h] | ||
| 1426 | Introduce debugging aid for queue macros. Disabled by default; but | ||
| 1427 | developers are encouraged to run with this enabled. | ||
| 1428 | ok krw@ fgsch@ deraadt@ | ||
| 1429 | - otto@cvs.openbsd.org 2007/04/30 18:42:34 | ||
| 1430 | [openbsd-compat/sys-queue.h] | ||
| 1431 | Enable QUEUE_MACRO_DEBUG on DIAGNOSTIC kernels. | ||
| 1432 | Input and okays from krw@, millert@, otto@, deraadt@, miod@. | ||
| 1433 | - millert@cvs.openbsd.org 2004/10/07 16:56:11 | ||
| 1434 | GLOB_NOESCAPE is POSIX so move it out of the #ifndef _POSIX_SOURCE | ||
| 1435 | block. | ||
| 1436 | (NB. mostly an RCS ID sync, as portable strips out the conditionals) | ||
| 1437 | - (djm) [regress/sftp-cmds.sh] | ||
| 1438 | Use more restrictive glob to pick up test files from /bin - some platforms | ||
| 1439 | ship broken symlinks there which could spoil the test. | ||
| 1440 | - (djm) [openbsd-compat/bindresvport.c] | ||
| 1441 | Sync RCS ID after irrelevant (for portable OpenSSH) header shuffling | ||
| 1442 | |||
| 1443 | 20070927 | ||
| 1444 | - (dtucker) [configure.ac atomicio.c] Fall back to including <sys/poll.h> if | ||
| 1445 | we don't have <poll.h> (eq QNX). From bacon at cs nyu edu. | ||
| 1446 | - (dtucker) [configure.ac defines.h] Shadow expiry does not work on QNX6 | ||
| 1447 | so disable it for that platform. From bacon at cs nyu edu. | ||
| 1448 | |||
| 1449 | 20070921 | ||
| 1450 | - (djm) [atomicio.c] Fix spin avoidance for platforms that define | ||
| 1451 | EWOULDBLOCK; patch from ben AT psc.edu | ||
| 1452 | |||
| 1453 | 20070917 | ||
| 1454 | - (djm) OpenBSD CVS Sync | ||
| 1455 | - djm@cvs.openbsd.org 2007/08/23 02:49:43 | ||
| 1456 | [auth-passwd.c auth.c session.c] | ||
| 1457 | unifdef HAVE_LOGIN_CAP; ok deraadt@ millert@ | ||
| 1458 | NB. RCS ID sync only for portable | ||
| 1459 | - djm@cvs.openbsd.org 2007/08/23 02:55:51 | ||
| 1460 | [auth-passwd.c auth.c session.c] | ||
| 1461 | missed include bits from last commit | ||
| 1462 | NB. RCS ID sync only for portable | ||
| 1463 | - djm@cvs.openbsd.org 2007/08/23 03:06:10 | ||
| 1464 | [auth.h] | ||
| 1465 | login_cap.h doesn't belong here | ||
| 1466 | NB. RCS ID sync only for portable | ||
| 1467 | - djm@cvs.openbsd.org 2007/08/23 03:22:16 | ||
| 1468 | [auth2-none.c sshd_config sshd_config.5] | ||
| 1469 | Support "Banner=none" to disable displaying of the pre-login banner; | ||
| 1470 | ok dtucker@ deraadt@ | ||
| 1471 | - djm@cvs.openbsd.org 2007/08/23 03:23:26 | ||
| 1472 | [sshconnect.c] | ||
| 1473 | Execute ProxyCommands with $SHELL rather than /bin/sh unconditionally | ||
| 1474 | - djm@cvs.openbsd.org 2007/09/04 03:21:03 | ||
| 1475 | [clientloop.c monitor.c monitor_fdpass.c monitor_fdpass.h] | ||
| 1476 | [monitor_wrap.c ssh.c] | ||
| 1477 | make file descriptor passing code return an error rather than call fatal() | ||
| 1478 | when it encounters problems, and use this to make session multiplexing | ||
| 1479 | masters survive slaves failing to pass all stdio FDs; ok markus@ | ||
| 1480 | - djm@cvs.openbsd.org 2007/09/04 11:15:56 | ||
| 1481 | [ssh.c sshconnect.c sshconnect.h] | ||
| 1482 | make ssh(1)'s ConnectTimeout option apply to both the TCP connection and | ||
| 1483 | SSH banner exchange (previously it just covered the TCP connection). | ||
| 1484 | This allows callers of ssh(1) to better detect and deal with stuck servers | ||
| 1485 | that accept a TCP connection but don't progress the protocol, and also | ||
| 1486 | makes ConnectTimeout useful for connections via a ProxyCommand; | ||
| 1487 | feedback and "looks ok" markus@ | ||
| 1488 | - sobrado@cvs.openbsd.org 2007/09/09 11:38:01 | ||
| 1489 | [ssh-add.c ssh-agent.1 ssh-agent.c ssh-keygen.c] | ||
| 1490 | sort synopsis and options in ssh-agent(1); usage is lowercase | ||
| 1491 | ok jmc@ | ||
| 1492 | - stevesk@cvs.openbsd.org 2007/09/11 04:36:29 | ||
| 1493 | [sshpty.c] | ||
| 1494 | sort #include | ||
| 1495 | NB. RCS ID sync only | ||
| 1496 | - gilles@cvs.openbsd.org 2007/09/11 15:47:17 | ||
| 1497 | [session.c ssh-keygen.c sshlogin.c] | ||
| 1498 | use strcspn to properly overwrite '\n' in fgets returned buffer | ||
| 1499 | ok pyr@, ray@, millert@, moritz@, chl@ | ||
| 1500 | - stevesk@cvs.openbsd.org 2007/09/11 23:49:09 | ||
| 1501 | [sshpty.c] | ||
| 1502 | remove #if defined block not needed; ok markus@ dtucker@ | ||
| 1503 | NB. RCS ID sync only | ||
| 1504 | - stevesk@cvs.openbsd.org 2007/09/12 19:39:19 | ||
| 1505 | [umac.c] | ||
| 1506 | use xmalloc() and xfree(); ok markus@ pvalchev@ | ||
| 1507 | - djm@cvs.openbsd.org 2007/09/13 04:39:04 | ||
| 1508 | [sftp-server.c] | ||
| 1509 | fix incorrect test when setting syslog facility; from Jan Pechanec | ||
| 1510 | - djm@cvs.openbsd.org 2007/09/16 00:55:52 | ||
| 1511 | [sftp-client.c] | ||
| 1512 | use off_t instead of u_int64_t for file offsets, matching what the | ||
| 1513 | progressmeter code expects; bz #842 | ||
| 1514 | - (tim) [defines.h] Fix regression in long password support on OpenServer 6. | ||
| 1515 | Problem report and additional testing rac AT tenzing.org. | ||
| 1516 | |||
| 1517 | 20070914 | ||
| 1518 | - (dtucker) [openbsd-compat/bsd-asprintf.c] Plug mem leak in error path. | ||
| 1519 | Patch from Jan.Pechanec at sun com. | ||
| 1520 | |||
| 1521 | 20070910 | ||
| 1522 | - (dtucker) [openbsd-compat/regress/closefromtest.c] Bug #1358: Always | ||
| 1523 | return 0 on successful test. From David.Leonard at quest com. | ||
| 1524 | - (tim) [configure.ac] Autoconf didn't define HAVE_LIBIAF because we | ||
| 1525 | did a AC_CHECK_FUNCS within the AC_CHECK_LIB test. | ||
| 1526 | |||
| 1 | 20070817 | 1527 | 20070817 |
| 2 | - (dtucker) [sshd.8] Many Linux variants use a single "!" to denote locked | 1528 | - (dtucker) [sshd.8] Many Linux variants use a single "!" to denote locked |
| 3 | accounts and that's what the code looks for, so make man page and code | 1529 | accounts and that's what the code looks for, so make man page and code |
| @@ -3184,4 +4710,4 @@ | |||
| 3184 | OpenServer 6 and add osr5bigcrypt support so when someone migrates | 4710 | OpenServer 6 and add osr5bigcrypt support so when someone migrates |
| 3185 | passwords between UnixWare and OpenServer they will still work. OK dtucker@ | 4711 | passwords between UnixWare and OpenServer they will still work. OK dtucker@ |
| 3186 | 4712 | ||
| 3187 | $Id: ChangeLog,v 1.4738.2.1 2007/09/04 06:49:09 djm Exp $ | 4713 | $Id: ChangeLog,v 1.5095 2008/07/21 08:22:25 djm Exp $ |
diff --git a/ChangeLog.gssapi b/ChangeLog.gssapi index 010612c4c..5c110d0d8 100644 --- a/ChangeLog.gssapi +++ b/ChangeLog.gssapi | |||
| @@ -1,3 +1,9 @@ | |||
| 1 | 20080404 | ||
| 2 | - [ gss-serv.c ] | ||
| 3 | Add code to actually implement GSSAPIStrictAcceptCheck, which had somehow | ||
| 4 | been omitted from a previous version of this patch. Reported by Borislav | ||
| 5 | Stoichkov | ||
| 6 | |||
| 1 | 20070317 | 7 | 20070317 |
| 2 | - [ gss-serv-krb5.c ] | 8 | - [ gss-serv-krb5.c ] |
| 3 | Remove C99ism, where new_ccname was being declared in the middle of a | 9 | Remove C99ism, where new_ccname was being declared in the middle of a |
diff --git a/Makefile.in b/Makefile.in index a6b8aa693..2fdc7adba 100644 --- a/Makefile.in +++ b/Makefile.in | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | # $Id: Makefile.in,v 1.285 2007/06/11 04:01:42 djm Exp $ | 1 | # $Id: Makefile.in,v 1.297 2008/07/08 14:21:12 djm Exp $ |
| 2 | 2 | ||
| 3 | # uncomment if you run a non bourne compatable shell. Ie. csh | 3 | # uncomment if you run a non bourne compatable shell. Ie. csh |
| 4 | #SHELL = @SH@ | 4 | #SHELL = @SH@ |
| @@ -69,14 +69,14 @@ LIBSSH_OBJS=acss.o authfd.o authfile.o bufaux.o bufbn.o buffer.o \ | |||
| 69 | cipher-bf1.o cipher-ctr.o cipher-3des1.o cleanup.o \ | 69 | cipher-bf1.o cipher-ctr.o cipher-3des1.o cleanup.o \ |
| 70 | compat.o compress.o crc32.o deattack.o fatal.o hostfile.o \ | 70 | compat.o compress.o crc32.o deattack.o fatal.o hostfile.o \ |
| 71 | log.o match.o md-sha256.o moduli.o nchan.o packet.o \ | 71 | log.o match.o md-sha256.o moduli.o nchan.o packet.o \ |
| 72 | readpass.o rsa.o ttymodes.o xmalloc.o \ | 72 | readpass.o rsa.o ttymodes.o xmalloc.o addrmatch.o \ |
| 73 | atomicio.o key.o dispatch.o kex.o mac.o uidswap.o uuencode.o misc.o \ | 73 | atomicio.o key.o dispatch.o kex.o mac.o uidswap.o uuencode.o misc.o \ |
| 74 | monitor_fdpass.o rijndael.o ssh-dss.o ssh-rsa.o dh.o kexdh.o \ | 74 | monitor_fdpass.o rijndael.o ssh-dss.o ssh-rsa.o dh.o kexdh.o \ |
| 75 | kexgex.o kexdhc.o kexgexc.o scard.o msg.o progressmeter.o dns.o \ | 75 | kexgex.o kexdhc.o kexgexc.o scard.o msg.o progressmeter.o dns.o \ |
| 76 | entropy.o scard-opensc.o gss-genr.o umac.o kexgssc.o | 76 | entropy.o scard-opensc.o gss-genr.o umac.o kexgssc.o |
| 77 | 77 | ||
| 78 | SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \ | 78 | SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \ |
| 79 | sshconnect.o sshconnect1.o sshconnect2.o | 79 | sshconnect.o sshconnect1.o sshconnect2.o mux.o |
| 80 | 80 | ||
| 81 | SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o \ | 81 | SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o \ |
| 82 | sshpty.o sshlogin.o servconf.o serverloop.o \ | 82 | sshpty.o sshlogin.o servconf.o serverloop.o \ |
| @@ -88,10 +88,10 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o \ | |||
| 88 | auth-krb5.o \ | 88 | auth-krb5.o \ |
| 89 | auth2-gss.o gss-serv.o gss-serv-krb5.o kexgsss.o\ | 89 | auth2-gss.o gss-serv.o gss-serv-krb5.o kexgsss.o\ |
| 90 | loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \ | 90 | loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \ |
| 91 | audit.o audit-bsm.o platform.o | 91 | audit.o audit-bsm.o platform.o sftp-server.o sftp-common.o |
| 92 | 92 | ||
| 93 | MANPAGES = scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-rand-helper.8.out ssh-keysign.8.out ssh-vulnkey.1.out sshd_config.5.out ssh_config.5.out | 93 | MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-rand-helper.8.out ssh-keysign.8.out ssh-vulnkey.1.out sshd_config.5.out ssh_config.5.out |
| 94 | MANPAGES_IN = scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-rand-helper.8 ssh-keysign.8 ssh-vulnkey.1 sshd_config.5 ssh_config.5 | 94 | MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-rand-helper.8 ssh-keysign.8 ssh-vulnkey.1 sshd_config.5 ssh_config.5 |
| 95 | MANTYPE = @MANTYPE@ | 95 | MANTYPE = @MANTYPE@ |
| 96 | 96 | ||
| 97 | CONFIGFILES=sshd_config.out ssh_config.out moduli.out | 97 | CONFIGFILES=sshd_config.out ssh_config.out moduli.out |
| @@ -108,6 +108,7 @@ PATHSUBS = \ | |||
| 108 | -e 's|/etc/ssh/ssh_host_dsa_key|$(sysconfdir)/ssh_host_dsa_key|g' \ | 108 | -e 's|/etc/ssh/ssh_host_dsa_key|$(sysconfdir)/ssh_host_dsa_key|g' \ |
| 109 | -e 's|/etc/ssh/ssh_host_rsa_key|$(sysconfdir)/ssh_host_rsa_key|g' \ | 109 | -e 's|/etc/ssh/ssh_host_rsa_key|$(sysconfdir)/ssh_host_rsa_key|g' \ |
| 110 | -e 's|/var/run/sshd.pid|$(piddir)/sshd.pid|g' \ | 110 | -e 's|/var/run/sshd.pid|$(piddir)/sshd.pid|g' \ |
| 111 | -e 's|/etc/moduli|$(sysconfdir)/moduli|g' \ | ||
| 111 | -e 's|/etc/ssh/moduli|$(sysconfdir)/moduli|g' \ | 112 | -e 's|/etc/ssh/moduli|$(sysconfdir)/moduli|g' \ |
| 112 | -e 's|/etc/ssh/sshrc|$(sysconfdir)/sshrc|g' \ | 113 | -e 's|/etc/ssh/sshrc|$(sysconfdir)/sshrc|g' \ |
| 113 | -e 's|/usr/X11R6/bin/xauth|$(XAUTH_PATH)|g' \ | 114 | -e 's|/usr/X11R6/bin/xauth|$(XAUTH_PATH)|g' \ |
| @@ -158,8 +159,8 @@ ssh-keysign$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keysign.o | |||
| 158 | ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o | 159 | ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o |
| 159 | $(LD) -o $@ ssh-keyscan.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS) | 160 | $(LD) -o $@ ssh-keyscan.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS) |
| 160 | 161 | ||
| 161 | sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-common.o sftp-server.o | 162 | sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-common.o sftp-server.o sftp-server-main.o |
| 162 | $(LD) -o $@ sftp-server.o sftp-common.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) | 163 | $(LD) -o $@ sftp-server.o sftp-common.o sftp-server-main.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) |
| 163 | 164 | ||
| 164 | sftp$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-client.o sftp-common.o sftp-glob.o progressmeter.o | 165 | sftp$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-client.o sftp-common.o sftp-glob.o progressmeter.o |
| 165 | $(LD) -o $@ progressmeter.o sftp.o sftp-client.o sftp-common.o sftp-glob.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LIBEDIT) | 166 | $(LD) -o $@ progressmeter.o sftp.o sftp-client.o sftp-common.o sftp-glob.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LIBEDIT) |
| @@ -276,6 +277,7 @@ install-files: scard-install | |||
| 276 | $(INSTALL) -m 644 ssh-agent.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-agent.1 | 277 | $(INSTALL) -m 644 ssh-agent.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-agent.1 |
| 277 | $(INSTALL) -m 644 ssh-keygen.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-keygen.1 | 278 | $(INSTALL) -m 644 ssh-keygen.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-keygen.1 |
| 278 | $(INSTALL) -m 644 ssh-keyscan.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-keyscan.1 | 279 | $(INSTALL) -m 644 ssh-keyscan.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-keyscan.1 |
| 280 | $(INSTALL) -m 644 moduli.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/moduli.5 | ||
| 279 | $(INSTALL) -m 644 sshd_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/sshd_config.5 | 281 | $(INSTALL) -m 644 sshd_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/sshd_config.5 |
| 280 | $(INSTALL) -m 644 ssh_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/ssh_config.5 | 282 | $(INSTALL) -m 644 ssh_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/ssh_config.5 |
| 281 | $(INSTALL) -m 644 sshd.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sshd.8 | 283 | $(INSTALL) -m 644 sshd.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sshd.8 |
| @@ -388,7 +390,7 @@ uninstall: | |||
| 388 | -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8 | 390 | -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8 |
| 389 | -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1 | 391 | -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1 |
| 390 | 392 | ||
| 391 | tests: $(TARGETS) | 393 | tests interop-tests: $(TARGETS) |
| 392 | BUILDDIR=`pwd`; \ | 394 | BUILDDIR=`pwd`; \ |
| 393 | [ -d `pwd`/regress ] || mkdir -p `pwd`/regress; \ | 395 | [ -d `pwd`/regress ] || mkdir -p `pwd`/regress; \ |
| 394 | [ -f `pwd`/regress/Makefile ] || \ | 396 | [ -f `pwd`/regress/Makefile ] || \ |
| @@ -402,6 +404,10 @@ tests: $(TARGETS) | |||
| 402 | TEST_SSH_SSHKEYSCAN="$${BUILDDIR}/ssh-keyscan"; \ | 404 | TEST_SSH_SSHKEYSCAN="$${BUILDDIR}/ssh-keyscan"; \ |
| 403 | TEST_SSH_SFTP="$${BUILDDIR}/sftp"; \ | 405 | TEST_SSH_SFTP="$${BUILDDIR}/sftp"; \ |
| 404 | TEST_SSH_SFTPSERVER="$${BUILDDIR}/sftp-server"; \ | 406 | TEST_SSH_SFTPSERVER="$${BUILDDIR}/sftp-server"; \ |
| 407 | TEST_SSH_PLINK="plink"; \ | ||
| 408 | TEST_SSH_PUTTYGEN="puttygen"; \ | ||
| 409 | TEST_SSH_CONCH="conch"; \ | ||
| 410 | TEST_SSH_IPV6="@TEST_SSH_IPV6@" ; \ | ||
| 405 | cd $(srcdir)/regress || exit $$?; \ | 411 | cd $(srcdir)/regress || exit $$?; \ |
| 406 | $(MAKE) \ | 412 | $(MAKE) \ |
| 407 | .OBJDIR="$${BUILDDIR}/regress" \ | 413 | .OBJDIR="$${BUILDDIR}/regress" \ |
| @@ -418,8 +424,12 @@ tests: $(TARGETS) | |||
| 418 | TEST_SSH_SSHKEYSCAN="$${TEST_SSH_SSHKEYSCAN}" \ | 424 | TEST_SSH_SSHKEYSCAN="$${TEST_SSH_SSHKEYSCAN}" \ |
| 419 | TEST_SSH_SFTP="$${TEST_SSH_SFTP}" \ | 425 | TEST_SSH_SFTP="$${TEST_SSH_SFTP}" \ |
| 420 | TEST_SSH_SFTPSERVER="$${TEST_SSH_SFTPSERVER}" \ | 426 | TEST_SSH_SFTPSERVER="$${TEST_SSH_SFTPSERVER}" \ |
| 427 | TEST_SSH_PLINK="$${TEST_SSH_PLINK}" \ | ||
| 428 | TEST_SSH_PUTTYGEN="$${TEST_SSH_PUTTYGEN}" \ | ||
| 429 | TEST_SSH_CONCH="$${TEST_SSH_CONCH}" \ | ||
| 430 | TEST_SSH_IPV6="@TEST_SSH_IPV6@" \ | ||
| 421 | EXEEXT="$(EXEEXT)" \ | 431 | EXEEXT="$(EXEEXT)" \ |
| 422 | $@ | 432 | $@ && echo all tests passed |
| 423 | 433 | ||
| 424 | compat-tests: $(LIBCOMPAT) | 434 | compat-tests: $(LIBCOMPAT) |
| 425 | (cd openbsd-compat/regress && $(MAKE)) | 435 | (cd openbsd-compat/regress && $(MAKE)) |
diff --git a/PROTOCOL b/PROTOCOL new file mode 100644 index 000000000..37fd536d9 --- /dev/null +++ b/PROTOCOL | |||
| @@ -0,0 +1,243 @@ | |||
| 1 | This documents OpenSSH's deviations and extensions to the published SSH | ||
| 2 | protocol. | ||
| 3 | |||
| 4 | Note that OpenSSH's sftp and sftp-server implement revision 3 of the SSH | ||
| 5 | filexfer protocol described in: | ||
| 6 | |||
| 7 | http://www.openssh.com/txt/draft-ietf-secsh-filexfer-02.txt | ||
| 8 | |||
| 9 | Features from newer versions of the draft are not supported, unless | ||
| 10 | explicitly implemented as extensions described below. | ||
| 11 | |||
| 12 | The protocol used by OpenSSH's ssh-agent is described in the file | ||
| 13 | PROTOCOL.agent | ||
| 14 | |||
| 15 | 1. transport: Protocol 2 MAC algorithm "umac-64@openssh.com" | ||
| 16 | |||
| 17 | This is a new transport-layer MAC method using the UMAC algorithm | ||
| 18 | (rfc4418). This method is identical to the "umac-64" method documented | ||
| 19 | in: | ||
| 20 | |||
| 21 | http://www.openssh.com/txt/draft-miller-secsh-umac-01.txt | ||
| 22 | |||
| 23 | 2. transport: Protocol 2 compression algorithm "zlib@openssh.com" | ||
| 24 | |||
| 25 | This transport-layer compression method uses the zlib compression | ||
| 26 | algorithm (identical to the "zlib" method in rfc4253), but delays the | ||
| 27 | start of compression until after authentication has completed. This | ||
| 28 | avoids exposing compression code to attacks from unauthenticated users. | ||
| 29 | |||
| 30 | The method is documented in: | ||
| 31 | |||
| 32 | http://www.openssh.com/txt/draft-miller-secsh-compression-delayed-00.txt | ||
| 33 | |||
| 34 | 3. connection: Channel write close extension "eow@openssh.com" | ||
| 35 | |||
| 36 | The SSH connection protocol (rfc4254) provides the SSH_MSG_CHANNEL_EOF | ||
| 37 | message to allow an endpoint to signal its peer that it will send no | ||
| 38 | more data over a channel. Unfortunately, there is no symmetric way for | ||
| 39 | an endpoint to request that its peer should cease sending data to it | ||
| 40 | while still keeping the channel open for the endpoint to send data to | ||
| 41 | the peer. | ||
| 42 | |||
| 43 | This is desirable, since it saves the transmission of data that would | ||
| 44 | otherwise need to be discarded and it allows an endpoint to signal local | ||
| 45 | processes of the condition, e.g. by closing the corresponding file | ||
| 46 | descriptor. | ||
| 47 | |||
| 48 | OpenSSH implements a channel extension message to perform this | ||
| 49 | signalling: "eow@openssh.com" (End Of Write). This message is sent by | ||
| 50 | an endpoint when the local output of a session channel is closed or | ||
| 51 | experiences a write error. The message is formatted as follows: | ||
| 52 | |||
| 53 | byte SSH_MSG_CHANNEL_REQUEST | ||
| 54 | uint32 recipient channel | ||
| 55 | string "eow@openssh.com" | ||
| 56 | boolean FALSE | ||
| 57 | |||
| 58 | On receiving this message, the peer SHOULD cease sending data of | ||
| 59 | the channel and MAY signal the process from which the channel data | ||
| 60 | originates (e.g. by closing its read file descriptor). | ||
| 61 | |||
| 62 | As with the symmetric SSH_MSG_CHANNEL_EOF message, the channel does | ||
| 63 | remain open after a "eow@openssh.com" has been sent and more data may | ||
| 64 | still be sent in the other direction. This message does not consume | ||
| 65 | window space and may be sent even if no window space is available. | ||
| 66 | |||
| 67 | 4. connection: disallow additional sessions extension | ||
| 68 | "no-more-sessions@openssh.com" | ||
| 69 | |||
| 70 | Most SSH connections will only ever request a single session, but a | ||
| 71 | attacker may abuse a running ssh client to surreptitiously open | ||
| 72 | additional sessions under their control. OpenSSH provides a global | ||
| 73 | request "no-more-sessions@openssh.com" to mitigate this attack. | ||
| 74 | |||
| 75 | When an OpenSSH client expects that it will never open another session | ||
| 76 | (i.e. it has been started with connection multiplexing disabled), it | ||
| 77 | will send the following global request: | ||
| 78 | |||
| 79 | byte SSH_MSG_GLOBAL_REQUEST | ||
| 80 | string "no-more-sessions@openssh.com" | ||
| 81 | char want-reply | ||
| 82 | |||
| 83 | On receipt of such a message, an OpenSSH server will refuse to open | ||
| 84 | future channels of type "session" and instead immediately abort the | ||
| 85 | connection. | ||
| 86 | |||
| 87 | Note that this is not a general defence against compromised clients | ||
| 88 | (that is impossible), but it thwarts a simple attack. | ||
| 89 | |||
| 90 | 5. connection: Tunnel forward extension "tun@openssh.com" | ||
| 91 | |||
| 92 | OpenSSH supports layer 2 and layer 3 tunnelling via the "tun@openssh.com" | ||
| 93 | channel type. This channel type supports forwarding of network packets | ||
| 94 | with datagram boundaries intact between endpoints equipped with | ||
| 95 | interfaces like the BSD tun(4) device. Tunnel forwarding channels are | ||
| 96 | requested by the client with the following packet: | ||
| 97 | |||
| 98 | byte SSH_MSG_CHANNEL_OPEN | ||
| 99 | string "tun@openssh.com" | ||
| 100 | uint32 sender channel | ||
| 101 | uint32 initial window size | ||
| 102 | uint32 maximum packet size | ||
| 103 | uint32 tunnel mode | ||
| 104 | uint32 remote unit number | ||
| 105 | |||
| 106 | The "tunnel mode" parameter specifies whether the tunnel should forward | ||
| 107 | layer 2 frames or layer 3 packets. It may take one of the following values: | ||
| 108 | |||
| 109 | SSH_TUNMODE_POINTOPOINT 1 /* layer 3 packets */ | ||
| 110 | SSH_TUNMODE_ETHERNET 2 /* layer 2 frames */ | ||
| 111 | |||
| 112 | The "tunnel unit number" specifies the remote interface number, or may | ||
| 113 | be zero to allow the server to automatically chose an interface. A server | ||
| 114 | that is not willing to open a client-specified unit should refuse the | ||
| 115 | request with a SSH_MSG_CHANNEL_OPEN_FAILURE error. On successful open, | ||
| 116 | the server should reply with SSH_MSG_CHANNEL_OPEN_SUCCESS. | ||
| 117 | |||
| 118 | Once established the client and server may exchange packet or frames | ||
| 119 | over the tunnel channel by encapsulating them in SSH protocol strings | ||
| 120 | and sending them as channel data. This ensures that packet boundaries | ||
| 121 | are kept intact. Specifically, packets are transmitted using normal | ||
| 122 | SSH_MSG_CHANNEL_DATA packets: | ||
| 123 | |||
| 124 | byte SSH_MSG_CHANNEL_DATA | ||
| 125 | uint32 recipient channel | ||
| 126 | string data | ||
| 127 | |||
| 128 | The contents of the "data" field for layer 3 packets is: | ||
| 129 | |||
| 130 | uint32 packet length | ||
| 131 | uint32 address family | ||
| 132 | byte[packet length - 4] packet data | ||
| 133 | |||
| 134 | The "address family" field identifies the type of packet in the message. | ||
| 135 | It may be one of: | ||
| 136 | |||
| 137 | SSH_TUN_AF_INET 2 /* IPv4 */ | ||
| 138 | SSH_TUN_AF_INET6 24 /* IPv6 */ | ||
| 139 | |||
| 140 | The "packet data" field consists of the IPv4/IPv6 datagram itself | ||
| 141 | without any link layer header. | ||
| 142 | |||
| 143 | The contents of the "data" field for layer 3 packets is: | ||
| 144 | |||
| 145 | uint32 packet length | ||
| 146 | byte[packet length] frame | ||
| 147 | |||
| 148 | The "frame" field contains an IEEE 802.3 Ethernet frame, including | ||
| 149 | header. | ||
| 150 | |||
| 151 | 6. sftp: Reversal of arguments to SSH_FXP_SYMLINK | ||
| 152 | |||
| 153 | When OpenSSH's sftp-server was implemented, the order of the arguments | ||
| 154 | to the SSH_FXP_SYMLINK method was inadvertently reversed. Unfortunately, | ||
| 155 | the reversal was not noticed until the server was widely deployed. Since | ||
| 156 | fixing this to follow the specification would cause incompatibility, the | ||
| 157 | current order was retained. For correct operation, clients should send | ||
| 158 | SSH_FXP_SYMLINK as follows: | ||
| 159 | |||
| 160 | uint32 id | ||
| 161 | string targetpath | ||
| 162 | string linkpath | ||
| 163 | |||
| 164 | 7. sftp: Server extension announcement in SSH_FXP_VERSION | ||
| 165 | |||
| 166 | OpenSSH's sftp-server lists the extensions it supports using the | ||
| 167 | standard extension announcement mechanism in the SSH_FXP_VERSION server | ||
| 168 | hello packet: | ||
| 169 | |||
| 170 | uint32 3 /* protocol version */ | ||
| 171 | string ext1-name | ||
| 172 | string ext1-version | ||
| 173 | string ext2-name | ||
| 174 | string ext2-version | ||
| 175 | ... | ||
| 176 | string extN-name | ||
| 177 | string extN-version | ||
| 178 | |||
| 179 | Each extension reports its integer version number as an ASCII encoded | ||
| 180 | string, e.g. "1". The version will be incremented if the extension is | ||
| 181 | ever changed in an incompatible way. The server MAY advertise the same | ||
| 182 | extension with multiple versions (though this is unlikely). Clients MUST | ||
| 183 | check the version number before attempting to use the extension. | ||
| 184 | |||
| 185 | 8. sftp: Extension request "posix-rename@openssh.com" | ||
| 186 | |||
| 187 | This operation provides a rename operation with POSIX semantics, which | ||
| 188 | are different to those provided by the standard SSH_FXP_RENAME in | ||
| 189 | draft-ietf-secsh-filexfer-02.txt. This request is implemented as a | ||
| 190 | SSH_FXP_EXTENDED request with the following format: | ||
| 191 | |||
| 192 | uint32 id | ||
| 193 | string "posix-rename@openssh.com" | ||
| 194 | string oldpath | ||
| 195 | string newpath | ||
| 196 | |||
| 197 | On receiving this request the server will perform the POSIX operation | ||
| 198 | rename(oldpath, newpath) and will respond with a SSH_FXP_STATUS message. | ||
| 199 | This extension is advertised in the SSH_FXP_VERSION hello with version | ||
| 200 | "1". | ||
| 201 | |||
| 202 | 9. sftp: Extension requests "statvfs@openssh.com" and | ||
| 203 | "fstatvfs@openssh.com" | ||
| 204 | |||
| 205 | These requests correspond to the statvfs and fstatvfs POSIX system | ||
| 206 | interfaces. The "statvfs@openssh.com" request operates on an explicit | ||
| 207 | pathname, and is formatted as follows: | ||
| 208 | |||
| 209 | uint32 id | ||
| 210 | string "statvfs@openssh.com" | ||
| 211 | string path | ||
| 212 | |||
| 213 | The "fstatvfs@openssh.com" operates on an open file handle: | ||
| 214 | |||
| 215 | uint32 id | ||
| 216 | string "fstatvfs@openssh.com" | ||
| 217 | string handle | ||
| 218 | |||
| 219 | These requests return a SSH_FXP_STATUS reply on failure. On success they | ||
| 220 | return the following SSH_FXP_EXTENDED_REPLY reply: | ||
| 221 | |||
| 222 | uint32 id | ||
| 223 | uint64 f_bsize /* file system block size */ | ||
| 224 | uint64 f_frsize /* fundamental fs block size */ | ||
| 225 | uint64 f_blocks /* number of blocks (unit f_frsize) */ | ||
| 226 | uint64 f_bfree /* free blocks in file system */ | ||
| 227 | uint64 f_bavail /* free blocks for non-root */ | ||
| 228 | uint64 f_files /* total file inodes */ | ||
| 229 | uint64 f_ffree /* free file inodes */ | ||
| 230 | uint64 f_favail /* free file inodes for to non-root */ | ||
| 231 | uint64 f_fsid /* file system id */ | ||
| 232 | uint64 f_flag /* bit mask of f_flag values */ | ||
| 233 | uint64 f_namemax /* maximum filename length */ | ||
| 234 | |||
| 235 | The values of the f_flag bitmask are as follows: | ||
| 236 | |||
| 237 | #define SSH_FXE_STATVFS_ST_RDONLY 0x1 /* read-only */ | ||
| 238 | #define SSH_FXE_STATVFS_ST_NOSUID 0x2 /* no setuid */ | ||
| 239 | |||
| 240 | Both the "statvfs@openssh.com" and "fstatvfs@openssh.com" extensions are | ||
| 241 | advertised in the SSH_FXP_VERSION hello with version "2". | ||
| 242 | |||
| 243 | $OpenBSD: PROTOCOL,v 1.11 2008/07/05 05:16:01 djm Exp $ | ||
diff --git a/PROTOCOL.agent b/PROTOCOL.agent new file mode 100644 index 000000000..49adbdd5c --- /dev/null +++ b/PROTOCOL.agent | |||
| @@ -0,0 +1,516 @@ | |||
| 1 | This describes the protocol used by OpenSSH's ssh-agent. | ||
| 2 | |||
| 3 | OpenSSH's agent supports managing keys for the standard SSH protocol | ||
| 4 | 2 as well as the legacy SSH protocol 1. Support for these key types | ||
| 5 | is almost completely disjoint - in all but a few cases, operations on | ||
| 6 | protocol 2 keys cannot see or affect protocol 1 keys and vice-versa. | ||
| 7 | |||
| 8 | Protocol 1 and protocol 2 keys are separated because of the differing | ||
| 9 | cryptographic usage: protocol 1 private RSA keys are used to decrypt | ||
| 10 | challenges that were encrypted with the corresponding public key, | ||
| 11 | whereas protocol 2 RSA private keys are used to sign challenges with | ||
| 12 | a private key for verification with the corresponding public key. It | ||
| 13 | is considered unsound practice to use the same key for signing and | ||
| 14 | encryption. | ||
| 15 | |||
| 16 | With a couple of exceptions, the protocol message names used in this | ||
| 17 | document indicate which type of key the message relates to. SSH_* | ||
| 18 | messages refer to protocol 1 keys only. SSH2_* messages refer to | ||
| 19 | protocol 2 keys. Furthermore, the names also indicate whether the | ||
| 20 | message is a request to the agent (*_AGENTC_*) or a reply from the | ||
| 21 | agent (*_AGENT_*). Section 3 below contains the mapping of the | ||
| 22 | protocol message names to their integer values. | ||
| 23 | |||
| 24 | 1. Data types | ||
| 25 | |||
| 26 | Because of support for legacy SSH protocol 1 keys, OpenSSH's agent | ||
| 27 | protocol makes use of some data types not defined in RFC 4251. | ||
| 28 | |||
| 29 | 1.1 uint16 | ||
| 30 | |||
| 31 | The "uint16" data type is a simple MSB-first 16 bit unsigned integer | ||
| 32 | encoded in two bytes. | ||
| 33 | |||
| 34 | 1.2 mpint1 | ||
| 35 | |||
| 36 | The "mpint1" type represents an arbitrary precision integer (bignum). | ||
| 37 | Its format is as follows: | ||
| 38 | |||
| 39 | uint16 bits | ||
| 40 | byte[(bits + 7) / 8] bignum | ||
| 41 | |||
| 42 | "bignum" contains an unsigned arbitrary precision integer encoded as | ||
| 43 | eight bits per byte in big-endian (MSB first) format. | ||
| 44 | |||
| 45 | Note the difference between the "mpint1" encoding and the "mpint" | ||
| 46 | encoding defined in RFC 4251. Also note that the length of the encoded | ||
| 47 | integer is specified in bits, not bytes and that the byte length of | ||
| 48 | the integer must be calculated by rounding up the number of bits to the | ||
| 49 | nearest eight. | ||
| 50 | |||
| 51 | 2. Protocol Messages | ||
| 52 | |||
| 53 | All protocol messages are prefixed with their length in bytes, encoded | ||
| 54 | as a 32 bit unsigned integer. Specifically: | ||
| 55 | |||
| 56 | uint32 message_length | ||
| 57 | byte[message_length] message | ||
| 58 | |||
| 59 | The following message descriptions refer only to the content the | ||
| 60 | "message" field. | ||
| 61 | |||
| 62 | 2.1 Generic server responses | ||
| 63 | |||
| 64 | The following generic messages may be sent by the server in response to | ||
| 65 | requests from the client. On success the agent may reply either with: | ||
| 66 | |||
| 67 | byte SSH_AGENT_SUCCESS | ||
| 68 | |||
| 69 | or a request-specific success message. | ||
| 70 | |||
| 71 | On failure, the agent may reply with: | ||
| 72 | |||
| 73 | byte SSH_AGENT_FAILURE | ||
| 74 | |||
| 75 | SSH_AGENT_FAILURE messages are also sent in reply to unknown request | ||
| 76 | types. | ||
| 77 | |||
| 78 | 2.2 Adding keys to the agent | ||
| 79 | |||
| 80 | Keys are added to the agent using the SSH_AGENTC_ADD_RSA_IDENTITY and | ||
| 81 | SSH2_AGENTC_ADD_IDENTITY requests for protocol 1 and protocol 2 keys | ||
| 82 | respectively. | ||
| 83 | |||
| 84 | Two variants of these requests are SSH_AGENTC_ADD_RSA_ID_CONSTRAINED | ||
| 85 | and SSH2_AGENTC_ADD_ID_CONSTRAINED - these add keys with optional | ||
| 86 | "constraints" on their usage. | ||
| 87 | |||
| 88 | OpenSSH may be built with support for keys hosted on a smartcard | ||
| 89 | or other hardware security module. These keys may be added | ||
| 90 | to the agent using the SSH_AGENTC_ADD_SMARTCARD_KEY and | ||
| 91 | SSH_AGENTC_ADD_SMARTCARD_KEY_CONSTRAINED requests. | ||
| 92 | |||
| 93 | 2.2.1 Key constraints | ||
| 94 | |||
| 95 | The OpenSSH agent supports some basic optional constraints on key usage. | ||
| 96 | At present there are two constraints defined. | ||
| 97 | |||
| 98 | The first constraint limits the validity duration of a key. It is | ||
| 99 | encoded as: | ||
| 100 | |||
| 101 | byte SSH_AGENT_CONSTRAIN_LIFETIME | ||
| 102 | uint32 seconds | ||
| 103 | |||
| 104 | Where "seconds" contains the number of seconds that the key shall remain | ||
| 105 | valid measured from the moment that the agent receives it. After the | ||
| 106 | validity period has expired, OpenSSH's agent will erase these keys from | ||
| 107 | memory. | ||
| 108 | |||
| 109 | The second constraint requires the agent to seek explicit user | ||
| 110 | confirmation before performing private key operations with the loaded | ||
| 111 | key. This constraint is encoded as: | ||
| 112 | |||
| 113 | byte SSH_AGENT_CONSTRAIN_CONFIRM | ||
| 114 | |||
| 115 | Zero or more constraints may be specified when adding a key with one | ||
| 116 | of the *_CONSTRAINED requests. Multiple constraints are appended | ||
| 117 | consecutively to the end of the request: | ||
| 118 | |||
| 119 | byte constraint1_type | ||
| 120 | .... constraint1_data | ||
| 121 | byte constraint2_type | ||
| 122 | .... constraint2_data | ||
| 123 | .... | ||
| 124 | byte constraintN_type | ||
| 125 | .... constraintN_data | ||
| 126 | |||
| 127 | Such a sequence of zero or more constraints will be referred to below | ||
| 128 | as "constraint[]". Agents may determine whether there are constraints | ||
| 129 | by checking whether additional data exists in the "add key" request | ||
| 130 | after the key data itself. OpenSSH will refuse to add a key if it | ||
| 131 | contains unknown constraints. | ||
| 132 | |||
| 133 | 2.2.2 Add protocol 1 key | ||
| 134 | |||
| 135 | A client may add a protocol 1 key to an agent with the following | ||
| 136 | request: | ||
| 137 | |||
| 138 | byte SSH_AGENTC_ADD_RSA_IDENTITY or | ||
| 139 | SSH_AGENTC_ADD_RSA_ID_CONSTRAINED | ||
| 140 | uint32 ignored | ||
| 141 | mpint1 rsa_n | ||
| 142 | mpint1 rsa_e | ||
| 143 | mpint1 rsa_d | ||
| 144 | mpint1 rsa_iqmp | ||
| 145 | mpint1 rsa_q | ||
| 146 | mpint1 rsa_p | ||
| 147 | string key_comment | ||
| 148 | constraint[] key_constraints | ||
| 149 | |||
| 150 | Note that there is some redundancy in the key parameters; a key could be | ||
| 151 | fully specified using just rsa_q, rsa_p and rsa_e at the cost of extra | ||
| 152 | computation. | ||
| 153 | |||
| 154 | "key_constraints" may only be present if the request type is | ||
| 155 | SSH_AGENTC_ADD_RSA_IDENTITY. | ||
| 156 | |||
| 157 | The agent will reply with a SSH_AGENT_SUCCESS if the key has been | ||
| 158 | successfully added or a SSH_AGENT_FAILURE if an error occurred. | ||
| 159 | |||
| 160 | 2.2.3 Add protocol 2 key | ||
| 161 | |||
| 162 | The OpenSSH agent supports DSA and RSA keys for protocol 2. DSA keys may | ||
| 163 | be added using the following request | ||
| 164 | |||
| 165 | byte SSH2_AGENTC_ADD_IDENTITY or | ||
| 166 | SSH2_AGENTC_ADD_ID_CONSTRAINED | ||
| 167 | string "ssh-dss" | ||
| 168 | mpint dsa_p | ||
| 169 | mpint dsa_q | ||
| 170 | mpint dsa_g | ||
| 171 | mpint dsa_public_key | ||
| 172 | mpint dsa_private_key | ||
| 173 | string key_comment | ||
| 174 | constraint[] key_constraints | ||
| 175 | |||
| 176 | RSA keys may be added with this request: | ||
| 177 | |||
| 178 | byte SSH2_AGENTC_ADD_IDENTITY or | ||
| 179 | SSH2_AGENTC_ADD_ID_CONSTRAINED | ||
| 180 | string "ssh-rsa" | ||
| 181 | mpint rsa_n | ||
| 182 | mpint rsa_e | ||
| 183 | mpint rsa_d | ||
| 184 | mpint rsa_iqmp | ||
| 185 | mpint rsa_p | ||
| 186 | mpint rsa_q | ||
| 187 | string key_comment | ||
| 188 | constraint[] key_constraints | ||
| 189 | |||
| 190 | Note that the 'rsa_p' and 'rsa_q' parameters are sent in the reverse | ||
| 191 | order to the protocol 1 add keys message. As with the corresponding | ||
| 192 | protocol 1 "add key" request, the private key is overspecified to avoid | ||
| 193 | redundant processing. | ||
| 194 | |||
| 195 | For both DSA and RSA key add requests, "key_constraints" may only be | ||
| 196 | present if the request type is SSH2_AGENTC_ADD_ID_CONSTRAINED. | ||
| 197 | |||
| 198 | The agent will reply with a SSH_AGENT_SUCCESS if the key has been | ||
| 199 | successfully added or a SSH_AGENT_FAILURE if an error occurred. | ||
| 200 | |||
| 201 | 2.2.4 Loading keys from a smartcard | ||
| 202 | |||
| 203 | The OpenSSH agent may have optional smartcard support built in to it. If | ||
| 204 | so, it supports an operation to load keys from a smartcard. Technically, | ||
| 205 | only the public components of the keys are loaded into the agent so | ||
| 206 | this operation really arranges for future private key operations to be | ||
| 207 | delegated to the smartcard. | ||
| 208 | |||
| 209 | byte SSH_AGENTC_ADD_SMARTCARD_KEY or | ||
| 210 | SSH_AGENTC_ADD_SMARTCARD_KEY_CONSTRAINED | ||
| 211 | string reader_id | ||
| 212 | string pin | ||
| 213 | constraint[] key_constraints | ||
| 214 | |||
| 215 | "reader_id" is an identifier to a smartcard reader and "pin" | ||
| 216 | is a PIN or passphrase used to unlock the private key(s) on the | ||
| 217 | device. "key_constraints" may only be present if the request type is | ||
| 218 | SSH_AGENTC_ADD_SMARTCARD_KEY_CONSTRAINED. | ||
| 219 | |||
| 220 | This operation may load all SSH keys that are unlocked using the | ||
| 221 | "pin" on the specified reader. The type of key loaded (protocol 1 | ||
| 222 | or protocol 2) will be specified by the smartcard itself, it is not | ||
| 223 | client-specified. | ||
| 224 | |||
| 225 | The agent will reply with a SSH_AGENT_SUCCESS if one or more keys have | ||
| 226 | been successfully loaded or a SSH_AGENT_FAILURE if an error occurred. | ||
| 227 | The agent will also return SSH_AGENT_FAILURE if it does not support | ||
| 228 | smartcards. | ||
| 229 | |||
| 230 | 2.3 Removing multiple keys | ||
| 231 | |||
| 232 | A client may request that an agent delete all protocol 1 keys using the | ||
| 233 | following request: | ||
| 234 | |||
| 235 | byte SSH_AGENTC_REMOVE_ALL_RSA_IDENTITIES | ||
| 236 | |||
| 237 | This message requests the deletion of all protocol 2 keys: | ||
| 238 | |||
| 239 | byte SSH2_AGENTC_REMOVE_ALL_IDENTITIES | ||
| 240 | |||
| 241 | On success, the agent will delete all keys of the requested type and | ||
| 242 | reply with a SSH_AGENT_SUCCESS message. If an error occurred, the agent | ||
| 243 | will reply with SSH_AGENT_FAILURE. | ||
| 244 | |||
| 245 | Note that, to delete all keys (both protocol 1 and 2), a client | ||
| 246 | must send both a SSH_AGENTC_REMOVE_ALL_RSA_IDENTITIES and a | ||
| 247 | SSH2_AGENTC_REMOVE_ALL_IDENTITIES request. | ||
| 248 | |||
| 249 | 2.4 Removing specific keys | ||
| 250 | |||
| 251 | 2.4.1 Removing a protocol 1 key | ||
| 252 | |||
| 253 | Removal of a protocol 1 key may be requested with the following message: | ||
| 254 | |||
| 255 | byte SSH_AGENTC_REMOVE_RSA_IDENTITY | ||
| 256 | uint32 key_bits | ||
| 257 | mpint1 rsa_e | ||
| 258 | mpint1 rsa_n | ||
| 259 | |||
| 260 | Note that key_bits is strictly redundant, as it may be inferred by the | ||
| 261 | length of rsa_n. | ||
| 262 | |||
| 263 | The agent will delete any private key matching the specified public key | ||
| 264 | and return SSH_AGENT_SUCCESS. If no such key was found, the agent will | ||
| 265 | return SSH_AGENT_FAILURE. | ||
| 266 | |||
| 267 | 2.4.2 Removing a protocol 2 key | ||
| 268 | |||
| 269 | Protocol 2 keys may be removed with the following request: | ||
| 270 | |||
| 271 | byte SSH2_AGENTC_REMOVE_IDENTITY | ||
| 272 | string key_blob | ||
| 273 | |||
| 274 | Where "key_blob" is encoded as per RFC 4253 section 6.6 "Public Key | ||
| 275 | Algorithms" for either of the supported key types: "ssh-dss" or | ||
| 276 | "ssh-rsa". | ||
| 277 | |||
| 278 | The agent will delete any private key matching the specified public key | ||
| 279 | and return SSH_AGENT_SUCCESS. If no such key was found, the agent will | ||
| 280 | return SSH_AGENT_FAILURE. | ||
| 281 | |||
| 282 | 2.4.3 Removing keys loaded from a smartcard | ||
| 283 | |||
| 284 | A client may request that a server remove one or more smartcard-hosted | ||
| 285 | keys using this message: | ||
| 286 | |||
| 287 | byte SSH_AGENTC_REMOVE_SMARTCARD_KEY | ||
| 288 | string reader_id | ||
| 289 | string pin | ||
| 290 | |||
| 291 | "reader_id" the an identifier to a smartcard reader and "pin" is a PIN | ||
| 292 | or passphrase used to unlock the private key(s) on the device. | ||
| 293 | |||
| 294 | When this message is received, and if the agent supports | ||
| 295 | smartcard-hosted keys, it will delete all keys that are hosted on the | ||
| 296 | specified smartcard that may be accessed with the given "pin". | ||
| 297 | |||
| 298 | The agent will reply with a SSH_AGENT_SUCCESS if one or more keys have | ||
| 299 | been successfully removed or a SSH_AGENT_FAILURE if an error occurred. | ||
| 300 | The agent will also return SSH_AGENT_FAILURE if it does not support | ||
| 301 | smartcards. | ||
| 302 | |||
| 303 | 2.5 Requesting a list of known keys | ||
| 304 | |||
| 305 | An agent may be requested to list which keys it holds. Different | ||
| 306 | requests exist for protocol 1 and protocol 2 keys. | ||
| 307 | |||
| 308 | 2.5.1 Requesting a list of protocol 1 keys | ||
| 309 | |||
| 310 | To request a list of protocol 1 keys that are held in the agent, a | ||
| 311 | client may send the following message: | ||
| 312 | |||
| 313 | byte SSH_AGENTC_REQUEST_RSA_IDENTITIES | ||
| 314 | |||
| 315 | The agent will reply with the following message: | ||
| 316 | |||
| 317 | byte SSH_AGENT_RSA_IDENTITIES_ANSWER | ||
| 318 | uint32 num_keys | ||
| 319 | |||
| 320 | Followed by zero or more consecutive keys, encoded as: | ||
| 321 | |||
| 322 | uint32 bits | ||
| 323 | mpint1 rsa_e | ||
| 324 | mpint1 rsa_n | ||
| 325 | string key_comment | ||
| 326 | |||
| 327 | 2.5.2 Requesting a list of protocol 2 keys | ||
| 328 | |||
| 329 | A client may send the following message to request a list of | ||
| 330 | protocol 2 keys that are stored in the agent: | ||
| 331 | |||
| 332 | byte SSH2_AGENTC_REQUEST_IDENTITIES | ||
| 333 | |||
| 334 | The agent will reply with the following message header: | ||
| 335 | |||
| 336 | byte SSH2_AGENT_IDENTITIES_ANSWER | ||
| 337 | uint32 num_keys | ||
| 338 | |||
| 339 | Followed by zero or more consecutive keys, encoded as: | ||
| 340 | |||
| 341 | string key_blob | ||
| 342 | string key_comment | ||
| 343 | |||
| 344 | Where "key_blob" is encoded as per RFC 4253 section 6.6 "Public Key | ||
| 345 | Algorithms" for either of the supported key types: "ssh-dss" or | ||
| 346 | "ssh-rsa". | ||
| 347 | |||
| 348 | 2.6 Private key operations | ||
| 349 | |||
| 350 | The purpose of the agent is to perform private key operations, such as | ||
| 351 | signing and encryption without requiring a passphrase to unlock the | ||
| 352 | key and without allowing the private key itself to be exposed. There | ||
| 353 | are separate requests for the protocol 1 and protocol 2 private key | ||
| 354 | operations. | ||
| 355 | |||
| 356 | 2.6.1 Protocol 1 private key challenge | ||
| 357 | |||
| 358 | The private key operation used in version 1 of the SSH protocol is | ||
| 359 | decrypting a challenge that has been encrypted with a public key. | ||
| 360 | It may be requested using this message: | ||
| 361 | |||
| 362 | byte SSH_AGENTC_RSA_CHALLENGE | ||
| 363 | uint32 ignored | ||
| 364 | mpint1 rsa_e | ||
| 365 | mpint1 rsa_n | ||
| 366 | mpint1 encrypted_challenge | ||
| 367 | byte[16] session_id | ||
| 368 | uint32 response_type /* must be 1 */ | ||
| 369 | |||
| 370 | "rsa_e" and "rsa_n" are used to identify which private key to use. | ||
| 371 | "encrypted_challenge" is a challenge blob that has (presumably) | ||
| 372 | been encrypted with the public key and must be in the range | ||
| 373 | 1 <= encrypted_challenge < 2^256. "session_id" is the SSH protocol 1 | ||
| 374 | session ID (computed from the server host key, the server semi-ephemeral | ||
| 375 | key and the session cookie). | ||
| 376 | |||
| 377 | "ignored" and "response_type" exist for compatibility with legacy | ||
| 378 | implementations. "response_type" must be equal to 1; other response | ||
| 379 | types are not supported. | ||
| 380 | |||
| 381 | On receiving this request, the server decrypts the "encrypted_challenge" | ||
| 382 | using the private key matching the supplied (rsa_e, rsa_n) values. For | ||
| 383 | the response derivation, the decrypted challenge is represented as an | ||
| 384 | unsigned, big-endian integer encoded in a 32 byte buffer (i.e. values | ||
| 385 | smaller than 2^248 will have leading 0 bytes). | ||
| 386 | |||
| 387 | The response value is then calculated as: | ||
| 388 | |||
| 389 | response = MD5(decrypted_challenge || session_id) | ||
| 390 | |||
| 391 | and returned in the following message | ||
| 392 | |||
| 393 | byte SSH_AGENT_RSA_RESPONSE | ||
| 394 | byte[16] response | ||
| 395 | |||
| 396 | If the agent cannot find the key specified by the supplied (rsa_e, | ||
| 397 | rsa_n) then it will return SSH_AGENT_FAILURE. | ||
| 398 | |||
| 399 | 2.6.2 Protocol 2 private key signature request | ||
| 400 | |||
| 401 | A client may use the following message to request signing of data using | ||
| 402 | a protocol 2 key: | ||
| 403 | |||
| 404 | byte SSH2_AGENTC_SIGN_REQUEST | ||
| 405 | string key_blob | ||
| 406 | string data | ||
| 407 | uint32 flags | ||
| 408 | |||
| 409 | Where "key_blob" is encoded as per RFC 4253 section 6.6 "Public Key | ||
| 410 | Algorithms" for either of the supported key types: "ssh-dss" or | ||
| 411 | "ssh-rsa". "flags" is a bit-mask, but at present only one possible value | ||
| 412 | is defined (see below for its meaning): | ||
| 413 | |||
| 414 | SSH_AGENT_OLD_SIGNATURE 1 | ||
| 415 | |||
| 416 | Upon receiving this request, the agent will look up the private key that | ||
| 417 | corresponds to the public key contained in key_blob. It will use this | ||
| 418 | private key to sign the "data" and produce a signature blob using the | ||
| 419 | key type-specific method described in RFC 4253 section 6.6 "Public Key | ||
| 420 | Algorithms". | ||
| 421 | |||
| 422 | An exception to this is for "ssh-dss" keys where the "flags" word | ||
| 423 | contains the value SSH_AGENT_OLD_SIGNATURE. In this case, a legacy | ||
| 424 | signature encoding is used in lieu of the standard one. In this case, | ||
| 425 | the DSA signature blob is encoded as: | ||
| 426 | |||
| 427 | byte[40] signature | ||
| 428 | |||
| 429 | The signature will be returned in the response message: | ||
| 430 | |||
| 431 | byte SSH2_AGENT_SIGN_RESPONSE | ||
| 432 | string signature_blob | ||
| 433 | |||
| 434 | If the agent cannot find the key specified by the supplied key_blob then | ||
| 435 | it will return SSH_AGENT_FAILURE. | ||
| 436 | |||
| 437 | 2.7 Locking or unlocking an agent | ||
| 438 | |||
| 439 | The agent supports temporary locking with a passphrase to suspend | ||
| 440 | processing of sensitive operations until it has been unlocked with the | ||
| 441 | same passphrase. To lock an agent, a client send the following request: | ||
| 442 | |||
| 443 | byte SSH_AGENTC_LOCK | ||
| 444 | string passphrase | ||
| 445 | |||
| 446 | Upon receipt of this message and if the agent is not already locked, | ||
| 447 | it will suspend processing requests and return a SSH_AGENT_SUCCESS | ||
| 448 | reply. If the agent is already locked, it will return SSH_AGENT_FAILURE. | ||
| 449 | |||
| 450 | While locked, the agent will refuse all requests except | ||
| 451 | SSH_AGENTC_UNLOCK, SSH_AGENTC_REQUEST_RSA_IDENTITIES and | ||
| 452 | SSH2_AGENTC_REQUEST_IDENTITIES. The "request identities" requests are | ||
| 453 | treated specially by a locked agent: it will always return an empty list | ||
| 454 | of keys. | ||
| 455 | |||
| 456 | To unlock an agent, a client may request: | ||
| 457 | |||
| 458 | byte SSH_AGENTC_UNLOCK | ||
| 459 | string passphrase | ||
| 460 | |||
| 461 | If the passphrase matches and the agent is locked, then it will resume | ||
| 462 | processing all requests and return SSH_AGENT_SUCCESS. If the agent | ||
| 463 | is not locked or the passphrase does not match then it will return | ||
| 464 | SSH_AGENT_FAILURE. | ||
| 465 | |||
| 466 | Locking and unlocking affects both protocol 1 and protocol 2 keys. | ||
| 467 | |||
| 468 | 3. Protocol message numbers | ||
| 469 | |||
| 470 | 3.1 Requests from client to agent for protocol 1 key operations | ||
| 471 | |||
| 472 | SSH_AGENTC_REQUEST_RSA_IDENTITIES 1 | ||
| 473 | SSH_AGENTC_RSA_CHALLENGE 3 | ||
| 474 | SSH_AGENTC_ADD_RSA_IDENTITY 7 | ||
| 475 | SSH_AGENTC_REMOVE_RSA_IDENTITY 8 | ||
| 476 | SSH_AGENTC_REMOVE_ALL_RSA_IDENTITIES 9 | ||
| 477 | SSH_AGENTC_ADD_RSA_ID_CONSTRAINED 24 | ||
| 478 | |||
| 479 | 3.2 Requests from client to agent for protocol 2 key operations | ||
| 480 | |||
| 481 | SSH2_AGENTC_REQUEST_IDENTITIES 11 | ||
| 482 | SSH2_AGENTC_SIGN_REQUEST 13 | ||
| 483 | SSH2_AGENTC_ADD_IDENTITY 17 | ||
| 484 | SSH2_AGENTC_REMOVE_IDENTITY 18 | ||
| 485 | SSH2_AGENTC_REMOVE_ALL_IDENTITIES 19 | ||
| 486 | SSH2_AGENTC_ADD_ID_CONSTRAINED 25 | ||
| 487 | |||
| 488 | 3.3 Key-type independent requests from client to agent | ||
| 489 | |||
| 490 | SSH_AGENTC_ADD_SMARTCARD_KEY 20 | ||
| 491 | SSH_AGENTC_REMOVE_SMARTCARD_KEY 21 | ||
| 492 | SSH_AGENTC_LOCK 22 | ||
| 493 | SSH_AGENTC_UNLOCK 23 | ||
| 494 | SSH_AGENTC_ADD_SMARTCARD_KEY_CONSTRAINED 26 | ||
| 495 | |||
| 496 | 3.4 Generic replies from agent to client | ||
| 497 | |||
| 498 | SSH_AGENT_FAILURE 5 | ||
| 499 | SSH_AGENT_SUCCESS 6 | ||
| 500 | |||
| 501 | 3.5 Replies from agent to client for protocol 1 key operations | ||
| 502 | |||
| 503 | SSH_AGENT_RSA_IDENTITIES_ANSWER 2 | ||
| 504 | SSH_AGENT_RSA_RESPONSE 4 | ||
| 505 | |||
| 506 | 3.6 Replies from agent to client for protocol 2 key operations | ||
| 507 | |||
| 508 | SSH2_AGENT_IDENTITIES_ANSWER 12 | ||
| 509 | SSH2_AGENT_SIGN_RESPONSE 14 | ||
| 510 | |||
| 511 | 3.7 Key constraint identifiers | ||
| 512 | |||
| 513 | SSH_AGENT_CONSTRAIN_LIFETIME 1 | ||
| 514 | SSH_AGENT_CONSTRAIN_CONFIRM 2 | ||
| 515 | |||
| 516 | $OpenBSD: PROTOCOL.agent,v 1.4 2008/07/01 23:12:47 stevesk Exp $ | ||
| @@ -1,4 +1,4 @@ | |||
| 1 | See http://www.openssh.com/txt/release-4.7 for the release notes. | 1 | See http://www.openssh.com/txt/release-5.1 for the release notes. |
| 2 | 2 | ||
| 3 | - A Japanese translation of this document and of the OpenSSH FAQ is | 3 | - A Japanese translation of this document and of the OpenSSH FAQ is |
| 4 | - available at http://www.unixuser.org/~haruyama/security/openssh/index.html | 4 | - available at http://www.unixuser.org/~haruyama/security/openssh/index.html |
| @@ -62,4 +62,4 @@ References - | |||
| 62 | [6] http://www.openbsd.org/cgi-bin/man.cgi?query=style&sektion=9 | 62 | [6] http://www.openbsd.org/cgi-bin/man.cgi?query=style&sektion=9 |
| 63 | [7] http://www.openssh.com/faq.html | 63 | [7] http://www.openssh.com/faq.html |
| 64 | 64 | ||
| 65 | $Id: README,v 1.66 2007/08/15 09:22:20 dtucker Exp $ | 65 | $Id: README,v 1.69 2008/07/21 08:21:52 djm Exp $ |
diff --git a/addrmatch.c b/addrmatch.c new file mode 100644 index 000000000..2086afe84 --- /dev/null +++ b/addrmatch.c | |||
| @@ -0,0 +1,421 @@ | |||
| 1 | /* $OpenBSD: addrmatch.c,v 1.3 2008/06/10 23:06:19 djm Exp $ */ | ||
| 2 | |||
| 3 | /* | ||
| 4 | * Copyright (c) 2004-2008 Damien Miller <djm@mindrot.org> | ||
| 5 | * | ||
| 6 | * Permission to use, copy, modify, and distribute this software for any | ||
| 7 | * purpose with or without fee is hereby granted, provided that the above | ||
| 8 | * copyright notice and this permission notice appear in all copies. | ||
| 9 | * | ||
| 10 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES | ||
| 11 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF | ||
| 12 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR | ||
| 13 | * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES | ||
| 14 | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN | ||
| 15 | * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF | ||
| 16 | * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. | ||
| 17 | */ | ||
| 18 | |||
| 19 | #include "includes.h" | ||
| 20 | |||
| 21 | #include <sys/types.h> | ||
| 22 | #include <sys/socket.h> | ||
| 23 | #include <netinet/in.h> | ||
| 24 | #include <arpa/inet.h> | ||
| 25 | |||
| 26 | #include <netdb.h> | ||
| 27 | #include <string.h> | ||
| 28 | #include <stdlib.h> | ||
| 29 | #include <stdio.h> | ||
| 30 | #include <stdarg.h> | ||
| 31 | |||
| 32 | #include "match.h" | ||
| 33 | #include "log.h" | ||
| 34 | |||
| 35 | struct xaddr { | ||
| 36 | sa_family_t af; | ||
| 37 | union { | ||
| 38 | struct in_addr v4; | ||
| 39 | struct in6_addr v6; | ||
| 40 | u_int8_t addr8[16]; | ||
| 41 | u_int32_t addr32[4]; | ||
| 42 | } xa; /* 128-bit address */ | ||
| 43 | u_int32_t scope_id; /* iface scope id for v6 */ | ||
| 44 | #define v4 xa.v4 | ||
| 45 | #define v6 xa.v6 | ||
| 46 | #define addr8 xa.addr8 | ||
| 47 | #define addr32 xa.addr32 | ||
| 48 | }; | ||
| 49 | |||
| 50 | static int | ||
| 51 | addr_unicast_masklen(int af) | ||
| 52 | { | ||
| 53 | switch (af) { | ||
| 54 | case AF_INET: | ||
| 55 | return 32; | ||
| 56 | case AF_INET6: | ||
| 57 | return 128; | ||
| 58 | default: | ||
| 59 | return -1; | ||
| 60 | } | ||
| 61 | } | ||
| 62 | |||
| 63 | static inline int | ||
| 64 | masklen_valid(int af, u_int masklen) | ||
| 65 | { | ||
| 66 | switch (af) { | ||
| 67 | case AF_INET: | ||
| 68 | return masklen <= 32 ? 0 : -1; | ||
| 69 | case AF_INET6: | ||
| 70 | return masklen <= 128 ? 0 : -1; | ||
| 71 | default: | ||
| 72 | return -1; | ||
| 73 | } | ||
| 74 | } | ||
| 75 | |||
| 76 | /* | ||
| 77 | * Convert struct sockaddr to struct xaddr | ||
| 78 | * Returns 0 on success, -1 on failure. | ||
| 79 | */ | ||
| 80 | static int | ||
| 81 | addr_sa_to_xaddr(struct sockaddr *sa, socklen_t slen, struct xaddr *xa) | ||
| 82 | { | ||
| 83 | struct sockaddr_in *in4 = (struct sockaddr_in *)sa; | ||
| 84 | struct sockaddr_in6 *in6 = (struct sockaddr_in6 *)sa; | ||
| 85 | |||
| 86 | memset(xa, '\0', sizeof(*xa)); | ||
| 87 | |||
| 88 | switch (sa->sa_family) { | ||
| 89 | case AF_INET: | ||
| 90 | if (slen < sizeof(*in4)) | ||
| 91 | return -1; | ||
| 92 | xa->af = AF_INET; | ||
| 93 | memcpy(&xa->v4, &in4->sin_addr, sizeof(xa->v4)); | ||
| 94 | break; | ||
| 95 | case AF_INET6: | ||
| 96 | if (slen < sizeof(*in6)) | ||
| 97 | return -1; | ||
| 98 | xa->af = AF_INET6; | ||
| 99 | memcpy(&xa->v6, &in6->sin6_addr, sizeof(xa->v6)); | ||
| 100 | xa->scope_id = in6->sin6_scope_id; | ||
| 101 | break; | ||
| 102 | default: | ||
| 103 | return -1; | ||
| 104 | } | ||
| 105 | |||
| 106 | return 0; | ||
| 107 | } | ||
| 108 | |||
| 109 | /* | ||
| 110 | * Calculate a netmask of length 'l' for address family 'af' and | ||
| 111 | * store it in 'n'. | ||
| 112 | * Returns 0 on success, -1 on failure. | ||
| 113 | */ | ||
| 114 | static int | ||
| 115 | addr_netmask(int af, u_int l, struct xaddr *n) | ||
| 116 | { | ||
| 117 | int i; | ||
| 118 | |||
| 119 | if (masklen_valid(af, l) != 0 || n == NULL) | ||
| 120 | return -1; | ||
| 121 | |||
| 122 | memset(n, '\0', sizeof(*n)); | ||
| 123 | switch (af) { | ||
| 124 | case AF_INET: | ||
| 125 | n->af = AF_INET; | ||
| 126 | n->v4.s_addr = htonl((0xffffffff << (32 - l)) & 0xffffffff); | ||
| 127 | return 0; | ||
| 128 | case AF_INET6: | ||
| 129 | n->af = AF_INET6; | ||
| 130 | for (i = 0; i < 4 && l >= 32; i++, l -= 32) | ||
| 131 | n->addr32[i] = 0xffffffffU; | ||
| 132 | if (i < 4 && l != 0) | ||
| 133 | n->addr32[i] = htonl((0xffffffff << (32 - l)) & | ||
| 134 | 0xffffffff); | ||
| 135 | return 0; | ||
| 136 | default: | ||
| 137 | return -1; | ||
| 138 | } | ||
| 139 | } | ||
| 140 | |||
| 141 | /* | ||
| 142 | * Perform logical AND of addresses 'a' and 'b', storing result in 'dst'. | ||
| 143 | * Returns 0 on success, -1 on failure. | ||
| 144 | */ | ||
| 145 | static int | ||
| 146 | addr_and(struct xaddr *dst, const struct xaddr *a, const struct xaddr *b) | ||
| 147 | { | ||
| 148 | int i; | ||
| 149 | |||
| 150 | if (dst == NULL || a == NULL || b == NULL || a->af != b->af) | ||
| 151 | return -1; | ||
| 152 | |||
| 153 | memcpy(dst, a, sizeof(*dst)); | ||
| 154 | switch (a->af) { | ||
| 155 | case AF_INET: | ||
| 156 | dst->v4.s_addr &= b->v4.s_addr; | ||
| 157 | return 0; | ||
| 158 | case AF_INET6: | ||
| 159 | dst->scope_id = a->scope_id; | ||
| 160 | for (i = 0; i < 4; i++) | ||
| 161 | dst->addr32[i] &= b->addr32[i]; | ||
| 162 | return 0; | ||
| 163 | default: | ||
| 164 | return -1; | ||
| 165 | } | ||
| 166 | } | ||
| 167 | |||
| 168 | /* | ||
| 169 | * Compare addresses 'a' and 'b' | ||
| 170 | * Return 0 if addresses are identical, -1 if (a < b) or 1 if (a > b) | ||
| 171 | */ | ||
| 172 | static int | ||
| 173 | addr_cmp(const struct xaddr *a, const struct xaddr *b) | ||
| 174 | { | ||
| 175 | int i; | ||
| 176 | |||
| 177 | if (a->af != b->af) | ||
| 178 | return a->af == AF_INET6 ? 1 : -1; | ||
| 179 | |||
| 180 | switch (a->af) { | ||
| 181 | case AF_INET: | ||
| 182 | if (a->v4.s_addr == b->v4.s_addr) | ||
| 183 | return 0; | ||
| 184 | return ntohl(a->v4.s_addr) > ntohl(b->v4.s_addr) ? 1 : -1; | ||
| 185 | case AF_INET6: | ||
| 186 | for (i = 0; i < 16; i++) | ||
| 187 | if (a->addr8[i] - b->addr8[i] != 0) | ||
| 188 | return a->addr8[i] > b->addr8[i] ? 1 : -1; | ||
| 189 | if (a->scope_id == b->scope_id) | ||
| 190 | return 0; | ||
| 191 | return a->scope_id > b->scope_id ? 1 : -1; | ||
| 192 | default: | ||
| 193 | return -1; | ||
| 194 | } | ||
| 195 | } | ||
| 196 | |||
| 197 | /* | ||
| 198 | * Parse string address 'p' into 'n' | ||
| 199 | * Returns 0 on success, -1 on failure. | ||
| 200 | */ | ||
| 201 | static int | ||
| 202 | addr_pton(const char *p, struct xaddr *n) | ||
| 203 | { | ||
| 204 | struct addrinfo hints, *ai; | ||
| 205 | |||
| 206 | memset(&hints, '\0', sizeof(hints)); | ||
| 207 | hints.ai_flags = AI_NUMERICHOST; | ||
| 208 | |||
| 209 | if (p == NULL || getaddrinfo(p, NULL, &hints, &ai) != 0) | ||
| 210 | return -1; | ||
| 211 | |||
| 212 | if (ai == NULL || ai->ai_addr == NULL) | ||
| 213 | return -1; | ||
| 214 | |||
| 215 | if (n != NULL && | ||
| 216 | addr_sa_to_xaddr(ai->ai_addr, ai->ai_addrlen, n) == -1) { | ||
| 217 | freeaddrinfo(ai); | ||
| 218 | return -1; | ||
| 219 | } | ||
| 220 | |||
| 221 | freeaddrinfo(ai); | ||
| 222 | return 0; | ||
| 223 | } | ||
| 224 | |||
| 225 | /* | ||
| 226 | * Perform bitwise negation of address | ||
| 227 | * Returns 0 on success, -1 on failure. | ||
| 228 | */ | ||
| 229 | static int | ||
| 230 | addr_invert(struct xaddr *n) | ||
| 231 | { | ||
| 232 | int i; | ||
| 233 | |||
| 234 | if (n == NULL) | ||
| 235 | return (-1); | ||
| 236 | |||
| 237 | switch (n->af) { | ||
| 238 | case AF_INET: | ||
| 239 | n->v4.s_addr = ~n->v4.s_addr; | ||
| 240 | return (0); | ||
| 241 | case AF_INET6: | ||
| 242 | for (i = 0; i < 4; i++) | ||
| 243 | n->addr32[i] = ~n->addr32[i]; | ||
| 244 | return (0); | ||
| 245 | default: | ||
| 246 | return (-1); | ||
| 247 | } | ||
| 248 | } | ||
| 249 | |||
| 250 | /* | ||
| 251 | * Calculate a netmask of length 'l' for address family 'af' and | ||
| 252 | * store it in 'n'. | ||
| 253 | * Returns 0 on success, -1 on failure. | ||
| 254 | */ | ||
| 255 | static int | ||
| 256 | addr_hostmask(int af, u_int l, struct xaddr *n) | ||
| 257 | { | ||
| 258 | if (addr_netmask(af, l, n) == -1 || addr_invert(n) == -1) | ||
| 259 | return (-1); | ||
| 260 | return (0); | ||
| 261 | } | ||
| 262 | |||
| 263 | /* | ||
| 264 | * Test whether address 'a' is all zeros (i.e. 0.0.0.0 or ::) | ||
| 265 | * Returns 0 on if address is all-zeros, -1 if not all zeros or on failure. | ||
| 266 | */ | ||
| 267 | static int | ||
| 268 | addr_is_all0s(const struct xaddr *a) | ||
| 269 | { | ||
| 270 | int i; | ||
| 271 | |||
| 272 | switch (a->af) { | ||
| 273 | case AF_INET: | ||
| 274 | return (a->v4.s_addr == 0 ? 0 : -1); | ||
| 275 | case AF_INET6:; | ||
| 276 | for (i = 0; i < 4; i++) | ||
| 277 | if (a->addr32[i] != 0) | ||
| 278 | return (-1); | ||
| 279 | return (0); | ||
| 280 | default: | ||
| 281 | return (-1); | ||
| 282 | } | ||
| 283 | } | ||
| 284 | |||
| 285 | /* | ||
| 286 | * Test whether host portion of address 'a', as determined by 'masklen' | ||
| 287 | * is all zeros. | ||
| 288 | * Returns 0 on if host portion of address is all-zeros, | ||
| 289 | * -1 if not all zeros or on failure. | ||
| 290 | */ | ||
| 291 | static int | ||
| 292 | addr_host_is_all0s(const struct xaddr *a, u_int masklen) | ||
| 293 | { | ||
| 294 | struct xaddr tmp_addr, tmp_mask, tmp_result; | ||
| 295 | |||
| 296 | memcpy(&tmp_addr, a, sizeof(tmp_addr)); | ||
| 297 | if (addr_hostmask(a->af, masklen, &tmp_mask) == -1) | ||
| 298 | return (-1); | ||
| 299 | if (addr_and(&tmp_result, &tmp_addr, &tmp_mask) == -1) | ||
| 300 | return (-1); | ||
| 301 | return (addr_is_all0s(&tmp_result)); | ||
| 302 | } | ||
| 303 | |||
| 304 | /* | ||
| 305 | * Parse a CIDR address (x.x.x.x/y or xxxx:yyyy::/z). | ||
| 306 | * Return -1 on parse error, -2 on inconsistency or 0 on success. | ||
| 307 | */ | ||
| 308 | static int | ||
| 309 | addr_pton_cidr(const char *p, struct xaddr *n, u_int *l) | ||
| 310 | { | ||
| 311 | struct xaddr tmp; | ||
| 312 | long unsigned int masklen = 999; | ||
| 313 | char addrbuf[64], *mp, *cp; | ||
| 314 | |||
| 315 | /* Don't modify argument */ | ||
| 316 | if (p == NULL || strlcpy(addrbuf, p, sizeof(addrbuf)) > sizeof(addrbuf)) | ||
| 317 | return -1; | ||
| 318 | |||
| 319 | if ((mp = strchr(addrbuf, '/')) != NULL) { | ||
| 320 | *mp = '\0'; | ||
| 321 | mp++; | ||
| 322 | masklen = strtoul(mp, &cp, 10); | ||
| 323 | if (*mp == '\0' || *cp != '\0' || masklen > 128) | ||
| 324 | return -1; | ||
| 325 | } | ||
| 326 | |||
| 327 | if (addr_pton(addrbuf, &tmp) == -1) | ||
| 328 | return -1; | ||
| 329 | |||
| 330 | if (mp == NULL) | ||
| 331 | masklen = addr_unicast_masklen(tmp.af); | ||
| 332 | if (masklen_valid(tmp.af, masklen) == -1) | ||
| 333 | return -2; | ||
| 334 | if (addr_host_is_all0s(&tmp, masklen) != 0) | ||
| 335 | return -2; | ||
| 336 | |||
| 337 | if (n != NULL) | ||
| 338 | memcpy(n, &tmp, sizeof(*n)); | ||
| 339 | if (l != NULL) | ||
| 340 | *l = masklen; | ||
| 341 | |||
| 342 | return 0; | ||
| 343 | } | ||
| 344 | |||
| 345 | static int | ||
| 346 | addr_netmatch(const struct xaddr *host, const struct xaddr *net, u_int masklen) | ||
| 347 | { | ||
| 348 | struct xaddr tmp_mask, tmp_result; | ||
| 349 | |||
| 350 | if (host->af != net->af) | ||
| 351 | return -1; | ||
| 352 | |||
| 353 | if (addr_netmask(host->af, masklen, &tmp_mask) == -1) | ||
| 354 | return -1; | ||
| 355 | if (addr_and(&tmp_result, host, &tmp_mask) == -1) | ||
| 356 | return -1; | ||
| 357 | return addr_cmp(&tmp_result, net); | ||
| 358 | } | ||
| 359 | |||
| 360 | /* | ||
| 361 | * Match "addr" against list pattern list "_list", which may contain a | ||
| 362 | * mix of CIDR addresses and old-school wildcards. | ||
| 363 | * | ||
| 364 | * If addr is NULL, then no matching is performed, but _list is parsed | ||
| 365 | * and checked for well-formedness. | ||
| 366 | * | ||
| 367 | * Returns 1 on match found (never returned when addr == NULL). | ||
| 368 | * Returns 0 on if no match found, or no errors found when addr == NULL. | ||
| 369 | * Returns -1 on negated match found (never returned when addr == NULL). | ||
| 370 | * Returns -2 on invalid list entry. | ||
| 371 | */ | ||
| 372 | int | ||
| 373 | addr_match_list(const char *addr, const char *_list) | ||
| 374 | { | ||
| 375 | char *list, *cp, *o; | ||
| 376 | struct xaddr try_addr, match_addr; | ||
| 377 | u_int masklen, neg; | ||
| 378 | int ret = 0, r; | ||
| 379 | |||
| 380 | if (addr != NULL && addr_pton(addr, &try_addr) != 0) { | ||
| 381 | debug2("%s: couldn't parse address %.100s", __func__, addr); | ||
| 382 | return 0; | ||
| 383 | } | ||
| 384 | if ((o = list = strdup(_list)) == NULL) | ||
| 385 | return -1; | ||
| 386 | while ((cp = strsep(&list, ",")) != NULL) { | ||
| 387 | neg = *cp == '!'; | ||
| 388 | if (neg) | ||
| 389 | cp++; | ||
| 390 | if (*cp == '\0') { | ||
| 391 | ret = -2; | ||
| 392 | break; | ||
| 393 | } | ||
| 394 | /* Prefer CIDR address matching */ | ||
| 395 | r = addr_pton_cidr(cp, &match_addr, &masklen); | ||
| 396 | if (r == -2) { | ||
| 397 | error("Inconsistent mask length for " | ||
| 398 | "network \"%.100s\"", cp); | ||
| 399 | ret = -2; | ||
| 400 | break; | ||
| 401 | } else if (r == 0) { | ||
| 402 | if (addr != NULL && addr_netmatch(&try_addr, | ||
| 403 | &match_addr, masklen) == 0) { | ||
| 404 | foundit: | ||
| 405 | if (neg) { | ||
| 406 | ret = -1; | ||
| 407 | break; | ||
| 408 | } | ||
| 409 | ret = 1; | ||
| 410 | } | ||
| 411 | continue; | ||
| 412 | } else { | ||
| 413 | /* If CIDR parse failed, try wildcard string match */ | ||
| 414 | if (addr != NULL && match_pattern(addr, cp) == 1) | ||
| 415 | goto foundit; | ||
| 416 | } | ||
| 417 | } | ||
| 418 | free(o); | ||
| 419 | |||
| 420 | return ret; | ||
| 421 | } | ||
diff --git a/atomicio.c b/atomicio.c index f32ff85ba..a6b2d127a 100644 --- a/atomicio.c +++ b/atomicio.c | |||
| @@ -34,6 +34,10 @@ | |||
| 34 | #include <errno.h> | 34 | #include <errno.h> |
| 35 | #ifdef HAVE_POLL_H | 35 | #ifdef HAVE_POLL_H |
| 36 | #include <poll.h> | 36 | #include <poll.h> |
| 37 | #else | ||
| 38 | # ifdef HAVE_SYS_POLL_H | ||
| 39 | # include <sys/poll.h> | ||
| 40 | # endif | ||
| 37 | #endif | 41 | #endif |
| 38 | #include <string.h> | 42 | #include <string.h> |
| 39 | #include <unistd.h> | 43 | #include <unistd.h> |
| @@ -57,13 +61,9 @@ atomicio(ssize_t (*f) (int, void *, size_t), int fd, void *_s, size_t n) | |||
| 57 | res = (f) (fd, s + pos, n - pos); | 61 | res = (f) (fd, s + pos, n - pos); |
| 58 | switch (res) { | 62 | switch (res) { |
| 59 | case -1: | 63 | case -1: |
| 60 | #ifdef EWOULDBLOCK | ||
| 61 | if (errno == EINTR || errno == EWOULDBLOCK) | ||
| 62 | #else | ||
| 63 | if (errno == EINTR) | 64 | if (errno == EINTR) |
| 64 | #endif | ||
| 65 | continue; | 65 | continue; |
| 66 | if (errno == EAGAIN) { | 66 | if (errno == EAGAIN || errno == EWOULDBLOCK) { |
| 67 | (void)poll(&pfd, 1, -1); | 67 | (void)poll(&pfd, 1, -1); |
| 68 | continue; | 68 | continue; |
| 69 | } | 69 | } |
| @@ -97,20 +97,20 @@ atomiciov(ssize_t (*f) (int, const struct iovec *, int), int fd, | |||
| 97 | /* Make a copy of the iov array because we may modify it below */ | 97 | /* Make a copy of the iov array because we may modify it below */ |
| 98 | memcpy(iov, _iov, iovcnt * sizeof(*_iov)); | 98 | memcpy(iov, _iov, iovcnt * sizeof(*_iov)); |
| 99 | 99 | ||
| 100 | #ifndef BROKEN_READV_COMPARISON | ||
| 100 | pfd.fd = fd; | 101 | pfd.fd = fd; |
| 101 | pfd.events = f == readv ? POLLIN : POLLOUT; | 102 | pfd.events = f == readv ? POLLIN : POLLOUT; |
| 103 | #endif | ||
| 102 | for (; iovcnt > 0 && iov[0].iov_len > 0;) { | 104 | for (; iovcnt > 0 && iov[0].iov_len > 0;) { |
| 103 | res = (f) (fd, iov, iovcnt); | 105 | res = (f) (fd, iov, iovcnt); |
| 104 | switch (res) { | 106 | switch (res) { |
| 105 | case -1: | 107 | case -1: |
| 106 | #ifdef EWOULDBLOCK | ||
| 107 | if (errno == EINTR || errno == EWOULDBLOCK) | ||
| 108 | #else | ||
| 109 | if (errno == EINTR) | 108 | if (errno == EINTR) |
| 110 | #endif | ||
| 111 | continue; | 109 | continue; |
| 112 | if (errno == EAGAIN) { | 110 | if (errno == EAGAIN || errno == EWOULDBLOCK) { |
| 111 | #ifndef BROKEN_READV_COMPARISON | ||
| 113 | (void)poll(&pfd, 1, -1); | 112 | (void)poll(&pfd, 1, -1); |
| 113 | #endif | ||
| 114 | continue; | 114 | continue; |
| 115 | } | 115 | } |
| 116 | return 0; | 116 | return 0; |
diff --git a/audit-bsm.c b/audit-bsm.c index c26b4caed..2c417bc27 100644 --- a/audit-bsm.c +++ b/audit-bsm.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $Id: audit-bsm.c,v 1.5 2006/09/30 22:09:50 dtucker Exp $ */ | 1 | /* $Id: audit-bsm.c,v 1.6 2008/02/25 10:05:04 dtucker Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * TODO | 4 | * TODO |
| @@ -40,7 +40,9 @@ | |||
| 40 | #include <sys/types.h> | 40 | #include <sys/types.h> |
| 41 | 41 | ||
| 42 | #include <errno.h> | 42 | #include <errno.h> |
| 43 | #include <netdb.h> | ||
| 43 | #include <stdarg.h> | 44 | #include <stdarg.h> |
| 45 | #include <string.h> | ||
| 44 | #include <unistd.h> | 46 | #include <unistd.h> |
| 45 | 47 | ||
| 46 | #include "ssh.h" | 48 | #include "ssh.h" |
| @@ -62,8 +64,6 @@ | |||
| 62 | #if defined(HAVE_GETAUDIT_ADDR) | 64 | #if defined(HAVE_GETAUDIT_ADDR) |
| 63 | #define AuditInfoStruct auditinfo_addr | 65 | #define AuditInfoStruct auditinfo_addr |
| 64 | #define AuditInfoTermID au_tid_addr_t | 66 | #define AuditInfoTermID au_tid_addr_t |
| 65 | #define GetAuditFunc(a,b) getaudit_addr((a),(b)) | ||
| 66 | #define GetAuditFuncText "getaudit_addr" | ||
| 67 | #define SetAuditFunc(a,b) setaudit_addr((a),(b)) | 67 | #define SetAuditFunc(a,b) setaudit_addr((a),(b)) |
| 68 | #define SetAuditFuncText "setaudit_addr" | 68 | #define SetAuditFuncText "setaudit_addr" |
| 69 | #define AUToSubjectFunc au_to_subject_ex | 69 | #define AUToSubjectFunc au_to_subject_ex |
| @@ -71,18 +71,16 @@ | |||
| 71 | #else | 71 | #else |
| 72 | #define AuditInfoStruct auditinfo | 72 | #define AuditInfoStruct auditinfo |
| 73 | #define AuditInfoTermID au_tid_t | 73 | #define AuditInfoTermID au_tid_t |
| 74 | #define GetAuditFunc(a,b) getaudit(a) | ||
| 75 | #define GetAuditFuncText "getaudit" | ||
| 76 | #define SetAuditFunc(a,b) setaudit(a) | 74 | #define SetAuditFunc(a,b) setaudit(a) |
| 77 | #define SetAuditFuncText "setaudit" | 75 | #define SetAuditFuncText "setaudit" |
| 78 | #define AUToSubjectFunc au_to_subject | 76 | #define AUToSubjectFunc au_to_subject |
| 79 | #define AUToReturnFunc(a,b) au_to_return((a), (u_int)(b)) | 77 | #define AUToReturnFunc(a,b) au_to_return((a), (u_int)(b)) |
| 80 | #endif | 78 | #endif |
| 81 | 79 | ||
| 80 | #ifndef cannot_audit | ||
| 82 | extern int cannot_audit(int); | 81 | extern int cannot_audit(int); |
| 82 | #endif | ||
| 83 | extern void aug_init(void); | 83 | extern void aug_init(void); |
| 84 | extern dev_t aug_get_port(void); | ||
| 85 | extern int aug_get_machine(char *, u_int32_t *, u_int32_t *); | ||
| 86 | extern void aug_save_auid(au_id_t); | 84 | extern void aug_save_auid(au_id_t); |
| 87 | extern void aug_save_uid(uid_t); | 85 | extern void aug_save_uid(uid_t); |
| 88 | extern void aug_save_euid(uid_t); | 86 | extern void aug_save_euid(uid_t); |
| @@ -119,6 +117,51 @@ static AuditInfoTermID ssh_bsm_tid; | |||
| 119 | /* Below is the low-level BSM interface code */ | 117 | /* Below is the low-level BSM interface code */ |
| 120 | 118 | ||
| 121 | /* | 119 | /* |
| 120 | * aug_get_machine is only required on IPv6 capable machines, we use a | ||
| 121 | * different mechanism in audit_connection_from() for IPv4-only machines. | ||
| 122 | * getaudit_addr() is only present on IPv6 capable machines. | ||
| 123 | */ | ||
| 124 | #if defined(HAVE_AUG_GET_MACHINE) || !defined(HAVE_GETAUDIT_ADDR) | ||
| 125 | extern int aug_get_machine(char *, u_int32_t *, u_int32_t *); | ||
| 126 | #else | ||
| 127 | static int | ||
| 128 | aug_get_machine(char *host, u_int32_t *addr, u_int32_t *type) | ||
| 129 | { | ||
| 130 | struct addrinfo *ai; | ||
| 131 | struct sockaddr_in *in4; | ||
| 132 | struct sockaddr_in6 *in6; | ||
| 133 | int ret = 0, r; | ||
| 134 | |||
| 135 | if ((r = getaddrinfo(host, NULL, NULL, &ai)) != 0) { | ||
| 136 | error("BSM audit: getaddrinfo failed for %.100s: %.100s", host, | ||
| 137 | r == EAI_SYSTEM ? strerror(errno) : gai_strerror(r)); | ||
| 138 | return -1; | ||
| 139 | } | ||
| 140 | |||
| 141 | switch (ai->ai_family) { | ||
| 142 | case AF_INET: | ||
| 143 | in4 = (struct sockaddr_in *)ai->ai_addr; | ||
| 144 | *type = AU_IPv4; | ||
| 145 | memcpy(addr, &in4->sin_addr, sizeof(struct in_addr)); | ||
| 146 | break; | ||
| 147 | #ifdef AU_IPv6 | ||
| 148 | case AF_INET6: | ||
| 149 | in6 = (struct sockaddr_in6 *)ai->ai_addr; | ||
| 150 | *type = AU_IPv6; | ||
| 151 | memcpy(addr, &in6->sin6_addr, sizeof(struct in6_addr)); | ||
| 152 | break; | ||
| 153 | #endif | ||
| 154 | default: | ||
| 155 | error("BSM audit: unknown address family for %.100s: %d", | ||
| 156 | host, ai->ai_family); | ||
| 157 | ret = -1; | ||
| 158 | } | ||
| 159 | freeaddrinfo(ai); | ||
| 160 | return ret; | ||
| 161 | } | ||
| 162 | #endif | ||
| 163 | |||
| 164 | /* | ||
| 122 | * Check if the specified event is selected (enabled) for auditing. | 165 | * Check if the specified event is selected (enabled) for auditing. |
| 123 | * Returns 1 if the event is selected, 0 if not and -1 on failure. | 166 | * Returns 1 if the event is selected, 0 if not and -1 on failure. |
| 124 | */ | 167 | */ |
diff --git a/auth-bsdauth.c b/auth-bsdauth.c index 37d527d11..0b3262b49 100644 --- a/auth-bsdauth.c +++ b/auth-bsdauth.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: auth-bsdauth.c,v 1.10 2006/08/03 03:34:41 deraadt Exp $ */ | 1 | /* $OpenBSD: auth-bsdauth.c,v 1.11 2007/09/21 08:15:29 djm Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Copyright (c) 2001 Markus Friedl. All rights reserved. | 3 | * Copyright (c) 2001 Markus Friedl. All rights reserved. |
| 4 | * | 4 | * |
diff --git a/auth-options.c b/auth-options.c index 8f9df7a76..25361455e 100644 --- a/auth-options.c +++ b/auth-options.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: auth-options.c,v 1.40 2006/08/03 03:34:41 deraadt Exp $ */ | 1 | /* $OpenBSD: auth-options.c,v 1.43 2008/06/10 23:06:19 djm Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
| @@ -20,6 +20,7 @@ | |||
| 20 | #include <stdio.h> | 20 | #include <stdio.h> |
| 21 | #include <stdarg.h> | 21 | #include <stdarg.h> |
| 22 | 22 | ||
| 23 | #include "openbsd-compat/sys-queue.h" | ||
| 23 | #include "xmalloc.h" | 24 | #include "xmalloc.h" |
| 24 | #include "match.h" | 25 | #include "match.h" |
| 25 | #include "log.h" | 26 | #include "log.h" |
| @@ -225,8 +226,19 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum) | |||
| 225 | } | 226 | } |
| 226 | patterns[i] = '\0'; | 227 | patterns[i] = '\0'; |
| 227 | opts++; | 228 | opts++; |
| 228 | if (match_host_and_ip(remote_host, remote_ip, | 229 | switch (match_host_and_ip(remote_host, remote_ip, |
| 229 | patterns) != 1) { | 230 | patterns)) { |
| 231 | case 1: | ||
| 232 | xfree(patterns); | ||
| 233 | /* Host name matches. */ | ||
| 234 | goto next_option; | ||
| 235 | case -1: | ||
| 236 | debug("%.100s, line %lu: invalid criteria", | ||
| 237 | file, linenum); | ||
| 238 | auth_debug_add("%.100s, line %lu: " | ||
| 239 | "invalid criteria", file, linenum); | ||
| 240 | /* FALLTHROUGH */ | ||
| 241 | case 0: | ||
| 230 | xfree(patterns); | 242 | xfree(patterns); |
| 231 | logit("Authentication tried for %.100s with " | 243 | logit("Authentication tried for %.100s with " |
| 232 | "correct key but not from a permitted " | 244 | "correct key but not from a permitted " |
| @@ -235,12 +247,10 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum) | |||
| 235 | auth_debug_add("Your host '%.200s' is not " | 247 | auth_debug_add("Your host '%.200s' is not " |
| 236 | "permitted to use this key for login.", | 248 | "permitted to use this key for login.", |
| 237 | remote_host); | 249 | remote_host); |
| 238 | /* deny access */ | 250 | break; |
| 239 | return 0; | ||
| 240 | } | 251 | } |
| 241 | xfree(patterns); | 252 | /* deny access */ |
| 242 | /* Host name matches. */ | 253 | return 0; |
| 243 | goto next_option; | ||
| 244 | } | 254 | } |
| 245 | cp = "permitopen=\""; | 255 | cp = "permitopen=\""; |
| 246 | if (strncasecmp(opts, cp, strlen(cp)) == 0) { | 256 | if (strncasecmp(opts, cp, strlen(cp)) == 0) { |
diff --git a/auth-options.h b/auth-options.h index 86583cc47..14488f72d 100644 --- a/auth-options.h +++ b/auth-options.h | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: auth-options.h,v 1.16 2006/08/03 03:34:41 deraadt Exp $ */ | 1 | /* $OpenBSD: auth-options.h,v 1.17 2008/03/26 21:28:14 djm Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
diff --git a/auth-pam.c b/auth-pam.c index a07f1fe77..ccdb9937e 100644 --- a/auth-pam.c +++ b/auth-pam.c | |||
| @@ -598,15 +598,17 @@ static struct pam_conv store_conv = { sshpam_store_conv, NULL }; | |||
| 598 | void | 598 | void |
| 599 | sshpam_cleanup(void) | 599 | sshpam_cleanup(void) |
| 600 | { | 600 | { |
| 601 | debug("PAM: cleanup"); | 601 | if (sshpam_handle == NULL || (use_privsep && !mm_is_monitor())) |
| 602 | if (sshpam_handle == NULL) | ||
| 603 | return; | 602 | return; |
| 603 | debug("PAM: cleanup"); | ||
| 604 | pam_set_item(sshpam_handle, PAM_CONV, (const void *)&null_conv); | 604 | pam_set_item(sshpam_handle, PAM_CONV, (const void *)&null_conv); |
| 605 | if (sshpam_cred_established) { | 605 | if (sshpam_cred_established) { |
| 606 | debug("PAM: deleting credentials"); | ||
| 606 | pam_setcred(sshpam_handle, PAM_DELETE_CRED); | 607 | pam_setcred(sshpam_handle, PAM_DELETE_CRED); |
| 607 | sshpam_cred_established = 0; | 608 | sshpam_cred_established = 0; |
| 608 | } | 609 | } |
| 609 | if (sshpam_session_open) { | 610 | if (sshpam_session_open) { |
| 611 | debug("PAM: closing session"); | ||
| 610 | pam_close_session(sshpam_handle, PAM_SILENT); | 612 | pam_close_session(sshpam_handle, PAM_SILENT); |
| 611 | sshpam_session_open = 0; | 613 | sshpam_session_open = 0; |
| 612 | } | 614 | } |
diff --git a/auth-passwd.c b/auth-passwd.c index be6283796..bdfced023 100644 --- a/auth-passwd.c +++ b/auth-passwd.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: auth-passwd.c,v 1.40 2006/08/03 03:34:41 deraadt Exp $ */ | 1 | /* $OpenBSD: auth-passwd.c,v 1.43 2007/09/21 08:15:29 djm Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
diff --git a/auth-rhosts.c b/auth-rhosts.c index cd0a7967a..5c1296701 100644 --- a/auth-rhosts.c +++ b/auth-rhosts.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: auth-rhosts.c,v 1.41 2006/08/03 03:34:41 deraadt Exp $ */ | 1 | /* $OpenBSD: auth-rhosts.c,v 1.43 2008/06/13 14:18:51 dtucker Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
| @@ -26,6 +26,8 @@ | |||
| 26 | #include <stdio.h> | 26 | #include <stdio.h> |
| 27 | #include <string.h> | 27 | #include <string.h> |
| 28 | #include <stdarg.h> | 28 | #include <stdarg.h> |
| 29 | #include <fcntl.h> | ||
| 30 | #include <unistd.h> | ||
| 29 | 31 | ||
| 30 | #include "packet.h" | 32 | #include "packet.h" |
| 31 | #include "buffer.h" | 33 | #include "buffer.h" |
| @@ -37,6 +39,7 @@ | |||
| 37 | #include "key.h" | 39 | #include "key.h" |
| 38 | #include "hostfile.h" | 40 | #include "hostfile.h" |
| 39 | #include "auth.h" | 41 | #include "auth.h" |
| 42 | #include "misc.h" | ||
| 40 | 43 | ||
| 41 | /* import */ | 44 | /* import */ |
| 42 | extern ServerOptions options; | 45 | extern ServerOptions options; |
| @@ -55,12 +58,27 @@ check_rhosts_file(const char *filename, const char *hostname, | |||
| 55 | { | 58 | { |
| 56 | FILE *f; | 59 | FILE *f; |
| 57 | char buf[1024]; /* Must not be larger than host, user, dummy below. */ | 60 | char buf[1024]; /* Must not be larger than host, user, dummy below. */ |
| 61 | int fd; | ||
| 62 | struct stat st; | ||
| 58 | 63 | ||
| 59 | /* Open the .rhosts file, deny if unreadable */ | 64 | /* Open the .rhosts file, deny if unreadable */ |
| 60 | f = fopen(filename, "r"); | 65 | if ((fd = open(filename, O_RDONLY|O_NONBLOCK)) == -1) |
| 61 | if (!f) | ||
| 62 | return 0; | 66 | return 0; |
| 63 | 67 | if (fstat(fd, &st) == -1) { | |
| 68 | close(fd); | ||
| 69 | return 0; | ||
| 70 | } | ||
| 71 | if (!S_ISREG(st.st_mode)) { | ||
| 72 | logit("User %s hosts file %s is not a regular file", | ||
| 73 | server_user, filename); | ||
| 74 | close(fd); | ||
| 75 | return 0; | ||
| 76 | } | ||
| 77 | unset_nonblock(fd); | ||
| 78 | if ((f = fdopen(fd, "r")) == NULL) { | ||
| 79 | close(fd); | ||
| 80 | return 0; | ||
| 81 | } | ||
| 64 | while (fgets(buf, sizeof(buf), f)) { | 82 | while (fgets(buf, sizeof(buf), f)) { |
| 65 | /* All three must be at least as big as buf to avoid overflows. */ | 83 | /* All three must be at least as big as buf to avoid overflows. */ |
| 66 | char hostbuf[1024], userbuf[1024], dummy[1024], *host, *user, *cp; | 84 | char hostbuf[1024], userbuf[1024], dummy[1024], *host, *user, *cp; |
diff --git a/auth-rsa.c b/auth-rsa.c index b7cbc0fe5..4876aad5d 100644 --- a/auth-rsa.c +++ b/auth-rsa.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: auth-rsa.c,v 1.72 2006/11/06 21:25:27 markus Exp $ */ | 1 | /* $OpenBSD: auth-rsa.c,v 1.73 2008/07/02 12:03:51 dtucker Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
| @@ -173,7 +173,6 @@ auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey) | |||
| 173 | u_int bits; | 173 | u_int bits; |
| 174 | FILE *f; | 174 | FILE *f; |
| 175 | u_long linenum = 0; | 175 | u_long linenum = 0; |
| 176 | struct stat st; | ||
| 177 | Key *key; | 176 | Key *key; |
| 178 | 177 | ||
| 179 | /* Temporarily use the user's uid. */ | 178 | /* Temporarily use the user's uid. */ |
| @@ -182,27 +181,9 @@ auth_rsa_key_allowed(struct passwd *pw, BIGNUM *client_n, Key **rkey) | |||
| 182 | /* The authorized keys. */ | 181 | /* The authorized keys. */ |
| 183 | file = authorized_keys_file(pw); | 182 | file = authorized_keys_file(pw); |
| 184 | debug("trying public RSA key file %s", file); | 183 | debug("trying public RSA key file %s", file); |
| 185 | 184 | f = auth_openkeyfile(file, pw, options.strict_modes); | |
| 186 | /* Fail quietly if file does not exist */ | ||
| 187 | if (stat(file, &st) < 0) { | ||
| 188 | /* Restore the privileged uid. */ | ||
| 189 | restore_uid(); | ||
| 190 | xfree(file); | ||
| 191 | return (0); | ||
| 192 | } | ||
| 193 | /* Open the file containing the authorized keys. */ | ||
| 194 | f = fopen(file, "r"); | ||
| 195 | if (!f) { | 185 | if (!f) { |
| 196 | /* Restore the privileged uid. */ | ||
| 197 | restore_uid(); | ||
| 198 | xfree(file); | ||
| 199 | return (0); | ||
| 200 | } | ||
| 201 | if (options.strict_modes && | ||
| 202 | secure_filename(f, file, pw, line, sizeof(line)) != 0) { | ||
| 203 | xfree(file); | 186 | xfree(file); |
| 204 | fclose(f); | ||
| 205 | logit("Authentication refused: %s", line); | ||
| 206 | restore_uid(); | 187 | restore_uid(); |
| 207 | return (0); | 188 | return (0); |
| 208 | } | 189 | } |
diff --git a/auth-sia.c b/auth-sia.c index a9e1c258c..debf30201 100644 --- a/auth-sia.c +++ b/auth-sia.c | |||
| @@ -34,6 +34,10 @@ | |||
| 34 | #include <unistd.h> | 34 | #include <unistd.h> |
| 35 | #include <stdarg.h> | 35 | #include <stdarg.h> |
| 36 | #include <string.h> | 36 | #include <string.h> |
| 37 | #include <sys/types.h> | ||
| 38 | #include <sys/security.h> | ||
| 39 | #include <prot.h> | ||
| 40 | #include <time.h> | ||
| 37 | 41 | ||
| 38 | #include "ssh.h" | 42 | #include "ssh.h" |
| 39 | #include "key.h" | 43 | #include "key.h" |
| @@ -49,6 +53,52 @@ extern ServerOptions options; | |||
| 49 | extern int saved_argc; | 53 | extern int saved_argc; |
| 50 | extern char **saved_argv; | 54 | extern char **saved_argv; |
| 51 | 55 | ||
| 56 | static int | ||
| 57 | sia_password_change_required(const char *user) | ||
| 58 | { | ||
| 59 | struct es_passwd *acct; | ||
| 60 | time_t pw_life; | ||
| 61 | time_t pw_date; | ||
| 62 | |||
| 63 | set_auth_parameters(saved_argc, saved_argv); | ||
| 64 | |||
| 65 | if ((acct = getespwnam(user)) == NULL) { | ||
| 66 | error("Couldn't access protected database entry for %s", user); | ||
| 67 | endprpwent(); | ||
| 68 | return (0); | ||
| 69 | } | ||
| 70 | |||
| 71 | /* If forced password change flag is set, honor it */ | ||
| 72 | if (acct->uflg->fg_psw_chg_reqd && acct->ufld->fd_psw_chg_reqd) { | ||
| 73 | endprpwent(); | ||
| 74 | return (1); | ||
| 75 | } | ||
| 76 | |||
| 77 | /* Obtain password lifetime; if none, it can't have expired */ | ||
| 78 | if (acct->uflg->fg_expire) | ||
| 79 | pw_life = acct->ufld->fd_expire; | ||
| 80 | else if (acct->sflg->fg_expire) | ||
| 81 | pw_life = acct->sfld->fd_expire; | ||
| 82 | else { | ||
| 83 | endprpwent(); | ||
| 84 | return (0); | ||
| 85 | } | ||
| 86 | |||
| 87 | /* Offset from last change; if none, it must be expired */ | ||
| 88 | if (acct->uflg->fg_schange) | ||
| 89 | pw_date = acct->ufld->fd_schange + pw_life; | ||
| 90 | else { | ||
| 91 | endprpwent(); | ||
| 92 | return (1); | ||
| 93 | } | ||
| 94 | |||
| 95 | endprpwent(); | ||
| 96 | |||
| 97 | /* If expiration date is prior to now, change password */ | ||
| 98 | |||
| 99 | return (pw_date <= time((time_t *) NULL)); | ||
| 100 | } | ||
| 101 | |||
| 52 | int | 102 | int |
| 53 | sys_auth_passwd(Authctxt *authctxt, const char *pass) | 103 | sys_auth_passwd(Authctxt *authctxt, const char *pass) |
| 54 | { | 104 | { |
| @@ -76,6 +126,9 @@ sys_auth_passwd(Authctxt *authctxt, const char *pass) | |||
| 76 | 126 | ||
| 77 | sia_ses_release(&ent); | 127 | sia_ses_release(&ent); |
| 78 | 128 | ||
| 129 | authctxt->force_pwchange = sia_password_change_required( | ||
| 130 | authctxt->user); | ||
| 131 | |||
| 79 | return (1); | 132 | return (1); |
| 80 | } | 133 | } |
| 81 | 134 | ||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: auth.c,v 1.75 2006/08/03 03:34:41 deraadt Exp $ */ | 1 | /* $OpenBSD: auth.c,v 1.79 2008/07/02 12:03:51 dtucker Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Copyright (c) 2000 Markus Friedl. All rights reserved. | 3 | * Copyright (c) 2000 Markus Friedl. All rights reserved. |
| 4 | * | 4 | * |
| @@ -32,6 +32,7 @@ | |||
| 32 | #include <netinet/in.h> | 32 | #include <netinet/in.h> |
| 33 | 33 | ||
| 34 | #include <errno.h> | 34 | #include <errno.h> |
| 35 | #include <fcntl.h> | ||
| 35 | #ifdef HAVE_PATHS_H | 36 | #ifdef HAVE_PATHS_H |
| 36 | # include <paths.h> | 37 | # include <paths.h> |
| 37 | #endif | 38 | #endif |
| @@ -48,6 +49,7 @@ | |||
| 48 | #include <stdarg.h> | 49 | #include <stdarg.h> |
| 49 | #include <stdio.h> | 50 | #include <stdio.h> |
| 50 | #include <string.h> | 51 | #include <string.h> |
| 52 | #include <unistd.h> | ||
| 51 | 53 | ||
| 52 | #include "xmalloc.h" | 54 | #include "xmalloc.h" |
| 53 | #include "match.h" | 55 | #include "match.h" |
| @@ -114,6 +116,7 @@ allowed_user(struct passwd * pw) | |||
| 114 | #endif /* USE_SHADOW */ | 116 | #endif /* USE_SHADOW */ |
| 115 | 117 | ||
| 116 | /* grab passwd field for locked account check */ | 118 | /* grab passwd field for locked account check */ |
| 119 | passwd = pw->pw_passwd; | ||
| 117 | #ifdef USE_SHADOW | 120 | #ifdef USE_SHADOW |
| 118 | if (spw != NULL) | 121 | if (spw != NULL) |
| 119 | #ifdef USE_LIBIAF | 122 | #ifdef USE_LIBIAF |
| @@ -121,8 +124,6 @@ allowed_user(struct passwd * pw) | |||
| 121 | #else | 124 | #else |
| 122 | passwd = spw->sp_pwdp; | 125 | passwd = spw->sp_pwdp; |
| 123 | #endif /* USE_LIBIAF */ | 126 | #endif /* USE_LIBIAF */ |
| 124 | #else | ||
| 125 | passwd = pw->pw_passwd; | ||
| 126 | #endif | 127 | #endif |
| 127 | 128 | ||
| 128 | /* check for locked account */ | 129 | /* check for locked account */ |
| @@ -443,7 +444,7 @@ reject_blacklisted_key(Key *key, int hostkey) | |||
| 443 | * | 444 | * |
| 444 | * Returns 0 on success and -1 on failure | 445 | * Returns 0 on success and -1 on failure |
| 445 | */ | 446 | */ |
| 446 | int | 447 | static int |
| 447 | secure_filename(FILE *f, const char *file, struct passwd *pw, | 448 | secure_filename(FILE *f, const char *file, struct passwd *pw, |
| 448 | char *err, size_t errlen) | 449 | char *err, size_t errlen) |
| 449 | { | 450 | { |
| @@ -503,6 +504,46 @@ secure_filename(FILE *f, const char *file, struct passwd *pw, | |||
| 503 | return 0; | 504 | return 0; |
| 504 | } | 505 | } |
| 505 | 506 | ||
| 507 | FILE * | ||
| 508 | auth_openkeyfile(const char *file, struct passwd *pw, int strict_modes) | ||
| 509 | { | ||
| 510 | char line[1024]; | ||
| 511 | struct stat st; | ||
| 512 | int fd; | ||
| 513 | FILE *f; | ||
| 514 | |||
| 515 | /* | ||
| 516 | * Open the file containing the authorized keys | ||
| 517 | * Fail quietly if file does not exist | ||
| 518 | */ | ||
| 519 | if ((fd = open(file, O_RDONLY|O_NONBLOCK)) == -1) | ||
| 520 | return NULL; | ||
| 521 | |||
| 522 | if (fstat(fd, &st) < 0) { | ||
| 523 | close(fd); | ||
| 524 | return NULL; | ||
| 525 | } | ||
| 526 | if (!S_ISREG(st.st_mode)) { | ||
| 527 | logit("User %s authorized keys %s is not a regular file", | ||
| 528 | pw->pw_name, file); | ||
| 529 | close(fd); | ||
| 530 | return NULL; | ||
| 531 | } | ||
| 532 | unset_nonblock(fd); | ||
| 533 | if ((f = fdopen(fd, "r")) == NULL) { | ||
| 534 | close(fd); | ||
| 535 | return NULL; | ||
| 536 | } | ||
| 537 | if (options.strict_modes && | ||
| 538 | secure_filename(f, file, pw, line, sizeof(line)) != 0) { | ||
| 539 | fclose(f); | ||
| 540 | logit("Authentication refused: %s", line); | ||
| 541 | return NULL; | ||
| 542 | } | ||
| 543 | |||
| 544 | return f; | ||
| 545 | } | ||
| 546 | |||
| 506 | struct passwd * | 547 | struct passwd * |
| 507 | getpwnamallow(const char *user) | 548 | getpwnamallow(const char *user) |
| 508 | { | 549 | { |
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: auth.h,v 1.58 2006/08/18 09:15:20 markus Exp $ */ | 1 | /* $OpenBSD: auth.h,v 1.61 2008/07/02 12:03:51 dtucker Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Copyright (c) 2000 Markus Friedl. All rights reserved. | 4 | * Copyright (c) 2000 Markus Friedl. All rights reserved. |
| @@ -168,8 +168,7 @@ void abandon_challenge_response(Authctxt *); | |||
| 168 | char *authorized_keys_file(struct passwd *); | 168 | char *authorized_keys_file(struct passwd *); |
| 169 | char *authorized_keys_file2(struct passwd *); | 169 | char *authorized_keys_file2(struct passwd *); |
| 170 | 170 | ||
| 171 | int | 171 | FILE *auth_openkeyfile(const char *, struct passwd *, int); |
| 172 | secure_filename(FILE *, const char *, struct passwd *, char *, size_t); | ||
| 173 | 172 | ||
| 174 | HostStatus | 173 | HostStatus |
| 175 | check_key_in_hostfiles(struct passwd *, Key *, const char *, | 174 | check_key_in_hostfiles(struct passwd *, Key *, const char *, |
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: auth1.c,v 1.70 2006/08/03 03:34:41 deraadt Exp $ */ | 1 | /* $OpenBSD: auth1.c,v 1.73 2008/07/04 23:30:16 djm Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 3 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
| 4 | * All rights reserved | 4 | * All rights reserved |
| @@ -20,6 +20,7 @@ | |||
| 20 | #include <unistd.h> | 20 | #include <unistd.h> |
| 21 | #include <pwd.h> | 21 | #include <pwd.h> |
| 22 | 22 | ||
| 23 | #include "openbsd-compat/sys-queue.h" | ||
| 23 | #include "xmalloc.h" | 24 | #include "xmalloc.h" |
| 24 | #include "rsa.h" | 25 | #include "rsa.h" |
| 25 | #include "ssh1.h" | 26 | #include "ssh1.h" |
| @@ -283,6 +284,8 @@ do_authloop(Authctxt *authctxt) | |||
| 283 | type != SSH_CMSG_AUTH_TIS_RESPONSE) | 284 | type != SSH_CMSG_AUTH_TIS_RESPONSE) |
| 284 | abandon_challenge_response(authctxt); | 285 | abandon_challenge_response(authctxt); |
| 285 | 286 | ||
| 287 | if (authctxt->failures >= options.max_authtries) | ||
| 288 | goto skip; | ||
| 286 | if ((meth = lookup_authmethod1(type)) == NULL) { | 289 | if ((meth = lookup_authmethod1(type)) == NULL) { |
| 287 | logit("Unknown message during authentication: " | 290 | logit("Unknown message during authentication: " |
| 288 | "type %d", type); | 291 | "type %d", type); |
| @@ -351,7 +354,7 @@ do_authloop(Authctxt *authctxt) | |||
| 351 | msg[len] = '\0'; | 354 | msg[len] = '\0'; |
| 352 | else | 355 | else |
| 353 | msg = "Access denied."; | 356 | msg = "Access denied."; |
| 354 | packet_disconnect(msg); | 357 | packet_disconnect("%s", msg); |
| 355 | } | 358 | } |
| 356 | #endif | 359 | #endif |
| 357 | 360 | ||
| @@ -367,7 +370,7 @@ do_authloop(Authctxt *authctxt) | |||
| 367 | if (authenticated) | 370 | if (authenticated) |
| 368 | return; | 371 | return; |
| 369 | 372 | ||
| 370 | if (authctxt->failures++ > options.max_authtries) { | 373 | if (++authctxt->failures >= options.max_authtries) { |
| 371 | #ifdef SSH_AUDIT_EVENTS | 374 | #ifdef SSH_AUDIT_EVENTS |
| 372 | PRIVSEP(audit_event(SSH_LOGIN_EXCEED_MAXTRIES)); | 375 | PRIVSEP(audit_event(SSH_LOGIN_EXCEED_MAXTRIES)); |
| 373 | #endif | 376 | #endif |
diff --git a/auth2-chall.c b/auth2-chall.c index 51059c2bd..d816578c6 100644 --- a/auth2-chall.c +++ b/auth2-chall.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: auth2-chall.c,v 1.32 2007/01/03 03:01:40 stevesk Exp $ */ | 1 | /* $OpenBSD: auth2-chall.c,v 1.33 2007/09/21 08:15:29 djm Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Copyright (c) 2001 Markus Friedl. All rights reserved. | 3 | * Copyright (c) 2001 Markus Friedl. All rights reserved. |
| 4 | * Copyright (c) 2001 Per Allansson. All rights reserved. | 4 | * Copyright (c) 2001 Per Allansson. All rights reserved. |
diff --git a/auth2-gss.c b/auth2-gss.c index 50bdc6452..9f76f59bd 100644 --- a/auth2-gss.c +++ b/auth2-gss.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: auth2-gss.c,v 1.15 2006/08/03 03:34:41 deraadt Exp $ */ | 1 | /* $OpenBSD: auth2-gss.c,v 1.16 2007/10/29 00:52:45 dtucker Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved. | 4 | * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved. |
diff --git a/auth2-hostbased.c b/auth2-hostbased.c index f6fb74043..bc933d434 100644 --- a/auth2-hostbased.c +++ b/auth2-hostbased.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: auth2-hostbased.c,v 1.11 2006/08/03 03:34:41 deraadt Exp $ */ | 1 | /* $OpenBSD: auth2-hostbased.c,v 1.12 2008/07/17 08:51:07 djm Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Copyright (c) 2000 Markus Friedl. All rights reserved. | 3 | * Copyright (c) 2000 Markus Friedl. All rights reserved. |
| 4 | * | 4 | * |
| @@ -154,15 +154,16 @@ hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost, | |||
| 154 | debug2("userauth_hostbased: chost %s resolvedname %s ipaddr %s", | 154 | debug2("userauth_hostbased: chost %s resolvedname %s ipaddr %s", |
| 155 | chost, resolvedname, ipaddr); | 155 | chost, resolvedname, ipaddr); |
| 156 | 156 | ||
| 157 | if (((len = strlen(chost)) > 0) && chost[len - 1] == '.') { | ||
| 158 | debug2("stripping trailing dot from chost %s", chost); | ||
| 159 | chost[len - 1] = '\0'; | ||
| 160 | } | ||
| 161 | |||
| 157 | if (options.hostbased_uses_name_from_packet_only) { | 162 | if (options.hostbased_uses_name_from_packet_only) { |
| 158 | if (auth_rhosts2(pw, cuser, chost, chost) == 0) | 163 | if (auth_rhosts2(pw, cuser, chost, chost) == 0) |
| 159 | return 0; | 164 | return 0; |
| 160 | lookup = chost; | 165 | lookup = chost; |
| 161 | } else { | 166 | } else { |
| 162 | if (((len = strlen(chost)) > 0) && chost[len - 1] == '.') { | ||
| 163 | debug2("stripping trailing dot from chost %s", chost); | ||
| 164 | chost[len - 1] = '\0'; | ||
| 165 | } | ||
| 166 | if (strcasecmp(resolvedname, chost) != 0) | 167 | if (strcasecmp(resolvedname, chost) != 0) |
| 167 | logit("userauth_hostbased mismatch: " | 168 | logit("userauth_hostbased mismatch: " |
| 168 | "client sends %s, but we resolve %s to %s", | 169 | "client sends %s, but we resolve %s to %s", |
diff --git a/auth2-none.c b/auth2-none.c index 952b44824..10accfe55 100644 --- a/auth2-none.c +++ b/auth2-none.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: auth2-none.c,v 1.13 2006/08/05 07:52:52 dtucker Exp $ */ | 1 | /* $OpenBSD: auth2-none.c,v 1.15 2008/07/02 12:36:39 djm Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Copyright (c) 2000 Markus Friedl. All rights reserved. | 3 | * Copyright (c) 2000 Markus Friedl. All rights reserved. |
| 4 | * | 4 | * |
| @@ -31,8 +31,10 @@ | |||
| 31 | 31 | ||
| 32 | #include <fcntl.h> | 32 | #include <fcntl.h> |
| 33 | #include <stdarg.h> | 33 | #include <stdarg.h> |
| 34 | #include <string.h> | ||
| 34 | #include <unistd.h> | 35 | #include <unistd.h> |
| 35 | 36 | ||
| 37 | #include "atomicio.h" | ||
| 36 | #include "xmalloc.h" | 38 | #include "xmalloc.h" |
| 37 | #include "key.h" | 39 | #include "key.h" |
| 38 | #include "hostfile.h" | 40 | #include "hostfile.h" |
| @@ -41,7 +43,6 @@ | |||
| 41 | #include "log.h" | 43 | #include "log.h" |
| 42 | #include "buffer.h" | 44 | #include "buffer.h" |
| 43 | #include "servconf.h" | 45 | #include "servconf.h" |
| 44 | #include "atomicio.h" | ||
| 45 | #include "compat.h" | 46 | #include "compat.h" |
| 46 | #include "ssh2.h" | 47 | #include "ssh2.h" |
| 47 | #ifdef GSSAPI | 48 | #ifdef GSSAPI |
| @@ -55,75 +56,11 @@ extern ServerOptions options; | |||
| 55 | /* "none" is allowed only one time */ | 56 | /* "none" is allowed only one time */ |
| 56 | static int none_enabled = 1; | 57 | static int none_enabled = 1; |
| 57 | 58 | ||
| 58 | char * | ||
| 59 | auth2_read_banner(void) | ||
| 60 | { | ||
| 61 | struct stat st; | ||
| 62 | char *banner = NULL; | ||
| 63 | size_t len, n; | ||
| 64 | int fd; | ||
| 65 | |||
| 66 | if ((fd = open(options.banner, O_RDONLY)) == -1) | ||
| 67 | return (NULL); | ||
| 68 | if (fstat(fd, &st) == -1) { | ||
| 69 | close(fd); | ||
| 70 | return (NULL); | ||
| 71 | } | ||
| 72 | if (st.st_size > 1*1024*1024) { | ||
| 73 | close(fd); | ||
| 74 | return (NULL); | ||
| 75 | } | ||
| 76 | |||
| 77 | len = (size_t)st.st_size; /* truncate */ | ||
| 78 | banner = xmalloc(len + 1); | ||
| 79 | n = atomicio(read, fd, banner, len); | ||
| 80 | close(fd); | ||
| 81 | |||
| 82 | if (n != len) { | ||
| 83 | xfree(banner); | ||
| 84 | return (NULL); | ||
| 85 | } | ||
| 86 | banner[n] = '\0'; | ||
| 87 | |||
| 88 | return (banner); | ||
| 89 | } | ||
| 90 | |||
| 91 | void | ||
| 92 | userauth_send_banner(const char *msg) | ||
| 93 | { | ||
| 94 | if (datafellows & SSH_BUG_BANNER) | ||
| 95 | return; | ||
| 96 | |||
| 97 | packet_start(SSH2_MSG_USERAUTH_BANNER); | ||
| 98 | packet_put_cstring(msg); | ||
| 99 | packet_put_cstring(""); /* language, unused */ | ||
| 100 | packet_send(); | ||
| 101 | debug("%s: sent", __func__); | ||
| 102 | } | ||
| 103 | |||
| 104 | static void | ||
| 105 | userauth_banner(void) | ||
| 106 | { | ||
| 107 | char *banner = NULL; | ||
| 108 | |||
| 109 | if (options.banner == NULL || (datafellows & SSH_BUG_BANNER)) | ||
| 110 | return; | ||
| 111 | |||
| 112 | if ((banner = PRIVSEP(auth2_read_banner())) == NULL) | ||
| 113 | goto done; | ||
| 114 | userauth_send_banner(banner); | ||
| 115 | |||
| 116 | done: | ||
| 117 | if (banner) | ||
| 118 | xfree(banner); | ||
| 119 | } | ||
| 120 | |||
| 121 | static int | 59 | static int |
| 122 | userauth_none(Authctxt *authctxt) | 60 | userauth_none(Authctxt *authctxt) |
| 123 | { | 61 | { |
| 124 | none_enabled = 0; | 62 | none_enabled = 0; |
| 125 | packet_check_eom(); | 63 | packet_check_eom(); |
| 126 | userauth_banner(); | ||
| 127 | #ifdef HAVE_CYGWIN | 64 | #ifdef HAVE_CYGWIN |
| 128 | if (check_nt_auth(1, authctxt->pw) == 0) | 65 | if (check_nt_auth(1, authctxt->pw) == 0) |
| 129 | return (0); | 66 | return (0); |
diff --git a/auth2-pubkey.c b/auth2-pubkey.c index 4f305ef1b..4014444fb 100644 --- a/auth2-pubkey.c +++ b/auth2-pubkey.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: auth2-pubkey.c,v 1.15 2006/08/03 03:34:41 deraadt Exp $ */ | 1 | /* $OpenBSD: auth2-pubkey.c,v 1.19 2008/07/03 21:46:58 otto Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Copyright (c) 2000 Markus Friedl. All rights reserved. | 3 | * Copyright (c) 2000 Markus Friedl. All rights reserved. |
| 4 | * | 4 | * |
| @@ -28,9 +28,11 @@ | |||
| 28 | #include <sys/types.h> | 28 | #include <sys/types.h> |
| 29 | #include <sys/stat.h> | 29 | #include <sys/stat.h> |
| 30 | 30 | ||
| 31 | #include <fcntl.h> | ||
| 31 | #include <pwd.h> | 32 | #include <pwd.h> |
| 32 | #include <stdio.h> | 33 | #include <stdio.h> |
| 33 | #include <stdarg.h> | 34 | #include <stdarg.h> |
| 35 | #include <unistd.h> | ||
| 34 | 36 | ||
| 35 | #include "xmalloc.h" | 37 | #include "xmalloc.h" |
| 36 | #include "ssh.h" | 38 | #include "ssh.h" |
| @@ -183,7 +185,6 @@ user_key_allowed2(struct passwd *pw, Key *key, char *file) | |||
| 183 | int found_key = 0; | 185 | int found_key = 0; |
| 184 | FILE *f; | 186 | FILE *f; |
| 185 | u_long linenum = 0; | 187 | u_long linenum = 0; |
| 186 | struct stat st; | ||
| 187 | Key *found; | 188 | Key *found; |
| 188 | char *fp; | 189 | char *fp; |
| 189 | 190 | ||
| @@ -191,24 +192,9 @@ user_key_allowed2(struct passwd *pw, Key *key, char *file) | |||
| 191 | temporarily_use_uid(pw); | 192 | temporarily_use_uid(pw); |
| 192 | 193 | ||
| 193 | debug("trying public key file %s", file); | 194 | debug("trying public key file %s", file); |
| 195 | f = auth_openkeyfile(file, pw, options.strict_modes); | ||
| 194 | 196 | ||
| 195 | /* Fail quietly if file does not exist */ | ||
| 196 | if (stat(file, &st) < 0) { | ||
| 197 | /* Restore the privileged uid. */ | ||
| 198 | restore_uid(); | ||
| 199 | return 0; | ||
| 200 | } | ||
| 201 | /* Open the file containing the authorized keys. */ | ||
| 202 | f = fopen(file, "r"); | ||
| 203 | if (!f) { | 197 | if (!f) { |
| 204 | /* Restore the privileged uid. */ | ||
| 205 | restore_uid(); | ||
| 206 | return 0; | ||
| 207 | } | ||
| 208 | if (options.strict_modes && | ||
| 209 | secure_filename(f, file, pw, line, sizeof(line)) != 0) { | ||
| 210 | fclose(f); | ||
| 211 | logit("Authentication refused: %s", line); | ||
| 212 | restore_uid(); | 198 | restore_uid(); |
| 213 | return 0; | 199 | return 0; |
| 214 | } | 200 | } |
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: auth2.c,v 1.115 2007/04/14 22:01:58 stevesk Exp $ */ | 1 | /* $OpenBSD: auth2.c,v 1.119 2008/07/04 23:30:16 djm Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Copyright (c) 2000 Markus Friedl. All rights reserved. | 3 | * Copyright (c) 2000 Markus Friedl. All rights reserved. |
| 4 | * | 4 | * |
| @@ -26,12 +26,17 @@ | |||
| 26 | #include "includes.h" | 26 | #include "includes.h" |
| 27 | 27 | ||
| 28 | #include <sys/types.h> | 28 | #include <sys/types.h> |
| 29 | #include <sys/stat.h> | ||
| 30 | #include <sys/uio.h> | ||
| 29 | 31 | ||
| 32 | #include <fcntl.h> | ||
| 30 | #include <pwd.h> | 33 | #include <pwd.h> |
| 31 | #include <stdarg.h> | 34 | #include <stdarg.h> |
| 32 | #include <string.h> | 35 | #include <string.h> |
| 36 | #include <unistd.h> | ||
| 33 | 37 | ||
| 34 | #include "xmalloc.h" | 38 | #include "xmalloc.h" |
| 39 | #include "atomicio.h" | ||
| 35 | #include "ssh2.h" | 40 | #include "ssh2.h" |
| 36 | #include "packet.h" | 41 | #include "packet.h" |
| 37 | #include "log.h" | 42 | #include "log.h" |
| @@ -89,12 +94,75 @@ static void input_userauth_request(int, u_int32_t, void *); | |||
| 89 | /* helper */ | 94 | /* helper */ |
| 90 | static Authmethod *authmethod_lookup(const char *); | 95 | static Authmethod *authmethod_lookup(const char *); |
| 91 | static char *authmethods_get(void); | 96 | static char *authmethods_get(void); |
| 92 | int user_key_allowed(struct passwd *, Key *); | 97 | |
| 98 | char * | ||
| 99 | auth2_read_banner(void) | ||
| 100 | { | ||
| 101 | struct stat st; | ||
| 102 | char *banner = NULL; | ||
| 103 | size_t len, n; | ||
| 104 | int fd; | ||
| 105 | |||
| 106 | if ((fd = open(options.banner, O_RDONLY)) == -1) | ||
| 107 | return (NULL); | ||
| 108 | if (fstat(fd, &st) == -1) { | ||
| 109 | close(fd); | ||
| 110 | return (NULL); | ||
| 111 | } | ||
| 112 | if (st.st_size > 1*1024*1024) { | ||
| 113 | close(fd); | ||
| 114 | return (NULL); | ||
| 115 | } | ||
| 116 | |||
| 117 | len = (size_t)st.st_size; /* truncate */ | ||
| 118 | banner = xmalloc(len + 1); | ||
| 119 | n = atomicio(read, fd, banner, len); | ||
| 120 | close(fd); | ||
| 121 | |||
| 122 | if (n != len) { | ||
| 123 | xfree(banner); | ||
| 124 | return (NULL); | ||
| 125 | } | ||
| 126 | banner[n] = '\0'; | ||
| 127 | |||
| 128 | return (banner); | ||
| 129 | } | ||
| 130 | |||
| 131 | void | ||
| 132 | userauth_send_banner(const char *msg) | ||
| 133 | { | ||
| 134 | if (datafellows & SSH_BUG_BANNER) | ||
| 135 | return; | ||
| 136 | |||
| 137 | packet_start(SSH2_MSG_USERAUTH_BANNER); | ||
| 138 | packet_put_cstring(msg); | ||
| 139 | packet_put_cstring(""); /* language, unused */ | ||
| 140 | packet_send(); | ||
| 141 | debug("%s: sent", __func__); | ||
| 142 | } | ||
| 143 | |||
| 144 | static void | ||
| 145 | userauth_banner(void) | ||
| 146 | { | ||
| 147 | char *banner = NULL; | ||
| 148 | |||
| 149 | if (options.banner == NULL || | ||
| 150 | strcasecmp(options.banner, "none") == 0 || | ||
| 151 | (datafellows & SSH_BUG_BANNER) != 0) | ||
| 152 | return; | ||
| 153 | |||
| 154 | if ((banner = PRIVSEP(auth2_read_banner())) == NULL) | ||
| 155 | goto done; | ||
| 156 | userauth_send_banner(banner); | ||
| 157 | |||
| 158 | done: | ||
| 159 | if (banner) | ||
| 160 | xfree(banner); | ||
| 161 | } | ||
| 93 | 162 | ||
| 94 | /* | 163 | /* |
| 95 | * loop until authctxt->success == TRUE | 164 | * loop until authctxt->success == TRUE |
| 96 | */ | 165 | */ |
| 97 | |||
| 98 | void | 166 | void |
| 99 | do_authentication2(Authctxt *authctxt) | 167 | do_authentication2(Authctxt *authctxt) |
| 100 | { | 168 | { |
| @@ -188,6 +256,7 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt) | |||
| 188 | authctxt->role = role ? xstrdup(role) : NULL; | 256 | authctxt->role = role ? xstrdup(role) : NULL; |
| 189 | if (use_privsep) | 257 | if (use_privsep) |
| 190 | mm_inform_authserv(service, style, role); | 258 | mm_inform_authserv(service, style, role); |
| 259 | userauth_banner(); | ||
| 191 | } else if (strcmp(user, authctxt->user) != 0 || | 260 | } else if (strcmp(user, authctxt->user) != 0 || |
| 192 | strcmp(service, authctxt->service) != 0) { | 261 | strcmp(service, authctxt->service) != 0) { |
| 193 | packet_disconnect("Change of username or service not allowed: " | 262 | packet_disconnect("Change of username or service not allowed: " |
| @@ -207,7 +276,7 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt) | |||
| 207 | 276 | ||
| 208 | /* try to authenticate user */ | 277 | /* try to authenticate user */ |
| 209 | m = authmethod_lookup(method); | 278 | m = authmethod_lookup(method); |
| 210 | if (m != NULL) { | 279 | if (m != NULL && authctxt->failures < options.max_authtries) { |
| 211 | debug2("input_userauth_request: try method %s", method); | 280 | debug2("input_userauth_request: try method %s", method); |
| 212 | authenticated = m->userauth(authctxt); | 281 | authenticated = m->userauth(authctxt); |
| 213 | } | 282 | } |
| @@ -274,9 +343,13 @@ userauth_finish(Authctxt *authctxt, int authenticated, char *method) | |||
| 274 | /* now we can break out */ | 343 | /* now we can break out */ |
| 275 | authctxt->success = 1; | 344 | authctxt->success = 1; |
| 276 | } else { | 345 | } else { |
| 277 | /* Dont count server configuration issues against the client */ | 346 | |
| 278 | if (!authctxt->server_caused_failure && | 347 | /* Allow initial try of "none" auth without failure penalty */ |
| 279 | authctxt->failures++ > options.max_authtries) { | 348 | /* Don't count server configuration issues against the client */ |
| 349 | if (!authctxt->server_caused_failure && | ||
| 350 | (authctxt->attempt > 1 || strcmp(method, "none") != 0)) | ||
| 351 | authctxt->failures++; | ||
| 352 | if (authctxt->failures >= options.max_authtries) { | ||
| 280 | #ifdef SSH_AUDIT_EVENTS | 353 | #ifdef SSH_AUDIT_EVENTS |
| 281 | PRIVSEP(audit_event(SSH_LOGIN_EXCEED_MAXTRIES)); | 354 | PRIVSEP(audit_event(SSH_LOGIN_EXCEED_MAXTRIES)); |
| 282 | #endif | 355 | #endif |
| @@ -332,3 +405,4 @@ authmethod_lookup(const char *name) | |||
| 332 | name ? name : "NULL"); | 405 | name ? name : "NULL"); |
| 333 | return NULL; | 406 | return NULL; |
| 334 | } | 407 | } |
| 408 | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: bufaux.c,v 1.44 2006/08/03 03:34:41 deraadt Exp $ */ | 1 | /* $OpenBSD: bufaux.c,v 1.46 2008/06/10 23:21:34 dtucker Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
| @@ -180,7 +180,7 @@ buffer_get_string_ret(Buffer *buffer, u_int *length_ptr) | |||
| 180 | return (NULL); | 180 | return (NULL); |
| 181 | } | 181 | } |
| 182 | /* Append a null character to make processing easier. */ | 182 | /* Append a null character to make processing easier. */ |
| 183 | value[len] = 0; | 183 | value[len] = '\0'; |
| 184 | /* Optionally return the length of the string. */ | 184 | /* Optionally return the length of the string. */ |
| 185 | if (length_ptr) | 185 | if (length_ptr) |
| 186 | *length_ptr = len; | 186 | *length_ptr = len; |
| @@ -197,6 +197,22 @@ buffer_get_string(Buffer *buffer, u_int *length_ptr) | |||
| 197 | return (ret); | 197 | return (ret); |
| 198 | } | 198 | } |
| 199 | 199 | ||
| 200 | void * | ||
| 201 | buffer_get_string_ptr(Buffer *buffer, u_int *length_ptr) | ||
| 202 | { | ||
| 203 | void *ptr; | ||
| 204 | u_int len; | ||
| 205 | |||
| 206 | len = buffer_get_int(buffer); | ||
| 207 | if (len > 256 * 1024) | ||
| 208 | fatal("buffer_get_string_ptr: bad string length %u", len); | ||
| 209 | ptr = buffer_ptr(buffer); | ||
| 210 | buffer_consume(buffer, len); | ||
| 211 | if (length_ptr) | ||
| 212 | *length_ptr = len; | ||
| 213 | return (ptr); | ||
| 214 | } | ||
| 215 | |||
| 200 | /* | 216 | /* |
| 201 | * Stores and arbitrary binary string in the buffer. | 217 | * Stores and arbitrary binary string in the buffer. |
| 202 | */ | 218 | */ |
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: buffer.h,v 1.16 2006/08/03 03:34:41 deraadt Exp $ */ | 1 | /* $OpenBSD: buffer.h,v 1.17 2008/05/08 06:59:01 markus Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| @@ -66,6 +66,7 @@ int buffer_get_char(Buffer *); | |||
| 66 | void buffer_put_char(Buffer *, int); | 66 | void buffer_put_char(Buffer *, int); |
| 67 | 67 | ||
| 68 | void *buffer_get_string(Buffer *, u_int *); | 68 | void *buffer_get_string(Buffer *, u_int *); |
| 69 | void *buffer_get_string_ptr(Buffer *, u_int *); | ||
| 69 | void buffer_put_string(Buffer *, const void *, u_int); | 70 | void buffer_put_string(Buffer *, const void *, u_int); |
| 70 | void buffer_put_cstring(Buffer *, const char *); | 71 | void buffer_put_cstring(Buffer *, const char *); |
| 71 | 72 | ||
diff --git a/canohost.c b/canohost.c index 2345cc35c..42011fd0a 100644 --- a/canohost.c +++ b/canohost.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: canohost.c,v 1.61 2006/08/03 03:34:41 deraadt Exp $ */ | 1 | /* $OpenBSD: canohost.c,v 1.63 2008/06/12 00:03:49 dtucker Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
| @@ -32,6 +32,7 @@ | |||
| 32 | #include "packet.h" | 32 | #include "packet.h" |
| 33 | #include "log.h" | 33 | #include "log.h" |
| 34 | #include "canohost.h" | 34 | #include "canohost.h" |
| 35 | #include "misc.h" | ||
| 35 | 36 | ||
| 36 | static void check_ip_options(int, char *); | 37 | static void check_ip_options(int, char *); |
| 37 | 38 | ||
| @@ -88,7 +89,7 @@ get_remote_hostname(int sock, int use_dns) | |||
| 88 | memset(&hints, 0, sizeof(hints)); | 89 | memset(&hints, 0, sizeof(hints)); |
| 89 | hints.ai_socktype = SOCK_DGRAM; /*dummy*/ | 90 | hints.ai_socktype = SOCK_DGRAM; /*dummy*/ |
| 90 | hints.ai_flags = AI_NUMERICHOST; | 91 | hints.ai_flags = AI_NUMERICHOST; |
| 91 | if (getaddrinfo(name, "0", &hints, &ai) == 0) { | 92 | if (getaddrinfo(name, NULL, &hints, &ai) == 0) { |
| 92 | logit("Nasty PTR record \"%s\" is set up for %s, ignoring", | 93 | logit("Nasty PTR record \"%s\" is set up for %s, ignoring", |
| 93 | name, ntop); | 94 | name, ntop); |
| 94 | freeaddrinfo(ai); | 95 | freeaddrinfo(ai); |
| @@ -271,7 +272,7 @@ get_socket_address(int sock, int remote, int flags) | |||
| 271 | if ((r = getnameinfo((struct sockaddr *)&addr, addrlen, ntop, | 272 | if ((r = getnameinfo((struct sockaddr *)&addr, addrlen, ntop, |
| 272 | sizeof(ntop), NULL, 0, flags)) != 0) { | 273 | sizeof(ntop), NULL, 0, flags)) != 0) { |
| 273 | error("get_socket_address: getnameinfo %d failed: %s", flags, | 274 | error("get_socket_address: getnameinfo %d failed: %s", flags, |
| 274 | r == EAI_SYSTEM ? strerror(errno) : gai_strerror(r)); | 275 | ssh_gai_strerror(r)); |
| 275 | return NULL; | 276 | return NULL; |
| 276 | } | 277 | } |
| 277 | return xstrdup(ntop); | 278 | return xstrdup(ntop); |
| @@ -372,7 +373,7 @@ get_sock_port(int sock, int local) | |||
| 372 | if ((r = getnameinfo((struct sockaddr *)&from, fromlen, NULL, 0, | 373 | if ((r = getnameinfo((struct sockaddr *)&from, fromlen, NULL, 0, |
| 373 | strport, sizeof(strport), NI_NUMERICSERV)) != 0) | 374 | strport, sizeof(strport), NI_NUMERICSERV)) != 0) |
| 374 | fatal("get_sock_port: getnameinfo NI_NUMERICSERV failed: %s", | 375 | fatal("get_sock_port: getnameinfo NI_NUMERICSERV failed: %s", |
| 375 | r == EAI_SYSTEM ? strerror(errno) : gai_strerror(r)); | 376 | ssh_gai_strerror(r)); |
| 376 | return atoi(strport); | 377 | return atoi(strport); |
| 377 | } | 378 | } |
| 378 | 379 | ||
diff --git a/channels.c b/channels.c index 900ab848f..c293eadf1 100644 --- a/channels.c +++ b/channels.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: channels.c,v 1.270 2007/06/25 08:20:03 dtucker Exp $ */ | 1 | /* $OpenBSD: channels.c,v 1.286 2008/07/16 11:52:19 djm Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
| @@ -61,6 +61,7 @@ | |||
| 61 | #include <unistd.h> | 61 | #include <unistd.h> |
| 62 | #include <stdarg.h> | 62 | #include <stdarg.h> |
| 63 | 63 | ||
| 64 | #include "openbsd-compat/sys-queue.h" | ||
| 64 | #include "xmalloc.h" | 65 | #include "xmalloc.h" |
| 65 | #include "ssh.h" | 66 | #include "ssh.h" |
| 66 | #include "ssh1.h" | 67 | #include "ssh1.h" |
| @@ -164,6 +165,10 @@ static int IPv4or6 = AF_UNSPEC; | |||
| 164 | /* helper */ | 165 | /* helper */ |
| 165 | static void port_open_helper(Channel *c, char *rtype); | 166 | static void port_open_helper(Channel *c, char *rtype); |
| 166 | 167 | ||
| 168 | /* non-blocking connect helpers */ | ||
| 169 | static int connect_next(struct channel_connect *); | ||
| 170 | static void channel_connect_ctx_free(struct channel_connect *); | ||
| 171 | |||
| 167 | /* -- channel core */ | 172 | /* -- channel core */ |
| 168 | 173 | ||
| 169 | Channel * | 174 | Channel * |
| @@ -216,7 +221,7 @@ channel_lookup(int id) | |||
| 216 | */ | 221 | */ |
| 217 | static void | 222 | static void |
| 218 | channel_register_fds(Channel *c, int rfd, int wfd, int efd, | 223 | channel_register_fds(Channel *c, int rfd, int wfd, int efd, |
| 219 | int extusage, int nonblock) | 224 | int extusage, int nonblock, int is_tty) |
| 220 | { | 225 | { |
| 221 | /* Update the maximum file descriptor value. */ | 226 | /* Update the maximum file descriptor value. */ |
| 222 | channel_max_fd = MAX(channel_max_fd, rfd); | 227 | channel_max_fd = MAX(channel_max_fd, rfd); |
| @@ -232,18 +237,9 @@ channel_register_fds(Channel *c, int rfd, int wfd, int efd, | |||
| 232 | c->efd = efd; | 237 | c->efd = efd; |
| 233 | c->extended_usage = extusage; | 238 | c->extended_usage = extusage; |
| 234 | 239 | ||
| 235 | /* XXX ugly hack: nonblock is only set by the server */ | 240 | if ((c->isatty = is_tty) != 0) |
| 236 | if (nonblock && isatty(c->rfd)) { | ||
| 237 | debug2("channel %d: rfd %d isatty", c->self, c->rfd); | 241 | debug2("channel %d: rfd %d isatty", c->self, c->rfd); |
| 238 | c->isatty = 1; | 242 | c->wfd_isatty = is_tty || isatty(c->wfd); |
| 239 | if (!isatty(c->wfd)) { | ||
| 240 | error("channel %d: wfd %d is not a tty?", | ||
| 241 | c->self, c->wfd); | ||
| 242 | } | ||
| 243 | } else { | ||
| 244 | c->isatty = 0; | ||
| 245 | } | ||
| 246 | c->wfd_isatty = isatty(c->wfd); | ||
| 247 | 243 | ||
| 248 | /* enable nonblocking mode */ | 244 | /* enable nonblocking mode */ |
| 249 | if (nonblock) { | 245 | if (nonblock) { |
| @@ -303,7 +299,7 @@ channel_new(char *ctype, int type, int rfd, int wfd, int efd, | |||
| 303 | c->ostate = CHAN_OUTPUT_OPEN; | 299 | c->ostate = CHAN_OUTPUT_OPEN; |
| 304 | c->istate = CHAN_INPUT_OPEN; | 300 | c->istate = CHAN_INPUT_OPEN; |
| 305 | c->flags = 0; | 301 | c->flags = 0; |
| 306 | channel_register_fds(c, rfd, wfd, efd, extusage, nonblock); | 302 | channel_register_fds(c, rfd, wfd, efd, extusage, nonblock, 0); |
| 307 | c->self = found; | 303 | c->self = found; |
| 308 | c->type = type; | 304 | c->type = type; |
| 309 | c->ctype = ctype; | 305 | c->ctype = ctype; |
| @@ -319,10 +315,13 @@ channel_new(char *ctype, int type, int rfd, int wfd, int efd, | |||
| 319 | c->single_connection = 0; | 315 | c->single_connection = 0; |
| 320 | c->detach_user = NULL; | 316 | c->detach_user = NULL; |
| 321 | c->detach_close = 0; | 317 | c->detach_close = 0; |
| 322 | c->confirm = NULL; | 318 | c->open_confirm = NULL; |
| 323 | c->confirm_ctx = NULL; | 319 | c->open_confirm_ctx = NULL; |
| 324 | c->input_filter = NULL; | 320 | c->input_filter = NULL; |
| 325 | c->output_filter = NULL; | 321 | c->output_filter = NULL; |
| 322 | c->filter_ctx = NULL; | ||
| 323 | c->filter_cleanup = NULL; | ||
| 324 | TAILQ_INIT(&c->status_confirms); | ||
| 326 | debug("channel %d: new [%s]", found, remote_name); | 325 | debug("channel %d: new [%s]", found, remote_name); |
| 327 | return c; | 326 | return c; |
| 328 | } | 327 | } |
| @@ -379,6 +378,7 @@ channel_free(Channel *c) | |||
| 379 | { | 378 | { |
| 380 | char *s; | 379 | char *s; |
| 381 | u_int i, n; | 380 | u_int i, n; |
| 381 | struct channel_confirm *cc; | ||
| 382 | 382 | ||
| 383 | for (n = 0, i = 0; i < channels_alloc; i++) | 383 | for (n = 0, i = 0; i < channels_alloc; i++) |
| 384 | if (channels[i]) | 384 | if (channels[i]) |
| @@ -402,6 +402,15 @@ channel_free(Channel *c) | |||
| 402 | xfree(c->remote_name); | 402 | xfree(c->remote_name); |
| 403 | c->remote_name = NULL; | 403 | c->remote_name = NULL; |
| 404 | } | 404 | } |
| 405 | while ((cc = TAILQ_FIRST(&c->status_confirms)) != NULL) { | ||
| 406 | if (cc->abandon_cb != NULL) | ||
| 407 | cc->abandon_cb(c, cc->ctx); | ||
| 408 | TAILQ_REMOVE(&c->status_confirms, cc, entry); | ||
| 409 | bzero(cc, sizeof(*cc)); | ||
| 410 | xfree(cc); | ||
| 411 | } | ||
| 412 | if (c->filter_cleanup != NULL && c->filter_ctx != NULL) | ||
| 413 | c->filter_cleanup(c->self, c->filter_ctx); | ||
| 405 | channels[c->self] = NULL; | 414 | channels[c->self] = NULL; |
| 406 | xfree(c); | 415 | xfree(c); |
| 407 | } | 416 | } |
| @@ -660,16 +669,33 @@ channel_request_start(int id, char *service, int wantconfirm) | |||
| 660 | } | 669 | } |
| 661 | 670 | ||
| 662 | void | 671 | void |
| 663 | channel_register_confirm(int id, channel_callback_fn *fn, void *ctx) | 672 | channel_register_status_confirm(int id, channel_confirm_cb *cb, |
| 673 | channel_confirm_abandon_cb *abandon_cb, void *ctx) | ||
| 674 | { | ||
| 675 | struct channel_confirm *cc; | ||
| 676 | Channel *c; | ||
| 677 | |||
| 678 | if ((c = channel_lookup(id)) == NULL) | ||
| 679 | fatal("channel_register_expect: %d: bad id", id); | ||
| 680 | |||
| 681 | cc = xmalloc(sizeof(*cc)); | ||
| 682 | cc->cb = cb; | ||
| 683 | cc->abandon_cb = abandon_cb; | ||
| 684 | cc->ctx = ctx; | ||
| 685 | TAILQ_INSERT_TAIL(&c->status_confirms, cc, entry); | ||
| 686 | } | ||
| 687 | |||
| 688 | void | ||
| 689 | channel_register_open_confirm(int id, channel_callback_fn *fn, void *ctx) | ||
| 664 | { | 690 | { |
| 665 | Channel *c = channel_lookup(id); | 691 | Channel *c = channel_lookup(id); |
| 666 | 692 | ||
| 667 | if (c == NULL) { | 693 | if (c == NULL) { |
| 668 | logit("channel_register_comfirm: %d: bad id", id); | 694 | logit("channel_register_open_comfirm: %d: bad id", id); |
| 669 | return; | 695 | return; |
| 670 | } | 696 | } |
| 671 | c->confirm = fn; | 697 | c->open_confirm = fn; |
| 672 | c->confirm_ctx = ctx; | 698 | c->open_confirm_ctx = ctx; |
| 673 | } | 699 | } |
| 674 | 700 | ||
| 675 | void | 701 | void |
| @@ -700,7 +726,7 @@ channel_cancel_cleanup(int id) | |||
| 700 | 726 | ||
| 701 | void | 727 | void |
| 702 | channel_register_filter(int id, channel_infilter_fn *ifn, | 728 | channel_register_filter(int id, channel_infilter_fn *ifn, |
| 703 | channel_outfilter_fn *ofn) | 729 | channel_outfilter_fn *ofn, channel_filter_cleanup_fn *cfn, void *ctx) |
| 704 | { | 730 | { |
| 705 | Channel *c = channel_lookup(id); | 731 | Channel *c = channel_lookup(id); |
| 706 | 732 | ||
| @@ -710,17 +736,19 @@ channel_register_filter(int id, channel_infilter_fn *ifn, | |||
| 710 | } | 736 | } |
| 711 | c->input_filter = ifn; | 737 | c->input_filter = ifn; |
| 712 | c->output_filter = ofn; | 738 | c->output_filter = ofn; |
| 739 | c->filter_ctx = ctx; | ||
| 740 | c->filter_cleanup = cfn; | ||
| 713 | } | 741 | } |
| 714 | 742 | ||
| 715 | void | 743 | void |
| 716 | channel_set_fds(int id, int rfd, int wfd, int efd, | 744 | channel_set_fds(int id, int rfd, int wfd, int efd, |
| 717 | int extusage, int nonblock, u_int window_max) | 745 | int extusage, int nonblock, int is_tty, u_int window_max) |
| 718 | { | 746 | { |
| 719 | Channel *c = channel_lookup(id); | 747 | Channel *c = channel_lookup(id); |
| 720 | 748 | ||
| 721 | if (c == NULL || c->type != SSH_CHANNEL_LARVAL) | 749 | if (c == NULL || c->type != SSH_CHANNEL_LARVAL) |
| 722 | fatal("channel_activate for non-larval channel %d.", id); | 750 | fatal("channel_activate for non-larval channel %d.", id); |
| 723 | channel_register_fds(c, rfd, wfd, efd, extusage, nonblock); | 751 | channel_register_fds(c, rfd, wfd, efd, extusage, nonblock, is_tty); |
| 724 | c->type = SSH_CHANNEL_OPEN; | 752 | c->type = SSH_CHANNEL_OPEN; |
| 725 | c->local_window = c->local_window_max = window_max; | 753 | c->local_window = c->local_window_max = window_max; |
| 726 | packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST); | 754 | packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST); |
| @@ -788,7 +816,8 @@ channel_pre_open(Channel *c, fd_set *readset, fd_set *writeset) | |||
| 788 | } | 816 | } |
| 789 | } | 817 | } |
| 790 | /** XXX check close conditions, too */ | 818 | /** XXX check close conditions, too */ |
| 791 | if (compat20 && c->efd != -1) { | 819 | if (compat20 && c->efd != -1 && |
| 820 | !(c->istate == CHAN_INPUT_CLOSED && c->ostate == CHAN_OUTPUT_CLOSED)) { | ||
| 792 | if (c->extended_usage == CHAN_EXTENDED_WRITE && | 821 | if (c->extended_usage == CHAN_EXTENDED_WRITE && |
| 793 | buffer_len(&c->extended) > 0) | 822 | buffer_len(&c->extended) > 0) |
| 794 | FD_SET(c->efd, writeset); | 823 | FD_SET(c->efd, writeset); |
| @@ -1181,7 +1210,7 @@ static void | |||
| 1181 | channel_post_x11_listener(Channel *c, fd_set *readset, fd_set *writeset) | 1210 | channel_post_x11_listener(Channel *c, fd_set *readset, fd_set *writeset) |
| 1182 | { | 1211 | { |
| 1183 | Channel *nc; | 1212 | Channel *nc; |
| 1184 | struct sockaddr addr; | 1213 | struct sockaddr_storage addr; |
| 1185 | int newsock; | 1214 | int newsock; |
| 1186 | socklen_t addrlen; | 1215 | socklen_t addrlen; |
| 1187 | char buf[16384], *remote_ipaddr; | 1216 | char buf[16384], *remote_ipaddr; |
| @@ -1190,7 +1219,7 @@ channel_post_x11_listener(Channel *c, fd_set *readset, fd_set *writeset) | |||
| 1190 | if (FD_ISSET(c->sock, readset)) { | 1219 | if (FD_ISSET(c->sock, readset)) { |
| 1191 | debug("X11 connection requested."); | 1220 | debug("X11 connection requested."); |
| 1192 | addrlen = sizeof(addr); | 1221 | addrlen = sizeof(addr); |
| 1193 | newsock = accept(c->sock, &addr, &addrlen); | 1222 | newsock = accept(c->sock, (struct sockaddr *)&addr, &addrlen); |
| 1194 | if (c->single_connection) { | 1223 | if (c->single_connection) { |
| 1195 | debug2("single_connection: closing X11 listener."); | 1224 | debug2("single_connection: closing X11 listener."); |
| 1196 | channel_close_fd(&c->sock); | 1225 | channel_close_fd(&c->sock); |
| @@ -1307,7 +1336,7 @@ static void | |||
| 1307 | channel_post_port_listener(Channel *c, fd_set *readset, fd_set *writeset) | 1336 | channel_post_port_listener(Channel *c, fd_set *readset, fd_set *writeset) |
| 1308 | { | 1337 | { |
| 1309 | Channel *nc; | 1338 | Channel *nc; |
| 1310 | struct sockaddr addr; | 1339 | struct sockaddr_storage addr; |
| 1311 | int newsock, nextstate; | 1340 | int newsock, nextstate; |
| 1312 | socklen_t addrlen; | 1341 | socklen_t addrlen; |
| 1313 | char *rtype; | 1342 | char *rtype; |
| @@ -1331,7 +1360,7 @@ channel_post_port_listener(Channel *c, fd_set *readset, fd_set *writeset) | |||
| 1331 | } | 1360 | } |
| 1332 | 1361 | ||
| 1333 | addrlen = sizeof(addr); | 1362 | addrlen = sizeof(addr); |
| 1334 | newsock = accept(c->sock, &addr, &addrlen); | 1363 | newsock = accept(c->sock, (struct sockaddr *)&addr, &addrlen); |
| 1335 | if (newsock < 0) { | 1364 | if (newsock < 0) { |
| 1336 | error("accept: %.100s", strerror(errno)); | 1365 | error("accept: %.100s", strerror(errno)); |
| 1337 | return; | 1366 | return; |
| @@ -1366,12 +1395,12 @@ channel_post_auth_listener(Channel *c, fd_set *readset, fd_set *writeset) | |||
| 1366 | { | 1395 | { |
| 1367 | Channel *nc; | 1396 | Channel *nc; |
| 1368 | int newsock; | 1397 | int newsock; |
| 1369 | struct sockaddr addr; | 1398 | struct sockaddr_storage addr; |
| 1370 | socklen_t addrlen; | 1399 | socklen_t addrlen; |
| 1371 | 1400 | ||
| 1372 | if (FD_ISSET(c->sock, readset)) { | 1401 | if (FD_ISSET(c->sock, readset)) { |
| 1373 | addrlen = sizeof(addr); | 1402 | addrlen = sizeof(addr); |
| 1374 | newsock = accept(c->sock, &addr, &addrlen); | 1403 | newsock = accept(c->sock, (struct sockaddr *)&addr, &addrlen); |
| 1375 | if (newsock < 0) { | 1404 | if (newsock < 0) { |
| 1376 | error("accept from auth socket: %.100s", strerror(errno)); | 1405 | error("accept from auth socket: %.100s", strerror(errno)); |
| 1377 | return; | 1406 | return; |
| @@ -1398,7 +1427,7 @@ channel_post_auth_listener(Channel *c, fd_set *readset, fd_set *writeset) | |||
| 1398 | static void | 1427 | static void |
| 1399 | channel_post_connecting(Channel *c, fd_set *readset, fd_set *writeset) | 1428 | channel_post_connecting(Channel *c, fd_set *readset, fd_set *writeset) |
| 1400 | { | 1429 | { |
| 1401 | int err = 0; | 1430 | int err = 0, sock; |
| 1402 | socklen_t sz = sizeof(err); | 1431 | socklen_t sz = sizeof(err); |
| 1403 | 1432 | ||
| 1404 | if (FD_ISSET(c->sock, writeset)) { | 1433 | if (FD_ISSET(c->sock, writeset)) { |
| @@ -1407,7 +1436,9 @@ channel_post_connecting(Channel *c, fd_set *readset, fd_set *writeset) | |||
| 1407 | error("getsockopt SO_ERROR failed"); | 1436 | error("getsockopt SO_ERROR failed"); |
| 1408 | } | 1437 | } |
| 1409 | if (err == 0) { | 1438 | if (err == 0) { |
| 1410 | debug("channel %d: connected", c->self); | 1439 | debug("channel %d: connected to %s port %d", |
| 1440 | c->self, c->connect_ctx.host, c->connect_ctx.port); | ||
| 1441 | channel_connect_ctx_free(&c->connect_ctx); | ||
| 1411 | c->type = SSH_CHANNEL_OPEN; | 1442 | c->type = SSH_CHANNEL_OPEN; |
| 1412 | if (compat20) { | 1443 | if (compat20) { |
| 1413 | packet_start(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION); | 1444 | packet_start(SSH2_MSG_CHANNEL_OPEN_CONFIRMATION); |
| @@ -1421,8 +1452,19 @@ channel_post_connecting(Channel *c, fd_set *readset, fd_set *writeset) | |||
| 1421 | packet_put_int(c->self); | 1452 | packet_put_int(c->self); |
| 1422 | } | 1453 | } |
| 1423 | } else { | 1454 | } else { |
| 1424 | debug("channel %d: not connected: %s", | 1455 | debug("channel %d: connection failed: %s", |
| 1425 | c->self, strerror(err)); | 1456 | c->self, strerror(err)); |
| 1457 | /* Try next address, if any */ | ||
| 1458 | if ((sock = connect_next(&c->connect_ctx)) > 0) { | ||
| 1459 | close(c->sock); | ||
| 1460 | c->sock = c->rfd = c->wfd = sock; | ||
| 1461 | channel_max_fd = channel_find_maxfd(); | ||
| 1462 | return; | ||
| 1463 | } | ||
| 1464 | /* Exhausted all addresses */ | ||
| 1465 | error("connect_to %.100s port %d: failed.", | ||
| 1466 | c->connect_ctx.host, c->connect_ctx.port); | ||
| 1467 | channel_connect_ctx_free(&c->connect_ctx); | ||
| 1426 | if (compat20) { | 1468 | if (compat20) { |
| 1427 | packet_start(SSH2_MSG_CHANNEL_OPEN_FAILURE); | 1469 | packet_start(SSH2_MSG_CHANNEL_OPEN_FAILURE); |
| 1428 | packet_put_int(c->remote_id); | 1470 | packet_put_int(c->remote_id); |
| @@ -1452,7 +1494,8 @@ channel_handle_rfd(Channel *c, fd_set *readset, fd_set *writeset) | |||
| 1452 | if (c->rfd != -1 && (force || FD_ISSET(c->rfd, readset))) { | 1494 | if (c->rfd != -1 && (force || FD_ISSET(c->rfd, readset))) { |
| 1453 | errno = 0; | 1495 | errno = 0; |
| 1454 | len = read(c->rfd, buf, sizeof(buf)); | 1496 | len = read(c->rfd, buf, sizeof(buf)); |
| 1455 | if (len < 0 && (errno == EINTR || (errno == EAGAIN && !force))) | 1497 | if (len < 0 && (errno == EINTR || |
| 1498 | ((errno == EAGAIN || errno == EWOULDBLOCK) && !force))) | ||
| 1456 | return 1; | 1499 | return 1; |
| 1457 | #ifndef PTY_ZEROREAD | 1500 | #ifndef PTY_ZEROREAD |
| 1458 | if (len <= 0) { | 1501 | if (len <= 0) { |
| @@ -1523,7 +1566,8 @@ channel_handle_wfd(Channel *c, fd_set *readset, fd_set *writeset) | |||
| 1523 | c->local_consumed += dlen + 4; | 1566 | c->local_consumed += dlen + 4; |
| 1524 | len = write(c->wfd, buf, dlen); | 1567 | len = write(c->wfd, buf, dlen); |
| 1525 | xfree(data); | 1568 | xfree(data); |
| 1526 | if (len < 0 && (errno == EINTR || errno == EAGAIN)) | 1569 | if (len < 0 && (errno == EINTR || errno == EAGAIN || |
| 1570 | errno == EWOULDBLOCK)) | ||
| 1527 | return 1; | 1571 | return 1; |
| 1528 | if (len <= 0) { | 1572 | if (len <= 0) { |
| 1529 | if (c->type != SSH_CHANNEL_OPEN) | 1573 | if (c->type != SSH_CHANNEL_OPEN) |
| @@ -1541,7 +1585,8 @@ channel_handle_wfd(Channel *c, fd_set *readset, fd_set *writeset) | |||
| 1541 | #endif | 1585 | #endif |
| 1542 | 1586 | ||
| 1543 | len = write(c->wfd, buf, dlen); | 1587 | len = write(c->wfd, buf, dlen); |
| 1544 | if (len < 0 && (errno == EINTR || errno == EAGAIN)) | 1588 | if (len < 0 && |
| 1589 | (errno == EINTR || errno == EAGAIN || errno == EWOULDBLOCK)) | ||
| 1545 | return 1; | 1590 | return 1; |
| 1546 | if (len <= 0) { | 1591 | if (len <= 0) { |
| 1547 | if (c->type != SSH_CHANNEL_OPEN) { | 1592 | if (c->type != SSH_CHANNEL_OPEN) { |
| @@ -1593,7 +1638,8 @@ channel_handle_efd(Channel *c, fd_set *readset, fd_set *writeset) | |||
| 1593 | buffer_len(&c->extended)); | 1638 | buffer_len(&c->extended)); |
| 1594 | debug2("channel %d: written %d to efd %d", | 1639 | debug2("channel %d: written %d to efd %d", |
| 1595 | c->self, len, c->efd); | 1640 | c->self, len, c->efd); |
| 1596 | if (len < 0 && (errno == EINTR || errno == EAGAIN)) | 1641 | if (len < 0 && (errno == EINTR || errno == EAGAIN || |
| 1642 | errno == EWOULDBLOCK)) | ||
| 1597 | return 1; | 1643 | return 1; |
| 1598 | if (len <= 0) { | 1644 | if (len <= 0) { |
| 1599 | debug2("channel %d: closing write-efd %d", | 1645 | debug2("channel %d: closing write-efd %d", |
| @@ -1608,8 +1654,8 @@ channel_handle_efd(Channel *c, fd_set *readset, fd_set *writeset) | |||
| 1608 | len = read(c->efd, buf, sizeof(buf)); | 1654 | len = read(c->efd, buf, sizeof(buf)); |
| 1609 | debug2("channel %d: read %d from efd %d", | 1655 | debug2("channel %d: read %d from efd %d", |
| 1610 | c->self, len, c->efd); | 1656 | c->self, len, c->efd); |
| 1611 | if (len < 0 && (errno == EINTR || | 1657 | if (len < 0 && (errno == EINTR || ((errno == EAGAIN || |
| 1612 | (errno == EAGAIN && !c->detach_close))) | 1658 | errno == EWOULDBLOCK) && !c->detach_close))) |
| 1613 | return 1; | 1659 | return 1; |
| 1614 | if (len <= 0) { | 1660 | if (len <= 0) { |
| 1615 | debug2("channel %d: closing read-efd %d", | 1661 | debug2("channel %d: closing read-efd %d", |
| @@ -1633,7 +1679,8 @@ channel_handle_ctl(Channel *c, fd_set *readset, fd_set *writeset) | |||
| 1633 | /* Monitor control fd to detect if the slave client exits */ | 1679 | /* Monitor control fd to detect if the slave client exits */ |
| 1634 | if (c->ctl_fd != -1 && FD_ISSET(c->ctl_fd, readset)) { | 1680 | if (c->ctl_fd != -1 && FD_ISSET(c->ctl_fd, readset)) { |
| 1635 | len = read(c->ctl_fd, buf, sizeof(buf)); | 1681 | len = read(c->ctl_fd, buf, sizeof(buf)); |
| 1636 | if (len < 0 && (errno == EINTR || errno == EAGAIN)) | 1682 | if (len < 0 && |
| 1683 | (errno == EINTR || errno == EAGAIN || errno == EWOULDBLOCK)) | ||
| 1637 | return 1; | 1684 | return 1; |
| 1638 | if (len <= 0) { | 1685 | if (len <= 0) { |
| 1639 | debug2("channel %d: ctl read<=0", c->self); | 1686 | debug2("channel %d: ctl read<=0", c->self); |
| @@ -2012,7 +2059,7 @@ channel_input_data(int type, u_int32_t seq, void *ctxt) | |||
| 2012 | return; | 2059 | return; |
| 2013 | 2060 | ||
| 2014 | /* Get the data. */ | 2061 | /* Get the data. */ |
| 2015 | data = packet_get_string(&data_len); | 2062 | data = packet_get_string_ptr(&data_len); |
| 2016 | 2063 | ||
| 2017 | /* | 2064 | /* |
| 2018 | * Ignore data for protocol > 1.3 if output end is no longer open. | 2065 | * Ignore data for protocol > 1.3 if output end is no longer open. |
| @@ -2026,7 +2073,6 @@ channel_input_data(int type, u_int32_t seq, void *ctxt) | |||
| 2026 | c->local_window -= data_len; | 2073 | c->local_window -= data_len; |
| 2027 | c->local_consumed += data_len; | 2074 | c->local_consumed += data_len; |
| 2028 | } | 2075 | } |
| 2029 | xfree(data); | ||
| 2030 | return; | 2076 | return; |
| 2031 | } | 2077 | } |
| 2032 | 2078 | ||
| @@ -2038,17 +2084,15 @@ channel_input_data(int type, u_int32_t seq, void *ctxt) | |||
| 2038 | if (data_len > c->local_window) { | 2084 | if (data_len > c->local_window) { |
| 2039 | logit("channel %d: rcvd too much data %d, win %d", | 2085 | logit("channel %d: rcvd too much data %d, win %d", |
| 2040 | c->self, data_len, c->local_window); | 2086 | c->self, data_len, c->local_window); |
| 2041 | xfree(data); | ||
| 2042 | return; | 2087 | return; |
| 2043 | } | 2088 | } |
| 2044 | c->local_window -= data_len; | 2089 | c->local_window -= data_len; |
| 2045 | } | 2090 | } |
| 2046 | packet_check_eom(); | ||
| 2047 | if (c->datagram) | 2091 | if (c->datagram) |
| 2048 | buffer_put_string(&c->output, data, data_len); | 2092 | buffer_put_string(&c->output, data, data_len); |
| 2049 | else | 2093 | else |
| 2050 | buffer_append(&c->output, data, data_len); | 2094 | buffer_append(&c->output, data, data_len); |
| 2051 | xfree(data); | 2095 | packet_check_eom(); |
| 2052 | } | 2096 | } |
| 2053 | 2097 | ||
| 2054 | /* ARGSUSED */ | 2098 | /* ARGSUSED */ |
| @@ -2212,9 +2256,9 @@ channel_input_open_confirmation(int type, u_int32_t seq, void *ctxt) | |||
| 2212 | if (compat20) { | 2256 | if (compat20) { |
| 2213 | c->remote_window = packet_get_int(); | 2257 | c->remote_window = packet_get_int(); |
| 2214 | c->remote_maxpacket = packet_get_int(); | 2258 | c->remote_maxpacket = packet_get_int(); |
| 2215 | if (c->confirm) { | 2259 | if (c->open_confirm) { |
| 2216 | debug2("callback start"); | 2260 | debug2("callback start"); |
| 2217 | c->confirm(c->self, c->confirm_ctx); | 2261 | c->open_confirm(c->self, c->open_confirm_ctx); |
| 2218 | debug2("callback done"); | 2262 | debug2("callback done"); |
| 2219 | } | 2263 | } |
| 2220 | debug2("channel %d: open confirm rwindow %u rmax %u", c->self, | 2264 | debug2("channel %d: open confirm rwindow %u rmax %u", c->self, |
| @@ -2303,7 +2347,7 @@ channel_input_port_open(int type, u_int32_t seq, void *ctxt) | |||
| 2303 | Channel *c = NULL; | 2347 | Channel *c = NULL; |
| 2304 | u_short host_port; | 2348 | u_short host_port; |
| 2305 | char *host, *originator_string; | 2349 | char *host, *originator_string; |
| 2306 | int remote_id, sock = -1; | 2350 | int remote_id; |
| 2307 | 2351 | ||
| 2308 | remote_id = packet_get_int(); | 2352 | remote_id = packet_get_int(); |
| 2309 | host = packet_get_string(NULL); | 2353 | host = packet_get_string(NULL); |
| @@ -2315,22 +2359,46 @@ channel_input_port_open(int type, u_int32_t seq, void *ctxt) | |||
| 2315 | originator_string = xstrdup("unknown (remote did not supply name)"); | 2359 | originator_string = xstrdup("unknown (remote did not supply name)"); |
| 2316 | } | 2360 | } |
| 2317 | packet_check_eom(); | 2361 | packet_check_eom(); |
| 2318 | sock = channel_connect_to(host, host_port); | 2362 | c = channel_connect_to(host, host_port, |
| 2319 | if (sock != -1) { | 2363 | "connected socket", originator_string); |
| 2320 | c = channel_new("connected socket", | ||
| 2321 | SSH_CHANNEL_CONNECTING, sock, sock, -1, 0, 0, 0, | ||
| 2322 | originator_string, 1); | ||
| 2323 | c->remote_id = remote_id; | ||
| 2324 | } | ||
| 2325 | xfree(originator_string); | 2364 | xfree(originator_string); |
| 2365 | xfree(host); | ||
| 2326 | if (c == NULL) { | 2366 | if (c == NULL) { |
| 2327 | packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE); | 2367 | packet_start(SSH_MSG_CHANNEL_OPEN_FAILURE); |
| 2328 | packet_put_int(remote_id); | 2368 | packet_put_int(remote_id); |
| 2329 | packet_send(); | 2369 | packet_send(); |
| 2330 | } | 2370 | } else |
| 2331 | xfree(host); | 2371 | c->remote_id = remote_id; |
| 2332 | } | 2372 | } |
| 2333 | 2373 | ||
| 2374 | /* ARGSUSED */ | ||
| 2375 | void | ||
| 2376 | channel_input_status_confirm(int type, u_int32_t seq, void *ctxt) | ||
| 2377 | { | ||
| 2378 | Channel *c; | ||
| 2379 | struct channel_confirm *cc; | ||
| 2380 | int remote_id; | ||
| 2381 | |||
| 2382 | /* Reset keepalive timeout */ | ||
| 2383 | keep_alive_timeouts = 0; | ||
| 2384 | |||
| 2385 | remote_id = packet_get_int(); | ||
| 2386 | packet_check_eom(); | ||
| 2387 | |||
| 2388 | debug2("channel_input_confirm: type %d id %d", type, remote_id); | ||
| 2389 | |||
| 2390 | if ((c = channel_lookup(remote_id)) == NULL) { | ||
| 2391 | logit("channel_input_success_failure: %d: unknown", remote_id); | ||
| 2392 | return; | ||
| 2393 | } | ||
| 2394 | ; | ||
| 2395 | if ((cc = TAILQ_FIRST(&c->status_confirms)) == NULL) | ||
| 2396 | return; | ||
| 2397 | cc->cb(type, c, cc->ctx); | ||
| 2398 | TAILQ_REMOVE(&c->status_confirms, cc, entry); | ||
| 2399 | bzero(cc, sizeof(*cc)); | ||
| 2400 | xfree(cc); | ||
| 2401 | } | ||
| 2334 | 2402 | ||
| 2335 | /* -- tcp forwarding */ | 2403 | /* -- tcp forwarding */ |
| 2336 | 2404 | ||
| @@ -2385,7 +2453,7 @@ channel_setup_fwd_listener(int type, const char *listen_addr, u_short listen_por | |||
| 2385 | wildcard = 1; | 2453 | wildcard = 1; |
| 2386 | } else if (gateway_ports || is_client) { | 2454 | } else if (gateway_ports || is_client) { |
| 2387 | if (((datafellows & SSH_OLD_FORWARD_ADDR) && | 2455 | if (((datafellows & SSH_OLD_FORWARD_ADDR) && |
| 2388 | strcmp(listen_addr, "0.0.0.0") == 0) || | 2456 | strcmp(listen_addr, "0.0.0.0") == 0 && is_client == 0) || |
| 2389 | *listen_addr == '\0' || strcmp(listen_addr, "*") == 0 || | 2457 | *listen_addr == '\0' || strcmp(listen_addr, "*") == 0 || |
| 2390 | (!is_client && gateway_ports == 1)) | 2458 | (!is_client && gateway_ports == 1)) |
| 2391 | wildcard = 1; | 2459 | wildcard = 1; |
| @@ -2409,10 +2477,11 @@ channel_setup_fwd_listener(int type, const char *listen_addr, u_short listen_por | |||
| 2409 | if (addr == NULL) { | 2477 | if (addr == NULL) { |
| 2410 | /* This really shouldn't happen */ | 2478 | /* This really shouldn't happen */ |
| 2411 | packet_disconnect("getaddrinfo: fatal error: %s", | 2479 | packet_disconnect("getaddrinfo: fatal error: %s", |
| 2412 | gai_strerror(r)); | 2480 | ssh_gai_strerror(r)); |
| 2413 | } else { | 2481 | } else { |
| 2414 | error("channel_setup_fwd_listener: " | 2482 | error("channel_setup_fwd_listener: " |
| 2415 | "getaddrinfo(%.64s): %s", addr, gai_strerror(r)); | 2483 | "getaddrinfo(%.64s): %s", addr, |
| 2484 | ssh_gai_strerror(r)); | ||
| 2416 | } | 2485 | } |
| 2417 | return 0; | 2486 | return 0; |
| 2418 | } | 2487 | } |
| @@ -2717,35 +2786,37 @@ channel_clear_adm_permitted_opens(void) | |||
| 2717 | num_adm_permitted_opens = 0; | 2786 | num_adm_permitted_opens = 0; |
| 2718 | } | 2787 | } |
| 2719 | 2788 | ||
| 2720 | /* return socket to remote host, port */ | 2789 | void |
| 2790 | channel_print_adm_permitted_opens(void) | ||
| 2791 | { | ||
| 2792 | int i; | ||
| 2793 | |||
| 2794 | for (i = 0; i < num_adm_permitted_opens; i++) | ||
| 2795 | if (permitted_adm_opens[i].host_to_connect != NULL) | ||
| 2796 | printf(" %s:%d", permitted_adm_opens[i].host_to_connect, | ||
| 2797 | permitted_adm_opens[i].port_to_connect); | ||
| 2798 | } | ||
| 2799 | |||
| 2800 | /* Try to start non-blocking connect to next host in cctx list */ | ||
| 2721 | static int | 2801 | static int |
| 2722 | connect_to(const char *host, u_short port) | 2802 | connect_next(struct channel_connect *cctx) |
| 2723 | { | 2803 | { |
| 2724 | struct addrinfo hints, *ai, *aitop; | 2804 | int sock, saved_errno; |
| 2725 | char ntop[NI_MAXHOST], strport[NI_MAXSERV]; | 2805 | char ntop[NI_MAXHOST], strport[NI_MAXSERV]; |
| 2726 | int gaierr; | ||
| 2727 | int sock = -1; | ||
| 2728 | 2806 | ||
| 2729 | memset(&hints, 0, sizeof(hints)); | 2807 | for (; cctx->ai; cctx->ai = cctx->ai->ai_next) { |
| 2730 | hints.ai_family = IPv4or6; | 2808 | if (cctx->ai->ai_family != AF_INET && |
| 2731 | hints.ai_socktype = SOCK_STREAM; | 2809 | cctx->ai->ai_family != AF_INET6) |
| 2732 | snprintf(strport, sizeof strport, "%d", port); | ||
| 2733 | if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0) { | ||
| 2734 | error("connect_to %.100s: unknown host (%s)", host, | ||
| 2735 | gai_strerror(gaierr)); | ||
| 2736 | return -1; | ||
| 2737 | } | ||
| 2738 | for (ai = aitop; ai; ai = ai->ai_next) { | ||
| 2739 | if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6) | ||
| 2740 | continue; | 2810 | continue; |
| 2741 | if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop, sizeof(ntop), | 2811 | if (getnameinfo(cctx->ai->ai_addr, cctx->ai->ai_addrlen, |
| 2742 | strport, sizeof(strport), NI_NUMERICHOST|NI_NUMERICSERV) != 0) { | 2812 | ntop, sizeof(ntop), strport, sizeof(strport), |
| 2743 | error("connect_to: getnameinfo failed"); | 2813 | NI_NUMERICHOST|NI_NUMERICSERV) != 0) { |
| 2814 | error("connect_next: getnameinfo failed"); | ||
| 2744 | continue; | 2815 | continue; |
| 2745 | } | 2816 | } |
| 2746 | sock = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol); | 2817 | if ((sock = socket(cctx->ai->ai_family, cctx->ai->ai_socktype, |
| 2747 | if (sock < 0) { | 2818 | cctx->ai->ai_protocol)) == -1) { |
| 2748 | if (ai->ai_next == NULL) | 2819 | if (cctx->ai->ai_next == NULL) |
| 2749 | error("socket: %.100s", strerror(errno)); | 2820 | error("socket: %.100s", strerror(errno)); |
| 2750 | else | 2821 | else |
| 2751 | verbose("socket: %.100s", strerror(errno)); | 2822 | verbose("socket: %.100s", strerror(errno)); |
| @@ -2753,45 +2824,95 @@ connect_to(const char *host, u_short port) | |||
| 2753 | } | 2824 | } |
| 2754 | if (set_nonblock(sock) == -1) | 2825 | if (set_nonblock(sock) == -1) |
| 2755 | fatal("%s: set_nonblock(%d)", __func__, sock); | 2826 | fatal("%s: set_nonblock(%d)", __func__, sock); |
| 2756 | if (connect(sock, ai->ai_addr, ai->ai_addrlen) < 0 && | 2827 | if (connect(sock, cctx->ai->ai_addr, |
| 2757 | errno != EINPROGRESS) { | 2828 | cctx->ai->ai_addrlen) == -1 && errno != EINPROGRESS) { |
| 2758 | error("connect_to %.100s port %s: %.100s", ntop, strport, | 2829 | debug("connect_next: host %.100s ([%.100s]:%s): " |
| 2830 | "%.100s", cctx->host, ntop, strport, | ||
| 2759 | strerror(errno)); | 2831 | strerror(errno)); |
| 2832 | saved_errno = errno; | ||
| 2760 | close(sock); | 2833 | close(sock); |
| 2834 | errno = saved_errno; | ||
| 2761 | continue; /* fail -- try next */ | 2835 | continue; /* fail -- try next */ |
| 2762 | } | 2836 | } |
| 2763 | break; /* success */ | 2837 | debug("connect_next: host %.100s ([%.100s]:%s) " |
| 2838 | "in progress, fd=%d", cctx->host, ntop, strport, sock); | ||
| 2839 | cctx->ai = cctx->ai->ai_next; | ||
| 2840 | set_nodelay(sock); | ||
| 2841 | return sock; | ||
| 2842 | } | ||
| 2843 | return -1; | ||
| 2844 | } | ||
| 2764 | 2845 | ||
| 2846 | static void | ||
| 2847 | channel_connect_ctx_free(struct channel_connect *cctx) | ||
| 2848 | { | ||
| 2849 | xfree(cctx->host); | ||
| 2850 | if (cctx->aitop) | ||
| 2851 | freeaddrinfo(cctx->aitop); | ||
| 2852 | bzero(cctx, sizeof(*cctx)); | ||
| 2853 | cctx->host = NULL; | ||
| 2854 | cctx->ai = cctx->aitop = NULL; | ||
| 2855 | } | ||
| 2856 | |||
| 2857 | /* Return CONNECTING channel to remote host, port */ | ||
| 2858 | static Channel * | ||
| 2859 | connect_to(const char *host, u_short port, char *ctype, char *rname) | ||
| 2860 | { | ||
| 2861 | struct addrinfo hints; | ||
| 2862 | int gaierr; | ||
| 2863 | int sock = -1; | ||
| 2864 | char strport[NI_MAXSERV]; | ||
| 2865 | struct channel_connect cctx; | ||
| 2866 | Channel *c; | ||
| 2867 | |||
| 2868 | memset(&cctx, 0, sizeof(cctx)); | ||
| 2869 | memset(&hints, 0, sizeof(hints)); | ||
| 2870 | hints.ai_family = IPv4or6; | ||
| 2871 | hints.ai_socktype = SOCK_STREAM; | ||
| 2872 | snprintf(strport, sizeof strport, "%d", port); | ||
| 2873 | if ((gaierr = getaddrinfo(host, strport, &hints, &cctx.aitop)) != 0) { | ||
| 2874 | error("connect_to %.100s: unknown host (%s)", host, | ||
| 2875 | ssh_gai_strerror(gaierr)); | ||
| 2876 | return NULL; | ||
| 2765 | } | 2877 | } |
| 2766 | freeaddrinfo(aitop); | 2878 | |
| 2767 | if (!ai) { | 2879 | cctx.host = xstrdup(host); |
| 2768 | error("connect_to %.100s port %d: failed.", host, port); | 2880 | cctx.port = port; |
| 2769 | return -1; | 2881 | cctx.ai = cctx.aitop; |
| 2882 | |||
| 2883 | if ((sock = connect_next(&cctx)) == -1) { | ||
| 2884 | error("connect to %.100s port %d failed: %s", | ||
| 2885 | host, port, strerror(errno)); | ||
| 2886 | channel_connect_ctx_free(&cctx); | ||
| 2887 | return NULL; | ||
| 2770 | } | 2888 | } |
| 2771 | /* success */ | 2889 | c = channel_new(ctype, SSH_CHANNEL_CONNECTING, sock, sock, -1, |
| 2772 | set_nodelay(sock); | 2890 | CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0, rname, 1); |
| 2773 | return sock; | 2891 | c->connect_ctx = cctx; |
| 2892 | return c; | ||
| 2774 | } | 2893 | } |
| 2775 | 2894 | ||
| 2776 | int | 2895 | Channel * |
| 2777 | channel_connect_by_listen_address(u_short listen_port) | 2896 | channel_connect_by_listen_address(u_short listen_port, char *ctype, char *rname) |
| 2778 | { | 2897 | { |
| 2779 | int i; | 2898 | int i; |
| 2780 | 2899 | ||
| 2781 | for (i = 0; i < num_permitted_opens; i++) | 2900 | for (i = 0; i < num_permitted_opens; i++) { |
| 2782 | if (permitted_opens[i].host_to_connect != NULL && | 2901 | if (permitted_opens[i].host_to_connect != NULL && |
| 2783 | permitted_opens[i].listen_port == listen_port) | 2902 | permitted_opens[i].listen_port == listen_port) { |
| 2784 | return connect_to( | 2903 | return connect_to( |
| 2785 | permitted_opens[i].host_to_connect, | 2904 | permitted_opens[i].host_to_connect, |
| 2786 | permitted_opens[i].port_to_connect); | 2905 | permitted_opens[i].port_to_connect, ctype, rname); |
| 2906 | } | ||
| 2907 | } | ||
| 2787 | error("WARNING: Server requests forwarding for unknown listen_port %d", | 2908 | error("WARNING: Server requests forwarding for unknown listen_port %d", |
| 2788 | listen_port); | 2909 | listen_port); |
| 2789 | return -1; | 2910 | return NULL; |
| 2790 | } | 2911 | } |
| 2791 | 2912 | ||
| 2792 | /* Check if connecting to that port is permitted and connect. */ | 2913 | /* Check if connecting to that port is permitted and connect. */ |
| 2793 | int | 2914 | Channel * |
| 2794 | channel_connect_to(const char *host, u_short port) | 2915 | channel_connect_to(const char *host, u_short port, char *ctype, char *rname) |
| 2795 | { | 2916 | { |
| 2796 | int i, permit, permit_adm = 1; | 2917 | int i, permit, permit_adm = 1; |
| 2797 | 2918 | ||
| @@ -2817,9 +2938,9 @@ channel_connect_to(const char *host, u_short port) | |||
| 2817 | if (!permit || !permit_adm) { | 2938 | if (!permit || !permit_adm) { |
| 2818 | logit("Received request to connect to host %.100s port %d, " | 2939 | logit("Received request to connect to host %.100s port %d, " |
| 2819 | "but the request was denied.", host, port); | 2940 | "but the request was denied.", host, port); |
| 2820 | return -1; | 2941 | return NULL; |
| 2821 | } | 2942 | } |
| 2822 | return connect_to(host, port); | 2943 | return connect_to(host, port, ctype, rname); |
| 2823 | } | 2944 | } |
| 2824 | 2945 | ||
| 2825 | void | 2946 | void |
| @@ -2874,7 +2995,7 @@ x11_create_display_inet(int x11_display_offset, int x11_use_localhost, | |||
| 2874 | hints.ai_socktype = SOCK_STREAM; | 2995 | hints.ai_socktype = SOCK_STREAM; |
| 2875 | snprintf(strport, sizeof strport, "%d", port); | 2996 | snprintf(strport, sizeof strport, "%d", port); |
| 2876 | if ((gaierr = getaddrinfo(NULL, strport, &hints, &aitop)) != 0) { | 2997 | if ((gaierr = getaddrinfo(NULL, strport, &hints, &aitop)) != 0) { |
| 2877 | error("getaddrinfo: %.100s", gai_strerror(gaierr)); | 2998 | error("getaddrinfo: %.100s", ssh_gai_strerror(gaierr)); |
| 2878 | return -1; | 2999 | return -1; |
| 2879 | } | 3000 | } |
| 2880 | for (ai = aitop; ai; ai = ai->ai_next) { | 3001 | for (ai = aitop; ai; ai = ai->ai_next) { |
| @@ -2904,7 +3025,8 @@ x11_create_display_inet(int x11_display_offset, int x11_use_localhost, | |||
| 2904 | error("setsockopt IPV6_V6ONLY: %.100s", strerror(errno)); | 3025 | error("setsockopt IPV6_V6ONLY: %.100s", strerror(errno)); |
| 2905 | } | 3026 | } |
| 2906 | #endif | 3027 | #endif |
| 2907 | channel_set_reuseaddr(sock); | 3028 | if (x11_use_localhost) |
| 3029 | channel_set_reuseaddr(sock); | ||
| 2908 | if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) { | 3030 | if (bind(sock, ai->ai_addr, ai->ai_addrlen) < 0) { |
| 2909 | debug2("bind port %d: %.100s", port, strerror(errno)); | 3031 | debug2("bind port %d: %.100s", port, strerror(errno)); |
| 2910 | close(sock); | 3032 | close(sock); |
| @@ -2916,17 +3038,8 @@ x11_create_display_inet(int x11_display_offset, int x11_use_localhost, | |||
| 2916 | break; | 3038 | break; |
| 2917 | } | 3039 | } |
| 2918 | socks[num_socks++] = sock; | 3040 | socks[num_socks++] = sock; |
| 2919 | #ifndef DONT_TRY_OTHER_AF | ||
| 2920 | if (num_socks == NUM_SOCKS) | 3041 | if (num_socks == NUM_SOCKS) |
| 2921 | break; | 3042 | break; |
| 2922 | #else | ||
| 2923 | if (x11_use_localhost) { | ||
| 2924 | if (num_socks == NUM_SOCKS) | ||
| 2925 | break; | ||
| 2926 | } else { | ||
| 2927 | break; | ||
| 2928 | } | ||
| 2929 | #endif | ||
| 2930 | } | 3043 | } |
| 2931 | freeaddrinfo(aitop); | 3044 | freeaddrinfo(aitop); |
| 2932 | if (num_socks > 0) | 3045 | if (num_socks > 0) |
| @@ -3048,7 +3161,8 @@ x11_connect_display(void) | |||
| 3048 | hints.ai_socktype = SOCK_STREAM; | 3161 | hints.ai_socktype = SOCK_STREAM; |
| 3049 | snprintf(strport, sizeof strport, "%u", 6000 + display_number); | 3162 | snprintf(strport, sizeof strport, "%u", 6000 + display_number); |
| 3050 | if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) { | 3163 | if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) { |
| 3051 | error("%.100s: unknown host. (%s)", buf, gai_strerror(gaierr)); | 3164 | error("%.100s: unknown host. (%s)", buf, |
| 3165 | ssh_gai_strerror(gaierr)); | ||
| 3052 | return -1; | 3166 | return -1; |
| 3053 | } | 3167 | } |
| 3054 | for (ai = aitop; ai; ai = ai->ai_next) { | 3168 | for (ai = aitop; ai; ai = ai->ai_next) { |
diff --git a/channels.h b/channels.h index b632a86af..108b36068 100644 --- a/channels.h +++ b/channels.h | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: channels.h,v 1.89 2007/06/11 09:14:00 markus Exp $ */ | 1 | /* $OpenBSD: channels.h,v 1.96 2008/06/15 20:06:26 djm Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| @@ -62,8 +62,27 @@ typedef struct Channel Channel; | |||
| 62 | 62 | ||
| 63 | typedef void channel_callback_fn(int, void *); | 63 | typedef void channel_callback_fn(int, void *); |
| 64 | typedef int channel_infilter_fn(struct Channel *, char *, int); | 64 | typedef int channel_infilter_fn(struct Channel *, char *, int); |
| 65 | typedef void channel_filter_cleanup_fn(int, void *); | ||
| 65 | typedef u_char *channel_outfilter_fn(struct Channel *, u_char **, u_int *); | 66 | typedef u_char *channel_outfilter_fn(struct Channel *, u_char **, u_int *); |
| 66 | 67 | ||
| 68 | /* Channel success/failure callbacks */ | ||
| 69 | typedef void channel_confirm_cb(int, struct Channel *, void *); | ||
| 70 | typedef void channel_confirm_abandon_cb(struct Channel *, void *); | ||
| 71 | struct channel_confirm { | ||
| 72 | TAILQ_ENTRY(channel_confirm) entry; | ||
| 73 | channel_confirm_cb *cb; | ||
| 74 | channel_confirm_abandon_cb *abandon_cb; | ||
| 75 | void *ctx; | ||
| 76 | }; | ||
| 77 | TAILQ_HEAD(channel_confirms, channel_confirm); | ||
| 78 | |||
| 79 | /* Context for non-blocking connects */ | ||
| 80 | struct channel_connect { | ||
| 81 | char *host; | ||
| 82 | int port; | ||
| 83 | struct addrinfo *ai, *aitop; | ||
| 84 | }; | ||
| 85 | |||
| 67 | struct Channel { | 86 | struct Channel { |
| 68 | int type; /* channel type/state */ | 87 | int type; /* channel type/state */ |
| 69 | int self; /* my own channel identifier */ | 88 | int self; /* my own channel identifier */ |
| @@ -104,16 +123,23 @@ struct Channel { | |||
| 104 | char *ctype; /* type */ | 123 | char *ctype; /* type */ |
| 105 | 124 | ||
| 106 | /* callback */ | 125 | /* callback */ |
| 107 | channel_callback_fn *confirm; | 126 | channel_callback_fn *open_confirm; |
| 108 | void *confirm_ctx; | 127 | void *open_confirm_ctx; |
| 109 | channel_callback_fn *detach_user; | 128 | channel_callback_fn *detach_user; |
| 110 | int detach_close; | 129 | int detach_close; |
| 130 | struct channel_confirms status_confirms; | ||
| 111 | 131 | ||
| 112 | /* filter */ | 132 | /* filter */ |
| 113 | channel_infilter_fn *input_filter; | 133 | channel_infilter_fn *input_filter; |
| 114 | channel_outfilter_fn *output_filter; | 134 | channel_outfilter_fn *output_filter; |
| 135 | void *filter_ctx; | ||
| 136 | channel_filter_cleanup_fn *filter_cleanup; | ||
| 137 | |||
| 138 | /* keep boundaries */ | ||
| 139 | int datagram; | ||
| 115 | 140 | ||
| 116 | int datagram; /* keep boundaries */ | 141 | /* non-blocking connect */ |
| 142 | struct channel_connect connect_ctx; | ||
| 117 | }; | 143 | }; |
| 118 | 144 | ||
| 119 | #define CHAN_EXTENDED_IGNORE 0 | 145 | #define CHAN_EXTENDED_IGNORE 0 |
| @@ -162,7 +188,7 @@ struct Channel { | |||
| 162 | Channel *channel_by_id(int); | 188 | Channel *channel_by_id(int); |
| 163 | Channel *channel_lookup(int); | 189 | Channel *channel_lookup(int); |
| 164 | Channel *channel_new(char *, int, int, int, int, u_int, u_int, int, char *, int); | 190 | Channel *channel_new(char *, int, int, int, int, u_int, u_int, int, char *, int); |
| 165 | void channel_set_fds(int, int, int, int, int, int, u_int); | 191 | void channel_set_fds(int, int, int, int, int, int, int, u_int); |
| 166 | void channel_free(Channel *); | 192 | void channel_free(Channel *); |
| 167 | void channel_free_all(void); | 193 | void channel_free_all(void); |
| 168 | void channel_stop_listening(void); | 194 | void channel_stop_listening(void); |
| @@ -170,8 +196,11 @@ void channel_stop_listening(void); | |||
| 170 | void channel_send_open(int); | 196 | void channel_send_open(int); |
| 171 | void channel_request_start(int, char *, int); | 197 | void channel_request_start(int, char *, int); |
| 172 | void channel_register_cleanup(int, channel_callback_fn *, int); | 198 | void channel_register_cleanup(int, channel_callback_fn *, int); |
| 173 | void channel_register_confirm(int, channel_callback_fn *, void *); | 199 | void channel_register_open_confirm(int, channel_callback_fn *, void *); |
| 174 | void channel_register_filter(int, channel_infilter_fn *, channel_outfilter_fn *); | 200 | void channel_register_filter(int, channel_infilter_fn *, |
| 201 | channel_outfilter_fn *, channel_filter_cleanup_fn *, void *); | ||
| 202 | void channel_register_status_confirm(int, channel_confirm_cb *, | ||
| 203 | channel_confirm_abandon_cb *, void *); | ||
| 175 | void channel_cancel_cleanup(int); | 204 | void channel_cancel_cleanup(int); |
| 176 | int channel_close_fd(int *); | 205 | int channel_close_fd(int *); |
| 177 | void channel_send_window_changes(void); | 206 | void channel_send_window_changes(void); |
| @@ -188,6 +217,7 @@ void channel_input_open_confirmation(int, u_int32_t, void *); | |||
| 188 | void channel_input_open_failure(int, u_int32_t, void *); | 217 | void channel_input_open_failure(int, u_int32_t, void *); |
| 189 | void channel_input_port_open(int, u_int32_t, void *); | 218 | void channel_input_port_open(int, u_int32_t, void *); |
| 190 | void channel_input_window_adjust(int, u_int32_t, void *); | 219 | void channel_input_window_adjust(int, u_int32_t, void *); |
| 220 | void channel_input_status_confirm(int, u_int32_t, void *); | ||
| 191 | 221 | ||
| 192 | /* file descriptor handling (read/write) */ | 222 | /* file descriptor handling (read/write) */ |
| 193 | 223 | ||
| @@ -208,9 +238,10 @@ void channel_add_permitted_opens(char *, int); | |||
| 208 | int channel_add_adm_permitted_opens(char *, int); | 238 | int channel_add_adm_permitted_opens(char *, int); |
| 209 | void channel_clear_permitted_opens(void); | 239 | void channel_clear_permitted_opens(void); |
| 210 | void channel_clear_adm_permitted_opens(void); | 240 | void channel_clear_adm_permitted_opens(void); |
| 241 | void channel_print_adm_permitted_opens(void); | ||
| 211 | int channel_input_port_forward_request(int, int); | 242 | int channel_input_port_forward_request(int, int); |
| 212 | int channel_connect_to(const char *, u_short); | 243 | Channel *channel_connect_to(const char *, u_short, char *, char *); |
| 213 | int channel_connect_by_listen_address(u_short); | 244 | Channel *channel_connect_by_listen_address(u_short, char *, char *); |
| 214 | int channel_request_remote_forwarding(const char *, u_short, | 245 | int channel_request_remote_forwarding(const char *, u_short, |
| 215 | const char *, u_short); | 246 | const char *, u_short); |
| 216 | int channel_setup_local_fwd_listener(const char *, u_short, | 247 | int channel_setup_local_fwd_listener(const char *, u_short, |
| @@ -225,7 +256,7 @@ int x11_connect_display(void); | |||
| 225 | int x11_create_display_inet(int, int, int, u_int *, int **); | 256 | int x11_create_display_inet(int, int, int, u_int *, int **); |
| 226 | void x11_input_open(int, u_int32_t, void *); | 257 | void x11_input_open(int, u_int32_t, void *); |
| 227 | void x11_request_forwarding_with_spoofing(int, const char *, const char *, | 258 | void x11_request_forwarding_with_spoofing(int, const char *, const char *, |
| 228 | const char *); | 259 | const char *); |
| 229 | void deny_input_open(int, u_int32_t, void *); | 260 | void deny_input_open(int, u_int32_t, void *); |
| 230 | 261 | ||
| 231 | /* agent forwarding */ | 262 | /* agent forwarding */ |
| @@ -240,6 +271,7 @@ void chan_mark_dead(Channel *); | |||
| 240 | /* channel events */ | 271 | /* channel events */ |
| 241 | 272 | ||
| 242 | void chan_rcvd_oclose(Channel *); | 273 | void chan_rcvd_oclose(Channel *); |
| 274 | void chan_rcvd_eow(Channel *); /* SSH2-only */ | ||
| 243 | void chan_read_failed(Channel *); | 275 | void chan_read_failed(Channel *); |
| 244 | void chan_ibuf_empty(Channel *); | 276 | void chan_ibuf_empty(Channel *); |
| 245 | 277 | ||
diff --git a/clientloop.c b/clientloop.c index 7037c4192..abe5609de 100644 --- a/clientloop.c +++ b/clientloop.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: clientloop.c,v 1.181 2007/08/15 08:14:46 markus Exp $ */ | 1 | /* $OpenBSD: clientloop.c,v 1.201 2008/07/16 11:51:14 djm Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
| @@ -86,6 +86,7 @@ | |||
| 86 | #include <pwd.h> | 86 | #include <pwd.h> |
| 87 | #include <unistd.h> | 87 | #include <unistd.h> |
| 88 | 88 | ||
| 89 | #include "openbsd-compat/sys-queue.h" | ||
| 89 | #include "xmalloc.h" | 90 | #include "xmalloc.h" |
| 90 | #include "ssh.h" | 91 | #include "ssh.h" |
| 91 | #include "ssh1.h" | 92 | #include "ssh1.h" |
| @@ -120,7 +121,7 @@ extern int stdin_null_flag; | |||
| 120 | extern int no_shell_flag; | 121 | extern int no_shell_flag; |
| 121 | 122 | ||
| 122 | /* Control socket */ | 123 | /* Control socket */ |
| 123 | extern int control_fd; | 124 | extern int muxserver_sock; |
| 124 | 125 | ||
| 125 | /* | 126 | /* |
| 126 | * Name of the host we are connecting to. This is the name given on the | 127 | * Name of the host we are connecting to. This is the name given on the |
| @@ -143,36 +144,46 @@ static int in_non_blocking_mode = 0; | |||
| 143 | 144 | ||
| 144 | /* Common data for the client loop code. */ | 145 | /* Common data for the client loop code. */ |
| 145 | static volatile sig_atomic_t quit_pending; /* Set non-zero to quit the loop. */ | 146 | static volatile sig_atomic_t quit_pending; /* Set non-zero to quit the loop. */ |
| 146 | static int escape_char; /* Escape character. */ | 147 | static int escape_char1; /* Escape character. (proto1 only) */ |
| 147 | static int escape_pending; /* Last character was the escape character */ | 148 | static int escape_pending1; /* Last character was an escape (proto1 only) */ |
| 148 | static int last_was_cr; /* Last character was a newline. */ | 149 | static int last_was_cr; /* Last character was a newline. */ |
| 149 | static int exit_status; /* Used to store the exit status of the command. */ | 150 | static int exit_status; /* Used to store the command exit status. */ |
| 150 | static int stdin_eof; /* EOF has been encountered on standard error. */ | 151 | static int stdin_eof; /* EOF has been encountered on stderr. */ |
| 151 | static Buffer stdin_buffer; /* Buffer for stdin data. */ | 152 | static Buffer stdin_buffer; /* Buffer for stdin data. */ |
| 152 | static Buffer stdout_buffer; /* Buffer for stdout data. */ | 153 | static Buffer stdout_buffer; /* Buffer for stdout data. */ |
| 153 | static Buffer stderr_buffer; /* Buffer for stderr data. */ | 154 | static Buffer stderr_buffer; /* Buffer for stderr data. */ |
| 154 | static u_long stdin_bytes, stdout_bytes, stderr_bytes; | ||
| 155 | static u_int buffer_high;/* Soft max buffer size. */ | 155 | static u_int buffer_high;/* Soft max buffer size. */ |
| 156 | static int connection_in; /* Connection to server (input). */ | 156 | static int connection_in; /* Connection to server (input). */ |
| 157 | static int connection_out; /* Connection to server (output). */ | 157 | static int connection_out; /* Connection to server (output). */ |
| 158 | static int need_rekeying; /* Set to non-zero if rekeying is requested. */ | 158 | static int need_rekeying; /* Set to non-zero if rekeying is requested. */ |
| 159 | static int session_closed = 0; /* In SSH2: login session closed. */ | 159 | static int session_closed = 0; /* In SSH2: login session closed. */ |
| 160 | static int server_alive_timeouts = 0; | ||
| 161 | 160 | ||
| 162 | static void client_init_dispatch(void); | 161 | static void client_init_dispatch(void); |
| 163 | int session_ident = -1; | 162 | int session_ident = -1; |
| 164 | 163 | ||
| 165 | struct confirm_ctx { | 164 | /* Track escape per proto2 channel */ |
| 166 | int want_tty; | 165 | struct escape_filter_ctx { |
| 167 | int want_subsys; | 166 | int escape_pending; |
| 168 | int want_x_fwd; | 167 | int escape_char; |
| 169 | int want_agent_fwd; | ||
| 170 | Buffer cmd; | ||
| 171 | char *term; | ||
| 172 | struct termios tio; | ||
| 173 | char **env; | ||
| 174 | }; | 168 | }; |
| 175 | 169 | ||
| 170 | /* Context for channel confirmation replies */ | ||
| 171 | struct channel_reply_ctx { | ||
| 172 | const char *request_type; | ||
| 173 | int id, do_close; | ||
| 174 | }; | ||
| 175 | |||
| 176 | /* Global request success/failure callbacks */ | ||
| 177 | struct global_confirm { | ||
| 178 | TAILQ_ENTRY(global_confirm) entry; | ||
| 179 | global_confirm_cb *cb; | ||
| 180 | void *ctx; | ||
| 181 | int ref_count; | ||
| 182 | }; | ||
| 183 | TAILQ_HEAD(global_confirms, global_confirm); | ||
| 184 | static struct global_confirms global_confirms = | ||
| 185 | TAILQ_HEAD_INITIALIZER(global_confirms); | ||
| 186 | |||
| 176 | /*XXX*/ | 187 | /*XXX*/ |
| 177 | extern Kex *xxx_kex; | 188 | extern Kex *xxx_kex; |
| 178 | 189 | ||
| @@ -380,7 +391,10 @@ client_check_initial_eof_on_stdin(void) | |||
| 380 | /* Check for immediate EOF on stdin. */ | 391 | /* Check for immediate EOF on stdin. */ |
| 381 | len = read(fileno(stdin), buf, 1); | 392 | len = read(fileno(stdin), buf, 1); |
| 382 | if (len == 0) { | 393 | if (len == 0) { |
| 383 | /* EOF. Record that we have seen it and send EOF to server. */ | 394 | /* |
| 395 | * EOF. Record that we have seen it and send | ||
| 396 | * EOF to server. | ||
| 397 | */ | ||
| 384 | debug("Sending eof."); | 398 | debug("Sending eof."); |
| 385 | stdin_eof = 1; | 399 | stdin_eof = 1; |
| 386 | packet_start(SSH_CMSG_EOF); | 400 | packet_start(SSH_CMSG_EOF); |
| @@ -391,8 +405,8 @@ client_check_initial_eof_on_stdin(void) | |||
| 391 | * and also process it as an escape character if | 405 | * and also process it as an escape character if |
| 392 | * appropriate. | 406 | * appropriate. |
| 393 | */ | 407 | */ |
| 394 | if ((u_char) buf[0] == escape_char) | 408 | if ((u_char) buf[0] == escape_char1) |
| 395 | escape_pending = 1; | 409 | escape_pending1 = 1; |
| 396 | else | 410 | else |
| 397 | buffer_append(&stdin_buffer, buf, 1); | 411 | buffer_append(&stdin_buffer, buf, 1); |
| 398 | } | 412 | } |
| @@ -422,7 +436,6 @@ client_make_packets_from_stdin_data(void) | |||
| 422 | packet_put_string(buffer_ptr(&stdin_buffer), len); | 436 | packet_put_string(buffer_ptr(&stdin_buffer), len); |
| 423 | packet_send(); | 437 | packet_send(); |
| 424 | buffer_consume(&stdin_buffer, len); | 438 | buffer_consume(&stdin_buffer, len); |
| 425 | stdin_bytes += len; | ||
| 426 | /* If we have a pending EOF, send it now. */ | 439 | /* If we have a pending EOF, send it now. */ |
| 427 | if (stdin_eof && buffer_len(&stdin_buffer) == 0) { | 440 | if (stdin_eof && buffer_len(&stdin_buffer) == 0) { |
| 428 | packet_start(SSH_CMSG_EOF); | 441 | packet_start(SSH_CMSG_EOF); |
| @@ -467,15 +480,26 @@ client_check_window_change(void) | |||
| 467 | static void | 480 | static void |
| 468 | client_global_request_reply(int type, u_int32_t seq, void *ctxt) | 481 | client_global_request_reply(int type, u_int32_t seq, void *ctxt) |
| 469 | { | 482 | { |
| 470 | server_alive_timeouts = 0; | 483 | struct global_confirm *gc; |
| 471 | client_global_request_reply_fwd(type, seq, ctxt); | 484 | |
| 485 | if ((gc = TAILQ_FIRST(&global_confirms)) == NULL) | ||
| 486 | return; | ||
| 487 | if (gc->cb != NULL) | ||
| 488 | gc->cb(type, seq, gc->ctx); | ||
| 489 | if (--gc->ref_count <= 0) { | ||
| 490 | TAILQ_REMOVE(&global_confirms, gc, entry); | ||
| 491 | bzero(gc, sizeof(*gc)); | ||
| 492 | xfree(gc); | ||
| 493 | } | ||
| 494 | |||
| 495 | keep_alive_timeouts = 0; | ||
| 472 | } | 496 | } |
| 473 | 497 | ||
| 474 | static void | 498 | static void |
| 475 | server_alive_check(void) | 499 | server_alive_check(void) |
| 476 | { | 500 | { |
| 477 | if (compat20) { | 501 | if (compat20) { |
| 478 | if (++server_alive_timeouts > options.server_alive_count_max) { | 502 | if (++keep_alive_timeouts > options.server_alive_count_max) { |
| 479 | logit("Timeout, server not responding."); | 503 | logit("Timeout, server not responding."); |
| 480 | cleanup_exit(255); | 504 | cleanup_exit(255); |
| 481 | } | 505 | } |
| @@ -483,6 +507,8 @@ server_alive_check(void) | |||
| 483 | packet_put_cstring("keepalive@openssh.com"); | 507 | packet_put_cstring("keepalive@openssh.com"); |
| 484 | packet_put_char(1); /* boolean: want reply */ | 508 | packet_put_char(1); /* boolean: want reply */ |
| 485 | packet_send(); | 509 | packet_send(); |
| 510 | /* Insert an empty placeholder to maintain ordering */ | ||
| 511 | client_register_global_confirm(NULL, NULL); | ||
| 486 | } else { | 512 | } else { |
| 487 | packet_send_ignore(0); | 513 | packet_send_ignore(0); |
| 488 | packet_send(); | 514 | packet_send(); |
| @@ -538,8 +564,8 @@ client_wait_until_can_do_something(fd_set **readsetp, fd_set **writesetp, | |||
| 538 | if (packet_have_data_to_write()) | 564 | if (packet_have_data_to_write()) |
| 539 | FD_SET(connection_out, *writesetp); | 565 | FD_SET(connection_out, *writesetp); |
| 540 | 566 | ||
| 541 | if (control_fd != -1) | 567 | if (muxserver_sock != -1) |
| 542 | FD_SET(control_fd, *readsetp); | 568 | FD_SET(muxserver_sock, *readsetp); |
| 543 | 569 | ||
| 544 | /* | 570 | /* |
| 545 | * Wait for something to happen. This will suspend the process until | 571 | * Wait for something to happen. This will suspend the process until |
| @@ -581,9 +607,11 @@ client_suspend_self(Buffer *bin, Buffer *bout, Buffer *berr) | |||
| 581 | { | 607 | { |
| 582 | /* Flush stdout and stderr buffers. */ | 608 | /* Flush stdout and stderr buffers. */ |
| 583 | if (buffer_len(bout) > 0) | 609 | if (buffer_len(bout) > 0) |
| 584 | atomicio(vwrite, fileno(stdout), buffer_ptr(bout), buffer_len(bout)); | 610 | atomicio(vwrite, fileno(stdout), buffer_ptr(bout), |
| 611 | buffer_len(bout)); | ||
| 585 | if (buffer_len(berr) > 0) | 612 | if (buffer_len(berr) > 0) |
| 586 | atomicio(vwrite, fileno(stderr), buffer_ptr(berr), buffer_len(berr)); | 613 | atomicio(vwrite, fileno(stderr), buffer_ptr(berr), |
| 614 | buffer_len(berr)); | ||
| 587 | 615 | ||
| 588 | leave_raw_mode(); | 616 | leave_raw_mode(); |
| 589 | 617 | ||
| @@ -623,9 +651,13 @@ client_process_net_input(fd_set *readset) | |||
| 623 | /* Read as much as possible. */ | 651 | /* Read as much as possible. */ |
| 624 | len = read(connection_in, buf, sizeof(buf)); | 652 | len = read(connection_in, buf, sizeof(buf)); |
| 625 | if (len == 0) { | 653 | if (len == 0) { |
| 626 | /* Received EOF. The remote host has closed the connection. */ | 654 | /* |
| 627 | snprintf(buf, sizeof buf, "Connection to %.300s closed by remote host.\r\n", | 655 | * Received EOF. The remote host has closed the |
| 628 | host); | 656 | * connection. |
| 657 | */ | ||
| 658 | snprintf(buf, sizeof buf, | ||
| 659 | "Connection to %.300s closed by remote host.\r\n", | ||
| 660 | host); | ||
| 629 | buffer_append(&stderr_buffer, buf, strlen(buf)); | 661 | buffer_append(&stderr_buffer, buf, strlen(buf)); |
| 630 | quit_pending = 1; | 662 | quit_pending = 1; |
| 631 | return; | 663 | return; |
| @@ -634,13 +666,18 @@ client_process_net_input(fd_set *readset) | |||
| 634 | * There is a kernel bug on Solaris that causes select to | 666 | * There is a kernel bug on Solaris that causes select to |
| 635 | * sometimes wake up even though there is no data available. | 667 | * sometimes wake up even though there is no data available. |
| 636 | */ | 668 | */ |
| 637 | if (len < 0 && (errno == EAGAIN || errno == EINTR)) | 669 | if (len < 0 && |
| 670 | (errno == EAGAIN || errno == EINTR || errno == EWOULDBLOCK)) | ||
| 638 | len = 0; | 671 | len = 0; |
| 639 | 672 | ||
| 640 | if (len < 0) { | 673 | if (len < 0) { |
| 641 | /* An error has encountered. Perhaps there is a network problem. */ | 674 | /* |
| 642 | snprintf(buf, sizeof buf, "Read from remote host %.300s: %.100s\r\n", | 675 | * An error has encountered. Perhaps there is a |
| 643 | host, strerror(errno)); | 676 | * network problem. |
| 677 | */ | ||
| 678 | snprintf(buf, sizeof buf, | ||
| 679 | "Read from remote host %.300s: %.100s\r\n", | ||
| 680 | host, strerror(errno)); | ||
| 644 | buffer_append(&stderr_buffer, buf, strlen(buf)); | 681 | buffer_append(&stderr_buffer, buf, strlen(buf)); |
| 645 | quit_pending = 1; | 682 | quit_pending = 1; |
| 646 | return; | 683 | return; |
| @@ -650,289 +687,81 @@ client_process_net_input(fd_set *readset) | |||
| 650 | } | 687 | } |
| 651 | 688 | ||
| 652 | static void | 689 | static void |
| 653 | client_subsystem_reply(int type, u_int32_t seq, void *ctxt) | 690 | client_status_confirm(int type, Channel *c, void *ctx) |
| 654 | { | 691 | { |
| 655 | int id; | 692 | struct channel_reply_ctx *cr = (struct channel_reply_ctx *)ctx; |
| 656 | Channel *c; | 693 | char errmsg[256]; |
| 657 | 694 | int tochan; | |
| 658 | id = packet_get_int(); | 695 | |
| 659 | packet_check_eom(); | 696 | /* XXX supress on mux _client_ quietmode */ |
| 660 | 697 | tochan = options.log_level >= SYSLOG_LEVEL_ERROR && | |
| 661 | if ((c = channel_lookup(id)) == NULL) { | 698 | c->ctl_fd != -1 && c->extended_usage == CHAN_EXTENDED_WRITE; |
| 662 | error("%s: no channel for id %d", __func__, id); | 699 | |
| 663 | return; | 700 | if (type == SSH2_MSG_CHANNEL_SUCCESS) { |
| 664 | } | 701 | debug2("%s request accepted on channel %d", |
| 665 | 702 | cr->request_type, c->self); | |
| 666 | if (type == SSH2_MSG_CHANNEL_SUCCESS) | 703 | } else if (type == SSH2_MSG_CHANNEL_FAILURE) { |
| 667 | debug2("Request suceeded on channel %d", id); | 704 | if (tochan) { |
| 668 | else if (type == SSH2_MSG_CHANNEL_FAILURE) { | 705 | snprintf(errmsg, sizeof(errmsg), |
| 669 | error("Request failed on channel %d", id); | 706 | "%s request failed\r\n", cr->request_type); |
| 670 | channel_free(c); | 707 | } else { |
| 708 | snprintf(errmsg, sizeof(errmsg), | ||
| 709 | "%s request failed on channel %d", | ||
| 710 | cr->request_type, c->self); | ||
| 711 | } | ||
| 712 | /* If error occurred on primary session channel, then exit */ | ||
| 713 | if (cr->do_close && c->self == session_ident) | ||
| 714 | fatal("%s", errmsg); | ||
| 715 | /* If error occurred on mux client, append to their stderr */ | ||
| 716 | if (tochan) | ||
| 717 | buffer_append(&c->extended, errmsg, strlen(errmsg)); | ||
| 718 | else | ||
| 719 | error("%s", errmsg); | ||
| 720 | if (cr->do_close) { | ||
| 721 | chan_read_failed(c); | ||
| 722 | chan_write_failed(c); | ||
| 723 | } | ||
| 671 | } | 724 | } |
| 725 | xfree(cr); | ||
| 672 | } | 726 | } |
| 673 | 727 | ||
| 674 | static void | 728 | static void |
| 675 | client_extra_session2_setup(int id, void *arg) | 729 | client_abandon_status_confirm(Channel *c, void *ctx) |
| 676 | { | 730 | { |
| 677 | struct confirm_ctx *cctx = arg; | 731 | xfree(ctx); |
| 678 | const char *display; | ||
| 679 | Channel *c; | ||
| 680 | int i; | ||
| 681 | |||
| 682 | if (cctx == NULL) | ||
| 683 | fatal("%s: cctx == NULL", __func__); | ||
| 684 | if ((c = channel_lookup(id)) == NULL) | ||
| 685 | fatal("%s: no channel for id %d", __func__, id); | ||
| 686 | |||
| 687 | display = getenv("DISPLAY"); | ||
| 688 | if (cctx->want_x_fwd && options.forward_x11 && display != NULL) { | ||
| 689 | char *proto, *data; | ||
| 690 | /* Get reasonable local authentication information. */ | ||
| 691 | client_x11_get_proto(display, options.xauth_location, | ||
| 692 | options.forward_x11_trusted, &proto, &data); | ||
| 693 | /* Request forwarding with authentication spoofing. */ | ||
| 694 | debug("Requesting X11 forwarding with authentication spoofing."); | ||
| 695 | x11_request_forwarding_with_spoofing(id, display, proto, data); | ||
| 696 | /* XXX wait for reply */ | ||
| 697 | } | ||
| 698 | |||
| 699 | if (cctx->want_agent_fwd && options.forward_agent) { | ||
| 700 | debug("Requesting authentication agent forwarding."); | ||
| 701 | channel_request_start(id, "auth-agent-req@openssh.com", 0); | ||
| 702 | packet_send(); | ||
| 703 | } | ||
| 704 | |||
| 705 | client_session2_setup(id, cctx->want_tty, cctx->want_subsys, | ||
| 706 | cctx->term, &cctx->tio, c->rfd, &cctx->cmd, cctx->env, | ||
| 707 | client_subsystem_reply); | ||
| 708 | |||
| 709 | c->confirm_ctx = NULL; | ||
| 710 | buffer_free(&cctx->cmd); | ||
| 711 | xfree(cctx->term); | ||
| 712 | if (cctx->env != NULL) { | ||
| 713 | for (i = 0; cctx->env[i] != NULL; i++) | ||
| 714 | xfree(cctx->env[i]); | ||
| 715 | xfree(cctx->env); | ||
| 716 | } | ||
| 717 | xfree(cctx); | ||
| 718 | } | 732 | } |
| 719 | 733 | ||
| 720 | static void | 734 | static void |
| 721 | client_process_control(fd_set *readset) | 735 | client_expect_confirm(int id, const char *request, int do_close) |
| 722 | { | 736 | { |
| 723 | Buffer m; | 737 | struct channel_reply_ctx *cr = xmalloc(sizeof(*cr)); |
| 724 | Channel *c; | ||
| 725 | int client_fd, new_fd[3], ver, allowed, window, packetmax; | ||
| 726 | socklen_t addrlen; | ||
| 727 | struct sockaddr_storage addr; | ||
| 728 | struct confirm_ctx *cctx; | ||
| 729 | char *cmd; | ||
| 730 | u_int i, len, env_len, command, flags; | ||
| 731 | uid_t euid; | ||
| 732 | gid_t egid; | ||
| 733 | |||
| 734 | /* | ||
| 735 | * Accept connection on control socket | ||
| 736 | */ | ||
| 737 | if (control_fd == -1 || !FD_ISSET(control_fd, readset)) | ||
| 738 | return; | ||
| 739 | |||
| 740 | memset(&addr, 0, sizeof(addr)); | ||
| 741 | addrlen = sizeof(addr); | ||
| 742 | if ((client_fd = accept(control_fd, | ||
| 743 | (struct sockaddr*)&addr, &addrlen)) == -1) { | ||
| 744 | error("%s accept: %s", __func__, strerror(errno)); | ||
| 745 | return; | ||
| 746 | } | ||
| 747 | |||
| 748 | if (getpeereid(client_fd, &euid, &egid) < 0) { | ||
| 749 | error("%s getpeereid failed: %s", __func__, strerror(errno)); | ||
| 750 | close(client_fd); | ||
| 751 | return; | ||
| 752 | } | ||
| 753 | if ((euid != 0) && (getuid() != euid)) { | ||
| 754 | error("control mode uid mismatch: peer euid %u != uid %u", | ||
| 755 | (u_int) euid, (u_int) getuid()); | ||
| 756 | close(client_fd); | ||
| 757 | return; | ||
| 758 | } | ||
| 759 | |||
| 760 | unset_nonblock(client_fd); | ||
| 761 | |||
| 762 | /* Read command */ | ||
| 763 | buffer_init(&m); | ||
| 764 | if (ssh_msg_recv(client_fd, &m) == -1) { | ||
| 765 | error("%s: client msg_recv failed", __func__); | ||
| 766 | close(client_fd); | ||
| 767 | buffer_free(&m); | ||
| 768 | return; | ||
| 769 | } | ||
| 770 | if ((ver = buffer_get_char(&m)) != SSHMUX_VER) { | ||
| 771 | error("%s: wrong client version %d", __func__, ver); | ||
| 772 | buffer_free(&m); | ||
| 773 | close(client_fd); | ||
| 774 | return; | ||
| 775 | } | ||
| 776 | |||
| 777 | allowed = 1; | ||
| 778 | command = buffer_get_int(&m); | ||
| 779 | flags = buffer_get_int(&m); | ||
| 780 | |||
| 781 | buffer_clear(&m); | ||
| 782 | |||
| 783 | switch (command) { | ||
| 784 | case SSHMUX_COMMAND_OPEN: | ||
| 785 | if (options.control_master == SSHCTL_MASTER_ASK || | ||
| 786 | options.control_master == SSHCTL_MASTER_AUTO_ASK) | ||
| 787 | allowed = ask_permission("Allow shared connection " | ||
| 788 | "to %s? ", host); | ||
| 789 | /* continue below */ | ||
| 790 | break; | ||
| 791 | case SSHMUX_COMMAND_TERMINATE: | ||
| 792 | if (options.control_master == SSHCTL_MASTER_ASK || | ||
| 793 | options.control_master == SSHCTL_MASTER_AUTO_ASK) | ||
| 794 | allowed = ask_permission("Terminate shared connection " | ||
| 795 | "to %s? ", host); | ||
| 796 | if (allowed) | ||
| 797 | quit_pending = 1; | ||
| 798 | /* FALLTHROUGH */ | ||
| 799 | case SSHMUX_COMMAND_ALIVE_CHECK: | ||
| 800 | /* Reply for SSHMUX_COMMAND_TERMINATE and ALIVE_CHECK */ | ||
| 801 | buffer_clear(&m); | ||
| 802 | buffer_put_int(&m, allowed); | ||
| 803 | buffer_put_int(&m, getpid()); | ||
| 804 | if (ssh_msg_send(client_fd, SSHMUX_VER, &m) == -1) { | ||
| 805 | error("%s: client msg_send failed", __func__); | ||
| 806 | close(client_fd); | ||
| 807 | buffer_free(&m); | ||
| 808 | return; | ||
| 809 | } | ||
| 810 | buffer_free(&m); | ||
| 811 | close(client_fd); | ||
| 812 | return; | ||
| 813 | default: | ||
| 814 | error("Unsupported command %d", command); | ||
| 815 | buffer_free(&m); | ||
| 816 | close(client_fd); | ||
| 817 | return; | ||
| 818 | } | ||
| 819 | |||
| 820 | /* Reply for SSHMUX_COMMAND_OPEN */ | ||
| 821 | buffer_clear(&m); | ||
| 822 | buffer_put_int(&m, allowed); | ||
| 823 | buffer_put_int(&m, getpid()); | ||
| 824 | if (ssh_msg_send(client_fd, SSHMUX_VER, &m) == -1) { | ||
| 825 | error("%s: client msg_send failed", __func__); | ||
| 826 | close(client_fd); | ||
| 827 | buffer_free(&m); | ||
| 828 | return; | ||
| 829 | } | ||
| 830 | |||
| 831 | if (!allowed) { | ||
| 832 | error("Refused control connection"); | ||
| 833 | close(client_fd); | ||
| 834 | buffer_free(&m); | ||
| 835 | return; | ||
| 836 | } | ||
| 837 | 738 | ||
| 838 | buffer_clear(&m); | 739 | cr->request_type = request; |
| 839 | if (ssh_msg_recv(client_fd, &m) == -1) { | 740 | cr->do_close = do_close; |
| 840 | error("%s: client msg_recv failed", __func__); | ||
| 841 | close(client_fd); | ||
| 842 | buffer_free(&m); | ||
| 843 | return; | ||
| 844 | } | ||
| 845 | if ((ver = buffer_get_char(&m)) != SSHMUX_VER) { | ||
| 846 | error("%s: wrong client version %d", __func__, ver); | ||
| 847 | buffer_free(&m); | ||
| 848 | close(client_fd); | ||
| 849 | return; | ||
| 850 | } | ||
| 851 | 741 | ||
| 852 | cctx = xcalloc(1, sizeof(*cctx)); | 742 | channel_register_status_confirm(id, client_status_confirm, |
| 853 | cctx->want_tty = (flags & SSHMUX_FLAG_TTY) != 0; | 743 | client_abandon_status_confirm, cr); |
| 854 | cctx->want_subsys = (flags & SSHMUX_FLAG_SUBSYS) != 0; | 744 | } |
| 855 | cctx->want_x_fwd = (flags & SSHMUX_FLAG_X11_FWD) != 0; | ||
| 856 | cctx->want_agent_fwd = (flags & SSHMUX_FLAG_AGENT_FWD) != 0; | ||
| 857 | cctx->term = buffer_get_string(&m, &len); | ||
| 858 | |||
| 859 | cmd = buffer_get_string(&m, &len); | ||
| 860 | buffer_init(&cctx->cmd); | ||
| 861 | buffer_append(&cctx->cmd, cmd, strlen(cmd)); | ||
| 862 | |||
| 863 | env_len = buffer_get_int(&m); | ||
| 864 | env_len = MIN(env_len, 4096); | ||
| 865 | debug3("%s: receiving %d env vars", __func__, env_len); | ||
| 866 | if (env_len != 0) { | ||
| 867 | cctx->env = xcalloc(env_len + 1, sizeof(*cctx->env)); | ||
| 868 | for (i = 0; i < env_len; i++) | ||
| 869 | cctx->env[i] = buffer_get_string(&m, &len); | ||
| 870 | cctx->env[i] = NULL; | ||
| 871 | } | ||
| 872 | 745 | ||
| 873 | debug2("%s: accepted tty %d, subsys %d, cmd %s", __func__, | 746 | void |
| 874 | cctx->want_tty, cctx->want_subsys, cmd); | 747 | client_register_global_confirm(global_confirm_cb *cb, void *ctx) |
| 875 | xfree(cmd); | 748 | { |
| 876 | 749 | struct global_confirm *gc, *last_gc; | |
| 877 | /* Gather fds from client */ | 750 | |
| 878 | new_fd[0] = mm_receive_fd(client_fd); | 751 | /* Coalesce identical callbacks */ |
| 879 | new_fd[1] = mm_receive_fd(client_fd); | 752 | last_gc = TAILQ_LAST(&global_confirms, global_confirms); |
| 880 | new_fd[2] = mm_receive_fd(client_fd); | 753 | if (last_gc && last_gc->cb == cb && last_gc->ctx == ctx) { |
| 881 | 754 | if (++last_gc->ref_count >= INT_MAX) | |
| 882 | debug2("%s: got fds stdin %d, stdout %d, stderr %d", __func__, | 755 | fatal("%s: last_gc->ref_count = %d", |
| 883 | new_fd[0], new_fd[1], new_fd[2]); | 756 | __func__, last_gc->ref_count); |
| 884 | |||
| 885 | /* Try to pick up ttymodes from client before it goes raw */ | ||
| 886 | if (cctx->want_tty && tcgetattr(new_fd[0], &cctx->tio) == -1) | ||
| 887 | error("%s: tcgetattr: %s", __func__, strerror(errno)); | ||
| 888 | |||
| 889 | /* This roundtrip is just for synchronisation of ttymodes */ | ||
| 890 | buffer_clear(&m); | ||
| 891 | if (ssh_msg_send(client_fd, SSHMUX_VER, &m) == -1) { | ||
| 892 | error("%s: client msg_send failed", __func__); | ||
| 893 | close(client_fd); | ||
| 894 | close(new_fd[0]); | ||
| 895 | close(new_fd[1]); | ||
| 896 | close(new_fd[2]); | ||
| 897 | buffer_free(&m); | ||
| 898 | xfree(cctx->term); | ||
| 899 | if (env_len != 0) { | ||
| 900 | for (i = 0; i < env_len; i++) | ||
| 901 | xfree(cctx->env[i]); | ||
| 902 | xfree(cctx->env); | ||
| 903 | } | ||
| 904 | return; | 757 | return; |
| 905 | } | 758 | } |
| 906 | buffer_free(&m); | ||
| 907 | |||
| 908 | /* enable nonblocking unless tty */ | ||
| 909 | if (!isatty(new_fd[0])) | ||
| 910 | set_nonblock(new_fd[0]); | ||
| 911 | if (!isatty(new_fd[1])) | ||
| 912 | set_nonblock(new_fd[1]); | ||
| 913 | if (!isatty(new_fd[2])) | ||
| 914 | set_nonblock(new_fd[2]); | ||
| 915 | |||
| 916 | set_nonblock(client_fd); | ||
| 917 | |||
| 918 | window = CHAN_SES_WINDOW_DEFAULT; | ||
| 919 | packetmax = CHAN_SES_PACKET_DEFAULT; | ||
| 920 | if (cctx->want_tty) { | ||
| 921 | window >>= 1; | ||
| 922 | packetmax >>= 1; | ||
| 923 | } | ||
| 924 | |||
| 925 | c = channel_new("session", SSH_CHANNEL_OPENING, | ||
| 926 | new_fd[0], new_fd[1], new_fd[2], window, packetmax, | ||
| 927 | CHAN_EXTENDED_WRITE, "client-session", /*nonblock*/0); | ||
| 928 | 759 | ||
| 929 | /* XXX */ | 760 | gc = xmalloc(sizeof(*gc)); |
| 930 | c->ctl_fd = client_fd; | 761 | gc->cb = cb; |
| 931 | 762 | gc->ctx = ctx; | |
| 932 | debug3("%s: channel_new: %d", __func__, c->self); | 763 | gc->ref_count = 1; |
| 933 | 764 | TAILQ_INSERT_TAIL(&global_confirms, gc, entry); | |
| 934 | channel_send_open(c->self); | ||
| 935 | channel_register_confirm(c->self, client_extra_session2_setup, cctx); | ||
| 936 | } | 765 | } |
| 937 | 766 | ||
| 938 | static void | 767 | static void |
| @@ -945,6 +774,9 @@ process_cmdline(void) | |||
| 945 | u_short cancel_port; | 774 | u_short cancel_port; |
| 946 | Forward fwd; | 775 | Forward fwd; |
| 947 | 776 | ||
| 777 | bzero(&fwd, sizeof(fwd)); | ||
| 778 | fwd.listen_host = fwd.connect_host = NULL; | ||
| 779 | |||
| 948 | leave_raw_mode(); | 780 | leave_raw_mode(); |
| 949 | handler = signal(SIGINT, SIG_IGN); | 781 | handler = signal(SIGINT, SIG_IGN); |
| 950 | cmd = s = read_passphrase("\r\nssh> ", RP_ECHO); | 782 | cmd = s = read_passphrase("\r\nssh> ", RP_ECHO); |
| @@ -1044,11 +876,18 @@ out: | |||
| 1044 | enter_raw_mode(); | 876 | enter_raw_mode(); |
| 1045 | if (cmd) | 877 | if (cmd) |
| 1046 | xfree(cmd); | 878 | xfree(cmd); |
| 879 | if (fwd.listen_host != NULL) | ||
| 880 | xfree(fwd.listen_host); | ||
| 881 | if (fwd.connect_host != NULL) | ||
| 882 | xfree(fwd.connect_host); | ||
| 1047 | } | 883 | } |
| 1048 | 884 | ||
| 1049 | /* process the characters one by one */ | 885 | /* |
| 886 | * Process the characters one by one, call with c==NULL for proto1 case. | ||
| 887 | */ | ||
| 1050 | static int | 888 | static int |
| 1051 | process_escapes(Buffer *bin, Buffer *bout, Buffer *berr, char *buf, int len) | 889 | process_escapes(Channel *c, Buffer *bin, Buffer *bout, Buffer *berr, |
| 890 | char *buf, int len) | ||
| 1052 | { | 891 | { |
| 1053 | char string[1024]; | 892 | char string[1024]; |
| 1054 | pid_t pid; | 893 | pid_t pid; |
| @@ -1056,7 +895,20 @@ process_escapes(Buffer *bin, Buffer *bout, Buffer *berr, char *buf, int len) | |||
| 1056 | u_int i; | 895 | u_int i; |
| 1057 | u_char ch; | 896 | u_char ch; |
| 1058 | char *s; | 897 | char *s; |
| 898 | int *escape_pendingp, escape_char; | ||
| 899 | struct escape_filter_ctx *efc; | ||
| 1059 | 900 | ||
| 901 | if (c == NULL) { | ||
| 902 | escape_pendingp = &escape_pending1; | ||
| 903 | escape_char = escape_char1; | ||
| 904 | } else { | ||
| 905 | if (c->filter_ctx == NULL) | ||
| 906 | return 0; | ||
| 907 | efc = (struct escape_filter_ctx *)c->filter_ctx; | ||
| 908 | escape_pendingp = &efc->escape_pending; | ||
| 909 | escape_char = efc->escape_char; | ||
| 910 | } | ||
| 911 | |||
| 1060 | if (len <= 0) | 912 | if (len <= 0) |
| 1061 | return (0); | 913 | return (0); |
| 1062 | 914 | ||
| @@ -1064,25 +916,42 @@ process_escapes(Buffer *bin, Buffer *bout, Buffer *berr, char *buf, int len) | |||
| 1064 | /* Get one character at a time. */ | 916 | /* Get one character at a time. */ |
| 1065 | ch = buf[i]; | 917 | ch = buf[i]; |
| 1066 | 918 | ||
| 1067 | if (escape_pending) { | 919 | if (*escape_pendingp) { |
| 1068 | /* We have previously seen an escape character. */ | 920 | /* We have previously seen an escape character. */ |
| 1069 | /* Clear the flag now. */ | 921 | /* Clear the flag now. */ |
| 1070 | escape_pending = 0; | 922 | *escape_pendingp = 0; |
| 1071 | 923 | ||
| 1072 | /* Process the escaped character. */ | 924 | /* Process the escaped character. */ |
| 1073 | switch (ch) { | 925 | switch (ch) { |
| 1074 | case '.': | 926 | case '.': |
| 1075 | /* Terminate the connection. */ | 927 | /* Terminate the connection. */ |
| 1076 | snprintf(string, sizeof string, "%c.\r\n", escape_char); | 928 | snprintf(string, sizeof string, "%c.\r\n", |
| 929 | escape_char); | ||
| 1077 | buffer_append(berr, string, strlen(string)); | 930 | buffer_append(berr, string, strlen(string)); |
| 1078 | 931 | ||
| 1079 | quit_pending = 1; | 932 | if (c && c->ctl_fd != -1) { |
| 933 | chan_read_failed(c); | ||
| 934 | chan_write_failed(c); | ||
| 935 | return 0; | ||
| 936 | } else | ||
| 937 | quit_pending = 1; | ||
| 1080 | return -1; | 938 | return -1; |
| 1081 | 939 | ||
| 1082 | case 'Z' - 64: | 940 | case 'Z' - 64: |
| 1083 | /* Suspend the program. */ | 941 | /* XXX support this for mux clients */ |
| 1084 | /* Print a message to that effect to the user. */ | 942 | if (c && c->ctl_fd != -1) { |
| 1085 | snprintf(string, sizeof string, "%c^Z [suspend ssh]\r\n", escape_char); | 943 | noescape: |
| 944 | snprintf(string, sizeof string, | ||
| 945 | "%c%c escape not available to " | ||
| 946 | "multiplexed sessions\r\n", | ||
| 947 | escape_char, ch); | ||
| 948 | buffer_append(berr, string, | ||
| 949 | strlen(string)); | ||
| 950 | continue; | ||
| 951 | } | ||
| 952 | /* Suspend the program. Inform the user */ | ||
| 953 | snprintf(string, sizeof string, | ||
| 954 | "%c^Z [suspend ssh]\r\n", escape_char); | ||
| 1086 | buffer_append(berr, string, strlen(string)); | 955 | buffer_append(berr, string, strlen(string)); |
| 1087 | 956 | ||
| 1088 | /* Restore terminal modes and suspend. */ | 957 | /* Restore terminal modes and suspend. */ |
| @@ -1107,16 +976,20 @@ process_escapes(Buffer *bin, Buffer *bout, Buffer *berr, char *buf, int len) | |||
| 1107 | case 'R': | 976 | case 'R': |
| 1108 | if (compat20) { | 977 | if (compat20) { |
| 1109 | if (datafellows & SSH_BUG_NOREKEY) | 978 | if (datafellows & SSH_BUG_NOREKEY) |
| 1110 | logit("Server does not support re-keying"); | 979 | logit("Server does not " |
| 980 | "support re-keying"); | ||
| 1111 | else | 981 | else |
| 1112 | need_rekeying = 1; | 982 | need_rekeying = 1; |
| 1113 | } | 983 | } |
| 1114 | continue; | 984 | continue; |
| 1115 | 985 | ||
| 1116 | case '&': | 986 | case '&': |
| 987 | if (c && c->ctl_fd != -1) | ||
| 988 | goto noescape; | ||
| 1117 | /* | 989 | /* |
| 1118 | * Detach the program (continue to serve connections, | 990 | * Detach the program (continue to serve |
| 1119 | * but put in background and no more new connections). | 991 | * connections, but put in background and no |
| 992 | * more new connections). | ||
| 1120 | */ | 993 | */ |
| 1121 | /* Restore tty modes. */ | 994 | /* Restore tty modes. */ |
| 1122 | leave_raw_mode(); | 995 | leave_raw_mode(); |
| @@ -1145,9 +1018,9 @@ process_escapes(Buffer *bin, Buffer *bout, Buffer *berr, char *buf, int len) | |||
| 1145 | return -1; | 1018 | return -1; |
| 1146 | } else if (!stdin_eof) { | 1019 | } else if (!stdin_eof) { |
| 1147 | /* | 1020 | /* |
| 1148 | * Sending SSH_CMSG_EOF alone does not always appear | 1021 | * Sending SSH_CMSG_EOF alone does not |
| 1149 | * to be enough. So we try to send an EOF character | 1022 | * always appear to be enough. So we |
| 1150 | * first. | 1023 | * try to send an EOF character first. |
| 1151 | */ | 1024 | */ |
| 1152 | packet_start(SSH_CMSG_STDIN_DATA); | 1025 | packet_start(SSH_CMSG_STDIN_DATA); |
| 1153 | packet_put_string("\004", 1); | 1026 | packet_put_string("\004", 1); |
| @@ -1162,27 +1035,50 @@ process_escapes(Buffer *bin, Buffer *bout, Buffer *berr, char *buf, int len) | |||
| 1162 | continue; | 1035 | continue; |
| 1163 | 1036 | ||
| 1164 | case '?': | 1037 | case '?': |
| 1165 | snprintf(string, sizeof string, | 1038 | if (c && c->ctl_fd != -1) { |
| 1039 | snprintf(string, sizeof string, | ||
| 1166 | "%c?\r\n\ | 1040 | "%c?\r\n\ |
| 1167 | Supported escape sequences:\r\n\ | 1041 | Supported escape sequences:\r\n\ |
| 1168 | %c. - terminate connection\r\n\ | 1042 | %c. - terminate session\r\n\ |
| 1169 | %cB - send a BREAK to the remote system\r\n\ | 1043 | %cB - send a BREAK to the remote system\r\n\ |
| 1170 | %cC - open a command line\r\n\ | 1044 | %cC - open a command line\r\n\ |
| 1171 | %cR - Request rekey (SSH protocol 2 only)\r\n\ | 1045 | %cR - Request rekey (SSH protocol 2 only)\r\n\ |
| 1172 | %c^Z - suspend ssh\r\n\ | 1046 | %c# - list forwarded connections\r\n\ |
| 1173 | %c# - list forwarded connections\r\n\ | 1047 | %c? - this message\r\n\ |
| 1174 | %c& - background ssh (when waiting for connections to terminate)\r\n\ | 1048 | %c%c - send the escape character by typing it twice\r\n\ |
| 1175 | %c? - this message\r\n\ | ||
| 1176 | %c%c - send the escape character by typing it twice\r\n\ | ||
| 1177 | (Note that escapes are only recognized immediately after newline.)\r\n", | 1049 | (Note that escapes are only recognized immediately after newline.)\r\n", |
| 1178 | escape_char, escape_char, escape_char, escape_char, | 1050 | escape_char, escape_char, |
| 1179 | escape_char, escape_char, escape_char, escape_char, | 1051 | escape_char, escape_char, |
| 1180 | escape_char, escape_char, escape_char); | 1052 | escape_char, escape_char, |
| 1053 | escape_char, escape_char, | ||
| 1054 | escape_char); | ||
| 1055 | } else { | ||
| 1056 | snprintf(string, sizeof string, | ||
| 1057 | "%c?\r\n\ | ||
| 1058 | Supported escape sequences:\r\n\ | ||
| 1059 | %c. - terminate connection (and any multiplexed sessions)\r\n\ | ||
| 1060 | %cB - send a BREAK to the remote system\r\n\ | ||
| 1061 | %cC - open a command line\r\n\ | ||
| 1062 | %cR - Request rekey (SSH protocol 2 only)\r\n\ | ||
| 1063 | %c^Z - suspend ssh\r\n\ | ||
| 1064 | %c# - list forwarded connections\r\n\ | ||
| 1065 | %c& - background ssh (when waiting for connections to terminate)\r\n\ | ||
| 1066 | %c? - this message\r\n\ | ||
| 1067 | %c%c - send the escape character by typing it twice\r\n\ | ||
| 1068 | (Note that escapes are only recognized immediately after newline.)\r\n", | ||
| 1069 | escape_char, escape_char, | ||
| 1070 | escape_char, escape_char, | ||
| 1071 | escape_char, escape_char, | ||
| 1072 | escape_char, escape_char, | ||
| 1073 | escape_char, escape_char, | ||
| 1074 | escape_char); | ||
| 1075 | } | ||
| 1181 | buffer_append(berr, string, strlen(string)); | 1076 | buffer_append(berr, string, strlen(string)); |
| 1182 | continue; | 1077 | continue; |
| 1183 | 1078 | ||
| 1184 | case '#': | 1079 | case '#': |
| 1185 | snprintf(string, sizeof string, "%c#\r\n", escape_char); | 1080 | snprintf(string, sizeof string, "%c#\r\n", |
| 1081 | escape_char); | ||
| 1186 | buffer_append(berr, string, strlen(string)); | 1082 | buffer_append(berr, string, strlen(string)); |
| 1187 | s = channel_open_message(); | 1083 | s = channel_open_message(); |
| 1188 | buffer_append(berr, s, strlen(s)); | 1084 | buffer_append(berr, s, strlen(s)); |
| @@ -1203,12 +1099,15 @@ Supported escape sequences:\r\n\ | |||
| 1203 | } | 1099 | } |
| 1204 | } else { | 1100 | } else { |
| 1205 | /* | 1101 | /* |
| 1206 | * The previous character was not an escape char. Check if this | 1102 | * The previous character was not an escape char. |
| 1207 | * is an escape. | 1103 | * Check if this is an escape. |
| 1208 | */ | 1104 | */ |
| 1209 | if (last_was_cr && ch == escape_char) { | 1105 | if (last_was_cr && ch == escape_char) { |
| 1210 | /* It is. Set the flag and continue to next character. */ | 1106 | /* |
| 1211 | escape_pending = 1; | 1107 | * It is. Set the flag and continue to |
| 1108 | * next character. | ||
| 1109 | */ | ||
| 1110 | *escape_pendingp = 1; | ||
| 1212 | continue; | 1111 | continue; |
| 1213 | } | 1112 | } |
| 1214 | } | 1113 | } |
| @@ -1234,7 +1133,8 @@ client_process_input(fd_set *readset) | |||
| 1234 | if (FD_ISSET(fileno(stdin), readset)) { | 1133 | if (FD_ISSET(fileno(stdin), readset)) { |
| 1235 | /* Read as much as possible. */ | 1134 | /* Read as much as possible. */ |
| 1236 | len = read(fileno(stdin), buf, sizeof(buf)); | 1135 | len = read(fileno(stdin), buf, sizeof(buf)); |
| 1237 | if (len < 0 && (errno == EAGAIN || errno == EINTR)) | 1136 | if (len < 0 && |
| 1137 | (errno == EAGAIN || errno == EINTR || errno == EWOULDBLOCK)) | ||
| 1238 | return; /* we'll try again later */ | 1138 | return; /* we'll try again later */ |
| 1239 | if (len <= 0) { | 1139 | if (len <= 0) { |
| 1240 | /* | 1140 | /* |
| @@ -1243,7 +1143,8 @@ client_process_input(fd_set *readset) | |||
| 1243 | * if it was an error condition. | 1143 | * if it was an error condition. |
| 1244 | */ | 1144 | */ |
| 1245 | if (len < 0) { | 1145 | if (len < 0) { |
| 1246 | snprintf(buf, sizeof buf, "read: %.100s\r\n", strerror(errno)); | 1146 | snprintf(buf, sizeof buf, "read: %.100s\r\n", |
| 1147 | strerror(errno)); | ||
| 1247 | buffer_append(&stderr_buffer, buf, strlen(buf)); | 1148 | buffer_append(&stderr_buffer, buf, strlen(buf)); |
| 1248 | } | 1149 | } |
| 1249 | /* Mark that we have seen EOF. */ | 1150 | /* Mark that we have seen EOF. */ |
| @@ -1259,7 +1160,7 @@ client_process_input(fd_set *readset) | |||
| 1259 | packet_start(SSH_CMSG_EOF); | 1160 | packet_start(SSH_CMSG_EOF); |
| 1260 | packet_send(); | 1161 | packet_send(); |
| 1261 | } | 1162 | } |
| 1262 | } else if (escape_char == SSH_ESCAPECHAR_NONE) { | 1163 | } else if (escape_char1 == SSH_ESCAPECHAR_NONE) { |
| 1263 | /* | 1164 | /* |
| 1264 | * Normal successful read, and no escape character. | 1165 | * Normal successful read, and no escape character. |
| 1265 | * Just append the data to buffer. | 1166 | * Just append the data to buffer. |
| @@ -1267,11 +1168,12 @@ client_process_input(fd_set *readset) | |||
| 1267 | buffer_append(&stdin_buffer, buf, len); | 1168 | buffer_append(&stdin_buffer, buf, len); |
| 1268 | } else { | 1169 | } else { |
| 1269 | /* | 1170 | /* |
| 1270 | * Normal, successful read. But we have an escape character | 1171 | * Normal, successful read. But we have an escape |
| 1271 | * and have to process the characters one by one. | 1172 | * character and have to process the characters one |
| 1173 | * by one. | ||
| 1272 | */ | 1174 | */ |
| 1273 | if (process_escapes(&stdin_buffer, &stdout_buffer, | 1175 | if (process_escapes(NULL, &stdin_buffer, |
| 1274 | &stderr_buffer, buf, len) == -1) | 1176 | &stdout_buffer, &stderr_buffer, buf, len) == -1) |
| 1275 | return; | 1177 | return; |
| 1276 | } | 1178 | } |
| 1277 | } | 1179 | } |
| @@ -1289,14 +1191,16 @@ client_process_output(fd_set *writeset) | |||
| 1289 | len = write(fileno(stdout), buffer_ptr(&stdout_buffer), | 1191 | len = write(fileno(stdout), buffer_ptr(&stdout_buffer), |
| 1290 | buffer_len(&stdout_buffer)); | 1192 | buffer_len(&stdout_buffer)); |
| 1291 | if (len <= 0) { | 1193 | if (len <= 0) { |
| 1292 | if (errno == EINTR || errno == EAGAIN) | 1194 | if (errno == EINTR || errno == EAGAIN || |
| 1195 | errno == EWOULDBLOCK) | ||
| 1293 | len = 0; | 1196 | len = 0; |
| 1294 | else { | 1197 | else { |
| 1295 | /* | 1198 | /* |
| 1296 | * An error or EOF was encountered. Put an | 1199 | * An error or EOF was encountered. Put an |
| 1297 | * error message to stderr buffer. | 1200 | * error message to stderr buffer. |
| 1298 | */ | 1201 | */ |
| 1299 | snprintf(buf, sizeof buf, "write stdout: %.50s\r\n", strerror(errno)); | 1202 | snprintf(buf, sizeof buf, |
| 1203 | "write stdout: %.50s\r\n", strerror(errno)); | ||
| 1300 | buffer_append(&stderr_buffer, buf, strlen(buf)); | 1204 | buffer_append(&stderr_buffer, buf, strlen(buf)); |
| 1301 | quit_pending = 1; | 1205 | quit_pending = 1; |
| 1302 | return; | 1206 | return; |
| @@ -1304,7 +1208,6 @@ client_process_output(fd_set *writeset) | |||
| 1304 | } | 1208 | } |
| 1305 | /* Consume printed data from the buffer. */ | 1209 | /* Consume printed data from the buffer. */ |
| 1306 | buffer_consume(&stdout_buffer, len); | 1210 | buffer_consume(&stdout_buffer, len); |
| 1307 | stdout_bytes += len; | ||
| 1308 | } | 1211 | } |
| 1309 | /* Write buffered output to stderr. */ | 1212 | /* Write buffered output to stderr. */ |
| 1310 | if (FD_ISSET(fileno(stderr), writeset)) { | 1213 | if (FD_ISSET(fileno(stderr), writeset)) { |
| @@ -1312,17 +1215,20 @@ client_process_output(fd_set *writeset) | |||
| 1312 | len = write(fileno(stderr), buffer_ptr(&stderr_buffer), | 1215 | len = write(fileno(stderr), buffer_ptr(&stderr_buffer), |
| 1313 | buffer_len(&stderr_buffer)); | 1216 | buffer_len(&stderr_buffer)); |
| 1314 | if (len <= 0) { | 1217 | if (len <= 0) { |
| 1315 | if (errno == EINTR || errno == EAGAIN) | 1218 | if (errno == EINTR || errno == EAGAIN || |
| 1219 | errno == EWOULDBLOCK) | ||
| 1316 | len = 0; | 1220 | len = 0; |
| 1317 | else { | 1221 | else { |
| 1318 | /* EOF or error, but can't even print error message. */ | 1222 | /* |
| 1223 | * EOF or error, but can't even print | ||
| 1224 | * error message. | ||
| 1225 | */ | ||
| 1319 | quit_pending = 1; | 1226 | quit_pending = 1; |
| 1320 | return; | 1227 | return; |
| 1321 | } | 1228 | } |
| 1322 | } | 1229 | } |
| 1323 | /* Consume printed characters from the buffer. */ | 1230 | /* Consume printed characters from the buffer. */ |
| 1324 | buffer_consume(&stderr_buffer, len); | 1231 | buffer_consume(&stderr_buffer, len); |
| 1325 | stderr_bytes += len; | ||
| 1326 | } | 1232 | } |
| 1327 | } | 1233 | } |
| 1328 | 1234 | ||
| @@ -1341,16 +1247,39 @@ client_process_output(fd_set *writeset) | |||
| 1341 | static void | 1247 | static void |
| 1342 | client_process_buffered_input_packets(void) | 1248 | client_process_buffered_input_packets(void) |
| 1343 | { | 1249 | { |
| 1344 | dispatch_run(DISPATCH_NONBLOCK, &quit_pending, compat20 ? xxx_kex : NULL); | 1250 | dispatch_run(DISPATCH_NONBLOCK, &quit_pending, |
| 1251 | compat20 ? xxx_kex : NULL); | ||
| 1345 | } | 1252 | } |
| 1346 | 1253 | ||
| 1347 | /* scan buf[] for '~' before sending data to the peer */ | 1254 | /* scan buf[] for '~' before sending data to the peer */ |
| 1348 | 1255 | ||
| 1349 | static int | 1256 | /* Helper: allocate a new escape_filter_ctx and fill in its escape char */ |
| 1350 | simple_escape_filter(Channel *c, char *buf, int len) | 1257 | void * |
| 1258 | client_new_escape_filter_ctx(int escape_char) | ||
| 1259 | { | ||
| 1260 | struct escape_filter_ctx *ret; | ||
| 1261 | |||
| 1262 | ret = xmalloc(sizeof(*ret)); | ||
| 1263 | ret->escape_pending = 0; | ||
| 1264 | ret->escape_char = escape_char; | ||
| 1265 | return (void *)ret; | ||
| 1266 | } | ||
| 1267 | |||
| 1268 | /* Free the escape filter context on channel free */ | ||
| 1269 | void | ||
| 1270 | client_filter_cleanup(int cid, void *ctx) | ||
| 1271 | { | ||
| 1272 | xfree(ctx); | ||
| 1273 | } | ||
| 1274 | |||
| 1275 | int | ||
| 1276 | client_simple_escape_filter(Channel *c, char *buf, int len) | ||
| 1351 | { | 1277 | { |
| 1352 | /* XXX we assume c->extended is writeable */ | 1278 | if (c->extended_usage != CHAN_EXTENDED_WRITE) |
| 1353 | return process_escapes(&c->input, &c->output, &c->extended, buf, len); | 1279 | return 0; |
| 1280 | |||
| 1281 | return process_escapes(c, &c->input, &c->output, &c->extended, | ||
| 1282 | buf, len); | ||
| 1354 | } | 1283 | } |
| 1355 | 1284 | ||
| 1356 | static void | 1285 | static void |
| @@ -1374,6 +1303,7 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id) | |||
| 1374 | fd_set *readset = NULL, *writeset = NULL; | 1303 | fd_set *readset = NULL, *writeset = NULL; |
| 1375 | double start_time, total_time; | 1304 | double start_time, total_time; |
| 1376 | int max_fd = 0, max_fd2 = 0, len, rekeying = 0; | 1305 | int max_fd = 0, max_fd2 = 0, len, rekeying = 0; |
| 1306 | u_int64_t ibytes, obytes; | ||
| 1377 | u_int nalloc = 0; | 1307 | u_int nalloc = 0; |
| 1378 | char buf[100]; | 1308 | char buf[100]; |
| 1379 | 1309 | ||
| @@ -1382,7 +1312,7 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id) | |||
| 1382 | start_time = get_current_time(); | 1312 | start_time = get_current_time(); |
| 1383 | 1313 | ||
| 1384 | /* Initialize variables. */ | 1314 | /* Initialize variables. */ |
| 1385 | escape_pending = 0; | 1315 | escape_pending1 = 0; |
| 1386 | last_was_cr = 1; | 1316 | last_was_cr = 1; |
| 1387 | exit_status = -1; | 1317 | exit_status = -1; |
| 1388 | stdin_eof = 0; | 1318 | stdin_eof = 0; |
| @@ -1390,8 +1320,8 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id) | |||
| 1390 | connection_in = packet_get_connection_in(); | 1320 | connection_in = packet_get_connection_in(); |
| 1391 | connection_out = packet_get_connection_out(); | 1321 | connection_out = packet_get_connection_out(); |
| 1392 | max_fd = MAX(connection_in, connection_out); | 1322 | max_fd = MAX(connection_in, connection_out); |
| 1393 | if (control_fd != -1) | 1323 | if (muxserver_sock != -1) |
| 1394 | max_fd = MAX(max_fd, control_fd); | 1324 | max_fd = MAX(max_fd, muxserver_sock); |
| 1395 | 1325 | ||
| 1396 | if (!compat20) { | 1326 | if (!compat20) { |
| 1397 | /* enable nonblocking unless tty */ | 1327 | /* enable nonblocking unless tty */ |
| @@ -1405,11 +1335,8 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id) | |||
| 1405 | max_fd = MAX(max_fd, fileno(stdout)); | 1335 | max_fd = MAX(max_fd, fileno(stdout)); |
| 1406 | max_fd = MAX(max_fd, fileno(stderr)); | 1336 | max_fd = MAX(max_fd, fileno(stderr)); |
| 1407 | } | 1337 | } |
| 1408 | stdin_bytes = 0; | ||
| 1409 | stdout_bytes = 0; | ||
| 1410 | stderr_bytes = 0; | ||
| 1411 | quit_pending = 0; | 1338 | quit_pending = 0; |
| 1412 | escape_char = escape_char_arg; | 1339 | escape_char1 = escape_char_arg; |
| 1413 | 1340 | ||
| 1414 | /* Initialize buffers. */ | 1341 | /* Initialize buffers. */ |
| 1415 | buffer_init(&stdin_buffer); | 1342 | buffer_init(&stdin_buffer); |
| @@ -1437,9 +1364,11 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id) | |||
| 1437 | 1364 | ||
| 1438 | if (compat20) { | 1365 | if (compat20) { |
| 1439 | session_ident = ssh2_chan_id; | 1366 | session_ident = ssh2_chan_id; |
| 1440 | if (escape_char != SSH_ESCAPECHAR_NONE) | 1367 | if (escape_char_arg != SSH_ESCAPECHAR_NONE) |
| 1441 | channel_register_filter(session_ident, | 1368 | channel_register_filter(session_ident, |
| 1442 | simple_escape_filter, NULL); | 1369 | client_simple_escape_filter, NULL, |
| 1370 | client_filter_cleanup, | ||
| 1371 | client_new_escape_filter_ctx(escape_char_arg)); | ||
| 1443 | if (session_ident != -1) | 1372 | if (session_ident != -1) |
| 1444 | channel_register_cleanup(session_ident, | 1373 | channel_register_cleanup(session_ident, |
| 1445 | client_channel_closed, 0); | 1374 | client_channel_closed, 0); |
| @@ -1511,7 +1440,10 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id) | |||
| 1511 | client_process_net_input(readset); | 1440 | client_process_net_input(readset); |
| 1512 | 1441 | ||
| 1513 | /* Accept control connections. */ | 1442 | /* Accept control connections. */ |
| 1514 | client_process_control(readset); | 1443 | if (muxserver_sock != -1 &&FD_ISSET(muxserver_sock, readset)) { |
| 1444 | if (muxserver_accept_control()) | ||
| 1445 | quit_pending = 1; | ||
| 1446 | } | ||
| 1515 | 1447 | ||
| 1516 | if (quit_pending) | 1448 | if (quit_pending) |
| 1517 | break; | 1449 | break; |
| @@ -1526,7 +1458,10 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id) | |||
| 1526 | client_process_output(writeset); | 1458 | client_process_output(writeset); |
| 1527 | } | 1459 | } |
| 1528 | 1460 | ||
| 1529 | /* Send as much buffered packet data as possible to the sender. */ | 1461 | /* |
| 1462 | * Send as much buffered packet data as possible to the | ||
| 1463 | * sender. | ||
| 1464 | */ | ||
| 1530 | if (FD_ISSET(connection_out, writeset)) | 1465 | if (FD_ISSET(connection_out, writeset)) |
| 1531 | packet_write_poll(); | 1466 | packet_write_poll(); |
| 1532 | } | 1467 | } |
| @@ -1573,7 +1508,8 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id) | |||
| 1573 | * that the connection has been closed. | 1508 | * that the connection has been closed. |
| 1574 | */ | 1509 | */ |
| 1575 | if (have_pty && options.log_level > SYSLOG_LEVEL_QUIET) { | 1510 | if (have_pty && options.log_level > SYSLOG_LEVEL_QUIET) { |
| 1576 | snprintf(buf, sizeof buf, "Connection to %.64s closed.\r\n", host); | 1511 | snprintf(buf, sizeof buf, |
| 1512 | "Connection to %.64s closed.\r\n", host); | ||
| 1577 | buffer_append(&stderr_buffer, buf, strlen(buf)); | 1513 | buffer_append(&stderr_buffer, buf, strlen(buf)); |
| 1578 | } | 1514 | } |
| 1579 | 1515 | ||
| @@ -1586,7 +1522,6 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id) | |||
| 1586 | break; | 1522 | break; |
| 1587 | } | 1523 | } |
| 1588 | buffer_consume(&stdout_buffer, len); | 1524 | buffer_consume(&stdout_buffer, len); |
| 1589 | stdout_bytes += len; | ||
| 1590 | } | 1525 | } |
| 1591 | 1526 | ||
| 1592 | /* Output any buffered data for stderr. */ | 1527 | /* Output any buffered data for stderr. */ |
| @@ -1598,7 +1533,6 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id) | |||
| 1598 | break; | 1533 | break; |
| 1599 | } | 1534 | } |
| 1600 | buffer_consume(&stderr_buffer, len); | 1535 | buffer_consume(&stderr_buffer, len); |
| 1601 | stderr_bytes += len; | ||
| 1602 | } | 1536 | } |
| 1603 | 1537 | ||
| 1604 | /* Clear and free any buffers. */ | 1538 | /* Clear and free any buffers. */ |
| @@ -1609,13 +1543,13 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id) | |||
| 1609 | 1543 | ||
| 1610 | /* Report bytes transferred, and transfer rates. */ | 1544 | /* Report bytes transferred, and transfer rates. */ |
| 1611 | total_time = get_current_time() - start_time; | 1545 | total_time = get_current_time() - start_time; |
| 1612 | debug("Transferred: stdin %lu, stdout %lu, stderr %lu bytes in %.1f seconds", | 1546 | packet_get_state(MODE_IN, NULL, NULL, NULL, &ibytes); |
| 1613 | stdin_bytes, stdout_bytes, stderr_bytes, total_time); | 1547 | packet_get_state(MODE_OUT, NULL, NULL, NULL, &obytes); |
| 1548 | verbose("Transferred: sent %llu, received %llu bytes, in %.1f seconds", | ||
| 1549 | obytes, ibytes, total_time); | ||
| 1614 | if (total_time > 0) | 1550 | if (total_time > 0) |
| 1615 | debug("Bytes per second: stdin %.1f, stdout %.1f, stderr %.1f", | 1551 | verbose("Bytes per second: sent %.1f, received %.1f", |
| 1616 | stdin_bytes / total_time, stdout_bytes / total_time, | 1552 | obytes / total_time, ibytes / total_time); |
| 1617 | stderr_bytes / total_time); | ||
| 1618 | |||
| 1619 | /* Return the exit status of the program. */ | 1553 | /* Return the exit status of the program. */ |
| 1620 | debug("Exit status %d", exit_status); | 1554 | debug("Exit status %d", exit_status); |
| 1621 | return exit_status; | 1555 | return exit_status; |
| @@ -1706,7 +1640,6 @@ client_request_forwarded_tcpip(const char *request_type, int rchan) | |||
| 1706 | Channel *c = NULL; | 1640 | Channel *c = NULL; |
| 1707 | char *listen_address, *originator_address; | 1641 | char *listen_address, *originator_address; |
| 1708 | int listen_port, originator_port; | 1642 | int listen_port, originator_port; |
| 1709 | int sock; | ||
| 1710 | 1643 | ||
| 1711 | /* Get rest of the packet */ | 1644 | /* Get rest of the packet */ |
| 1712 | listen_address = packet_get_string(NULL); | 1645 | listen_address = packet_get_string(NULL); |
| @@ -1715,19 +1648,13 @@ client_request_forwarded_tcpip(const char *request_type, int rchan) | |||
| 1715 | originator_port = packet_get_int(); | 1648 | originator_port = packet_get_int(); |
| 1716 | packet_check_eom(); | 1649 | packet_check_eom(); |
| 1717 | 1650 | ||
| 1718 | debug("client_request_forwarded_tcpip: listen %s port %d, originator %s port %d", | 1651 | debug("client_request_forwarded_tcpip: listen %s port %d, " |
| 1719 | listen_address, listen_port, originator_address, originator_port); | 1652 | "originator %s port %d", listen_address, listen_port, |
| 1653 | originator_address, originator_port); | ||
| 1654 | |||
| 1655 | c = channel_connect_by_listen_address(listen_port, | ||
| 1656 | "forwarded-tcpip", originator_address); | ||
| 1720 | 1657 | ||
| 1721 | sock = channel_connect_by_listen_address(listen_port); | ||
| 1722 | if (sock < 0) { | ||
| 1723 | xfree(originator_address); | ||
| 1724 | xfree(listen_address); | ||
| 1725 | return NULL; | ||
| 1726 | } | ||
| 1727 | c = channel_new("forwarded-tcpip", | ||
| 1728 | SSH_CHANNEL_CONNECTING, sock, sock, -1, | ||
| 1729 | CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0, | ||
| 1730 | originator_address, 1); | ||
| 1731 | xfree(originator_address); | 1658 | xfree(originator_address); |
| 1732 | xfree(listen_address); | 1659 | xfree(listen_address); |
| 1733 | return c; | 1660 | return c; |
| @@ -1743,7 +1670,8 @@ client_request_x11(const char *request_type, int rchan) | |||
| 1743 | 1670 | ||
| 1744 | if (!options.forward_x11) { | 1671 | if (!options.forward_x11) { |
| 1745 | error("Warning: ssh server tried X11 forwarding."); | 1672 | error("Warning: ssh server tried X11 forwarding."); |
| 1746 | error("Warning: this is probably a break-in attempt by a malicious server."); | 1673 | error("Warning: this is probably a break-in attempt by a " |
| 1674 | "malicious server."); | ||
| 1747 | return NULL; | 1675 | return NULL; |
| 1748 | } | 1676 | } |
| 1749 | originator = packet_get_string(NULL); | 1677 | originator = packet_get_string(NULL); |
| @@ -1776,7 +1704,8 @@ client_request_agent(const char *request_type, int rchan) | |||
| 1776 | 1704 | ||
| 1777 | if (!options.forward_agent) { | 1705 | if (!options.forward_agent) { |
| 1778 | error("Warning: ssh server tried agent forwarding."); | 1706 | error("Warning: ssh server tried agent forwarding."); |
| 1779 | error("Warning: this is probably a break-in attempt by a malicious server."); | 1707 | error("Warning: this is probably a break-in attempt by a " |
| 1708 | "malicious server."); | ||
| 1780 | return NULL; | 1709 | return NULL; |
| 1781 | } | 1710 | } |
| 1782 | sock = ssh_get_authentication_socket(); | 1711 | sock = ssh_get_authentication_socket(); |
| @@ -1819,7 +1748,7 @@ client_request_tun_fwd(int tun_mode, int local_tun, int remote_tun) | |||
| 1819 | #if defined(SSH_TUN_FILTER) | 1748 | #if defined(SSH_TUN_FILTER) |
| 1820 | if (options.tun_open == SSH_TUNMODE_POINTOPOINT) | 1749 | if (options.tun_open == SSH_TUNMODE_POINTOPOINT) |
| 1821 | channel_register_filter(c->self, sys_tun_infilter, | 1750 | channel_register_filter(c->self, sys_tun_infilter, |
| 1822 | sys_tun_outfilter); | 1751 | sys_tun_outfilter, NULL, NULL); |
| 1823 | #endif | 1752 | #endif |
| 1824 | 1753 | ||
| 1825 | packet_start(SSH2_MSG_CHANNEL_OPEN); | 1754 | packet_start(SSH2_MSG_CHANNEL_OPEN); |
| @@ -1902,7 +1831,11 @@ client_input_channel_req(int type, u_int32_t seq, void *ctxt) | |||
| 1902 | if (id == -1) { | 1831 | if (id == -1) { |
| 1903 | error("client_input_channel_req: request for channel -1"); | 1832 | error("client_input_channel_req: request for channel -1"); |
| 1904 | } else if ((c = channel_lookup(id)) == NULL) { | 1833 | } else if ((c = channel_lookup(id)) == NULL) { |
| 1905 | error("client_input_channel_req: channel %d: unknown channel", id); | 1834 | error("client_input_channel_req: channel %d: " |
| 1835 | "unknown channel", id); | ||
| 1836 | } else if (strcmp(rtype, "eow@openssh.com") == 0) { | ||
| 1837 | packet_check_eom(); | ||
| 1838 | chan_rcvd_eow(c); | ||
| 1906 | } else if (strcmp(rtype, "exit-status") == 0) { | 1839 | } else if (strcmp(rtype, "exit-status") == 0) { |
| 1907 | exitval = packet_get_int(); | 1840 | exitval = packet_get_int(); |
| 1908 | if (id == session_ident) { | 1841 | if (id == session_ident) { |
| @@ -1947,8 +1880,7 @@ client_input_global_request(int type, u_int32_t seq, void *ctxt) | |||
| 1947 | 1880 | ||
| 1948 | void | 1881 | void |
| 1949 | client_session2_setup(int id, int want_tty, int want_subsystem, | 1882 | client_session2_setup(int id, int want_tty, int want_subsystem, |
| 1950 | const char *term, struct termios *tiop, int in_fd, Buffer *cmd, char **env, | 1883 | const char *term, struct termios *tiop, int in_fd, Buffer *cmd, char **env) |
| 1951 | dispatch_fn *subsys_repl) | ||
| 1952 | { | 1884 | { |
| 1953 | int len; | 1885 | int len; |
| 1954 | Channel *c = NULL; | 1886 | Channel *c = NULL; |
| @@ -1960,20 +1892,21 @@ client_session2_setup(int id, int want_tty, int want_subsystem, | |||
| 1960 | 1892 | ||
| 1961 | if (want_tty) { | 1893 | if (want_tty) { |
| 1962 | struct winsize ws; | 1894 | struct winsize ws; |
| 1963 | struct termios tio; | ||
| 1964 | 1895 | ||
| 1965 | /* Store window size in the packet. */ | 1896 | /* Store window size in the packet. */ |
| 1966 | if (ioctl(in_fd, TIOCGWINSZ, &ws) < 0) | 1897 | if (ioctl(in_fd, TIOCGWINSZ, &ws) < 0) |
| 1967 | memset(&ws, 0, sizeof(ws)); | 1898 | memset(&ws, 0, sizeof(ws)); |
| 1968 | 1899 | ||
| 1969 | channel_request_start(id, "pty-req", 0); | 1900 | channel_request_start(id, "pty-req", 1); |
| 1901 | client_expect_confirm(id, "PTY allocation", 0); | ||
| 1970 | packet_put_cstring(term != NULL ? term : ""); | 1902 | packet_put_cstring(term != NULL ? term : ""); |
| 1971 | packet_put_int((u_int)ws.ws_col); | 1903 | packet_put_int((u_int)ws.ws_col); |
| 1972 | packet_put_int((u_int)ws.ws_row); | 1904 | packet_put_int((u_int)ws.ws_row); |
| 1973 | packet_put_int((u_int)ws.ws_xpixel); | 1905 | packet_put_int((u_int)ws.ws_xpixel); |
| 1974 | packet_put_int((u_int)ws.ws_ypixel); | 1906 | packet_put_int((u_int)ws.ws_ypixel); |
| 1975 | tio = get_saved_tio(); | 1907 | if (tiop == NULL) |
| 1976 | tty_make_modes(-1, tiop != NULL ? tiop : &tio); | 1908 | tiop = get_saved_tio(); |
| 1909 | tty_make_modes(-1, tiop); | ||
| 1977 | packet_send(); | 1910 | packet_send(); |
| 1978 | /* XXX wait for reply */ | 1911 | /* XXX wait for reply */ |
| 1979 | c->client_tty = 1; | 1912 | c->client_tty = 1; |
| @@ -2021,22 +1954,21 @@ client_session2_setup(int id, int want_tty, int want_subsystem, | |||
| 2021 | if (len > 900) | 1954 | if (len > 900) |
| 2022 | len = 900; | 1955 | len = 900; |
| 2023 | if (want_subsystem) { | 1956 | if (want_subsystem) { |
| 2024 | debug("Sending subsystem: %.*s", len, (u_char*)buffer_ptr(cmd)); | 1957 | debug("Sending subsystem: %.*s", |
| 2025 | channel_request_start(id, "subsystem", subsys_repl != NULL); | 1958 | len, (u_char*)buffer_ptr(cmd)); |
| 2026 | if (subsys_repl != NULL) { | 1959 | channel_request_start(id, "subsystem", 1); |
| 2027 | /* register callback for reply */ | 1960 | client_expect_confirm(id, "subsystem", 1); |
| 2028 | /* XXX we assume that client_loop has already been called */ | ||
| 2029 | dispatch_set(SSH2_MSG_CHANNEL_FAILURE, subsys_repl); | ||
| 2030 | dispatch_set(SSH2_MSG_CHANNEL_SUCCESS, subsys_repl); | ||
| 2031 | } | ||
| 2032 | } else { | 1961 | } else { |
| 2033 | debug("Sending command: %.*s", len, (u_char*)buffer_ptr(cmd)); | 1962 | debug("Sending command: %.*s", |
| 2034 | channel_request_start(id, "exec", 0); | 1963 | len, (u_char*)buffer_ptr(cmd)); |
| 1964 | channel_request_start(id, "exec", 1); | ||
| 1965 | client_expect_confirm(id, "exec", 1); | ||
| 2035 | } | 1966 | } |
| 2036 | packet_put_string(buffer_ptr(cmd), buffer_len(cmd)); | 1967 | packet_put_string(buffer_ptr(cmd), buffer_len(cmd)); |
| 2037 | packet_send(); | 1968 | packet_send(); |
| 2038 | } else { | 1969 | } else { |
| 2039 | channel_request_start(id, "shell", 0); | 1970 | channel_request_start(id, "shell", 1); |
| 1971 | client_expect_confirm(id, "shell", 1); | ||
| 2040 | packet_send(); | 1972 | packet_send(); |
| 2041 | } | 1973 | } |
| 2042 | } | 1974 | } |
| @@ -2055,6 +1987,8 @@ client_init_dispatch_20(void) | |||
| 2055 | dispatch_set(SSH2_MSG_CHANNEL_OPEN_FAILURE, &channel_input_open_failure); | 1987 | dispatch_set(SSH2_MSG_CHANNEL_OPEN_FAILURE, &channel_input_open_failure); |
| 2056 | dispatch_set(SSH2_MSG_CHANNEL_REQUEST, &client_input_channel_req); | 1988 | dispatch_set(SSH2_MSG_CHANNEL_REQUEST, &client_input_channel_req); |
| 2057 | dispatch_set(SSH2_MSG_CHANNEL_WINDOW_ADJUST, &channel_input_window_adjust); | 1989 | dispatch_set(SSH2_MSG_CHANNEL_WINDOW_ADJUST, &channel_input_window_adjust); |
| 1990 | dispatch_set(SSH2_MSG_CHANNEL_SUCCESS, &channel_input_status_confirm); | ||
| 1991 | dispatch_set(SSH2_MSG_CHANNEL_FAILURE, &channel_input_status_confirm); | ||
| 2058 | dispatch_set(SSH2_MSG_GLOBAL_REQUEST, &client_input_global_request); | 1992 | dispatch_set(SSH2_MSG_GLOBAL_REQUEST, &client_input_global_request); |
| 2059 | 1993 | ||
| 2060 | /* rekeying */ | 1994 | /* rekeying */ |
| @@ -2064,6 +1998,7 @@ client_init_dispatch_20(void) | |||
| 2064 | dispatch_set(SSH2_MSG_REQUEST_FAILURE, &client_global_request_reply); | 1998 | dispatch_set(SSH2_MSG_REQUEST_FAILURE, &client_global_request_reply); |
| 2065 | dispatch_set(SSH2_MSG_REQUEST_SUCCESS, &client_global_request_reply); | 1999 | dispatch_set(SSH2_MSG_REQUEST_SUCCESS, &client_global_request_reply); |
| 2066 | } | 2000 | } |
| 2001 | |||
| 2067 | static void | 2002 | static void |
| 2068 | client_init_dispatch_13(void) | 2003 | client_init_dispatch_13(void) |
| 2069 | { | 2004 | { |
| @@ -2083,6 +2018,7 @@ client_init_dispatch_13(void) | |||
| 2083 | dispatch_set(SSH_SMSG_X11_OPEN, options.forward_x11 ? | 2018 | dispatch_set(SSH_SMSG_X11_OPEN, options.forward_x11 ? |
| 2084 | &x11_input_open : &deny_input_open); | 2019 | &x11_input_open : &deny_input_open); |
| 2085 | } | 2020 | } |
| 2021 | |||
| 2086 | static void | 2022 | static void |
| 2087 | client_init_dispatch_15(void) | 2023 | client_init_dispatch_15(void) |
| 2088 | { | 2024 | { |
| @@ -2090,6 +2026,7 @@ client_init_dispatch_15(void) | |||
| 2090 | dispatch_set(SSH_MSG_CHANNEL_CLOSE, &channel_input_ieof); | 2026 | dispatch_set(SSH_MSG_CHANNEL_CLOSE, &channel_input_ieof); |
| 2091 | dispatch_set(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION, & channel_input_oclose); | 2027 | dispatch_set(SSH_MSG_CHANNEL_CLOSE_CONFIRMATION, & channel_input_oclose); |
| 2092 | } | 2028 | } |
| 2029 | |||
| 2093 | static void | 2030 | static void |
| 2094 | client_init_dispatch(void) | 2031 | client_init_dispatch(void) |
| 2095 | { | 2032 | { |
| @@ -2107,7 +2044,7 @@ cleanup_exit(int i) | |||
| 2107 | { | 2044 | { |
| 2108 | leave_raw_mode(); | 2045 | leave_raw_mode(); |
| 2109 | leave_non_blocking(); | 2046 | leave_non_blocking(); |
| 2110 | if (options.control_path != NULL && control_fd != -1) | 2047 | if (options.control_path != NULL && muxserver_sock != -1) |
| 2111 | unlink(options.control_path); | 2048 | unlink(options.control_path); |
| 2112 | _exit(i); | 2049 | _exit(i); |
| 2113 | } | 2050 | } |
diff --git a/clientloop.h b/clientloop.h index c7d2233d0..8bb874b38 100644 --- a/clientloop.h +++ b/clientloop.h | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: clientloop.h,v 1.17 2007/08/07 07:32:53 djm Exp $ */ | 1 | /* $OpenBSD: clientloop.h,v 1.22 2008/06/12 15:19:17 djm Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| @@ -43,11 +43,20 @@ void client_x11_get_proto(const char *, const char *, u_int, | |||
| 43 | char **, char **); | 43 | char **, char **); |
| 44 | void client_global_request_reply_fwd(int, u_int32_t, void *); | 44 | void client_global_request_reply_fwd(int, u_int32_t, void *); |
| 45 | void client_session2_setup(int, int, int, const char *, struct termios *, | 45 | void client_session2_setup(int, int, int, const char *, struct termios *, |
| 46 | int, Buffer *, char **, dispatch_fn *); | 46 | int, Buffer *, char **); |
| 47 | int client_request_tun_fwd(int, int, int); | 47 | int client_request_tun_fwd(int, int, int); |
| 48 | 48 | ||
| 49 | /* Escape filter for protocol 2 sessions */ | ||
| 50 | void *client_new_escape_filter_ctx(int); | ||
| 51 | void client_filter_cleanup(int, void *); | ||
| 52 | int client_simple_escape_filter(Channel *, char *, int); | ||
| 53 | |||
| 54 | /* Global request confirmation callbacks */ | ||
| 55 | typedef void global_confirm_cb(int, u_int32_t seq, void *); | ||
| 56 | void client_register_global_confirm(global_confirm_cb *, void *); | ||
| 57 | |||
| 49 | /* Multiplexing protocol version */ | 58 | /* Multiplexing protocol version */ |
| 50 | #define SSHMUX_VER 1 | 59 | #define SSHMUX_VER 2 |
| 51 | 60 | ||
| 52 | /* Multiplexing control protocol flags */ | 61 | /* Multiplexing control protocol flags */ |
| 53 | #define SSHMUX_COMMAND_OPEN 1 /* Open new connection */ | 62 | #define SSHMUX_COMMAND_OPEN 1 /* Open new connection */ |
| @@ -58,3 +67,7 @@ int client_request_tun_fwd(int, int, int); | |||
| 58 | #define SSHMUX_FLAG_SUBSYS (1<<1) /* Subsystem request on open */ | 67 | #define SSHMUX_FLAG_SUBSYS (1<<1) /* Subsystem request on open */ |
| 59 | #define SSHMUX_FLAG_X11_FWD (1<<2) /* Request X11 forwarding */ | 68 | #define SSHMUX_FLAG_X11_FWD (1<<2) /* Request X11 forwarding */ |
| 60 | #define SSHMUX_FLAG_AGENT_FWD (1<<3) /* Request agent forwarding */ | 69 | #define SSHMUX_FLAG_AGENT_FWD (1<<3) /* Request agent forwarding */ |
| 70 | |||
| 71 | void muxserver_listen(void); | ||
| 72 | int muxserver_accept_control(void); | ||
| 73 | void muxclient(const char *); | ||
diff --git a/config.h.in b/config.h.in index d2641866c..855829e93 100644 --- a/config.h.in +++ b/config.h.in | |||
| @@ -7,6 +7,9 @@ | |||
| 7 | /* Define if your AIX loginfailed() function takes 4 arguments (AIX >= 5.2) */ | 7 | /* Define if your AIX loginfailed() function takes 4 arguments (AIX >= 5.2) */ |
| 8 | #undef AIX_LOGINFAILED_4ARG | 8 | #undef AIX_LOGINFAILED_4ARG |
| 9 | 9 | ||
| 10 | /* System only supports IPv4 audit records */ | ||
| 11 | #undef AU_IPv4 | ||
| 12 | |||
| 10 | /* Define if your resolver libs need this for getrrsetbyname */ | 13 | /* Define if your resolver libs need this for getrrsetbyname */ |
| 11 | #undef BIND_8_COMPAT | 14 | #undef BIND_8_COMPAT |
| 12 | 15 | ||
| @@ -19,6 +22,9 @@ | |||
| 19 | /* getgroups(0,NULL) will return -1 */ | 22 | /* getgroups(0,NULL) will return -1 */ |
| 20 | #undef BROKEN_GETGROUPS | 23 | #undef BROKEN_GETGROUPS |
| 21 | 24 | ||
| 25 | /* FreeBSD glob does not do what we need */ | ||
| 26 | #undef BROKEN_GLOB | ||
| 27 | |||
| 22 | /* Define if you system's inet_ntoa is busted (e.g. Irix gcc issue) */ | 28 | /* Define if you system's inet_ntoa is busted (e.g. Irix gcc issue) */ |
| 23 | #undef BROKEN_INET_NTOA | 29 | #undef BROKEN_INET_NTOA |
| 24 | 30 | ||
| @@ -32,6 +38,9 @@ | |||
| 32 | */ | 38 | */ |
| 33 | #undef BROKEN_ONE_BYTE_DIRENT_D_NAME | 39 | #undef BROKEN_ONE_BYTE_DIRENT_D_NAME |
| 34 | 40 | ||
| 41 | /* Can't do comparisons on readv */ | ||
| 42 | #undef BROKEN_READV_COMPARISON | ||
| 43 | |||
| 35 | /* Define if you have a broken realpath. */ | 44 | /* Define if you have a broken realpath. */ |
| 36 | #undef BROKEN_REALPATH | 45 | #undef BROKEN_REALPATH |
| 37 | 46 | ||
| @@ -53,6 +62,9 @@ | |||
| 53 | /* LynxOS has broken setvbuf() implementation */ | 62 | /* LynxOS has broken setvbuf() implementation */ |
| 54 | #undef BROKEN_SETVBUF | 63 | #undef BROKEN_SETVBUF |
| 55 | 64 | ||
| 65 | /* QNX shadow support is broken */ | ||
| 66 | #undef BROKEN_SHADOW_EXPIRE | ||
| 67 | |||
| 56 | /* Define if your snprintf is busted */ | 68 | /* Define if your snprintf is busted */ |
| 57 | #undef BROKEN_SNPRINTF | 69 | #undef BROKEN_SNPRINTF |
| 58 | 70 | ||
| @@ -107,12 +119,12 @@ | |||
| 107 | /* Define if you don't want to use wtmpx */ | 119 | /* Define if you don't want to use wtmpx */ |
| 108 | #undef DISABLE_WTMPX | 120 | #undef DISABLE_WTMPX |
| 109 | 121 | ||
| 110 | /* Workaround more Linux IPv6 quirks */ | ||
| 111 | #undef DONT_TRY_OTHER_AF | ||
| 112 | |||
| 113 | /* Builtin PRNG command timeout */ | 122 | /* Builtin PRNG command timeout */ |
| 114 | #undef ENTROPY_TIMEOUT_MSEC | 123 | #undef ENTROPY_TIMEOUT_MSEC |
| 115 | 124 | ||
| 125 | /* f_fsid has members */ | ||
| 126 | #undef FSID_HAS_VAL | ||
| 127 | |||
| 116 | /* Define to 1 if the `getpgrp' function requires zero arguments. */ | 128 | /* Define to 1 if the `getpgrp' function requires zero arguments. */ |
| 117 | #undef GETPGRP_VOID | 129 | #undef GETPGRP_VOID |
| 118 | 130 | ||
| @@ -149,6 +161,12 @@ | |||
| 149 | /* Define to 1 if you have the `arc4random' function. */ | 161 | /* Define to 1 if you have the `arc4random' function. */ |
| 150 | #undef HAVE_ARC4RANDOM | 162 | #undef HAVE_ARC4RANDOM |
| 151 | 163 | ||
| 164 | /* Define to 1 if you have the `arc4random_buf' function. */ | ||
| 165 | #undef HAVE_ARC4RANDOM_BUF | ||
| 166 | |||
| 167 | /* Define to 1 if you have the `arc4random_uniform' function. */ | ||
| 168 | #undef HAVE_ARC4RANDOM_UNIFORM | ||
| 169 | |||
| 152 | /* Define to 1 if you have the `asprintf' function. */ | 170 | /* Define to 1 if you have the `asprintf' function. */ |
| 153 | #undef HAVE_ASPRINTF | 171 | #undef HAVE_ASPRINTF |
| 154 | 172 | ||
| @@ -161,6 +179,9 @@ | |||
| 161 | /* OpenBSD's gcc has sentinel */ | 179 | /* OpenBSD's gcc has sentinel */ |
| 162 | #undef HAVE_ATTRIBUTE__SENTINEL__ | 180 | #undef HAVE_ATTRIBUTE__SENTINEL__ |
| 163 | 181 | ||
| 182 | /* Define to 1 if you have the `aug_get_machine' function. */ | ||
| 183 | #undef HAVE_AUG_GET_MACHINE | ||
| 184 | |||
| 164 | /* Define to 1 if you have the `b64_ntop' function. */ | 185 | /* Define to 1 if you have the `b64_ntop' function. */ |
| 165 | #undef HAVE_B64_NTOP | 186 | #undef HAVE_B64_NTOP |
| 166 | 187 | ||
| @@ -320,9 +341,21 @@ | |||
| 320 | /* Define to 1 if you have the <floatingpoint.h> header file. */ | 341 | /* Define to 1 if you have the <floatingpoint.h> header file. */ |
| 321 | #undef HAVE_FLOATINGPOINT_H | 342 | #undef HAVE_FLOATINGPOINT_H |
| 322 | 343 | ||
| 344 | /* Define to 1 if you have the `fmt_scaled' function. */ | ||
| 345 | #undef HAVE_FMT_SCALED | ||
| 346 | |||
| 323 | /* Define to 1 if you have the `freeaddrinfo' function. */ | 347 | /* Define to 1 if you have the `freeaddrinfo' function. */ |
| 324 | #undef HAVE_FREEADDRINFO | 348 | #undef HAVE_FREEADDRINFO |
| 325 | 349 | ||
| 350 | /* Define to 1 if the system has the type `fsblkcnt_t'. */ | ||
| 351 | #undef HAVE_FSBLKCNT_T | ||
| 352 | |||
| 353 | /* Define to 1 if the system has the type `fsfilcnt_t'. */ | ||
| 354 | #undef HAVE_FSFILCNT_T | ||
| 355 | |||
| 356 | /* Define to 1 if you have the `fstatvfs' function. */ | ||
| 357 | #undef HAVE_FSTATVFS | ||
| 358 | |||
| 326 | /* Define to 1 if you have the `futimes' function. */ | 359 | /* Define to 1 if you have the `futimes' function. */ |
| 327 | #undef HAVE_FUTIMES | 360 | #undef HAVE_FUTIMES |
| 328 | 361 | ||
| @@ -344,6 +377,9 @@ | |||
| 344 | /* Define to 1 if you have the `getgrouplist' function. */ | 377 | /* Define to 1 if you have the `getgrouplist' function. */ |
| 345 | #undef HAVE_GETGROUPLIST | 378 | #undef HAVE_GETGROUPLIST |
| 346 | 379 | ||
| 380 | /* Define to 1 if you have the `getgrset' function. */ | ||
| 381 | #undef HAVE_GETGRSET | ||
| 382 | |||
| 347 | /* Define to 1 if you have the `getluid' function. */ | 383 | /* Define to 1 if you have the `getluid' function. */ |
| 348 | #undef HAVE_GETLUID | 384 | #undef HAVE_GETLUID |
| 349 | 385 | ||
| @@ -494,6 +530,9 @@ | |||
| 494 | /* Define to 1 if you have the <libgen.h> header file. */ | 530 | /* Define to 1 if you have the <libgen.h> header file. */ |
| 495 | #undef HAVE_LIBGEN_H | 531 | #undef HAVE_LIBGEN_H |
| 496 | 532 | ||
| 533 | /* Define if system has libiaf that supports set_id */ | ||
| 534 | #undef HAVE_LIBIAF | ||
| 535 | |||
| 497 | /* Define to 1 if you have the `nsl' library (-lnsl). */ | 536 | /* Define to 1 if you have the `nsl' library (-lnsl). */ |
| 498 | #undef HAVE_LIBNSL | 537 | #undef HAVE_LIBNSL |
| 499 | 538 | ||
| @@ -792,6 +831,12 @@ | |||
| 792 | /* Fields in struct sockaddr_storage */ | 831 | /* Fields in struct sockaddr_storage */ |
| 793 | #undef HAVE_SS_FAMILY_IN_SS | 832 | #undef HAVE_SS_FAMILY_IN_SS |
| 794 | 833 | ||
| 834 | /* Define to 1 if you have the `statfs' function. */ | ||
| 835 | #undef HAVE_STATFS | ||
| 836 | |||
| 837 | /* Define to 1 if you have the `statvfs' function. */ | ||
| 838 | #undef HAVE_STATVFS | ||
| 839 | |||
| 795 | /* Define to 1 if you have the <stddef.h> header file. */ | 840 | /* Define to 1 if you have the <stddef.h> header file. */ |
| 796 | #undef HAVE_STDDEF_H | 841 | #undef HAVE_STDDEF_H |
| 797 | 842 | ||
| @@ -894,12 +939,18 @@ | |||
| 894 | /* Define to 1 if you have the <sys/mman.h> header file. */ | 939 | /* Define to 1 if you have the <sys/mman.h> header file. */ |
| 895 | #undef HAVE_SYS_MMAN_H | 940 | #undef HAVE_SYS_MMAN_H |
| 896 | 941 | ||
| 942 | /* Define to 1 if you have the <sys/mount.h> header file. */ | ||
| 943 | #undef HAVE_SYS_MOUNT_H | ||
| 944 | |||
| 897 | /* Define to 1 if you have the <sys/ndir.h> header file. */ | 945 | /* Define to 1 if you have the <sys/ndir.h> header file. */ |
| 898 | #undef HAVE_SYS_NDIR_H | 946 | #undef HAVE_SYS_NDIR_H |
| 899 | 947 | ||
| 900 | /* Define if your system defines sys_nerr */ | 948 | /* Define if your system defines sys_nerr */ |
| 901 | #undef HAVE_SYS_NERR | 949 | #undef HAVE_SYS_NERR |
| 902 | 950 | ||
| 951 | /* Define to 1 if you have the <sys/poll.h> header file. */ | ||
| 952 | #undef HAVE_SYS_POLL_H | ||
| 953 | |||
| 903 | /* Define to 1 if you have the <sys/prctl.h> header file. */ | 954 | /* Define to 1 if you have the <sys/prctl.h> header file. */ |
| 904 | #undef HAVE_SYS_PRCTL_H | 955 | #undef HAVE_SYS_PRCTL_H |
| 905 | 956 | ||
| @@ -912,6 +963,9 @@ | |||
| 912 | /* Define to 1 if you have the <sys/select.h> header file. */ | 963 | /* Define to 1 if you have the <sys/select.h> header file. */ |
| 913 | #undef HAVE_SYS_SELECT_H | 964 | #undef HAVE_SYS_SELECT_H |
| 914 | 965 | ||
| 966 | /* Define to 1 if you have the <sys/statvfs.h> header file. */ | ||
| 967 | #undef HAVE_SYS_STATVFS_H | ||
| 968 | |||
| 915 | /* Define to 1 if you have the <sys/stat.h> header file. */ | 969 | /* Define to 1 if you have the <sys/stat.h> header file. */ |
| 916 | #undef HAVE_SYS_STAT_H | 970 | #undef HAVE_SYS_STAT_H |
| 917 | 971 | ||
| @@ -1,5 +1,5 @@ | |||
| 1 | #! /bin/sh | 1 | #! /bin/sh |
| 2 | # From configure.ac Revision: 1.383 . | 2 | # From configure.ac Revision: 1.409 . |
| 3 | # Guess values for system-dependent variables and create Makefiles. | 3 | # Guess values for system-dependent variables and create Makefiles. |
| 4 | # Generated by GNU Autoconf 2.61 for OpenSSH Portable. | 4 | # Generated by GNU Autoconf 2.61 for OpenSSH Portable. |
| 5 | # | 5 | # |
| @@ -723,6 +723,7 @@ MANTYPE | |||
| 723 | mansubdir | 723 | mansubdir |
| 724 | user_path | 724 | user_path |
| 725 | piddir | 725 | piddir |
| 726 | TEST_SSH_IPV6 | ||
| 726 | LIBOBJS | 727 | LIBOBJS |
| 727 | LTLIBOBJS' | 728 | LTLIBOBJS' |
| 728 | ac_subst_files='' | 729 | ac_subst_files='' |
| @@ -1324,6 +1325,7 @@ Optional Features: | |||
| 1324 | Optional Packages: | 1325 | Optional Packages: |
| 1325 | --with-PACKAGE[=ARG] use PACKAGE [ARG=yes] | 1326 | --with-PACKAGE[=ARG] use PACKAGE [ARG=yes] |
| 1326 | --without-PACKAGE do not use PACKAGE (same as --with-PACKAGE=no) | 1327 | --without-PACKAGE do not use PACKAGE (same as --with-PACKAGE=no) |
| 1328 | --without-stackprotect Don't use compiler's stack protection | ||
| 1327 | --without-rpath Disable auto-added -R linker paths | 1329 | --without-rpath Disable auto-added -R linker paths |
| 1328 | --with-cflags Specify additional flags to pass to compiler | 1330 | --with-cflags Specify additional flags to pass to compiler |
| 1329 | --with-cppflags Specify additional flags to pass to preprocessor | 1331 | --with-cppflags Specify additional flags to pass to preprocessor |
| @@ -1349,7 +1351,7 @@ Optional Packages: | |||
| 1349 | --with-privsep-user=user Specify non-privileged user for privilege separation | 1351 | --with-privsep-user=user Specify non-privileged user for privilege separation |
| 1350 | --with-sectok Enable smartcard support using libsectok | 1352 | --with-sectok Enable smartcard support using libsectok |
| 1351 | --with-opensc[=PFX] Enable smartcard support using OpenSC (optionally in PATH) | 1353 | --with-opensc[=PFX] Enable smartcard support using OpenSC (optionally in PATH) |
| 1352 | --with-selinux Enable SELinux support | 1354 | --with-selinux Enable SELinux support |
| 1353 | --with-kerberos5=PATH Enable Kerberos 5 support | 1355 | --with-kerberos5=PATH Enable Kerberos 5 support |
| 1354 | --with-privsep-path=xxx Path for privilege separation chroot (default=/var/empty) | 1356 | --with-privsep-path=xxx Path for privilege separation chroot (default=/var/empty) |
| 1355 | --with-xauth=PATH Specify path to xauth program | 1357 | --with-xauth=PATH Specify path to xauth program |
| @@ -5383,6 +5385,17 @@ if test $ac_cv_have_decl_LLONG_MAX = yes; then | |||
| 5383 | fi | 5385 | fi |
| 5384 | 5386 | ||
| 5385 | 5387 | ||
| 5388 | use_stack_protector=1 | ||
| 5389 | |||
| 5390 | # Check whether --with-stackprotect was given. | ||
| 5391 | if test "${with_stackprotect+set}" = set; then | ||
| 5392 | withval=$with_stackprotect; | ||
| 5393 | if test "x$withval" = "xno"; then | ||
| 5394 | use_stack_protector=0 | ||
| 5395 | fi | ||
| 5396 | fi | ||
| 5397 | |||
| 5398 | |||
| 5386 | if test "$GCC" = "yes" || test "$GCC" = "egcs"; then | 5399 | if test "$GCC" = "yes" || test "$GCC" = "egcs"; then |
| 5387 | CFLAGS="$CFLAGS -Wall -Wpointer-arith -Wuninitialized" | 5400 | CFLAGS="$CFLAGS -Wall -Wpointer-arith -Wuninitialized" |
| 5388 | GCC_VER=`$CC -v 2>&1 | $AWK '/gcc version /{print $3}'` | 5401 | GCC_VER=`$CC -v 2>&1 | $AWK '/gcc version /{print $3}'` |
| @@ -5393,11 +5406,175 @@ if test "$GCC" = "yes" || test "$GCC" = "egcs"; then | |||
| 5393 | no_attrib_nonnull=1 | 5406 | no_attrib_nonnull=1 |
| 5394 | ;; | 5407 | ;; |
| 5395 | 2.*) no_attrib_nonnull=1 ;; | 5408 | 2.*) no_attrib_nonnull=1 ;; |
| 5396 | 3.*) CFLAGS="$CFLAGS -Wsign-compare" ;; | 5409 | 3.*) CFLAGS="$CFLAGS -Wsign-compare -Wformat-security" ;; |
| 5397 | 4.*) CFLAGS="$CFLAGS -Wsign-compare -Wno-pointer-sign" ;; | 5410 | 4.*) CFLAGS="$CFLAGS -Wsign-compare -Wno-pointer-sign -Wformat-security" ;; |
| 5398 | *) ;; | 5411 | *) ;; |
| 5399 | esac | 5412 | esac |
| 5400 | 5413 | ||
| 5414 | { echo "$as_me:$LINENO: checking if $CC accepts -fno-builtin-memset" >&5 | ||
| 5415 | echo $ECHO_N "checking if $CC accepts -fno-builtin-memset... $ECHO_C" >&6; } | ||
| 5416 | saved_CFLAGS="$CFLAGS" | ||
| 5417 | CFLAGS="$CFLAGS -fno-builtin-memset" | ||
| 5418 | cat >conftest.$ac_ext <<_ACEOF | ||
| 5419 | /* confdefs.h. */ | ||
| 5420 | _ACEOF | ||
| 5421 | cat confdefs.h >>conftest.$ac_ext | ||
| 5422 | cat >>conftest.$ac_ext <<_ACEOF | ||
| 5423 | /* end confdefs.h. */ | ||
| 5424 | |||
| 5425 | #include <string.h> | ||
| 5426 | int main(void){char b[10]; memset(b, 0, sizeof(b));} | ||
| 5427 | |||
| 5428 | _ACEOF | ||
| 5429 | rm -f conftest.$ac_objext conftest$ac_exeext | ||
| 5430 | if { (ac_try="$ac_link" | ||
| 5431 | case "(($ac_try" in | ||
| 5432 | *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; | ||
| 5433 | *) ac_try_echo=$ac_try;; | ||
| 5434 | esac | ||
| 5435 | eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 | ||
| 5436 | (eval "$ac_link") 2>conftest.er1 | ||
| 5437 | ac_status=$? | ||
| 5438 | grep -v '^ *+' conftest.er1 >conftest.err | ||
| 5439 | rm -f conftest.er1 | ||
| 5440 | cat conftest.err >&5 | ||
| 5441 | echo "$as_me:$LINENO: \$? = $ac_status" >&5 | ||
| 5442 | (exit $ac_status); } && { | ||
| 5443 | test -z "$ac_c_werror_flag" || | ||
| 5444 | test ! -s conftest.err | ||
| 5445 | } && test -s conftest$ac_exeext && | ||
| 5446 | $as_test_x conftest$ac_exeext; then | ||
| 5447 | { echo "$as_me:$LINENO: result: yes" >&5 | ||
| 5448 | echo "${ECHO_T}yes" >&6; } | ||
| 5449 | else | ||
| 5450 | echo "$as_me: failed program was:" >&5 | ||
| 5451 | sed 's/^/| /' conftest.$ac_ext >&5 | ||
| 5452 | |||
| 5453 | { echo "$as_me:$LINENO: result: no" >&5 | ||
| 5454 | echo "${ECHO_T}no" >&6; } | ||
| 5455 | CFLAGS="$saved_CFLAGS" | ||
| 5456 | |||
| 5457 | fi | ||
| 5458 | |||
| 5459 | rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \ | ||
| 5460 | conftest$ac_exeext conftest.$ac_ext | ||
| 5461 | |||
| 5462 | # -fstack-protector-all doesn't always work for some GCC versions | ||
| 5463 | # and/or platforms, so we test if we can. If it's not supported | ||
| 5464 | # on a give platform gcc will emit a warning so we use -Werror. | ||
| 5465 | if test "x$use_stack_protector" = "x1"; then | ||
| 5466 | for t in -fstack-protector-all -fstack-protector; do | ||
| 5467 | { echo "$as_me:$LINENO: checking if $CC supports $t" >&5 | ||
| 5468 | echo $ECHO_N "checking if $CC supports $t... $ECHO_C" >&6; } | ||
| 5469 | saved_CFLAGS="$CFLAGS" | ||
| 5470 | saved_LDFLAGS="$LDFLAGS" | ||
| 5471 | CFLAGS="$CFLAGS $t -Werror" | ||
| 5472 | LDFLAGS="$LDFLAGS $t -Werror" | ||
| 5473 | cat >conftest.$ac_ext <<_ACEOF | ||
| 5474 | /* confdefs.h. */ | ||
| 5475 | _ACEOF | ||
| 5476 | cat confdefs.h >>conftest.$ac_ext | ||
| 5477 | cat >>conftest.$ac_ext <<_ACEOF | ||
| 5478 | /* end confdefs.h. */ | ||
| 5479 | |||
| 5480 | #include <stdlib.h> | ||
| 5481 | int main(void){return 0;} | ||
| 5482 | |||
| 5483 | _ACEOF | ||
| 5484 | rm -f conftest.$ac_objext conftest$ac_exeext | ||
| 5485 | if { (ac_try="$ac_link" | ||
| 5486 | case "(($ac_try" in | ||
| 5487 | *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; | ||
| 5488 | *) ac_try_echo=$ac_try;; | ||
| 5489 | esac | ||
| 5490 | eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 | ||
| 5491 | (eval "$ac_link") 2>conftest.er1 | ||
| 5492 | ac_status=$? | ||
| 5493 | grep -v '^ *+' conftest.er1 >conftest.err | ||
| 5494 | rm -f conftest.er1 | ||
| 5495 | cat conftest.err >&5 | ||
| 5496 | echo "$as_me:$LINENO: \$? = $ac_status" >&5 | ||
| 5497 | (exit $ac_status); } && { | ||
| 5498 | test -z "$ac_c_werror_flag" || | ||
| 5499 | test ! -s conftest.err | ||
| 5500 | } && test -s conftest$ac_exeext && | ||
| 5501 | $as_test_x conftest$ac_exeext; then | ||
| 5502 | { echo "$as_me:$LINENO: result: yes" >&5 | ||
| 5503 | echo "${ECHO_T}yes" >&6; } | ||
| 5504 | CFLAGS="$saved_CFLAGS $t" | ||
| 5505 | LDFLAGS="$saved_LDFLAGS $t" | ||
| 5506 | { echo "$as_me:$LINENO: checking if $t works" >&5 | ||
| 5507 | echo $ECHO_N "checking if $t works... $ECHO_C" >&6; } | ||
| 5508 | if test "$cross_compiling" = yes; then | ||
| 5509 | { echo "$as_me:$LINENO: WARNING: cross compiling: cannot test" >&5 | ||
| 5510 | echo "$as_me: WARNING: cross compiling: cannot test" >&2;} | ||
| 5511 | break | ||
| 5512 | |||
| 5513 | else | ||
| 5514 | cat >conftest.$ac_ext <<_ACEOF | ||
| 5515 | /* confdefs.h. */ | ||
| 5516 | _ACEOF | ||
| 5517 | cat confdefs.h >>conftest.$ac_ext | ||
| 5518 | cat >>conftest.$ac_ext <<_ACEOF | ||
| 5519 | /* end confdefs.h. */ | ||
| 5520 | |||
| 5521 | #include <stdlib.h> | ||
| 5522 | int main(void){exit(0);} | ||
| 5523 | |||
| 5524 | _ACEOF | ||
| 5525 | rm -f conftest$ac_exeext | ||
| 5526 | if { (ac_try="$ac_link" | ||
| 5527 | case "(($ac_try" in | ||
| 5528 | *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; | ||
| 5529 | *) ac_try_echo=$ac_try;; | ||
| 5530 | esac | ||
| 5531 | eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 | ||
| 5532 | (eval "$ac_link") 2>&5 | ||
| 5533 | ac_status=$? | ||
| 5534 | echo "$as_me:$LINENO: \$? = $ac_status" >&5 | ||
| 5535 | (exit $ac_status); } && { ac_try='./conftest$ac_exeext' | ||
| 5536 | { (case "(($ac_try" in | ||
| 5537 | *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; | ||
| 5538 | *) ac_try_echo=$ac_try;; | ||
| 5539 | esac | ||
| 5540 | eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 | ||
| 5541 | (eval "$ac_try") 2>&5 | ||
| 5542 | ac_status=$? | ||
| 5543 | echo "$as_me:$LINENO: \$? = $ac_status" >&5 | ||
| 5544 | (exit $ac_status); }; }; then | ||
| 5545 | { echo "$as_me:$LINENO: result: yes" >&5 | ||
| 5546 | echo "${ECHO_T}yes" >&6; } | ||
| 5547 | break | ||
| 5548 | else | ||
| 5549 | echo "$as_me: program exited with status $ac_status" >&5 | ||
| 5550 | echo "$as_me: failed program was:" >&5 | ||
| 5551 | sed 's/^/| /' conftest.$ac_ext >&5 | ||
| 5552 | |||
| 5553 | ( exit $ac_status ) | ||
| 5554 | { echo "$as_me:$LINENO: result: no" >&5 | ||
| 5555 | echo "${ECHO_T}no" >&6; } | ||
| 5556 | fi | ||
| 5557 | rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext conftest.$ac_objext conftest.$ac_ext | ||
| 5558 | fi | ||
| 5559 | |||
| 5560 | |||
| 5561 | |||
| 5562 | else | ||
| 5563 | echo "$as_me: failed program was:" >&5 | ||
| 5564 | sed 's/^/| /' conftest.$ac_ext >&5 | ||
| 5565 | |||
| 5566 | { echo "$as_me:$LINENO: result: no" >&5 | ||
| 5567 | echo "${ECHO_T}no" >&6; } | ||
| 5568 | |||
| 5569 | fi | ||
| 5570 | |||
| 5571 | rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \ | ||
| 5572 | conftest$ac_exeext conftest.$ac_ext | ||
| 5573 | CFLAGS="$saved_CFLAGS" | ||
| 5574 | LDFLAGS="$saved_LDFLAGS" | ||
| 5575 | done | ||
| 5576 | fi | ||
| 5577 | |||
| 5401 | if test -z "$have_llong_max"; then | 5578 | if test -z "$have_llong_max"; then |
| 5402 | # retry LLONG_MAX with -std=gnu99, needed on some Linuxes | 5579 | # retry LLONG_MAX with -std=gnu99, needed on some Linuxes |
| 5403 | unset ac_cv_have_decl_LLONG_MAX | 5580 | unset ac_cv_have_decl_LLONG_MAX |
| @@ -5614,6 +5791,9 @@ fi | |||
| 5614 | 5791 | ||
| 5615 | 5792 | ||
| 5616 | 5793 | ||
| 5794 | |||
| 5795 | |||
| 5796 | |||
| 5617 | for ac_header in \ | 5797 | for ac_header in \ |
| 5618 | bstring.h \ | 5798 | bstring.h \ |
| 5619 | crypt.h \ | 5799 | crypt.h \ |
| @@ -5653,7 +5833,9 @@ for ac_header in \ | |||
| 5653 | sys/cdefs.h \ | 5833 | sys/cdefs.h \ |
| 5654 | sys/dir.h \ | 5834 | sys/dir.h \ |
| 5655 | sys/mman.h \ | 5835 | sys/mman.h \ |
| 5836 | sys/mount.h \ | ||
| 5656 | sys/ndir.h \ | 5837 | sys/ndir.h \ |
| 5838 | sys/poll.h \ | ||
| 5657 | sys/prctl.h \ | 5839 | sys/prctl.h \ |
| 5658 | sys/pstat.h \ | 5840 | sys/pstat.h \ |
| 5659 | sys/select.h \ | 5841 | sys/select.h \ |
| @@ -5661,6 +5843,7 @@ for ac_header in \ | |||
| 5661 | sys/stream.h \ | 5843 | sys/stream.h \ |
| 5662 | sys/stropts.h \ | 5844 | sys/stropts.h \ |
| 5663 | sys/strtio.h \ | 5845 | sys/strtio.h \ |
| 5846 | sys/statvfs.h \ | ||
| 5664 | sys/sysmacros.h \ | 5847 | sys/sysmacros.h \ |
| 5665 | sys/time.h \ | 5848 | sys/time.h \ |
| 5666 | sys/timers.h \ | 5849 | sys/timers.h \ |
| @@ -6761,7 +6944,8 @@ fi | |||
| 6761 | 6944 | ||
| 6762 | 6945 | ||
| 6763 | 6946 | ||
| 6764 | for ac_func in setauthdb | 6947 | |
| 6948 | for ac_func in getgrset setauthdb | ||
| 6765 | do | 6949 | do |
| 6766 | as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh` | 6950 | as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh` |
| 6767 | { echo "$as_me:$LINENO: checking for $ac_func" >&5 | 6951 | { echo "$as_me:$LINENO: checking for $ac_func" >&5 |
| @@ -7094,6 +7278,11 @@ _ACEOF | |||
| 7094 | _ACEOF | 7278 | _ACEOF |
| 7095 | 7279 | ||
| 7096 | 7280 | ||
| 7281 | cat >>confdefs.h <<\_ACEOF | ||
| 7282 | #define BROKEN_GLOB 1 | ||
| 7283 | _ACEOF | ||
| 7284 | |||
| 7285 | |||
| 7097 | cat >>confdefs.h <<_ACEOF | 7286 | cat >>confdefs.h <<_ACEOF |
| 7098 | #define BIND_8_COMPAT 1 | 7287 | #define BIND_8_COMPAT 1 |
| 7099 | _ACEOF | 7288 | _ACEOF |
| @@ -7113,6 +7302,71 @@ cat >>confdefs.h <<\_ACEOF | |||
| 7113 | #define SSH_TUN_PREPEND_AF 1 | 7302 | #define SSH_TUN_PREPEND_AF 1 |
| 7114 | _ACEOF | 7303 | _ACEOF |
| 7115 | 7304 | ||
| 7305 | |||
| 7306 | { echo "$as_me:$LINENO: checking whether AU_IPv4 is declared" >&5 | ||
| 7307 | echo $ECHO_N "checking whether AU_IPv4 is declared... $ECHO_C" >&6; } | ||
| 7308 | if test "${ac_cv_have_decl_AU_IPv4+set}" = set; then | ||
| 7309 | echo $ECHO_N "(cached) $ECHO_C" >&6 | ||
| 7310 | else | ||
| 7311 | cat >conftest.$ac_ext <<_ACEOF | ||
| 7312 | /* confdefs.h. */ | ||
| 7313 | _ACEOF | ||
| 7314 | cat confdefs.h >>conftest.$ac_ext | ||
| 7315 | cat >>conftest.$ac_ext <<_ACEOF | ||
| 7316 | /* end confdefs.h. */ | ||
| 7317 | $ac_includes_default | ||
| 7318 | int | ||
| 7319 | main () | ||
| 7320 | { | ||
| 7321 | #ifndef AU_IPv4 | ||
| 7322 | (void) AU_IPv4; | ||
| 7323 | #endif | ||
| 7324 | |||
| 7325 | ; | ||
| 7326 | return 0; | ||
| 7327 | } | ||
| 7328 | _ACEOF | ||
| 7329 | rm -f conftest.$ac_objext | ||
| 7330 | if { (ac_try="$ac_compile" | ||
| 7331 | case "(($ac_try" in | ||
| 7332 | *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; | ||
| 7333 | *) ac_try_echo=$ac_try;; | ||
| 7334 | esac | ||
| 7335 | eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 | ||
| 7336 | (eval "$ac_compile") 2>conftest.er1 | ||
| 7337 | ac_status=$? | ||
| 7338 | grep -v '^ *+' conftest.er1 >conftest.err | ||
| 7339 | rm -f conftest.er1 | ||
| 7340 | cat conftest.err >&5 | ||
| 7341 | echo "$as_me:$LINENO: \$? = $ac_status" >&5 | ||
| 7342 | (exit $ac_status); } && { | ||
| 7343 | test -z "$ac_c_werror_flag" || | ||
| 7344 | test ! -s conftest.err | ||
| 7345 | } && test -s conftest.$ac_objext; then | ||
| 7346 | ac_cv_have_decl_AU_IPv4=yes | ||
| 7347 | else | ||
| 7348 | echo "$as_me: failed program was:" >&5 | ||
| 7349 | sed 's/^/| /' conftest.$ac_ext >&5 | ||
| 7350 | |||
| 7351 | ac_cv_have_decl_AU_IPv4=no | ||
| 7352 | fi | ||
| 7353 | |||
| 7354 | rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext | ||
| 7355 | fi | ||
| 7356 | { echo "$as_me:$LINENO: result: $ac_cv_have_decl_AU_IPv4" >&5 | ||
| 7357 | echo "${ECHO_T}$ac_cv_have_decl_AU_IPv4" >&6; } | ||
| 7358 | if test $ac_cv_have_decl_AU_IPv4 = yes; then | ||
| 7359 | : | ||
| 7360 | else | ||
| 7361 | |||
| 7362 | cat >>confdefs.h <<\_ACEOF | ||
| 7363 | #define AU_IPv4 0 | ||
| 7364 | _ACEOF | ||
| 7365 | |||
| 7366 | #include <bsm/audit.h> | ||
| 7367 | |||
| 7368 | fi | ||
| 7369 | |||
| 7116 | { echo "$as_me:$LINENO: checking if we have the Security Authorization Session API" >&5 | 7370 | { echo "$as_me:$LINENO: checking if we have the Security Authorization Session API" >&5 |
| 7117 | echo $ECHO_N "checking if we have the Security Authorization Session API... $ECHO_C" >&6; } | 7371 | echo $ECHO_N "checking if we have the Security Authorization Session API... $ECHO_C" >&6; } |
| 7118 | cat >conftest.$ac_ext <<_ACEOF | 7372 | cat >conftest.$ac_ext <<_ACEOF |
| @@ -7224,7 +7478,7 @@ echo "${ECHO_T}no" >&6; } | |||
| 7224 | fi | 7478 | fi |
| 7225 | 7479 | ||
| 7226 | rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext | 7480 | rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext |
| 7227 | ;; | 7481 | ;; |
| 7228 | *-*-dragonfly*) | 7482 | *-*-dragonfly*) |
| 7229 | SSHDLIBS="$SSHDLIBS -lcrypt" | 7483 | SSHDLIBS="$SSHDLIBS -lcrypt" |
| 7230 | ;; | 7484 | ;; |
| @@ -7569,11 +7823,6 @@ _ACEOF | |||
| 7569 | check_for_openpty_ctty_bug=1 | 7823 | check_for_openpty_ctty_bug=1 |
| 7570 | 7824 | ||
| 7571 | cat >>confdefs.h <<\_ACEOF | 7825 | cat >>confdefs.h <<\_ACEOF |
| 7572 | #define DONT_TRY_OTHER_AF 1 | ||
| 7573 | _ACEOF | ||
| 7574 | |||
| 7575 | |||
| 7576 | cat >>confdefs.h <<\_ACEOF | ||
| 7577 | #define PAM_TTY_KLUDGE 1 | 7826 | #define PAM_TTY_KLUDGE 1 |
| 7578 | _ACEOF | 7827 | _ACEOF |
| 7579 | 7828 | ||
| @@ -8097,6 +8346,11 @@ _ACEOF | |||
| 8097 | fi | 8346 | fi |
| 8098 | 8347 | ||
| 8099 | 8348 | ||
| 8349 | |||
| 8350 | cat >>confdefs.h <<\_ACEOF | ||
| 8351 | #define BROKEN_GLOB 1 | ||
| 8352 | _ACEOF | ||
| 8353 | |||
| 8100 | ;; | 8354 | ;; |
| 8101 | *-*-bsdi*) | 8355 | *-*-bsdi*) |
| 8102 | cat >>confdefs.h <<\_ACEOF | 8356 | cat >>confdefs.h <<\_ACEOF |
| @@ -8980,6 +9234,11 @@ _ACEOF | |||
| 8980 | #define BROKEN_SETREGID 1 | 9234 | #define BROKEN_SETREGID 1 |
| 8981 | _ACEOF | 9235 | _ACEOF |
| 8982 | 9236 | ||
| 9237 | |||
| 9238 | cat >>confdefs.h <<\_ACEOF | ||
| 9239 | #define BROKEN_READV_COMPARISON 1 | ||
| 9240 | _ACEOF | ||
| 9241 | |||
| 8983 | ;; | 9242 | ;; |
| 8984 | 9243 | ||
| 8985 | *-*-nto-qnx*) | 9244 | *-*-nto-qnx*) |
| @@ -9014,6 +9273,11 @@ _ACEOF | |||
| 9014 | #define SSHD_ACQUIRES_CTTY 1 | 9273 | #define SSHD_ACQUIRES_CTTY 1 |
| 9015 | _ACEOF | 9274 | _ACEOF |
| 9016 | 9275 | ||
| 9276 | |||
| 9277 | cat >>confdefs.h <<\_ACEOF | ||
| 9278 | #define BROKEN_SHADOW_EXPIRE 1 | ||
| 9279 | _ACEOF | ||
| 9280 | |||
| 9017 | enable_etc_default_login=no # has incompatible /etc/default/login | 9281 | enable_etc_default_login=no # has incompatible /etc/default/login |
| 9018 | case "$host" in | 9282 | case "$host" in |
| 9019 | *-*-nto-qnx6*) | 9283 | *-*-nto-qnx6*) |
| @@ -11179,7 +11443,8 @@ fi | |||
| 11179 | 11443 | ||
| 11180 | 11444 | ||
| 11181 | 11445 | ||
| 11182 | for ac_func in logout updwtmp logwtmp | 11446 | |
| 11447 | for ac_func in fmt_scaled logout updwtmp logwtmp | ||
| 11183 | do | 11448 | do |
| 11184 | as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh` | 11449 | as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh` |
| 11185 | { echo "$as_me:$LINENO: checking for $ac_func" >&5 | 11450 | { echo "$as_me:$LINENO: checking for $ac_func" >&5 |
| @@ -12320,7 +12585,8 @@ done | |||
| 12320 | 12585 | ||
| 12321 | # These are optional | 12586 | # These are optional |
| 12322 | 12587 | ||
| 12323 | for ac_func in getaudit_addr | 12588 | |
| 12589 | for ac_func in getaudit_addr aug_get_machine | ||
| 12324 | do | 12590 | do |
| 12325 | as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh` | 12591 | as_ac_var=`echo "ac_cv_func_$ac_func" | $as_tr_sh` |
| 12326 | { echo "$as_me:$LINENO: checking for $ac_func" >&5 | 12592 | { echo "$as_me:$LINENO: checking for $ac_func" >&5 |
| @@ -12527,8 +12793,15 @@ fi | |||
| 12527 | 12793 | ||
| 12528 | 12794 | ||
| 12529 | 12795 | ||
| 12796 | |||
| 12797 | |||
| 12798 | |||
| 12799 | |||
| 12800 | |||
| 12530 | for ac_func in \ | 12801 | for ac_func in \ |
| 12531 | arc4random \ | 12802 | arc4random \ |
| 12803 | arc4random_buf \ | ||
| 12804 | arc4random_uniform \ | ||
| 12532 | asprintf \ | 12805 | asprintf \ |
| 12533 | b64_ntop \ | 12806 | b64_ntop \ |
| 12534 | __b64_ntop \ | 12807 | __b64_ntop \ |
| @@ -12542,6 +12815,7 @@ for ac_func in \ | |||
| 12542 | fchmod \ | 12815 | fchmod \ |
| 12543 | fchown \ | 12816 | fchown \ |
| 12544 | freeaddrinfo \ | 12817 | freeaddrinfo \ |
| 12818 | fstatvfs \ | ||
| 12545 | futimes \ | 12819 | futimes \ |
| 12546 | getaddrinfo \ | 12820 | getaddrinfo \ |
| 12547 | getcwd \ | 12821 | getcwd \ |
| @@ -12593,6 +12867,8 @@ for ac_func in \ | |||
| 12593 | sigvec \ | 12867 | sigvec \ |
| 12594 | snprintf \ | 12868 | snprintf \ |
| 12595 | socketpair \ | 12869 | socketpair \ |
| 12870 | statfs \ | ||
| 12871 | statvfs \ | ||
| 12596 | strdup \ | 12872 | strdup \ |
| 12597 | strerror \ | 12873 | strerror \ |
| 12598 | strlcat \ | 12874 | strlcat \ |
| @@ -16760,6 +17036,12 @@ if test `eval echo '${'$as_ac_var'}'` = yes; then | |||
| 16760 | #define `echo "HAVE_$ac_func" | $as_tr_cpp` 1 | 17036 | #define `echo "HAVE_$ac_func" | $as_tr_cpp` 1 |
| 16761 | _ACEOF | 17037 | _ACEOF |
| 16762 | SSHDLIBS="$SSHDLIBS -liaf" | 17038 | SSHDLIBS="$SSHDLIBS -liaf" |
| 17039 | |||
| 17040 | cat >>confdefs.h <<\_ACEOF | ||
| 17041 | #define HAVE_LIBIAF 1 | ||
| 17042 | _ACEOF | ||
| 17043 | |||
| 17044 | |||
| 16763 | fi | 17045 | fi |
| 16764 | done | 17046 | done |
| 16765 | 17047 | ||
| @@ -21541,6 +21823,153 @@ _ACEOF | |||
| 21541 | 21823 | ||
| 21542 | fi | 21824 | fi |
| 21543 | 21825 | ||
| 21826 | { echo "$as_me:$LINENO: checking for fsblkcnt_t" >&5 | ||
| 21827 | echo $ECHO_N "checking for fsblkcnt_t... $ECHO_C" >&6; } | ||
| 21828 | if test "${ac_cv_type_fsblkcnt_t+set}" = set; then | ||
| 21829 | echo $ECHO_N "(cached) $ECHO_C" >&6 | ||
| 21830 | else | ||
| 21831 | cat >conftest.$ac_ext <<_ACEOF | ||
| 21832 | /* confdefs.h. */ | ||
| 21833 | _ACEOF | ||
| 21834 | cat confdefs.h >>conftest.$ac_ext | ||
| 21835 | cat >>conftest.$ac_ext <<_ACEOF | ||
| 21836 | /* end confdefs.h. */ | ||
| 21837 | |||
| 21838 | #include <sys/types.h> | ||
| 21839 | #ifdef HAVE_SYS_BITYPES_H | ||
| 21840 | #include <sys/bitypes.h> | ||
| 21841 | #endif | ||
| 21842 | #ifdef HAVE_SYS_STATFS_H | ||
| 21843 | #include <sys/statfs.h> | ||
| 21844 | #endif | ||
| 21845 | #ifdef HAVE_SYS_STATVFS_H | ||
| 21846 | #include <sys/statvfs.h> | ||
| 21847 | #endif | ||
| 21848 | |||
| 21849 | |||
| 21850 | typedef fsblkcnt_t ac__type_new_; | ||
| 21851 | int | ||
| 21852 | main () | ||
| 21853 | { | ||
| 21854 | if ((ac__type_new_ *) 0) | ||
| 21855 | return 0; | ||
| 21856 | if (sizeof (ac__type_new_)) | ||
| 21857 | return 0; | ||
| 21858 | ; | ||
| 21859 | return 0; | ||
| 21860 | } | ||
| 21861 | _ACEOF | ||
| 21862 | rm -f conftest.$ac_objext | ||
| 21863 | if { (ac_try="$ac_compile" | ||
| 21864 | case "(($ac_try" in | ||
| 21865 | *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; | ||
| 21866 | *) ac_try_echo=$ac_try;; | ||
| 21867 | esac | ||
| 21868 | eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 | ||
| 21869 | (eval "$ac_compile") 2>conftest.er1 | ||
| 21870 | ac_status=$? | ||
| 21871 | grep -v '^ *+' conftest.er1 >conftest.err | ||
| 21872 | rm -f conftest.er1 | ||
| 21873 | cat conftest.err >&5 | ||
| 21874 | echo "$as_me:$LINENO: \$? = $ac_status" >&5 | ||
| 21875 | (exit $ac_status); } && { | ||
| 21876 | test -z "$ac_c_werror_flag" || | ||
| 21877 | test ! -s conftest.err | ||
| 21878 | } && test -s conftest.$ac_objext; then | ||
| 21879 | ac_cv_type_fsblkcnt_t=yes | ||
| 21880 | else | ||
| 21881 | echo "$as_me: failed program was:" >&5 | ||
| 21882 | sed 's/^/| /' conftest.$ac_ext >&5 | ||
| 21883 | |||
| 21884 | ac_cv_type_fsblkcnt_t=no | ||
| 21885 | fi | ||
| 21886 | |||
| 21887 | rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext | ||
| 21888 | fi | ||
| 21889 | { echo "$as_me:$LINENO: result: $ac_cv_type_fsblkcnt_t" >&5 | ||
| 21890 | echo "${ECHO_T}$ac_cv_type_fsblkcnt_t" >&6; } | ||
| 21891 | if test $ac_cv_type_fsblkcnt_t = yes; then | ||
| 21892 | |||
| 21893 | cat >>confdefs.h <<_ACEOF | ||
| 21894 | #define HAVE_FSBLKCNT_T 1 | ||
| 21895 | _ACEOF | ||
| 21896 | |||
| 21897 | |||
| 21898 | fi | ||
| 21899 | { echo "$as_me:$LINENO: checking for fsfilcnt_t" >&5 | ||
| 21900 | echo $ECHO_N "checking for fsfilcnt_t... $ECHO_C" >&6; } | ||
| 21901 | if test "${ac_cv_type_fsfilcnt_t+set}" = set; then | ||
| 21902 | echo $ECHO_N "(cached) $ECHO_C" >&6 | ||
| 21903 | else | ||
| 21904 | cat >conftest.$ac_ext <<_ACEOF | ||
| 21905 | /* confdefs.h. */ | ||
| 21906 | _ACEOF | ||
| 21907 | cat confdefs.h >>conftest.$ac_ext | ||
| 21908 | cat >>conftest.$ac_ext <<_ACEOF | ||
| 21909 | /* end confdefs.h. */ | ||
| 21910 | |||
| 21911 | #include <sys/types.h> | ||
| 21912 | #ifdef HAVE_SYS_BITYPES_H | ||
| 21913 | #include <sys/bitypes.h> | ||
| 21914 | #endif | ||
| 21915 | #ifdef HAVE_SYS_STATFS_H | ||
| 21916 | #include <sys/statfs.h> | ||
| 21917 | #endif | ||
| 21918 | #ifdef HAVE_SYS_STATVFS_H | ||
| 21919 | #include <sys/statvfs.h> | ||
| 21920 | #endif | ||
| 21921 | |||
| 21922 | |||
| 21923 | typedef fsfilcnt_t ac__type_new_; | ||
| 21924 | int | ||
| 21925 | main () | ||
| 21926 | { | ||
| 21927 | if ((ac__type_new_ *) 0) | ||
| 21928 | return 0; | ||
| 21929 | if (sizeof (ac__type_new_)) | ||
| 21930 | return 0; | ||
| 21931 | ; | ||
| 21932 | return 0; | ||
| 21933 | } | ||
| 21934 | _ACEOF | ||
| 21935 | rm -f conftest.$ac_objext | ||
| 21936 | if { (ac_try="$ac_compile" | ||
| 21937 | case "(($ac_try" in | ||
| 21938 | *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; | ||
| 21939 | *) ac_try_echo=$ac_try;; | ||
| 21940 | esac | ||
| 21941 | eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 | ||
| 21942 | (eval "$ac_compile") 2>conftest.er1 | ||
| 21943 | ac_status=$? | ||
| 21944 | grep -v '^ *+' conftest.er1 >conftest.err | ||
| 21945 | rm -f conftest.er1 | ||
| 21946 | cat conftest.err >&5 | ||
| 21947 | echo "$as_me:$LINENO: \$? = $ac_status" >&5 | ||
| 21948 | (exit $ac_status); } && { | ||
| 21949 | test -z "$ac_c_werror_flag" || | ||
| 21950 | test ! -s conftest.err | ||
| 21951 | } && test -s conftest.$ac_objext; then | ||
| 21952 | ac_cv_type_fsfilcnt_t=yes | ||
| 21953 | else | ||
| 21954 | echo "$as_me: failed program was:" >&5 | ||
| 21955 | sed 's/^/| /' conftest.$ac_ext >&5 | ||
| 21956 | |||
| 21957 | ac_cv_type_fsfilcnt_t=no | ||
| 21958 | fi | ||
| 21959 | |||
| 21960 | rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext | ||
| 21961 | fi | ||
| 21962 | { echo "$as_me:$LINENO: result: $ac_cv_type_fsfilcnt_t" >&5 | ||
| 21963 | echo "${ECHO_T}$ac_cv_type_fsfilcnt_t" >&6; } | ||
| 21964 | if test $ac_cv_type_fsfilcnt_t = yes; then | ||
| 21965 | |||
| 21966 | cat >>confdefs.h <<_ACEOF | ||
| 21967 | #define HAVE_FSFILCNT_T 1 | ||
| 21968 | _ACEOF | ||
| 21969 | |||
| 21970 | |||
| 21971 | fi | ||
| 21972 | |||
| 21544 | 21973 | ||
| 21545 | { echo "$as_me:$LINENO: checking for in_addr_t" >&5 | 21974 | { echo "$as_me:$LINENO: checking for in_addr_t" >&5 |
| 21546 | echo $ECHO_N "checking for in_addr_t... $ECHO_C" >&6; } | 21975 | echo $ECHO_N "checking for in_addr_t... $ECHO_C" >&6; } |
| @@ -23848,6 +24277,60 @@ _ACEOF | |||
| 23848 | 24277 | ||
| 23849 | fi | 24278 | fi |
| 23850 | 24279 | ||
| 24280 | { echo "$as_me:$LINENO: checking if f_fsid has val members" >&5 | ||
| 24281 | echo $ECHO_N "checking if f_fsid has val members... $ECHO_C" >&6; } | ||
| 24282 | cat >conftest.$ac_ext <<_ACEOF | ||
| 24283 | /* confdefs.h. */ | ||
| 24284 | _ACEOF | ||
| 24285 | cat confdefs.h >>conftest.$ac_ext | ||
| 24286 | cat >>conftest.$ac_ext <<_ACEOF | ||
| 24287 | /* end confdefs.h. */ | ||
| 24288 | |||
| 24289 | #include <sys/types.h> | ||
| 24290 | #include <sys/statvfs.h> | ||
| 24291 | int | ||
| 24292 | main () | ||
| 24293 | { | ||
| 24294 | struct fsid_t t; t.val[0] = 0; | ||
| 24295 | ; | ||
| 24296 | return 0; | ||
| 24297 | } | ||
| 24298 | _ACEOF | ||
| 24299 | rm -f conftest.$ac_objext | ||
| 24300 | if { (ac_try="$ac_compile" | ||
| 24301 | case "(($ac_try" in | ||
| 24302 | *\"* | *\`* | *\\*) ac_try_echo=\$ac_try;; | ||
| 24303 | *) ac_try_echo=$ac_try;; | ||
| 24304 | esac | ||
| 24305 | eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 | ||
| 24306 | (eval "$ac_compile") 2>conftest.er1 | ||
| 24307 | ac_status=$? | ||
| 24308 | grep -v '^ *+' conftest.er1 >conftest.err | ||
| 24309 | rm -f conftest.er1 | ||
| 24310 | cat conftest.err >&5 | ||
| 24311 | echo "$as_me:$LINENO: \$? = $ac_status" >&5 | ||
| 24312 | (exit $ac_status); } && { | ||
| 24313 | test -z "$ac_c_werror_flag" || | ||
| 24314 | test ! -s conftest.err | ||
| 24315 | } && test -s conftest.$ac_objext; then | ||
| 24316 | { echo "$as_me:$LINENO: result: yes" >&5 | ||
| 24317 | echo "${ECHO_T}yes" >&6; } | ||
| 24318 | |||
| 24319 | cat >>confdefs.h <<\_ACEOF | ||
| 24320 | #define FSID_HAS_VAL 1 | ||
| 24321 | _ACEOF | ||
| 24322 | |||
| 24323 | else | ||
| 24324 | echo "$as_me: failed program was:" >&5 | ||
| 24325 | sed 's/^/| /' conftest.$ac_ext >&5 | ||
| 24326 | |||
| 24327 | { echo "$as_me:$LINENO: result: no" >&5 | ||
| 24328 | echo "${ECHO_T}no" >&6; } | ||
| 24329 | |||
| 24330 | fi | ||
| 24331 | |||
| 24332 | rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext | ||
| 24333 | |||
| 23851 | { echo "$as_me:$LINENO: checking for msg_control field in struct msghdr" >&5 | 24334 | { echo "$as_me:$LINENO: checking for msg_control field in struct msghdr" >&5 |
| 23852 | echo $ECHO_N "checking for msg_control field in struct msghdr... $ECHO_C" >&6; } | 24335 | echo $ECHO_N "checking for msg_control field in struct msghdr... $ECHO_C" >&6; } |
| 23853 | if test "${ac_cv_have_control_in_msghdr+set}" = set; then | 24336 | if test "${ac_cv_have_control_in_msghdr+set}" = set; then |
| @@ -26128,13 +26611,13 @@ if test "$ac_res" != no; then | |||
| 26128 | fi | 26611 | fi |
| 26129 | 26612 | ||
| 26130 | 26613 | ||
| 26131 | { echo "$as_me:$LINENO: checking for gss_init_sec_context in -lgssapi" >&5 | 26614 | { echo "$as_me:$LINENO: checking for gss_init_sec_context in -lgssapi_krb5" >&5 |
| 26132 | echo $ECHO_N "checking for gss_init_sec_context in -lgssapi... $ECHO_C" >&6; } | 26615 | echo $ECHO_N "checking for gss_init_sec_context in -lgssapi_krb5... $ECHO_C" >&6; } |
| 26133 | if test "${ac_cv_lib_gssapi_gss_init_sec_context+set}" = set; then | 26616 | if test "${ac_cv_lib_gssapi_krb5_gss_init_sec_context+set}" = set; then |
| 26134 | echo $ECHO_N "(cached) $ECHO_C" >&6 | 26617 | echo $ECHO_N "(cached) $ECHO_C" >&6 |
| 26135 | else | 26618 | else |
| 26136 | ac_check_lib_save_LIBS=$LIBS | 26619 | ac_check_lib_save_LIBS=$LIBS |
| 26137 | LIBS="-lgssapi $K5LIBS $LIBS" | 26620 | LIBS="-lgssapi_krb5 $K5LIBS $LIBS" |
| 26138 | cat >conftest.$ac_ext <<_ACEOF | 26621 | cat >conftest.$ac_ext <<_ACEOF |
| 26139 | /* confdefs.h. */ | 26622 | /* confdefs.h. */ |
| 26140 | _ACEOF | 26623 | _ACEOF |
| @@ -26175,34 +26658,34 @@ eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 | |||
| 26175 | test ! -s conftest.err | 26658 | test ! -s conftest.err |
| 26176 | } && test -s conftest$ac_exeext && | 26659 | } && test -s conftest$ac_exeext && |
| 26177 | $as_test_x conftest$ac_exeext; then | 26660 | $as_test_x conftest$ac_exeext; then |
| 26178 | ac_cv_lib_gssapi_gss_init_sec_context=yes | 26661 | ac_cv_lib_gssapi_krb5_gss_init_sec_context=yes |
| 26179 | else | 26662 | else |
| 26180 | echo "$as_me: failed program was:" >&5 | 26663 | echo "$as_me: failed program was:" >&5 |
| 26181 | sed 's/^/| /' conftest.$ac_ext >&5 | 26664 | sed 's/^/| /' conftest.$ac_ext >&5 |
| 26182 | 26665 | ||
| 26183 | ac_cv_lib_gssapi_gss_init_sec_context=no | 26666 | ac_cv_lib_gssapi_krb5_gss_init_sec_context=no |
| 26184 | fi | 26667 | fi |
| 26185 | 26668 | ||
| 26186 | rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \ | 26669 | rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \ |
| 26187 | conftest$ac_exeext conftest.$ac_ext | 26670 | conftest$ac_exeext conftest.$ac_ext |
| 26188 | LIBS=$ac_check_lib_save_LIBS | 26671 | LIBS=$ac_check_lib_save_LIBS |
| 26189 | fi | 26672 | fi |
| 26190 | { echo "$as_me:$LINENO: result: $ac_cv_lib_gssapi_gss_init_sec_context" >&5 | 26673 | { echo "$as_me:$LINENO: result: $ac_cv_lib_gssapi_krb5_gss_init_sec_context" >&5 |
| 26191 | echo "${ECHO_T}$ac_cv_lib_gssapi_gss_init_sec_context" >&6; } | 26674 | echo "${ECHO_T}$ac_cv_lib_gssapi_krb5_gss_init_sec_context" >&6; } |
| 26192 | if test $ac_cv_lib_gssapi_gss_init_sec_context = yes; then | 26675 | if test $ac_cv_lib_gssapi_krb5_gss_init_sec_context = yes; then |
| 26193 | cat >>confdefs.h <<\_ACEOF | 26676 | cat >>confdefs.h <<\_ACEOF |
| 26194 | #define GSSAPI 1 | 26677 | #define GSSAPI 1 |
| 26195 | _ACEOF | 26678 | _ACEOF |
| 26196 | 26679 | ||
| 26197 | K5LIBS="-lgssapi $K5LIBS" | 26680 | K5LIBS="-lgssapi_krb5 $K5LIBS" |
| 26198 | else | 26681 | else |
| 26199 | { echo "$as_me:$LINENO: checking for gss_init_sec_context in -lgssapi_krb5" >&5 | 26682 | { echo "$as_me:$LINENO: checking for gss_init_sec_context in -lgssapi" >&5 |
| 26200 | echo $ECHO_N "checking for gss_init_sec_context in -lgssapi_krb5... $ECHO_C" >&6; } | 26683 | echo $ECHO_N "checking for gss_init_sec_context in -lgssapi... $ECHO_C" >&6; } |
| 26201 | if test "${ac_cv_lib_gssapi_krb5_gss_init_sec_context+set}" = set; then | 26684 | if test "${ac_cv_lib_gssapi_gss_init_sec_context+set}" = set; then |
| 26202 | echo $ECHO_N "(cached) $ECHO_C" >&6 | 26685 | echo $ECHO_N "(cached) $ECHO_C" >&6 |
| 26203 | else | 26686 | else |
| 26204 | ac_check_lib_save_LIBS=$LIBS | 26687 | ac_check_lib_save_LIBS=$LIBS |
| 26205 | LIBS="-lgssapi_krb5 $K5LIBS $LIBS" | 26688 | LIBS="-lgssapi $K5LIBS $LIBS" |
| 26206 | cat >conftest.$ac_ext <<_ACEOF | 26689 | cat >conftest.$ac_ext <<_ACEOF |
| 26207 | /* confdefs.h. */ | 26690 | /* confdefs.h. */ |
| 26208 | _ACEOF | 26691 | _ACEOF |
| @@ -26243,26 +26726,26 @@ eval "echo \"\$as_me:$LINENO: $ac_try_echo\"") >&5 | |||
| 26243 | test ! -s conftest.err | 26726 | test ! -s conftest.err |
| 26244 | } && test -s conftest$ac_exeext && | 26727 | } && test -s conftest$ac_exeext && |
| 26245 | $as_test_x conftest$ac_exeext; then | 26728 | $as_test_x conftest$ac_exeext; then |
| 26246 | ac_cv_lib_gssapi_krb5_gss_init_sec_context=yes | 26729 | ac_cv_lib_gssapi_gss_init_sec_context=yes |
| 26247 | else | 26730 | else |
| 26248 | echo "$as_me: failed program was:" >&5 | 26731 | echo "$as_me: failed program was:" >&5 |
| 26249 | sed 's/^/| /' conftest.$ac_ext >&5 | 26732 | sed 's/^/| /' conftest.$ac_ext >&5 |
| 26250 | 26733 | ||
| 26251 | ac_cv_lib_gssapi_krb5_gss_init_sec_context=no | 26734 | ac_cv_lib_gssapi_gss_init_sec_context=no |
| 26252 | fi | 26735 | fi |
| 26253 | 26736 | ||
| 26254 | rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \ | 26737 | rm -f core conftest.err conftest.$ac_objext conftest_ipa8_conftest.oo \ |
| 26255 | conftest$ac_exeext conftest.$ac_ext | 26738 | conftest$ac_exeext conftest.$ac_ext |
| 26256 | LIBS=$ac_check_lib_save_LIBS | 26739 | LIBS=$ac_check_lib_save_LIBS |
| 26257 | fi | 26740 | fi |
| 26258 | { echo "$as_me:$LINENO: result: $ac_cv_lib_gssapi_krb5_gss_init_sec_context" >&5 | 26741 | { echo "$as_me:$LINENO: result: $ac_cv_lib_gssapi_gss_init_sec_context" >&5 |
| 26259 | echo "${ECHO_T}$ac_cv_lib_gssapi_krb5_gss_init_sec_context" >&6; } | 26742 | echo "${ECHO_T}$ac_cv_lib_gssapi_gss_init_sec_context" >&6; } |
| 26260 | if test $ac_cv_lib_gssapi_krb5_gss_init_sec_context = yes; then | 26743 | if test $ac_cv_lib_gssapi_gss_init_sec_context = yes; then |
| 26261 | cat >>confdefs.h <<\_ACEOF | 26744 | cat >>confdefs.h <<\_ACEOF |
| 26262 | #define GSSAPI 1 | 26745 | #define GSSAPI 1 |
| 26263 | _ACEOF | 26746 | _ACEOF |
| 26264 | 26747 | ||
| 26265 | K5LIBS="-lgssapi_krb5 $K5LIBS" | 26748 | K5LIBS="-lgssapi $K5LIBS" |
| 26266 | else | 26749 | else |
| 26267 | { echo "$as_me:$LINENO: WARNING: Cannot find any suitable gss-api library - build may fail" >&5 | 26750 | { echo "$as_me:$LINENO: WARNING: Cannot find any suitable gss-api library - build may fail" >&5 |
| 26268 | echo "$as_me: WARNING: Cannot find any suitable gss-api library - build may fail" >&2;} | 26751 | echo "$as_me: WARNING: Cannot find any suitable gss-api library - build may fail" >&2;} |
| @@ -28532,6 +29015,15 @@ fi | |||
| 28532 | 29015 | ||
| 28533 | CFLAGS="$CFLAGS $werror_flags" | 29016 | CFLAGS="$CFLAGS $werror_flags" |
| 28534 | 29017 | ||
| 29018 | if grep "#define BROKEN_GETADDRINFO 1" confdefs.h >/dev/null || \ | ||
| 29019 | test "x$ac_cv_func_getaddrinfo" != "xyes" ; then | ||
| 29020 | TEST_SSH_IPV6=no | ||
| 29021 | |||
| 29022 | else | ||
| 29023 | TEST_SSH_IPV6=yes | ||
| 29024 | |||
| 29025 | fi | ||
| 29026 | |||
| 28535 | 29027 | ||
| 28536 | ac_config_files="$ac_config_files Makefile buildpkg.sh opensshd.init openssh.xml openbsd-compat/Makefile openbsd-compat/regress/Makefile scard/Makefile ssh_prng_cmds survey.sh" | 29028 | ac_config_files="$ac_config_files Makefile buildpkg.sh opensshd.init openssh.xml openbsd-compat/Makefile openbsd-compat/regress/Makefile scard/Makefile ssh_prng_cmds survey.sh" |
| 28537 | 29029 | ||
| @@ -29307,11 +29799,12 @@ MANTYPE!$MANTYPE$ac_delim | |||
| 29307 | mansubdir!$mansubdir$ac_delim | 29799 | mansubdir!$mansubdir$ac_delim |
| 29308 | user_path!$user_path$ac_delim | 29800 | user_path!$user_path$ac_delim |
| 29309 | piddir!$piddir$ac_delim | 29801 | piddir!$piddir$ac_delim |
| 29802 | TEST_SSH_IPV6!$TEST_SSH_IPV6$ac_delim | ||
| 29310 | LIBOBJS!$LIBOBJS$ac_delim | 29803 | LIBOBJS!$LIBOBJS$ac_delim |
| 29311 | LTLIBOBJS!$LTLIBOBJS$ac_delim | 29804 | LTLIBOBJS!$LTLIBOBJS$ac_delim |
| 29312 | _ACEOF | 29805 | _ACEOF |
| 29313 | 29806 | ||
| 29314 | if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 12; then | 29807 | if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 13; then |
| 29315 | break | 29808 | break |
| 29316 | elif $ac_last_try; then | 29809 | elif $ac_last_try; then |
| 29317 | { { echo "$as_me:$LINENO: error: could not make $CONFIG_STATUS" >&5 | 29810 | { { echo "$as_me:$LINENO: error: could not make $CONFIG_STATUS" >&5 |
diff --git a/configure.ac b/configure.ac index 5a7f83bf9..991e0fef3 100644 --- a/configure.ac +++ b/configure.ac | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | # $Id: configure.ac,v 1.383 2007/08/10 04:36:12 dtucker Exp $ | 1 | # $Id: configure.ac,v 1.409 2008/07/09 11:07:19 djm Exp $ |
| 2 | # | 2 | # |
| 3 | # Copyright (c) 1999-2004 Damien Miller | 3 | # Copyright (c) 1999-2004 Damien Miller |
| 4 | # | 4 | # |
| @@ -15,7 +15,7 @@ | |||
| 15 | # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. | 15 | # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. |
| 16 | 16 | ||
| 17 | AC_INIT(OpenSSH, Portable, openssh-unix-dev@mindrot.org) | 17 | AC_INIT(OpenSSH, Portable, openssh-unix-dev@mindrot.org) |
| 18 | AC_REVISION($Revision: 1.383 $) | 18 | AC_REVISION($Revision: 1.409 $) |
| 19 | AC_CONFIG_SRCDIR([ssh.c]) | 19 | AC_CONFIG_SRCDIR([ssh.c]) |
| 20 | 20 | ||
| 21 | AC_CONFIG_HEADER(config.h) | 21 | AC_CONFIG_HEADER(config.h) |
| @@ -90,6 +90,13 @@ AC_C_INLINE | |||
| 90 | 90 | ||
| 91 | AC_CHECK_DECL(LLONG_MAX, have_llong_max=1, , [#include <limits.h>]) | 91 | AC_CHECK_DECL(LLONG_MAX, have_llong_max=1, , [#include <limits.h>]) |
| 92 | 92 | ||
| 93 | use_stack_protector=1 | ||
| 94 | AC_ARG_WITH(stackprotect, | ||
| 95 | [ --without-stackprotect Don't use compiler's stack protection], [ | ||
| 96 | if test "x$withval" = "xno"; then | ||
| 97 | use_stack_protector=0 | ||
| 98 | fi ]) | ||
| 99 | |||
| 93 | if test "$GCC" = "yes" || test "$GCC" = "egcs"; then | 100 | if test "$GCC" = "yes" || test "$GCC" = "egcs"; then |
| 94 | CFLAGS="$CFLAGS -Wall -Wpointer-arith -Wuninitialized" | 101 | CFLAGS="$CFLAGS -Wall -Wpointer-arith -Wuninitialized" |
| 95 | GCC_VER=`$CC -v 2>&1 | $AWK '/gcc version /{print $3}'` | 102 | GCC_VER=`$CC -v 2>&1 | $AWK '/gcc version /{print $3}'` |
| @@ -100,11 +107,61 @@ if test "$GCC" = "yes" || test "$GCC" = "egcs"; then | |||
| 100 | no_attrib_nonnull=1 | 107 | no_attrib_nonnull=1 |
| 101 | ;; | 108 | ;; |
| 102 | 2.*) no_attrib_nonnull=1 ;; | 109 | 2.*) no_attrib_nonnull=1 ;; |
| 103 | 3.*) CFLAGS="$CFLAGS -Wsign-compare" ;; | 110 | 3.*) CFLAGS="$CFLAGS -Wsign-compare -Wformat-security" ;; |
| 104 | 4.*) CFLAGS="$CFLAGS -Wsign-compare -Wno-pointer-sign" ;; | 111 | 4.*) CFLAGS="$CFLAGS -Wsign-compare -Wno-pointer-sign -Wformat-security" ;; |
| 105 | *) ;; | 112 | *) ;; |
| 106 | esac | 113 | esac |
| 107 | 114 | ||
| 115 | AC_MSG_CHECKING(if $CC accepts -fno-builtin-memset) | ||
| 116 | saved_CFLAGS="$CFLAGS" | ||
| 117 | CFLAGS="$CFLAGS -fno-builtin-memset" | ||
| 118 | AC_LINK_IFELSE( [AC_LANG_SOURCE([[ | ||
| 119 | #include <string.h> | ||
| 120 | int main(void){char b[10]; memset(b, 0, sizeof(b));} | ||
| 121 | ]])], | ||
| 122 | [ AC_MSG_RESULT(yes) ], | ||
| 123 | [ AC_MSG_RESULT(no) | ||
| 124 | CFLAGS="$saved_CFLAGS" ] | ||
| 125 | ) | ||
| 126 | |||
| 127 | # -fstack-protector-all doesn't always work for some GCC versions | ||
| 128 | # and/or platforms, so we test if we can. If it's not supported | ||
| 129 | # on a give platform gcc will emit a warning so we use -Werror. | ||
| 130 | if test "x$use_stack_protector" = "x1"; then | ||
| 131 | for t in -fstack-protector-all -fstack-protector; do | ||
| 132 | AC_MSG_CHECKING(if $CC supports $t) | ||
| 133 | saved_CFLAGS="$CFLAGS" | ||
| 134 | saved_LDFLAGS="$LDFLAGS" | ||
| 135 | CFLAGS="$CFLAGS $t -Werror" | ||
| 136 | LDFLAGS="$LDFLAGS $t -Werror" | ||
| 137 | AC_LINK_IFELSE( | ||
| 138 | [AC_LANG_SOURCE([ | ||
| 139 | #include <stdlib.h> | ||
| 140 | int main(void){return 0;} | ||
| 141 | ])], | ||
| 142 | [ AC_MSG_RESULT(yes) | ||
| 143 | CFLAGS="$saved_CFLAGS $t" | ||
| 144 | LDFLAGS="$saved_LDFLAGS $t" | ||
| 145 | AC_MSG_CHECKING(if $t works) | ||
| 146 | AC_RUN_IFELSE( | ||
| 147 | [AC_LANG_SOURCE([ | ||
| 148 | #include <stdlib.h> | ||
| 149 | int main(void){exit(0);} | ||
| 150 | ])], | ||
| 151 | [ AC_MSG_RESULT(yes) | ||
| 152 | break ], | ||
| 153 | [ AC_MSG_RESULT(no) ], | ||
| 154 | [ AC_MSG_WARN([cross compiling: cannot test]) | ||
| 155 | break ] | ||
| 156 | ) | ||
| 157 | ], | ||
| 158 | [ AC_MSG_RESULT(no) ] | ||
| 159 | ) | ||
| 160 | CFLAGS="$saved_CFLAGS" | ||
| 161 | LDFLAGS="$saved_LDFLAGS" | ||
| 162 | done | ||
| 163 | fi | ||
| 164 | |||
| 108 | if test -z "$have_llong_max"; then | 165 | if test -z "$have_llong_max"; then |
| 109 | # retry LLONG_MAX with -std=gnu99, needed on some Linuxes | 166 | # retry LLONG_MAX with -std=gnu99, needed on some Linuxes |
| 110 | unset ac_cv_have_decl_LLONG_MAX | 167 | unset ac_cv_have_decl_LLONG_MAX |
| @@ -222,7 +279,9 @@ AC_CHECK_HEADERS( \ | |||
| 222 | sys/cdefs.h \ | 279 | sys/cdefs.h \ |
| 223 | sys/dir.h \ | 280 | sys/dir.h \ |
| 224 | sys/mman.h \ | 281 | sys/mman.h \ |
| 282 | sys/mount.h \ | ||
| 225 | sys/ndir.h \ | 283 | sys/ndir.h \ |
| 284 | sys/poll.h \ | ||
| 226 | sys/prctl.h \ | 285 | sys/prctl.h \ |
| 227 | sys/pstat.h \ | 286 | sys/pstat.h \ |
| 228 | sys/select.h \ | 287 | sys/select.h \ |
| @@ -230,6 +289,7 @@ AC_CHECK_HEADERS( \ | |||
| 230 | sys/stream.h \ | 289 | sys/stream.h \ |
| 231 | sys/stropts.h \ | 290 | sys/stropts.h \ |
| 232 | sys/strtio.h \ | 291 | sys/strtio.h \ |
| 292 | sys/statvfs.h \ | ||
| 233 | sys/sysmacros.h \ | 293 | sys/sysmacros.h \ |
| 234 | sys/time.h \ | 294 | sys/time.h \ |
| 235 | sys/timers.h \ | 295 | sys/timers.h \ |
| @@ -343,7 +403,7 @@ int main(void) { exit(0); } | |||
| 343 | [], | 403 | [], |
| 344 | [#include <usersec.h>] | 404 | [#include <usersec.h>] |
| 345 | ) | 405 | ) |
| 346 | AC_CHECK_FUNCS(setauthdb) | 406 | AC_CHECK_FUNCS(getgrset setauthdb) |
| 347 | AC_CHECK_DECL(F_CLOSEM, | 407 | AC_CHECK_DECL(F_CLOSEM, |
| 348 | AC_DEFINE(HAVE_FCNTL_CLOSEM, 1, [Use F_CLOSEM fcntl for closefrom]), | 408 | AC_DEFINE(HAVE_FCNTL_CLOSEM, 1, [Use F_CLOSEM fcntl for closefrom]), |
| 349 | [], | 409 | [], |
| @@ -405,6 +465,7 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16)) | |||
| 405 | AC_DEFINE(SETEUID_BREAKS_SETUID) | 465 | AC_DEFINE(SETEUID_BREAKS_SETUID) |
| 406 | AC_DEFINE(BROKEN_SETREUID) | 466 | AC_DEFINE(BROKEN_SETREUID) |
| 407 | AC_DEFINE(BROKEN_SETREGID) | 467 | AC_DEFINE(BROKEN_SETREGID) |
| 468 | AC_DEFINE(BROKEN_GLOB, 1, [OS X glob does not do what we expect]) | ||
| 408 | AC_DEFINE_UNQUOTED(BIND_8_COMPAT, 1, | 469 | AC_DEFINE_UNQUOTED(BIND_8_COMPAT, 1, |
| 409 | [Define if your resolver libs need this for getrrsetbyname]) | 470 | [Define if your resolver libs need this for getrrsetbyname]) |
| 410 | AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way]) | 471 | AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way]) |
| @@ -412,6 +473,11 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16)) | |||
| 412 | [Use tunnel device compatibility to OpenBSD]) | 473 | [Use tunnel device compatibility to OpenBSD]) |
| 413 | AC_DEFINE(SSH_TUN_PREPEND_AF, 1, | 474 | AC_DEFINE(SSH_TUN_PREPEND_AF, 1, |
| 414 | [Prepend the address family to IP tunnel traffic]) | 475 | [Prepend the address family to IP tunnel traffic]) |
| 476 | m4_pattern_allow(AU_IPv) | ||
| 477 | AC_CHECK_DECL(AU_IPv4, [], | ||
| 478 | AC_DEFINE(AU_IPv4, 0, [System only supports IPv4 audit records]) | ||
| 479 | [#include <bsm/audit.h>] | ||
| 480 | ) | ||
| 415 | AC_MSG_CHECKING(if we have the Security Authorization Session API) | 481 | AC_MSG_CHECKING(if we have the Security Authorization Session API) |
| 416 | AC_TRY_COMPILE([#include <Security/AuthSession.h>], | 482 | AC_TRY_COMPILE([#include <Security/AuthSession.h>], |
| 417 | [SessionCreate(0, 0);], | 483 | [SessionCreate(0, 0);], |
| @@ -436,7 +502,7 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16)) | |||
| 436 | fi], | 502 | fi], |
| 437 | [AC_MSG_RESULT(no)] | 503 | [AC_MSG_RESULT(no)] |
| 438 | ) | 504 | ) |
| 439 | ;; | 505 | ;; |
| 440 | *-*-dragonfly*) | 506 | *-*-dragonfly*) |
| 441 | SSHDLIBS="$SSHDLIBS -lcrypt" | 507 | SSHDLIBS="$SSHDLIBS -lcrypt" |
| 442 | ;; | 508 | ;; |
| @@ -531,7 +597,6 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16)) | |||
| 531 | no_dev_ptmx=1 | 597 | no_dev_ptmx=1 |
| 532 | check_for_libcrypt_later=1 | 598 | check_for_libcrypt_later=1 |
| 533 | check_for_openpty_ctty_bug=1 | 599 | check_for_openpty_ctty_bug=1 |
| 534 | AC_DEFINE(DONT_TRY_OTHER_AF, 1, [Workaround more Linux IPv6 quirks]) | ||
| 535 | AC_DEFINE(PAM_TTY_KLUDGE, 1, | 600 | AC_DEFINE(PAM_TTY_KLUDGE, 1, |
| 536 | [Work around problematic Linux PAM modules handling of PAM_TTY]) | 601 | [Work around problematic Linux PAM modules handling of PAM_TTY]) |
| 537 | AC_DEFINE(LOCKED_PASSWD_PREFIX, "!", | 602 | AC_DEFINE(LOCKED_PASSWD_PREFIX, "!", |
| @@ -582,6 +647,7 @@ mips-sony-bsd|mips-sony-newsos4) | |||
| 582 | AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way]) | 647 | AC_DEFINE(SSH_TUN_FREEBSD, 1, [Open tunnel devices the FreeBSD way]) |
| 583 | AC_CHECK_HEADER([net/if_tap.h], , | 648 | AC_CHECK_HEADER([net/if_tap.h], , |
| 584 | AC_DEFINE(SSH_TUN_NO_L2, 1, [No layer 2 tunnel support])) | 649 | AC_DEFINE(SSH_TUN_NO_L2, 1, [No layer 2 tunnel support])) |
| 650 | AC_DEFINE(BROKEN_GLOB, 1, [FreeBSD glob does not do what we need]) | ||
| 585 | ;; | 651 | ;; |
| 586 | *-*-bsdi*) | 652 | *-*-bsdi*) |
| 587 | AC_DEFINE(SETEUID_BREAKS_SETUID) | 653 | AC_DEFINE(SETEUID_BREAKS_SETUID) |
| @@ -808,6 +874,7 @@ mips-sony-bsd|mips-sony-newsos4) | |||
| 808 | AC_DEFINE(SETEUID_BREAKS_SETUID) | 874 | AC_DEFINE(SETEUID_BREAKS_SETUID) |
| 809 | AC_DEFINE(BROKEN_SETREUID) | 875 | AC_DEFINE(BROKEN_SETREUID) |
| 810 | AC_DEFINE(BROKEN_SETREGID) | 876 | AC_DEFINE(BROKEN_SETREGID) |
| 877 | AC_DEFINE(BROKEN_READV_COMPARISON, 1, [Can't do comparisons on readv]) | ||
| 811 | ;; | 878 | ;; |
| 812 | 879 | ||
| 813 | *-*-nto-qnx*) | 880 | *-*-nto-qnx*) |
| @@ -818,6 +885,7 @@ mips-sony-bsd|mips-sony-newsos4) | |||
| 818 | AC_DEFINE(MISSING_FD_MASK, 1, [Define on *nto-qnx systems]) | 885 | AC_DEFINE(MISSING_FD_MASK, 1, [Define on *nto-qnx systems]) |
| 819 | AC_DEFINE(DISABLE_LASTLOG) | 886 | AC_DEFINE(DISABLE_LASTLOG) |
| 820 | AC_DEFINE(SSHD_ACQUIRES_CTTY) | 887 | AC_DEFINE(SSHD_ACQUIRES_CTTY) |
| 888 | AC_DEFINE(BROKEN_SHADOW_EXPIRE, 1, [QNX shadow support is broken]) | ||
| 821 | enable_etc_default_login=no # has incompatible /etc/default/login | 889 | enable_etc_default_login=no # has incompatible /etc/default/login |
| 822 | case "$host" in | 890 | case "$host" in |
| 823 | *-*-nto-qnx6*) | 891 | *-*-nto-qnx6*) |
| @@ -1013,7 +1081,7 @@ dnl Checks for libutil functions | |||
| 1013 | AC_CHECK_HEADERS(libutil.h) | 1081 | AC_CHECK_HEADERS(libutil.h) |
| 1014 | AC_SEARCH_LIBS(login, util bsd, [AC_DEFINE(HAVE_LOGIN, 1, | 1082 | AC_SEARCH_LIBS(login, util bsd, [AC_DEFINE(HAVE_LOGIN, 1, |
| 1015 | [Define if your libraries define login()])]) | 1083 | [Define if your libraries define login()])]) |
| 1016 | AC_CHECK_FUNCS(logout updwtmp logwtmp) | 1084 | AC_CHECK_FUNCS(fmt_scaled logout updwtmp logwtmp) |
| 1017 | 1085 | ||
| 1018 | AC_FUNC_STRFTIME | 1086 | AC_FUNC_STRFTIME |
| 1019 | 1087 | ||
| @@ -1247,7 +1315,7 @@ AC_ARG_WITH(audit, | |||
| 1247 | AC_CHECK_FUNCS(getaudit, [], | 1315 | AC_CHECK_FUNCS(getaudit, [], |
| 1248 | [AC_MSG_ERROR(BSM enabled and required function not found)]) | 1316 | [AC_MSG_ERROR(BSM enabled and required function not found)]) |
| 1249 | # These are optional | 1317 | # These are optional |
| 1250 | AC_CHECK_FUNCS(getaudit_addr) | 1318 | AC_CHECK_FUNCS(getaudit_addr aug_get_machine) |
| 1251 | AC_DEFINE(USE_BSM_AUDIT, 1, [Use BSM audit module]) | 1319 | AC_DEFINE(USE_BSM_AUDIT, 1, [Use BSM audit module]) |
| 1252 | ;; | 1320 | ;; |
| 1253 | debug) | 1321 | debug) |
| @@ -1267,6 +1335,8 @@ AC_ARG_WITH(audit, | |||
| 1267 | dnl Checks for library functions. Please keep in alphabetical order | 1335 | dnl Checks for library functions. Please keep in alphabetical order |
| 1268 | AC_CHECK_FUNCS( \ | 1336 | AC_CHECK_FUNCS( \ |
| 1269 | arc4random \ | 1337 | arc4random \ |
| 1338 | arc4random_buf \ | ||
| 1339 | arc4random_uniform \ | ||
| 1270 | asprintf \ | 1340 | asprintf \ |
| 1271 | b64_ntop \ | 1341 | b64_ntop \ |
| 1272 | __b64_ntop \ | 1342 | __b64_ntop \ |
| @@ -1280,6 +1350,7 @@ AC_CHECK_FUNCS( \ | |||
| 1280 | fchmod \ | 1350 | fchmod \ |
| 1281 | fchown \ | 1351 | fchown \ |
| 1282 | freeaddrinfo \ | 1352 | freeaddrinfo \ |
| 1353 | fstatvfs \ | ||
| 1283 | futimes \ | 1354 | futimes \ |
| 1284 | getaddrinfo \ | 1355 | getaddrinfo \ |
| 1285 | getcwd \ | 1356 | getcwd \ |
| @@ -1331,6 +1402,8 @@ AC_CHECK_FUNCS( \ | |||
| 1331 | sigvec \ | 1402 | sigvec \ |
| 1332 | snprintf \ | 1403 | snprintf \ |
| 1333 | socketpair \ | 1404 | socketpair \ |
| 1405 | statfs \ | ||
| 1406 | statvfs \ | ||
| 1334 | strdup \ | 1407 | strdup \ |
| 1335 | strerror \ | 1408 | strerror \ |
| 1336 | strlcat \ | 1409 | strlcat \ |
| @@ -2037,7 +2110,10 @@ AC_CHECK_FUNCS(SHA256_Update EVP_sha256) | |||
| 2037 | saved_LIBS="$LIBS" | 2110 | saved_LIBS="$LIBS" |
| 2038 | AC_CHECK_LIB(iaf, ia_openinfo, [ | 2111 | AC_CHECK_LIB(iaf, ia_openinfo, [ |
| 2039 | LIBS="$LIBS -liaf" | 2112 | LIBS="$LIBS -liaf" |
| 2040 | AC_CHECK_FUNCS(set_id, [SSHDLIBS="$SSHDLIBS -liaf"]) | 2113 | AC_CHECK_FUNCS(set_id, [SSHDLIBS="$SSHDLIBS -liaf" |
| 2114 | AC_DEFINE(HAVE_LIBIAF, 1, | ||
| 2115 | [Define if system has libiaf that supports set_id]) | ||
| 2116 | ]) | ||
| 2041 | ]) | 2117 | ]) |
| 2042 | LIBS="$saved_LIBS" | 2118 | LIBS="$saved_LIBS" |
| 2043 | 2119 | ||
| @@ -2621,6 +2697,18 @@ fi | |||
| 2621 | TYPE_SOCKLEN_T | 2697 | TYPE_SOCKLEN_T |
| 2622 | 2698 | ||
| 2623 | AC_CHECK_TYPES(sig_atomic_t,,,[#include <signal.h>]) | 2699 | AC_CHECK_TYPES(sig_atomic_t,,,[#include <signal.h>]) |
| 2700 | AC_CHECK_TYPES([fsblkcnt_t, fsfilcnt_t],,,[ | ||
| 2701 | #include <sys/types.h> | ||
| 2702 | #ifdef HAVE_SYS_BITYPES_H | ||
| 2703 | #include <sys/bitypes.h> | ||
| 2704 | #endif | ||
| 2705 | #ifdef HAVE_SYS_STATFS_H | ||
| 2706 | #include <sys/statfs.h> | ||
| 2707 | #endif | ||
| 2708 | #ifdef HAVE_SYS_STATVFS_H | ||
| 2709 | #include <sys/statvfs.h> | ||
| 2710 | #endif | ||
| 2711 | ]) | ||
| 2624 | 2712 | ||
| 2625 | AC_CHECK_TYPES(in_addr_t,,, | 2713 | AC_CHECK_TYPES(in_addr_t,,, |
| 2626 | [#include <sys/types.h> | 2714 | [#include <sys/types.h> |
| @@ -2983,6 +3071,16 @@ if test "x$ac_cv_have_accrights_in_msghdr" = "xyes" ; then | |||
| 2983 | file descriptor passing]) | 3071 | file descriptor passing]) |
| 2984 | fi | 3072 | fi |
| 2985 | 3073 | ||
| 3074 | AC_MSG_CHECKING(if f_fsid has val members) | ||
| 3075 | AC_TRY_COMPILE([ | ||
| 3076 | #include <sys/types.h> | ||
| 3077 | #include <sys/statvfs.h>], | ||
| 3078 | [struct fsid_t t; t.val[0] = 0;], | ||
| 3079 | [ AC_MSG_RESULT(yes) | ||
| 3080 | AC_DEFINE(FSID_HAS_VAL, 1, f_fsid has members) ], | ||
| 3081 | [ AC_MSG_RESULT(no) ] | ||
| 3082 | ) | ||
| 3083 | |||
| 2986 | AC_CACHE_CHECK([for msg_control field in struct msghdr], | 3084 | AC_CACHE_CHECK([for msg_control field in struct msghdr], |
| 2987 | ac_cv_have_control_in_msghdr, [ | 3085 | ac_cv_have_control_in_msghdr, [ |
| 2988 | AC_COMPILE_IFELSE( | 3086 | AC_COMPILE_IFELSE( |
| @@ -3234,7 +3332,7 @@ int main() { return 0; } | |||
| 3234 | SELINUX_MSG="no" | 3332 | SELINUX_MSG="no" |
| 3235 | LIBSELINUX="" | 3333 | LIBSELINUX="" |
| 3236 | AC_ARG_WITH(selinux, | 3334 | AC_ARG_WITH(selinux, |
| 3237 | [ --with-selinux Enable SELinux support], | 3335 | [ --with-selinux Enable SELinux support], |
| 3238 | [ if test "x$withval" != "xno" ; then | 3336 | [ if test "x$withval" != "xno" ; then |
| 3239 | save_LIBS="$LIBS" | 3337 | save_LIBS="$LIBS" |
| 3240 | AC_DEFINE(WITH_SELINUX,1,[Define if you want SELinux support.]) | 3338 | AC_DEFINE(WITH_SELINUX,1,[Define if you want SELinux support.]) |
| @@ -3314,12 +3412,12 @@ AC_ARG_WITH(kerberos5, | |||
| 3314 | ) | 3412 | ) |
| 3315 | AC_SEARCH_LIBS(dn_expand, resolv) | 3413 | AC_SEARCH_LIBS(dn_expand, resolv) |
| 3316 | 3414 | ||
| 3317 | AC_CHECK_LIB(gssapi,gss_init_sec_context, | 3415 | AC_CHECK_LIB(gssapi_krb5, gss_init_sec_context, |
| 3318 | [ AC_DEFINE(GSSAPI) | 3416 | [ AC_DEFINE(GSSAPI) |
| 3319 | K5LIBS="-lgssapi $K5LIBS" ], | 3417 | K5LIBS="-lgssapi_krb5 $K5LIBS" ], |
| 3320 | [ AC_CHECK_LIB(gssapi_krb5,gss_init_sec_context, | 3418 | [ AC_CHECK_LIB(gssapi, gss_init_sec_context, |
| 3321 | [ AC_DEFINE(GSSAPI) | 3419 | [ AC_DEFINE(GSSAPI) |
| 3322 | K5LIBS="-lgssapi_krb5 $K5LIBS" ], | 3420 | K5LIBS="-lgssapi $K5LIBS" ], |
| 3323 | AC_MSG_WARN([Cannot find any suitable gss-api library - build may fail]), | 3421 | AC_MSG_WARN([Cannot find any suitable gss-api library - build may fail]), |
| 3324 | $K5LIBS) | 3422 | $K5LIBS) |
| 3325 | ], | 3423 | ], |
| @@ -4018,6 +4116,13 @@ dnl Adding -Werror to CFLAGS early prevents configure tests from running. | |||
| 4018 | dnl Add now. | 4116 | dnl Add now. |
| 4019 | CFLAGS="$CFLAGS $werror_flags" | 4117 | CFLAGS="$CFLAGS $werror_flags" |
| 4020 | 4118 | ||
| 4119 | if grep "#define BROKEN_GETADDRINFO 1" confdefs.h >/dev/null || \ | ||
| 4120 | test "x$ac_cv_func_getaddrinfo" != "xyes" ; then | ||
| 4121 | AC_SUBST(TEST_SSH_IPV6, no) | ||
| 4122 | else | ||
| 4123 | AC_SUBST(TEST_SSH_IPV6, yes) | ||
| 4124 | fi | ||
| 4125 | |||
| 4021 | AC_EXEEXT | 4126 | AC_EXEEXT |
| 4022 | AC_CONFIG_FILES([Makefile buildpkg.sh opensshd.init openssh.xml \ | 4127 | AC_CONFIG_FILES([Makefile buildpkg.sh opensshd.init openssh.xml \ |
| 4023 | openbsd-compat/Makefile openbsd-compat/regress/Makefile \ | 4128 | openbsd-compat/Makefile openbsd-compat/regress/Makefile \ |
diff --git a/contrib/caldera/openssh.spec b/contrib/caldera/openssh.spec index 9cb5cb464..32d175d4b 100644 --- a/contrib/caldera/openssh.spec +++ b/contrib/caldera/openssh.spec | |||
| @@ -17,11 +17,11 @@ | |||
| 17 | #old cvs stuff. please update before use. may be deprecated. | 17 | #old cvs stuff. please update before use. may be deprecated. |
| 18 | %define use_stable 1 | 18 | %define use_stable 1 |
| 19 | %if %{use_stable} | 19 | %if %{use_stable} |
| 20 | %define version 4.7p1 | 20 | %define version 5.1p1 |
| 21 | %define cvs %{nil} | 21 | %define cvs %{nil} |
| 22 | %define release 1 | 22 | %define release 1 |
| 23 | %else | 23 | %else |
| 24 | %define version 4.1p1 | 24 | %define version 5.1p1 |
| 25 | %define cvs cvs20050315 | 25 | %define cvs cvs20050315 |
| 26 | %define release 0r1 | 26 | %define release 0r1 |
| 27 | %endif | 27 | %endif |
| @@ -342,6 +342,7 @@ fi | |||
| 342 | %config %{SVIcdir}/sshd | 342 | %config %{SVIcdir}/sshd |
| 343 | %{_libexecdir}/sftp-server | 343 | %{_libexecdir}/sftp-server |
| 344 | %{_sbindir}/sshd | 344 | %{_sbindir}/sshd |
| 345 | %{_mandir}/man5/moduli.5.gz | ||
| 345 | %{_mandir}/man5/sshd_config.5.gz | 346 | %{_mandir}/man5/sshd_config.5.gz |
| 346 | %{_mandir}/man8/sftp-server.8.gz | 347 | %{_mandir}/man8/sftp-server.8.gz |
| 347 | %{_mandir}/man8/sshd.8.gz | 348 | %{_mandir}/man8/sshd.8.gz |
| @@ -357,4 +358,4 @@ fi | |||
| 357 | * Mon Jan 01 1998 ... | 358 | * Mon Jan 01 1998 ... |
| 358 | Template Version: 1.31 | 359 | Template Version: 1.31 |
| 359 | 360 | ||
| 360 | $Id: openssh.spec,v 1.61 2007/08/15 09:22:20 dtucker Exp $ | 361 | $Id: openssh.spec,v 1.65 2008/07/21 08:21:53 djm Exp $ |
diff --git a/contrib/cygwin/Makefile b/contrib/cygwin/Makefile index 09e8ea2db..3e2d26404 100644 --- a/contrib/cygwin/Makefile +++ b/contrib/cygwin/Makefile | |||
| @@ -8,6 +8,7 @@ sshdocdir=$(docdir)/openssh | |||
| 8 | cygdocdir=$(docdir)/Cygwin | 8 | cygdocdir=$(docdir)/Cygwin |
| 9 | sysconfdir=/etc | 9 | sysconfdir=/etc |
| 10 | defaultsdir=$(sysconfdir)/defaults/etc | 10 | defaultsdir=$(sysconfdir)/defaults/etc |
| 11 | inetdefdir=$(defaultsdir)/inetd.d | ||
| 11 | PRIVSEP_PATH=/var/empty | 12 | PRIVSEP_PATH=/var/empty |
| 12 | INSTALL=/usr/bin/install -c | 13 | INSTALL=/usr/bin/install -c |
| 13 | 14 | ||
| @@ -27,6 +28,10 @@ move-config-files: $(DESTDIR)$(sysconfdir)/ssh_config $(DESTDIR)$(sysconfdir)/ss | |||
| 27 | remove-empty-dir: | 28 | remove-empty-dir: |
| 28 | rm -rf $(DESTDIR)$(PRIVSEP_PATH) | 29 | rm -rf $(DESTDIR)$(PRIVSEP_PATH) |
| 29 | 30 | ||
| 31 | install-inetd-config: | ||
| 32 | $(srcdir)/mkinstalldirs $(DESTDIR)$(inetdefdir) | ||
| 33 | $(INSTALL) -m 644 sshd-inetd $(DESTDIR)$(inetdefdir)/sshd-inetd | ||
| 34 | |||
| 30 | install-sshdoc: | 35 | install-sshdoc: |
| 31 | $(srcdir)/mkinstalldirs $(DESTDIR)$(sshdocdir) | 36 | $(srcdir)/mkinstalldirs $(DESTDIR)$(sshdocdir) |
| 32 | $(INSTALL) -m 644 $(srcdir)/CREDITS $(DESTDIR)$(sshdocdir)/CREDITS | 37 | $(INSTALL) -m 644 $(srcdir)/CREDITS $(DESTDIR)$(sshdocdir)/CREDITS |
| @@ -52,5 +57,5 @@ install-scripts: ssh-host-config ssh-user-config | |||
| 52 | $(INSTALL) -m 755 ssh-host-config $(DESTDIR)$(bindir)/ssh-host-config | 57 | $(INSTALL) -m 755 ssh-host-config $(DESTDIR)$(bindir)/ssh-host-config |
| 53 | $(INSTALL) -m 755 ssh-user-config $(DESTDIR)$(bindir)/ssh-user-config | 58 | $(INSTALL) -m 755 ssh-user-config $(DESTDIR)$(bindir)/ssh-user-config |
| 54 | 59 | ||
| 55 | cygwin-postinstall: move-config-files remove-empty-dir install-doc install-scripts | 60 | cygwin-postinstall: move-config-files remove-empty-dir install-inetd-config install-doc install-scripts |
| 56 | @echo "Cygwin specific configuration finished." | 61 | @echo "Cygwin specific configuration finished." |
diff --git a/contrib/cygwin/ssh-host-config b/contrib/cygwin/ssh-host-config index e2ad69f19..bbb6da4c4 100644 --- a/contrib/cygwin/ssh-host-config +++ b/contrib/cygwin/ssh-host-config | |||
| @@ -4,6 +4,15 @@ | |||
| 4 | # | 4 | # |
| 5 | # This file is part of the Cygwin port of OpenSSH. | 5 | # This file is part of the Cygwin port of OpenSSH. |
| 6 | 6 | ||
| 7 | # ====================================================================== | ||
| 8 | # Initialization | ||
| 9 | # ====================================================================== | ||
| 10 | PROGNAME=$(basename $0) | ||
| 11 | _tdir=$(dirname $0) | ||
| 12 | PROGDIR=$(cd $_tdir && pwd) | ||
| 13 | |||
| 14 | CSIH_SCRIPT=/usr/share/csih/cygwin-service-installation-helper.sh | ||
| 15 | |||
| 7 | # Subdirectory where the new package is being installed | 16 | # Subdirectory where the new package is being installed |
| 8 | PREFIX=/usr | 17 | PREFIX=/usr |
| 9 | 18 | ||
| @@ -11,43 +20,371 @@ PREFIX=/usr | |||
| 11 | SYSCONFDIR=/etc | 20 | SYSCONFDIR=/etc |
| 12 | LOCALSTATEDIR=/var | 21 | LOCALSTATEDIR=/var |
| 13 | 22 | ||
| 14 | progname=$0 | 23 | source ${CSIH_SCRIPT} |
| 15 | auto_answer="" | ||
| 16 | port_number=22 | ||
| 17 | 24 | ||
| 25 | port_number=22 | ||
| 18 | privsep_configured=no | 26 | privsep_configured=no |
| 19 | privsep_used=yes | 27 | privsep_used=yes |
| 20 | sshd_in_passwd=no | 28 | cygwin_value="ntsec" |
| 21 | sshd_in_sam=no | 29 | password_value= |
| 30 | |||
| 31 | # ====================================================================== | ||
| 32 | # Routine: create_host_keys | ||
| 33 | # ====================================================================== | ||
| 34 | create_host_keys() { | ||
| 35 | if [ ! -f "${SYSCONFDIR}/ssh_host_key" ] | ||
| 36 | then | ||
| 37 | csih_inform "Generating ${SYSCONFDIR}/ssh_host_key" | ||
| 38 | ssh-keygen -t rsa1 -f ${SYSCONFDIR}/ssh_host_key -N '' > /dev/null | ||
| 39 | fi | ||
| 40 | |||
| 41 | if [ ! -f "${SYSCONFDIR}/ssh_host_rsa_key" ] | ||
| 42 | then | ||
| 43 | csih_inform "Generating ${SYSCONFDIR}/ssh_host_rsa_key" | ||
| 44 | ssh-keygen -t rsa -f ${SYSCONFDIR}/ssh_host_rsa_key -N '' > /dev/null | ||
| 45 | fi | ||
| 46 | |||
| 47 | if [ ! -f "${SYSCONFDIR}/ssh_host_dsa_key" ] | ||
| 48 | then | ||
| 49 | csih_inform "Generating ${SYSCONFDIR}/ssh_host_dsa_key" | ||
| 50 | ssh-keygen -t dsa -f ${SYSCONFDIR}/ssh_host_dsa_key -N '' > /dev/null | ||
| 51 | fi | ||
| 52 | } # --- End of create_host_keys --- # | ||
| 53 | |||
| 54 | # ====================================================================== | ||
| 55 | # Routine: update_services_file | ||
| 56 | # ====================================================================== | ||
| 57 | update_services_file() { | ||
| 58 | local _my_etcdir="/ssh-host-config.$$" | ||
| 59 | local _win_etcdir | ||
| 60 | local _services | ||
| 61 | local _spaces | ||
| 62 | local _serv_tmp | ||
| 63 | local _wservices | ||
| 64 | |||
| 65 | if csih_is_nt | ||
| 66 | then | ||
| 67 | _win_etcdir="${SYSTEMROOT}\\system32\\drivers\\etc" | ||
| 68 | _services="${_my_etcdir}/services" | ||
| 69 | # On NT, 27 spaces, no space after the hash | ||
| 70 | _spaces=" #" | ||
| 71 | else | ||
| 72 | _win_etcdir="${WINDIR}" | ||
| 73 | _services="${_my_etcdir}/SERVICES" | ||
| 74 | # On 9x, 18 spaces (95 is very touchy), a space after the hash | ||
| 75 | _spaces=" # " | ||
| 76 | fi | ||
| 77 | _serv_tmp="${_my_etcdir}/srv.out.$$" | ||
| 78 | |||
| 79 | mount -t -f "${_win_etcdir}" "${_my_etcdir}" | ||
| 80 | |||
| 81 | # Depends on the above mount | ||
| 82 | _wservices=`cygpath -w "${_services}"` | ||
| 83 | |||
| 84 | # Remove sshd 22/port from services | ||
| 85 | if [ `grep -q 'sshd[ \t][ \t]*22' "${_services}"; echo $?` -eq 0 ] | ||
| 86 | then | ||
| 87 | grep -v 'sshd[ \t][ \t]*22' "${_services}" > "${_serv_tmp}" | ||
| 88 | if [ -f "${_serv_tmp}" ] | ||
| 89 | then | ||
| 90 | if mv "${_serv_tmp}" "${_services}" | ||
| 91 | then | ||
| 92 | csih_inform "Removing sshd from ${_wservices}" | ||
| 93 | else | ||
| 94 | csih_warning "Removing sshd from ${_wservices} failed!" | ||
| 95 | fi | ||
| 96 | rm -f "${_serv_tmp}" | ||
| 97 | else | ||
| 98 | csih_warning "Removing sshd from ${_wservices} failed!" | ||
| 99 | fi | ||
| 100 | fi | ||
| 101 | |||
| 102 | # Add ssh 22/tcp and ssh 22/udp to services | ||
| 103 | if [ `grep -q 'ssh[ \t][ \t]*22' "${_services}"; echo $?` -ne 0 ] | ||
| 104 | then | ||
| 105 | if awk '{ if ( $2 ~ /^23\/tcp/ ) print "ssh 22/tcp'"${_spaces}"'SSH Remote Login Protocol\nssh 22/udp'"${_spaces}"'SSH Remote Login Protocol"; print $0; }' < "${_services}" > "${_serv_tmp}" | ||
| 106 | then | ||
| 107 | if mv "${_serv_tmp}" "${_services}" | ||
| 108 | then | ||
| 109 | csih_inform "Added ssh to ${_wservices}" | ||
| 110 | else | ||
| 111 | csih_warning "Adding ssh to ${_wservices} failed!" | ||
| 112 | fi | ||
| 113 | rm -f "${_serv_tmp}" | ||
| 114 | else | ||
| 115 | csih_warning "Adding ssh to ${_wservices} failed!" | ||
| 116 | fi | ||
| 117 | fi | ||
| 118 | umount "${_my_etcdir}" | ||
| 119 | } # --- End of update_services_file --- # | ||
| 120 | |||
| 121 | # ====================================================================== | ||
| 122 | # Routine: sshd_privsep | ||
| 123 | # MODIFIES: privsep_configured privsep_used | ||
| 124 | # ====================================================================== | ||
| 125 | sshd_privsep() { | ||
| 126 | local sshdconfig_tmp | ||
| 22 | 127 | ||
| 23 | request() | 128 | if [ "${privsep_configured}" != "yes" ] |
| 24 | { | 129 | then |
| 25 | if [ "${auto_answer}" = "yes" ] | 130 | if csih_is_nt |
| 131 | then | ||
| 132 | csih_inform "Privilege separation is set to yes by default since OpenSSH 3.3." | ||
| 133 | csih_inform "However, this requires a non-privileged account called 'sshd'." | ||
| 134 | csih_inform "For more info on privilege separation read /usr/share/doc/openssh/README.privsep." | ||
| 135 | if csih_request "Should privilege separation be used?" | ||
| 136 | then | ||
| 137 | privsep_used=yes | ||
| 138 | if ! csih_create_unprivileged_user sshd | ||
| 139 | then | ||
| 140 | csih_warning "Couldn't create user 'sshd'!" | ||
| 141 | csih_warning "Privilege separation set to 'no' again!" | ||
| 142 | csih_warning "Check your ${SYSCONFDIR}/sshd_config file!" | ||
| 143 | privsep_used=no | ||
| 144 | fi | ||
| 145 | else | ||
| 146 | privsep_used=no | ||
| 147 | fi | ||
| 148 | else | ||
| 149 | # On 9x don't use privilege separation. Since security isn't | ||
| 150 | # available it just adds useless additional processes. | ||
| 151 | privsep_used=no | ||
| 152 | fi | ||
| 153 | fi | ||
| 154 | |||
| 155 | # Create default sshd_config from skeleton files in /etc/defaults/etc or | ||
| 156 | # modify to add the missing privsep configuration option | ||
| 157 | if cmp "${SYSCONFDIR}/sshd_config" "${SYSCONFDIR}/defaults/${SYSCONFDIR}/sshd_config" >/dev/null 2>&1 | ||
| 26 | then | 158 | then |
| 27 | echo "$1 (yes/no) yes" | 159 | csih_inform "Updating ${SYSCONFDIR}/sshd_config file" |
| 28 | return 0 | 160 | sshdconfig_tmp=${SYSCONFDIR}/sshd_config.$$ |
| 29 | elif [ "${auto_answer}" = "no" ] | 161 | sed -e "s/^#UsePrivilegeSeparation yes/UsePrivilegeSeparation ${privsep_used}/ |
| 162 | s/^#Port 22/Port ${port_number}/ | ||
| 163 | s/^#StrictModes yes/StrictModes no/" \ | ||
| 164 | < ${SYSCONFDIR}/sshd_config \ | ||
| 165 | > "${sshdconfig_tmp}" | ||
| 166 | mv "${sshdconfig_tmp}" ${SYSCONFDIR}/sshd_config | ||
| 167 | elif [ "${privsep_configured}" != "yes" ] | ||
| 30 | then | 168 | then |
| 31 | echo "$1 (yes/no) no" | 169 | echo >> ${SYSCONFDIR}/sshd_config |
| 32 | return 1 | 170 | echo "UsePrivilegeSeparation ${privsep_used}" >> ${SYSCONFDIR}/sshd_config |
| 33 | fi | 171 | fi |
| 172 | } # --- End of sshd_privsep --- # | ||
| 173 | |||
| 174 | # ====================================================================== | ||
| 175 | # Routine: update_inetd_conf | ||
| 176 | # ====================================================================== | ||
| 177 | update_inetd_conf() { | ||
| 178 | local _inetcnf="${SYSCONFDIR}/inetd.conf" | ||
| 179 | local _inetcnf_tmp="${SYSCONFDIR}/inetd.conf.$$" | ||
| 180 | local _inetcnf_dir="${SYSCONFDIR}/inetd.d" | ||
| 181 | local _sshd_inetd_conf="${_inetcnf_dir}/sshd-inetd" | ||
| 182 | local _sshd_inetd_conf_tmp="${_inetcnf_dir}/sshd-inetd.$$" | ||
| 183 | local _with_comment=1 | ||
| 184 | |||
| 185 | if [ -d "${_inetcnf_dir}" ] | ||
| 186 | then | ||
| 187 | # we have inetutils-1.5 inetd.d support | ||
| 188 | if [ -f "${_inetcnf}" ] | ||
| 189 | then | ||
| 190 | grep -q '^[ \t]*ssh' "${_inetcnf}" && _with_comment=0 | ||
| 34 | 191 | ||
| 35 | answer="" | 192 | # check for sshd OR ssh in top-level inetd.conf file, and remove |
| 36 | while [ "X${answer}" != "Xyes" -a "X${answer}" != "Xno" ] | 193 | # will be replaced by a file in inetd.d/ |
| 37 | do | 194 | if [ `grep -q '^[# \t]*ssh' "${_inetcnf}"; echo $?` -eq 0 ] |
| 38 | echo -n "$1 (yes/no) " | 195 | then |
| 39 | read -e answer | 196 | grep -v '^[# \t]*ssh' "${_inetcnf}" >> "${_inetcnf_tmp}" |
| 40 | done | 197 | if [ -f "${_inetcnf_tmp}" ] |
| 41 | if [ "X${answer}" = "Xyes" ] | 198 | then |
| 199 | if mv "${_inetcnf_tmp}" "${_inetcnf}" | ||
| 200 | then | ||
| 201 | csih_inform "Removed ssh[d] from ${_inetcnf}" | ||
| 202 | else | ||
| 203 | csih_warning "Removing ssh[d] from ${_inetcnf} failed!" | ||
| 204 | fi | ||
| 205 | rm -f "${_inetcnf_tmp}" | ||
| 206 | else | ||
| 207 | csih_warning "Removing ssh[d] from ${_inetcnf} failed!" | ||
| 208 | fi | ||
| 209 | fi | ||
| 210 | fi | ||
| 211 | |||
| 212 | csih_install_config "${_sshd_inetd_conf}" "${SYSCONFDIR}/defaults" | ||
| 213 | if cmp "${SYSCONFDIR}/defaults${_sshd_inetd_conf}" "${_sshd_inetd_conf}" >/dev/null 2>&1 | ||
| 214 | then | ||
| 215 | if [ "${_with_comment}" -eq 0 ] | ||
| 216 | then | ||
| 217 | sed -e 's/@COMMENT@[ \t]*//' < "${_sshd_inetd_conf}" > "${_sshd_inetd_conf_tmp}" | ||
| 218 | else | ||
| 219 | sed -e 's/@COMMENT@[ \t]*/# /' < "${_sshd_inetd_conf}" > "${_sshd_inetd_conf_tmp}" | ||
| 220 | fi | ||
| 221 | mv "${_sshd_inetd_conf_tmp}" "${_sshd_inetd_conf}" | ||
| 222 | csih_inform "Updated ${_sshd_inetd_conf}" | ||
| 223 | fi | ||
| 224 | |||
| 225 | elif [ -f "${_inetcnf}" ] | ||
| 42 | then | 226 | then |
| 43 | return 0 | 227 | grep -q '^[ \t]*sshd' "${_inetcnf}" && _with_comment=0 |
| 44 | else | 228 | |
| 45 | return 1 | 229 | # check for sshd in top-level inetd.conf file, and remove |
| 230 | # will be replaced by a file in inetd.d/ | ||
| 231 | if [ `grep -q '^[# \t]*sshd' "${_inetcnf}"; echo $?` -eq 0 ] | ||
| 232 | then | ||
| 233 | grep -v '^[# \t]*sshd' "${_inetcnf}" >> "${_inetcnf_tmp}" | ||
| 234 | if [ -f "${_inetcnf_tmp}" ] | ||
| 235 | then | ||
| 236 | if mv "${_inetcnf_tmp}" "${_inetcnf}" | ||
| 237 | then | ||
| 238 | csih_inform "Removed sshd from ${_inetcnf}" | ||
| 239 | else | ||
| 240 | csih_warning "Removing sshd from ${_inetcnf} failed!" | ||
| 241 | fi | ||
| 242 | rm -f "${_inetcnf_tmp}" | ||
| 243 | else | ||
| 244 | csih_warning "Removing sshd from ${_inetcnf} failed!" | ||
| 245 | fi | ||
| 246 | fi | ||
| 247 | |||
| 248 | # Add ssh line to inetd.conf | ||
| 249 | if [ `grep -q '^[# \t]*ssh' "${_inetcnf}"; echo $?` -ne 0 ] | ||
| 250 | then | ||
| 251 | if [ "${_with_comment}" -eq 0 ] | ||
| 252 | then | ||
| 253 | echo 'ssh stream tcp nowait root /usr/sbin/sshd sshd -i' >> "${_inetcnf}" | ||
| 254 | else | ||
| 255 | echo '# ssh stream tcp nowait root /usr/sbin/sshd sshd -i' >> "${_inetcnf}" | ||
| 256 | fi | ||
| 257 | csih_inform "Added ssh to ${_inetcnf}" | ||
| 258 | fi | ||
| 46 | fi | 259 | fi |
| 47 | } | 260 | } # --- End of update_inetd_conf --- # |
| 48 | 261 | ||
| 49 | # Check options | 262 | # ====================================================================== |
| 263 | # Routine: install_service | ||
| 264 | # Install sshd as a service | ||
| 265 | # ====================================================================== | ||
| 266 | install_service() { | ||
| 267 | local run_service_as | ||
| 268 | local password | ||
| 269 | |||
| 270 | if csih_is_nt | ||
| 271 | then | ||
| 272 | if ! cygrunsrv -Q sshd >/dev/null 2>&1 | ||
| 273 | then | ||
| 274 | echo | ||
| 275 | echo | ||
| 276 | csih_warning "The following functions require administrator privileges!" | ||
| 277 | echo | ||
| 278 | echo -e "${_csih_QUERY_STR} Do you want to install sshd as a service?" | ||
| 279 | if csih_request "(Say \"no\" if it is already installed as a service)" | ||
| 280 | then | ||
| 281 | csih_inform "Note that the CYGWIN variable must contain at least \"ntsec\"" | ||
| 282 | csih_inform "for sshd to be able to change user context without password." | ||
| 283 | csih_get_cygenv "${cygwin_value}" | ||
| 284 | |||
| 285 | if ( csih_is_nt2003 || [ "$csih_FORCE_PRIVILEGED_USER" = "yes" ] ) | ||
| 286 | then | ||
| 287 | csih_inform "On Windows Server 2003, Windows Vista, and above, the" | ||
| 288 | csih_inform "SYSTEM account cannot setuid to other users -- a capability" | ||
| 289 | csih_inform "sshd requires. You need to have or to create a privileged" | ||
| 290 | csih_inform "account. This script will help you do so." | ||
| 291 | echo | ||
| 292 | if ! csih_create_privileged_user "${password_value}" | ||
| 293 | then | ||
| 294 | csih_error_recoverable "There was a serious problem creating a privileged user." | ||
| 295 | csih_request "Do you want to proceed anyway?" || exit 1 | ||
| 296 | fi | ||
| 297 | fi | ||
| 298 | |||
| 299 | # never returns empty if NT or above | ||
| 300 | run_service_as=$(csih_service_should_run_as) | ||
| 301 | |||
| 302 | if [ "${run_service_as}" = "${csih_PRIVILEGED_USERNAME}" ] | ||
| 303 | then | ||
| 304 | password="${csih_PRIVILEGED_PASSWORD}" | ||
| 305 | if [ -z "${password}" ] | ||
| 306 | then | ||
| 307 | csih_get_value "Please enter the password for user '${run_service_as}':" "-s" | ||
| 308 | password="${csih_value}" | ||
| 309 | fi | ||
| 310 | fi | ||
| 311 | |||
| 312 | # at this point, we either have $run_service_as = "system" and $password is empty, | ||
| 313 | # or $run_service_as is some privileged user and (hopefully) $password contains | ||
| 314 | # the correct password. So, from here out, we use '-z "${password}"' to discriminate | ||
| 315 | # the two cases. | ||
| 316 | |||
| 317 | csih_check_user "${run_service_as}" | ||
| 318 | |||
| 319 | if [ -z "${password}" ] | ||
| 320 | then | ||
| 321 | if cygrunsrv -I sshd -d "CYGWIN sshd" -p /usr/sbin/sshd -a "-D" -y tcpip \ | ||
| 322 | -e CYGWIN="${csih_cygenv}" | ||
| 323 | then | ||
| 324 | echo | ||
| 325 | csih_inform "The sshd service has been installed under the LocalSystem" | ||
| 326 | csih_inform "account (also known as SYSTEM). To start the service now, call" | ||
| 327 | csih_inform "\`net start sshd' or \`cygrunsrv -S sshd'. Otherwise, it" | ||
| 328 | csih_inform "will start automatically after the next reboot." | ||
| 329 | fi | ||
| 330 | else | ||
| 331 | if cygrunsrv -I sshd -d "CYGWIN sshd" -p /usr/sbin/sshd -a "-D" -y tcpip \ | ||
| 332 | -e CYGWIN="${csih_cygenv}" -u "${run_service_as}" -w "${password}" | ||
| 333 | then | ||
| 334 | echo | ||
| 335 | csih_inform "The sshd service has been installed under the '${run_service_as}'" | ||
| 336 | csih_inform "account. To start the service now, call \`net start sshd' or" | ||
| 337 | csih_inform "\`cygrunsrv -S sshd'. Otherwise, it will start automatically" | ||
| 338 | csih_inform "after the next reboot." | ||
| 339 | fi | ||
| 340 | fi | ||
| 341 | |||
| 342 | # now, if successfully installed, set ownership of the affected files | ||
| 343 | if cygrunsrv -Q sshd >/dev/null 2>&1 | ||
| 344 | then | ||
| 345 | chown "${run_service_as}" ${SYSCONFDIR}/ssh* | ||
| 346 | chown "${run_service_as}".544 ${LOCALSTATEDIR}/empty | ||
| 347 | chown "${run_service_as}".544 ${LOCALSTATEDIR}/log/lastlog | ||
| 348 | if [ -f ${LOCALSTATEDIR}/log/sshd.log ] | ||
| 349 | then | ||
| 350 | chown "${run_service_as}".544 ${LOCALSTATEDIR}/log/sshd.log | ||
| 351 | fi | ||
| 352 | else | ||
| 353 | csih_warning "Something went wrong installing the sshd service." | ||
| 354 | fi | ||
| 355 | fi # user allowed us to install as service | ||
| 356 | fi # service not yet installed | ||
| 357 | fi # csih_is_nt | ||
| 358 | } # --- End of install_service --- # | ||
| 359 | |||
| 360 | # ====================================================================== | ||
| 361 | # Main Entry Point | ||
| 362 | # ====================================================================== | ||
| 363 | |||
| 364 | # Check how the script has been started. If | ||
| 365 | # (1) it has been started by giving the full path and | ||
| 366 | # that path is /etc/postinstall, OR | ||
| 367 | # (2) Otherwise, if the environment variable | ||
| 368 | # SSH_HOST_CONFIG_AUTO_ANSWER_NO is set | ||
| 369 | # then set auto_answer to "no". This allows automatic | ||
| 370 | # creation of the config files in /etc w/o overwriting | ||
| 371 | # them if they already exist. In both cases, color | ||
| 372 | # escape sequences are suppressed, so as to prevent | ||
| 373 | # cluttering setup's logfiles. | ||
| 374 | if [ "$PROGDIR" = "/etc/postinstall" ] | ||
| 375 | then | ||
| 376 | csih_auto_answer="no" | ||
| 377 | csih_disable_color | ||
| 378 | fi | ||
| 379 | if [ -n "${SSH_HOST_CONFIG_AUTO_ANSWER_NO}" ] | ||
| 380 | then | ||
| 381 | csih_auto_answer="no" | ||
| 382 | csih_disable_color | ||
| 383 | fi | ||
| 50 | 384 | ||
| 385 | # ====================================================================== | ||
| 386 | # Parse options | ||
| 387 | # ====================================================================== | ||
| 51 | while : | 388 | while : |
| 52 | do | 389 | do |
| 53 | case $# in | 390 | case $# in |
| @@ -62,14 +399,15 @@ do | |||
| 62 | case "${option}" in | 399 | case "${option}" in |
| 63 | -d | --debug ) | 400 | -d | --debug ) |
| 64 | set -x | 401 | set -x |
| 402 | csih_trace_on | ||
| 65 | ;; | 403 | ;; |
| 66 | 404 | ||
| 67 | -y | --yes ) | 405 | -y | --yes ) |
| 68 | auto_answer=yes | 406 | csih_auto_answer=yes |
| 69 | ;; | 407 | ;; |
| 70 | 408 | ||
| 71 | -n | --no ) | 409 | -n | --no ) |
| 72 | auto_answer=no | 410 | csih_auto_answer=no |
| 73 | ;; | 411 | ;; |
| 74 | 412 | ||
| 75 | -c | --cygwin ) | 413 | -c | --cygwin ) |
| @@ -87,6 +425,10 @@ do | |||
| 87 | shift | 425 | shift |
| 88 | ;; | 426 | ;; |
| 89 | 427 | ||
| 428 | --privileged ) | ||
| 429 | csih_FORCE_PRIVILEGED_USER=yes | ||
| 430 | ;; | ||
| 431 | |||
| 90 | *) | 432 | *) |
| 91 | echo "usage: ${progname} [OPTION]..." | 433 | echo "usage: ${progname} [OPTION]..." |
| 92 | echo | 434 | echo |
| @@ -98,7 +440,9 @@ do | |||
| 98 | echo " --no -n Answer all questions with \"no\" automatically." | 440 | echo " --no -n Answer all questions with \"no\" automatically." |
| 99 | echo " --cygwin -c <options> Use \"options\" as value for CYGWIN environment var." | 441 | echo " --cygwin -c <options> Use \"options\" as value for CYGWIN environment var." |
| 100 | echo " --port -p <n> sshd listens on port n." | 442 | echo " --port -p <n> sshd listens on port n." |
| 101 | echo " --pwd -w <passwd> Use \"pwd\" as password for user 'sshd_server'." | 443 | echo " --pwd -w <passwd> Use \"pwd\" as password for privileged user." |
| 444 | echo " --privileged On Windows NT/2k/XP, require privileged user" | ||
| 445 | echo " instead of LocalSystem for sshd service." | ||
| 102 | echo | 446 | echo |
| 103 | exit 1 | 447 | exit 1 |
| 104 | ;; | 448 | ;; |
| @@ -106,73 +450,34 @@ do | |||
| 106 | esac | 450 | esac |
| 107 | done | 451 | done |
| 108 | 452 | ||
| 109 | # Check if running on NT | 453 | # ====================================================================== |
| 110 | _sys="`uname`" | 454 | # Action! |
| 111 | _nt=`expr "${_sys}" : "CYGWIN_NT"` | 455 | # ====================================================================== |
| 112 | # If running on NT, check if running under 2003 Server or later | ||
| 113 | if [ ${_nt} -gt 0 ] | ||
| 114 | then | ||
| 115 | _nt2003=`uname | awk -F- '{print ( $2 >= 5.2 ) ? 1 : 0;}'` | ||
| 116 | fi | ||
| 117 | 456 | ||
| 118 | # Check for running ssh/sshd processes first. Refuse to do anything while | 457 | # Check for running ssh/sshd processes first. Refuse to do anything while |
| 119 | # some ssh processes are still running | 458 | # some ssh processes are still running |
| 120 | |||
| 121 | if ps -ef | grep -v grep | grep -q ssh | 459 | if ps -ef | grep -v grep | grep -q ssh |
| 122 | then | 460 | then |
| 123 | echo | 461 | echo |
| 124 | echo "There are still ssh processes running. Please shut them down first." | 462 | csih_error "There are still ssh processes running. Please shut them down first." |
| 125 | echo | ||
| 126 | exit 1 | ||
| 127 | fi | 463 | fi |
| 128 | 464 | ||
| 129 | # Check for ${SYSCONFDIR} directory | 465 | # Check for ${SYSCONFDIR} directory |
| 466 | csih_make_dir "${SYSCONFDIR}" "Cannot create global configuration files." | ||
| 467 | chmod 775 "${SYSCONFDIR}" | ||
| 468 | setfacl -m u:system:rwx "${SYSCONFDIR}" | ||
| 130 | 469 | ||
| 131 | if [ -e "${SYSCONFDIR}" -a ! -d "${SYSCONFDIR}" ] | 470 | # Check for /var/log directory |
| 132 | then | 471 | csih_make_dir "${LOCALSTATEDIR}/log" "Cannot create log directory." |
| 133 | echo | 472 | chmod 775 "${LOCALSTATEDIR}/log" |
| 134 | echo "${SYSCONFDIR} is existant but not a directory." | 473 | setfacl -m u:system:rwx "${LOCALSTATEDIR}/log" |
| 135 | echo "Cannot create global configuration files." | ||
| 136 | echo | ||
| 137 | exit 1 | ||
| 138 | fi | ||
| 139 | |||
| 140 | # Create it if necessary | ||
| 141 | |||
| 142 | if [ ! -e "${SYSCONFDIR}" ] | ||
| 143 | then | ||
| 144 | mkdir "${SYSCONFDIR}" | ||
| 145 | if [ ! -e "${SYSCONFDIR}" ] | ||
| 146 | then | ||
| 147 | echo | ||
| 148 | echo "Creating ${SYSCONFDIR} directory failed" | ||
| 149 | echo | ||
| 150 | exit 1 | ||
| 151 | fi | ||
| 152 | fi | ||
| 153 | |||
| 154 | # Create /var/log and /var/log/lastlog if not already existing | ||
| 155 | |||
| 156 | if [ -e ${LOCALSTATEDIR}/log -a ! -d ${LOCALSTATEDIR}/log ] | ||
| 157 | then | ||
| 158 | echo | ||
| 159 | echo "${LOCALSTATEDIR}/log is existant but not a directory." | ||
| 160 | echo "Cannot create ssh host configuration." | ||
| 161 | echo | ||
| 162 | exit 1 | ||
| 163 | fi | ||
| 164 | if [ ! -e ${LOCALSTATEDIR}/log ] | ||
| 165 | then | ||
| 166 | mkdir -p ${LOCALSTATEDIR}/log | ||
| 167 | fi | ||
| 168 | 474 | ||
| 475 | # Create /var/log/lastlog if not already exists | ||
| 169 | if [ -e ${LOCALSTATEDIR}/log/lastlog -a ! -f ${LOCALSTATEDIR}/log/lastlog ] | 476 | if [ -e ${LOCALSTATEDIR}/log/lastlog -a ! -f ${LOCALSTATEDIR}/log/lastlog ] |
| 170 | then | 477 | then |
| 171 | echo | 478 | echo |
| 172 | echo "${LOCALSTATEDIR}/log/lastlog exists, but is not a file." | 479 | csih_error_multi "${LOCALSTATEDIR}/log/lastlog exists, but is not a file." \ |
| 173 | echo "Cannot create ssh host configuration." | 480 | "Cannot create ssh host configuration." |
| 174 | echo | ||
| 175 | exit 1 | ||
| 176 | fi | 481 | fi |
| 177 | if [ ! -e ${LOCALSTATEDIR}/log/lastlog ] | 482 | if [ ! -e ${LOCALSTATEDIR}/log/lastlog ] |
| 178 | then | 483 | then |
| @@ -181,431 +486,44 @@ then | |||
| 181 | fi | 486 | fi |
| 182 | 487 | ||
| 183 | # Create /var/empty file used as chroot jail for privilege separation | 488 | # Create /var/empty file used as chroot jail for privilege separation |
| 184 | if [ -f ${LOCALSTATEDIR}/empty ] | 489 | csih_make_dir "${LOCALSTATEDIR}/empty" "Cannot create log directory." |
| 185 | then | 490 | chmod 755 "${LOCALSTATEDIR}/empty" |
| 186 | echo "Creating ${LOCALSTATEDIR}/empty failed!" | 491 | setfacl -m u:system:rwx "${LOCALSTATEDIR}/empty" |
| 187 | else | ||
| 188 | mkdir -p ${LOCALSTATEDIR}/empty | ||
| 189 | if [ ${_nt} -gt 0 ] | ||
| 190 | then | ||
| 191 | chmod 755 ${LOCALSTATEDIR}/empty | ||
| 192 | fi | ||
| 193 | fi | ||
| 194 | 492 | ||
| 195 | # First generate host keys if not already existing | 493 | # host keys |
| 494 | create_host_keys | ||
| 196 | 495 | ||
| 197 | if [ ! -f "${SYSCONFDIR}/ssh_host_key" ] | 496 | # use 'cmp' program to determine if a config file is identical |
| 198 | then | 497 | # to the default version of that config file |
| 199 | echo "Generating ${SYSCONFDIR}/ssh_host_key" | 498 | csih_check_program_or_error cmp diffutils |
| 200 | ssh-keygen -t rsa1 -f ${SYSCONFDIR}/ssh_host_key -N '' > /dev/null | ||
| 201 | fi | ||
| 202 | 499 | ||
| 203 | if [ ! -f "${SYSCONFDIR}/ssh_host_rsa_key" ] | ||
| 204 | then | ||
| 205 | echo "Generating ${SYSCONFDIR}/ssh_host_rsa_key" | ||
| 206 | ssh-keygen -t rsa -f ${SYSCONFDIR}/ssh_host_rsa_key -N '' > /dev/null | ||
| 207 | fi | ||
| 208 | 500 | ||
| 209 | if [ ! -f "${SYSCONFDIR}/ssh_host_dsa_key" ] | 501 | # handle ssh_config |
| 502 | csih_install_config "${SYSCONFDIR}/ssh_config" "${SYSCONFDIR}/defaults" | ||
| 503 | if cmp "${SYSCONFDIR}/ssh_config" "${SYSCONFDIR}/defaults/${SYSCONFDIR}/ssh_config" >/dev/null 2>&1 | ||
| 210 | then | 504 | then |
| 211 | echo "Generating ${SYSCONFDIR}/ssh_host_dsa_key" | ||
| 212 | ssh-keygen -t dsa -f ${SYSCONFDIR}/ssh_host_dsa_key -N '' > /dev/null | ||
| 213 | fi | ||
| 214 | |||
| 215 | # Check if ssh_config exists. If yes, ask for overwriting | ||
| 216 | |||
| 217 | if [ -f "${SYSCONFDIR}/ssh_config" ] | ||
| 218 | then | ||
| 219 | if request "Overwrite existing ${SYSCONFDIR}/ssh_config file?" | ||
| 220 | then | ||
| 221 | rm -f "${SYSCONFDIR}/ssh_config" | ||
| 222 | if [ -f "${SYSCONFDIR}/ssh_config" ] | ||
| 223 | then | ||
| 224 | echo "Can't overwrite. ${SYSCONFDIR}/ssh_config is write protected." | ||
| 225 | fi | ||
| 226 | fi | ||
| 227 | fi | ||
| 228 | |||
| 229 | # Create default ssh_config from skeleton file in /etc/defaults/etc | ||
| 230 | |||
| 231 | if [ ! -f "${SYSCONFDIR}/ssh_config" ] | ||
| 232 | then | ||
| 233 | echo "Generating ${SYSCONFDIR}/ssh_config file" | ||
| 234 | cp ${SYSCONFDIR}/defaults/etc/ssh_config ${SYSCONFDIR}/ssh_config | ||
| 235 | if [ "${port_number}" != "22" ] | 505 | if [ "${port_number}" != "22" ] |
| 236 | then | 506 | then |
| 507 | csih_inform "Updating ${SYSCONFDIR}/ssh_config file with requested port" | ||
| 237 | echo "Host localhost" >> ${SYSCONFDIR}/ssh_config | 508 | echo "Host localhost" >> ${SYSCONFDIR}/ssh_config |
| 238 | echo " Port ${port_number}" >> ${SYSCONFDIR}/ssh_config | 509 | echo " Port ${port_number}" >> ${SYSCONFDIR}/ssh_config |
| 239 | fi | 510 | fi |
| 240 | fi | 511 | fi |
| 241 | 512 | ||
| 242 | # Check if sshd_config exists. If yes, ask for overwriting | 513 | # handle sshd_config (and privsep) |
| 243 | 514 | csih_install_config "${SYSCONFDIR}/sshd_config" "${SYSCONFDIR}/defaults" | |
| 244 | if [ -f "${SYSCONFDIR}/sshd_config" ] | 515 | if ! cmp "${SYSCONFDIR}/sshd_config" "${SYSCONFDIR}/defaults/${SYSCONFDIR}/sshd_config" >/dev/null 2>&1 |
| 245 | then | 516 | then |
| 246 | if request "Overwrite existing ${SYSCONFDIR}/sshd_config file?" | 517 | grep -q UsePrivilegeSeparation ${SYSCONFDIR}/sshd_config && privsep_configured=yes |
| 247 | then | ||
| 248 | rm -f "${SYSCONFDIR}/sshd_config" | ||
| 249 | if [ -f "${SYSCONFDIR}/sshd_config" ] | ||
| 250 | then | ||
| 251 | echo "Can't overwrite. ${SYSCONFDIR}/sshd_config is write protected." | ||
| 252 | fi | ||
| 253 | else | ||
| 254 | grep -q UsePrivilegeSeparation ${SYSCONFDIR}/sshd_config && privsep_configured=yes | ||
| 255 | fi | ||
| 256 | fi | 518 | fi |
| 519 | sshd_privsep | ||
| 257 | 520 | ||
| 258 | # Prior to creating or modifying sshd_config, care for privilege separation | ||
| 259 | 521 | ||
| 260 | if [ "${privsep_configured}" != "yes" ] | ||
| 261 | then | ||
| 262 | if [ ${_nt} -gt 0 ] | ||
| 263 | then | ||
| 264 | echo "Privilege separation is set to yes by default since OpenSSH 3.3." | ||
| 265 | echo "However, this requires a non-privileged account called 'sshd'." | ||
| 266 | echo "For more info on privilege separation read /usr/share/doc/openssh/README.privsep." | ||
| 267 | echo | ||
| 268 | if request "Should privilege separation be used?" | ||
| 269 | then | ||
| 270 | privsep_used=yes | ||
| 271 | grep -q '^sshd:' ${SYSCONFDIR}/passwd && sshd_in_passwd=yes | ||
| 272 | net user sshd >/dev/null 2>&1 && sshd_in_sam=yes | ||
| 273 | if [ "${sshd_in_passwd}" != "yes" ] | ||
| 274 | then | ||
| 275 | if [ "${sshd_in_sam}" != "yes" ] | ||
| 276 | then | ||
| 277 | echo "Warning: The following function requires administrator privileges!" | ||
| 278 | if request "Should this script create a local user 'sshd' on this machine?" | ||
| 279 | then | ||
| 280 | dos_var_empty=`cygpath -w ${LOCALSTATEDIR}/empty` | ||
| 281 | net user sshd /add /fullname:"sshd privsep" "/homedir:${dos_var_empty}" /active:no > /dev/null 2>&1 && sshd_in_sam=yes | ||
| 282 | if [ "${sshd_in_sam}" != "yes" ] | ||
| 283 | then | ||
| 284 | echo "Warning: Creating the user 'sshd' failed!" | ||
| 285 | fi | ||
| 286 | fi | ||
| 287 | fi | ||
| 288 | if [ "${sshd_in_sam}" != "yes" ] | ||
| 289 | then | ||
| 290 | echo "Warning: Can't create user 'sshd' in ${SYSCONFDIR}/passwd!" | ||
| 291 | echo " Privilege separation set to 'no' again!" | ||
| 292 | echo " Check your ${SYSCONFDIR}/sshd_config file!" | ||
| 293 | privsep_used=no | ||
| 294 | else | ||
| 295 | mkpasswd -l -u sshd | sed -e 's/bash$/false/' >> ${SYSCONFDIR}/passwd | ||
| 296 | fi | ||
| 297 | fi | ||
| 298 | else | ||
| 299 | privsep_used=no | ||
| 300 | fi | ||
| 301 | else | ||
| 302 | # On 9x don't use privilege separation. Since security isn't | ||
| 303 | # available it just adds useless additional processes. | ||
| 304 | privsep_used=no | ||
| 305 | fi | ||
| 306 | fi | ||
| 307 | |||
| 308 | # Create default sshd_config from skeleton files in /etc/defaults/etc or | ||
| 309 | # modify to add the missing privsep configuration option | ||
| 310 | |||
| 311 | if [ ! -f "${SYSCONFDIR}/sshd_config" ] | ||
| 312 | then | ||
| 313 | echo "Generating ${SYSCONFDIR}/sshd_config file" | ||
| 314 | sed -e "s/^#UsePrivilegeSeparation yes/UsePrivilegeSeparation ${privsep_used}/ | ||
| 315 | s/^#Port 22/Port ${port_number}/ | ||
| 316 | s/^#StrictModes yes/StrictModes no/" \ | ||
| 317 | < ${SYSCONFDIR}/defaults/etc/sshd_config \ | ||
| 318 | > ${SYSCONFDIR}/sshd_config | ||
| 319 | elif [ "${privsep_configured}" != "yes" ] | ||
| 320 | then | ||
| 321 | echo >> ${SYSCONFDIR}/sshd_config | ||
| 322 | echo "UsePrivilegeSeparation ${privsep_used}" >> ${SYSCONFDIR}/sshd_config | ||
| 323 | fi | ||
| 324 | 522 | ||
| 325 | # Care for services file | 523 | update_services_file |
| 326 | _my_etcdir="/ssh-host-config.$$" | 524 | update_inetd_conf |
| 327 | if [ ${_nt} -gt 0 ] | 525 | install_service |
| 328 | then | ||
| 329 | _win_etcdir="${SYSTEMROOT}\\system32\\drivers\\etc" | ||
| 330 | _services="${_my_etcdir}/services" | ||
| 331 | # On NT, 27 spaces, no space after the hash | ||
| 332 | _spaces=" #" | ||
| 333 | else | ||
| 334 | _win_etcdir="${WINDIR}" | ||
| 335 | _services="${_my_etcdir}/SERVICES" | ||
| 336 | # On 9x, 18 spaces (95 is very touchy), a space after the hash | ||
| 337 | _spaces=" # " | ||
| 338 | fi | ||
| 339 | _serv_tmp="${_my_etcdir}/srv.out.$$" | ||
| 340 | |||
| 341 | mount -t -f "${_win_etcdir}" "${_my_etcdir}" | ||
| 342 | |||
| 343 | # Depends on the above mount | ||
| 344 | _wservices=`cygpath -w "${_services}"` | ||
| 345 | |||
| 346 | # Remove sshd 22/port from services | ||
| 347 | if [ `grep -q 'sshd[ \t][ \t]*22' "${_services}"; echo $?` -eq 0 ] | ||
| 348 | then | ||
| 349 | grep -v 'sshd[ \t][ \t]*22' "${_services}" > "${_serv_tmp}" | ||
| 350 | if [ -f "${_serv_tmp}" ] | ||
| 351 | then | ||
| 352 | if mv "${_serv_tmp}" "${_services}" | ||
| 353 | then | ||
| 354 | echo "Removing sshd from ${_wservices}" | ||
| 355 | else | ||
| 356 | echo "Removing sshd from ${_wservices} failed!" | ||
| 357 | fi | ||
| 358 | rm -f "${_serv_tmp}" | ||
| 359 | else | ||
| 360 | echo "Removing sshd from ${_wservices} failed!" | ||
| 361 | fi | ||
| 362 | fi | ||
| 363 | |||
| 364 | # Add ssh 22/tcp and ssh 22/udp to services | ||
| 365 | if [ `grep -q 'ssh[ \t][ \t]*22' "${_services}"; echo $?` -ne 0 ] | ||
| 366 | then | ||
| 367 | if awk '{ if ( $2 ~ /^23\/tcp/ ) print "ssh 22/tcp'"${_spaces}"'SSH Remote Login Protocol\nssh 22/udp'"${_spaces}"'SSH Remote Login Protocol"; print $0; }' < "${_services}" > "${_serv_tmp}" | ||
| 368 | then | ||
| 369 | if mv "${_serv_tmp}" "${_services}" | ||
| 370 | then | ||
| 371 | echo "Added ssh to ${_wservices}" | ||
| 372 | else | ||
| 373 | echo "Adding ssh to ${_wservices} failed!" | ||
| 374 | fi | ||
| 375 | rm -f "${_serv_tmp}" | ||
| 376 | else | ||
| 377 | echo "WARNING: Adding ssh to ${_wservices} failed!" | ||
| 378 | fi | ||
| 379 | fi | ||
| 380 | |||
| 381 | umount "${_my_etcdir}" | ||
| 382 | |||
| 383 | # Care for inetd.conf file | ||
| 384 | _inetcnf="${SYSCONFDIR}/inetd.conf" | ||
| 385 | _inetcnf_tmp="${SYSCONFDIR}/inetd.conf.$$" | ||
| 386 | |||
| 387 | if [ -f "${_inetcnf}" ] | ||
| 388 | then | ||
| 389 | # Check if ssh service is already in use as sshd | ||
| 390 | with_comment=1 | ||
| 391 | grep -q '^[ \t]*sshd' "${_inetcnf}" && with_comment=0 | ||
| 392 | # Remove sshd line from inetd.conf | ||
| 393 | if [ `grep -q '^[# \t]*sshd' "${_inetcnf}"; echo $?` -eq 0 ] | ||
| 394 | then | ||
| 395 | grep -v '^[# \t]*sshd' "${_inetcnf}" >> "${_inetcnf_tmp}" | ||
| 396 | if [ -f "${_inetcnf_tmp}" ] | ||
| 397 | then | ||
| 398 | if mv "${_inetcnf_tmp}" "${_inetcnf}" | ||
| 399 | then | ||
| 400 | echo "Removed sshd from ${_inetcnf}" | ||
| 401 | else | ||
| 402 | echo "Removing sshd from ${_inetcnf} failed!" | ||
| 403 | fi | ||
| 404 | rm -f "${_inetcnf_tmp}" | ||
| 405 | else | ||
| 406 | echo "Removing sshd from ${_inetcnf} failed!" | ||
| 407 | fi | ||
| 408 | fi | ||
| 409 | |||
| 410 | # Add ssh line to inetd.conf | ||
| 411 | if [ `grep -q '^[# \t]*ssh' "${_inetcnf}"; echo $?` -ne 0 ] | ||
| 412 | then | ||
| 413 | if [ "${with_comment}" -eq 0 ] | ||
| 414 | then | ||
| 415 | echo 'ssh stream tcp nowait root /usr/sbin/sshd sshd -i' >> "${_inetcnf}" | ||
| 416 | else | ||
| 417 | echo '# ssh stream tcp nowait root /usr/sbin/sshd sshd -i' >> "${_inetcnf}" | ||
| 418 | fi | ||
| 419 | echo "Added ssh to ${_inetcnf}" | ||
| 420 | fi | ||
| 421 | fi | ||
| 422 | |||
| 423 | # On NT ask if sshd should be installed as service | ||
| 424 | if [ ${_nt} -gt 0 ] | ||
| 425 | then | ||
| 426 | # But only if it is not already installed | ||
| 427 | if ! cygrunsrv -Q sshd > /dev/null 2>&1 | ||
| 428 | then | ||
| 429 | echo | ||
| 430 | echo | ||
| 431 | echo "Warning: The following functions require administrator privileges!" | ||
| 432 | echo | ||
| 433 | echo "Do you want to install sshd as service?" | ||
| 434 | if request "(Say \"no\" if it's already installed as service)" | ||
| 435 | then | ||
| 436 | if [ $_nt2003 -gt 0 ] | ||
| 437 | then | ||
| 438 | grep -q '^sshd_server:' ${SYSCONFDIR}/passwd && sshd_server_in_passwd=yes | ||
| 439 | if [ "${sshd_server_in_passwd}" = "yes" ] | ||
| 440 | then | ||
| 441 | # Drop sshd_server from passwd since it could have wrong settings | ||
| 442 | grep -v '^sshd_server:' ${SYSCONFDIR}/passwd > ${SYSCONFDIR}/passwd.$$ | ||
| 443 | rm -f ${SYSCONFDIR}/passwd | ||
| 444 | mv ${SYSCONFDIR}/passwd.$$ ${SYSCONFDIR}/passwd | ||
| 445 | chmod g-w,o-w ${SYSCONFDIR}/passwd | ||
| 446 | fi | ||
| 447 | net user sshd_server >/dev/null 2>&1 && sshd_server_in_sam=yes | ||
| 448 | if [ "${sshd_server_in_sam}" != "yes" ] | ||
| 449 | then | ||
| 450 | echo | ||
| 451 | echo "You appear to be running Windows 2003 Server or later. On 2003 and" | ||
| 452 | echo "later systems, it's not possible to use the LocalSystem account" | ||
| 453 | echo "if sshd should allow passwordless logon (e. g. public key authentication)." | ||
| 454 | echo "If you want to enable that functionality, it's required to create a new" | ||
| 455 | echo "account 'sshd_server' with special privileges, which is then used to run" | ||
| 456 | echo "the sshd service under." | ||
| 457 | echo | ||
| 458 | echo "Should this script create a new local account 'sshd_server' which has" | ||
| 459 | if request "the required privileges?" | ||
| 460 | then | ||
| 461 | _admingroup=`mkgroup -l | awk -F: '{if ( $2 == "S-1-5-32-544" ) print $1;}' ` | ||
| 462 | if [ -z "${_admingroup}" ] | ||
| 463 | then | ||
| 464 | echo "mkgroup -l produces no group with SID S-1-5-32-544 (Local administrators group)." | ||
| 465 | exit 1 | ||
| 466 | fi | ||
| 467 | dos_var_empty=`cygpath -w ${LOCALSTATEDIR}/empty` | ||
| 468 | while [ "${sshd_server_in_sam}" != "yes" ] | ||
| 469 | do | ||
| 470 | if [ -n "${password_value}" ] | ||
| 471 | then | ||
| 472 | _password="${password_value}" | ||
| 473 | # Allow to ask for password if first try fails | ||
| 474 | password_value="" | ||
| 475 | else | ||
| 476 | echo | ||
| 477 | echo "Please enter a password for new user 'sshd_server'. Please be sure that" | ||
| 478 | echo "this password matches the password rules given on your system." | ||
| 479 | echo -n "Entering no password will exit the configuration. PASSWORD=" | ||
| 480 | read -e _password | ||
| 481 | if [ -z "${_password}" ] | ||
| 482 | then | ||
| 483 | echo | ||
| 484 | echo "Exiting configuration. No user sshd_server has been created," | ||
| 485 | echo "no sshd service installed." | ||
| 486 | exit 1 | ||
| 487 | fi | ||
| 488 | fi | ||
| 489 | net user sshd_server "${_password}" /add /fullname:"sshd server account" "/homedir:${dos_var_empty}" /yes > /tmp/nu.$$ 2>&1 && sshd_server_in_sam=yes | ||
| 490 | if [ "${sshd_server_in_sam}" != "yes" ] | ||
| 491 | then | ||
| 492 | echo "Creating the user 'sshd_server' failed! Reason:" | ||
| 493 | cat /tmp/nu.$$ | ||
| 494 | rm /tmp/nu.$$ | ||
| 495 | fi | ||
| 496 | done | ||
| 497 | net localgroup "${_admingroup}" sshd_server /add > /dev/null 2>&1 && sshd_server_in_admingroup=yes | ||
| 498 | if [ "${sshd_server_in_admingroup}" != "yes" ] | ||
| 499 | then | ||
| 500 | echo "WARNING: Adding user sshd_server to local group ${_admingroup} failed!" | ||
| 501 | echo "Please add sshd_server to local group ${_admingroup} before" | ||
| 502 | echo "starting the sshd service!" | ||
| 503 | echo | ||
| 504 | fi | ||
| 505 | passwd_has_expiry_flags=`passwd -v | awk '/^passwd /{print ( $3 >= 1.5 ) ? "yes" : "no";}'` | ||
| 506 | if [ "${passwd_has_expiry_flags}" != "yes" ] | ||
| 507 | then | ||
| 508 | echo | ||
| 509 | echo "WARNING: User sshd_server has password expiry set to system default." | ||
| 510 | echo "Please check that password never expires or set it to your needs." | ||
| 511 | elif ! passwd -e sshd_server | ||
| 512 | then | ||
| 513 | echo | ||
| 514 | echo "WARNING: Setting password expiry for user sshd_server failed!" | ||
| 515 | echo "Please check that password never expires or set it to your needs." | ||
| 516 | fi | ||
| 517 | editrights -a SeAssignPrimaryTokenPrivilege -u sshd_server && | ||
| 518 | editrights -a SeCreateTokenPrivilege -u sshd_server && | ||
| 519 | editrights -a SeTcbPrivilege -u sshd_server && | ||
| 520 | editrights -a SeDenyInteractiveLogonRight -u sshd_server && | ||
| 521 | editrights -a SeDenyNetworkLogonRight -u sshd_server && | ||
| 522 | editrights -a SeDenyRemoteInteractiveLogonRight -u sshd_server && | ||
| 523 | editrights -a SeIncreaseQuotaPrivilege -u sshd_server && | ||
| 524 | editrights -a SeServiceLogonRight -u sshd_server && | ||
| 525 | sshd_server_got_all_rights="yes" | ||
| 526 | if [ "${sshd_server_got_all_rights}" != "yes" ] | ||
| 527 | then | ||
| 528 | echo | ||
| 529 | echo "Assigning the appropriate privileges to user 'sshd_server' failed!" | ||
| 530 | echo "Can't create sshd service!" | ||
| 531 | exit 1 | ||
| 532 | fi | ||
| 533 | echo | ||
| 534 | echo "User 'sshd_server' has been created with password '${_password}'." | ||
| 535 | echo "If you change the password, please keep in mind to change the password" | ||
| 536 | echo "for the sshd service, too." | ||
| 537 | echo | ||
| 538 | echo "Also keep in mind that the user sshd_server needs read permissions on all" | ||
| 539 | echo "users' .ssh/authorized_keys file to allow public key authentication for" | ||
| 540 | echo "these users!. (Re-)running ssh-user-config for each user will set the" | ||
| 541 | echo "required permissions correctly." | ||
| 542 | echo | ||
| 543 | fi | ||
| 544 | fi | ||
| 545 | if [ "${sshd_server_in_sam}" = "yes" ] | ||
| 546 | then | ||
| 547 | mkpasswd -l -u sshd_server | sed -e 's/bash$/false/' >> ${SYSCONFDIR}/passwd | ||
| 548 | fi | ||
| 549 | fi | ||
| 550 | if [ -n "${cygwin_value}" ] | ||
| 551 | then | ||
| 552 | _cygwin="${cygwin_value}" | ||
| 553 | else | ||
| 554 | echo | ||
| 555 | echo "Which value should the environment variable CYGWIN have when" | ||
| 556 | echo "sshd starts? It's recommended to set at least \"ntsec\" to be" | ||
| 557 | echo "able to change user context without password." | ||
| 558 | echo -n "Default is \"ntsec\". CYGWIN=" | ||
| 559 | read -e _cygwin | ||
| 560 | fi | ||
| 561 | [ -z "${_cygwin}" ] && _cygwin="ntsec" | ||
| 562 | if [ $_nt2003 -gt 0 -a "${sshd_server_in_sam}" = "yes" ] | ||
| 563 | then | ||
| 564 | if cygrunsrv -I sshd -d "CYGWIN sshd" -p /usr/sbin/sshd -a -D -u sshd_server -w "${_password}" -e "CYGWIN=${_cygwin}" -y tcpip | ||
| 565 | then | ||
| 566 | echo | ||
| 567 | echo "The service has been installed under sshd_server account." | ||
| 568 | echo "To start the service, call \`net start sshd' or \`cygrunsrv -S sshd'." | ||
| 569 | fi | ||
| 570 | else | ||
| 571 | if cygrunsrv -I sshd -d "CYGWIN sshd" -p /usr/sbin/sshd -a -D -e "CYGWIN=${_cygwin}" -y tcpip | ||
| 572 | then | ||
| 573 | echo | ||
| 574 | echo "The service has been installed under LocalSystem account." | ||
| 575 | echo "To start the service, call \`net start sshd' or \`cygrunsrv -S sshd'." | ||
| 576 | fi | ||
| 577 | fi | ||
| 578 | fi | ||
| 579 | # Now check if sshd has been successfully installed. This allows to | ||
| 580 | # set the ownership of the affected files correctly. | ||
| 581 | if cygrunsrv -Q sshd > /dev/null 2>&1 | ||
| 582 | then | ||
| 583 | if [ $_nt2003 -gt 0 -a "${sshd_server_in_sam}" = "yes" ] | ||
| 584 | then | ||
| 585 | _user="sshd_server" | ||
| 586 | else | ||
| 587 | _user="system" | ||
| 588 | fi | ||
| 589 | chown "${_user}" ${SYSCONFDIR}/ssh* | ||
| 590 | chown "${_user}".544 ${LOCALSTATEDIR}/empty | ||
| 591 | chown "${_user}".544 ${LOCALSTATEDIR}/log/lastlog | ||
| 592 | if [ -f ${LOCALSTATEDIR}/log/sshd.log ] | ||
| 593 | then | ||
| 594 | chown "${_user}".544 ${LOCALSTATEDIR}/log/sshd.log | ||
| 595 | fi | ||
| 596 | fi | ||
| 597 | if ! ( mount | egrep -q 'on /(|usr/(bin|lib)) type system' ) | ||
| 598 | then | ||
| 599 | echo | ||
| 600 | echo "Warning: It appears that you have user mode mounts (\"Just me\"" | ||
| 601 | echo "chosen during install.) Any daemons installed as services will" | ||
| 602 | echo "fail to function unless system mounts are used. To change this," | ||
| 603 | echo "re-run setup.exe and choose \"All users\"." | ||
| 604 | echo | ||
| 605 | echo "For more information, see http://cygwin.com/faq/faq0.html#TOC33" | ||
| 606 | fi | ||
| 607 | fi | ||
| 608 | fi | ||
| 609 | 526 | ||
| 610 | echo | 527 | echo |
| 611 | echo "Host configuration finished. Have fun!" | 528 | csih_inform "Host configuration finished. Have fun!" |
| 529 | |||
diff --git a/contrib/cygwin/ssh-user-config b/contrib/cygwin/ssh-user-config index 9482efe9e..f210bd556 100644 --- a/contrib/cygwin/ssh-user-config +++ b/contrib/cygwin/ssh-user-config | |||
| @@ -1,52 +1,235 @@ | |||
| 1 | #!/bin/sh | 1 | #!/bin/bash |
| 2 | # | 2 | # |
| 3 | # ssh-user-config, Copyright 2000, 2001, 2002, 2003, Red Hat Inc. | 3 | # ssh-user-config, Copyright 2000, 2001, 2002, 2003, Red Hat Inc. |
| 4 | # | 4 | # |
| 5 | # This file is part of the Cygwin port of OpenSSH. | 5 | # This file is part of the Cygwin port of OpenSSH. |
| 6 | 6 | ||
| 7 | # ====================================================================== | ||
| 8 | # Initialization | ||
| 9 | # ====================================================================== | ||
| 10 | PROGNAME=$(basename -- $0) | ||
| 11 | _tdir=$(dirname -- $0) | ||
| 12 | PROGDIR=$(cd $_tdir && pwd) | ||
| 13 | |||
| 14 | CSIH_SCRIPT=/usr/share/csih/cygwin-service-installation-helper.sh | ||
| 15 | |||
| 16 | # Subdirectory where the new package is being installed | ||
| 17 | PREFIX=/usr | ||
| 18 | |||
| 7 | # Directory where the config files are stored | 19 | # Directory where the config files are stored |
| 8 | SYSCONFDIR=/etc | 20 | SYSCONFDIR=/etc |
| 9 | 21 | ||
| 10 | progname=$0 | 22 | source ${CSIH_SCRIPT} |
| 11 | auto_answer="" | 23 | |
| 12 | auto_passphrase="no" | 24 | auto_passphrase="no" |
| 13 | passphrase="" | 25 | passphrase="" |
| 26 | pwdhome= | ||
| 27 | with_passphrase= | ||
| 28 | |||
| 29 | # ====================================================================== | ||
| 30 | # Routine: create_ssh1_identity | ||
| 31 | # optionally create ~/.ssh/identity[.pub] | ||
| 32 | # optionally add result to ~/.ssh/authorized_keys | ||
| 33 | # ====================================================================== | ||
| 34 | create_ssh1_identity() { | ||
| 35 | if [ ! -f "${pwdhome}/.ssh/identity" ] | ||
| 36 | then | ||
| 37 | if csih_request "Shall I create an SSH1 RSA identity file for you?" | ||
| 38 | then | ||
| 39 | csih_inform "Generating ${pwdhome}/.ssh/identity" | ||
| 40 | if [ "${with_passphrase}" = "yes" ] | ||
| 41 | then | ||
| 42 | ssh-keygen -t rsa1 -N "${passphrase}" -f "${pwdhome}/.ssh/identity" > /dev/null | ||
| 43 | else | ||
| 44 | ssh-keygen -t rsa1 -f "${pwdhome}/.ssh/identity" > /dev/null | ||
| 45 | fi | ||
| 46 | if csih_request "Do you want to use this identity to login to this machine?" | ||
| 47 | then | ||
| 48 | csih_inform "Adding to ${pwdhome}/.ssh/authorized_keys" | ||
| 49 | cat "${pwdhome}/.ssh/identity.pub" >> "${pwdhome}/.ssh/authorized_keys" | ||
| 50 | fi | ||
| 51 | fi | ||
| 52 | fi | ||
| 53 | } # === End of create_ssh1_identity() === # | ||
| 54 | readonly -f create_ssh1_identity | ||
| 55 | |||
| 56 | # ====================================================================== | ||
| 57 | # Routine: create_ssh2_rsa_identity | ||
| 58 | # optionally create ~/.ssh/id_rsa[.pub] | ||
| 59 | # optionally add result to ~/.ssh/authorized_keys | ||
| 60 | # ====================================================================== | ||
| 61 | create_ssh2_rsa_identity() { | ||
| 62 | if [ ! -f "${pwdhome}/.ssh/id_rsa" ] | ||
| 63 | then | ||
| 64 | if csih_request "Shall I create an SSH2 RSA identity file for you?" | ||
| 65 | then | ||
| 66 | csih_inform "Generating ${pwdhome}/.ssh/id_rsa" | ||
| 67 | if [ "${with_passphrase}" = "yes" ] | ||
| 68 | then | ||
| 69 | ssh-keygen -t rsa -N "${passphrase}" -f "${pwdhome}/.ssh/id_rsa" > /dev/null | ||
| 70 | else | ||
| 71 | ssh-keygen -t rsa -f "${pwdhome}/.ssh/id_rsa" > /dev/null | ||
| 72 | fi | ||
| 73 | if csih_request "Do you want to use this identity to login to this machine?" | ||
| 74 | then | ||
| 75 | csih_inform "Adding to ${pwdhome}/.ssh/authorized_keys" | ||
| 76 | cat "${pwdhome}/.ssh/id_rsa.pub" >> "${pwdhome}/.ssh/authorized_keys" | ||
| 77 | fi | ||
| 78 | fi | ||
| 79 | fi | ||
| 80 | } # === End of create_ssh2_rsa_identity() === # | ||
| 81 | readonly -f create_ssh2_rsa_identity | ||
| 82 | |||
| 83 | # ====================================================================== | ||
| 84 | # Routine: create_ssh2_dsa_identity | ||
| 85 | # optionally create ~/.ssh/id_dsa[.pub] | ||
| 86 | # optionally add result to ~/.ssh/authorized_keys | ||
| 87 | # ====================================================================== | ||
| 88 | create_ssh2_dsa_identity() { | ||
| 89 | if [ ! -f "${pwdhome}/.ssh/id_dsa" ] | ||
| 90 | then | ||
| 91 | if csih_request "Shall I create an SSH2 DSA identity file for you?" | ||
| 92 | then | ||
| 93 | csih_inform "Generating ${pwdhome}/.ssh/id_dsa" | ||
| 94 | if [ "${with_passphrase}" = "yes" ] | ||
| 95 | then | ||
| 96 | ssh-keygen -t dsa -N "${passphrase}" -f "${pwdhome}/.ssh/id_dsa" > /dev/null | ||
| 97 | else | ||
| 98 | ssh-keygen -t dsa -f "${pwdhome}/.ssh/id_dsa" > /dev/null | ||
| 99 | fi | ||
| 100 | if csih_request "Do you want to use this identity to login to this machine?" | ||
| 101 | then | ||
| 102 | csih_inform "Adding to ${pwdhome}/.ssh/authorized_keys" | ||
| 103 | cat "${pwdhome}/.ssh/id_dsa.pub" >> "${pwdhome}/.ssh/authorized_keys" | ||
| 104 | fi | ||
| 105 | fi | ||
| 106 | fi | ||
| 107 | } # === End of create_ssh2_dsa_identity() === # | ||
| 108 | readonly -f create_ssh2_dsa_identity | ||
| 109 | |||
| 110 | # ====================================================================== | ||
| 111 | # Routine: check_user_homedir | ||
| 112 | # Perform various checks on the user's home directory | ||
| 113 | # SETS GLOBAL VARIABLE: | ||
| 114 | # pwdhome | ||
| 115 | # ====================================================================== | ||
| 116 | check_user_homedir() { | ||
| 117 | local uid=$(id -u) | ||
| 118 | pwdhome=$(awk -F: '{ if ( $3 == '${uid}' ) print $6; }' < ${SYSCONFDIR}/passwd) | ||
| 119 | if [ "X${pwdhome}" = "X" ] | ||
| 120 | then | ||
| 121 | csih_error_multiline \ | ||
| 122 | "There is no home directory set for you in ${SYSCONFDIR}/passwd." \ | ||
| 123 | 'Setting $HOME is not sufficient!' | ||
| 124 | fi | ||
| 125 | |||
| 126 | if [ ! -d "${pwdhome}" ] | ||
| 127 | then | ||
| 128 | csih_error_multiline \ | ||
| 129 | "${pwdhome} is set in ${SYSCONFDIR}/passwd as your home directory" \ | ||
| 130 | 'but it is not a valid directory. Cannot create user identity files.' | ||
| 131 | fi | ||
| 132 | |||
| 133 | # If home is the root dir, set home to empty string to avoid error messages | ||
| 134 | # in subsequent parts of that script. | ||
| 135 | if [ "X${pwdhome}" = "X/" ] | ||
| 136 | then | ||
| 137 | # But first raise a warning! | ||
| 138 | csih_warning "Your home directory in ${SYSCONFDIR}/passwd is set to root (/). This is not recommended!" | ||
| 139 | if csih_request "Would you like to proceed anyway?" | ||
| 140 | then | ||
| 141 | pwdhome='' | ||
| 142 | else | ||
| 143 | csih_warning "Exiting. Configuration is not complete" | ||
| 144 | exit 1 | ||
| 145 | fi | ||
| 146 | fi | ||
| 147 | |||
| 148 | if [ -d "${pwdhome}" -a csih_is_nt -a -n "`chmod -c g-w,o-w "${pwdhome}"`" ] | ||
| 149 | then | ||
| 150 | echo | ||
| 151 | csih_warning 'group and other have been revoked write permission to your home' | ||
| 152 | csih_warning "directory ${pwdhome}." | ||
| 153 | csih_warning 'This is required by OpenSSH to allow public key authentication using' | ||
| 154 | csih_warning 'the key files stored in your .ssh subdirectory.' | ||
| 155 | csih_warning 'Revert this change ONLY if you know what you are doing!' | ||
| 156 | echo | ||
| 157 | fi | ||
| 158 | } # === End of check_user_homedir() === # | ||
| 159 | readonly -f check_user_homedir | ||
| 14 | 160 | ||
| 15 | request() | 161 | # ====================================================================== |
| 16 | { | 162 | # Routine: check_user_dot_ssh_dir |
| 17 | if [ "${auto_answer}" = "yes" ] | 163 | # Perform various checks on the ~/.ssh directory |
| 164 | # PREREQUISITE: | ||
| 165 | # pwdhome -- check_user_homedir() | ||
| 166 | # ====================================================================== | ||
| 167 | check_user_dot_ssh_dir() { | ||
| 168 | if [ -e "${pwdhome}/.ssh" -a ! -d "${pwdhome}/.ssh" ] | ||
| 18 | then | 169 | then |
| 19 | return 0 | 170 | csih_error "${pwdhome}/.ssh is existant but not a directory. Cannot create user identity files." |
| 20 | elif [ "${auto_answer}" = "no" ] | 171 | fi |
| 172 | |||
| 173 | if [ ! -e "${pwdhome}/.ssh" ] | ||
| 21 | then | 174 | then |
| 22 | return 1 | 175 | mkdir "${pwdhome}/.ssh" |
| 176 | if [ ! -e "${pwdhome}/.ssh" ] | ||
| 177 | then | ||
| 178 | csih_error "Creating users ${pwdhome}/.ssh directory failed" | ||
| 179 | fi | ||
| 23 | fi | 180 | fi |
| 181 | } # === End of check_user_dot_ssh_dir() === # | ||
| 182 | readonly -f check_user_dot_ssh_dir | ||
| 24 | 183 | ||
| 25 | answer="" | 184 | # ====================================================================== |
| 26 | while [ "X${answer}" != "Xyes" -a "X${answer}" != "Xno" ] | 185 | # Routine: fix_authorized_keys_perms |
| 27 | do | 186 | # Corrects the permissions of ~/.ssh/authorized_keys |
| 28 | echo -n "$1 (yes/no) " | 187 | # PREREQUISITE: |
| 29 | read answer | 188 | # pwdhome -- check_user_homedir() |
| 30 | done | 189 | # ====================================================================== |
| 31 | if [ "X${answer}" = "Xyes" ] | 190 | fix_authorized_keys_perms() { |
| 191 | if [ csih_is_nt -a -e "${pwdhome}/.ssh/authorized_keys" ] | ||
| 32 | then | 192 | then |
| 33 | return 0 | 193 | if ! setfacl -m "u::rw-,g::---,o::---" "${pwdhome}/.ssh/authorized_keys" |
| 34 | else | 194 | then |
| 35 | return 1 | 195 | csih_warning "Setting correct permissions to ${pwdhome}/.ssh/authorized_keys" |
| 196 | csih_warning "failed. Please care for the correct permissions. The minimum requirement" | ||
| 197 | csih_warning "is, the owner needs read permissions." | ||
| 198 | echo | ||
| 199 | fi | ||
| 36 | fi | 200 | fi |
| 37 | } | 201 | } # === End of fix_authorized_keys_perms() === # |
| 202 | readonly -f fix_authorized_keys_perms | ||
| 203 | |||
| 204 | |||
| 205 | # ====================================================================== | ||
| 206 | # Main Entry Point | ||
| 207 | # ====================================================================== | ||
| 38 | 208 | ||
| 39 | # Check if running on NT | 209 | # Check how the script has been started. If |
| 40 | _sys="`uname -a`" | 210 | # (1) it has been started by giving the full path and |
| 41 | _nt=`expr "$_sys" : "CYGWIN_NT"` | 211 | # that path is /etc/postinstall, OR |
| 42 | # If running on NT, check if running under 2003 Server or later | 212 | # (2) Otherwise, if the environment variable |
| 43 | if [ $_nt -gt 0 ] | 213 | # SSH_USER_CONFIG_AUTO_ANSWER_NO is set |
| 214 | # then set auto_answer to "no". This allows automatic | ||
| 215 | # creation of the config files in /etc w/o overwriting | ||
| 216 | # them if they already exist. In both cases, color | ||
| 217 | # escape sequences are suppressed, so as to prevent | ||
| 218 | # cluttering setup's logfiles. | ||
| 219 | if [ "$PROGDIR" = "/etc/postinstall" ] | ||
| 44 | then | 220 | then |
| 45 | _nt2003=`uname | awk -F- '{print ( $2 >= 5.2 ) ? 1 : 0;}'` | 221 | csih_auto_answer="no" |
| 222 | csih_disable_color | ||
| 223 | fi | ||
| 224 | if [ -n "${SSH_USER_CONFIG_AUTO_ANSWER_NO}" ] | ||
| 225 | then | ||
| 226 | csih_auto_answer="no" | ||
| 227 | csih_disable_color | ||
| 46 | fi | 228 | fi |
| 47 | 229 | ||
| 48 | # Check options | 230 | # ====================================================================== |
| 49 | 231 | # Parse options | |
| 232 | # ====================================================================== | ||
| 50 | while : | 233 | while : |
| 51 | do | 234 | do |
| 52 | case $# in | 235 | case $# in |
| @@ -61,14 +244,15 @@ do | |||
| 61 | case "$option" in | 244 | case "$option" in |
| 62 | -d | --debug ) | 245 | -d | --debug ) |
| 63 | set -x | 246 | set -x |
| 247 | csih_trace_on | ||
| 64 | ;; | 248 | ;; |
| 65 | 249 | ||
| 66 | -y | --yes ) | 250 | -y | --yes ) |
| 67 | auto_answer=yes | 251 | csih_auto_answer=yes |
| 68 | ;; | 252 | ;; |
| 69 | 253 | ||
| 70 | -n | --no ) | 254 | -n | --no ) |
| 71 | auto_answer=no | 255 | csih_auto_answer=no |
| 72 | ;; | 256 | ;; |
| 73 | 257 | ||
| 74 | -p | --passphrase ) | 258 | -p | --passphrase ) |
| @@ -77,8 +261,12 @@ do | |||
| 77 | shift | 261 | shift |
| 78 | ;; | 262 | ;; |
| 79 | 263 | ||
| 264 | --privileged ) | ||
| 265 | csih_FORCE_PRIVILEGED_USER=yes | ||
| 266 | ;; | ||
| 267 | |||
| 80 | *) | 268 | *) |
| 81 | echo "usage: ${progname} [OPTION]..." | 269 | echo "usage: ${PROGNAME} [OPTION]..." |
| 82 | echo | 270 | echo |
| 83 | echo "This script creates an OpenSSH user configuration." | 271 | echo "This script creates an OpenSSH user configuration." |
| 84 | echo | 272 | echo |
| @@ -87,6 +275,8 @@ do | |||
| 87 | echo " --yes -y Answer all questions with \"yes\" automatically." | 275 | echo " --yes -y Answer all questions with \"yes\" automatically." |
| 88 | echo " --no -n Answer all questions with \"no\" automatically." | 276 | echo " --no -n Answer all questions with \"no\" automatically." |
| 89 | echo " --passphrase -p word Use \"word\" as passphrase automatically." | 277 | echo " --passphrase -p word Use \"word\" as passphrase automatically." |
| 278 | echo " --privileged On Windows NT/2k/XP, assume privileged user" | ||
| 279 | echo " instead of LocalSystem for sshd service." | ||
| 90 | echo | 280 | echo |
| 91 | exit 1 | 281 | exit 1 |
| 92 | ;; | 282 | ;; |
| @@ -94,157 +284,27 @@ do | |||
| 94 | esac | 284 | esac |
| 95 | done | 285 | done |
| 96 | 286 | ||
| 97 | # Ask user if user identity should be generated | 287 | # ====================================================================== |
| 288 | # Action! | ||
| 289 | # ====================================================================== | ||
| 98 | 290 | ||
| 291 | # Check passwd file | ||
| 99 | if [ ! -f ${SYSCONFDIR}/passwd ] | 292 | if [ ! -f ${SYSCONFDIR}/passwd ] |
| 100 | then | 293 | then |
| 101 | echo "${SYSCONFDIR}/passwd is nonexistant. Please generate an ${SYSCONFDIR}/passwd file" | 294 | csih_error_multiline \ |
| 102 | echo 'first using mkpasswd. Check if it contains an entry for you and' | 295 | "${SYSCONFDIR}/passwd is nonexistant. Please generate an ${SYSCONFDIR}/passwd file" \ |
| 103 | echo 'please care for the home directory in your entry as well.' | 296 | 'first using mkpasswd. Check if it contains an entry for you and' \ |
| 104 | exit 1 | 297 | 'please care for the home directory in your entry as well.' |
| 105 | fi | ||
| 106 | |||
| 107 | uid=`id -u` | ||
| 108 | pwdhome=`awk -F: '{ if ( $3 == '${uid}' ) print $6; }' < ${SYSCONFDIR}/passwd` | ||
| 109 | |||
| 110 | if [ "X${pwdhome}" = "X" ] | ||
| 111 | then | ||
| 112 | echo "There is no home directory set for you in ${SYSCONFDIR}/passwd." | ||
| 113 | echo 'Setting $HOME is not sufficient!' | ||
| 114 | exit 1 | ||
| 115 | fi | ||
| 116 | |||
| 117 | if [ ! -d "${pwdhome}" ] | ||
| 118 | then | ||
| 119 | echo "${pwdhome} is set in ${SYSCONFDIR}/passwd as your home directory" | ||
| 120 | echo 'but it is not a valid directory. Cannot create user identity files.' | ||
| 121 | exit 1 | ||
| 122 | fi | ||
| 123 | |||
| 124 | # If home is the root dir, set home to empty string to avoid error messages | ||
| 125 | # in subsequent parts of that script. | ||
| 126 | if [ "X${pwdhome}" = "X/" ] | ||
| 127 | then | ||
| 128 | # But first raise a warning! | ||
| 129 | echo "Your home directory in ${SYSCONFDIR}/passwd is set to root (/). This is not recommended!" | ||
| 130 | if request "Would you like to proceed anyway?" | ||
| 131 | then | ||
| 132 | pwdhome='' | ||
| 133 | else | ||
| 134 | exit 1 | ||
| 135 | fi | ||
| 136 | fi | ||
| 137 | |||
| 138 | if [ -d "${pwdhome}" -a $_nt -gt 0 -a -n "`chmod -c g-w,o-w "${pwdhome}"`" ] | ||
| 139 | then | ||
| 140 | echo | ||
| 141 | echo 'WARNING: group and other have been revoked write permission to your home' | ||
| 142 | echo " directory ${pwdhome}." | ||
| 143 | echo ' This is required by OpenSSH to allow public key authentication using' | ||
| 144 | echo ' the key files stored in your .ssh subdirectory.' | ||
| 145 | echo ' Revert this change ONLY if you know what you are doing!' | ||
| 146 | echo | ||
| 147 | fi | ||
| 148 | |||
| 149 | if [ -e "${pwdhome}/.ssh" -a ! -d "${pwdhome}/.ssh" ] | ||
| 150 | then | ||
| 151 | echo "${pwdhome}/.ssh is existant but not a directory. Cannot create user identity files." | ||
| 152 | exit 1 | ||
| 153 | fi | ||
| 154 | |||
| 155 | if [ ! -e "${pwdhome}/.ssh" ] | ||
| 156 | then | ||
| 157 | mkdir "${pwdhome}/.ssh" | ||
| 158 | if [ ! -e "${pwdhome}/.ssh" ] | ||
| 159 | then | ||
| 160 | echo "Creating users ${pwdhome}/.ssh directory failed" | ||
| 161 | exit 1 | ||
| 162 | fi | ||
| 163 | fi | ||
| 164 | |||
| 165 | if [ $_nt -gt 0 ] | ||
| 166 | then | ||
| 167 | _user="system" | ||
| 168 | if [ $_nt2003 -gt 0 ] | ||
| 169 | then | ||
| 170 | grep -q '^sshd_server:' ${SYSCONFDIR}/passwd && _user="sshd_server" | ||
| 171 | fi | ||
| 172 | if ! setfacl -m "u::rwx,u:${_user}:r--,g::---,o::---" "${pwdhome}/.ssh" | ||
| 173 | then | ||
| 174 | echo "${pwdhome}/.ssh couldn't be given the correct permissions." | ||
| 175 | echo "Please try to solve this problem first." | ||
| 176 | exit 1 | ||
| 177 | fi | ||
| 178 | fi | ||
| 179 | |||
| 180 | if [ ! -f "${pwdhome}/.ssh/identity" ] | ||
| 181 | then | ||
| 182 | if request "Shall I create an SSH1 RSA identity file for you?" | ||
| 183 | then | ||
| 184 | echo "Generating ${pwdhome}/.ssh/identity" | ||
| 185 | if [ "${with_passphrase}" = "yes" ] | ||
| 186 | then | ||
| 187 | ssh-keygen -t rsa1 -N "${passphrase}" -f "${pwdhome}/.ssh/identity" > /dev/null | ||
| 188 | else | ||
| 189 | ssh-keygen -t rsa1 -f "${pwdhome}/.ssh/identity" > /dev/null | ||
| 190 | fi | ||
| 191 | if request "Do you want to use this identity to login to this machine?" | ||
| 192 | then | ||
| 193 | echo "Adding to ${pwdhome}/.ssh/authorized_keys" | ||
| 194 | cat "${pwdhome}/.ssh/identity.pub" >> "${pwdhome}/.ssh/authorized_keys" | ||
| 195 | fi | ||
| 196 | fi | ||
| 197 | fi | 298 | fi |
| 198 | 299 | ||
| 199 | if [ ! -f "${pwdhome}/.ssh/id_rsa" ] | 300 | check_user_homedir |
| 200 | then | 301 | check_user_dot_ssh_dir |
| 201 | if request "Shall I create an SSH2 RSA identity file for you?" | 302 | create_ssh1_identity |
| 202 | then | 303 | create_ssh2_rsa_identity |
| 203 | echo "Generating ${pwdhome}/.ssh/id_rsa" | 304 | create_ssh2_dsa_identity |
| 204 | if [ "${with_passphrase}" = "yes" ] | 305 | fix_authorized_keys_perms |
| 205 | then | ||
| 206 | ssh-keygen -t rsa -N "${passphrase}" -f "${pwdhome}/.ssh/id_rsa" > /dev/null | ||
| 207 | else | ||
| 208 | ssh-keygen -t rsa -f "${pwdhome}/.ssh/id_rsa" > /dev/null | ||
| 209 | fi | ||
| 210 | if request "Do you want to use this identity to login to this machine?" | ||
| 211 | then | ||
| 212 | echo "Adding to ${pwdhome}/.ssh/authorized_keys" | ||
| 213 | cat "${pwdhome}/.ssh/id_rsa.pub" >> "${pwdhome}/.ssh/authorized_keys" | ||
| 214 | fi | ||
| 215 | fi | ||
| 216 | fi | ||
| 217 | 306 | ||
| 218 | if [ ! -f "${pwdhome}/.ssh/id_dsa" ] | 307 | echo |
| 219 | then | 308 | csih_inform "Configuration finished. Have fun!" |
| 220 | if request "Shall I create an SSH2 DSA identity file for you?" | ||
| 221 | then | ||
| 222 | echo "Generating ${pwdhome}/.ssh/id_dsa" | ||
| 223 | if [ "${with_passphrase}" = "yes" ] | ||
| 224 | then | ||
| 225 | ssh-keygen -t dsa -N "${passphrase}" -f "${pwdhome}/.ssh/id_dsa" > /dev/null | ||
| 226 | else | ||
| 227 | ssh-keygen -t dsa -f "${pwdhome}/.ssh/id_dsa" > /dev/null | ||
| 228 | fi | ||
| 229 | if request "Do you want to use this identity to login to this machine?" | ||
| 230 | then | ||
| 231 | echo "Adding to ${pwdhome}/.ssh/authorized_keys" | ||
| 232 | cat "${pwdhome}/.ssh/id_dsa.pub" >> "${pwdhome}/.ssh/authorized_keys" | ||
| 233 | fi | ||
| 234 | fi | ||
| 235 | fi | ||
| 236 | 309 | ||
| 237 | if [ $_nt -gt 0 -a -e "${pwdhome}/.ssh/authorized_keys" ] | ||
| 238 | then | ||
| 239 | if ! setfacl -m "u::rw-,u:${_user}:r--,g::---,o::---" "${pwdhome}/.ssh/authorized_keys" | ||
| 240 | then | ||
| 241 | echo | ||
| 242 | echo "WARNING: Setting correct permissions to ${pwdhome}/.ssh/authorized_keys" | ||
| 243 | echo "failed. Please care for the correct permissions. The minimum requirement" | ||
| 244 | echo "is, the owner and ${_user} both need read permissions." | ||
| 245 | echo | ||
| 246 | fi | ||
| 247 | fi | ||
| 248 | 310 | ||
| 249 | echo | ||
| 250 | echo "Configuration finished. Have fun!" | ||
diff --git a/contrib/cygwin/sshd-inetd b/contrib/cygwin/sshd-inetd new file mode 100644 index 000000000..aa6bf073f --- /dev/null +++ b/contrib/cygwin/sshd-inetd | |||
| @@ -0,0 +1,4 @@ | |||
| 1 | # This file can be used to enable sshd as a slave of the inetd service | ||
| 2 | # To do so, the line below should be uncommented. | ||
| 3 | @COMMENT@ ssh stream tcp nowait root /usr/sbin/sshd sshd -i | ||
| 4 | |||
diff --git a/contrib/redhat/openssh.spec b/contrib/redhat/openssh.spec index 34ec6b7e1..bb9e4d616 100644 --- a/contrib/redhat/openssh.spec +++ b/contrib/redhat/openssh.spec | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | %define ver 4.7p1 | 1 | %define ver 5.1p1 |
| 2 | %define rel 1 | 2 | %define rel 1 |
| 3 | 3 | ||
| 4 | # OpenSSH privilege separation requires a user & group ID | 4 | # OpenSSH privilege separation requires a user & group ID |
| @@ -376,6 +376,7 @@ fi | |||
| 376 | %attr(0755,root,root) %{_sbindir}/sshd | 376 | %attr(0755,root,root) %{_sbindir}/sshd |
| 377 | %attr(0755,root,root) %{_libexecdir}/openssh/sftp-server | 377 | %attr(0755,root,root) %{_libexecdir}/openssh/sftp-server |
| 378 | %attr(0644,root,root) %{_mandir}/man8/sshd.8* | 378 | %attr(0644,root,root) %{_mandir}/man8/sshd.8* |
| 379 | %attr(0644,root,root) %{_mandir}/man5/moduli.5* | ||
| 379 | %attr(0644,root,root) %{_mandir}/man5/sshd_config.5* | 380 | %attr(0644,root,root) %{_mandir}/man5/sshd_config.5* |
| 380 | %attr(0644,root,root) %{_mandir}/man8/sftp-server.8* | 381 | %attr(0644,root,root) %{_mandir}/man8/sftp-server.8* |
| 381 | %attr(0755,root,root) %dir %{_sysconfdir}/ssh | 382 | %attr(0755,root,root) %dir %{_sysconfdir}/ssh |
diff --git a/contrib/ssh-copy-id b/contrib/ssh-copy-id index 2c480e359..65c0a8cd8 100644 --- a/contrib/ssh-copy-id +++ b/contrib/ssh-copy-id | |||
| @@ -11,7 +11,7 @@ if [ "-i" = "$1" ]; then | |||
| 11 | shift | 11 | shift |
| 12 | # check if we have 2 parameters left, if so the first is the new ID file | 12 | # check if we have 2 parameters left, if so the first is the new ID file |
| 13 | if [ -n "$2" ]; then | 13 | if [ -n "$2" ]; then |
| 14 | if expr "$1" : ".*\.pub" >/dev/null; then | 14 | if expr "$1" : ".*\.pub" > /dev/null ; then |
| 15 | ID_FILE="$1" | 15 | ID_FILE="$1" |
| 16 | else | 16 | else |
| 17 | ID_FILE="$1.pub" | 17 | ID_FILE="$1.pub" |
diff --git a/contrib/suse/openssh.spec b/contrib/suse/openssh.spec index 1f5230586..7bd9e0569 100644 --- a/contrib/suse/openssh.spec +++ b/contrib/suse/openssh.spec | |||
| @@ -13,7 +13,7 @@ | |||
| 13 | 13 | ||
| 14 | Summary: OpenSSH, a free Secure Shell (SSH) protocol implementation | 14 | Summary: OpenSSH, a free Secure Shell (SSH) protocol implementation |
| 15 | Name: openssh | 15 | Name: openssh |
| 16 | Version: 4.7p1 | 16 | Version: 5.1p1 |
| 17 | URL: http://www.openssh.com/ | 17 | URL: http://www.openssh.com/ |
| 18 | Release: 1 | 18 | Release: 1 |
| 19 | Source0: openssh-%{version}.tar.gz | 19 | Source0: openssh-%{version}.tar.gz |
| @@ -201,7 +201,7 @@ fi | |||
| 201 | %files | 201 | %files |
| 202 | %defattr(-,root,root) | 202 | %defattr(-,root,root) |
| 203 | %doc ChangeLog OVERVIEW README* | 203 | %doc ChangeLog OVERVIEW README* |
| 204 | %doc RFC.nroff TODO CREDITS LICENCE | 204 | %doc TODO CREDITS LICENCE |
| 205 | %attr(0755,root,root) %dir %{_sysconfdir}/ssh | 205 | %attr(0755,root,root) %dir %{_sysconfdir}/ssh |
| 206 | %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ssh/ssh_config | 206 | %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ssh/ssh_config |
| 207 | %attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/sshd_config | 207 | %attr(0600,root,root) %config(noreplace) %{_sysconfdir}/ssh/sshd_config |
| @@ -228,6 +228,7 @@ fi | |||
| 228 | %attr(0644,root,root) %doc %{_mandir}/man1/ssh-agent.1* | 228 | %attr(0644,root,root) %doc %{_mandir}/man1/ssh-agent.1* |
| 229 | %attr(0644,root,root) %doc %{_mandir}/man1/ssh-keygen.1* | 229 | %attr(0644,root,root) %doc %{_mandir}/man1/ssh-keygen.1* |
| 230 | %attr(0644,root,root) %doc %{_mandir}/man1/ssh-keyscan.1* | 230 | %attr(0644,root,root) %doc %{_mandir}/man1/ssh-keyscan.1* |
| 231 | %attr(0644,root,root) %doc %{_mandir}/man5/moduli.5* | ||
| 231 | %attr(0644,root,root) %doc %{_mandir}/man5/ssh_config.5* | 232 | %attr(0644,root,root) %doc %{_mandir}/man5/ssh_config.5* |
| 232 | %attr(0644,root,root) %doc %{_mandir}/man5/sshd_config.5* | 233 | %attr(0644,root,root) %doc %{_mandir}/man5/sshd_config.5* |
| 233 | %attr(0644,root,root) %doc %{_mandir}/man8/sftp-server.8* | 234 | %attr(0644,root,root) %doc %{_mandir}/man8/sftp-server.8* |
diff --git a/debian/changelog b/debian/changelog index 8ba684245..1530329a9 100644 --- a/debian/changelog +++ b/debian/changelog | |||
| @@ -1,3 +1,148 @@ | |||
| 1 | openssh (1:5.1p1-1) UNRELEASED; urgency=low | ||
| 2 | |||
| 3 | * New upstream release (closes: #474301). Important changes not previously | ||
| 4 | backported to 4.7p1: | ||
| 5 | - 4.9/4.9p1 (http://www.openssh.com/txt/release-4.9): | ||
| 6 | + Added chroot(2) support for sshd(8), controlled by a new option | ||
| 7 | "ChrootDirectory" (closes: #139047, LP: #24777). | ||
| 8 | + Linked sftp-server(8) into sshd(8). The internal sftp server is used | ||
| 9 | when the command "internal-sftp" is specified in a Subsystem or | ||
| 10 | ForceCommand declaration. When used with ChrootDirectory, the | ||
| 11 | internal sftp server requires no special configuration of files | ||
| 12 | inside the chroot environment. | ||
| 13 | + Added a protocol extension method "posix-rename@openssh.com" for | ||
| 14 | sftp-server(8) to perform POSIX atomic rename() operations; sftp(1) | ||
| 15 | prefers this if available (closes: #308561). | ||
| 16 | + Removed the fixed limit of 100 file handles in sftp-server(8). | ||
| 17 | + ssh(8) will now skip generation of SSH protocol 1 ephemeral server | ||
| 18 | keys when in inetd mode and protocol 2 connections are negotiated. | ||
| 19 | This speeds up protocol 2 connections to inetd-mode servers that | ||
| 20 | also allow Protocol 1. | ||
| 21 | + Accept the PermitRootLogin directive in a sshd_config(5) Match | ||
| 22 | block. Allows for, e.g. permitting root only from the local network. | ||
| 23 | + Reworked sftp(1) argument splitting and escaping to be more | ||
| 24 | internally consistent (i.e. between sftp commands) and more | ||
| 25 | consistent with sh(1). Please note that this will change the | ||
| 26 | interpretation of some quoted strings, especially those with | ||
| 27 | embedded backslash escape sequences. | ||
| 28 | + Support "Banner=none" in sshd_config(5) to disable sending of a | ||
| 29 | pre-login banner (e.g. in a Match block). | ||
| 30 | + ssh(1) ProxyCommands are now executed with $SHELL rather than | ||
| 31 | /bin/sh. | ||
| 32 | + ssh(1)'s ConnectTimeout option is now applied to both the TCP | ||
| 33 | connection and the SSH banner exchange (previously it just covered | ||
| 34 | the TCP connection). This allows callers of ssh(1) to better detect | ||
| 35 | and deal with stuck servers that accept a TCP connection but don't | ||
| 36 | progress the protocol, and also makes ConnectTimeout useful for | ||
| 37 | connections via a ProxyCommand. | ||
| 38 | + scp(1) incorrectly reported "stalled" on slow copies (closes: | ||
| 39 | #140828). | ||
| 40 | + scp(1) date underflow for timestamps before epoch. | ||
| 41 | + ssh(1) used the obsolete SIG DNS RRtype for host keys in DNS, | ||
| 42 | instead of the current standard RRSIG. | ||
| 43 | + Correctly drain ACKs when a sftp(1) upload write fails midway, | ||
| 44 | avoids a fatal() exit from what should be a recoverable condition. | ||
| 45 | + Fixed ssh-keygen(1) selective host key hashing (i.e. "ssh-keygen -HF | ||
| 46 | hostname") to not include any IP address in the data to be hashed. | ||
| 47 | + Make ssh(1) skip listening on the IPv6 wildcard address when a | ||
| 48 | binding address of 0.0.0.0 is used against an old SSH server that | ||
| 49 | does not support the RFC4254 syntax for wildcard bind addresses. | ||
| 50 | + Enable IPV6_V6ONLY socket option on sshd(8) listen socket, as is | ||
| 51 | already done for X11/TCP forwarding sockets (closes: #439661). | ||
| 52 | + Fix FD leak that could hang a ssh(1) connection multiplexing master. | ||
| 53 | + Make ssh(1) -q option documentation consistent with reality. | ||
| 54 | + Fixed sshd(8) PAM support not calling pam_session_close(), or | ||
| 55 | failing to call it with root privileges (closes: #372680). | ||
| 56 | + Fix activation of OpenSSL engine support when requested in configure | ||
| 57 | (LP: #119295). | ||
| 58 | - 5.1/5.1p1 (http://www.openssh.com/txt/release-5.1): | ||
| 59 | + Introduce experimental SSH Fingerprint ASCII Visualisation to ssh(1) | ||
| 60 | and ssh-keygen(1). Visual fingerprint display is controlled by a new | ||
| 61 | ssh_config(5) option "VisualHostKey". The intent is to render SSH | ||
| 62 | host keys in a visual form that is amenable to easy recall and | ||
| 63 | rejection of changed host keys. | ||
| 64 | + sshd_config(5) now supports CIDR address/masklen matching in "Match | ||
| 65 | address" blocks, with a fallback to classic wildcard matching. | ||
| 66 | + sshd(8) now supports CIDR matching in ~/.ssh/authorized_keys | ||
| 67 | from="..." restrictions, also with a fallback to classic wildcard | ||
| 68 | matching. | ||
| 69 | + Added an extended test mode (-T) to sshd(8) to request that it write | ||
| 70 | its effective configuration to stdout and exit. Extended test mode | ||
| 71 | also supports the specification of connection parameters (username, | ||
| 72 | source address and hostname) to test the application of | ||
| 73 | sshd_config(5) Match rules. | ||
| 74 | + ssh(1) now prints the number of bytes transferred and the overall | ||
| 75 | connection throughput for SSH protocol 2 sessions when in verbose | ||
| 76 | mode (previously these statistics were displayed for protocol 1 | ||
| 77 | connections only). | ||
| 78 | + sftp-server(8) now supports extension methods statvfs@openssh.com | ||
| 79 | and fstatvfs@openssh.com that implement statvfs(2)-like operations. | ||
| 80 | + sftp(1) now has a "df" command to the sftp client that uses the | ||
| 81 | statvfs@openssh.com to produce a df(1)-like display of filesystem | ||
| 82 | space and inode utilisation (requires statvfs@openssh.com support on | ||
| 83 | the server). | ||
| 84 | + Added a MaxSessions option to sshd_config(5) to allow control of the | ||
| 85 | number of multiplexed sessions supported over a single TCP | ||
| 86 | connection. This allows increasing the number of allowed sessions | ||
| 87 | above the previous default of 10, disabling connection multiplexing | ||
| 88 | (MaxSessions=1) or disallowing login/shell/subsystem sessions | ||
| 89 | entirely (MaxSessions=0). | ||
| 90 | + Added a no-more-sessions@openssh.com global request extension that | ||
| 91 | is sent from ssh(1) to sshd(8) when the client knows that it will | ||
| 92 | never request another session (i.e. when session multiplexing is | ||
| 93 | disabled). This allows a server to disallow further session requests | ||
| 94 | and terminate the session in cases where the client has been | ||
| 95 | hijacked. | ||
| 96 | + ssh-keygen(1) now supports the use of the -l option in combination | ||
| 97 | with -F to search for a host in ~/.ssh/known_hosts and display its | ||
| 98 | fingerprint. | ||
| 99 | + ssh-keyscan(1) now defaults to "rsa" (protocol 2) keys, instead of | ||
| 100 | "rsa1". | ||
| 101 | + Added an AllowAgentForwarding option to sshd_config(8) to control | ||
| 102 | whether authentication agent forwarding is permitted. Note that this | ||
| 103 | is a loose control, as a client may install their own unofficial | ||
| 104 | forwarder. | ||
| 105 | + ssh(1) and sshd(8): avoid unnecessary malloc/copy/free when | ||
| 106 | receiving network data, resulting in a ~10% speedup. | ||
| 107 | + ssh(1) and sshd(8) will now try additional addresses when connecting | ||
| 108 | to a port forward destination whose DNS name resolves to more than | ||
| 109 | one address. The previous behaviour was to try the only first | ||
| 110 | address and give up if that failed. | ||
| 111 | + ssh(1) and sshd(8) now support signalling that channels are | ||
| 112 | half-closed for writing, through a channel protocol extension | ||
| 113 | notification "eow@openssh.com". This allows propagation of closed | ||
| 114 | file descriptors, so that commands such as "ssh -2 localhost od | ||
| 115 | /bin/ls | true" do not send unnecessary data over the wire. | ||
| 116 | + sshd(8): increased the default size of ssh protocol 1 ephemeral keys | ||
| 117 | from 768 to 1024 bits. | ||
| 118 | + When ssh(1) has been requested to fork after authentication ("ssh | ||
| 119 | -f") with ExitOnForwardFailure enabled, delay the fork until after | ||
| 120 | replies for any -R forwards have been seen. Allows for robust | ||
| 121 | detection of -R forward failure when using -f. | ||
| 122 | + "Match group" blocks in sshd_config(5) now support negation of | ||
| 123 | groups. E.g. "Match group staff,!guests". | ||
| 124 | + sftp(1) and sftp-server(8) now allow chmod-like operations to set | ||
| 125 | set[ug]id/sticky bits. | ||
| 126 | + The MaxAuthTries option is now permitted in sshd_config(5) match | ||
| 127 | blocks. | ||
| 128 | + Multiplexed ssh(1) sessions now support a subset of the ~ escapes | ||
| 129 | that are available to a primary connection. | ||
| 130 | + ssh(1) connection multiplexing will now fall back to creating a new | ||
| 131 | connection in most error cases (closes: #352830). | ||
| 132 | + Make ssh(1) deal more gracefully with channel requests that fail. | ||
| 133 | Previously it would optimistically assume that requests would always | ||
| 134 | succeed, which could cause hangs if they did not (e.g. when the | ||
| 135 | server runs out of file descriptors). | ||
| 136 | + ssh(1) now reports multiplexing errors via the multiplex slave's | ||
| 137 | stderr where possible (subject to LogLevel in the mux master). | ||
| 138 | + Prevent sshd(8) from erroneously applying public key restrictions | ||
| 139 | leaned from ~/.ssh/authorized_keys to other authentication methods | ||
| 140 | when public key authentication subsequently fails (LP: #161047). | ||
| 141 | + Fixed an UMAC alignment problem that manifested on Itanium | ||
| 142 | platforms. | ||
| 143 | |||
| 144 | -- Colin Watson <cjwatson@ubuntu.com> Tue, 22 Jul 2008 17:34:06 +0100 | ||
| 145 | |||
| 1 | openssh (1:4.7p1-13) unstable; urgency=low | 146 | openssh (1:4.7p1-13) unstable; urgency=low |
| 2 | 147 | ||
| 3 | * Add some helpful advice to the end of ssh-vulnkey's output if there are | 148 | * Add some helpful advice to the end of ssh-vulnkey's output if there are |
| @@ -25,7 +25,7 @@ | |||
| 25 | #ifndef _DEFINES_H | 25 | #ifndef _DEFINES_H |
| 26 | #define _DEFINES_H | 26 | #define _DEFINES_H |
| 27 | 27 | ||
| 28 | /* $Id: defines.h,v 1.143 2007/08/09 04:37:52 dtucker Exp $ */ | 28 | /* $Id: defines.h,v 1.151 2008/07/04 13:10:49 djm Exp $ */ |
| 29 | 29 | ||
| 30 | 30 | ||
| 31 | /* Constants */ | 31 | /* Constants */ |
| @@ -431,10 +431,6 @@ struct winsize { | |||
| 431 | # define __attribute__(x) | 431 | # define __attribute__(x) |
| 432 | #endif /* !defined(__GNUC__) || (__GNUC__ < 2) */ | 432 | #endif /* !defined(__GNUC__) || (__GNUC__ < 2) */ |
| 433 | 433 | ||
| 434 | #ifndef __dead | ||
| 435 | # define __dead __attribute__((noreturn)) | ||
| 436 | #endif | ||
| 437 | |||
| 438 | #if !defined(HAVE_ATTRIBUTE__SENTINEL__) && !defined(__sentinel__) | 434 | #if !defined(HAVE_ATTRIBUTE__SENTINEL__) && !defined(__sentinel__) |
| 439 | # define __sentinel__ | 435 | # define __sentinel__ |
| 440 | #endif | 436 | #endif |
| @@ -540,6 +536,10 @@ struct winsize { | |||
| 540 | # undef HAVE_UPDWTMPX | 536 | # undef HAVE_UPDWTMPX |
| 541 | #endif | 537 | #endif |
| 542 | 538 | ||
| 539 | #if defined(BROKEN_SHADOW_EXPIRE) && defined(HAS_SHADOW_EXPIRE) | ||
| 540 | # undef HAS_SHADOW_EXPIRE | ||
| 541 | #endif | ||
| 542 | |||
| 543 | #if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT) && \ | 543 | #if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT) && \ |
| 544 | defined(SYSLOG_R_SAFE_IN_SIGHAND) | 544 | defined(SYSLOG_R_SAFE_IN_SIGHAND) |
| 545 | # define DO_LOG_SAFE_IN_SIGHAND | 545 | # define DO_LOG_SAFE_IN_SIGHAND |
| @@ -563,11 +563,6 @@ struct winsize { | |||
| 563 | # define CUSTOM_SSH_AUDIT_EVENTS | 563 | # define CUSTOM_SSH_AUDIT_EVENTS |
| 564 | #endif | 564 | #endif |
| 565 | 565 | ||
| 566 | /* OPENSSL_free() is Free() in versions before OpenSSL 0.9.6 */ | ||
| 567 | #if !defined(OPENSSL_VERSION_NUMBER) || (OPENSSL_VERSION_NUMBER < 0x0090600f) | ||
| 568 | # define OPENSSL_free(x) Free(x) | ||
| 569 | #endif | ||
| 570 | |||
| 571 | #if !defined(HAVE___func__) && defined(HAVE___FUNCTION__) | 566 | #if !defined(HAVE___func__) && defined(HAVE___FUNCTION__) |
| 572 | # define __func__ __FUNCTION__ | 567 | # define __func__ __FUNCTION__ |
| 573 | #elif !defined(HAVE___func__) | 568 | #elif !defined(HAVE___func__) |
| @@ -591,6 +586,15 @@ struct winsize { | |||
| 591 | # define SSH_SYSFDMAX 10000 | 586 | # define SSH_SYSFDMAX 10000 |
| 592 | #endif | 587 | #endif |
| 593 | 588 | ||
| 589 | #ifdef FSID_HAS_VAL | ||
| 590 | /* encode f_fsid into a 64 bit value */ | ||
| 591 | #define FSID_TO_ULONG(f) \ | ||
| 592 | ((((u_int64_t)(f).val[0] & 0xffffffffUL) << 32) | \ | ||
| 593 | ((f).val[1] & 0xffffffffUL)) | ||
| 594 | #else | ||
| 595 | # define FSID_TO_ULONG(f) ((f)) | ||
| 596 | #endif | ||
| 597 | |||
| 594 | #if defined(__Lynx__) | 598 | #if defined(__Lynx__) |
| 595 | /* | 599 | /* |
| 596 | * LynxOS defines these in param.h which we do not want to include since | 600 | * LynxOS defines these in param.h which we do not want to include since |
| @@ -694,9 +698,11 @@ struct winsize { | |||
| 694 | # define CUSTOM_SYS_AUTH_PASSWD 1 | 698 | # define CUSTOM_SYS_AUTH_PASSWD 1 |
| 695 | #endif | 699 | #endif |
| 696 | 700 | ||
| 701 | #if defined(HAVE_LIBIAF) && defined(HAVE_SET_ID) | ||
| 702 | # define CUSTOM_SYS_AUTH_PASSWD 1 | ||
| 703 | #endif | ||
| 697 | #if defined(HAVE_LIBIAF) && defined(HAVE_SET_ID) && !defined(BROKEN_LIBIAF) | 704 | #if defined(HAVE_LIBIAF) && defined(HAVE_SET_ID) && !defined(BROKEN_LIBIAF) |
| 698 | # define USE_LIBIAF | 705 | # define USE_LIBIAF |
| 699 | # define CUSTOM_SYS_AUTH_PASSWD 1 | ||
| 700 | #endif | 706 | #endif |
| 701 | 707 | ||
| 702 | /* HP-UX 11.11 */ | 708 | /* HP-UX 11.11 */ |
| @@ -728,4 +734,8 @@ struct winsize { | |||
| 728 | # endif | 734 | # endif |
| 729 | #endif | 735 | #endif |
| 730 | 736 | ||
| 737 | #ifndef EWOULDBLOCK | ||
| 738 | # define EWOULDBLOCK EAGAIN | ||
| 739 | #endif | ||
| 740 | |||
| 731 | #endif /* _DEFINES_H */ | 741 | #endif /* _DEFINES_H */ |
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: dh.c,v 1.44 2006/11/07 13:02:07 markus Exp $ */ | 1 | /* $OpenBSD: dh.c,v 1.47 2008/06/26 09:19:39 djm Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Copyright (c) 2000 Niels Provos. All rights reserved. | 3 | * Copyright (c) 2000 Niels Provos. All rights reserved. |
| 4 | * | 4 | * |
| @@ -46,6 +46,7 @@ parse_prime(int linenum, char *line, struct dhgroup *dhg) | |||
| 46 | char *cp, *arg; | 46 | char *cp, *arg; |
| 47 | char *strsize, *gen, *prime; | 47 | char *strsize, *gen, *prime; |
| 48 | const char *errstr = NULL; | 48 | const char *errstr = NULL; |
| 49 | long long n; | ||
| 49 | 50 | ||
| 50 | cp = line; | 51 | cp = line; |
| 51 | if ((arg = strdelim(&cp)) == NULL) | 52 | if ((arg = strdelim(&cp)) == NULL) |
| @@ -62,12 +63,24 @@ parse_prime(int linenum, char *line, struct dhgroup *dhg) | |||
| 62 | arg = strsep(&cp, " "); /* type */ | 63 | arg = strsep(&cp, " "); /* type */ |
| 63 | if (cp == NULL || *arg == '\0') | 64 | if (cp == NULL || *arg == '\0') |
| 64 | goto fail; | 65 | goto fail; |
| 66 | /* Ensure this is a safe prime */ | ||
| 67 | n = strtonum(arg, 0, 5, &errstr); | ||
| 68 | if (errstr != NULL || n != MODULI_TYPE_SAFE) | ||
| 69 | goto fail; | ||
| 65 | arg = strsep(&cp, " "); /* tests */ | 70 | arg = strsep(&cp, " "); /* tests */ |
| 66 | if (cp == NULL || *arg == '\0') | 71 | if (cp == NULL || *arg == '\0') |
| 67 | goto fail; | 72 | goto fail; |
| 73 | /* Ensure prime has been tested and is not composite */ | ||
| 74 | n = strtonum(arg, 0, 0x1f, &errstr); | ||
| 75 | if (errstr != NULL || | ||
| 76 | (n & MODULI_TESTS_COMPOSITE) || !(n & ~MODULI_TESTS_COMPOSITE)) | ||
| 77 | goto fail; | ||
| 68 | arg = strsep(&cp, " "); /* tries */ | 78 | arg = strsep(&cp, " "); /* tries */ |
| 69 | if (cp == NULL || *arg == '\0') | 79 | if (cp == NULL || *arg == '\0') |
| 70 | goto fail; | 80 | goto fail; |
| 81 | n = strtonum(arg, 0, 1<<30, &errstr); | ||
| 82 | if (errstr != NULL || n == 0) | ||
| 83 | goto fail; | ||
| 71 | strsize = strsep(&cp, " "); /* size */ | 84 | strsize = strsep(&cp, " "); /* size */ |
| 72 | if (cp == NULL || *strsize == '\0' || | 85 | if (cp == NULL || *strsize == '\0' || |
| 73 | (dhg->size = (u_int)strtonum(strsize, 0, 64*1024, &errstr)) == 0 || | 86 | (dhg->size = (u_int)strtonum(strsize, 0, 64*1024, &errstr)) == 0 || |
| @@ -153,7 +166,7 @@ choose_dh(int min, int wantbits, int max) | |||
| 153 | } | 166 | } |
| 154 | 167 | ||
| 155 | linenum = 0; | 168 | linenum = 0; |
| 156 | which = arc4random() % bestcount; | 169 | which = arc4random_uniform(bestcount); |
| 157 | while (fgets(line, sizeof(line), f)) { | 170 | while (fgets(line, sizeof(line), f)) { |
| 158 | if (!parse_prime(linenum, line, &dhg)) | 171 | if (!parse_prime(linenum, line, &dhg)) |
| 159 | continue; | 172 | continue; |
| @@ -185,7 +198,7 @@ dh_pub_is_valid(DH *dh, BIGNUM *dh_pub) | |||
| 185 | BIGNUM *tmp; | 198 | BIGNUM *tmp; |
| 186 | 199 | ||
| 187 | if (dh_pub->neg) { | 200 | if (dh_pub->neg) { |
| 188 | logit("invalid public DH value: negativ"); | 201 | logit("invalid public DH value: negative"); |
| 189 | return 0; | 202 | return 0; |
| 190 | } | 203 | } |
| 191 | if (BN_cmp(dh_pub, BN_value_one()) != 1) { /* pub_exp <= 1 */ | 204 | if (BN_cmp(dh_pub, BN_value_one()) != 1) { /* pub_exp <= 1 */ |
| @@ -193,8 +206,10 @@ dh_pub_is_valid(DH *dh, BIGNUM *dh_pub) | |||
| 193 | return 0; | 206 | return 0; |
| 194 | } | 207 | } |
| 195 | 208 | ||
| 196 | if ((tmp = BN_new()) == NULL) | 209 | if ((tmp = BN_new()) == NULL) { |
| 197 | return (-1); | 210 | error("%s: BN_new failed", __func__); |
| 211 | return 0; | ||
| 212 | } | ||
| 198 | if (!BN_sub(tmp, dh->p, BN_value_one()) || | 213 | if (!BN_sub(tmp, dh->p, BN_value_one()) || |
| 199 | BN_cmp(dh_pub, tmp) != -1) { /* pub_exp > p-2 */ | 214 | BN_cmp(dh_pub, tmp) != -1) { /* pub_exp > p-2 */ |
| 200 | BN_clear_free(tmp); | 215 | BN_clear_free(tmp); |
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: dh.h,v 1.9 2006/03/25 22:22:43 djm Exp $ */ | 1 | /* $OpenBSD: dh.h,v 1.10 2008/06/26 09:19:40 djm Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Copyright (c) 2000 Niels Provos. All rights reserved. | 4 | * Copyright (c) 2000 Niels Provos. All rights reserved. |
| @@ -46,4 +46,28 @@ int dh_estimate(int); | |||
| 46 | #define DH_GRP_MIN 1024 | 46 | #define DH_GRP_MIN 1024 |
| 47 | #define DH_GRP_MAX 8192 | 47 | #define DH_GRP_MAX 8192 |
| 48 | 48 | ||
| 49 | /* | ||
| 50 | * Values for "type" field of moduli(5) | ||
| 51 | * Specifies the internal structure of the prime modulus. | ||
| 52 | */ | ||
| 53 | #define MODULI_TYPE_UNKNOWN (0) | ||
| 54 | #define MODULI_TYPE_UNSTRUCTURED (1) | ||
| 55 | #define MODULI_TYPE_SAFE (2) | ||
| 56 | #define MODULI_TYPE_SCHNORR (3) | ||
| 57 | #define MODULI_TYPE_SOPHIE_GERMAIN (4) | ||
| 58 | #define MODULI_TYPE_STRONG (5) | ||
| 59 | |||
| 60 | /* | ||
| 61 | * Values for "tests" field of moduli(5) | ||
| 62 | * Specifies the methods used in checking for primality. | ||
| 63 | * Usually, more than one test is used. | ||
| 64 | */ | ||
| 65 | #define MODULI_TESTS_UNTESTED (0x00) | ||
| 66 | #define MODULI_TESTS_COMPOSITE (0x01) | ||
| 67 | #define MODULI_TESTS_SIEVE (0x02) | ||
| 68 | #define MODULI_TESTS_MILLER_RABIN (0x04) | ||
| 69 | #define MODULI_TESTS_JACOBI (0x08) | ||
| 70 | #define MODULI_TESTS_ELLIPTIC (0x10) | ||
| 71 | |||
| 72 | |||
| 49 | #endif | 73 | #endif |
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: dns.c,v 1.24 2007/01/03 03:01:40 stevesk Exp $ */ | 1 | /* $OpenBSD: dns.c,v 1.25 2008/06/12 00:03:49 dtucker Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Copyright (c) 2003 Wesley Griffin. All rights reserved. | 4 | * Copyright (c) 2003 Wesley Griffin. All rights reserved. |
| @@ -145,11 +145,20 @@ is_numeric_hostname(const char *hostname) | |||
| 145 | { | 145 | { |
| 146 | struct addrinfo hints, *ai; | 146 | struct addrinfo hints, *ai; |
| 147 | 147 | ||
| 148 | /* | ||
| 149 | * We shouldn't ever get a null host but if we do then log an error | ||
| 150 | * and return -1 which stops DNS key fingerprint processing. | ||
| 151 | */ | ||
| 152 | if (hostname == NULL) { | ||
| 153 | error("is_numeric_hostname called with NULL hostname"); | ||
| 154 | return -1; | ||
| 155 | } | ||
| 156 | |||
| 148 | memset(&hints, 0, sizeof(hints)); | 157 | memset(&hints, 0, sizeof(hints)); |
| 149 | hints.ai_socktype = SOCK_DGRAM; | 158 | hints.ai_socktype = SOCK_DGRAM; |
| 150 | hints.ai_flags = AI_NUMERICHOST; | 159 | hints.ai_flags = AI_NUMERICHOST; |
| 151 | 160 | ||
| 152 | if (getaddrinfo(hostname, "0", &hints, &ai) == 0) { | 161 | if (getaddrinfo(hostname, NULL, &hints, &ai) == 0) { |
| 153 | freeaddrinfo(ai); | 162 | freeaddrinfo(ai); |
| 154 | return -1; | 163 | return -1; |
| 155 | } | 164 | } |
diff --git a/groupaccess.c b/groupaccess.c index e73f62b22..2381aeb15 100644 --- a/groupaccess.c +++ b/groupaccess.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: groupaccess.c,v 1.12 2006/08/03 03:34:42 deraadt Exp $ */ | 1 | /* $OpenBSD: groupaccess.c,v 1.13 2008/07/04 03:44:59 djm Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Copyright (c) 2001 Kevin Steves. All rights reserved. | 3 | * Copyright (c) 2001 Kevin Steves. All rights reserved. |
| 4 | * | 4 | * |
| @@ -31,6 +31,7 @@ | |||
| 31 | #include <grp.h> | 31 | #include <grp.h> |
| 32 | #include <unistd.h> | 32 | #include <unistd.h> |
| 33 | #include <stdarg.h> | 33 | #include <stdarg.h> |
| 34 | #include <string.h> | ||
| 34 | 35 | ||
| 35 | #include "xmalloc.h" | 36 | #include "xmalloc.h" |
| 36 | #include "groupaccess.h" | 37 | #include "groupaccess.h" |
| @@ -88,6 +89,30 @@ ga_match(char * const *groups, int n) | |||
| 88 | } | 89 | } |
| 89 | 90 | ||
| 90 | /* | 91 | /* |
| 92 | * Return 1 if one of user's groups matches group_pattern list. | ||
| 93 | * Return 0 on negated or no match. | ||
| 94 | */ | ||
| 95 | int | ||
| 96 | ga_match_pattern_list(const char *group_pattern) | ||
| 97 | { | ||
| 98 | int i, found = 0; | ||
| 99 | size_t len = strlen(group_pattern); | ||
| 100 | |||
| 101 | for (i = 0; i < ngroups; i++) { | ||
| 102 | switch (match_pattern_list(groups_byname[i], | ||
| 103 | group_pattern, len, 0)) { | ||
| 104 | case -1: | ||
| 105 | return 0; /* Negated match wins */ | ||
| 106 | case 0: | ||
| 107 | continue; | ||
| 108 | case 1: | ||
| 109 | found = 1; | ||
| 110 | } | ||
| 111 | } | ||
| 112 | return found; | ||
| 113 | } | ||
| 114 | |||
| 115 | /* | ||
| 91 | * Free memory allocated for group access list. | 116 | * Free memory allocated for group access list. |
| 92 | */ | 117 | */ |
| 93 | void | 118 | void |
diff --git a/groupaccess.h b/groupaccess.h index 04b449894..000578e76 100644 --- a/groupaccess.h +++ b/groupaccess.h | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: groupaccess.h,v 1.7 2006/08/03 03:34:42 deraadt Exp $ */ | 1 | /* $OpenBSD: groupaccess.h,v 1.8 2008/07/04 03:44:59 djm Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Copyright (c) 2001 Kevin Steves. All rights reserved. | 4 | * Copyright (c) 2001 Kevin Steves. All rights reserved. |
| @@ -29,6 +29,7 @@ | |||
| 29 | 29 | ||
| 30 | int ga_init(const char *, gid_t); | 30 | int ga_init(const char *, gid_t); |
| 31 | int ga_match(char * const *, int); | 31 | int ga_match(char * const *, int); |
| 32 | int ga_match_pattern_list(const char *); | ||
| 32 | void ga_free(void); | 33 | void ga_free(void); |
| 33 | 34 | ||
| 34 | #endif | 35 | #endif |
diff --git a/gss-serv.c b/gss-serv.c index 3908d6378..9227b797c 100644 --- a/gss-serv.c +++ b/gss-serv.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: gss-serv.c,v 1.21 2007/06/12 08:20:00 djm Exp $ */ | 1 | /* $OpenBSD: gss-serv.c,v 1.22 2008/05/08 12:02:23 djm Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Copyright (c) 2001-2008 Simon Wilkinson. All rights reserved. | 4 | * Copyright (c) 2001-2008 Simon Wilkinson. All rights reserved. |
| @@ -35,6 +35,7 @@ | |||
| 35 | #include <string.h> | 35 | #include <string.h> |
| 36 | #include <unistd.h> | 36 | #include <unistd.h> |
| 37 | 37 | ||
| 38 | #include "openbsd-compat/sys-queue.h" | ||
| 38 | #include "xmalloc.h" | 39 | #include "xmalloc.h" |
| 39 | #include "buffer.h" | 40 | #include "buffer.h" |
| 40 | #include "key.h" | 41 | #include "key.h" |
diff --git a/includes.h b/includes.h index 9fcf1b023..f1b47f666 100644 --- a/includes.h +++ b/includes.h | |||
| @@ -149,6 +149,8 @@ | |||
| 149 | # include <sys/syslog.h> | 149 | # include <sys/syslog.h> |
| 150 | #endif | 150 | #endif |
| 151 | 151 | ||
| 152 | #include <errno.h> | ||
| 153 | |||
| 152 | /* | 154 | /* |
| 153 | * On HP-UX 11.11, shadow.h and prot.h provide conflicting declarations | 155 | * On HP-UX 11.11, shadow.h and prot.h provide conflicting declarations |
| 154 | * of getspnam when _INCLUDE__STDC__ is defined, so we unset it here. | 156 | * of getspnam when _INCLUDE__STDC__ is defined, so we unset it here. |
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: key.c,v 1.69 2007/07/12 05:48:05 ray Exp $ */ | 1 | /* $OpenBSD: key.c,v 1.78 2008/07/07 23:32:51 stevesk Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * read_bignum(): | 3 | * read_bignum(): |
| 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
| @@ -11,6 +11,7 @@ | |||
| 11 | * | 11 | * |
| 12 | * | 12 | * |
| 13 | * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. | 13 | * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. |
| 14 | * Copyright (c) 2008 Alexander von Gernler. All rights reserved. | ||
| 14 | * | 15 | * |
| 15 | * Redistribution and use in source and binary forms, with or without | 16 | * Redistribution and use in source and binary forms, with or without |
| 16 | * modification, are permitted provided that the following conditions | 17 | * modification, are permitted provided that the following conditions |
| @@ -35,9 +36,11 @@ | |||
| 35 | 36 | ||
| 36 | #include "includes.h" | 37 | #include "includes.h" |
| 37 | 38 | ||
| 39 | #include <sys/param.h> | ||
| 38 | #include <sys/types.h> | 40 | #include <sys/types.h> |
| 39 | 41 | ||
| 40 | #include <openssl/evp.h> | 42 | #include <openssl/evp.h> |
| 43 | #include <openbsd-compat/openssl-compat.h> | ||
| 41 | 44 | ||
| 42 | #include <stdarg.h> | 45 | #include <stdarg.h> |
| 43 | #include <stdio.h> | 46 | #include <stdio.h> |
| @@ -171,6 +174,7 @@ key_equal(const Key *a, const Key *b) | |||
| 171 | default: | 174 | default: |
| 172 | fatal("key_equal: bad key type %d", a->type); | 175 | fatal("key_equal: bad key type %d", a->type); |
| 173 | } | 176 | } |
| 177 | /* NOTREACHED */ | ||
| 174 | } | 178 | } |
| 175 | 179 | ||
| 176 | u_char* | 180 | u_char* |
| @@ -294,6 +298,114 @@ key_fingerprint_bubblebabble(u_char *dgst_raw, u_int dgst_raw_len) | |||
| 294 | return retval; | 298 | return retval; |
| 295 | } | 299 | } |
| 296 | 300 | ||
| 301 | /* | ||
| 302 | * Draw an ASCII-Art representing the fingerprint so human brain can | ||
| 303 | * profit from its built-in pattern recognition ability. | ||
| 304 | * This technique is called "random art" and can be found in some | ||
| 305 | * scientific publications like this original paper: | ||
| 306 | * | ||
| 307 | * "Hash Visualization: a New Technique to improve Real-World Security", | ||
| 308 | * Perrig A. and Song D., 1999, International Workshop on Cryptographic | ||
| 309 | * Techniques and E-Commerce (CrypTEC '99) | ||
| 310 | * sparrow.ece.cmu.edu/~adrian/projects/validation/validation.pdf | ||
| 311 | * | ||
| 312 | * The subject came up in a talk by Dan Kaminsky, too. | ||
| 313 | * | ||
| 314 | * If you see the picture is different, the key is different. | ||
| 315 | * If the picture looks the same, you still know nothing. | ||
| 316 | * | ||
| 317 | * The algorithm used here is a worm crawling over a discrete plane, | ||
| 318 | * leaving a trace (augmenting the field) everywhere it goes. | ||
| 319 | * Movement is taken from dgst_raw 2bit-wise. Bumping into walls | ||
| 320 | * makes the respective movement vector be ignored for this turn. | ||
| 321 | * Graphs are not unambiguous, because circles in graphs can be | ||
| 322 | * walked in either direction. | ||
| 323 | */ | ||
| 324 | |||
| 325 | /* | ||
| 326 | * Field sizes for the random art. Have to be odd, so the starting point | ||
| 327 | * can be in the exact middle of the picture, and FLDBASE should be >=8 . | ||
| 328 | * Else pictures would be too dense, and drawing the frame would | ||
| 329 | * fail, too, because the key type would not fit in anymore. | ||
| 330 | */ | ||
| 331 | #define FLDBASE 8 | ||
| 332 | #define FLDSIZE_Y (FLDBASE + 1) | ||
| 333 | #define FLDSIZE_X (FLDBASE * 2 + 1) | ||
| 334 | static char * | ||
| 335 | key_fingerprint_randomart(u_char *dgst_raw, u_int dgst_raw_len, const Key *k) | ||
| 336 | { | ||
| 337 | /* | ||
| 338 | * Chars to be used after each other every time the worm | ||
| 339 | * intersects with itself. Matter of taste. | ||
| 340 | */ | ||
| 341 | char *augmentation_string = " .o+=*BOX@%&#/^SE"; | ||
| 342 | char *retval, *p; | ||
| 343 | u_char field[FLDSIZE_X][FLDSIZE_Y]; | ||
| 344 | u_int i, b; | ||
| 345 | int x, y; | ||
| 346 | size_t len = strlen(augmentation_string) - 1; | ||
| 347 | |||
| 348 | retval = xcalloc(1, (FLDSIZE_X + 3) * (FLDSIZE_Y + 2)); | ||
| 349 | |||
| 350 | /* initialize field */ | ||
| 351 | memset(field, 0, FLDSIZE_X * FLDSIZE_Y * sizeof(char)); | ||
| 352 | x = FLDSIZE_X / 2; | ||
| 353 | y = FLDSIZE_Y / 2; | ||
| 354 | |||
| 355 | /* process raw key */ | ||
| 356 | for (i = 0; i < dgst_raw_len; i++) { | ||
| 357 | int input; | ||
| 358 | /* each byte conveys four 2-bit move commands */ | ||
| 359 | input = dgst_raw[i]; | ||
| 360 | for (b = 0; b < 4; b++) { | ||
| 361 | /* evaluate 2 bit, rest is shifted later */ | ||
| 362 | x += (input & 0x1) ? 1 : -1; | ||
| 363 | y += (input & 0x2) ? 1 : -1; | ||
| 364 | |||
| 365 | /* assure we are still in bounds */ | ||
| 366 | x = MAX(x, 0); | ||
| 367 | y = MAX(y, 0); | ||
| 368 | x = MIN(x, FLDSIZE_X - 1); | ||
| 369 | y = MIN(y, FLDSIZE_Y - 1); | ||
| 370 | |||
| 371 | /* augment the field */ | ||
| 372 | field[x][y]++; | ||
| 373 | input = input >> 2; | ||
| 374 | } | ||
| 375 | } | ||
| 376 | |||
| 377 | /* mark starting point and end point*/ | ||
| 378 | field[FLDSIZE_X / 2][FLDSIZE_Y / 2] = len - 1; | ||
| 379 | field[x][y] = len; | ||
| 380 | |||
| 381 | /* fill in retval */ | ||
| 382 | snprintf(retval, FLDSIZE_X, "+--[%4s %4u]", key_type(k), key_size(k)); | ||
| 383 | p = strchr(retval, '\0'); | ||
| 384 | |||
| 385 | /* output upper border */ | ||
| 386 | for (i = p - retval - 1; i < FLDSIZE_X; i++) | ||
| 387 | *p++ = '-'; | ||
| 388 | *p++ = '+'; | ||
| 389 | *p++ = '\n'; | ||
| 390 | |||
| 391 | /* output content */ | ||
| 392 | for (y = 0; y < FLDSIZE_Y; y++) { | ||
| 393 | *p++ = '|'; | ||
| 394 | for (x = 0; x < FLDSIZE_X; x++) | ||
| 395 | *p++ = augmentation_string[MIN(field[x][y], len)]; | ||
| 396 | *p++ = '|'; | ||
| 397 | *p++ = '\n'; | ||
| 398 | } | ||
| 399 | |||
| 400 | /* output lower border */ | ||
| 401 | *p++ = '+'; | ||
| 402 | for (i = 0; i < FLDSIZE_X; i++) | ||
| 403 | *p++ = '-'; | ||
| 404 | *p++ = '+'; | ||
| 405 | |||
| 406 | return retval; | ||
| 407 | } | ||
| 408 | |||
| 297 | char * | 409 | char * |
| 298 | key_fingerprint(const Key *k, enum fp_type dgst_type, enum fp_rep dgst_rep) | 410 | key_fingerprint(const Key *k, enum fp_type dgst_type, enum fp_rep dgst_rep) |
| 299 | { | 411 | { |
| @@ -311,6 +423,9 @@ key_fingerprint(const Key *k, enum fp_type dgst_type, enum fp_rep dgst_rep) | |||
| 311 | case SSH_FP_BUBBLEBABBLE: | 423 | case SSH_FP_BUBBLEBABBLE: |
| 312 | retval = key_fingerprint_bubblebabble(dgst_raw, dgst_raw_len); | 424 | retval = key_fingerprint_bubblebabble(dgst_raw, dgst_raw_len); |
| 313 | break; | 425 | break; |
| 426 | case SSH_FP_RANDOMART: | ||
| 427 | retval = key_fingerprint_randomart(dgst_raw, dgst_raw_len, k); | ||
| 428 | break; | ||
| 314 | default: | 429 | default: |
| 315 | fatal("key_fingerprint_ex: bad digest representation %d", | 430 | fatal("key_fingerprint_ex: bad digest representation %d", |
| 316 | dgst_rep); | 431 | dgst_rep); |
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: key.h,v 1.26 2006/08/03 03:34:42 deraadt Exp $ */ | 1 | /* $OpenBSD: key.h,v 1.27 2008/06/11 21:01:35 grunk Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. | 4 | * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. |
| @@ -43,7 +43,8 @@ enum fp_type { | |||
| 43 | }; | 43 | }; |
| 44 | enum fp_rep { | 44 | enum fp_rep { |
| 45 | SSH_FP_HEX, | 45 | SSH_FP_HEX, |
| 46 | SSH_FP_BUBBLEBABBLE | 46 | SSH_FP_BUBBLEBABBLE, |
| 47 | SSH_FP_RANDOMART | ||
| 47 | }; | 48 | }; |
| 48 | 49 | ||
| 49 | /* key is stored in external hardware */ | 50 | /* key is stored in external hardware */ |
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: log.c,v 1.40 2007/05/17 07:50:31 djm Exp $ */ | 1 | /* $OpenBSD: log.c,v 1.41 2008/06/10 04:50:25 dtucker Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
| @@ -115,6 +115,17 @@ log_facility_number(char *name) | |||
| 115 | return SYSLOG_FACILITY_NOT_SET; | 115 | return SYSLOG_FACILITY_NOT_SET; |
| 116 | } | 116 | } |
| 117 | 117 | ||
| 118 | const char * | ||
| 119 | log_facility_name(SyslogFacility facility) | ||
| 120 | { | ||
| 121 | u_int i; | ||
| 122 | |||
| 123 | for (i = 0; log_facilities[i].name; i++) | ||
| 124 | if (log_facilities[i].val == facility) | ||
| 125 | return log_facilities[i].name; | ||
| 126 | return NULL; | ||
| 127 | } | ||
| 128 | |||
| 118 | LogLevel | 129 | LogLevel |
| 119 | log_level_number(char *name) | 130 | log_level_number(char *name) |
| 120 | { | 131 | { |
| @@ -127,6 +138,17 @@ log_level_number(char *name) | |||
| 127 | return SYSLOG_LEVEL_NOT_SET; | 138 | return SYSLOG_LEVEL_NOT_SET; |
| 128 | } | 139 | } |
| 129 | 140 | ||
| 141 | const char * | ||
| 142 | log_level_name(LogLevel level) | ||
| 143 | { | ||
| 144 | u_int i; | ||
| 145 | |||
| 146 | for (i = 0; log_levels[i].name != NULL; i++) | ||
| 147 | if (log_levels[i].val == level) | ||
| 148 | return log_levels[i].name; | ||
| 149 | return NULL; | ||
| 150 | } | ||
| 151 | |||
| 130 | /* Error messages that should be logged. */ | 152 | /* Error messages that should be logged. */ |
| 131 | 153 | ||
| 132 | void | 154 | void |
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: log.h,v 1.15 2006/08/18 09:13:25 deraadt Exp $ */ | 1 | /* $OpenBSD: log.h,v 1.17 2008/06/13 00:12:02 dtucker Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| @@ -50,11 +50,15 @@ typedef enum { | |||
| 50 | void log_init(char *, LogLevel, SyslogFacility, int); | 50 | void log_init(char *, LogLevel, SyslogFacility, int); |
| 51 | 51 | ||
| 52 | SyslogFacility log_facility_number(char *); | 52 | SyslogFacility log_facility_number(char *); |
| 53 | LogLevel log_level_number(char *); | 53 | const char * log_facility_name(SyslogFacility); |
| 54 | LogLevel log_level_number(char *); | ||
| 55 | const char * log_level_name(LogLevel); | ||
| 54 | 56 | ||
| 55 | void fatal(const char *, ...) __dead __attribute__((format(printf, 1, 2))); | 57 | void fatal(const char *, ...) __attribute__((noreturn)) |
| 58 | __attribute__((format(printf, 1, 2))); | ||
| 56 | void error(const char *, ...) __attribute__((format(printf, 1, 2))); | 59 | void error(const char *, ...) __attribute__((format(printf, 1, 2))); |
| 57 | void sigdie(const char *, ...) __attribute__((format(printf, 1, 2))); | 60 | void sigdie(const char *, ...) __attribute__((noreturn)) |
| 61 | __attribute__((format(printf, 1, 2))); | ||
| 58 | void logit(const char *, ...) __attribute__((format(printf, 1, 2))); | 62 | void logit(const char *, ...) __attribute__((format(printf, 1, 2))); |
| 59 | void verbose(const char *, ...) __attribute__((format(printf, 1, 2))); | 63 | void verbose(const char *, ...) __attribute__((format(printf, 1, 2))); |
| 60 | void debug(const char *, ...) __attribute__((format(printf, 1, 2))); | 64 | void debug(const char *, ...) __attribute__((format(printf, 1, 2))); |
| @@ -62,5 +66,5 @@ void debug2(const char *, ...) __attribute__((format(printf, 1, 2))); | |||
| 62 | void debug3(const char *, ...) __attribute__((format(printf, 1, 2))); | 66 | void debug3(const char *, ...) __attribute__((format(printf, 1, 2))); |
| 63 | 67 | ||
| 64 | void do_log(LogLevel, const char *, va_list); | 68 | void do_log(LogLevel, const char *, va_list); |
| 65 | void cleanup_exit(int) __dead; | 69 | void cleanup_exit(int) __attribute__((noreturn)); |
| 66 | #endif | 70 | #endif |
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: mac.c,v 1.14 2007/06/07 19:37:34 pvalchev Exp $ */ | 1 | /* $OpenBSD: mac.c,v 1.15 2008/06/13 00:51:47 dtucker Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Copyright (c) 2001 Markus Friedl. All rights reserved. | 3 | * Copyright (c) 2001 Markus Friedl. All rights reserved. |
| 4 | * | 4 | * |
| @@ -128,7 +128,7 @@ mac_compute(Mac *mac, u_int32_t seqno, u_char *data, int datalen) | |||
| 128 | 128 | ||
| 129 | if (mac->mac_len > sizeof(m)) | 129 | if (mac->mac_len > sizeof(m)) |
| 130 | fatal("mac_compute: mac too long %u %lu", | 130 | fatal("mac_compute: mac too long %u %lu", |
| 131 | mac->mac_len, sizeof(m)); | 131 | mac->mac_len, (u_long)sizeof(m)); |
| 132 | 132 | ||
| 133 | switch (mac->type) { | 133 | switch (mac->type) { |
| 134 | case SSH_EVP: | 134 | case SSH_EVP: |
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: match.c,v 1.26 2006/08/03 03:34:42 deraadt Exp $ */ | 1 | /* $OpenBSD: match.c,v 1.27 2008/06/10 23:06:19 djm Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
| @@ -183,7 +183,8 @@ match_hostname(const char *host, const char *pattern, u_int len) | |||
| 183 | 183 | ||
| 184 | /* | 184 | /* |
| 185 | * returns 0 if we get a negative match for the hostname or the ip | 185 | * returns 0 if we get a negative match for the hostname or the ip |
| 186 | * or if we get no match at all. returns 1 otherwise. | 186 | * or if we get no match at all. returns -1 on error, or 1 on |
| 187 | * successful match. | ||
| 187 | */ | 188 | */ |
| 188 | int | 189 | int |
| 189 | match_host_and_ip(const char *host, const char *ipaddr, | 190 | match_host_and_ip(const char *host, const char *ipaddr, |
| @@ -191,9 +192,12 @@ match_host_and_ip(const char *host, const char *ipaddr, | |||
| 191 | { | 192 | { |
| 192 | int mhost, mip; | 193 | int mhost, mip; |
| 193 | 194 | ||
| 194 | /* negative ipaddr match */ | 195 | /* error in ipaddr match */ |
| 195 | if ((mip = match_hostname(ipaddr, patterns, strlen(patterns))) == -1) | 196 | if ((mip = addr_match_list(ipaddr, patterns)) == -2) |
| 197 | return -1; | ||
| 198 | else if (mip == -1) /* negative ip address match */ | ||
| 196 | return 0; | 199 | return 0; |
| 200 | |||
| 197 | /* negative hostname match */ | 201 | /* negative hostname match */ |
| 198 | if ((mhost = match_hostname(host, patterns, strlen(patterns))) == -1) | 202 | if ((mhost = match_hostname(host, patterns, strlen(patterns))) == -1) |
| 199 | return 0; | 203 | return 0; |
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: match.h,v 1.13 2006/03/25 22:22:43 djm Exp $ */ | 1 | /* $OpenBSD: match.h,v 1.14 2008/06/10 03:57:27 djm Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| @@ -21,4 +21,7 @@ int match_host_and_ip(const char *, const char *, const char *); | |||
| 21 | int match_user(const char *, const char *, const char *, const char *); | 21 | int match_user(const char *, const char *, const char *, const char *); |
| 22 | char *match_list(const char *, const char *, u_int *); | 22 | char *match_list(const char *, const char *, u_int *); |
| 23 | 23 | ||
| 24 | /* addrmatch.c */ | ||
| 25 | int addr_match_list(const char *, const char *); | ||
| 26 | |||
| 24 | #endif | 27 | #endif |
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: misc.c,v 1.65 2006/11/23 01:35:11 ray Exp $ */ | 1 | /* $OpenBSD: misc.c,v 1.69 2008/06/13 01:38:23 dtucker Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Copyright (c) 2000 Markus Friedl. All rights reserved. | 3 | * Copyright (c) 2000 Markus Friedl. All rights reserved. |
| 4 | * Copyright (c) 2005,2006 Damien Miller. All rights reserved. | 4 | * Copyright (c) 2005,2006 Damien Miller. All rights reserved. |
| @@ -42,6 +42,7 @@ | |||
| 42 | 42 | ||
| 43 | #include <errno.h> | 43 | #include <errno.h> |
| 44 | #include <fcntl.h> | 44 | #include <fcntl.h> |
| 45 | #include <netdb.h> | ||
| 45 | #ifdef HAVE_PATHS_H | 46 | #ifdef HAVE_PATHS_H |
| 46 | # include <paths.h> | 47 | # include <paths.h> |
| 47 | #include <pwd.h> | 48 | #include <pwd.h> |
| @@ -120,6 +121,14 @@ unset_nonblock(int fd) | |||
| 120 | return (0); | 121 | return (0); |
| 121 | } | 122 | } |
| 122 | 123 | ||
| 124 | const char * | ||
| 125 | ssh_gai_strerror(int gaierr) | ||
| 126 | { | ||
| 127 | if (gaierr == EAI_SYSTEM) | ||
| 128 | return strerror(errno); | ||
| 129 | return gai_strerror(gaierr); | ||
| 130 | } | ||
| 131 | |||
| 123 | /* disable nagle on socket */ | 132 | /* disable nagle on socket */ |
| 124 | void | 133 | void |
| 125 | set_nodelay(int fd) | 134 | set_nodelay(int fd) |
| @@ -525,7 +534,7 @@ tilde_expand_filename(const char *filename, uid_t uid) | |||
| 525 | if ((pw = getpwnam(user)) == NULL) | 534 | if ((pw = getpwnam(user)) == NULL) |
| 526 | fatal("tilde_expand_filename: No such user %s", user); | 535 | fatal("tilde_expand_filename: No such user %s", user); |
| 527 | } else if ((pw = getpwuid(uid)) == NULL) /* ~/path */ | 536 | } else if ((pw = getpwuid(uid)) == NULL) /* ~/path */ |
| 528 | fatal("tilde_expand_filename: No such uid %d", uid); | 537 | fatal("tilde_expand_filename: No such uid %ld", (long)uid); |
| 529 | 538 | ||
| 530 | if (strlcpy(ret, pw->pw_dir, sizeof(ret)) >= sizeof(ret)) | 539 | if (strlcpy(ret, pw->pw_dir, sizeof(ret)) >= sizeof(ret)) |
| 531 | fatal("tilde_expand_filename: Path too long"); | 540 | fatal("tilde_expand_filename: Path too long"); |
| @@ -823,3 +832,23 @@ put_u16(void *vp, u_int16_t v) | |||
| 823 | p[0] = (u_char)(v >> 8) & 0xff; | 832 | p[0] = (u_char)(v >> 8) & 0xff; |
| 824 | p[1] = (u_char)v & 0xff; | 833 | p[1] = (u_char)v & 0xff; |
| 825 | } | 834 | } |
| 835 | |||
| 836 | void | ||
| 837 | ms_subtract_diff(struct timeval *start, int *ms) | ||
| 838 | { | ||
| 839 | struct timeval diff, finish; | ||
| 840 | |||
| 841 | gettimeofday(&finish, NULL); | ||
| 842 | timersub(&finish, start, &diff); | ||
| 843 | *ms -= (diff.tv_sec * 1000) + (diff.tv_usec / 1000); | ||
| 844 | } | ||
| 845 | |||
| 846 | void | ||
| 847 | ms_to_timeval(struct timeval *tv, int ms) | ||
| 848 | { | ||
| 849 | if (ms < 0) | ||
| 850 | ms = 0; | ||
| 851 | tv->tv_sec = ms / 1000; | ||
| 852 | tv->tv_usec = (ms % 1000) * 1000; | ||
| 853 | } | ||
| 854 | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: misc.h,v 1.36 2006/08/18 10:27:16 djm Exp $ */ | 1 | /* $OpenBSD: misc.h,v 1.38 2008/06/12 20:38:28 dtucker Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| @@ -33,8 +33,11 @@ char *tilde_expand_filename(const char *, uid_t); | |||
| 33 | char *percent_expand(const char *, ...) __attribute__((__sentinel__)); | 33 | char *percent_expand(const char *, ...) __attribute__((__sentinel__)); |
| 34 | char *tohex(const void *, size_t); | 34 | char *tohex(const void *, size_t); |
| 35 | void sanitise_stdfd(void); | 35 | void sanitise_stdfd(void); |
| 36 | void ms_subtract_diff(struct timeval *, int *); | ||
| 37 | void ms_to_timeval(struct timeval *, int); | ||
| 36 | 38 | ||
| 37 | struct passwd *pwcopy(struct passwd *); | 39 | struct passwd *pwcopy(struct passwd *); |
| 40 | const char *ssh_gai_strerror(int); | ||
| 38 | 41 | ||
| 39 | typedef struct arglist arglist; | 42 | typedef struct arglist arglist; |
| 40 | struct arglist { | 43 | struct arglist { |
| @@ -1,189 +1,174 @@ | |||
| 1 | # $OpenBSD: moduli,v 1.3 2005/01/24 10:29:06 dtucker Exp $ | 1 | # $OpenBSD: moduli,v 1.4 2008/01/01 08:51:20 dtucker Exp $ |
| 2 | # Time Type Tests Tries Size Generator Modulus | 2 | # Time Type Tests Tries Size Generator Modulus |
| 3 | 20040225025212 2 6 100 1023 5 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7AFFE86A7 | 3 | 20060827013849 2 6 100 1023 2 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE261778F3 |
| 4 | 20040225025304 2 6 100 1023 2 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B01F83CB | 4 | 20060827013906 2 6 100 1023 2 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE261CC47B |
| 5 | 20040225025357 2 6 100 1023 2 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B03F2B73 | 5 | 20060827013924 2 6 100 1023 2 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE2621AFA3 |
| 6 | 20040225025411 2 6 100 1023 5 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B041C8C7 | 6 | 20060827014045 2 6 100 1023 2 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE26551B8B |
| 7 | 20040225025444 2 6 100 1023 2 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B0546E93 | 7 | 20060827014056 2 6 100 1023 5 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE26556A27 |
| 8 | 20040225025458 2 6 100 1023 5 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B0573767 | 8 | 20060827014115 2 6 100 1023 2 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE265B7273 |
| 9 | 20040225025522 2 6 100 1023 2 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B0629E73 | 9 | 20060827014137 2 6 100 1023 5 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE26644D77 |
| 10 | 20040225025545 2 6 100 1023 2 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B06CD95B | 10 | 20060827014203 2 6 100 1023 2 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE26717773 |
| 11 | 20040225025616 2 6 100 1023 2 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B07C93A3 | 11 | 20060827014214 2 6 100 1023 2 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE26722EBB |
| 12 | 20040225025655 2 6 100 1023 2 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B093C72B | 12 | 20060827014312 2 6 100 1023 2 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE26961C8B |
| 13 | 20040225025710 2 6 100 1023 2 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B096450B | 13 | 20060827014407 2 6 100 1023 5 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE26BA7BBF |
| 14 | 20040225025750 2 6 100 1023 2 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B0AF2C83 | 14 | 20060827014418 2 6 100 1023 5 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE26BAC107 |
| 15 | 20040225025830 2 6 100 1023 5 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B0C7F1FF | 15 | 20060827014436 2 6 100 1023 5 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE26C05207 |
| 16 | 20040225025845 2 6 100 1023 2 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B0CB565B | 16 | 20060827014515 2 6 100 1023 2 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE26D48C73 |
| 17 | 20040225025858 2 6 100 1023 5 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B0CD8557 | 17 | 20060827014527 2 6 100 1023 5 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE26D65CD7 |
| 18 | 20040225025915 2 6 100 1023 2 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B0D20473 | 18 | 20060827014538 2 6 100 1023 5 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE26D7096F |
| 19 | 20040225025934 2 6 100 1023 5 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B0D924F7 | 19 | 20060827014607 2 6 100 1023 2 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE26E3760B |
| 20 | 20040225025952 2 6 100 1023 2 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B0DFD8BB | 20 | 20060827014626 2 6 100 1023 5 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE26EAF29F |
| 21 | 20040225030015 2 6 100 1023 5 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B0E8E59F | 21 | 20060827014637 2 6 100 1023 5 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE26EBCF4F |
| 22 | 20040225030039 2 6 100 1023 2 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B0F43B0B | 22 | 20060827014653 2 6 100 1023 2 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE26F0D6BB |
| 23 | 20040225030104 2 6 100 1023 2 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B0FEB103 | 23 | 20060827014732 2 6 100 1023 2 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE27088963 |
| 24 | 20040225030130 2 6 100 1023 2 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B10AC3DB | 24 | 20060827014835 2 6 100 1023 2 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE27320A73 |
| 25 | 20040225030149 2 6 100 1023 5 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B1122527 | 25 | 20060827014915 2 6 100 1023 2 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE27486FA3 |
| 26 | 20040225030214 2 6 100 1023 2 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B11E494B | 26 | 20060827014926 2 6 100 1023 5 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE2748FD9F |
| 27 | 20040225030245 2 6 100 1023 2 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B12E727B | 27 | 20060827014940 2 6 100 1023 2 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE274BB323 |
| 28 | 20040225030319 2 6 100 1023 2 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B1416743 | 28 | 20060827014956 2 6 100 1023 5 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE274F8F7F |
| 29 | 20040225030347 2 6 100 1023 2 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B1507F2B | 29 | 20060827015028 2 6 100 1023 5 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE275C008F |
| 30 | 20040225030404 2 6 100 1023 2 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B1560FE3 | 30 | 20060827015112 2 6 100 1023 5 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE2776D9EF |
| 31 | 20040225030418 2 6 100 1023 5 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B1591CF7 | 31 | 20060827015134 2 6 100 1023 2 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE27809AA3 |
| 32 | 20040225030432 2 6 100 1023 5 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B15B57FF | 32 | 20060827015146 2 6 100 1023 2 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE27826DFB |
| 33 | 20040225030455 2 6 100 1023 5 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B165D0AF | 33 | 20060827015200 2 6 100 1023 5 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE2785363F |
| 34 | 20040225030511 2 6 100 1023 5 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B169C97F | 34 | 20060827015231 2 6 100 1023 5 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE27951F4F |
| 35 | 20040225030551 2 6 100 1023 2 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B182715B | 35 | 20060827015246 2 6 100 1023 2 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE27991903 |
| 36 | 20040225030621 2 6 100 1023 5 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B1920737 | 36 | 20060827015300 2 6 100 1023 5 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE279C7B37 |
| 37 | 20040225030648 2 6 100 1023 2 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B19FB54B | 37 | 20060827015329 2 6 100 1023 2 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE27AB4843 |
| 38 | 20040225030718 2 6 100 1023 5 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B1AFAE87 | 38 | 20060827015347 2 6 100 1023 5 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE27B0F9D7 |
| 39 | 20040225030736 2 6 100 1023 5 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B1B5A7AF | 39 | 20060827015359 2 6 100 1023 2 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE27B24D5B |
| 40 | 20040225030753 2 6 100 1023 5 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B1BC3C47 | 40 | 20060827015430 2 6 100 1023 5 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE27C2CE27 |
| 41 | 20040225030815 2 6 100 1023 2 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B1C6AF33 | 41 | 20060827015449 2 6 100 1023 2 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE27CA3BA3 |
| 42 | 20040225030831 2 6 100 1023 2 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B1CAD9FB | 42 | 20060827015546 2 6 100 1023 5 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE27E90A07 |
| 43 | 20040225030902 2 6 100 1023 5 CAADDDEC1667FC68B5FA15D53C4E1532DD24561A1A2D47A12C01ABEA1E00731F6921AAC40742311FDF9E634BB7131BEE1AF240261554389A910425E044E88C8359B010F5AD2B80E29CB1A5B027B19D9E01A6F63A6F45E5D7ED2FF6A2A0085050A7D0CF307C3DB51D2490355907B4427C23A98DF1EB8ABEF2BA209BB7B1DC6A8F | 43 | 20060827015607 2 6 100 1023 5 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE27F116BF |
| 44 | 20040225035226 2 6 100 1535 2 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF844800C47CAB | 44 | 20060827015630 2 6 100 1023 5 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE27FBB66F |
| 45 | 20040225035359 2 6 100 1535 2 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF844800D3866B | 45 | 20060827015649 2 6 100 1023 2 DE49FC9069994C379D2B6563EFD37EFAE6785EEB1DD0A12B090AAC272B22DF8C64A4A2AB7B99CE0B77A9A52E0833D52D53B258CEDFFD175DC8A3766A9B9807362646DC9215628C3F4AF0E08D00AB60A3B9E55BAE47E82651DA0C15A27355DDB06365CAE1DDDE4C0C97DC9942FD65E9867FA50E72E1C785411EDD28DE2803E313 |
| 46 | 20040225035635 2 6 100 1535 5 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF844800F43DFF | 46 | 20060827024302 2 6 100 1535 2 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6AD6C361B |
| 47 | 20040225035846 2 6 100 1535 2 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF8448010B4D93 | 47 | 20060827024350 2 6 100 1535 2 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6AD6F7E93 |
| 48 | 20040225040147 2 6 100 1535 2 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF8448013094F3 | 48 | 20060827024537 2 6 100 1535 2 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6AD7DE4BB |
| 49 | 20040225040301 2 6 100 1535 2 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF8448013AA0FB | 49 | 20060827025000 2 6 100 1535 5 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6ADB6D4D7 |
| 50 | 20040225040619 2 6 100 1535 2 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF84480163EC83 | 50 | 20060827025429 2 6 100 1535 2 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6ADEF2D8B |
| 51 | 20040225040718 2 6 100 1535 5 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF8448016AEB8F | 51 | 20060827025612 2 6 100 1535 2 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6ADFCCB13 |
| 52 | 20040225041023 2 6 100 1535 5 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF84480190871F | 52 | 20060827030138 2 6 100 1535 2 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6AE41E89B |
| 53 | 20040225041328 2 6 100 1535 2 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF844801B5F1B3 | 53 | 20060827030223 2 6 100 1535 2 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6AE44A263 |
| 54 | 20040225041740 2 6 100 1535 2 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF844801ED6FBB | 54 | 20060827030555 2 6 100 1535 5 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6AE6FD2A7 |
| 55 | 20040225041921 2 6 100 1535 5 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF844801FEC44F | 55 | 20060827031244 2 6 100 1535 2 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6AECC68C3 |
| 56 | 20040225042229 2 6 100 1535 5 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF844802245FF7 | 56 | 20060827031437 2 6 100 1535 2 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6AEDFB4EB |
| 57 | 20040225042513 2 6 100 1535 2 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF84480246F93B | 57 | 20060827031602 2 6 100 1535 5 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6AEEB07E7 |
| 58 | 20040225042547 2 6 100 1535 5 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF844802473F4F | 58 | 20060827032434 2 6 100 1535 2 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6AF5B1533 |
| 59 | 20040225042707 2 6 100 1535 2 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF84480253B03B | 59 | 20060827032933 2 6 100 1535 2 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6AF99D5D3 |
| 60 | 20040225043111 2 6 100 1535 2 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF84480287CD9B | 60 | 20060827033028 2 6 100 1535 5 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6AF9CF037 |
| 61 | 20040225043513 2 6 100 1535 2 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF844802BC32FB | 61 | 20060827033120 2 6 100 1535 5 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6AFA14BBF |
| 62 | 20040225043609 2 6 100 1535 2 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF844802C2125B | 62 | 20060827033331 2 6 100 1535 2 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6AFB9FD2B |
| 63 | 20040225043847 2 6 100 1535 2 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF844802E1B733 | 63 | 20060827033555 2 6 100 1535 2 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6AFD32F8B |
| 64 | 20040225043925 2 6 100 1535 2 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF844802E2E963 | 64 | 20060827033806 2 6 100 1535 2 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6AFEBB7DB |
| 65 | 20040225044335 2 6 100 1535 2 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF8448031AC423 | 65 | 20060827034045 2 6 100 1535 2 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6B009C8D3 |
| 66 | 20040225045303 2 6 100 1535 5 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF844803A10E07 | 66 | 20060827034214 2 6 100 1535 5 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6B0177447 |
| 67 | 20040225045443 2 6 100 1535 2 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF844803B0EF43 | 67 | 20060827034316 2 6 100 1535 5 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6B01EFC27 |
| 68 | 20040225045518 2 6 100 1535 2 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF844803B15033 | 68 | 20060827034514 2 6 100 1535 2 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6B0313F9B |
| 69 | 20040225045923 2 6 100 1535 5 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF844803E58317 | 69 | 20060827035109 2 6 100 1535 2 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6B07D542B |
| 70 | 20040225050120 2 6 100 1535 5 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF844803F9EB4F | 70 | 20060827035412 2 6 100 1535 5 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6B0A3485F |
| 71 | 20040225050333 2 6 100 1535 2 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF8448041304B3 | 71 | 20060827035525 2 6 100 1535 2 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6B0AAF3BB |
| 72 | 20040225050524 2 6 100 1535 5 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF844804279B2F | 72 | 20060827035829 2 6 100 1535 5 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6B0CFE04F |
| 73 | 20040225050559 2 6 100 1535 5 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF844804281047 | 73 | 20060827040101 2 6 100 1535 5 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6B0E988E7 |
| 74 | 20040225050810 2 6 100 1535 5 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF8448043F454F | 74 | 20060827040504 2 6 100 1535 2 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6B11D001B |
| 75 | 20040225051113 2 6 100 1535 5 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF844804672F1F | 75 | 20060827040746 2 6 100 1535 5 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6B13A45DF |
| 76 | 20040225051335 2 6 100 1535 2 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF844804809CB3 | 76 | 20060827041350 2 6 100 1535 5 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6B188B89F |
| 77 | 20040225051442 2 6 100 1535 5 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF84480489545F | 77 | 20060827041513 2 6 100 1535 2 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6B193B2EB |
| 78 | 20040225052303 2 6 100 1535 2 FC4601920ABD76FF37FDC717EDFFEC0E539D5F7697882432A53085C95B040175503AEBD8A0FDF38D5F4EAA8EB1A22389D2CF2070F4DD47E2E8F89F4DD4ACACE4593F762DB92C479EBF1BBD4EF450A7FFAA15F75FB921B42B62466C29A993E7C7D8FD8412A4869D867E2765C2CBA0BC0F31E625B9BE1FF5421FDC2E097E0EF66F1CC9FF04AEB9341327D3468630C4E049530EF12350D51A71FDF9B6DB3CE56ED8C9FE61148F8098722A43C4F0AE29855BC9E06068D3898146ACFF844804FE918B | 78 | 20060827041621 2 6 100 1535 5 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6B19B9807 |
| 79 | 20040225062215 2 6 100 2047 5 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6B9F68B3E7 | 79 | 20060827041657 2 6 100 1535 5 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6B19C0107 |
| 80 | 20040225063823 2 6 100 2047 5 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6B9FD47307 | 80 | 20060827041817 2 6 100 1535 2 DF09936D6567325CD4EDE975CB3B9BFFB26C5EC31A71ABA0931BE89AEEB81A531708540B7EA03875E5DF4935ED021F3955D5C941BB682DBDA5425F4EF84DD1F42C6DCC5E313D64DE5B658682A51785102358771DDB6C2B86079C3D0A4EB0DA149E7B2CAC0AC254FFBCD82DF11D74A4E0BBE3FA0AD0675B8A3C6E794E943B7F3799BA8C0F80D602F85D3032D206A96EB16DAFD2C036F8D4F3DA1CCDB2178F08BD851D7BB1C2E964F48F91B2546916E76A80D8E16F700E1FC194308DD6B1A6BE4B |
| 81 | 20040225064402 2 6 100 2047 5 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6B9FF43C0F | 81 | 20060827052122 2 6 100 2047 2 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532C77E8ED3 |
| 82 | 20040225065646 2 6 100 2047 2 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA04740DB | 82 | 20060827055248 2 6 100 2047 5 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532C8549C07 |
| 83 | 20040225065825 2 6 100 2047 5 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA04B01BF | 83 | 20060827055453 2 6 100 2047 5 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532C85B17DF |
| 84 | 20040225070116 2 6 100 2047 5 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA056DD47 | 84 | 20060827060456 2 6 100 2047 5 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532C899BBE7 |
| 85 | 20040225074027 2 6 100 2047 2 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA172E1B3 | 85 | 20060827061203 2 6 100 2047 2 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532C8C362B3 |
| 86 | 20040225080343 2 6 100 2047 5 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA217422F | 86 | 20060827061433 2 6 100 2047 5 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532C8CC69F7 |
| 87 | 20040225081159 2 6 100 2047 2 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA24927DB | 87 | 20060827061904 2 6 100 2047 5 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532C8E44BC7 |
| 88 | 20040225081331 2 6 100 2047 2 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA24C058B | 88 | 20060827062255 2 6 100 2047 5 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532C8F6B23F |
| 89 | 20040225082528 2 6 100 2047 5 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA2993EBF | 89 | 20060827063052 2 6 100 2047 5 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532C926C817 |
| 90 | 20040225084537 2 6 100 2047 2 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA3242BE3 | 90 | 20060827063354 2 6 100 2047 5 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532C9351ABF |
| 91 | 20040225085012 2 6 100 2047 2 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA33EF643 | 91 | 20060827063925 2 6 100 2047 2 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532C9541A43 |
| 92 | 20040225085829 2 6 100 2047 5 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA3729D77 | 92 | 20060827064904 2 6 100 2047 5 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532C98CFAE7 |
| 93 | 20040225090710 2 6 100 2047 2 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA3AC0143 | 93 | 20060827070314 2 6 100 2047 2 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532C9E30823 |
| 94 | 20040225091002 2 6 100 2047 2 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA3B8AE6B | 94 | 20060827070806 2 6 100 2047 2 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532C9F90C33 |
| 95 | 20040225092648 2 6 100 2047 5 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA42B65D7 | 95 | 20060827071119 2 6 100 2047 5 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532CA04D477 |
| 96 | 20040225093120 2 6 100 2047 2 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA4442793 | 96 | 20060827072534 2 6 100 2047 2 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532CA5A1ADB |
| 97 | 20040225093517 2 6 100 2047 5 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA459441F | 97 | 20060827073212 2 6 100 2047 2 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532CA7E88A3 |
| 98 | 20040225094409 2 6 100 2047 2 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA491BE4B | 98 | 20060827073641 2 6 100 2047 2 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532CA93A193 |
| 99 | 20040225095209 2 6 100 2047 5 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA4C4E437 | 99 | 20060827073850 2 6 100 2047 5 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532CA999B57 |
| 100 | 20040225095548 2 6 100 2047 2 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA4D5D7AB | 100 | 20060827080040 2 6 100 2047 5 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532CB21505F |
| 101 | 20040225100531 2 6 100 2047 2 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA51404EB | 101 | 20060827080817 2 6 100 2047 5 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532CB4C2F97 |
| 102 | 20040225100644 2 6 100 2047 5 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA5145C87 | 102 | 20060827083711 2 6 100 2047 5 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532CC0FAA7F |
| 103 | 20040225101834 2 6 100 2047 2 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA5609CBB | 103 | 20060827084308 2 6 100 2047 2 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532CC30FD83 |
| 104 | 20040225102317 2 6 100 2047 5 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA57AC86F | 104 | 20060827084830 2 6 100 2047 5 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532CC4EFB67 |
| 105 | 20040225103220 2 6 100 2047 2 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA5B631A3 | 105 | 20060827085653 2 6 100 2047 2 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532CC8152FB |
| 106 | 20040225103355 2 6 100 2047 5 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA5B98D2F | 106 | 20060827090522 2 6 100 2047 2 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532CCB5AE6B |
| 107 | 20040225103756 2 6 100 2047 2 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA5CEBAFB | 107 | 20060827092253 2 6 100 2047 2 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532CD252FCB |
| 108 | 20040225104020 2 6 100 2047 5 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA5D77CDF | 108 | 20060827095916 2 6 100 2047 5 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532CE117E2F |
| 109 | 20040225104557 2 6 100 2047 5 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA5F6FD9F | 109 | 20060827100246 2 6 100 2047 2 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532CE2087CB |
| 110 | 20040225110302 2 6 100 2047 5 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA66A70DF | 110 | 20060827102041 2 6 100 2047 5 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532CE925537 |
| 111 | 20040225110515 2 6 100 2047 2 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA6721A43 | 111 | 20060827102556 2 6 100 2047 5 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532CEAF2A27 |
| 112 | 20040225110913 2 6 100 2047 2 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA6879A53 | 112 | 20060827103749 2 6 100 2047 5 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532CEF9826F |
| 113 | 20040225111338 2 6 100 2047 2 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA69FE2FB | 113 | 20060827103917 2 6 100 2047 5 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532CEFBC467 |
| 114 | 20040225111911 2 6 100 2047 5 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA6C04F47 | 114 | 20060827104611 2 6 100 2047 2 C038282DE061BE1AD34F31325EFE9B1D8520DB14276CEB61FE3A2CB8D77FFE3B9A067505205BBA8353847FD2EA1E2471E4294862A5D4C4F9A2B80F9DA0619327CDBF2EB608B0B5549294A955972AA3512821B24782DD8AB97B53AAB04B48180394ABFBC4DCF9B819FC0CB5AC1275AC5F16EC378163501E4B27D49C67F660333888F1D503B96FA9C6C880543D8B5F04D70FE508FFCA161798AD32015145B8E9AD43AAB48ADA81FD1E5A8EA7711A8FF57EC7C4C081B47FAB0C2E9FA468E70DD6700F3412224890D5E99527A596CE635195F3A6D35E563BF4892DF2C79C809704411018D919102D12CB112CE1E66EBF5DB9F409F6C82A6A6E1E21E23532CF24A6E3 |
| 115 | 20040225112902 2 6 100 2047 2 F8F54DA4E1F232A9D05104B807DCBEA553C1E606FEB1CF149DEBB99243AAA7A354616FD95368EBCC1A58C8BCB87FB993F731400A413E07E35B1ADDD6484973E1734835FEFDC214DACA8C0844285A670D03BB3E1A5B5E14DC6F3B20EAAC8F18EB6C48AA5604F21EBEEA3C867F6CFA010858DFD589DCDEFBE8996A42F5BA00BEDFF6743F4D4E2808806965258C4E17D1B2BF371814696A2CC7C5C6548ED480AA7491A9DE16D2B12F15471B192295AA27F6D047EC2BA7547ED70674F52B4934D846712B1EA87E7FE12C5A210DEF5B3A14DBC8E712AA7192D877B4E6479F3CD69F82127E7352C19191B036A86BCF2D7D7CC687C25C5E4620295F10DCCE6BA7007CD3 | 115 | 20060827130320 2 6 100 3071 5 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084EFA80B3F |
| 116 | 20040225143208 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD8968A91B | 116 | 20060827132001 2 6 100 3071 2 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084EFC2F2A3 |
| 117 | 20040225144922 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD8987DF6B | 117 | 20060827132659 2 6 100 3071 2 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084EFC83DE3 |
| 118 | 20040225150309 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD899E0F8B | 118 | 20060827133231 2 6 100 3071 2 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084EFCAE263 |
| 119 | 20040225161716 2 6 100 3071 5 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD8A3A91CF | 119 | 20060827134212 2 6 100 3071 2 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084EFD5D943 |
| 120 | 20040225163012 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD8A4CED2B | 120 | 20060827135606 2 6 100 3071 2 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084EFEAD4AB |
| 121 | 20040225175457 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD8B02C5DB | 121 | 20060827142452 2 6 100 3071 2 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084F01CBFBB |
| 122 | 20040225182539 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD8B3E9D13 | 122 | 20060827185212 2 6 100 3071 5 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084F24CFF67 |
| 123 | 20040225194030 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD8BDE269B | 123 | 20060827190158 2 6 100 3071 5 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084F2599507 |
| 124 | 20040225201420 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD8C203553 | 124 | 20060827202730 2 6 100 3071 2 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084F305315B |
| 125 | 20040225203219 2 6 100 3071 5 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD8C40B747 | 125 | 20060827213252 2 6 100 3071 2 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084F38A5B63 |
| 126 | 20040225203908 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD8C46ED83 | 126 | 20060827214322 2 6 100 3071 5 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084F3987FC7 |
| 127 | 20040225210230 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD8C72586B | 127 | 20060827214825 2 6 100 3071 2 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084F39A3CDB |
| 128 | 20040225212746 2 6 100 3071 5 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD8CA15F2F | 128 | 20060827232520 2 6 100 3071 2 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084F46375AB |
| 129 | 20040225214624 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD8CC34833 | 129 | 20060828030405 2 6 100 3071 2 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084F62B17EB |
| 130 | 20040225223007 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD8D1B23AB | 130 | 20060828043230 2 6 100 3071 5 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084F6E0BB4F |
| 131 | 20040225234913 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD8DC36C9B | 131 | 20060828081338 2 6 100 3071 5 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084F8A9B0EF |
| 132 | 20040226001353 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD8DF174B3 | 132 | 20060828083613 2 6 100 3071 5 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084F8D164EF |
| 133 | 20040226004101 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD8E24518B | 133 | 20060828090529 2 6 100 3071 2 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084F906488B |
| 134 | 20040226010652 2 6 100 3071 5 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD8E543397 | 134 | 20060828100621 2 6 100 3071 2 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084F97FF4CB |
| 135 | 20040226015415 2 6 100 3071 5 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD8EB6152F | 135 | 20060828121421 2 6 100 3071 2 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084FA80824B |
| 136 | 20040226022931 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD8EFD1773 | 136 | 20060828141024 2 6 100 3071 5 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084FB659087 |
| 137 | 20040226025740 2 6 100 3071 5 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD8F3376D7 | 137 | 20060828142059 2 6 100 3071 5 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084FB739E8F |
| 138 | 20040226053010 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD90786CE3 | 138 | 20060828170552 2 6 100 3071 5 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084FCC5CE57 |
| 139 | 20040226054156 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD908AC36B | 139 | 20060828171327 2 6 100 3071 2 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084FCCCF9D3 |
| 140 | 20040226081600 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD91D61A43 | 140 | 20060828185943 2 6 100 3071 5 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084FDA67727 |
| 141 | 20040226083039 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD91ED4AE3 | 141 | 20060828190537 2 6 100 3071 2 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084FDAAC673 |
| 142 | 20040226092910 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD9265F7DB | 142 | 20060828191202 2 6 100 3071 5 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084FDAFC737 |
| 143 | 20040226112913 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD93696533 | 143 | 20060828192613 2 6 100 3071 2 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084FDC50FBB |
| 144 | 20040226115826 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD93A210A3 | 144 | 20060828193738 2 6 100 3071 5 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084FDD6023F |
| 145 | 20040226135326 2 6 100 3071 5 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD949596D7 | 145 | 20060828204936 2 6 100 3071 5 D3230D237572ECE9F92358715EBAC3A4D89F2D6B4DC39F056450263BEF1665FBD7B93916ABC867B7064802159D273C7EB01C5F9281A3D6DCCB7CF997D385998EC0E1FA3319AFE771A90ADBACEB414A020630D7C7F161FAFEC6C9FC06D3205C712AAE8848A1B2C21DFF301C7FFC0B75D13F060A313C32AFEEAF1493F641760EBEF38829B3371699D2A3264D0ECEB4E5C19581ED8C57699F559B9828BBFE147952E289F0E171C9C60335DD2F492CB409A4DB97BDF86E2DBA605064DB040A3DF5678E24F66718CA115C95C892FF7AEDFAABC2E6414716298CEC1A604270FEADF191B7C8A59C238C395A65442C0B963BF83025BED3951A271B7440EC7687C31DE63355DA7FEAC15DC962C7BF7614EB59B077B9889AD8703DFE98AC99615B722A0ABE89956D1058E025C7733420CB51D7E1608EFF2C0A30C9A5EB77CCA02C6B00CE781B172001C6C458630890062E27CE307D513A7686A69D1D548DE8334B13136D9E842A5E17FD67522C93823E03F08AEE8024AF5D88B2EE01D4D9980084FE68405F |
| 146 | 20040226145128 2 6 100 3071 5 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD95096CCF | 146 | 20060829063416 2 6 100 4095 2 DA110847314B537539F2A20681212A0B2ED264BF1F2595B817CC516D5AA4211585948B248F77277B11AB206738C71B5FB2FCC4041927B40B985282795A89EF66BDB111E1D07D790AC487DA5841B66FC407ED5DD8612703136422C442139C12040CE776FEB6C8B59B95408F31FB50073AD54B03F97113E61BE577E76D13AA971BA82CEE621C31C4770A7E076245A16689A9FE3E9190FB617FB330AA70AAC623B447D1858C24993D486C2B9A3C63FFCB3F230E7185F163C1EED434C24EE11EAC5B2369FEAF790523BD8BF7E8F9C87467ED6C89E5596974DCA6960E537259EA3AA587BF5198B26CE37638BC57012851903BB4CC0E2A28EC741EECB6220556EC5C118AE0142E5374AE2A3D1CEF165C09C0988A37877BCA6BBCAE28D52DA6701BF077307195C3618D4CAC58DDF64B6A8C2BF8E2FDCC0840973A8ED1F8413689BE05EA54AB6CD30464F94DD926D8CEC6B56704F534C6D8329A27ECAD9836721BC0C283E63CDA54FCEA851C0203E747BB02B75C92036928EFC201FFCBB747A2E093CCED157C3C3F74258D5607B6B8AA330DECCF42A73A6F81D300BAFCA921BAFF635DFC90824938F7454B258C1967FF90C1D828E028F9FA86AA7B287A87EC750EDCECEEEC223EAEA78511CB3C0130043950478737FDF6D56EA2B705D5E4C57701E955A9C862DBCAF36D0624D2F2C20616AA3E0478A4A722BBA577BC02578EE57DE9222B |
| 147 | 20040226153142 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD95582C7B | 147 | 20060829082327 2 6 100 4095 5 DA110847314B537539F2A20681212A0B2ED264BF1F2595B817CC516D5AA4211585948B248F77277B11AB206738C71B5FB2FCC4041927B40B985282795A89EF66BDB111E1D07D790AC487DA5841B66FC407ED5DD8612703136422C442139C12040CE776FEB6C8B59B95408F31FB50073AD54B03F97113E61BE577E76D13AA971BA82CEE621C31C4770A7E076245A16689A9FE3E9190FB617FB330AA70AAC623B447D1858C24993D486C2B9A3C63FFCB3F230E7185F163C1EED434C24EE11EAC5B2369FEAF790523BD8BF7E8F9C87467ED6C89E5596974DCA6960E537259EA3AA587BF5198B26CE37638BC57012851903BB4CC0E2A28EC741EECB6220556EC5C118AE0142E5374AE2A3D1CEF165C09C0988A37877BCA6BBCAE28D52DA6701BF077307195C3618D4CAC58DDF64B6A8C2BF8E2FDCC0840973A8ED1F8413689BE05EA54AB6CD30464F94DD926D8CEC6B56704F534C6D8329A27ECAD9836721BC0C283E63CDA54FCEA851C0203E747BB02B75C92036928EFC201FFCBB747A2E093CCED157C3C3F74258D5607B6B8AA330DECCF42A73A6F81D300BAFCA921BAFF635DFC90824938F7454B258C1967FF90C1D828E028F9FA86AA7B287A87EC750EDCECEEEC223EAEA78511CB3C0130043950478737FDF6D56EA2B705D5E4C57701E955A9C862DBCAF36D0624D2F2C20616AA3E0478A4A722BBA577BC02578EE57E5385E7 |
| 148 | 20040226164905 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD95FACE7B | 148 | 20060829092010 2 6 100 4095 2 DA110847314B537539F2A20681212A0B2ED264BF1F2595B817CC516D5AA4211585948B248F77277B11AB206738C71B5FB2FCC4041927B40B985282795A89EF66BDB111E1D07D790AC487DA5841B66FC407ED5DD8612703136422C442139C12040CE776FEB6C8B59B95408F31FB50073AD54B03F97113E61BE577E76D13AA971BA82CEE621C31C4770A7E076245A16689A9FE3E9190FB617FB330AA70AAC623B447D1858C24993D486C2B9A3C63FFCB3F230E7185F163C1EED434C24EE11EAC5B2369FEAF790523BD8BF7E8F9C87467ED6C89E5596974DCA6960E537259EA3AA587BF5198B26CE37638BC57012851903BB4CC0E2A28EC741EECB6220556EC5C118AE0142E5374AE2A3D1CEF165C09C0988A37877BCA6BBCAE28D52DA6701BF077307195C3618D4CAC58DDF64B6A8C2BF8E2FDCC0840973A8ED1F8413689BE05EA54AB6CD30464F94DD926D8CEC6B56704F534C6D8329A27ECAD9836721BC0C283E63CDA54FCEA851C0203E747BB02B75C92036928EFC201FFCBB747A2E093CCED157C3C3F74258D5607B6B8AA330DECCF42A73A6F81D300BAFCA921BAFF635DFC90824938F7454B258C1967FF90C1D828E028F9FA86AA7B287A87EC750EDCECEEEC223EAEA78511CB3C0130043950478737FDF6D56EA2B705D5E4C57701E955A9C862DBCAF36D0624D2F2C20616AA3E0478A4A722BBA577BC02578EE57E8501A3 |
| 149 | 20040226171921 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD9633F443 | 149 | 20060830004204 2 6 100 4095 5 DA110847314B537539F2A20681212A0B2ED264BF1F2595B817CC516D5AA4211585948B248F77277B11AB206738C71B5FB2FCC4041927B40B985282795A89EF66BDB111E1D07D790AC487DA5841B66FC407ED5DD8612703136422C442139C12040CE776FEB6C8B59B95408F31FB50073AD54B03F97113E61BE577E76D13AA971BA82CEE621C31C4770A7E076245A16689A9FE3E9190FB617FB330AA70AAC623B447D1858C24993D486C2B9A3C63FFCB3F230E7185F163C1EED434C24EE11EAC5B2369FEAF790523BD8BF7E8F9C87467ED6C89E5596974DCA6960E537259EA3AA587BF5198B26CE37638BC57012851903BB4CC0E2A28EC741EECB6220556EC5C118AE0142E5374AE2A3D1CEF165C09C0988A37877BCA6BBCAE28D52DA6701BF077307195C3618D4CAC58DDF64B6A8C2BF8E2FDCC0840973A8ED1F8413689BE05EA54AB6CD30464F94DD926D8CEC6B56704F534C6D8329A27ECAD9836721BC0C283E63CDA54FCEA851C0203E747BB02B75C92036928EFC201FFCBB747A2E093CCED157C3C3F74258D5607B6B8AA330DECCF42A73A6F81D300BAFCA921BAFF635DFC90824938F7454B258C1967FF90C1D828E028F9FA86AA7B287A87EC750EDCECEEEC223EAEA78511CB3C0130043950478737FDF6D56EA2B705D5E4C57701E955A9C862DBCAF36D0624D2F2C20616AA3E0478A4A722BBA577BC02578EE5825F180F |
| 150 | 20040226182347 2 6 100 3071 5 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD96BAC3A7 | 150 | 20060830013522 2 6 100 4095 2 DA110847314B537539F2A20681212A0B2ED264BF1F2595B817CC516D5AA4211585948B248F77277B11AB206738C71B5FB2FCC4041927B40B985282795A89EF66BDB111E1D07D790AC487DA5841B66FC407ED5DD8612703136422C442139C12040CE776FEB6C8B59B95408F31FB50073AD54B03F97113E61BE577E76D13AA971BA82CEE621C31C4770A7E076245A16689A9FE3E9190FB617FB330AA70AAC623B447D1858C24993D486C2B9A3C63FFCB3F230E7185F163C1EED434C24EE11EAC5B2369FEAF790523BD8BF7E8F9C87467ED6C89E5596974DCA6960E537259EA3AA587BF5198B26CE37638BC57012851903BB4CC0E2A28EC741EECB6220556EC5C118AE0142E5374AE2A3D1CEF165C09C0988A37877BCA6BBCAE28D52DA6701BF077307195C3618D4CAC58DDF64B6A8C2BF8E2FDCC0840973A8ED1F8413689BE05EA54AB6CD30464F94DD926D8CEC6B56704F534C6D8329A27ECAD9836721BC0C283E63CDA54FCEA851C0203E747BB02B75C92036928EFC201FFCBB747A2E093CCED157C3C3F74258D5607B6B8AA330DECCF42A73A6F81D300BAFCA921BAFF635DFC90824938F7454B258C1967FF90C1D828E028F9FA86AA7B287A87EC750EDCECEEEC223EAEA78511CB3C0130043950478737FDF6D56EA2B705D5E4C57701E955A9C862DBCAF36D0624D2F2C20616AA3E0478A4A722BBA577BC02578EE5828DFA2B |
| 151 | 20040226200555 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD97972EFB | 151 | 20060830124707 2 6 100 4095 2 DA110847314B537539F2A20681212A0B2ED264BF1F2595B817CC516D5AA4211585948B248F77277B11AB206738C71B5FB2FCC4041927B40B985282795A89EF66BDB111E1D07D790AC487DA5841B66FC407ED5DD8612703136422C442139C12040CE776FEB6C8B59B95408F31FB50073AD54B03F97113E61BE577E76D13AA971BA82CEE621C31C4770A7E076245A16689A9FE3E9190FB617FB330AA70AAC623B447D1858C24993D486C2B9A3C63FFCB3F230E7185F163C1EED434C24EE11EAC5B2369FEAF790523BD8BF7E8F9C87467ED6C89E5596974DCA6960E537259EA3AA587BF5198B26CE37638BC57012851903BB4CC0E2A28EC741EECB6220556EC5C118AE0142E5374AE2A3D1CEF165C09C0988A37877BCA6BBCAE28D52DA6701BF077307195C3618D4CAC58DDF64B6A8C2BF8E2FDCC0840973A8ED1F8413689BE05EA54AB6CD30464F94DD926D8CEC6B56704F534C6D8329A27ECAD9836721BC0C283E63CDA54FCEA851C0203E747BB02B75C92036928EFC201FFCBB747A2E093CCED157C3C3F74258D5607B6B8AA330DECCF42A73A6F81D300BAFCA921BAFF635DFC90824938F7454B258C1967FF90C1D828E028F9FA86AA7B287A87EC750EDCECEEEC223EAEA78511CB3C0130043950478737FDF6D56EA2B705D5E4C57701E955A9C862DBCAF36D0624D2F2C20616AA3E0478A4A722BBA577BC02578EE58555C9EB |
| 152 | 20040226202801 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD97C0B5C3 | 152 | 20060830180312 2 6 100 4095 5 DA110847314B537539F2A20681212A0B2ED264BF1F2595B817CC516D5AA4211585948B248F77277B11AB206738C71B5FB2FCC4041927B40B985282795A89EF66BDB111E1D07D790AC487DA5841B66FC407ED5DD8612703136422C442139C12040CE776FEB6C8B59B95408F31FB50073AD54B03F97113E61BE577E76D13AA971BA82CEE621C31C4770A7E076245A16689A9FE3E9190FB617FB330AA70AAC623B447D1858C24993D486C2B9A3C63FFCB3F230E7185F163C1EED434C24EE11EAC5B2369FEAF790523BD8BF7E8F9C87467ED6C89E5596974DCA6960E537259EA3AA587BF5198B26CE37638BC57012851903BB4CC0E2A28EC741EECB6220556EC5C118AE0142E5374AE2A3D1CEF165C09C0988A37877BCA6BBCAE28D52DA6701BF077307195C3618D4CAC58DDF64B6A8C2BF8E2FDCC0840973A8ED1F8413689BE05EA54AB6CD30464F94DD926D8CEC6B56704F534C6D8329A27ECAD9836721BC0C283E63CDA54FCEA851C0203E747BB02B75C92036928EFC201FFCBB747A2E093CCED157C3C3F74258D5607B6B8AA330DECCF42A73A6F81D300BAFCA921BAFF635DFC90824938F7454B258C1967FF90C1D828E028F9FA86AA7B287A87EC750EDCECEEEC223EAEA78511CB3C0130043950478737FDF6D56EA2B705D5E4C57701E955A9C862DBCAF36D0624D2F2C20616AA3E0478A4A722BBA577BC02578EE586989437 |
| 153 | 20040226214755 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD9868011B | 153 | 20060831041205 2 6 100 4095 5 DA110847314B537539F2A20681212A0B2ED264BF1F2595B817CC516D5AA4211585948B248F77277B11AB206738C71B5FB2FCC4041927B40B985282795A89EF66BDB111E1D07D790AC487DA5841B66FC407ED5DD8612703136422C442139C12040CE776FEB6C8B59B95408F31FB50073AD54B03F97113E61BE577E76D13AA971BA82CEE621C31C4770A7E076245A16689A9FE3E9190FB617FB330AA70AAC623B447D1858C24993D486C2B9A3C63FFCB3F230E7185F163C1EED434C24EE11EAC5B2369FEAF790523BD8BF7E8F9C87467ED6C89E5596974DCA6960E537259EA3AA587BF5198B26CE37638BC57012851903BB4CC0E2A28EC741EECB6220556EC5C118AE0142E5374AE2A3D1CEF165C09C0988A37877BCA6BBCAE28D52DA6701BF077307195C3618D4CAC58DDF64B6A8C2BF8E2FDCC0840973A8ED1F8413689BE05EA54AB6CD30464F94DD926D8CEC6B56704F534C6D8329A27ECAD9836721BC0C283E63CDA54FCEA851C0203E747BB02B75C92036928EFC201FFCBB747A2E093CCED157C3C3F74258D5607B6B8AA330DECCF42A73A6F81D300BAFCA921BAFF635DFC90824938F7454B258C1967FF90C1D828E028F9FA86AA7B287A87EC750EDCECEEEC223EAEA78511CB3C0130043950478737FDF6D56EA2B705D5E4C57701E955A9C862DBCAF36D0624D2F2C20616AA3E0478A4A722BBA577BC02578EE5891334BF |
| 154 | 20040226215843 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD9876E7FB | 154 | 20060831102341 2 6 100 4095 5 DA110847314B537539F2A20681212A0B2ED264BF1F2595B817CC516D5AA4211585948B248F77277B11AB206738C71B5FB2FCC4041927B40B985282795A89EF66BDB111E1D07D790AC487DA5841B66FC407ED5DD8612703136422C442139C12040CE776FEB6C8B59B95408F31FB50073AD54B03F97113E61BE577E76D13AA971BA82CEE621C31C4770A7E076245A16689A9FE3E9190FB617FB330AA70AAC623B447D1858C24993D486C2B9A3C63FFCB3F230E7185F163C1EED434C24EE11EAC5B2369FEAF790523BD8BF7E8F9C87467ED6C89E5596974DCA6960E537259EA3AA587BF5198B26CE37638BC57012851903BB4CC0E2A28EC741EECB6220556EC5C118AE0142E5374AE2A3D1CEF165C09C0988A37877BCA6BBCAE28D52DA6701BF077307195C3618D4CAC58DDF64B6A8C2BF8E2FDCC0840973A8ED1F8413689BE05EA54AB6CD30464F94DD926D8CEC6B56704F534C6D8329A27ECAD9836721BC0C283E63CDA54FCEA851C0203E747BB02B75C92036928EFC201FFCBB747A2E093CCED157C3C3F74258D5607B6B8AA330DECCF42A73A6F81D300BAFCA921BAFF635DFC90824938F7454B258C1967FF90C1D828E028F9FA86AA7B287A87EC750EDCECEEEC223EAEA78511CB3C0130043950478737FDF6D56EA2B705D5E4C57701E955A9C862DBCAF36D0624D2F2C20616AA3E0478A4A722BBA577BC02578EE58A8F8B27 |
| 155 | 20040226220422 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD987B4983 | 155 | 20060831234001 2 6 100 4095 2 DA110847314B537539F2A20681212A0B2ED264BF1F2595B817CC516D5AA4211585948B248F77277B11AB206738C71B5FB2FCC4041927B40B985282795A89EF66BDB111E1D07D790AC487DA5841B66FC407ED5DD8612703136422C442139C12040CE776FEB6C8B59B95408F31FB50073AD54B03F97113E61BE577E76D13AA971BA82CEE621C31C4770A7E076245A16689A9FE3E9190FB617FB330AA70AAC623B447D1858C24993D486C2B9A3C63FFCB3F230E7185F163C1EED434C24EE11EAC5B2369FEAF790523BD8BF7E8F9C87467ED6C89E5596974DCA6960E537259EA3AA587BF5198B26CE37638BC57012851903BB4CC0E2A28EC741EECB6220556EC5C118AE0142E5374AE2A3D1CEF165C09C0988A37877BCA6BBCAE28D52DA6701BF077307195C3618D4CAC58DDF64B6A8C2BF8E2FDCC0840973A8ED1F8413689BE05EA54AB6CD30464F94DD926D8CEC6B56704F534C6D8329A27ECAD9836721BC0C283E63CDA54FCEA851C0203E747BB02B75C92036928EFC201FFCBB747A2E093CCED157C3C3F74258D5607B6B8AA330DECCF42A73A6F81D300BAFCA921BAFF635DFC90824938F7454B258C1967FF90C1D828E028F9FA86AA7B287A87EC750EDCECEEEC223EAEA78511CB3C0130043950478737FDF6D56EA2B705D5E4C57701E955A9C862DBCAF36D0624D2F2C20616AA3E0478A4A722BBA577BC02578EE58DD7278B |
| 156 | 20040226222346 2 6 100 3071 2 EDDA2E6520E6A915FE821EA06B4E19C95EBA8092F521CDE778B7B6CCA0FD89E935C904E2FA83E37DD49C1C52120C0958B85AAEE0B1A0E36C89836CE6C5509D50ABA58C154289C129B4A12A9249589496A5381CEA2105D818DB8790C4913BAD3C4C5ADB6BE036BD44B8AFB9F607017277FA36C971E5F10D7D062354FAB31BA97B376D723451478D1BA7D2C213A2E377E6826FF2F0695A2EDF9F8107DE4FF78DD0C2EF3A715084592623C58D2B2775FC7C0CF8F745EA1C75BEA8E574B9747207357DE143B0A803829E418B8F4BB44C40481CBB086B8AC6B93CC0E989E1336A010529F5D0FC4E077F778672646C62B7371965D60822C871F97C03913DB5CE080F67A348DD1722DD7BFA0761B2BF16A925FB9FCB6DCD1BC959A8794ACAEA984E1E9AE7BB2276B9C866CC890D8A8C51A17C479DA689DAA065C019CF9B082ED67D9CF1C9753E2A4030CCC27BE34280F042384597CEA223D5FA6631E109D5A23C60312F1D4783C3403D67A0D67665F7C5BEABF0BC30514DB07D7EF2A8E07CDD989D61D3 | 156 | 20060901032352 2 6 100 4095 2 DA110847314B537539F2A20681212A0B2ED264BF1F2595B817CC516D5AA4211585948B248F77277B11AB206738C71B5FB2FCC4041927B40B985282795A89EF66BDB111E1D07D790AC487DA5841B66FC407ED5DD8612703136422C442139C12040CE776FEB6C8B59B95408F31FB50073AD54B03F97113E61BE577E76D13AA971BA82CEE621C31C4770A7E076245A16689A9FE3E9190FB617FB330AA70AAC623B447D1858C24993D486C2B9A3C63FFCB3F230E7185F163C1EED434C24EE11EAC5B2369FEAF790523BD8BF7E8F9C87467ED6C89E5596974DCA6960E537259EA3AA587BF5198B26CE37638BC57012851903BB4CC0E2A28EC741EECB6220556EC5C118AE0142E5374AE2A3D1CEF165C09C0988A37877BCA6BBCAE28D52DA6701BF077307195C3618D4CAC58DDF64B6A8C2BF8E2FDCC0840973A8ED1F8413689BE05EA54AB6CD30464F94DD926D8CEC6B56704F534C6D8329A27ECAD9836721BC0C283E63CDA54FCEA851C0203E747BB02B75C92036928EFC201FFCBB747A2E093CCED157C3C3F74258D5607B6B8AA330DECCF42A73A6F81D300BAFCA921BAFF635DFC90824938F7454B258C1967FF90C1D828E028F9FA86AA7B287A87EC750EDCECEEEC223EAEA78511CB3C0130043950478737FDF6D56EA2B705D5E4C57701E955A9C862DBCAF36D0624D2F2C20616AA3E0478A4A722BBA577BC02578EE58EBE93EB |
| 157 | 20040227091438 2 6 100 4095 5 C7FE661FF2675517258B6E893FE81DFC29EDFB28FFE325C4F929BFAF5D0203DF5D75D966B0886A4197CC8F2EE339349DF88E73C54A315C402DF609DA61A237435167524F8EA37E5AB33E8A0C80E36DF4F6B9D6141958CC784CDDB6E2543038C9966D62AC2474786F2E2890E4935AD47BB005A6FC309817807EC9597B69858F1FBD6A1B28E897EFB6219F9FF83BEAFFD448C9F2F8C33CEA7C08242428FD75D218411E41523B688BF3D9311374E43D8963C821611BBBC91CA23968E60FB143FA0B36120657734D5C83C1C58A5A229CCDDC27875E51C358F0C8FEDDE4A11C50E0A154C80127B6FF92F496F7F2FA41D601A3EA88A3A53569AA3F3ABA5761757AC553CF57578800379C5F06082DD6088841D7BA48A58D1422B0DEC088279655C2D6380CF7097CD39565E9998785CBEB300AFFADEACA285201CBB27F48456EF7E49DE75380D0D1B4CCC28ADB8E12903473548D74A8847DAADC34315F157351C4CD507FF9B03CA6DD1C954BB75C9FD3C425FEFA76FC03FB346BE11E61B67A3AD374C1843ECA636CC7454249AB2A08B645DADCBFB48A470B1206ED20020FF0A0F5C2253187BBC2BC7F449AD58D35746E5A47B4A7BB404592C0A1F4E3BA34938C1E3C32464E1A52D3E722FA1165B72E8B438C11CFD0DB42A4081ED09F468A2E17C8D3F2BB689DC0CC831F889D7BAFC39D2A7F6C9A362E9BAE48B12FBACF34F9DFC5737ECF | 157 | 20060901061345 2 6 100 4095 5 DA110847314B537539F2A20681212A0B2ED264BF1F2595B817CC516D5AA4211585948B248F77277B11AB206738C71B5FB2FCC4041927B40B985282795A89EF66BDB111E1D07D790AC487DA5841B66FC407ED5DD8612703136422C442139C12040CE776FEB6C8B59B95408F31FB50073AD54B03F97113E61BE577E76D13AA971BA82CEE621C31C4770A7E076245A16689A9FE3E9190FB617FB330AA70AAC623B447D1858C24993D486C2B9A3C63FFCB3F230E7185F163C1EED434C24EE11EAC5B2369FEAF790523BD8BF7E8F9C87467ED6C89E5596974DCA6960E537259EA3AA587BF5198B26CE37638BC57012851903BB4CC0E2A28EC741EECB6220556EC5C118AE0142E5374AE2A3D1CEF165C09C0988A37877BCA6BBCAE28D52DA6701BF077307195C3618D4CAC58DDF64B6A8C2BF8E2FDCC0840973A8ED1F8413689BE05EA54AB6CD30464F94DD926D8CEC6B56704F534C6D8329A27ECAD9836721BC0C283E63CDA54FCEA851C0203E747BB02B75C92036928EFC201FFCBB747A2E093CCED157C3C3F74258D5607B6B8AA330DECCF42A73A6F81D300BAFCA921BAFF635DFC90824938F7454B258C1967FF90C1D828E028F9FA86AA7B287A87EC750EDCECEEEC223EAEA78511CB3C0130043950478737FDF6D56EA2B705D5E4C57701E955A9C862DBCAF36D0624D2F2C20616AA3E0478A4A722BBA577BC02578EE58F693A3F |
| 158 | 20040227101541 2 6 100 4095 2 C7FE661FF2675517258B6E893FE81DFC29EDFB28FFE325C4F929BFAF5D0203DF5D75D966B0886A4197CC8F2EE339349DF88E73C54A315C402DF609DA61A237435167524F8EA37E5AB33E8A0C80E36DF4F6B9D6141958CC784CDDB6E2543038C9966D62AC2474786F2E2890E4935AD47BB005A6FC309817807EC9597B69858F1FBD6A1B28E897EFB6219F9FF83BEAFFD448C9F2F8C33CEA7C08242428FD75D218411E41523B688BF3D9311374E43D8963C821611BBBC91CA23968E60FB143FA0B36120657734D5C83C1C58A5A229CCDDC27875E51C358F0C8FEDDE4A11C50E0A154C80127B6FF92F496F7F2FA41D601A3EA88A3A53569AA3F3ABA5761757AC553CF57578800379C5F06082DD6088841D7BA48A58D1422B0DEC088279655C2D6380CF7097CD39565E9998785CBEB300AFFADEACA285201CBB27F48456EF7E49DE75380D0D1B4CCC28ADB8E12903473548D74A8847DAADC34315F157351C4CD507FF9B03CA6DD1C954BB75C9FD3C425FEFA76FC03FB346BE11E61B67A3AD374C1843ECA636CC7454249AB2A08B645DADCBFB48A470B1206ED20020FF0A0F5C2253187BBC2BC7F449AD58D35746E5A47B4A7BB404592C0A1F4E3BA34938C1E3C32464E1A52D3E722FA1165B72E8B438C11CFD0DB42A4081ED09F468A2E17C8D3F2BB689DC0CC831F889D7BAFC39D2A7F6C9A362E9BAE48B12FBACF34F9DFC5AE7363 | 158 | 20060901123055 2 6 100 4095 5 DA110847314B537539F2A20681212A0B2ED264BF1F2595B817CC516D5AA4211585948B248F77277B11AB206738C71B5FB2FCC4041927B40B985282795A89EF66BDB111E1D07D790AC487DA5841B66FC407ED5DD8612703136422C442139C12040CE776FEB6C8B59B95408F31FB50073AD54B03F97113E61BE577E76D13AA971BA82CEE621C31C4770A7E076245A16689A9FE3E9190FB617FB330AA70AAC623B447D1858C24993D486C2B9A3C63FFCB3F230E7185F163C1EED434C24EE11EAC5B2369FEAF790523BD8BF7E8F9C87467ED6C89E5596974DCA6960E537259EA3AA587BF5198B26CE37638BC57012851903BB4CC0E2A28EC741EECB6220556EC5C118AE0142E5374AE2A3D1CEF165C09C0988A37877BCA6BBCAE28D52DA6701BF077307195C3618D4CAC58DDF64B6A8C2BF8E2FDCC0840973A8ED1F8413689BE05EA54AB6CD30464F94DD926D8CEC6B56704F534C6D8329A27ECAD9836721BC0C283E63CDA54FCEA851C0203E747BB02B75C92036928EFC201FFCBB747A2E093CCED157C3C3F74258D5607B6B8AA330DECCF42A73A6F81D300BAFCA921BAFF635DFC90824938F7454B258C1967FF90C1D828E028F9FA86AA7B287A87EC750EDCECEEEC223EAEA78511CB3C0130043950478737FDF6D56EA2B705D5E4C57701E955A9C862DBCAF36D0624D2F2C20616AA3E0478A4A722BBA577BC02578EE590F80AE7 |
| 159 | 20040227160657 2 6 100 4095 5 C7FE661FF2675517258B6E893FE81DFC29EDFB28FFE325C4F929BFAF5D0203DF5D75D966B0886A4197CC8F2EE339349DF88E73C54A315C402DF609DA61A237435167524F8EA37E5AB33E8A0C80E36DF4F6B9D6141958CC784CDDB6E2543038C9966D62AC2474786F2E2890E4935AD47BB005A6FC309817807EC9597B69858F1FBD6A1B28E897EFB6219F9FF83BEAFFD448C9F2F8C33CEA7C08242428FD75D218411E41523B688BF3D9311374E43D8963C821611BBBC91CA23968E60FB143FA0B36120657734D5C83C1C58A5A229CCDDC27875E51C358F0C8FEDDE4A11C50E0A154C80127B6FF92F496F7F2FA41D601A3EA88A3A53569AA3F3ABA5761757AC553CF57578800379C5F06082DD6088841D7BA48A58D1422B0DEC088279655C2D6380CF7097CD39565E9998785CBEB300AFFADEACA285201CBB27F48456EF7E49DE75380D0D1B4CCC28ADB8E12903473548D74A8847DAADC34315F157351C4CD507FF9B03CA6DD1C954BB75C9FD3C425FEFA76FC03FB346BE11E61B67A3AD374C1843ECA636CC7454249AB2A08B645DADCBFB48A470B1206ED20020FF0A0F5C2253187BBC2BC7F449AD58D35746E5A47B4A7BB404592C0A1F4E3BA34938C1E3C32464E1A52D3E722FA1165B72E8B438C11CFD0DB42A4081ED09F468A2E17C8D3F2BB689DC0CC831F889D7BAFC39D2A7F6C9A362E9BAE48B12FBACF34F9DFC7295F4F | 159 | 20060901191922 2 6 100 4095 2 DA110847314B537539F2A20681212A0B2ED264BF1F2595B817CC516D5AA4211585948B248F77277B11AB206738C71B5FB2FCC4041927B40B985282795A89EF66BDB111E1D07D790AC487DA5841B66FC407ED5DD8612703136422C442139C12040CE776FEB6C8B59B95408F31FB50073AD54B03F97113E61BE577E76D13AA971BA82CEE621C31C4770A7E076245A16689A9FE3E9190FB617FB330AA70AAC623B447D1858C24993D486C2B9A3C63FFCB3F230E7185F163C1EED434C24EE11EAC5B2369FEAF790523BD8BF7E8F9C87467ED6C89E5596974DCA6960E537259EA3AA587BF5198B26CE37638BC57012851903BB4CC0E2A28EC741EECB6220556EC5C118AE0142E5374AE2A3D1CEF165C09C0988A37877BCA6BBCAE28D52DA6701BF077307195C3618D4CAC58DDF64B6A8C2BF8E2FDCC0840973A8ED1F8413689BE05EA54AB6CD30464F94DD926D8CEC6B56704F534C6D8329A27ECAD9836721BC0C283E63CDA54FCEA851C0203E747BB02B75C92036928EFC201FFCBB747A2E093CCED157C3C3F74258D5607B6B8AA330DECCF42A73A6F81D300BAFCA921BAFF635DFC90824938F7454B258C1967FF90C1D828E028F9FA86AA7B287A87EC750EDCECEEEC223EAEA78511CB3C0130043950478737FDF6D56EA2B705D5E4C57701E955A9C862DBCAF36D0624D2F2C20616AA3E0478A4A722BBA577BC02578EE592994C63 |
| 160 | 20040227180410 2 6 100 4095 2 C7FE661FF2675517258B6E893FE81DFC29EDFB28FFE325C4F929BFAF5D0203DF5D75D966B0886A4197CC8F2EE339349DF88E73C54A315C402DF609DA61A237435167524F8EA37E5AB33E8A0C80E36DF4F6B9D6141958CC784CDDB6E2543038C9966D62AC2474786F2E2890E4935AD47BB005A6FC309817807EC9597B69858F1FBD6A1B28E897EFB6219F9FF83BEAFFD448C9F2F8C33CEA7C08242428FD75D218411E41523B688BF3D9311374E43D8963C821611BBBC91CA23968E60FB143FA0B36120657734D5C83C1C58A5A229CCDDC27875E51C358F0C8FEDDE4A11C50E0A154C80127B6FF92F496F7F2FA41D601A3EA88A3A53569AA3F3ABA5761757AC553CF57578800379C5F06082DD6088841D7BA48A58D1422B0DEC088279655C2D6380CF7097CD39565E9998785CBEB300AFFADEACA285201CBB27F48456EF7E49DE75380D0D1B4CCC28ADB8E12903473548D74A8847DAADC34315F157351C4CD507FF9B03CA6DD1C954BB75C9FD3C425FEFA76FC03FB346BE11E61B67A3AD374C1843ECA636CC7454249AB2A08B645DADCBFB48A470B1206ED20020FF0A0F5C2253187BBC2BC7F449AD58D35746E5A47B4A7BB404592C0A1F4E3BA34938C1E3C32464E1A52D3E722FA1165B72E8B438C11CFD0DB42A4081ED09F468A2E17C8D3F2BB689DC0CC831F889D7BAFC39D2A7F6C9A362E9BAE48B12FBACF34F9DFC7A46573 | 160 | 20060901203957 2 6 100 4095 5 DA110847314B537539F2A20681212A0B2ED264BF1F2595B817CC516D5AA4211585948B248F77277B11AB206738C71B5FB2FCC4041927B40B985282795A89EF66BDB111E1D07D790AC487DA5841B66FC407ED5DD8612703136422C442139C12040CE776FEB6C8B59B95408F31FB50073AD54B03F97113E61BE577E76D13AA971BA82CEE621C31C4770A7E076245A16689A9FE3E9190FB617FB330AA70AAC623B447D1858C24993D486C2B9A3C63FFCB3F230E7185F163C1EED434C24EE11EAC5B2369FEAF790523BD8BF7E8F9C87467ED6C89E5596974DCA6960E537259EA3AA587BF5198B26CE37638BC57012851903BB4CC0E2A28EC741EECB6220556EC5C118AE0142E5374AE2A3D1CEF165C09C0988A37877BCA6BBCAE28D52DA6701BF077307195C3618D4CAC58DDF64B6A8C2BF8E2FDCC0840973A8ED1F8413689BE05EA54AB6CD30464F94DD926D8CEC6B56704F534C6D8329A27ECAD9836721BC0C283E63CDA54FCEA851C0203E747BB02B75C92036928EFC201FFCBB747A2E093CCED157C3C3F74258D5607B6B8AA330DECCF42A73A6F81D300BAFCA921BAFF635DFC90824938F7454B258C1967FF90C1D828E028F9FA86AA7B287A87EC750EDCECEEEC223EAEA78511CB3C0130043950478737FDF6D56EA2B705D5E4C57701E955A9C862DBCAF36D0624D2F2C20616AA3E0478A4A722BBA577BC02578EE592E5D92F |
| 161 | 20040227225950 2 6 100 4095 2 C7FE661FF2675517258B6E893FE81DFC29EDFB28FFE325C4F929BFAF5D0203DF5D75D966B0886A4197CC8F2EE339349DF88E73C54A315C402DF609DA61A237435167524F8EA37E5AB33E8A0C80E36DF4F6B9D6141958CC784CDDB6E2543038C9966D62AC2474786F2E2890E4935AD47BB005A6FC309817807EC9597B69858F1FBD6A1B28E897EFB6219F9FF83BEAFFD448C9F2F8C33CEA7C08242428FD75D218411E41523B688BF3D9311374E43D8963C821611BBBC91CA23968E60FB143FA0B36120657734D5C83C1C58A5A229CCDDC27875E51C358F0C8FEDDE4A11C50E0A154C80127B6FF92F496F7F2FA41D601A3EA88A3A53569AA3F3ABA5761757AC553CF57578800379C5F06082DD6088841D7BA48A58D1422B0DEC088279655C2D6380CF7097CD39565E9998785CBEB300AFFADEACA285201CBB27F48456EF7E49DE75380D0D1B4CCC28ADB8E12903473548D74A8847DAADC34315F157351C4CD507FF9B03CA6DD1C954BB75C9FD3C425FEFA76FC03FB346BE11E61B67A3AD374C1843ECA636CC7454249AB2A08B645DADCBFB48A470B1206ED20020FF0A0F5C2253187BBC2BC7F449AD58D35746E5A47B4A7BB404592C0A1F4E3BA34938C1E3C32464E1A52D3E722FA1165B72E8B438C11CFD0DB42A4081ED09F468A2E17C8D3F2BB689DC0CC831F889D7BAFC39D2A7F6C9A362E9BAE48B12FBACF34F9DFC8E6D5E3 | 161 | 20060901210250 2 6 100 4095 2 DA110847314B537539F2A20681212A0B2ED264BF1F2595B817CC516D5AA4211585948B248F77277B11AB206738C71B5FB2FCC4041927B40B985282795A89EF66BDB111E1D07D790AC487DA5841B66FC407ED5DD8612703136422C442139C12040CE776FEB6C8B59B95408F31FB50073AD54B03F97113E61BE577E76D13AA971BA82CEE621C31C4770A7E076245A16689A9FE3E9190FB617FB330AA70AAC623B447D1858C24993D486C2B9A3C63FFCB3F230E7185F163C1EED434C24EE11EAC5B2369FEAF790523BD8BF7E8F9C87467ED6C89E5596974DCA6960E537259EA3AA587BF5198B26CE37638BC57012851903BB4CC0E2A28EC741EECB6220556EC5C118AE0142E5374AE2A3D1CEF165C09C0988A37877BCA6BBCAE28D52DA6701BF077307195C3618D4CAC58DDF64B6A8C2BF8E2FDCC0840973A8ED1F8413689BE05EA54AB6CD30464F94DD926D8CEC6B56704F534C6D8329A27ECAD9836721BC0C283E63CDA54FCEA851C0203E747BB02B75C92036928EFC201FFCBB747A2E093CCED157C3C3F74258D5607B6B8AA330DECCF42A73A6F81D300BAFCA921BAFF635DFC90824938F7454B258C1967FF90C1D828E028F9FA86AA7B287A87EC750EDCECEEEC223EAEA78511CB3C0130043950478737FDF6D56EA2B705D5E4C57701E955A9C862DBCAF36D0624D2F2C20616AA3E0478A4A722BBA577BC02578EE592F4A5F3 |
| 162 | 20040227233727 2 6 100 4095 2 C7FE661FF2675517258B6E893FE81DFC29EDFB28FFE325C4F929BFAF5D0203DF5D75D966B0886A4197CC8F2EE339349DF88E73C54A315C402DF609DA61A237435167524F8EA37E5AB33E8A0C80E36DF4F6B9D6141958CC784CDDB6E2543038C9966D62AC2474786F2E2890E4935AD47BB005A6FC309817807EC9597B69858F1FBD6A1B28E897EFB6219F9FF83BEAFFD448C9F2F8C33CEA7C08242428FD75D218411E41523B688BF3D9311374E43D8963C821611BBBC91CA23968E60FB143FA0B36120657734D5C83C1C58A5A229CCDDC27875E51C358F0C8FEDDE4A11C50E0A154C80127B6FF92F496F7F2FA41D601A3EA88A3A53569AA3F3ABA5761757AC553CF57578800379C5F06082DD6088841D7BA48A58D1422B0DEC088279655C2D6380CF7097CD39565E9998785CBEB300AFFADEACA285201CBB27F48456EF7E49DE75380D0D1B4CCC28ADB8E12903473548D74A8847DAADC34315F157351C4CD507FF9B03CA6DD1C954BB75C9FD3C425FEFA76FC03FB346BE11E61B67A3AD374C1843ECA636CC7454249AB2A08B645DADCBFB48A470B1206ED20020FF0A0F5C2253187BBC2BC7F449AD58D35746E5A47B4A7BB404592C0A1F4E3BA34938C1E3C32464E1A52D3E722FA1165B72E8B438C11CFD0DB42A4081ED09F468A2E17C8D3F2BB689DC0CC831F889D7BAFC39D2A7F6C9A362E9BAE48B12FBACF34F9DFC9079B33 | 162 | 20060901225047 2 6 100 4095 2 DA110847314B537539F2A20681212A0B2ED264BF1F2595B817CC516D5AA4211585948B248F77277B11AB206738C71B5FB2FCC4041927B40B985282795A89EF66BDB111E1D07D790AC487DA5841B66FC407ED5DD8612703136422C442139C12040CE776FEB6C8B59B95408F31FB50073AD54B03F97113E61BE577E76D13AA971BA82CEE621C31C4770A7E076245A16689A9FE3E9190FB617FB330AA70AAC623B447D1858C24993D486C2B9A3C63FFCB3F230E7185F163C1EED434C24EE11EAC5B2369FEAF790523BD8BF7E8F9C87467ED6C89E5596974DCA6960E537259EA3AA587BF5198B26CE37638BC57012851903BB4CC0E2A28EC741EECB6220556EC5C118AE0142E5374AE2A3D1CEF165C09C0988A37877BCA6BBCAE28D52DA6701BF077307195C3618D4CAC58DDF64B6A8C2BF8E2FDCC0840973A8ED1F8413689BE05EA54AB6CD30464F94DD926D8CEC6B56704F534C6D8329A27ECAD9836721BC0C283E63CDA54FCEA851C0203E747BB02B75C92036928EFC201FFCBB747A2E093CCED157C3C3F74258D5607B6B8AA330DECCF42A73A6F81D300BAFCA921BAFF635DFC90824938F7454B258C1967FF90C1D828E028F9FA86AA7B287A87EC750EDCECEEEC223EAEA78511CB3C0130043950478737FDF6D56EA2B705D5E4C57701E955A9C862DBCAF36D0624D2F2C20616AA3E0478A4A722BBA577BC02578EE5935D124B |
| 163 | 20040228032633 2 6 100 4095 5 C7FE661FF2675517258B6E893FE81DFC29EDFB28FFE325C4F929BFAF5D0203DF5D75D966B0886A4197CC8F2EE339349DF88E73C54A315C402DF609DA61A237435167524F8EA37E5AB33E8A0C80E36DF4F6B9D6141958CC784CDDB6E2543038C9966D62AC2474786F2E2890E4935AD47BB005A6FC309817807EC9597B69858F1FBD6A1B28E897EFB6219F9FF83BEAFFD448C9F2F8C33CEA7C08242428FD75D218411E41523B688BF3D9311374E43D8963C821611BBBC91CA23968E60FB143FA0B36120657734D5C83C1C58A5A229CCDDC27875E51C358F0C8FEDDE4A11C50E0A154C80127B6FF92F496F7F2FA41D601A3EA88A3A53569AA3F3ABA5761757AC553CF57578800379C5F06082DD6088841D7BA48A58D1422B0DEC088279655C2D6380CF7097CD39565E9998785CBEB300AFFADEACA285201CBB27F48456EF7E49DE75380D0D1B4CCC28ADB8E12903473548D74A8847DAADC34315F157351C4CD507FF9B03CA6DD1C954BB75C9FD3C425FEFA76FC03FB346BE11E61B67A3AD374C1843ECA636CC7454249AB2A08B645DADCBFB48A470B1206ED20020FF0A0F5C2253187BBC2BC7F449AD58D35746E5A47B4A7BB404592C0A1F4E3BA34938C1E3C32464E1A52D3E722FA1165B72E8B438C11CFD0DB42A4081ED09F468A2E17C8D3F2BB689DC0CC831F889D7BAFC39D2A7F6C9A362E9BAE48B12FBACF34F9DFCA006227 | 163 | 20060902020657 2 6 100 4095 2 DA110847314B537539F2A20681212A0B2ED264BF1F2595B817CC516D5AA4211585948B248F77277B11AB206738C71B5FB2FCC4041927B40B985282795A89EF66BDB111E1D07D790AC487DA5841B66FC407ED5DD8612703136422C442139C12040CE776FEB6C8B59B95408F31FB50073AD54B03F97113E61BE577E76D13AA971BA82CEE621C31C4770A7E076245A16689A9FE3E9190FB617FB330AA70AAC623B447D1858C24993D486C2B9A3C63FFCB3F230E7185F163C1EED434C24EE11EAC5B2369FEAF790523BD8BF7E8F9C87467ED6C89E5596974DCA6960E537259EA3AA587BF5198B26CE37638BC57012851903BB4CC0E2A28EC741EECB6220556EC5C118AE0142E5374AE2A3D1CEF165C09C0988A37877BCA6BBCAE28D52DA6701BF077307195C3618D4CAC58DDF64B6A8C2BF8E2FDCC0840973A8ED1F8413689BE05EA54AB6CD30464F94DD926D8CEC6B56704F534C6D8329A27ECAD9836721BC0C283E63CDA54FCEA851C0203E747BB02B75C92036928EFC201FFCBB747A2E093CCED157C3C3F74258D5607B6B8AA330DECCF42A73A6F81D300BAFCA921BAFF635DFC90824938F7454B258C1967FF90C1D828E028F9FA86AA7B287A87EC750EDCECEEEC223EAEA78511CB3C0130043950478737FDF6D56EA2B705D5E4C57701E955A9C862DBCAF36D0624D2F2C20616AA3E0478A4A722BBA577BC02578EE5942520CB |
| 164 | 20040228060859 2 6 100 4095 2 C7FE661FF2675517258B6E893FE81DFC29EDFB28FFE325C4F929BFAF5D0203DF5D75D966B0886A4197CC8F2EE339349DF88E73C54A315C402DF609DA61A237435167524F8EA37E5AB33E8A0C80E36DF4F6B9D6141958CC784CDDB6E2543038C9966D62AC2474786F2E2890E4935AD47BB005A6FC309817807EC9597B69858F1FBD6A1B28E897EFB6219F9FF83BEAFFD448C9F2F8C33CEA7C08242428FD75D218411E41523B688BF3D9311374E43D8963C821611BBBC91CA23968E60FB143FA0B36120657734D5C83C1C58A5A229CCDDC27875E51C358F0C8FEDDE4A11C50E0A154C80127B6FF92F496F7F2FA41D601A3EA88A3A53569AA3F3ABA5761757AC553CF57578800379C5F06082DD6088841D7BA48A58D1422B0DEC088279655C2D6380CF7097CD39565E9998785CBEB300AFFADEACA285201CBB27F48456EF7E49DE75380D0D1B4CCC28ADB8E12903473548D74A8847DAADC34315F157351C4CD507FF9B03CA6DD1C954BB75C9FD3C425FEFA76FC03FB346BE11E61B67A3AD374C1843ECA636CC7454249AB2A08B645DADCBFB48A470B1206ED20020FF0A0F5C2253187BBC2BC7F449AD58D35746E5A47B4A7BB404592C0A1F4E3BA34938C1E3C32464E1A52D3E722FA1165B72E8B438C11CFD0DB42A4081ED09F468A2E17C8D3F2BB689DC0CC831F889D7BAFC39D2A7F6C9A362E9BAE48B12FBACF34F9DFCAAE6E63 | 164 | 20060902070624 2 6 100 4095 5 DA110847314B537539F2A20681212A0B2ED264BF1F2595B817CC516D5AA4211585948B248F77277B11AB206738C71B5FB2FCC4041927B40B985282795A89EF66BDB111E1D07D790AC487DA5841B66FC407ED5DD8612703136422C442139C12040CE776FEB6C8B59B95408F31FB50073AD54B03F97113E61BE577E76D13AA971BA82CEE621C31C4770A7E076245A16689A9FE3E9190FB617FB330AA70AAC623B447D1858C24993D486C2B9A3C63FFCB3F230E7185F163C1EED434C24EE11EAC5B2369FEAF790523BD8BF7E8F9C87467ED6C89E5596974DCA6960E537259EA3AA587BF5198B26CE37638BC57012851903BB4CC0E2A28EC741EECB6220556EC5C118AE0142E5374AE2A3D1CEF165C09C0988A37877BCA6BBCAE28D52DA6701BF077307195C3618D4CAC58DDF64B6A8C2BF8E2FDCC0840973A8ED1F8413689BE05EA54AB6CD30464F94DD926D8CEC6B56704F534C6D8329A27ECAD9836721BC0C283E63CDA54FCEA851C0203E747BB02B75C92036928EFC201FFCBB747A2E093CCED157C3C3F74258D5607B6B8AA330DECCF42A73A6F81D300BAFCA921BAFF635DFC90824938F7454B258C1967FF90C1D828E028F9FA86AA7B287A87EC750EDCECEEEC223EAEA78511CB3C0130043950478737FDF6D56EA2B705D5E4C57701E955A9C862DBCAF36D0624D2F2C20616AA3E0478A4A722BBA577BC02578EE59553E03F |
| 165 | 20040228101703 2 6 100 4095 2 C7FE661FF2675517258B6E893FE81DFC29EDFB28FFE325C4F929BFAF5D0203DF5D75D966B0886A4197CC8F2EE339349DF88E73C54A315C402DF609DA61A237435167524F8EA37E5AB33E8A0C80E36DF4F6B9D6141958CC784CDDB6E2543038C9966D62AC2474786F2E2890E4935AD47BB005A6FC309817807EC9597B69858F1FBD6A1B28E897EFB6219F9FF83BEAFFD448C9F2F8C33CEA7C08242428FD75D218411E41523B688BF3D9311374E43D8963C821611BBBC91CA23968E60FB143FA0B36120657734D5C83C1C58A5A229CCDDC27875E51C358F0C8FEDDE4A11C50E0A154C80127B6FF92F496F7F2FA41D601A3EA88A3A53569AA3F3ABA5761757AC553CF57578800379C5F06082DD6088841D7BA48A58D1422B0DEC088279655C2D6380CF7097CD39565E9998785CBEB300AFFADEACA285201CBB27F48456EF7E49DE75380D0D1B4CCC28ADB8E12903473548D74A8847DAADC34315F157351C4CD507FF9B03CA6DD1C954BB75C9FD3C425FEFA76FC03FB346BE11E61B67A3AD374C1843ECA636CC7454249AB2A08B645DADCBFB48A470B1206ED20020FF0A0F5C2253187BBC2BC7F449AD58D35746E5A47B4A7BB404592C0A1F4E3BA34938C1E3C32464E1A52D3E722FA1165B72E8B438C11CFD0DB42A4081ED09F468A2E17C8D3F2BB689DC0CC831F889D7BAFC39D2A7F6C9A362E9BAE48B12FBACF34F9DFCBBC54FB | 165 | 20060902095300 2 6 100 4095 2 DA110847314B537539F2A20681212A0B2ED264BF1F2595B817CC516D5AA4211585948B248F77277B11AB206738C71B5FB2FCC4041927B40B985282795A89EF66BDB111E1D07D790AC487DA5841B66FC407ED5DD8612703136422C442139C12040CE776FEB6C8B59B95408F31FB50073AD54B03F97113E61BE577E76D13AA971BA82CEE621C31C4770A7E076245A16689A9FE3E9190FB617FB330AA70AAC623B447D1858C24993D486C2B9A3C63FFCB3F230E7185F163C1EED434C24EE11EAC5B2369FEAF790523BD8BF7E8F9C87467ED6C89E5596974DCA6960E537259EA3AA587BF5198B26CE37638BC57012851903BB4CC0E2A28EC741EECB6220556EC5C118AE0142E5374AE2A3D1CEF165C09C0988A37877BCA6BBCAE28D52DA6701BF077307195C3618D4CAC58DDF64B6A8C2BF8E2FDCC0840973A8ED1F8413689BE05EA54AB6CD30464F94DD926D8CEC6B56704F534C6D8329A27ECAD9836721BC0C283E63CDA54FCEA851C0203E747BB02B75C92036928EFC201FFCBB747A2E093CCED157C3C3F74258D5607B6B8AA330DECCF42A73A6F81D300BAFCA921BAFF635DFC90824938F7454B258C1967FF90C1D828E028F9FA86AA7B287A87EC750EDCECEEEC223EAEA78511CB3C0130043950478737FDF6D56EA2B705D5E4C57701E955A9C862DBCAF36D0624D2F2C20616AA3E0478A4A722BBA577BC02578EE595F6EC6B |
| 166 | 20040228192850 2 6 100 4095 2 C7FE661FF2675517258B6E893FE81DFC29EDFB28FFE325C4F929BFAF5D0203DF5D75D966B0886A4197CC8F2EE339349DF88E73C54A315C402DF609DA61A237435167524F8EA37E5AB33E8A0C80E36DF4F6B9D6141958CC784CDDB6E2543038C9966D62AC2474786F2E2890E4935AD47BB005A6FC309817807EC9597B69858F1FBD6A1B28E897EFB6219F9FF83BEAFFD448C9F2F8C33CEA7C08242428FD75D218411E41523B688BF3D9311374E43D8963C821611BBBC91CA23968E60FB143FA0B36120657734D5C83C1C58A5A229CCDDC27875E51C358F0C8FEDDE4A11C50E0A154C80127B6FF92F496F7F2FA41D601A3EA88A3A53569AA3F3ABA5761757AC553CF57578800379C5F06082DD6088841D7BA48A58D1422B0DEC088279655C2D6380CF7097CD39565E9998785CBEB300AFFADEACA285201CBB27F48456EF7E49DE75380D0D1B4CCC28ADB8E12903473548D74A8847DAADC34315F157351C4CD507FF9B03CA6DD1C954BB75C9FD3C425FEFA76FC03FB346BE11E61B67A3AD374C1843ECA636CC7454249AB2A08B645DADCBFB48A470B1206ED20020FF0A0F5C2253187BBC2BC7F449AD58D35746E5A47B4A7BB404592C0A1F4E3BA34938C1E3C32464E1A52D3E722FA1165B72E8B438C11CFD0DB42A4081ED09F468A2E17C8D3F2BB689DC0CC831F889D7BAFC39D2A7F6C9A362E9BAE48B12FBACF34F9DFCE191D13 | 166 | 20060902113306 2 6 100 4095 5 DA110847314B537539F2A20681212A0B2ED264BF1F2595B817CC516D5AA4211585948B248F77277B11AB206738C71B5FB2FCC4041927B40B985282795A89EF66BDB111E1D07D790AC487DA5841B66FC407ED5DD8612703136422C442139C12040CE776FEB6C8B59B95408F31FB50073AD54B03F97113E61BE577E76D13AA971BA82CEE621C31C4770A7E076245A16689A9FE3E9190FB617FB330AA70AAC623B447D1858C24993D486C2B9A3C63FFCB3F230E7185F163C1EED434C24EE11EAC5B2369FEAF790523BD8BF7E8F9C87467ED6C89E5596974DCA6960E537259EA3AA587BF5198B26CE37638BC57012851903BB4CC0E2A28EC741EECB6220556EC5C118AE0142E5374AE2A3D1CEF165C09C0988A37877BCA6BBCAE28D52DA6701BF077307195C3618D4CAC58DDF64B6A8C2BF8E2FDCC0840973A8ED1F8413689BE05EA54AB6CD30464F94DD926D8CEC6B56704F534C6D8329A27ECAD9836721BC0C283E63CDA54FCEA851C0203E747BB02B75C92036928EFC201FFCBB747A2E093CCED157C3C3F74258D5607B6B8AA330DECCF42A73A6F81D300BAFCA921BAFF635DFC90824938F7454B258C1967FF90C1D828E028F9FA86AA7B287A87EC750EDCECEEEC223EAEA78511CB3C0130043950478737FDF6D56EA2B705D5E4C57701E955A9C862DBCAF36D0624D2F2C20616AA3E0478A4A722BBA577BC02578EE596599BEF |
| 167 | 20040229084451 2 6 100 4095 2 C7FE661FF2675517258B6E893FE81DFC29EDFB28FFE325C4F929BFAF5D0203DF5D75D966B0886A4197CC8F2EE339349DF88E73C54A315C402DF609DA61A237435167524F8EA37E5AB33E8A0C80E36DF4F6B9D6141958CC784CDDB6E2543038C9966D62AC2474786F2E2890E4935AD47BB005A6FC309817807EC9597B69858F1FBD6A1B28E897EFB6219F9FF83BEAFFD448C9F2F8C33CEA7C08242428FD75D218411E41523B688BF3D9311374E43D8963C821611BBBC91CA23968E60FB143FA0B36120657734D5C83C1C58A5A229CCDDC27875E51C358F0C8FEDDE4A11C50E0A154C80127B6FF92F496F7F2FA41D601A3EA88A3A53569AA3F3ABA5761757AC553CF57578800379C5F06082DD6088841D7BA48A58D1422B0DEC088279655C2D6380CF7097CD39565E9998785CBEB300AFFADEACA285201CBB27F48456EF7E49DE75380D0D1B4CCC28ADB8E12903473548D74A8847DAADC34315F157351C4CD507FF9B03CA6DD1C954BB75C9FD3C425FEFA76FC03FB346BE11E61B67A3AD374C1843ECA636CC7454249AB2A08B645DADCBFB48A470B1206ED20020FF0A0F5C2253187BBC2BC7F449AD58D35746E5A47B4A7BB404592C0A1F4E3BA34938C1E3C32464E1A52D3E722FA1165B72E8B438C11CFD0DB42A4081ED09F468A2E17C8D3F2BB689DC0CC831F889D7BAFC39D2A7F6C9A362E9BAE48B12FBACF34F9DFD1804AF3 | 167 | 20060902142302 2 6 100 4095 2 DA110847314B537539F2A20681212A0B2ED264BF1F2595B817CC516D5AA4211585948B248F77277B11AB206738C71B5FB2FCC4041927B40B985282795A89EF66BDB111E1D07D790AC487DA5841B66FC407ED5DD8612703136422C442139C12040CE776FEB6C8B59B95408F31FB50073AD54B03F97113E61BE577E76D13AA971BA82CEE621C31C4770A7E076245A16689A9FE3E9190FB617FB330AA70AAC623B447D1858C24993D486C2B9A3C63FFCB3F230E7185F163C1EED434C24EE11EAC5B2369FEAF790523BD8BF7E8F9C87467ED6C89E5596974DCA6960E537259EA3AA587BF5198B26CE37638BC57012851903BB4CC0E2A28EC741EECB6220556EC5C118AE0142E5374AE2A3D1CEF165C09C0988A37877BCA6BBCAE28D52DA6701BF077307195C3618D4CAC58DDF64B6A8C2BF8E2FDCC0840973A8ED1F8413689BE05EA54AB6CD30464F94DD926D8CEC6B56704F534C6D8329A27ECAD9836721BC0C283E63CDA54FCEA851C0203E747BB02B75C92036928EFC201FFCBB747A2E093CCED157C3C3F74258D5607B6B8AA330DECCF42A73A6F81D300BAFCA921BAFF635DFC90824938F7454B258C1967FF90C1D828E028F9FA86AA7B287A87EC750EDCECEEEC223EAEA78511CB3C0130043950478737FDF6D56EA2B705D5E4C57701E955A9C862DBCAF36D0624D2F2C20616AA3E0478A4A722BBA577BC02578EE59703582B |
| 168 | 20040229164933 2 6 100 4095 5 C7FE661FF2675517258B6E893FE81DFC29EDFB28FFE325C4F929BFAF5D0203DF5D75D966B0886A4197CC8F2EE339349DF88E73C54A315C402DF609DA61A237435167524F8EA37E5AB33E8A0C80E36DF4F6B9D6141958CC784CDDB6E2543038C9966D62AC2474786F2E2890E4935AD47BB005A6FC309817807EC9597B69858F1FBD6A1B28E897EFB6219F9FF83BEAFFD448C9F2F8C33CEA7C08242428FD75D218411E41523B688BF3D9311374E43D8963C821611BBBC91CA23968E60FB143FA0B36120657734D5C83C1C58A5A229CCDDC27875E51C358F0C8FEDDE4A11C50E0A154C80127B6FF92F496F7F2FA41D601A3EA88A3A53569AA3F3ABA5761757AC553CF57578800379C5F06082DD6088841D7BA48A58D1422B0DEC088279655C2D6380CF7097CD39565E9998785CBEB300AFFADEACA285201CBB27F48456EF7E49DE75380D0D1B4CCC28ADB8E12903473548D74A8847DAADC34315F157351C4CD507FF9B03CA6DD1C954BB75C9FD3C425FEFA76FC03FB346BE11E61B67A3AD374C1843ECA636CC7454249AB2A08B645DADCBFB48A470B1206ED20020FF0A0F5C2253187BBC2BC7F449AD58D35746E5A47B4A7BB404592C0A1F4E3BA34938C1E3C32464E1A52D3E722FA1165B72E8B438C11CFD0DB42A4081ED09F468A2E17C8D3F2BB689DC0CC831F889D7BAFC39D2A7F6C9A362E9BAE48B12FBACF34F9DFD3887E07 | 168 | 20060902210839 2 6 100 4095 5 DA110847314B537539F2A20681212A0B2ED264BF1F2595B817CC516D5AA4211585948B248F77277B11AB206738C71B5FB2FCC4041927B40B985282795A89EF66BDB111E1D07D790AC487DA5841B66FC407ED5DD8612703136422C442139C12040CE776FEB6C8B59B95408F31FB50073AD54B03F97113E61BE577E76D13AA971BA82CEE621C31C4770A7E076245A16689A9FE3E9190FB617FB330AA70AAC623B447D1858C24993D486C2B9A3C63FFCB3F230E7185F163C1EED434C24EE11EAC5B2369FEAF790523BD8BF7E8F9C87467ED6C89E5596974DCA6960E537259EA3AA587BF5198B26CE37638BC57012851903BB4CC0E2A28EC741EECB6220556EC5C118AE0142E5374AE2A3D1CEF165C09C0988A37877BCA6BBCAE28D52DA6701BF077307195C3618D4CAC58DDF64B6A8C2BF8E2FDCC0840973A8ED1F8413689BE05EA54AB6CD30464F94DD926D8CEC6B56704F534C6D8329A27ECAD9836721BC0C283E63CDA54FCEA851C0203E747BB02B75C92036928EFC201FFCBB747A2E093CCED157C3C3F74258D5607B6B8AA330DECCF42A73A6F81D300BAFCA921BAFF635DFC90824938F7454B258C1967FF90C1D828E028F9FA86AA7B287A87EC750EDCECEEEC223EAEA78511CB3C0130043950478737FDF6D56EA2B705D5E4C57701E955A9C862DBCAF36D0624D2F2C20616AA3E0478A4A722BBA577BC02578EE598A695F7 |
| 169 | 20040229210220 2 6 100 4095 5 C7FE661FF2675517258B6E893FE81DFC29EDFB28FFE325C4F929BFAF5D0203DF5D75D966B0886A4197CC8F2EE339349DF88E73C54A315C402DF609DA61A237435167524F8EA37E5AB33E8A0C80E36DF4F6B9D6141958CC784CDDB6E2543038C9966D62AC2474786F2E2890E4935AD47BB005A6FC309817807EC9597B69858F1FBD6A1B28E897EFB6219F9FF83BEAFFD448C9F2F8C33CEA7C08242428FD75D218411E41523B688BF3D9311374E43D8963C821611BBBC91CA23968E60FB143FA0B36120657734D5C83C1C58A5A229CCDDC27875E51C358F0C8FEDDE4A11C50E0A154C80127B6FF92F496F7F2FA41D601A3EA88A3A53569AA3F3ABA5761757AC553CF57578800379C5F06082DD6088841D7BA48A58D1422B0DEC088279655C2D6380CF7097CD39565E9998785CBEB300AFFADEACA285201CBB27F48456EF7E49DE75380D0D1B4CCC28ADB8E12903473548D74A8847DAADC34315F157351C4CD507FF9B03CA6DD1C954BB75C9FD3C425FEFA76FC03FB346BE11E61B67A3AD374C1843ECA636CC7454249AB2A08B645DADCBFB48A470B1206ED20020FF0A0F5C2253187BBC2BC7F449AD58D35746E5A47B4A7BB404592C0A1F4E3BA34938C1E3C32464E1A52D3E722FA1165B72E8B438C11CFD0DB42A4081ED09F468A2E17C8D3F2BB689DC0CC831F889D7BAFC39D2A7F6C9A362E9BAE48B12FBACF34F9DFD49457B7 | 169 | 20060903073325 2 6 100 4095 2 DA110847314B537539F2A20681212A0B2ED264BF1F2595B817CC516D5AA4211585948B248F77277B11AB206738C71B5FB2FCC4041927B40B985282795A89EF66BDB111E1D07D790AC487DA5841B66FC407ED5DD8612703136422C442139C12040CE776FEB6C8B59B95408F31FB50073AD54B03F97113E61BE577E76D13AA971BA82CEE621C31C4770A7E076245A16689A9FE3E9190FB617FB330AA70AAC623B447D1858C24993D486C2B9A3C63FFCB3F230E7185F163C1EED434C24EE11EAC5B2369FEAF790523BD8BF7E8F9C87467ED6C89E5596974DCA6960E537259EA3AA587BF5198B26CE37638BC57012851903BB4CC0E2A28EC741EECB6220556EC5C118AE0142E5374AE2A3D1CEF165C09C0988A37877BCA6BBCAE28D52DA6701BF077307195C3618D4CAC58DDF64B6A8C2BF8E2FDCC0840973A8ED1F8413689BE05EA54AB6CD30464F94DD926D8CEC6B56704F534C6D8329A27ECAD9836721BC0C283E63CDA54FCEA851C0203E747BB02B75C92036928EFC201FFCBB747A2E093CCED157C3C3F74258D5607B6B8AA330DECCF42A73A6F81D300BAFCA921BAFF635DFC90824938F7454B258C1967FF90C1D828E028F9FA86AA7B287A87EC750EDCECEEEC223EAEA78511CB3C0130043950478737FDF6D56EA2B705D5E4C57701E955A9C862DBCAF36D0624D2F2C20616AA3E0478A4A722BBA577BC02578EE59B315E9B |
| 170 | 20040229222958 2 6 100 4095 2 C7FE661FF2675517258B6E893FE81DFC29EDFB28FFE325C4F929BFAF5D0203DF5D75D966B0886A4197CC8F2EE339349DF88E73C54A315C402DF609DA61A237435167524F8EA37E5AB33E8A0C80E36DF4F6B9D6141958CC784CDDB6E2543038C9966D62AC2474786F2E2890E4935AD47BB005A6FC309817807EC9597B69858F1FBD6A1B28E897EFB6219F9FF83BEAFFD448C9F2F8C33CEA7C08242428FD75D218411E41523B688BF3D9311374E43D8963C821611BBBC91CA23968E60FB143FA0B36120657734D5C83C1C58A5A229CCDDC27875E51C358F0C8FEDDE4A11C50E0A154C80127B6FF92F496F7F2FA41D601A3EA88A3A53569AA3F3ABA5761757AC553CF57578800379C5F06082DD6088841D7BA48A58D1422B0DEC088279655C2D6380CF7097CD39565E9998785CBEB300AFFADEACA285201CBB27F48456EF7E49DE75380D0D1B4CCC28ADB8E12903473548D74A8847DAADC34315F157351C4CD507FF9B03CA6DD1C954BB75C9FD3C425FEFA76FC03FB346BE11E61B67A3AD374C1843ECA636CC7454249AB2A08B645DADCBFB48A470B1206ED20020FF0A0F5C2253187BBC2BC7F449AD58D35746E5A47B4A7BB404592C0A1F4E3BA34938C1E3C32464E1A52D3E722FA1165B72E8B438C11CFD0DB42A4081ED09F468A2E17C8D3F2BB689DC0CC831F889D7BAFC39D2A7F6C9A362E9BAE48B12FBACF34F9DFD4EA3223 | 170 | 20060903095626 2 6 100 4095 2 DA110847314B537539F2A20681212A0B2ED264BF1F2595B817CC516D5AA4211585948B248F77277B11AB206738C71B5FB2FCC4041927B40B985282795A89EF66BDB111E1D07D790AC487DA5841B66FC407ED5DD8612703136422C442139C12040CE776FEB6C8B59B95408F31FB50073AD54B03F97113E61BE577E76D13AA971BA82CEE621C31C4770A7E076245A16689A9FE3E9190FB617FB330AA70AAC623B447D1858C24993D486C2B9A3C63FFCB3F230E7185F163C1EED434C24EE11EAC5B2369FEAF790523BD8BF7E8F9C87467ED6C89E5596974DCA6960E537259EA3AA587BF5198B26CE37638BC57012851903BB4CC0E2A28EC741EECB6220556EC5C118AE0142E5374AE2A3D1CEF165C09C0988A37877BCA6BBCAE28D52DA6701BF077307195C3618D4CAC58DDF64B6A8C2BF8E2FDCC0840973A8ED1F8413689BE05EA54AB6CD30464F94DD926D8CEC6B56704F534C6D8329A27ECAD9836721BC0C283E63CDA54FCEA851C0203E747BB02B75C92036928EFC201FFCBB747A2E093CCED157C3C3F74258D5607B6B8AA330DECCF42A73A6F81D300BAFCA921BAFF635DFC90824938F7454B258C1967FF90C1D828E028F9FA86AA7B287A87EC750EDCECEEEC223EAEA78511CB3C0130043950478737FDF6D56EA2B705D5E4C57701E955A9C862DBCAF36D0624D2F2C20616AA3E0478A4A722BBA577BC02578EE59BBD7153 |
| 171 | 20040301003324 2 6 100 4095 2 C7FE661FF2675517258B6E893FE81DFC29EDFB28FFE325C4F929BFAF5D0203DF5D75D966B0886A4197CC8F2EE339349DF88E73C54A315C402DF609DA61A237435167524F8EA37E5AB33E8A0C80E36DF4F6B9D6141958CC784CDDB6E2543038C9966D62AC2474786F2E2890E4935AD47BB005A6FC309817807EC9597B69858F1FBD6A1B28E897EFB6219F9FF83BEAFFD448C9F2F8C33CEA7C08242428FD75D218411E41523B688BF3D9311374E43D8963C821611BBBC91CA23968E60FB143FA0B36120657734D5C83C1C58A5A229CCDDC27875E51C358F0C8FEDDE4A11C50E0A154C80127B6FF92F496F7F2FA41D601A3EA88A3A53569AA3F3ABA5761757AC553CF57578800379C5F06082DD6088841D7BA48A58D1422B0DEC088279655C2D6380CF7097CD39565E9998785CBEB300AFFADEACA285201CBB27F48456EF7E49DE75380D0D1B4CCC28ADB8E12903473548D74A8847DAADC34315F157351C4CD507FF9B03CA6DD1C954BB75C9FD3C425FEFA76FC03FB346BE11E61B67A3AD374C1843ECA636CC7454249AB2A08B645DADCBFB48A470B1206ED20020FF0A0F5C2253187BBC2BC7F449AD58D35746E5A47B4A7BB404592C0A1F4E3BA34938C1E3C32464E1A52D3E722FA1165B72E8B438C11CFD0DB42A4081ED09F468A2E17C8D3F2BB689DC0CC831F889D7BAFC39D2A7F6C9A362E9BAE48B12FBACF34F9DFD566C79B | 171 | 20060903162601 2 6 100 4095 2 DA110847314B537539F2A20681212A0B2ED264BF1F2595B817CC516D5AA4211585948B248F77277B11AB206738C71B5FB2FCC4041927B40B985282795A89EF66BDB111E1D07D790AC487DA5841B66FC407ED5DD8612703136422C442139C12040CE776FEB6C8B59B95408F31FB50073AD54B03F97113E61BE577E76D13AA971BA82CEE621C31C4770A7E076245A16689A9FE3E9190FB617FB330AA70AAC623B447D1858C24993D486C2B9A3C63FFCB3F230E7185F163C1EED434C24EE11EAC5B2369FEAF790523BD8BF7E8F9C87467ED6C89E5596974DCA6960E537259EA3AA587BF5198B26CE37638BC57012851903BB4CC0E2A28EC741EECB6220556EC5C118AE0142E5374AE2A3D1CEF165C09C0988A37877BCA6BBCAE28D52DA6701BF077307195C3618D4CAC58DDF64B6A8C2BF8E2FDCC0840973A8ED1F8413689BE05EA54AB6CD30464F94DD926D8CEC6B56704F534C6D8329A27ECAD9836721BC0C283E63CDA54FCEA851C0203E747BB02B75C92036928EFC201FFCBB747A2E093CCED157C3C3F74258D5607B6B8AA330DECCF42A73A6F81D300BAFCA921BAFF635DFC90824938F7454B258C1967FF90C1D828E028F9FA86AA7B287A87EC750EDCECEEEC223EAEA78511CB3C0130043950478737FDF6D56EA2B705D5E4C57701E955A9C862DBCAF36D0624D2F2C20616AA3E0478A4A722BBA577BC02578EE59D48AEE3 |
| 172 | 20040301030228 2 6 100 4095 5 C7FE661FF2675517258B6E893FE81DFC29EDFB28FFE325C4F929BFAF5D0203DF5D75D966B0886A4197CC8F2EE339349DF88E73C54A315C402DF609DA61A237435167524F8EA37E5AB33E8A0C80E36DF4F6B9D6141958CC784CDDB6E2543038C9966D62AC2474786F2E2890E4935AD47BB005A6FC309817807EC9597B69858F1FBD6A1B28E897EFB6219F9FF83BEAFFD448C9F2F8C33CEA7C08242428FD75D218411E41523B688BF3D9311374E43D8963C821611BBBC91CA23968E60FB143FA0B36120657734D5C83C1C58A5A229CCDDC27875E51C358F0C8FEDDE4A11C50E0A154C80127B6FF92F496F7F2FA41D601A3EA88A3A53569AA3F3ABA5761757AC553CF57578800379C5F06082DD6088841D7BA48A58D1422B0DEC088279655C2D6380CF7097CD39565E9998785CBEB300AFFADEACA285201CBB27F48456EF7E49DE75380D0D1B4CCC28ADB8E12903473548D74A8847DAADC34315F157351C4CD507FF9B03CA6DD1C954BB75C9FD3C425FEFA76FC03FB346BE11E61B67A3AD374C1843ECA636CC7454249AB2A08B645DADCBFB48A470B1206ED20020FF0A0F5C2253187BBC2BC7F449AD58D35746E5A47B4A7BB404592C0A1F4E3BA34938C1E3C32464E1A52D3E722FA1165B72E8B438C11CFD0DB42A4081ED09F468A2E17C8D3F2BB689DC0CC831F889D7BAFC39D2A7F6C9A362E9BAE48B12FBACF34F9DFD6032D8F | ||
| 173 | 20040301040042 2 6 100 4095 2 C7FE661FF2675517258B6E893FE81DFC29EDFB28FFE325C4F929BFAF5D0203DF5D75D966B0886A4197CC8F2EE339349DF88E73C54A315C402DF609DA61A237435167524F8EA37E5AB33E8A0C80E36DF4F6B9D6141958CC784CDDB6E2543038C9966D62AC2474786F2E2890E4935AD47BB005A6FC309817807EC9597B69858F1FBD6A1B28E897EFB6219F9FF83BEAFFD448C9F2F8C33CEA7C08242428FD75D218411E41523B688BF3D9311374E43D8963C821611BBBC91CA23968E60FB143FA0B36120657734D5C83C1C58A5A229CCDDC27875E51C358F0C8FEDDE4A11C50E0A154C80127B6FF92F496F7F2FA41D601A3EA88A3A53569AA3F3ABA5761757AC553CF57578800379C5F06082DD6088841D7BA48A58D1422B0DEC088279655C2D6380CF7097CD39565E9998785CBEB300AFFADEACA285201CBB27F48456EF7E49DE75380D0D1B4CCC28ADB8E12903473548D74A8847DAADC34315F157351C4CD507FF9B03CA6DD1C954BB75C9FD3C425FEFA76FC03FB346BE11E61B67A3AD374C1843ECA636CC7454249AB2A08B645DADCBFB48A470B1206ED20020FF0A0F5C2253187BBC2BC7F449AD58D35746E5A47B4A7BB404592C0A1F4E3BA34938C1E3C32464E1A52D3E722FA1165B72E8B438C11CFD0DB42A4081ED09F468A2E17C8D3F2BB689DC0CC831F889D7BAFC39D2A7F6C9A362E9BAE48B12FBACF34F9DFD63B1113 | ||
| 174 | 20040301073501 2 6 100 4095 5 C7FE661FF2675517258B6E893FE81DFC29EDFB28FFE325C4F929BFAF5D0203DF5D75D966B0886A4197CC8F2EE339349DF88E73C54A315C402DF609DA61A237435167524F8EA37E5AB33E8A0C80E36DF4F6B9D6141958CC784CDDB6E2543038C9966D62AC2474786F2E2890E4935AD47BB005A6FC309817807EC9597B69858F1FBD6A1B28E897EFB6219F9FF83BEAFFD448C9F2F8C33CEA7C08242428FD75D218411E41523B688BF3D9311374E43D8963C821611BBBC91CA23968E60FB143FA0B36120657734D5C83C1C58A5A229CCDDC27875E51C358F0C8FEDDE4A11C50E0A154C80127B6FF92F496F7F2FA41D601A3EA88A3A53569AA3F3ABA5761757AC553CF57578800379C5F06082DD6088841D7BA48A58D1422B0DEC088279655C2D6380CF7097CD39565E9998785CBEB300AFFADEACA285201CBB27F48456EF7E49DE75380D0D1B4CCC28ADB8E12903473548D74A8847DAADC34315F157351C4CD507FF9B03CA6DD1C954BB75C9FD3C425FEFA76FC03FB346BE11E61B67A3AD374C1843ECA636CC7454249AB2A08B645DADCBFB48A470B1206ED20020FF0A0F5C2253187BBC2BC7F449AD58D35746E5A47B4A7BB404592C0A1F4E3BA34938C1E3C32464E1A52D3E722FA1165B72E8B438C11CFD0DB42A4081ED09F468A2E17C8D3F2BB689DC0CC831F889D7BAFC39D2A7F6C9A362E9BAE48B12FBACF34F9DFD71C4A67 | ||
| 175 | 20040301133631 2 6 100 4095 2 C7FE661FF2675517258B6E893FE81DFC29EDFB28FFE325C4F929BFAF5D0203DF5D75D966B0886A4197CC8F2EE339349DF88E73C54A315C402DF609DA61A237435167524F8EA37E5AB33E8A0C80E36DF4F6B9D6141958CC784CDDB6E2543038C9966D62AC2474786F2E2890E4935AD47BB005A6FC309817807EC9597B69858F1FBD6A1B28E897EFB6219F9FF83BEAFFD448C9F2F8C33CEA7C08242428FD75D218411E41523B688BF3D9311374E43D8963C821611BBBC91CA23968E60FB143FA0B36120657734D5C83C1C58A5A229CCDDC27875E51C358F0C8FEDDE4A11C50E0A154C80127B6FF92F496F7F2FA41D601A3EA88A3A53569AA3F3ABA5761757AC553CF57578800379C5F06082DD6088841D7BA48A58D1422B0DEC088279655C2D6380CF7097CD39565E9998785CBEB300AFFADEACA285201CBB27F48456EF7E49DE75380D0D1B4CCC28ADB8E12903473548D74A8847DAADC34315F157351C4CD507FF9B03CA6DD1C954BB75C9FD3C425FEFA76FC03FB346BE11E61B67A3AD374C1843ECA636CC7454249AB2A08B645DADCBFB48A470B1206ED20020FF0A0F5C2253187BBC2BC7F449AD58D35746E5A47B4A7BB404592C0A1F4E3BA34938C1E3C32464E1A52D3E722FA1165B72E8B438C11CFD0DB42A4081ED09F468A2E17C8D3F2BB689DC0CC831F889D7BAFC39D2A7F6C9A362E9BAE48B12FBACF34F9DFD8A0BBD3 | ||
| 176 | 20040301165652 2 6 100 4095 2 C7FE661FF2675517258B6E893FE81DFC29EDFB28FFE325C4F929BFAF5D0203DF5D75D966B0886A4197CC8F2EE339349DF88E73C54A315C402DF609DA61A237435167524F8EA37E5AB33E8A0C80E36DF4F6B9D6141958CC784CDDB6E2543038C9966D62AC2474786F2E2890E4935AD47BB005A6FC309817807EC9597B69858F1FBD6A1B28E897EFB6219F9FF83BEAFFD448C9F2F8C33CEA7C08242428FD75D218411E41523B688BF3D9311374E43D8963C821611BBBC91CA23968E60FB143FA0B36120657734D5C83C1C58A5A229CCDDC27875E51C358F0C8FEDDE4A11C50E0A154C80127B6FF92F496F7F2FA41D601A3EA88A3A53569AA3F3ABA5761757AC553CF57578800379C5F06082DD6088841D7BA48A58D1422B0DEC088279655C2D6380CF7097CD39565E9998785CBEB300AFFADEACA285201CBB27F48456EF7E49DE75380D0D1B4CCC28ADB8E12903473548D74A8847DAADC34315F157351C4CD507FF9B03CA6DD1C954BB75C9FD3C425FEFA76FC03FB346BE11E61B67A3AD374C1843ECA636CC7454249AB2A08B645DADCBFB48A470B1206ED20020FF0A0F5C2253187BBC2BC7F449AD58D35746E5A47B4A7BB404592C0A1F4E3BA34938C1E3C32464E1A52D3E722FA1165B72E8B438C11CFD0DB42A4081ED09F468A2E17C8D3F2BB689DC0CC831F889D7BAFC39D2A7F6C9A362E9BAE48B12FBACF34F9DFD96E4053 | ||
| 177 | 20040301184021 2 6 100 4095 2 C7FE661FF2675517258B6E893FE81DFC29EDFB28FFE325C4F929BFAF5D0203DF5D75D966B0886A4197CC8F2EE339349DF88E73C54A315C402DF609DA61A237435167524F8EA37E5AB33E8A0C80E36DF4F6B9D6141958CC784CDDB6E2543038C9966D62AC2474786F2E2890E4935AD47BB005A6FC309817807EC9597B69858F1FBD6A1B28E897EFB6219F9FF83BEAFFD448C9F2F8C33CEA7C08242428FD75D218411E41523B688BF3D9311374E43D8963C821611BBBC91CA23968E60FB143FA0B36120657734D5C83C1C58A5A229CCDDC27875E51C358F0C8FEDDE4A11C50E0A154C80127B6FF92F496F7F2FA41D601A3EA88A3A53569AA3F3ABA5761757AC553CF57578800379C5F06082DD6088841D7BA48A58D1422B0DEC088279655C2D6380CF7097CD39565E9998785CBEB300AFFADEACA285201CBB27F48456EF7E49DE75380D0D1B4CCC28ADB8E12903473548D74A8847DAADC34315F157351C4CD507FF9B03CA6DD1C954BB75C9FD3C425FEFA76FC03FB346BE11E61B67A3AD374C1843ECA636CC7454249AB2A08B645DADCBFB48A470B1206ED20020FF0A0F5C2253187BBC2BC7F449AD58D35746E5A47B4A7BB404592C0A1F4E3BA34938C1E3C32464E1A52D3E722FA1165B72E8B438C11CFD0DB42A4081ED09F468A2E17C8D3F2BB689DC0CC831F889D7BAFC39D2A7F6C9A362E9BAE48B12FBACF34F9DFD9D662FB | ||
| 178 | 20040302045553 2 6 100 4095 2 C7FE661FF2675517258B6E893FE81DFC29EDFB28FFE325C4F929BFAF5D0203DF5D75D966B0886A4197CC8F2EE339349DF88E73C54A315C402DF609DA61A237435167524F8EA37E5AB33E8A0C80E36DF4F6B9D6141958CC784CDDB6E2543038C9966D62AC2474786F2E2890E4935AD47BB005A6FC309817807EC9597B69858F1FBD6A1B28E897EFB6219F9FF83BEAFFD448C9F2F8C33CEA7C08242428FD75D218411E41523B688BF3D9311374E43D8963C821611BBBC91CA23968E60FB143FA0B36120657734D5C83C1C58A5A229CCDDC27875E51C358F0C8FEDDE4A11C50E0A154C80127B6FF92F496F7F2FA41D601A3EA88A3A53569AA3F3ABA5761757AC553CF57578800379C5F06082DD6088841D7BA48A58D1422B0DEC088279655C2D6380CF7097CD39565E9998785CBEB300AFFADEACA285201CBB27F48456EF7E49DE75380D0D1B4CCC28ADB8E12903473548D74A8847DAADC34315F157351C4CD507FF9B03CA6DD1C954BB75C9FD3C425FEFA76FC03FB346BE11E61B67A3AD374C1843ECA636CC7454249AB2A08B645DADCBFB48A470B1206ED20020FF0A0F5C2253187BBC2BC7F449AD58D35746E5A47B4A7BB404592C0A1F4E3BA34938C1E3C32464E1A52D3E722FA1165B72E8B438C11CFD0DB42A4081ED09F468A2E17C8D3F2BB689DC0CC831F889D7BAFC39D2A7F6C9A362E9BAE48B12FBACF34F9DFDC5FE8E3 | ||
| 179 | 20040302112648 2 6 100 4095 2 C7FE661FF2675517258B6E893FE81DFC29EDFB28FFE325C4F929BFAF5D0203DF5D75D966B0886A4197CC8F2EE339349DF88E73C54A315C402DF609DA61A237435167524F8EA37E5AB33E8A0C80E36DF4F6B9D6141958CC784CDDB6E2543038C9966D62AC2474786F2E2890E4935AD47BB005A6FC309817807EC9597B69858F1FBD6A1B28E897EFB6219F9FF83BEAFFD448C9F2F8C33CEA7C08242428FD75D218411E41523B688BF3D9311374E43D8963C821611BBBC91CA23968E60FB143FA0B36120657734D5C83C1C58A5A229CCDDC27875E51C358F0C8FEDDE4A11C50E0A154C80127B6FF92F496F7F2FA41D601A3EA88A3A53569AA3F3ABA5761757AC553CF57578800379C5F06082DD6088841D7BA48A58D1422B0DEC088279655C2D6380CF7097CD39565E9998785CBEB300AFFADEACA285201CBB27F48456EF7E49DE75380D0D1B4CCC28ADB8E12903473548D74A8847DAADC34315F157351C4CD507FF9B03CA6DD1C954BB75C9FD3C425FEFA76FC03FB346BE11E61B67A3AD374C1843ECA636CC7454249AB2A08B645DADCBFB48A470B1206ED20020FF0A0F5C2253187BBC2BC7F449AD58D35746E5A47B4A7BB404592C0A1F4E3BA34938C1E3C32464E1A52D3E722FA1165B72E8B438C11CFD0DB42A4081ED09F468A2E17C8D3F2BB689DC0CC831F889D7BAFC39D2A7F6C9A362E9BAE48B12FBACF34F9DFDDFE9D13 | ||
| 180 | 20040302120026 2 6 100 4095 2 C7FE661FF2675517258B6E893FE81DFC29EDFB28FFE325C4F929BFAF5D0203DF5D75D966B0886A4197CC8F2EE339349DF88E73C54A315C402DF609DA61A237435167524F8EA37E5AB33E8A0C80E36DF4F6B9D6141958CC784CDDB6E2543038C9966D62AC2474786F2E2890E4935AD47BB005A6FC309817807EC9597B69858F1FBD6A1B28E897EFB6219F9FF83BEAFFD448C9F2F8C33CEA7C08242428FD75D218411E41523B688BF3D9311374E43D8963C821611BBBC91CA23968E60FB143FA0B36120657734D5C83C1C58A5A229CCDDC27875E51C358F0C8FEDDE4A11C50E0A154C80127B6FF92F496F7F2FA41D601A3EA88A3A53569AA3F3ABA5761757AC553CF57578800379C5F06082DD6088841D7BA48A58D1422B0DEC088279655C2D6380CF7097CD39565E9998785CBEB300AFFADEACA285201CBB27F48456EF7E49DE75380D0D1B4CCC28ADB8E12903473548D74A8847DAADC34315F157351C4CD507FF9B03CA6DD1C954BB75C9FD3C425FEFA76FC03FB346BE11E61B67A3AD374C1843ECA636CC7454249AB2A08B645DADCBFB48A470B1206ED20020FF0A0F5C2253187BBC2BC7F449AD58D35746E5A47B4A7BB404592C0A1F4E3BA34938C1E3C32464E1A52D3E722FA1165B72E8B438C11CFD0DB42A4081ED09F468A2E17C8D3F2BB689DC0CC831F889D7BAFC39D2A7F6C9A362E9BAE48B12FBACF34F9DFDE1A5AD3 | ||
| 181 | 20040302130757 2 6 100 4095 2 C7FE661FF2675517258B6E893FE81DFC29EDFB28FFE325C4F929BFAF5D0203DF5D75D966B0886A4197CC8F2EE339349DF88E73C54A315C402DF609DA61A237435167524F8EA37E5AB33E8A0C80E36DF4F6B9D6141958CC784CDDB6E2543038C9966D62AC2474786F2E2890E4935AD47BB005A6FC309817807EC9597B69858F1FBD6A1B28E897EFB6219F9FF83BEAFFD448C9F2F8C33CEA7C08242428FD75D218411E41523B688BF3D9311374E43D8963C821611BBBC91CA23968E60FB143FA0B36120657734D5C83C1C58A5A229CCDDC27875E51C358F0C8FEDDE4A11C50E0A154C80127B6FF92F496F7F2FA41D601A3EA88A3A53569AA3F3ABA5761757AC553CF57578800379C5F06082DD6088841D7BA48A58D1422B0DEC088279655C2D6380CF7097CD39565E9998785CBEB300AFFADEACA285201CBB27F48456EF7E49DE75380D0D1B4CCC28ADB8E12903473548D74A8847DAADC34315F157351C4CD507FF9B03CA6DD1C954BB75C9FD3C425FEFA76FC03FB346BE11E61B67A3AD374C1843ECA636CC7454249AB2A08B645DADCBFB48A470B1206ED20020FF0A0F5C2253187BBC2BC7F449AD58D35746E5A47B4A7BB404592C0A1F4E3BA34938C1E3C32464E1A52D3E722FA1165B72E8B438C11CFD0DB42A4081ED09F468A2E17C8D3F2BB689DC0CC831F889D7BAFC39D2A7F6C9A362E9BAE48B12FBACF34F9DFDE5E4073 | ||
| 182 | 20040302142004 2 6 100 4095 2 C7FE661FF2675517258B6E893FE81DFC29EDFB28FFE325C4F929BFAF5D0203DF5D75D966B0886A4197CC8F2EE339349DF88E73C54A315C402DF609DA61A237435167524F8EA37E5AB33E8A0C80E36DF4F6B9D6141958CC784CDDB6E2543038C9966D62AC2474786F2E2890E4935AD47BB005A6FC309817807EC9597B69858F1FBD6A1B28E897EFB6219F9FF83BEAFFD448C9F2F8C33CEA7C08242428FD75D218411E41523B688BF3D9311374E43D8963C821611BBBC91CA23968E60FB143FA0B36120657734D5C83C1C58A5A229CCDDC27875E51C358F0C8FEDDE4A11C50E0A154C80127B6FF92F496F7F2FA41D601A3EA88A3A53569AA3F3ABA5761757AC553CF57578800379C5F06082DD6088841D7BA48A58D1422B0DEC088279655C2D6380CF7097CD39565E9998785CBEB300AFFADEACA285201CBB27F48456EF7E49DE75380D0D1B4CCC28ADB8E12903473548D74A8847DAADC34315F157351C4CD507FF9B03CA6DD1C954BB75C9FD3C425FEFA76FC03FB346BE11E61B67A3AD374C1843ECA636CC7454249AB2A08B645DADCBFB48A470B1206ED20020FF0A0F5C2253187BBC2BC7F449AD58D35746E5A47B4A7BB404592C0A1F4E3BA34938C1E3C32464E1A52D3E722FA1165B72E8B438C11CFD0DB42A4081ED09F468A2E17C8D3F2BB689DC0CC831F889D7BAFC39D2A7F6C9A362E9BAE48B12FBACF34F9DFDEA4AA9B | ||
| 183 | 20040302145603 2 6 100 4095 2 C7FE661FF2675517258B6E893FE81DFC29EDFB28FFE325C4F929BFAF5D0203DF5D75D966B0886A4197CC8F2EE339349DF88E73C54A315C402DF609DA61A237435167524F8EA37E5AB33E8A0C80E36DF4F6B9D6141958CC784CDDB6E2543038C9966D62AC2474786F2E2890E4935AD47BB005A6FC309817807EC9597B69858F1FBD6A1B28E897EFB6219F9FF83BEAFFD448C9F2F8C33CEA7C08242428FD75D218411E41523B688BF3D9311374E43D8963C821611BBBC91CA23968E60FB143FA0B36120657734D5C83C1C58A5A229CCDDC27875E51C358F0C8FEDDE4A11C50E0A154C80127B6FF92F496F7F2FA41D601A3EA88A3A53569AA3F3ABA5761757AC553CF57578800379C5F06082DD6088841D7BA48A58D1422B0DEC088279655C2D6380CF7097CD39565E9998785CBEB300AFFADEACA285201CBB27F48456EF7E49DE75380D0D1B4CCC28ADB8E12903473548D74A8847DAADC34315F157351C4CD507FF9B03CA6DD1C954BB75C9FD3C425FEFA76FC03FB346BE11E61B67A3AD374C1843ECA636CC7454249AB2A08B645DADCBFB48A470B1206ED20020FF0A0F5C2253187BBC2BC7F449AD58D35746E5A47B4A7BB404592C0A1F4E3BA34938C1E3C32464E1A52D3E722FA1165B72E8B438C11CFD0DB42A4081ED09F468A2E17C8D3F2BB689DC0CC831F889D7BAFC39D2A7F6C9A362E9BAE48B12FBACF34F9DFDEC2C32B | ||
| 184 | 20040302212946 2 6 100 4095 5 C7FE661FF2675517258B6E893FE81DFC29EDFB28FFE325C4F929BFAF5D0203DF5D75D966B0886A4197CC8F2EE339349DF88E73C54A315C402DF609DA61A237435167524F8EA37E5AB33E8A0C80E36DF4F6B9D6141958CC784CDDB6E2543038C9966D62AC2474786F2E2890E4935AD47BB005A6FC309817807EC9597B69858F1FBD6A1B28E897EFB6219F9FF83BEAFFD448C9F2F8C33CEA7C08242428FD75D218411E41523B688BF3D9311374E43D8963C821611BBBC91CA23968E60FB143FA0B36120657734D5C83C1C58A5A229CCDDC27875E51C358F0C8FEDDE4A11C50E0A154C80127B6FF92F496F7F2FA41D601A3EA88A3A53569AA3F3ABA5761757AC553CF57578800379C5F06082DD6088841D7BA48A58D1422B0DEC088279655C2D6380CF7097CD39565E9998785CBEB300AFFADEACA285201CBB27F48456EF7E49DE75380D0D1B4CCC28ADB8E12903473548D74A8847DAADC34315F157351C4CD507FF9B03CA6DD1C954BB75C9FD3C425FEFA76FC03FB346BE11E61B67A3AD374C1843ECA636CC7454249AB2A08B645DADCBFB48A470B1206ED20020FF0A0F5C2253187BBC2BC7F449AD58D35746E5A47B4A7BB404592C0A1F4E3BA34938C1E3C32464E1A52D3E722FA1165B72E8B438C11CFD0DB42A4081ED09F468A2E17C8D3F2BB689DC0CC831F889D7BAFC39D2A7F6C9A362E9BAE48B12FBACF34F9DFE0652EC7 | ||
| 185 | 20040303003544 2 6 100 4095 2 C7FE661FF2675517258B6E893FE81DFC29EDFB28FFE325C4F929BFAF5D0203DF5D75D966B0886A4197CC8F2EE339349DF88E73C54A315C402DF609DA61A237435167524F8EA37E5AB33E8A0C80E36DF4F6B9D6141958CC784CDDB6E2543038C9966D62AC2474786F2E2890E4935AD47BB005A6FC309817807EC9597B69858F1FBD6A1B28E897EFB6219F9FF83BEAFFD448C9F2F8C33CEA7C08242428FD75D218411E41523B688BF3D9311374E43D8963C821611BBBC91CA23968E60FB143FA0B36120657734D5C83C1C58A5A229CCDDC27875E51C358F0C8FEDDE4A11C50E0A154C80127B6FF92F496F7F2FA41D601A3EA88A3A53569AA3F3ABA5761757AC553CF57578800379C5F06082DD6088841D7BA48A58D1422B0DEC088279655C2D6380CF7097CD39565E9998785CBEB300AFFADEACA285201CBB27F48456EF7E49DE75380D0D1B4CCC28ADB8E12903473548D74A8847DAADC34315F157351C4CD507FF9B03CA6DD1C954BB75C9FD3C425FEFA76FC03FB346BE11E61B67A3AD374C1843ECA636CC7454249AB2A08B645DADCBFB48A470B1206ED20020FF0A0F5C2253187BBC2BC7F449AD58D35746E5A47B4A7BB404592C0A1F4E3BA34938C1E3C32464E1A52D3E722FA1165B72E8B438C11CFD0DB42A4081ED09F468A2E17C8D3F2BB689DC0CC831F889D7BAFC39D2A7F6C9A362E9BAE48B12FBACF34F9DFE127CF63 | ||
| 186 | 20040303072925 2 6 100 4095 2 C7FE661FF2675517258B6E893FE81DFC29EDFB28FFE325C4F929BFAF5D0203DF5D75D966B0886A4197CC8F2EE339349DF88E73C54A315C402DF609DA61A237435167524F8EA37E5AB33E8A0C80E36DF4F6B9D6141958CC784CDDB6E2543038C9966D62AC2474786F2E2890E4935AD47BB005A6FC309817807EC9597B69858F1FBD6A1B28E897EFB6219F9FF83BEAFFD448C9F2F8C33CEA7C08242428FD75D218411E41523B688BF3D9311374E43D8963C821611BBBC91CA23968E60FB143FA0B36120657734D5C83C1C58A5A229CCDDC27875E51C358F0C8FEDDE4A11C50E0A154C80127B6FF92F496F7F2FA41D601A3EA88A3A53569AA3F3ABA5761757AC553CF57578800379C5F06082DD6088841D7BA48A58D1422B0DEC088279655C2D6380CF7097CD39565E9998785CBEB300AFFADEACA285201CBB27F48456EF7E49DE75380D0D1B4CCC28ADB8E12903473548D74A8847DAADC34315F157351C4CD507FF9B03CA6DD1C954BB75C9FD3C425FEFA76FC03FB346BE11E61B67A3AD374C1843ECA636CC7454249AB2A08B645DADCBFB48A470B1206ED20020FF0A0F5C2253187BBC2BC7F449AD58D35746E5A47B4A7BB404592C0A1F4E3BA34938C1E3C32464E1A52D3E722FA1165B72E8B438C11CFD0DB42A4081ED09F468A2E17C8D3F2BB689DC0CC831F889D7BAFC39D2A7F6C9A362E9BAE48B12FBACF34F9DFE2D793F3 | ||
| 187 | 20040305011518 2 6 100 6143 2 E95A4131F86234D27EE1E51791599559EEDB618912E4FE36B81B80CDA4D497959DBFAEE929317A66BE64A328BAB6183EA5A5CBB3581490B4B613B225ADD00EFD38540356E0F4716229CDDB260283AF044FDAF1EF9248BB0CE9031C117CF15D3259B3E7B0301CA1AAC91AFA7A57CCDEED2DA4EFC2DBC7A9FC53BB4D3CB2D57D209D5DDEF25DE14F8226404296BD504EC14F6340F0AA2A1A943B9552C4B91D3EB48C08A13671C36EE5042857625DD2CB58965C0975EB775057FF82BC2B8B69D0BF26E2F80115B3E1A984D1D73D9D02AD69C3A1AF90EC915DE6FC9F574BD755B2EF6BBE62F3717E128DC797A06FE35C1C28CED57A0F64F61A4439ACFE7A7B95A1A948417A5B8B69916A32989B00E2C3FB7C74139A4DA9E533C439E59FC7C4F90780D2BBCDF012C499C15A1E0B5C318F84FB17DF97AB3EC356FD0072CFA3884EFBED319009DE6DBF2A5C7C87A93DEB04CCD9147EF8C9BEC2FD713793E4F0BF8C4EFCEBFBF95D555E523AB5D742808C4E425979A1C216C8CB2B42C7715B8CA5907E84E6FBC35DA7BFBFC892870B659C882C6E3697E0DCC6C24771F26D51A890786DA516DBC2D161680B134F1715B32F734E667650398EC2241AF78877BB3D61D83D0158DDE894862EE6E1BEE278724EA7B34C74F0A5D6B7F79F1322E20AD5757E11D9AC31BFE27C56ABB23A275130533433DC41DDBA1081E3A018E0D0B55DF33ECAE104909DC74F1CA2256CFD423A859B0AC2112A0AE684396C0029AD07D0D30AC84FFD2C2E80B74DE29310FCAFE7D0CB8864729B6FD1F86052D7DD9A9CB085A186259A67C175B3F81C5DA19AFED1BF9C5C07F40A29ED47ED4F1C7DE878B8411E3239ED15AC0E4CCC1D7F8842E9FD9C989F301E2689F800C3D14A38810906A36EEA34207014E99C843C599D56FCFBC14278A2A009C13B6E4AC7460B54D2C7EF38D72AC450540097D2AF609D3FFF874D14582FA8FF21027DEC92844BD22A9A7EC14C66BCC8DB1E058B95AF87ACB60A5725767A76C9185744E483BCCD9278ED9FF15A04061D0F6E32D98B6853A39AA498673C7DD012982B1913B3C3CE2C7080E4CE974B | 172 | 20040305011518 2 6 100 6143 2 E95A4131F86234D27EE1E51791599559EEDB618912E4FE36B81B80CDA4D497959DBFAEE929317A66BE64A328BAB6183EA5A5CBB3581490B4B613B225ADD00EFD38540356E0F4716229CDDB260283AF044FDAF1EF9248BB0CE9031C117CF15D3259B3E7B0301CA1AAC91AFA7A57CCDEED2DA4EFC2DBC7A9FC53BB4D3CB2D57D209D5DDEF25DE14F8226404296BD504EC14F6340F0AA2A1A943B9552C4B91D3EB48C08A13671C36EE5042857625DD2CB58965C0975EB775057FF82BC2B8B69D0BF26E2F80115B3E1A984D1D73D9D02AD69C3A1AF90EC915DE6FC9F574BD755B2EF6BBE62F3717E128DC797A06FE35C1C28CED57A0F64F61A4439ACFE7A7B95A1A948417A5B8B69916A32989B00E2C3FB7C74139A4DA9E533C439E59FC7C4F90780D2BBCDF012C499C15A1E0B5C318F84FB17DF97AB3EC356FD0072CFA3884EFBED319009DE6DBF2A5C7C87A93DEB04CCD9147EF8C9BEC2FD713793E4F0BF8C4EFCEBFBF95D555E523AB5D742808C4E425979A1C216C8CB2B42C7715B8CA5907E84E6FBC35DA7BFBFC892870B659C882C6E3697E0DCC6C24771F26D51A890786DA516DBC2D161680B134F1715B32F734E667650398EC2241AF78877BB3D61D83D0158DDE894862EE6E1BEE278724EA7B34C74F0A5D6B7F79F1322E20AD5757E11D9AC31BFE27C56ABB23A275130533433DC41DDBA1081E3A018E0D0B55DF33ECAE104909DC74F1CA2256CFD423A859B0AC2112A0AE684396C0029AD07D0D30AC84FFD2C2E80B74DE29310FCAFE7D0CB8864729B6FD1F86052D7DD9A9CB085A186259A67C175B3F81C5DA19AFED1BF9C5C07F40A29ED47ED4F1C7DE878B8411E3239ED15AC0E4CCC1D7F8842E9FD9C989F301E2689F800C3D14A38810906A36EEA34207014E99C843C599D56FCFBC14278A2A009C13B6E4AC7460B54D2C7EF38D72AC450540097D2AF609D3FFF874D14582FA8FF21027DEC92844BD22A9A7EC14C66BCC8DB1E058B95AF87ACB60A5725767A76C9185744E483BCCD9278ED9FF15A04061D0F6E32D98B6853A39AA498673C7DD012982B1913B3C3CE2C7080E4CE974B |
| 188 | 20040305043124 2 6 100 6143 2 E95A4131F86234D27EE1E51791599559EEDB618912E4FE36B81B80CDA4D497959DBFAEE929317A66BE64A328BAB6183EA5A5CBB3581490B4B613B225ADD00EFD38540356E0F4716229CDDB260283AF044FDAF1EF9248BB0CE9031C117CF15D3259B3E7B0301CA1AAC91AFA7A57CCDEED2DA4EFC2DBC7A9FC53BB4D3CB2D57D209D5DDEF25DE14F8226404296BD504EC14F6340F0AA2A1A943B9552C4B91D3EB48C08A13671C36EE5042857625DD2CB58965C0975EB775057FF82BC2B8B69D0BF26E2F80115B3E1A984D1D73D9D02AD69C3A1AF90EC915DE6FC9F574BD755B2EF6BBE62F3717E128DC797A06FE35C1C28CED57A0F64F61A4439ACFE7A7B95A1A948417A5B8B69916A32989B00E2C3FB7C74139A4DA9E533C439E59FC7C4F90780D2BBCDF012C499C15A1E0B5C318F84FB17DF97AB3EC356FD0072CFA3884EFBED319009DE6DBF2A5C7C87A93DEB04CCD9147EF8C9BEC2FD713793E4F0BF8C4EFCEBFBF95D555E523AB5D742808C4E425979A1C216C8CB2B42C7715B8CA5907E84E6FBC35DA7BFBFC892870B659C882C6E3697E0DCC6C24771F26D51A890786DA516DBC2D161680B134F1715B32F734E667650398EC2241AF78877BB3D61D83D0158DDE894862EE6E1BEE278724EA7B34C74F0A5D6B7F79F1322E20AD5757E11D9AC31BFE27C56ABB23A275130533433DC41DDBA1081E3A018E0D0B55DF33ECAE104909DC74F1CA2256CFD423A859B0AC2112A0AE684396C0029AD07D0D30AC84FFD2C2E80B74DE29310FCAFE7D0CB8864729B6FD1F86052D7DD9A9CB085A186259A67C175B3F81C5DA19AFED1BF9C5C07F40A29ED47ED4F1C7DE878B8411E3239ED15AC0E4CCC1D7F8842E9FD9C989F301E2689F800C3D14A38810906A36EEA34207014E99C843C599D56FCFBC14278A2A009C13B6E4AC7460B54D2C7EF38D72AC450540097D2AF609D3FFF874D14582FA8FF21027DEC92844BD22A9A7EC14C66BCC8DB1E058B95AF87ACB60A5725767A76C9185744E483BCCD9278ED9FF15A04061D0F6E32D98B6853A39AA498673C7DD012982B1913B3C3CE2C7080E5050933 | 173 | 20040305043124 2 6 100 6143 2 E95A4131F86234D27EE1E51791599559EEDB618912E4FE36B81B80CDA4D497959DBFAEE929317A66BE64A328BAB6183EA5A5CBB3581490B4B613B225ADD00EFD38540356E0F4716229CDDB260283AF044FDAF1EF9248BB0CE9031C117CF15D3259B3E7B0301CA1AAC91AFA7A57CCDEED2DA4EFC2DBC7A9FC53BB4D3CB2D57D209D5DDEF25DE14F8226404296BD504EC14F6340F0AA2A1A943B9552C4B91D3EB48C08A13671C36EE5042857625DD2CB58965C0975EB775057FF82BC2B8B69D0BF26E2F80115B3E1A984D1D73D9D02AD69C3A1AF90EC915DE6FC9F574BD755B2EF6BBE62F3717E128DC797A06FE35C1C28CED57A0F64F61A4439ACFE7A7B95A1A948417A5B8B69916A32989B00E2C3FB7C74139A4DA9E533C439E59FC7C4F90780D2BBCDF012C499C15A1E0B5C318F84FB17DF97AB3EC356FD0072CFA3884EFBED319009DE6DBF2A5C7C87A93DEB04CCD9147EF8C9BEC2FD713793E4F0BF8C4EFCEBFBF95D555E523AB5D742808C4E425979A1C216C8CB2B42C7715B8CA5907E84E6FBC35DA7BFBFC892870B659C882C6E3697E0DCC6C24771F26D51A890786DA516DBC2D161680B134F1715B32F734E667650398EC2241AF78877BB3D61D83D0158DDE894862EE6E1BEE278724EA7B34C74F0A5D6B7F79F1322E20AD5757E11D9AC31BFE27C56ABB23A275130533433DC41DDBA1081E3A018E0D0B55DF33ECAE104909DC74F1CA2256CFD423A859B0AC2112A0AE684396C0029AD07D0D30AC84FFD2C2E80B74DE29310FCAFE7D0CB8864729B6FD1F86052D7DD9A9CB085A186259A67C175B3F81C5DA19AFED1BF9C5C07F40A29ED47ED4F1C7DE878B8411E3239ED15AC0E4CCC1D7F8842E9FD9C989F301E2689F800C3D14A38810906A36EEA34207014E99C843C599D56FCFBC14278A2A009C13B6E4AC7460B54D2C7EF38D72AC450540097D2AF609D3FFF874D14582FA8FF21027DEC92844BD22A9A7EC14C66BCC8DB1E058B95AF87ACB60A5725767A76C9185744E483BCCD9278ED9FF15A04061D0F6E32D98B6853A39AA498673C7DD012982B1913B3C3CE2C7080E5050933 |
| 189 | 20040305084728 2 6 100 6143 2 E95A4131F86234D27EE1E51791599559EEDB618912E4FE36B81B80CDA4D497959DBFAEE929317A66BE64A328BAB6183EA5A5CBB3581490B4B613B225ADD00EFD38540356E0F4716229CDDB260283AF044FDAF1EF9248BB0CE9031C117CF15D3259B3E7B0301CA1AAC91AFA7A57CCDEED2DA4EFC2DBC7A9FC53BB4D3CB2D57D209D5DDEF25DE14F8226404296BD504EC14F6340F0AA2A1A943B9552C4B91D3EB48C08A13671C36EE5042857625DD2CB58965C0975EB775057FF82BC2B8B69D0BF26E2F80115B3E1A984D1D73D9D02AD69C3A1AF90EC915DE6FC9F574BD755B2EF6BBE62F3717E128DC797A06FE35C1C28CED57A0F64F61A4439ACFE7A7B95A1A948417A5B8B69916A32989B00E2C3FB7C74139A4DA9E533C439E59FC7C4F90780D2BBCDF012C499C15A1E0B5C318F84FB17DF97AB3EC356FD0072CFA3884EFBED319009DE6DBF2A5C7C87A93DEB04CCD9147EF8C9BEC2FD713793E4F0BF8C4EFCEBFBF95D555E523AB5D742808C4E425979A1C216C8CB2B42C7715B8CA5907E84E6FBC35DA7BFBFC892870B659C882C6E3697E0DCC6C24771F26D51A890786DA516DBC2D161680B134F1715B32F734E667650398EC2241AF78877BB3D61D83D0158DDE894862EE6E1BEE278724EA7B34C74F0A5D6B7F79F1322E20AD5757E11D9AC31BFE27C56ABB23A275130533433DC41DDBA1081E3A018E0D0B55DF33ECAE104909DC74F1CA2256CFD423A859B0AC2112A0AE684396C0029AD07D0D30AC84FFD2C2E80B74DE29310FCAFE7D0CB8864729B6FD1F86052D7DD9A9CB085A186259A67C175B3F81C5DA19AFED1BF9C5C07F40A29ED47ED4F1C7DE878B8411E3239ED15AC0E4CCC1D7F8842E9FD9C989F301E2689F800C3D14A38810906A36EEA34207014E99C843C599D56FCFBC14278A2A009C13B6E4AC7460B54D2C7EF38D72AC450540097D2AF609D3FFF874D14582FA8FF21027DEC92844BD22A9A7EC14C66BCC8DB1E058B95AF87ACB60A5725767A76C9185744E483BCCD9278ED9FF15A04061D0F6E32D98B6853A39AA498673C7DD012982B1913B3C3CE2C7080E54C7783 | 174 | 20040305084728 2 6 100 6143 2 E95A4131F86234D27EE1E51791599559EEDB618912E4FE36B81B80CDA4D497959DBFAEE929317A66BE64A328BAB6183EA5A5CBB3581490B4B613B225ADD00EFD38540356E0F4716229CDDB260283AF044FDAF1EF9248BB0CE9031C117CF15D3259B3E7B0301CA1AAC91AFA7A57CCDEED2DA4EFC2DBC7A9FC53BB4D3CB2D57D209D5DDEF25DE14F8226404296BD504EC14F6340F0AA2A1A943B9552C4B91D3EB48C08A13671C36EE5042857625DD2CB58965C0975EB775057FF82BC2B8B69D0BF26E2F80115B3E1A984D1D73D9D02AD69C3A1AF90EC915DE6FC9F574BD755B2EF6BBE62F3717E128DC797A06FE35C1C28CED57A0F64F61A4439ACFE7A7B95A1A948417A5B8B69916A32989B00E2C3FB7C74139A4DA9E533C439E59FC7C4F90780D2BBCDF012C499C15A1E0B5C318F84FB17DF97AB3EC356FD0072CFA3884EFBED319009DE6DBF2A5C7C87A93DEB04CCD9147EF8C9BEC2FD713793E4F0BF8C4EFCEBFBF95D555E523AB5D742808C4E425979A1C216C8CB2B42C7715B8CA5907E84E6FBC35DA7BFBFC892870B659C882C6E3697E0DCC6C24771F26D51A890786DA516DBC2D161680B134F1715B32F734E667650398EC2241AF78877BB3D61D83D0158DDE894862EE6E1BEE278724EA7B34C74F0A5D6B7F79F1322E20AD5757E11D9AC31BFE27C56ABB23A275130533433DC41DDBA1081E3A018E0D0B55DF33ECAE104909DC74F1CA2256CFD423A859B0AC2112A0AE684396C0029AD07D0D30AC84FFD2C2E80B74DE29310FCAFE7D0CB8864729B6FD1F86052D7DD9A9CB085A186259A67C175B3F81C5DA19AFED1BF9C5C07F40A29ED47ED4F1C7DE878B8411E3239ED15AC0E4CCC1D7F8842E9FD9C989F301E2689F800C3D14A38810906A36EEA34207014E99C843C599D56FCFBC14278A2A009C13B6E4AC7460B54D2C7EF38D72AC450540097D2AF609D3FFF874D14582FA8FF21027DEC92844BD22A9A7EC14C66BCC8DB1E058B95AF87ACB60A5725767A76C9185744E483BCCD9278ED9FF15A04061D0F6E32D98B6853A39AA498673C7DD012982B1913B3C3CE2C7080E54C7783 |
| @@ -198,3 +183,6 @@ | |||
| 198 | 20040319025848 2 6 100 6143 2 E95A4131F86234D27EE1E51791599559EEDB618912E4FE36B81B80CDA4D497959DBFAEE929317A66BE64A328BAB6183EA5A5CBB3581490B4B613B225ADD00EFD38540356E0F4716229CDDB260283AF044FDAF1EF9248BB0CE9031C117CF15D3259B3E7B0301CA1AAC91AFA7A57CCDEED2DA4EFC2DBC7A9FC53BB4D3CB2D57D209D5DDEF25DE14F8226404296BD504EC14F6340F0AA2A1A943B9552C4B91D3EB48C08A13671C36EE5042857625DD2CB58965C0975EB775057FF82BC2B8B69D0BF26E2F80115B3E1A984D1D73D9D02AD69C3A1AF90EC915DE6FC9F574BD755B2EF6BBE62F3717E128DC797A06FE35C1C28CED57A0F64F61A4439ACFE7A7B95A1A948417A5B8B69916A32989B00E2C3FB7C74139A4DA9E533C439E59FC7C4F90780D2BBCDF012C499C15A1E0B5C318F84FB17DF97AB3EC356FD0072CFA3884EFBED319009DE6DBF2A5C7C87A93DEB04CCD9147EF8C9BEC2FD713793E4F0BF8C4EFCEBFBF95D555E523AB5D742808C4E425979A1C216C8CB2B42C7715B8CA5907E84E6FBC35DA7BFBFC892870B659C882C6E3697E0DCC6C24771F26D51A890786DA516DBC2D161680B134F1715B32F734E667650398EC2241AF78877BB3D61D83D0158DDE894862EE6E1BEE278724EA7B34C74F0A5D6B7F79F1322E20AD5757E11D9AC31BFE27C56ABB23A275130533433DC41DDBA1081E3A018E0D0B55DF33ECAE104909DC74F1CA2256CFD423A859B0AC2112A0AE684396C0029AD07D0D30AC84FFD2C2E80B74DE29310FCAFE7D0CB8864729B6FD1F86052D7DD9A9CB085A186259A67C175B3F81C5DA19AFED1BF9C5C07F40A29ED47ED4F1C7DE878B8411E3239ED15AC0E4CCC1D7F8842E9FD9C989F301E2689F800C3D14A38810906A36EEA34207014E99C843C599D56FCFBC14278A2A009C13B6E4AC7460B54D2C7EF38D72AC450540097D2AF609D3FFF874D14582FA8FF21027DEC92844BD22A9A7EC14C66BCC8DB1E058B95AF87ACB60A5725767A76C9185744E483BCCD9278ED9FF15A04061D0F6E32D98B6853A39AA498673C7DD012982B1913B3C3CE2C7080FD81741B | 183 | 20040319025848 2 6 100 6143 2 E95A4131F86234D27EE1E51791599559EEDB618912E4FE36B81B80CDA4D497959DBFAEE929317A66BE64A328BAB6183EA5A5CBB3581490B4B613B225ADD00EFD38540356E0F4716229CDDB260283AF044FDAF1EF9248BB0CE9031C117CF15D3259B3E7B0301CA1AAC91AFA7A57CCDEED2DA4EFC2DBC7A9FC53BB4D3CB2D57D209D5DDEF25DE14F8226404296BD504EC14F6340F0AA2A1A943B9552C4B91D3EB48C08A13671C36EE5042857625DD2CB58965C0975EB775057FF82BC2B8B69D0BF26E2F80115B3E1A984D1D73D9D02AD69C3A1AF90EC915DE6FC9F574BD755B2EF6BBE62F3717E128DC797A06FE35C1C28CED57A0F64F61A4439ACFE7A7B95A1A948417A5B8B69916A32989B00E2C3FB7C74139A4DA9E533C439E59FC7C4F90780D2BBCDF012C499C15A1E0B5C318F84FB17DF97AB3EC356FD0072CFA3884EFBED319009DE6DBF2A5C7C87A93DEB04CCD9147EF8C9BEC2FD713793E4F0BF8C4EFCEBFBF95D555E523AB5D742808C4E425979A1C216C8CB2B42C7715B8CA5907E84E6FBC35DA7BFBFC892870B659C882C6E3697E0DCC6C24771F26D51A890786DA516DBC2D161680B134F1715B32F734E667650398EC2241AF78877BB3D61D83D0158DDE894862EE6E1BEE278724EA7B34C74F0A5D6B7F79F1322E20AD5757E11D9AC31BFE27C56ABB23A275130533433DC41DDBA1081E3A018E0D0B55DF33ECAE104909DC74F1CA2256CFD423A859B0AC2112A0AE684396C0029AD07D0D30AC84FFD2C2E80B74DE29310FCAFE7D0CB8864729B6FD1F86052D7DD9A9CB085A186259A67C175B3F81C5DA19AFED1BF9C5C07F40A29ED47ED4F1C7DE878B8411E3239ED15AC0E4CCC1D7F8842E9FD9C989F301E2689F800C3D14A38810906A36EEA34207014E99C843C599D56FCFBC14278A2A009C13B6E4AC7460B54D2C7EF38D72AC450540097D2AF609D3FFF874D14582FA8FF21027DEC92844BD22A9A7EC14C66BCC8DB1E058B95AF87ACB60A5725767A76C9185744E483BCCD9278ED9FF15A04061D0F6E32D98B6853A39AA498673C7DD012982B1913B3C3CE2C7080FD81741B |
| 199 | 20040323194658 2 6 100 6143 5 E95A4131F86234D27EE1E51791599559EEDB618912E4FE36B81B80CDA4D497959DBFAEE929317A66BE64A328BAB6183EA5A5CBB3581490B4B613B225ADD00EFD38540356E0F4716229CDDB260283AF044FDAF1EF9248BB0CE9031C117CF15D3259B3E7B0301CA1AAC91AFA7A57CCDEED2DA4EFC2DBC7A9FC53BB4D3CB2D57D209D5DDEF25DE14F8226404296BD504EC14F6340F0AA2A1A943B9552C4B91D3EB48C08A13671C36EE5042857625DD2CB58965C0975EB775057FF82BC2B8B69D0BF26E2F80115B3E1A984D1D73D9D02AD69C3A1AF90EC915DE6FC9F574BD755B2EF6BBE62F3717E128DC797A06FE35C1C28CED57A0F64F61A4439ACFE7A7B95A1A948417A5B8B69916A32989B00E2C3FB7C74139A4DA9E533C439E59FC7C4F90780D2BBCDF012C499C15A1E0B5C318F84FB17DF97AB3EC356FD0072CFA3884EFBED319009DE6DBF2A5C7C87A93DEB04CCD9147EF8C9BEC2FD713793E4F0BF8C4EFCEBFBF95D555E523AB5D742808C4E425979A1C216C8CB2B42C7715B8CA5907E84E6FBC35DA7BFBFC892870B659C882C6E3697E0DCC6C24771F26D51A890786DA516DBC2D161680B134F1715B32F734E667650398EC2241AF78877BB3D61D83D0158DDE894862EE6E1BEE278724EA7B34C74F0A5D6B7F79F1322E20AD5757E11D9AC31BFE27C56ABB23A275130533433DC41DDBA1081E3A018E0D0B55DF33ECAE104909DC74F1CA2256CFD423A859B0AC2112A0AE684396C0029AD07D0D30AC84FFD2C2E80B74DE29310FCAFE7D0CB8864729B6FD1F86052D7DD9A9CB085A186259A67C175B3F81C5DA19AFED1BF9C5C07F40A29ED47ED4F1C7DE878B8411E3239ED15AC0E4CCC1D7F8842E9FD9C989F301E2689F800C3D14A38810906A36EEA34207014E99C843C599D56FCFBC14278A2A009C13B6E4AC7460B54D2C7EF38D72AC450540097D2AF609D3FFF874D14582FA8FF21027DEC92844BD22A9A7EC14C66BCC8DB1E058B95AF87ACB60A5725767A76C9185744E483BCCD9278ED9FF15A04061D0F6E32D98B6853A39AA498673C7DD012982B1913B3C3CE2C708105AF04AF | 184 | 20040323194658 2 6 100 6143 5 E95A4131F86234D27EE1E51791599559EEDB618912E4FE36B81B80CDA4D497959DBFAEE929317A66BE64A328BAB6183EA5A5CBB3581490B4B613B225ADD00EFD38540356E0F4716229CDDB260283AF044FDAF1EF9248BB0CE9031C117CF15D3259B3E7B0301CA1AAC91AFA7A57CCDEED2DA4EFC2DBC7A9FC53BB4D3CB2D57D209D5DDEF25DE14F8226404296BD504EC14F6340F0AA2A1A943B9552C4B91D3EB48C08A13671C36EE5042857625DD2CB58965C0975EB775057FF82BC2B8B69D0BF26E2F80115B3E1A984D1D73D9D02AD69C3A1AF90EC915DE6FC9F574BD755B2EF6BBE62F3717E128DC797A06FE35C1C28CED57A0F64F61A4439ACFE7A7B95A1A948417A5B8B69916A32989B00E2C3FB7C74139A4DA9E533C439E59FC7C4F90780D2BBCDF012C499C15A1E0B5C318F84FB17DF97AB3EC356FD0072CFA3884EFBED319009DE6DBF2A5C7C87A93DEB04CCD9147EF8C9BEC2FD713793E4F0BF8C4EFCEBFBF95D555E523AB5D742808C4E425979A1C216C8CB2B42C7715B8CA5907E84E6FBC35DA7BFBFC892870B659C882C6E3697E0DCC6C24771F26D51A890786DA516DBC2D161680B134F1715B32F734E667650398EC2241AF78877BB3D61D83D0158DDE894862EE6E1BEE278724EA7B34C74F0A5D6B7F79F1322E20AD5757E11D9AC31BFE27C56ABB23A275130533433DC41DDBA1081E3A018E0D0B55DF33ECAE104909DC74F1CA2256CFD423A859B0AC2112A0AE684396C0029AD07D0D30AC84FFD2C2E80B74DE29310FCAFE7D0CB8864729B6FD1F86052D7DD9A9CB085A186259A67C175B3F81C5DA19AFED1BF9C5C07F40A29ED47ED4F1C7DE878B8411E3239ED15AC0E4CCC1D7F8842E9FD9C989F301E2689F800C3D14A38810906A36EEA34207014E99C843C599D56FCFBC14278A2A009C13B6E4AC7460B54D2C7EF38D72AC450540097D2AF609D3FFF874D14582FA8FF21027DEC92844BD22A9A7EC14C66BCC8DB1E058B95AF87ACB60A5725767A76C9185744E483BCCD9278ED9FF15A04061D0F6E32D98B6853A39AA498673C7DD012982B1913B3C3CE2C708105AF04AF |
| 200 | 20040324041535 2 6 100 6143 5 E95A4131F86234D27EE1E51791599559EEDB618912E4FE36B81B80CDA4D497959DBFAEE929317A66BE64A328BAB6183EA5A5CBB3581490B4B613B225ADD00EFD38540356E0F4716229CDDB260283AF044FDAF1EF9248BB0CE9031C117CF15D3259B3E7B0301CA1AAC91AFA7A57CCDEED2DA4EFC2DBC7A9FC53BB4D3CB2D57D209D5DDEF25DE14F8226404296BD504EC14F6340F0AA2A1A943B9552C4B91D3EB48C08A13671C36EE5042857625DD2CB58965C0975EB775057FF82BC2B8B69D0BF26E2F80115B3E1A984D1D73D9D02AD69C3A1AF90EC915DE6FC9F574BD755B2EF6BBE62F3717E128DC797A06FE35C1C28CED57A0F64F61A4439ACFE7A7B95A1A948417A5B8B69916A32989B00E2C3FB7C74139A4DA9E533C439E59FC7C4F90780D2BBCDF012C499C15A1E0B5C318F84FB17DF97AB3EC356FD0072CFA3884EFBED319009DE6DBF2A5C7C87A93DEB04CCD9147EF8C9BEC2FD713793E4F0BF8C4EFCEBFBF95D555E523AB5D742808C4E425979A1C216C8CB2B42C7715B8CA5907E84E6FBC35DA7BFBFC892870B659C882C6E3697E0DCC6C24771F26D51A890786DA516DBC2D161680B134F1715B32F734E667650398EC2241AF78877BB3D61D83D0158DDE894862EE6E1BEE278724EA7B34C74F0A5D6B7F79F1322E20AD5757E11D9AC31BFE27C56ABB23A275130533433DC41DDBA1081E3A018E0D0B55DF33ECAE104909DC74F1CA2256CFD423A859B0AC2112A0AE684396C0029AD07D0D30AC84FFD2C2E80B74DE29310FCAFE7D0CB8864729B6FD1F86052D7DD9A9CB085A186259A67C175B3F81C5DA19AFED1BF9C5C07F40A29ED47ED4F1C7DE878B8411E3239ED15AC0E4CCC1D7F8842E9FD9C989F301E2689F800C3D14A38810906A36EEA34207014E99C843C599D56FCFBC14278A2A009C13B6E4AC7460B54D2C7EF38D72AC450540097D2AF609D3FFF874D14582FA8FF21027DEC92844BD22A9A7EC14C66BCC8DB1E058B95AF87ACB60A5725767A76C9185744E483BCCD9278ED9FF15A04061D0F6E32D98B6853A39AA498673C7DD012982B1913B3C3CE2C70810643E737 | 185 | 20040324041535 2 6 100 6143 5 E95A4131F86234D27EE1E51791599559EEDB618912E4FE36B81B80CDA4D497959DBFAEE929317A66BE64A328BAB6183EA5A5CBB3581490B4B613B225ADD00EFD38540356E0F4716229CDDB260283AF044FDAF1EF9248BB0CE9031C117CF15D3259B3E7B0301CA1AAC91AFA7A57CCDEED2DA4EFC2DBC7A9FC53BB4D3CB2D57D209D5DDEF25DE14F8226404296BD504EC14F6340F0AA2A1A943B9552C4B91D3EB48C08A13671C36EE5042857625DD2CB58965C0975EB775057FF82BC2B8B69D0BF26E2F80115B3E1A984D1D73D9D02AD69C3A1AF90EC915DE6FC9F574BD755B2EF6BBE62F3717E128DC797A06FE35C1C28CED57A0F64F61A4439ACFE7A7B95A1A948417A5B8B69916A32989B00E2C3FB7C74139A4DA9E533C439E59FC7C4F90780D2BBCDF012C499C15A1E0B5C318F84FB17DF97AB3EC356FD0072CFA3884EFBED319009DE6DBF2A5C7C87A93DEB04CCD9147EF8C9BEC2FD713793E4F0BF8C4EFCEBFBF95D555E523AB5D742808C4E425979A1C216C8CB2B42C7715B8CA5907E84E6FBC35DA7BFBFC892870B659C882C6E3697E0DCC6C24771F26D51A890786DA516DBC2D161680B134F1715B32F734E667650398EC2241AF78877BB3D61D83D0158DDE894862EE6E1BEE278724EA7B34C74F0A5D6B7F79F1322E20AD5757E11D9AC31BFE27C56ABB23A275130533433DC41DDBA1081E3A018E0D0B55DF33ECAE104909DC74F1CA2256CFD423A859B0AC2112A0AE684396C0029AD07D0D30AC84FFD2C2E80B74DE29310FCAFE7D0CB8864729B6FD1F86052D7DD9A9CB085A186259A67C175B3F81C5DA19AFED1BF9C5C07F40A29ED47ED4F1C7DE878B8411E3239ED15AC0E4CCC1D7F8842E9FD9C989F301E2689F800C3D14A38810906A36EEA34207014E99C843C599D56FCFBC14278A2A009C13B6E4AC7460B54D2C7EF38D72AC450540097D2AF609D3FFF874D14582FA8FF21027DEC92844BD22A9A7EC14C66BCC8DB1E058B95AF87ACB60A5725767A76C9185744E483BCCD9278ED9FF15A04061D0F6E32D98B6853A39AA498673C7DD012982B1913B3C3CE2C70810643E737 |
| 186 | 20061002171426 2 6 100 8191 2 D2D64D8CC6FDFA9897C8AE805EA7CB972D7A10F5A268EB5B33B0CCE2C75E480365A49070185D8B316872BAF0F3AAF94498A8E0007A13D574C905441F19D4B0D55A83E2A70C09F7B3E353DEA76F5FEB4191E31F4A52D0BC643B9FD1959BDF8B99C13F245B5D9E8589D6C18A844814486F25A8E189B964A9E72675DDE4D759C901C09F7C24CB3E939B54D2009AE9331446C1EDE5FA9D0A33B36F6A6C9B55E956A94169FBE9C1A24EC9A3E497371F4131F2B1E4FB25A1BB27B23A6661155F37C6EC913E5CB207AD894C2319852C556CA040C6B72DE6E913BCF419E5914507119F771206FAB25B1D6BAD57AFEAF74D807CC576549CD979B0AAC13F5D2B637CCF4A54D2D903A4B29C16B9E8BEE8AD6200D24E4E3E97EB25B2DD13C31AE2A4F27D6EFBFA113F9334F92204FCFFCAA5EBDCCBA986C5B6E665FE71D6654ACA3C8051424133597FD65A18BB2AA24FFDD8B09A8758D984E09BE1F55B16A37B36B058295B1E9942A89D386D4B4DB58C516429248052D97DE42BFC32AB14F13D7F963E86867B8B7245062061C9F315EA94C38FCC0E118373BEFC41D1004CF0FA6D951E20BAC5D2C15F5796163469B88A75FE5F5D2C69C949DA47DAC75D22869F37FAB2490791FA5A5854360EAA13701CEE40EC371797272A12746ABA9CB303224B82F8CCE3F62C0D3EA0D62BF3B2C387E015B1A96A4C4A2A73ADA521B0536B81A536A5119EC559D524BA7F2B25A094A164A4EEBB8ADA886DCBA9647FC4D2D4A91BA0DB32805EDA75B61E09F44BC49862D70B8F28C8E630CD6F0DF245535D79DCD75ECBDE51B29AA6DD3F59736E5028E3AB1E75CFCDA1FF9E6F8D52027A4BC218FC9A9E660BF7EB14D300F4199C04B24725405AFA6535DF0837FEF33C0F8B57B9BDFFB1D956E7B40E822FF40603FB5417523B115FE5864094001CEF2526395C19532F153C4630B95E9835FAC985E1C9DF62188DBA12D5B8BEEB414FFD90AFEDF8F986DF33EF5BC7F7C16ACDC4D40A00822CE17A9724066EED89127195BB9D037CB7FB74AA7178A1A4CBECC5D9F67747AA74156C70E54BABA8641A55B93637385A0D1D56E5220867B5A11ED44CFC405AC238DC39690A966A2DE238FFA1E3B3C859D988DE14916C32AB2A2CB35C57F3609C34F1E8E4B5FAC2F446E0EB78CFD64DD7A3570677D373E8FEC6FF47D5471577D92F22B115D03F302C8CD1A43FCDCEBBA823EE942D7733FF7F78672BEAACCEA279744CC14D60E3912E81A14421989CF5B2C10FD1CDB6CA95E2CA8C574AA6C4F3856602A0D32A9978697752878C0DCB50EF5463EE61C83F776AB9D8098755AF00D2972D3E5E502C39A9CE52C8588472C1D3242CA658290F472D48CB0876752643C2F63CFEB66DF6E93C8BE2404DFA10AB3D8EEF214C371DC0EC29755C086574B1AA92A892B517F6E01056DD5EFEB2437E23100E487E3D4B | ||
| 187 | 20061005090403 2 6 100 8191 5 D2D64D8CC6FDFA9897C8AE805EA7CB972D7A10F5A268EB5B33B0CCE2C75E480365A49070185D8B316872BAF0F3AAF94498A8E0007A13D574C905441F19D4B0D55A83E2A70C09F7B3E353DEA76F5FEB4191E31F4A52D0BC643B9FD1959BDF8B99C13F245B5D9E8589D6C18A844814486F25A8E189B964A9E72675DDE4D759C901C09F7C24CB3E939B54D2009AE9331446C1EDE5FA9D0A33B36F6A6C9B55E956A94169FBE9C1A24EC9A3E497371F4131F2B1E4FB25A1BB27B23A6661155F37C6EC913E5CB207AD894C2319852C556CA040C6B72DE6E913BCF419E5914507119F771206FAB25B1D6BAD57AFEAF74D807CC576549CD979B0AAC13F5D2B637CCF4A54D2D903A4B29C16B9E8BEE8AD6200D24E4E3E97EB25B2DD13C31AE2A4F27D6EFBFA113F9334F92204FCFFCAA5EBDCCBA986C5B6E665FE71D6654ACA3C8051424133597FD65A18BB2AA24FFDD8B09A8758D984E09BE1F55B16A37B36B058295B1E9942A89D386D4B4DB58C516429248052D97DE42BFC32AB14F13D7F963E86867B8B7245062061C9F315EA94C38FCC0E118373BEFC41D1004CF0FA6D951E20BAC5D2C15F5796163469B88A75FE5F5D2C69C949DA47DAC75D22869F37FAB2490791FA5A5854360EAA13701CEE40EC371797272A12746ABA9CB303224B82F8CCE3F62C0D3EA0D62BF3B2C387E015B1A96A4C4A2A73ADA521B0536B81A536A5119EC559D524BA7F2B25A094A164A4EEBB8ADA886DCBA9647FC4D2D4A91BA0DB32805EDA75B61E09F44BC49862D70B8F28C8E630CD6F0DF245535D79DCD75ECBDE51B29AA6DD3F59736E5028E3AB1E75CFCDA1FF9E6F8D52027A4BC218FC9A9E660BF7EB14D300F4199C04B24725405AFA6535DF0837FEF33C0F8B57B9BDFFB1D956E7B40E822FF40603FB5417523B115FE5864094001CEF2526395C19532F153C4630B95E9835FAC985E1C9DF62188DBA12D5B8BEEB414FFD90AFEDF8F986DF33EF5BC7F7C16ACDC4D40A00822CE17A9724066EED89127195BB9D037CB7FB74AA7178A1A4CBECC5D9F67747AA74156C70E54BABA8641A55B93637385A0D1D56E5220867B5A11ED44CFC405AC238DC39690A966A2DE238FFA1E3B3C859D988DE14916C32AB2A2CB35C57F3609C34F1E8E4B5FAC2F446E0EB78CFD64DD7A3570677D373E8FEC6FF47D5471577D92F22B115D03F302C8CD1A43FCDCEBBA823EE942D7733FF7F78672BEAACCEA279744CC14D60E3912E81A14421989CF5B2C10FD1CDB6CA95E2CA8C574AA6C4F3856602A0D32A9978697752878C0DCB50EF5463EE61C83F776AB9D8098755AF00D2972D3E5E502C39A9CE52C8588472C1D3242CA658290F472D48CB0876752643C2F63CFEB66DF6E93C8BE2404DFA10AB3D8EEF214C371DC0EC29755C086574B1AA92A892B517F6E01056DD5EFEB2437E23100E4A242A2F | ||
| 188 | 20061005152228 2 6 100 8191 2 D2D64D8CC6FDFA9897C8AE805EA7CB972D7A10F5A268EB5B33B0CCE2C75E480365A49070185D8B316872BAF0F3AAF94498A8E0007A13D574C905441F19D4B0D55A83E2A70C09F7B3E353DEA76F5FEB4191E31F4A52D0BC643B9FD1959BDF8B99C13F245B5D9E8589D6C18A844814486F25A8E189B964A9E72675DDE4D759C901C09F7C24CB3E939B54D2009AE9331446C1EDE5FA9D0A33B36F6A6C9B55E956A94169FBE9C1A24EC9A3E497371F4131F2B1E4FB25A1BB27B23A6661155F37C6EC913E5CB207AD894C2319852C556CA040C6B72DE6E913BCF419E5914507119F771206FAB25B1D6BAD57AFEAF74D807CC576549CD979B0AAC13F5D2B637CCF4A54D2D903A4B29C16B9E8BEE8AD6200D24E4E3E97EB25B2DD13C31AE2A4F27D6EFBFA113F9334F92204FCFFCAA5EBDCCBA986C5B6E665FE71D6654ACA3C8051424133597FD65A18BB2AA24FFDD8B09A8758D984E09BE1F55B16A37B36B058295B1E9942A89D386D4B4DB58C516429248052D97DE42BFC32AB14F13D7F963E86867B8B7245062061C9F315EA94C38FCC0E118373BEFC41D1004CF0FA6D951E20BAC5D2C15F5796163469B88A75FE5F5D2C69C949DA47DAC75D22869F37FAB2490791FA5A5854360EAA13701CEE40EC371797272A12746ABA9CB303224B82F8CCE3F62C0D3EA0D62BF3B2C387E015B1A96A4C4A2A73ADA521B0536B81A536A5119EC559D524BA7F2B25A094A164A4EEBB8ADA886DCBA9647FC4D2D4A91BA0DB32805EDA75B61E09F44BC49862D70B8F28C8E630CD6F0DF245535D79DCD75ECBDE51B29AA6DD3F59736E5028E3AB1E75CFCDA1FF9E6F8D52027A4BC218FC9A9E660BF7EB14D300F4199C04B24725405AFA6535DF0837FEF33C0F8B57B9BDFFB1D956E7B40E822FF40603FB5417523B115FE5864094001CEF2526395C19532F153C4630B95E9835FAC985E1C9DF62188DBA12D5B8BEEB414FFD90AFEDF8F986DF33EF5BC7F7C16ACDC4D40A00822CE17A9724066EED89127195BB9D037CB7FB74AA7178A1A4CBECC5D9F67747AA74156C70E54BABA8641A55B93637385A0D1D56E5220867B5A11ED44CFC405AC238DC39690A966A2DE238FFA1E3B3C859D988DE14916C32AB2A2CB35C57F3609C34F1E8E4B5FAC2F446E0EB78CFD64DD7A3570677D373E8FEC6FF47D5471577D92F22B115D03F302C8CD1A43FCDCEBBA823EE942D7733FF7F78672BEAACCEA279744CC14D60E3912E81A14421989CF5B2C10FD1CDB6CA95E2CA8C574AA6C4F3856602A0D32A9978697752878C0DCB50EF5463EE61C83F776AB9D8098755AF00D2972D3E5E502C39A9CE52C8588472C1D3242CA658290F472D48CB0876752643C2F63CFEB66DF6E93C8BE2404DFA10AB3D8EEF214C371DC0EC29755C086574B1AA92A892B517F6E01056DD5EFEB2437E23100E4A4C3B0B | ||
diff --git a/moduli.0 b/moduli.0 new file mode 100644 index 000000000..55a315fab --- /dev/null +++ b/moduli.0 | |||
| @@ -0,0 +1,72 @@ | |||
| 1 | MODULI(5) OpenBSD Programmer's Manual MODULI(5) | ||
| 2 | |||
| 3 | NAME | ||
| 4 | moduli - Diffie Hellman moduli | ||
| 5 | |||
| 6 | DESCRIPTION | ||
| 7 | The /etc/moduli file contains prime numbers and generators for use by | ||
| 8 | sshd(8) in the Diffie-Hellman Group Exchange key exchange method. | ||
| 9 | |||
| 10 | New moduli may be generated with ssh-keygen(1) using a two-step process. | ||
| 11 | An initial candidate generation pass, using ssh-keygen -G, calculates | ||
| 12 | numbers that are likely to be useful. A second primality testing pass, | ||
| 13 | using ssh-keygen -T provides a high degree of assurance that the numbers | ||
| 14 | are prime and are safe for use in Diffie Hellman operations by sshd(8). | ||
| 15 | This moduli format is used as the output from each pass. | ||
| 16 | |||
| 17 | The file consists of newline-separated records, one per modulus, contain- | ||
| 18 | ing seven space separated fields. These fields are as follows: | ||
| 19 | |||
| 20 | timestamp The time that the modulus was last processed as YYYYM- | ||
| 21 | MDDHHMMSS. | ||
| 22 | |||
| 23 | type Decimal number specifying the internal structure of | ||
| 24 | the prime modulus. Supported types are: | ||
| 25 | |||
| 26 | 0 Unknown, not tested | ||
| 27 | 2 "Safe" prime; (p-1)/2 is also prime. | ||
| 28 | 4 Sophie Germain; (p+1)*2 is also prime. | ||
| 29 | |||
| 30 | Moduli candidates initially produced by ssh-keygen(1) | ||
| 31 | are Sophie Germain primes (type 4). Futher primality | ||
| 32 | testing with ssh-keygen(1) produces safe prime moduli | ||
| 33 | (type 2) that are ready for use in sshd(8). Other | ||
| 34 | types are not used by OpenSSH. | ||
| 35 | |||
| 36 | tests Decimal number indicating the type of primality tests | ||
| 37 | that the number has been subjected to represented as a | ||
| 38 | bitmask of the following values: | ||
| 39 | |||
| 40 | 0x00 Not tested | ||
| 41 | 0x01 Composite number - not prime. | ||
| 42 | 0x02 Sieve of Eratosthenes | ||
| 43 | 0x04 Probabalistic Miller-Rabin primality tests. | ||
| 44 | |||
| 45 | The ssh-keygen(1) moduli candidate generation uses the | ||
| 46 | Sieve of Eratosthenes (flag 0x02). Subsequent | ||
| 47 | ssh-keygen(1) primality tests are Miller-Rabin tests | ||
| 48 | (flag 0x04). | ||
| 49 | |||
| 50 | trials Decimal number indicating of primaility trials that | ||
| 51 | have been performed on the modulus. | ||
| 52 | |||
| 53 | size Decimal number indicating the size of the prime in | ||
| 54 | bits. | ||
| 55 | |||
| 56 | generator The recommended generator for use with this modulus | ||
| 57 | (hexadecimal). | ||
| 58 | |||
| 59 | modulus The modulus itself in hexadecimal. | ||
| 60 | |||
| 61 | When performing Diffie Hellman Group Exchange, sshd(8) first estimates | ||
| 62 | the size of the modulus required to produce enough Diffie Hellman output | ||
| 63 | to sufficiently key the selected symmetric cipher. sshd(8) then randomly | ||
| 64 | selects a modulus from /etc/moduli that best meets the size requirement. | ||
| 65 | |||
| 66 | SEE ALSO | ||
| 67 | ssh-keygen(1), sshd(8), | ||
| 68 | |||
| 69 | Diffie-Hellman Group Exchange for the Secure Shell (SSH) Transport Layer | ||
| 70 | Protocol, RFC 4419, 2006. | ||
| 71 | |||
| 72 | OpenBSD 4.4 June 26, 2008 2 | ||
diff --git a/moduli.5 b/moduli.5 new file mode 100644 index 000000000..4a99439cc --- /dev/null +++ b/moduli.5 | |||
| @@ -0,0 +1,124 @@ | |||
| 1 | .\" $OpenBSD: moduli.5,v 1.12 2008/06/26 05:57:54 djm Exp $ | ||
| 2 | .\" | ||
| 3 | .\" Copyright (c) 2008 Damien Miller <djm@mindrot.org> | ||
| 4 | .\" | ||
| 5 | .\" Permission to use, copy, modify, and distribute this software for any | ||
| 6 | .\" purpose with or without fee is hereby granted, provided that the above | ||
| 7 | .\" copyright notice and this permission notice appear in all copies. | ||
| 8 | .\" | ||
| 9 | .\" THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES | ||
| 10 | .\" WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF | ||
| 11 | .\" MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR | ||
| 12 | .\" ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES | ||
| 13 | .\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN | ||
| 14 | .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF | ||
| 15 | .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. | ||
| 16 | .Dd $Mdocdate: June 26 2008 $ | ||
| 17 | .Dt MODULI 5 | ||
| 18 | .Os | ||
| 19 | .Sh NAME | ||
| 20 | .Nm moduli | ||
| 21 | .Nd Diffie Hellman moduli | ||
| 22 | .Sh DESCRIPTION | ||
| 23 | The | ||
| 24 | .Pa /etc/moduli | ||
| 25 | file contains prime numbers and generators for use by | ||
| 26 | .Xr sshd 8 | ||
| 27 | in the Diffie-Hellman Group Exchange key exchange method. | ||
| 28 | .Pp | ||
| 29 | New moduli may be generated with | ||
| 30 | .Xr ssh-keygen 1 | ||
| 31 | using a two-step process. | ||
| 32 | An initial | ||
| 33 | .Em candidate generation | ||
| 34 | pass, using | ||
| 35 | .Ic ssh-keygen -G , | ||
| 36 | calculates numbers that are likely to be useful. | ||
| 37 | A second | ||
| 38 | .Em primality testing | ||
| 39 | pass, using | ||
| 40 | .Ic ssh-keygen -T | ||
| 41 | provides a high degree of assurance that the numbers are prime and are | ||
| 42 | safe for use in Diffie Hellman operations by | ||
| 43 | .Xr sshd 8 . | ||
| 44 | This | ||
| 45 | .Nm | ||
| 46 | format is used as the output from each pass. | ||
| 47 | .Pp | ||
| 48 | The file consists of newline-separated records, one per modulus, | ||
| 49 | containing seven space separated fields. | ||
| 50 | These fields are as follows: | ||
| 51 | .Pp | ||
| 52 | .Bl -tag -width Description -offset indent | ||
| 53 | .It timestamp | ||
| 54 | The time that the modulus was last processed as YYYYMMDDHHMMSS. | ||
| 55 | .It type | ||
| 56 | Decimal number specifying the internal structure of the prime modulus. | ||
| 57 | Supported types are: | ||
| 58 | .Pp | ||
| 59 | .Bl -tag -width 0x00 -compact | ||
| 60 | .It 0 | ||
| 61 | Unknown, not tested | ||
| 62 | .It 2 | ||
| 63 | "Safe" prime; (p-1)/2 is also prime. | ||
| 64 | .It 4 | ||
| 65 | Sophie Germain; (p+1)*2 is also prime. | ||
| 66 | .El | ||
| 67 | .Pp | ||
| 68 | Moduli candidates initially produced by | ||
| 69 | .Xr ssh-keygen 1 | ||
| 70 | are Sophie Germain primes (type 4). | ||
| 71 | Futher primality testing with | ||
| 72 | .Xr ssh-keygen 1 | ||
| 73 | produces safe prime moduli (type 2) that are ready for use in | ||
| 74 | .Xr sshd 8 . | ||
| 75 | Other types are not used by OpenSSH. | ||
| 76 | .It tests | ||
| 77 | Decimal number indicating the type of primality tests that the number | ||
| 78 | has been subjected to represented as a bitmask of the following values: | ||
| 79 | .Pp | ||
| 80 | .Bl -tag -width 0x00 -compact | ||
| 81 | .It 0x00 | ||
| 82 | Not tested | ||
| 83 | .It 0x01 | ||
| 84 | Composite number - not prime. | ||
| 85 | .It 0x02 | ||
| 86 | Sieve of Eratosthenes | ||
| 87 | .It 0x04 | ||
| 88 | Probabalistic Miller-Rabin primality tests. | ||
| 89 | .El | ||
| 90 | .Pp | ||
| 91 | The | ||
| 92 | .Xr ssh-keygen 1 | ||
| 93 | moduli candidate generation uses the Sieve of Eratosthenes (flag 0x02). | ||
| 94 | Subsequent | ||
| 95 | .Xr ssh-keygen 1 | ||
| 96 | primality tests are Miller-Rabin tests (flag 0x04). | ||
| 97 | .It trials | ||
| 98 | Decimal number indicating of primaility trials that have been performed | ||
| 99 | on the modulus. | ||
| 100 | .It size | ||
| 101 | Decimal number indicating the size of the prime in bits. | ||
| 102 | .It generator | ||
| 103 | The recommended generator for use with this modulus (hexadecimal). | ||
| 104 | .It modulus | ||
| 105 | The modulus itself in hexadecimal. | ||
| 106 | .El | ||
| 107 | .Pp | ||
| 108 | When performing Diffie Hellman Group Exchange, | ||
| 109 | .Xr sshd 8 | ||
| 110 | first estimates the size of the modulus required to produce enough | ||
| 111 | Diffie Hellman output to sufficiently key the selected symmetric cipher. | ||
| 112 | .Xr sshd 8 | ||
| 113 | then randomly selects a modulus from | ||
| 114 | .Fa /etc/moduli | ||
| 115 | that best meets the size requirement. | ||
| 116 | .Pp | ||
| 117 | .Sh SEE ALSO | ||
| 118 | .Xr ssh-keygen 1 , | ||
| 119 | .Xr sshd 8 , | ||
| 120 | .Rs | ||
| 121 | .%R RFC 4419 | ||
| 122 | .%T "Diffie-Hellman Group Exchange for the Secure Shell (SSH) Transport Layer Protocol" | ||
| 123 | .%D 2006 | ||
| 124 | .Re | ||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: moduli.c,v 1.20 2007/02/24 03:30:11 ray Exp $ */ | 1 | /* $OpenBSD: moduli.c,v 1.21 2008/06/26 09:19:40 djm Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Copyright 1994 Phil Karn <karn@qualcomm.com> | 3 | * Copyright 1994 Phil Karn <karn@qualcomm.com> |
| 4 | * Copyright 1996-1998, 2003 William Allen Simpson <wsimpson@greendragon.com> | 4 | * Copyright 1996-1998, 2003 William Allen Simpson <wsimpson@greendragon.com> |
| @@ -42,6 +42,7 @@ | |||
| 42 | #include <sys/types.h> | 42 | #include <sys/types.h> |
| 43 | 43 | ||
| 44 | #include <openssl/bn.h> | 44 | #include <openssl/bn.h> |
| 45 | #include <openssl/dh.h> | ||
| 45 | 46 | ||
| 46 | #include <stdio.h> | 47 | #include <stdio.h> |
| 47 | #include <stdlib.h> | 48 | #include <stdlib.h> |
| @@ -50,6 +51,7 @@ | |||
| 50 | #include <time.h> | 51 | #include <time.h> |
| 51 | 52 | ||
| 52 | #include "xmalloc.h" | 53 | #include "xmalloc.h" |
| 54 | #include "dh.h" | ||
| 53 | #include "log.h" | 55 | #include "log.h" |
| 54 | 56 | ||
| 55 | /* | 57 | /* |
| @@ -59,27 +61,6 @@ | |||
| 59 | /* need line long enough for largest moduli plus headers */ | 61 | /* need line long enough for largest moduli plus headers */ |
| 60 | #define QLINESIZE (100+8192) | 62 | #define QLINESIZE (100+8192) |
| 61 | 63 | ||
| 62 | /* Type: decimal. | ||
| 63 | * Specifies the internal structure of the prime modulus. | ||
| 64 | */ | ||
| 65 | #define QTYPE_UNKNOWN (0) | ||
| 66 | #define QTYPE_UNSTRUCTURED (1) | ||
| 67 | #define QTYPE_SAFE (2) | ||
| 68 | #define QTYPE_SCHNORR (3) | ||
| 69 | #define QTYPE_SOPHIE_GERMAIN (4) | ||
| 70 | #define QTYPE_STRONG (5) | ||
| 71 | |||
| 72 | /* Tests: decimal (bit field). | ||
| 73 | * Specifies the methods used in checking for primality. | ||
| 74 | * Usually, more than one test is used. | ||
| 75 | */ | ||
| 76 | #define QTEST_UNTESTED (0x00) | ||
| 77 | #define QTEST_COMPOSITE (0x01) | ||
| 78 | #define QTEST_SIEVE (0x02) | ||
| 79 | #define QTEST_MILLER_RABIN (0x04) | ||
| 80 | #define QTEST_JACOBI (0x08) | ||
| 81 | #define QTEST_ELLIPTIC (0x10) | ||
| 82 | |||
| 83 | /* | 64 | /* |
| 84 | * Size: decimal. | 65 | * Size: decimal. |
| 85 | * Specifies the number of the most significant bit (0 to M). | 66 | * Specifies the number of the most significant bit (0 to M). |
| @@ -434,8 +415,9 @@ gen_candidates(FILE *out, u_int32_t memory, u_int32_t power, BIGNUM *start) | |||
| 434 | fatal("BN_set_word failed"); | 415 | fatal("BN_set_word failed"); |
| 435 | if (BN_add(q, q, largebase) == 0) | 416 | if (BN_add(q, q, largebase) == 0) |
| 436 | fatal("BN_add failed"); | 417 | fatal("BN_add failed"); |
| 437 | if (qfileout(out, QTYPE_SOPHIE_GERMAIN, QTEST_SIEVE, | 418 | if (qfileout(out, MODULI_TYPE_SOPHIE_GERMAIN, |
| 438 | largetries, (power - 1) /* MSB */, (0), q) == -1) { | 419 | MODULI_TESTS_SIEVE, largetries, |
| 420 | (power - 1) /* MSB */, (0), q) == -1) { | ||
| 439 | ret = -1; | 421 | ret = -1; |
| 440 | break; | 422 | break; |
| 441 | } | 423 | } |
| @@ -507,7 +489,7 @@ prime_test(FILE *in, FILE *out, u_int32_t trials, u_int32_t generator_wanted) | |||
| 507 | /* tests */ | 489 | /* tests */ |
| 508 | in_tests = strtoul(cp, &cp, 10); | 490 | in_tests = strtoul(cp, &cp, 10); |
| 509 | 491 | ||
| 510 | if (in_tests & QTEST_COMPOSITE) { | 492 | if (in_tests & MODULI_TESTS_COMPOSITE) { |
| 511 | debug2("%10u: known composite", count_in); | 493 | debug2("%10u: known composite", count_in); |
| 512 | continue; | 494 | continue; |
| 513 | } | 495 | } |
| @@ -526,7 +508,7 @@ prime_test(FILE *in, FILE *out, u_int32_t trials, u_int32_t generator_wanted) | |||
| 526 | 508 | ||
| 527 | /* modulus (hex) */ | 509 | /* modulus (hex) */ |
| 528 | switch (in_type) { | 510 | switch (in_type) { |
| 529 | case QTYPE_SOPHIE_GERMAIN: | 511 | case MODULI_TYPE_SOPHIE_GERMAIN: |
| 530 | debug2("%10u: (%u) Sophie-Germain", count_in, in_type); | 512 | debug2("%10u: (%u) Sophie-Germain", count_in, in_type); |
| 531 | a = q; | 513 | a = q; |
| 532 | if (BN_hex2bn(&a, cp) == 0) | 514 | if (BN_hex2bn(&a, cp) == 0) |
| @@ -539,11 +521,11 @@ prime_test(FILE *in, FILE *out, u_int32_t trials, u_int32_t generator_wanted) | |||
| 539 | in_size += 1; | 521 | in_size += 1; |
| 540 | generator_known = 0; | 522 | generator_known = 0; |
| 541 | break; | 523 | break; |
| 542 | case QTYPE_UNSTRUCTURED: | 524 | case MODULI_TYPE_UNSTRUCTURED: |
| 543 | case QTYPE_SAFE: | 525 | case MODULI_TYPE_SAFE: |
| 544 | case QTYPE_SCHNORR: | 526 | case MODULI_TYPE_SCHNORR: |
| 545 | case QTYPE_STRONG: | 527 | case MODULI_TYPE_STRONG: |
| 546 | case QTYPE_UNKNOWN: | 528 | case MODULI_TYPE_UNKNOWN: |
| 547 | debug2("%10u: (%u)", count_in, in_type); | 529 | debug2("%10u: (%u)", count_in, in_type); |
| 548 | a = p; | 530 | a = p; |
| 549 | if (BN_hex2bn(&a, cp) == 0) | 531 | if (BN_hex2bn(&a, cp) == 0) |
| @@ -570,7 +552,7 @@ prime_test(FILE *in, FILE *out, u_int32_t trials, u_int32_t generator_wanted) | |||
| 570 | continue; | 552 | continue; |
| 571 | } | 553 | } |
| 572 | 554 | ||
| 573 | if (in_tests & QTEST_MILLER_RABIN) | 555 | if (in_tests & MODULI_TESTS_MILLER_RABIN) |
| 574 | in_tries += trials; | 556 | in_tries += trials; |
| 575 | else | 557 | else |
| 576 | in_tries = trials; | 558 | in_tries = trials; |
| @@ -644,7 +626,8 @@ prime_test(FILE *in, FILE *out, u_int32_t trials, u_int32_t generator_wanted) | |||
| 644 | } | 626 | } |
| 645 | debug("%10u: q is almost certainly prime", count_in); | 627 | debug("%10u: q is almost certainly prime", count_in); |
| 646 | 628 | ||
| 647 | if (qfileout(out, QTYPE_SAFE, (in_tests | QTEST_MILLER_RABIN), | 629 | if (qfileout(out, MODULI_TYPE_SAFE, |
| 630 | in_tests | MODULI_TESTS_MILLER_RABIN, | ||
| 648 | in_tries, in_size, generator_known, p)) { | 631 | in_tries, in_size, generator_known, p)) { |
| 649 | res = -1; | 632 | res = -1; |
| 650 | break; | 633 | break; |
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: monitor.c,v 1.91 2007/05/17 20:52:13 djm Exp $ */ | 1 | /* $OpenBSD: monitor.c,v 1.99 2008/07/10 18:08:11 markus Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Copyright 2002 Niels Provos <provos@citi.umich.edu> | 3 | * Copyright 2002 Niels Provos <provos@citi.umich.edu> |
| 4 | * Copyright 2002 Markus Friedl <markus@openbsd.org> | 4 | * Copyright 2002 Markus Friedl <markus@openbsd.org> |
| @@ -51,6 +51,7 @@ | |||
| 51 | 51 | ||
| 52 | #include <openssl/dh.h> | 52 | #include <openssl/dh.h> |
| 53 | 53 | ||
| 54 | #include "openbsd-compat/sys-queue.h" | ||
| 54 | #include "xmalloc.h" | 55 | #include "xmalloc.h" |
| 55 | #include "ssh.h" | 56 | #include "ssh.h" |
| 56 | #include "key.h" | 57 | #include "key.h" |
| @@ -660,11 +661,11 @@ mm_answer_pwnamallow(int sock, Buffer *m) | |||
| 660 | #endif | 661 | #endif |
| 661 | buffer_put_cstring(m, pwent->pw_dir); | 662 | buffer_put_cstring(m, pwent->pw_dir); |
| 662 | buffer_put_cstring(m, pwent->pw_shell); | 663 | buffer_put_cstring(m, pwent->pw_shell); |
| 664 | |||
| 665 | out: | ||
| 663 | buffer_put_string(m, &options, sizeof(options)); | 666 | buffer_put_string(m, &options, sizeof(options)); |
| 664 | if (options.banner != NULL) | 667 | if (options.banner != NULL) |
| 665 | buffer_put_cstring(m, options.banner); | 668 | buffer_put_cstring(m, options.banner); |
| 666 | |||
| 667 | out: | ||
| 668 | debug3("%s: sending MONITOR_ANS_PWNAM: %d", __func__, allowed); | 669 | debug3("%s: sending MONITOR_ANS_PWNAM: %d", __func__, allowed); |
| 669 | mm_request_send(sock, MONITOR_ANS_PWNAM, m); | 670 | mm_request_send(sock, MONITOR_ANS_PWNAM, m); |
| 670 | 671 | ||
| @@ -1055,6 +1056,8 @@ mm_answer_keyallowed(int sock, Buffer *m) | |||
| 1055 | allowed = options.pubkey_authentication && | 1056 | allowed = options.pubkey_authentication && |
| 1056 | user_key_allowed(authctxt->pw, key); | 1057 | user_key_allowed(authctxt->pw, key); |
| 1057 | auth_method = "publickey"; | 1058 | auth_method = "publickey"; |
| 1059 | if (options.pubkey_authentication && allowed != 1) | ||
| 1060 | auth_clear_options(); | ||
| 1058 | break; | 1061 | break; |
| 1059 | case MM_HOSTKEY: | 1062 | case MM_HOSTKEY: |
| 1060 | allowed = options.hostbased_authentication && | 1063 | allowed = options.hostbased_authentication && |
| @@ -1067,6 +1070,8 @@ mm_answer_keyallowed(int sock, Buffer *m) | |||
| 1067 | allowed = options.rhosts_rsa_authentication && | 1070 | allowed = options.rhosts_rsa_authentication && |
| 1068 | auth_rhosts_rsa_key_allowed(authctxt->pw, | 1071 | auth_rhosts_rsa_key_allowed(authctxt->pw, |
| 1069 | cuser, chost, key); | 1072 | cuser, chost, key); |
| 1073 | if (options.rhosts_rsa_authentication && allowed != 1) | ||
| 1074 | auth_clear_options(); | ||
| 1070 | auth_method = "rsa"; | 1075 | auth_method = "rsa"; |
| 1071 | break; | 1076 | break; |
| 1072 | default: | 1077 | default: |
| @@ -1096,7 +1101,7 @@ mm_answer_keyallowed(int sock, Buffer *m) | |||
| 1096 | } | 1101 | } |
| 1097 | 1102 | ||
| 1098 | debug3("%s: key %p is %s", | 1103 | debug3("%s: key %p is %s", |
| 1099 | __func__, key, allowed ? "allowed" : "disallowed"); | 1104 | __func__, key, allowed ? "allowed" : "not allowed"); |
| 1100 | 1105 | ||
| 1101 | buffer_clear(m); | 1106 | buffer_clear(m); |
| 1102 | buffer_put_int(m, allowed); | 1107 | buffer_put_int(m, allowed); |
| @@ -1313,7 +1318,7 @@ mm_session_close(Session *s) | |||
| 1313 | debug3("%s: tty %s ptyfd %d", __func__, s->tty, s->ptyfd); | 1318 | debug3("%s: tty %s ptyfd %d", __func__, s->tty, s->ptyfd); |
| 1314 | session_pty_cleanup2(s); | 1319 | session_pty_cleanup2(s); |
| 1315 | } | 1320 | } |
| 1316 | s->used = 0; | 1321 | session_unused(s->self); |
| 1317 | } | 1322 | } |
| 1318 | 1323 | ||
| 1319 | int | 1324 | int |
| @@ -1355,8 +1360,9 @@ mm_answer_pty(int sock, Buffer *m) | |||
| 1355 | 1360 | ||
| 1356 | mm_request_send(sock, MONITOR_ANS_PTY, m); | 1361 | mm_request_send(sock, MONITOR_ANS_PTY, m); |
| 1357 | 1362 | ||
| 1358 | mm_send_fd(sock, s->ptyfd); | 1363 | if (mm_send_fd(sock, s->ptyfd) == -1 || |
| 1359 | mm_send_fd(sock, s->ttyfd); | 1364 | mm_send_fd(sock, s->ttyfd) == -1) |
| 1365 | fatal("%s: send fds failed", __func__); | ||
| 1360 | 1366 | ||
| 1361 | /* make sure nothing uses fd 0 */ | 1367 | /* make sure nothing uses fd 0 */ |
| 1362 | if ((fd0 = open(_PATH_DEVNULL, O_RDONLY)) < 0) | 1368 | if ((fd0 = open(_PATH_DEVNULL, O_RDONLY)) < 0) |
| @@ -1587,6 +1593,11 @@ mm_answer_term(int sock, Buffer *req) | |||
| 1587 | /* The child is terminating */ | 1593 | /* The child is terminating */ |
| 1588 | session_destroy_all(&mm_session_close); | 1594 | session_destroy_all(&mm_session_close); |
| 1589 | 1595 | ||
| 1596 | #ifdef USE_PAM | ||
| 1597 | if (options.use_pam) | ||
| 1598 | sshpam_cleanup(); | ||
| 1599 | #endif | ||
| 1600 | |||
| 1590 | while (waitpid(pmonitor->m_pid, &status, 0) == -1) | 1601 | while (waitpid(pmonitor->m_pid, &status, 0) == -1) |
| 1591 | if (errno != EINTR) | 1602 | if (errno != EINTR) |
| 1592 | exit(1); | 1603 | exit(1); |
| @@ -1740,7 +1751,7 @@ mm_get_keystate(struct monitor *pmonitor) | |||
| 1740 | u_char *blob, *p; | 1751 | u_char *blob, *p; |
| 1741 | u_int bloblen, plen; | 1752 | u_int bloblen, plen; |
| 1742 | u_int32_t seqnr, packets; | 1753 | u_int32_t seqnr, packets; |
| 1743 | u_int64_t blocks; | 1754 | u_int64_t blocks, bytes; |
| 1744 | 1755 | ||
| 1745 | debug3("%s: Waiting for new keys", __func__); | 1756 | debug3("%s: Waiting for new keys", __func__); |
| 1746 | 1757 | ||
| @@ -1773,11 +1784,13 @@ mm_get_keystate(struct monitor *pmonitor) | |||
| 1773 | seqnr = buffer_get_int(&m); | 1784 | seqnr = buffer_get_int(&m); |
| 1774 | blocks = buffer_get_int64(&m); | 1785 | blocks = buffer_get_int64(&m); |
| 1775 | packets = buffer_get_int(&m); | 1786 | packets = buffer_get_int(&m); |
| 1776 | packet_set_state(MODE_OUT, seqnr, blocks, packets); | 1787 | bytes = buffer_get_int64(&m); |
| 1788 | packet_set_state(MODE_OUT, seqnr, blocks, packets, bytes); | ||
| 1777 | seqnr = buffer_get_int(&m); | 1789 | seqnr = buffer_get_int(&m); |
| 1778 | blocks = buffer_get_int64(&m); | 1790 | blocks = buffer_get_int64(&m); |
| 1779 | packets = buffer_get_int(&m); | 1791 | packets = buffer_get_int(&m); |
| 1780 | packet_set_state(MODE_IN, seqnr, blocks, packets); | 1792 | bytes = buffer_get_int64(&m); |
| 1793 | packet_set_state(MODE_IN, seqnr, blocks, packets, bytes); | ||
| 1781 | 1794 | ||
| 1782 | skip: | 1795 | skip: |
| 1783 | /* Get the key context */ | 1796 | /* Get the key context */ |
diff --git a/monitor_fdpass.c b/monitor_fdpass.c index 52d133647..28296d64b 100644 --- a/monitor_fdpass.c +++ b/monitor_fdpass.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: monitor_fdpass.c,v 1.12 2006/08/03 03:34:42 deraadt Exp $ */ | 1 | /* $OpenBSD: monitor_fdpass.c,v 1.17 2008/03/24 16:11:07 deraadt Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Copyright 2001 Niels Provos <provos@citi.umich.edu> | 3 | * Copyright 2001 Niels Provos <provos@citi.umich.edu> |
| 4 | * All rights reserved. | 4 | * All rights reserved. |
| @@ -64,7 +64,7 @@ cmsg_type_is_broken(void) | |||
| 64 | return broken_cmsg_type; | 64 | return broken_cmsg_type; |
| 65 | } | 65 | } |
| 66 | 66 | ||
| 67 | void | 67 | int |
| 68 | mm_send_fd(int sock, int fd) | 68 | mm_send_fd(int sock, int fd) |
| 69 | { | 69 | { |
| 70 | #if defined(HAVE_SENDMSG) && (defined(HAVE_ACCRIGHTS_IN_MSGHDR) || defined(HAVE_CONTROL_IN_MSGHDR)) | 70 | #if defined(HAVE_SENDMSG) && (defined(HAVE_ACCRIGHTS_IN_MSGHDR) || defined(HAVE_CONTROL_IN_MSGHDR)) |
| @@ -73,7 +73,11 @@ mm_send_fd(int sock, int fd) | |||
| 73 | char ch = '\0'; | 73 | char ch = '\0'; |
| 74 | ssize_t n; | 74 | ssize_t n; |
| 75 | #ifndef HAVE_ACCRIGHTS_IN_MSGHDR | 75 | #ifndef HAVE_ACCRIGHTS_IN_MSGHDR |
| 76 | char tmp[CMSG_SPACE(sizeof(int))]; | 76 | union { |
| 77 | struct cmsghdr hdr; | ||
| 78 | char tmp[CMSG_SPACE(sizeof(int))]; | ||
| 79 | char buf[CMSG_SPACE(sizeof(int))]; | ||
| 80 | } cmsgbuf; | ||
| 77 | struct cmsghdr *cmsg; | 81 | struct cmsghdr *cmsg; |
| 78 | #endif | 82 | #endif |
| 79 | 83 | ||
| @@ -82,8 +86,8 @@ mm_send_fd(int sock, int fd) | |||
| 82 | msg.msg_accrights = (caddr_t)&fd; | 86 | msg.msg_accrights = (caddr_t)&fd; |
| 83 | msg.msg_accrightslen = sizeof(fd); | 87 | msg.msg_accrightslen = sizeof(fd); |
| 84 | #else | 88 | #else |
| 85 | msg.msg_control = (caddr_t)tmp; | 89 | msg.msg_control = (caddr_t)&cmsgbuf.buf; |
| 86 | msg.msg_controllen = CMSG_LEN(sizeof(int)); | 90 | msg.msg_controllen = sizeof(cmsgbuf.buf); |
| 87 | cmsg = CMSG_FIRSTHDR(&msg); | 91 | cmsg = CMSG_FIRSTHDR(&msg); |
| 88 | cmsg->cmsg_len = CMSG_LEN(sizeof(int)); | 92 | cmsg->cmsg_len = CMSG_LEN(sizeof(int)); |
| 89 | cmsg->cmsg_level = SOL_SOCKET; | 93 | cmsg->cmsg_level = SOL_SOCKET; |
| @@ -96,15 +100,21 @@ mm_send_fd(int sock, int fd) | |||
| 96 | msg.msg_iov = &vec; | 100 | msg.msg_iov = &vec; |
| 97 | msg.msg_iovlen = 1; | 101 | msg.msg_iovlen = 1; |
| 98 | 102 | ||
| 99 | if ((n = sendmsg(sock, &msg, 0)) == -1) | 103 | if ((n = sendmsg(sock, &msg, 0)) == -1) { |
| 100 | fatal("%s: sendmsg(%d): %s", __func__, fd, | 104 | error("%s: sendmsg(%d): %s", __func__, fd, |
| 101 | strerror(errno)); | 105 | strerror(errno)); |
| 102 | if (n != 1) | 106 | return -1; |
| 103 | fatal("%s: sendmsg: expected sent 1 got %ld", | 107 | } |
| 108 | |||
| 109 | if (n != 1) { | ||
| 110 | error("%s: sendmsg: expected sent 1 got %ld", | ||
| 104 | __func__, (long)n); | 111 | __func__, (long)n); |
| 112 | return -1; | ||
| 113 | } | ||
| 114 | return 0; | ||
| 105 | #else | 115 | #else |
| 106 | fatal("%s: UsePrivilegeSeparation=yes not supported", | 116 | error("%s: file descriptor passing not supported", __func__); |
| 107 | __func__); | 117 | return -1; |
| 108 | #endif | 118 | #endif |
| 109 | } | 119 | } |
| 110 | 120 | ||
| @@ -118,7 +128,10 @@ mm_receive_fd(int sock) | |||
| 118 | char ch; | 128 | char ch; |
| 119 | int fd; | 129 | int fd; |
| 120 | #ifndef HAVE_ACCRIGHTS_IN_MSGHDR | 130 | #ifndef HAVE_ACCRIGHTS_IN_MSGHDR |
| 121 | char tmp[CMSG_SPACE(sizeof(int))]; | 131 | union { |
| 132 | struct cmsghdr hdr; | ||
| 133 | char buf[CMSG_SPACE(sizeof(int))]; | ||
| 134 | } cmsgbuf; | ||
| 122 | struct cmsghdr *cmsg; | 135 | struct cmsghdr *cmsg; |
| 123 | #endif | 136 | #endif |
| 124 | 137 | ||
| @@ -131,31 +144,41 @@ mm_receive_fd(int sock) | |||
| 131 | msg.msg_accrights = (caddr_t)&fd; | 144 | msg.msg_accrights = (caddr_t)&fd; |
| 132 | msg.msg_accrightslen = sizeof(fd); | 145 | msg.msg_accrightslen = sizeof(fd); |
| 133 | #else | 146 | #else |
| 134 | msg.msg_control = tmp; | 147 | msg.msg_control = &cmsgbuf.buf; |
| 135 | msg.msg_controllen = sizeof(tmp); | 148 | msg.msg_controllen = sizeof(cmsgbuf.buf); |
| 136 | #endif | 149 | #endif |
| 137 | 150 | ||
| 138 | if ((n = recvmsg(sock, &msg, 0)) == -1) | 151 | if ((n = recvmsg(sock, &msg, 0)) == -1) { |
| 139 | fatal("%s: recvmsg: %s", __func__, strerror(errno)); | 152 | error("%s: recvmsg: %s", __func__, strerror(errno)); |
| 140 | if (n != 1) | 153 | return -1; |
| 141 | fatal("%s: recvmsg: expected received 1 got %ld", | 154 | } |
| 155 | if (n != 1) { | ||
| 156 | error("%s: recvmsg: expected received 1 got %ld", | ||
| 142 | __func__, (long)n); | 157 | __func__, (long)n); |
| 158 | return -1; | ||
| 159 | } | ||
| 143 | 160 | ||
| 144 | #ifdef HAVE_ACCRIGHTS_IN_MSGHDR | 161 | #ifdef HAVE_ACCRIGHTS_IN_MSGHDR |
| 145 | if (msg.msg_accrightslen != sizeof(fd)) | 162 | if (msg.msg_accrightslen != sizeof(fd)) { |
| 146 | fatal("%s: no fd", __func__); | 163 | error("%s: no fd", __func__); |
| 164 | return -1; | ||
| 165 | } | ||
| 147 | #else | 166 | #else |
| 148 | cmsg = CMSG_FIRSTHDR(&msg); | 167 | cmsg = CMSG_FIRSTHDR(&msg); |
| 149 | if (cmsg == NULL) | 168 | if (cmsg == NULL) { |
| 150 | fatal("%s: no message header", __func__); | 169 | error("%s: no message header", __func__); |
| 151 | if (!cmsg_type_is_broken() && cmsg->cmsg_type != SCM_RIGHTS) | 170 | return -1; |
| 152 | fatal("%s: expected type %d got %d", __func__, | 171 | } |
| 172 | if (!cmsg_type_is_broken() && cmsg->cmsg_type != SCM_RIGHTS) { | ||
| 173 | error("%s: expected type %d got %d", __func__, | ||
| 153 | SCM_RIGHTS, cmsg->cmsg_type); | 174 | SCM_RIGHTS, cmsg->cmsg_type); |
| 175 | return -1; | ||
| 176 | } | ||
| 154 | fd = (*(int *)CMSG_DATA(cmsg)); | 177 | fd = (*(int *)CMSG_DATA(cmsg)); |
| 155 | #endif | 178 | #endif |
| 156 | return fd; | 179 | return fd; |
| 157 | #else | 180 | #else |
| 158 | fatal("%s: UsePrivilegeSeparation=yes not supported", | 181 | error("%s: file descriptor passing not supported", __func__); |
| 159 | __func__); | 182 | return -1; |
| 160 | #endif | 183 | #endif |
| 161 | } | 184 | } |
diff --git a/monitor_fdpass.h b/monitor_fdpass.h index 12c67ec2d..a4b1f6358 100644 --- a/monitor_fdpass.h +++ b/monitor_fdpass.h | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: monitor_fdpass.h,v 1.3 2006/03/25 22:22:43 djm Exp $ */ | 1 | /* $OpenBSD: monitor_fdpass.h,v 1.4 2007/09/04 03:21:03 djm Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Copyright 2002 Niels Provos <provos@citi.umich.edu> | 4 | * Copyright 2002 Niels Provos <provos@citi.umich.edu> |
| @@ -28,7 +28,7 @@ | |||
| 28 | #ifndef _MM_FDPASS_H_ | 28 | #ifndef _MM_FDPASS_H_ |
| 29 | #define _MM_FDPASS_H_ | 29 | #define _MM_FDPASS_H_ |
| 30 | 30 | ||
| 31 | void mm_send_fd(int, int); | 31 | int mm_send_fd(int, int); |
| 32 | int mm_receive_fd(int); | 32 | int mm_receive_fd(int); |
| 33 | 33 | ||
| 34 | #endif /* _MM_FDPASS_H_ */ | 34 | #endif /* _MM_FDPASS_H_ */ |
diff --git a/monitor_mm.h b/monitor_mm.h index 36a07a06d..c890f7709 100644 --- a/monitor_mm.h +++ b/monitor_mm.h | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: monitor_mm.h,v 1.4 2006/08/03 03:34:42 deraadt Exp $ */ | 1 | /* $OpenBSD: monitor_mm.h,v 1.5 2008/04/29 11:20:31 otto Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Copyright 2002 Niels Provos <provos@citi.umich.edu> | 4 | * Copyright 2002 Niels Provos <provos@citi.umich.edu> |
| @@ -41,9 +41,6 @@ struct mm_master { | |||
| 41 | size_t size; | 41 | size_t size; |
| 42 | 42 | ||
| 43 | struct mm_master *mmalloc; /* Used to completely share */ | 43 | struct mm_master *mmalloc; /* Used to completely share */ |
| 44 | |||
| 45 | int write; /* used to writing to other party */ | ||
| 46 | int read; /* used for reading from other party */ | ||
| 47 | }; | 44 | }; |
| 48 | 45 | ||
| 49 | RB_PROTOTYPE(mmtree, mm_share, next, mm_compare) | 46 | RB_PROTOTYPE(mmtree, mm_share, next, mm_compare) |
diff --git a/monitor_wrap.c b/monitor_wrap.c index 752af6f93..125f879c5 100644 --- a/monitor_wrap.c +++ b/monitor_wrap.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: monitor_wrap.c,v 1.57 2007/06/07 19:37:34 pvalchev Exp $ */ | 1 | /* $OpenBSD: monitor_wrap.c,v 1.63 2008/07/10 18:08:11 markus Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Copyright 2002 Niels Provos <provos@citi.umich.edu> | 3 | * Copyright 2002 Niels Provos <provos@citi.umich.edu> |
| 4 | * Copyright 2002 Markus Friedl <markus@openbsd.org> | 4 | * Copyright 2002 Markus Friedl <markus@openbsd.org> |
| @@ -41,6 +41,7 @@ | |||
| 41 | #include <openssl/bn.h> | 41 | #include <openssl/bn.h> |
| 42 | #include <openssl/dh.h> | 42 | #include <openssl/dh.h> |
| 43 | 43 | ||
| 44 | #include "openbsd-compat/sys-queue.h" | ||
| 44 | #include "xmalloc.h" | 45 | #include "xmalloc.h" |
| 45 | #include "ssh.h" | 46 | #include "ssh.h" |
| 46 | #include "dh.h" | 47 | #include "dh.h" |
| @@ -222,8 +223,8 @@ mm_getpwnamallow(const char *username) | |||
| 222 | mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PWNAM, &m); | 223 | mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_PWNAM, &m); |
| 223 | 224 | ||
| 224 | if (buffer_get_char(&m) == 0) { | 225 | if (buffer_get_char(&m) == 0) { |
| 225 | buffer_free(&m); | 226 | pw = NULL; |
| 226 | return (NULL); | 227 | goto out; |
| 227 | } | 228 | } |
| 228 | pw = buffer_get_string(&m, &len); | 229 | pw = buffer_get_string(&m, &len); |
| 229 | if (len != sizeof(struct passwd)) | 230 | if (len != sizeof(struct passwd)) |
| @@ -237,6 +238,7 @@ mm_getpwnamallow(const char *username) | |||
| 237 | pw->pw_dir = buffer_get_string(&m, NULL); | 238 | pw->pw_dir = buffer_get_string(&m, NULL); |
| 238 | pw->pw_shell = buffer_get_string(&m, NULL); | 239 | pw->pw_shell = buffer_get_string(&m, NULL); |
| 239 | 240 | ||
| 241 | out: | ||
| 240 | /* copy options block as a Match directive may have changed some */ | 242 | /* copy options block as a Match directive may have changed some */ |
| 241 | newopts = buffer_get_string(&m, &len); | 243 | newopts = buffer_get_string(&m, &len); |
| 242 | if (len != sizeof(*newopts)) | 244 | if (len != sizeof(*newopts)) |
| @@ -589,7 +591,7 @@ mm_send_keystate(struct monitor *monitor) | |||
| 589 | u_char *blob, *p; | 591 | u_char *blob, *p; |
| 590 | u_int bloblen, plen; | 592 | u_int bloblen, plen; |
| 591 | u_int32_t seqnr, packets; | 593 | u_int32_t seqnr, packets; |
| 592 | u_int64_t blocks; | 594 | u_int64_t blocks, bytes; |
| 593 | 595 | ||
| 594 | buffer_init(&m); | 596 | buffer_init(&m); |
| 595 | 597 | ||
| @@ -638,14 +640,16 @@ mm_send_keystate(struct monitor *monitor) | |||
| 638 | buffer_put_string(&m, blob, bloblen); | 640 | buffer_put_string(&m, blob, bloblen); |
| 639 | xfree(blob); | 641 | xfree(blob); |
| 640 | 642 | ||
| 641 | packet_get_state(MODE_OUT, &seqnr, &blocks, &packets); | 643 | packet_get_state(MODE_OUT, &seqnr, &blocks, &packets, &bytes); |
| 642 | buffer_put_int(&m, seqnr); | 644 | buffer_put_int(&m, seqnr); |
| 643 | buffer_put_int64(&m, blocks); | 645 | buffer_put_int64(&m, blocks); |
| 644 | buffer_put_int(&m, packets); | 646 | buffer_put_int(&m, packets); |
| 645 | packet_get_state(MODE_IN, &seqnr, &blocks, &packets); | 647 | buffer_put_int64(&m, bytes); |
| 648 | packet_get_state(MODE_IN, &seqnr, &blocks, &packets, &bytes); | ||
| 646 | buffer_put_int(&m, seqnr); | 649 | buffer_put_int(&m, seqnr); |
| 647 | buffer_put_int64(&m, blocks); | 650 | buffer_put_int64(&m, blocks); |
| 648 | buffer_put_int(&m, packets); | 651 | buffer_put_int(&m, packets); |
| 652 | buffer_put_int64(&m, bytes); | ||
| 649 | 653 | ||
| 650 | debug3("%s: New keys have been sent", __func__); | 654 | debug3("%s: New keys have been sent", __func__); |
| 651 | skip: | 655 | skip: |
| @@ -682,7 +686,20 @@ mm_pty_allocate(int *ptyfd, int *ttyfd, char *namebuf, size_t namebuflen) | |||
| 682 | { | 686 | { |
| 683 | Buffer m; | 687 | Buffer m; |
| 684 | char *p, *msg; | 688 | char *p, *msg; |
| 685 | int success = 0; | 689 | int success = 0, tmp1 = -1, tmp2 = -1; |
| 690 | |||
| 691 | /* Kludge: ensure there are fds free to receive the pty/tty */ | ||
| 692 | if ((tmp1 = dup(pmonitor->m_recvfd)) == -1 || | ||
| 693 | (tmp2 = dup(pmonitor->m_recvfd)) == -1) { | ||
| 694 | error("%s: cannot allocate fds for pty", __func__); | ||
| 695 | if (tmp1 > 0) | ||
| 696 | close(tmp1); | ||
| 697 | if (tmp2 > 0) | ||
| 698 | close(tmp2); | ||
| 699 | return 0; | ||
| 700 | } | ||
| 701 | close(tmp1); | ||
| 702 | close(tmp2); | ||
| 686 | 703 | ||
| 687 | buffer_init(&m); | 704 | buffer_init(&m); |
| 688 | mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PTY, &m); | 705 | mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PTY, &m); |
| @@ -706,8 +723,9 @@ mm_pty_allocate(int *ptyfd, int *ttyfd, char *namebuf, size_t namebuflen) | |||
| 706 | buffer_append(&loginmsg, msg, strlen(msg)); | 723 | buffer_append(&loginmsg, msg, strlen(msg)); |
| 707 | xfree(msg); | 724 | xfree(msg); |
| 708 | 725 | ||
| 709 | *ptyfd = mm_receive_fd(pmonitor->m_recvfd); | 726 | if ((*ptyfd = mm_receive_fd(pmonitor->m_recvfd)) == -1 || |
| 710 | *ttyfd = mm_receive_fd(pmonitor->m_recvfd); | 727 | (*ttyfd = mm_receive_fd(pmonitor->m_recvfd)) == -1) |
| 728 | fatal("%s: receive fds failed", __func__); | ||
| 711 | 729 | ||
| 712 | /* Success */ | 730 | /* Success */ |
| 713 | return (1); | 731 | return (1); |
| @@ -726,8 +744,9 @@ mm_session_pty_cleanup2(Session *s) | |||
| 726 | buffer_free(&m); | 744 | buffer_free(&m); |
| 727 | 745 | ||
| 728 | /* closed dup'ed master */ | 746 | /* closed dup'ed master */ |
| 729 | if (close(s->ptymaster) < 0) | 747 | if (s->ptymaster != -1 && close(s->ptymaster) < 0) |
| 730 | error("close(s->ptymaster): %s", strerror(errno)); | 748 | error("close(s->ptymaster/%d): %s", |
| 749 | s->ptymaster, strerror(errno)); | ||
| 731 | 750 | ||
| 732 | /* unlink pty from session */ | 751 | /* unlink pty from session */ |
| 733 | s->ttyfd = -1; | 752 | s->ttyfd = -1; |
| @@ -0,0 +1,728 @@ | |||
| 1 | /* $OpenBSD: mux.c,v 1.7 2008/06/13 17:21:20 dtucker Exp $ */ | ||
| 2 | /* | ||
| 3 | * Copyright (c) 2002-2008 Damien Miller <djm@openbsd.org> | ||
| 4 | * | ||
| 5 | * Permission to use, copy, modify, and distribute this software for any | ||
| 6 | * purpose with or without fee is hereby granted, provided that the above | ||
| 7 | * copyright notice and this permission notice appear in all copies. | ||
| 8 | * | ||
| 9 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES | ||
| 10 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF | ||
| 11 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR | ||
| 12 | * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES | ||
| 13 | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN | ||
| 14 | * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF | ||
| 15 | * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. | ||
| 16 | */ | ||
| 17 | |||
| 18 | /* ssh session multiplexing support */ | ||
| 19 | |||
| 20 | #include "includes.h" | ||
| 21 | |||
| 22 | /* | ||
| 23 | * TODO: | ||
| 24 | * 1. partial reads in muxserver_accept_control (maybe make channels | ||
| 25 | * from accepted connections) | ||
| 26 | * 2. Better signalling from master to slave, especially passing of | ||
| 27 | * error messages | ||
| 28 | * 3. Better fall-back from mux slave error to new connection. | ||
| 29 | * 3. Add/delete forwardings via slave | ||
| 30 | * 4. ExitOnForwardingFailure (after #3 obviously) | ||
| 31 | * 5. Maybe extension mechanisms for multi-X11/multi-agent forwarding | ||
| 32 | * 6. Document the mux mini-protocol somewhere. | ||
| 33 | * 7. Support ~^Z in mux slaves. | ||
| 34 | * 8. Inspect or control sessions in master. | ||
| 35 | * 9. If we ever support the "signal" channel request, send signals on | ||
| 36 | * sessions in master. | ||
| 37 | */ | ||
| 38 | |||
| 39 | #include <sys/types.h> | ||
| 40 | #include <sys/param.h> | ||
| 41 | #include <sys/stat.h> | ||
| 42 | #include <sys/socket.h> | ||
| 43 | #include <sys/un.h> | ||
| 44 | |||
| 45 | #include <errno.h> | ||
| 46 | #include <fcntl.h> | ||
| 47 | #include <signal.h> | ||
| 48 | #include <stdarg.h> | ||
| 49 | #include <stddef.h> | ||
| 50 | #include <stdlib.h> | ||
| 51 | #include <stdio.h> | ||
| 52 | #include <string.h> | ||
| 53 | #include <unistd.h> | ||
| 54 | #ifdef HAVE_PATHS_H | ||
| 55 | #include <paths.h> | ||
| 56 | #endif | ||
| 57 | |||
| 58 | #ifdef HAVE_UTIL_H | ||
| 59 | # include <util.h> | ||
| 60 | #endif | ||
| 61 | |||
| 62 | #ifdef HAVE_LIBUTIL_H | ||
| 63 | # include <libutil.h> | ||
| 64 | #endif | ||
| 65 | |||
| 66 | #include "openbsd-compat/sys-queue.h" | ||
| 67 | #include "xmalloc.h" | ||
| 68 | #include "log.h" | ||
| 69 | #include "ssh.h" | ||
| 70 | #include "pathnames.h" | ||
| 71 | #include "misc.h" | ||
| 72 | #include "match.h" | ||
| 73 | #include "buffer.h" | ||
| 74 | #include "channels.h" | ||
| 75 | #include "msg.h" | ||
| 76 | #include "packet.h" | ||
| 77 | #include "monitor_fdpass.h" | ||
| 78 | #include "sshpty.h" | ||
| 79 | #include "key.h" | ||
| 80 | #include "readconf.h" | ||
| 81 | #include "clientloop.h" | ||
| 82 | |||
| 83 | /* from ssh.c */ | ||
| 84 | extern int tty_flag; | ||
| 85 | extern Options options; | ||
| 86 | extern int stdin_null_flag; | ||
| 87 | extern char *host; | ||
| 88 | int subsystem_flag; | ||
| 89 | extern Buffer command; | ||
| 90 | |||
| 91 | /* Context for session open confirmation callback */ | ||
| 92 | struct mux_session_confirm_ctx { | ||
| 93 | int want_tty; | ||
| 94 | int want_subsys; | ||
| 95 | int want_x_fwd; | ||
| 96 | int want_agent_fwd; | ||
| 97 | Buffer cmd; | ||
| 98 | char *term; | ||
| 99 | struct termios tio; | ||
| 100 | char **env; | ||
| 101 | }; | ||
| 102 | |||
| 103 | /* fd to control socket */ | ||
| 104 | int muxserver_sock = -1; | ||
| 105 | |||
| 106 | /* Multiplexing control command */ | ||
| 107 | u_int muxclient_command = 0; | ||
| 108 | |||
| 109 | /* Set when signalled. */ | ||
| 110 | static volatile sig_atomic_t muxclient_terminate = 0; | ||
| 111 | |||
| 112 | /* PID of multiplex server */ | ||
| 113 | static u_int muxserver_pid = 0; | ||
| 114 | |||
| 115 | |||
| 116 | /* ** Multiplexing master support */ | ||
| 117 | |||
| 118 | /* Prepare a mux master to listen on a Unix domain socket. */ | ||
| 119 | void | ||
| 120 | muxserver_listen(void) | ||
| 121 | { | ||
| 122 | struct sockaddr_un addr; | ||
| 123 | mode_t old_umask; | ||
| 124 | int addr_len; | ||
| 125 | |||
| 126 | if (options.control_path == NULL || | ||
| 127 | options.control_master == SSHCTL_MASTER_NO) | ||
| 128 | return; | ||
| 129 | |||
| 130 | debug("setting up multiplex master socket"); | ||
| 131 | |||
| 132 | memset(&addr, '\0', sizeof(addr)); | ||
| 133 | addr.sun_family = AF_UNIX; | ||
| 134 | addr_len = offsetof(struct sockaddr_un, sun_path) + | ||
| 135 | strlen(options.control_path) + 1; | ||
| 136 | |||
| 137 | if (strlcpy(addr.sun_path, options.control_path, | ||
| 138 | sizeof(addr.sun_path)) >= sizeof(addr.sun_path)) | ||
| 139 | fatal("ControlPath too long"); | ||
| 140 | |||
| 141 | if ((muxserver_sock = socket(PF_UNIX, SOCK_STREAM, 0)) < 0) | ||
| 142 | fatal("%s socket(): %s", __func__, strerror(errno)); | ||
| 143 | |||
| 144 | old_umask = umask(0177); | ||
| 145 | if (bind(muxserver_sock, (struct sockaddr *)&addr, addr_len) == -1) { | ||
| 146 | muxserver_sock = -1; | ||
| 147 | if (errno == EINVAL || errno == EADDRINUSE) { | ||
| 148 | error("ControlSocket %s already exists, " | ||
| 149 | "disabling multiplexing", options.control_path); | ||
| 150 | close(muxserver_sock); | ||
| 151 | muxserver_sock = -1; | ||
| 152 | xfree(options.control_path); | ||
| 153 | options.control_path = NULL; | ||
| 154 | options.control_master = SSHCTL_MASTER_NO; | ||
| 155 | return; | ||
| 156 | } else | ||
| 157 | fatal("%s bind(): %s", __func__, strerror(errno)); | ||
| 158 | } | ||
| 159 | umask(old_umask); | ||
| 160 | |||
| 161 | if (listen(muxserver_sock, 64) == -1) | ||
| 162 | fatal("%s listen(): %s", __func__, strerror(errno)); | ||
| 163 | |||
| 164 | set_nonblock(muxserver_sock); | ||
| 165 | } | ||
| 166 | |||
| 167 | /* Callback on open confirmation in mux master for a mux client session. */ | ||
| 168 | static void | ||
| 169 | mux_session_confirm(int id, void *arg) | ||
| 170 | { | ||
| 171 | struct mux_session_confirm_ctx *cctx = arg; | ||
| 172 | const char *display; | ||
| 173 | Channel *c; | ||
| 174 | int i; | ||
| 175 | |||
| 176 | if (cctx == NULL) | ||
| 177 | fatal("%s: cctx == NULL", __func__); | ||
| 178 | if ((c = channel_lookup(id)) == NULL) | ||
| 179 | fatal("%s: no channel for id %d", __func__, id); | ||
| 180 | |||
| 181 | display = getenv("DISPLAY"); | ||
| 182 | if (cctx->want_x_fwd && options.forward_x11 && display != NULL) { | ||
| 183 | char *proto, *data; | ||
| 184 | /* Get reasonable local authentication information. */ | ||
| 185 | client_x11_get_proto(display, options.xauth_location, | ||
| 186 | options.forward_x11_trusted, &proto, &data); | ||
| 187 | /* Request forwarding with authentication spoofing. */ | ||
| 188 | debug("Requesting X11 forwarding with authentication spoofing."); | ||
| 189 | x11_request_forwarding_with_spoofing(id, display, proto, data); | ||
| 190 | /* XXX wait for reply */ | ||
| 191 | } | ||
| 192 | |||
| 193 | if (cctx->want_agent_fwd && options.forward_agent) { | ||
| 194 | debug("Requesting authentication agent forwarding."); | ||
| 195 | channel_request_start(id, "auth-agent-req@openssh.com", 0); | ||
| 196 | packet_send(); | ||
| 197 | } | ||
| 198 | |||
| 199 | client_session2_setup(id, cctx->want_tty, cctx->want_subsys, | ||
| 200 | cctx->term, &cctx->tio, c->rfd, &cctx->cmd, cctx->env); | ||
| 201 | |||
| 202 | c->open_confirm_ctx = NULL; | ||
| 203 | buffer_free(&cctx->cmd); | ||
| 204 | xfree(cctx->term); | ||
| 205 | if (cctx->env != NULL) { | ||
| 206 | for (i = 0; cctx->env[i] != NULL; i++) | ||
| 207 | xfree(cctx->env[i]); | ||
| 208 | xfree(cctx->env); | ||
| 209 | } | ||
| 210 | xfree(cctx); | ||
| 211 | } | ||
| 212 | |||
| 213 | /* | ||
| 214 | * Accept a connection on the mux master socket and process the | ||
| 215 | * client's request. Returns flag indicating whether mux master should | ||
| 216 | * begin graceful close. | ||
| 217 | */ | ||
| 218 | int | ||
| 219 | muxserver_accept_control(void) | ||
| 220 | { | ||
| 221 | Buffer m; | ||
| 222 | Channel *c; | ||
| 223 | int client_fd, new_fd[3], ver, allowed, window, packetmax; | ||
| 224 | socklen_t addrlen; | ||
| 225 | struct sockaddr_storage addr; | ||
| 226 | struct mux_session_confirm_ctx *cctx; | ||
| 227 | char *cmd; | ||
| 228 | u_int i, j, len, env_len, mux_command, flags, escape_char; | ||
| 229 | uid_t euid; | ||
| 230 | gid_t egid; | ||
| 231 | int start_close = 0; | ||
| 232 | |||
| 233 | /* | ||
| 234 | * Accept connection on control socket | ||
| 235 | */ | ||
| 236 | memset(&addr, 0, sizeof(addr)); | ||
| 237 | addrlen = sizeof(addr); | ||
| 238 | if ((client_fd = accept(muxserver_sock, | ||
| 239 | (struct sockaddr*)&addr, &addrlen)) == -1) { | ||
| 240 | error("%s accept: %s", __func__, strerror(errno)); | ||
| 241 | return 0; | ||
| 242 | } | ||
| 243 | |||
| 244 | if (getpeereid(client_fd, &euid, &egid) < 0) { | ||
| 245 | error("%s getpeereid failed: %s", __func__, strerror(errno)); | ||
| 246 | close(client_fd); | ||
| 247 | return 0; | ||
| 248 | } | ||
| 249 | if ((euid != 0) && (getuid() != euid)) { | ||
| 250 | error("control mode uid mismatch: peer euid %u != uid %u", | ||
| 251 | (u_int) euid, (u_int) getuid()); | ||
| 252 | close(client_fd); | ||
| 253 | return 0; | ||
| 254 | } | ||
| 255 | |||
| 256 | /* XXX handle asynchronously */ | ||
| 257 | unset_nonblock(client_fd); | ||
| 258 | |||
| 259 | /* Read command */ | ||
| 260 | buffer_init(&m); | ||
| 261 | if (ssh_msg_recv(client_fd, &m) == -1) { | ||
| 262 | error("%s: client msg_recv failed", __func__); | ||
| 263 | close(client_fd); | ||
| 264 | buffer_free(&m); | ||
| 265 | return 0; | ||
| 266 | } | ||
| 267 | if ((ver = buffer_get_char(&m)) != SSHMUX_VER) { | ||
| 268 | error("%s: wrong client version %d", __func__, ver); | ||
| 269 | buffer_free(&m); | ||
| 270 | close(client_fd); | ||
| 271 | return 0; | ||
| 272 | } | ||
| 273 | |||
| 274 | allowed = 1; | ||
| 275 | mux_command = buffer_get_int(&m); | ||
| 276 | flags = buffer_get_int(&m); | ||
| 277 | |||
| 278 | buffer_clear(&m); | ||
| 279 | |||
| 280 | switch (mux_command) { | ||
| 281 | case SSHMUX_COMMAND_OPEN: | ||
| 282 | if (options.control_master == SSHCTL_MASTER_ASK || | ||
| 283 | options.control_master == SSHCTL_MASTER_AUTO_ASK) | ||
| 284 | allowed = ask_permission("Allow shared connection " | ||
| 285 | "to %s? ", host); | ||
| 286 | /* continue below */ | ||
| 287 | break; | ||
| 288 | case SSHMUX_COMMAND_TERMINATE: | ||
| 289 | if (options.control_master == SSHCTL_MASTER_ASK || | ||
| 290 | options.control_master == SSHCTL_MASTER_AUTO_ASK) | ||
| 291 | allowed = ask_permission("Terminate shared connection " | ||
| 292 | "to %s? ", host); | ||
| 293 | if (allowed) | ||
| 294 | start_close = 1; | ||
| 295 | /* FALLTHROUGH */ | ||
| 296 | case SSHMUX_COMMAND_ALIVE_CHECK: | ||
| 297 | /* Reply for SSHMUX_COMMAND_TERMINATE and ALIVE_CHECK */ | ||
| 298 | buffer_clear(&m); | ||
| 299 | buffer_put_int(&m, allowed); | ||
| 300 | buffer_put_int(&m, getpid()); | ||
| 301 | if (ssh_msg_send(client_fd, SSHMUX_VER, &m) == -1) { | ||
| 302 | error("%s: client msg_send failed", __func__); | ||
| 303 | close(client_fd); | ||
| 304 | buffer_free(&m); | ||
| 305 | return start_close; | ||
| 306 | } | ||
| 307 | buffer_free(&m); | ||
| 308 | close(client_fd); | ||
| 309 | return start_close; | ||
| 310 | default: | ||
| 311 | error("Unsupported command %d", mux_command); | ||
| 312 | buffer_free(&m); | ||
| 313 | close(client_fd); | ||
| 314 | return 0; | ||
| 315 | } | ||
| 316 | |||
| 317 | /* Reply for SSHMUX_COMMAND_OPEN */ | ||
| 318 | buffer_clear(&m); | ||
| 319 | buffer_put_int(&m, allowed); | ||
| 320 | buffer_put_int(&m, getpid()); | ||
| 321 | if (ssh_msg_send(client_fd, SSHMUX_VER, &m) == -1) { | ||
| 322 | error("%s: client msg_send failed", __func__); | ||
| 323 | close(client_fd); | ||
| 324 | buffer_free(&m); | ||
| 325 | return 0; | ||
| 326 | } | ||
| 327 | |||
| 328 | if (!allowed) { | ||
| 329 | error("Refused control connection"); | ||
| 330 | close(client_fd); | ||
| 331 | buffer_free(&m); | ||
| 332 | return 0; | ||
| 333 | } | ||
| 334 | |||
| 335 | buffer_clear(&m); | ||
| 336 | if (ssh_msg_recv(client_fd, &m) == -1) { | ||
| 337 | error("%s: client msg_recv failed", __func__); | ||
| 338 | close(client_fd); | ||
| 339 | buffer_free(&m); | ||
| 340 | return 0; | ||
| 341 | } | ||
| 342 | if ((ver = buffer_get_char(&m)) != SSHMUX_VER) { | ||
| 343 | error("%s: wrong client version %d", __func__, ver); | ||
| 344 | buffer_free(&m); | ||
| 345 | close(client_fd); | ||
| 346 | return 0; | ||
| 347 | } | ||
| 348 | |||
| 349 | cctx = xcalloc(1, sizeof(*cctx)); | ||
| 350 | cctx->want_tty = (flags & SSHMUX_FLAG_TTY) != 0; | ||
| 351 | cctx->want_subsys = (flags & SSHMUX_FLAG_SUBSYS) != 0; | ||
| 352 | cctx->want_x_fwd = (flags & SSHMUX_FLAG_X11_FWD) != 0; | ||
| 353 | cctx->want_agent_fwd = (flags & SSHMUX_FLAG_AGENT_FWD) != 0; | ||
| 354 | cctx->term = buffer_get_string(&m, &len); | ||
| 355 | escape_char = buffer_get_int(&m); | ||
| 356 | |||
| 357 | cmd = buffer_get_string(&m, &len); | ||
| 358 | buffer_init(&cctx->cmd); | ||
| 359 | buffer_append(&cctx->cmd, cmd, strlen(cmd)); | ||
| 360 | |||
| 361 | env_len = buffer_get_int(&m); | ||
| 362 | env_len = MIN(env_len, 4096); | ||
| 363 | debug3("%s: receiving %d env vars", __func__, env_len); | ||
| 364 | if (env_len != 0) { | ||
| 365 | cctx->env = xcalloc(env_len + 1, sizeof(*cctx->env)); | ||
| 366 | for (i = 0; i < env_len; i++) | ||
| 367 | cctx->env[i] = buffer_get_string(&m, &len); | ||
| 368 | cctx->env[i] = NULL; | ||
| 369 | } | ||
| 370 | |||
| 371 | debug2("%s: accepted tty %d, subsys %d, cmd %s", __func__, | ||
| 372 | cctx->want_tty, cctx->want_subsys, cmd); | ||
| 373 | xfree(cmd); | ||
| 374 | |||
| 375 | /* Gather fds from client */ | ||
| 376 | for(i = 0; i < 3; i++) { | ||
| 377 | if ((new_fd[i] = mm_receive_fd(client_fd)) == -1) { | ||
| 378 | error("%s: failed to receive fd %d from slave", | ||
| 379 | __func__, i); | ||
| 380 | for (j = 0; j < i; j++) | ||
| 381 | close(new_fd[j]); | ||
| 382 | for (j = 0; j < env_len; j++) | ||
| 383 | xfree(cctx->env[j]); | ||
| 384 | if (env_len > 0) | ||
| 385 | xfree(cctx->env); | ||
| 386 | xfree(cctx->term); | ||
| 387 | buffer_free(&cctx->cmd); | ||
| 388 | close(client_fd); | ||
| 389 | xfree(cctx); | ||
| 390 | return 0; | ||
| 391 | } | ||
| 392 | } | ||
| 393 | |||
| 394 | debug2("%s: got fds stdin %d, stdout %d, stderr %d", __func__, | ||
| 395 | new_fd[0], new_fd[1], new_fd[2]); | ||
| 396 | |||
| 397 | /* Try to pick up ttymodes from client before it goes raw */ | ||
| 398 | if (cctx->want_tty && tcgetattr(new_fd[0], &cctx->tio) == -1) | ||
| 399 | error("%s: tcgetattr: %s", __func__, strerror(errno)); | ||
| 400 | |||
| 401 | /* This roundtrip is just for synchronisation of ttymodes */ | ||
| 402 | buffer_clear(&m); | ||
| 403 | if (ssh_msg_send(client_fd, SSHMUX_VER, &m) == -1) { | ||
| 404 | error("%s: client msg_send failed", __func__); | ||
| 405 | close(client_fd); | ||
| 406 | close(new_fd[0]); | ||
| 407 | close(new_fd[1]); | ||
| 408 | close(new_fd[2]); | ||
| 409 | buffer_free(&m); | ||
| 410 | xfree(cctx->term); | ||
| 411 | if (env_len != 0) { | ||
| 412 | for (i = 0; i < env_len; i++) | ||
| 413 | xfree(cctx->env[i]); | ||
| 414 | xfree(cctx->env); | ||
| 415 | } | ||
| 416 | return 0; | ||
| 417 | } | ||
| 418 | buffer_free(&m); | ||
| 419 | |||
| 420 | /* enable nonblocking unless tty */ | ||
| 421 | if (!isatty(new_fd[0])) | ||
| 422 | set_nonblock(new_fd[0]); | ||
| 423 | if (!isatty(new_fd[1])) | ||
| 424 | set_nonblock(new_fd[1]); | ||
| 425 | if (!isatty(new_fd[2])) | ||
| 426 | set_nonblock(new_fd[2]); | ||
| 427 | |||
| 428 | set_nonblock(client_fd); | ||
| 429 | |||
| 430 | window = CHAN_SES_WINDOW_DEFAULT; | ||
| 431 | packetmax = CHAN_SES_PACKET_DEFAULT; | ||
| 432 | if (cctx->want_tty) { | ||
| 433 | window >>= 1; | ||
| 434 | packetmax >>= 1; | ||
| 435 | } | ||
| 436 | |||
| 437 | c = channel_new("session", SSH_CHANNEL_OPENING, | ||
| 438 | new_fd[0], new_fd[1], new_fd[2], window, packetmax, | ||
| 439 | CHAN_EXTENDED_WRITE, "client-session", /*nonblock*/0); | ||
| 440 | |||
| 441 | c->ctl_fd = client_fd; | ||
| 442 | if (cctx->want_tty && escape_char != 0xffffffff) { | ||
| 443 | channel_register_filter(c->self, | ||
| 444 | client_simple_escape_filter, NULL, | ||
| 445 | client_filter_cleanup, | ||
| 446 | client_new_escape_filter_ctx((int)escape_char)); | ||
| 447 | } | ||
| 448 | |||
| 449 | debug3("%s: channel_new: %d", __func__, c->self); | ||
| 450 | |||
| 451 | channel_send_open(c->self); | ||
| 452 | channel_register_open_confirm(c->self, mux_session_confirm, cctx); | ||
| 453 | return 0; | ||
| 454 | } | ||
| 455 | |||
| 456 | /* ** Multiplexing client support */ | ||
| 457 | |||
| 458 | /* Exit signal handler */ | ||
| 459 | static void | ||
| 460 | control_client_sighandler(int signo) | ||
| 461 | { | ||
| 462 | muxclient_terminate = signo; | ||
| 463 | } | ||
| 464 | |||
| 465 | /* | ||
| 466 | * Relay signal handler - used to pass some signals from mux client to | ||
| 467 | * mux master. | ||
| 468 | */ | ||
| 469 | static void | ||
| 470 | control_client_sigrelay(int signo) | ||
| 471 | { | ||
| 472 | int save_errno = errno; | ||
| 473 | |||
| 474 | if (muxserver_pid > 1) | ||
| 475 | kill(muxserver_pid, signo); | ||
| 476 | |||
| 477 | errno = save_errno; | ||
| 478 | } | ||
| 479 | |||
| 480 | /* Check mux client environment variables before passing them to mux master. */ | ||
| 481 | static int | ||
| 482 | env_permitted(char *env) | ||
| 483 | { | ||
| 484 | int i, ret; | ||
| 485 | char name[1024], *cp; | ||
| 486 | |||
| 487 | if ((cp = strchr(env, '=')) == NULL || cp == env) | ||
| 488 | return (0); | ||
| 489 | ret = snprintf(name, sizeof(name), "%.*s", (int)(cp - env), env); | ||
| 490 | if (ret <= 0 || (size_t)ret >= sizeof(name)) | ||
| 491 | fatal("env_permitted: name '%.100s...' too long", env); | ||
| 492 | |||
| 493 | for (i = 0; i < options.num_send_env; i++) | ||
| 494 | if (match_pattern(name, options.send_env[i])) | ||
| 495 | return (1); | ||
| 496 | |||
| 497 | return (0); | ||
| 498 | } | ||
| 499 | |||
| 500 | /* Multiplex client main loop. */ | ||
| 501 | void | ||
| 502 | muxclient(const char *path) | ||
| 503 | { | ||
| 504 | struct sockaddr_un addr; | ||
| 505 | int i, r, fd, sock, exitval[2], num_env, addr_len; | ||
| 506 | Buffer m; | ||
| 507 | char *term; | ||
| 508 | extern char **environ; | ||
| 509 | u_int allowed, flags; | ||
| 510 | |||
| 511 | if (muxclient_command == 0) | ||
| 512 | muxclient_command = SSHMUX_COMMAND_OPEN; | ||
| 513 | |||
| 514 | switch (options.control_master) { | ||
| 515 | case SSHCTL_MASTER_AUTO: | ||
| 516 | case SSHCTL_MASTER_AUTO_ASK: | ||
| 517 | debug("auto-mux: Trying existing master"); | ||
| 518 | /* FALLTHROUGH */ | ||
| 519 | case SSHCTL_MASTER_NO: | ||
| 520 | break; | ||
| 521 | default: | ||
| 522 | return; | ||
| 523 | } | ||
| 524 | |||
| 525 | memset(&addr, '\0', sizeof(addr)); | ||
| 526 | addr.sun_family = AF_UNIX; | ||
| 527 | addr_len = offsetof(struct sockaddr_un, sun_path) + | ||
| 528 | strlen(path) + 1; | ||
| 529 | |||
| 530 | if (strlcpy(addr.sun_path, path, | ||
| 531 | sizeof(addr.sun_path)) >= sizeof(addr.sun_path)) | ||
| 532 | fatal("ControlPath too long"); | ||
| 533 | |||
| 534 | if ((sock = socket(PF_UNIX, SOCK_STREAM, 0)) < 0) | ||
| 535 | fatal("%s socket(): %s", __func__, strerror(errno)); | ||
| 536 | |||
| 537 | if (connect(sock, (struct sockaddr *)&addr, addr_len) == -1) { | ||
| 538 | if (muxclient_command != SSHMUX_COMMAND_OPEN) { | ||
| 539 | fatal("Control socket connect(%.100s): %s", path, | ||
| 540 | strerror(errno)); | ||
| 541 | } | ||
| 542 | if (errno == ENOENT) | ||
| 543 | debug("Control socket \"%.100s\" does not exist", path); | ||
| 544 | else { | ||
| 545 | error("Control socket connect(%.100s): %s", path, | ||
| 546 | strerror(errno)); | ||
| 547 | } | ||
| 548 | close(sock); | ||
| 549 | return; | ||
| 550 | } | ||
| 551 | |||
| 552 | if (stdin_null_flag) { | ||
| 553 | if ((fd = open(_PATH_DEVNULL, O_RDONLY)) == -1) | ||
| 554 | fatal("open(/dev/null): %s", strerror(errno)); | ||
| 555 | if (dup2(fd, STDIN_FILENO) == -1) | ||
| 556 | fatal("dup2: %s", strerror(errno)); | ||
| 557 | if (fd > STDERR_FILENO) | ||
| 558 | close(fd); | ||
| 559 | } | ||
| 560 | |||
| 561 | term = getenv("TERM"); | ||
| 562 | |||
| 563 | flags = 0; | ||
| 564 | if (tty_flag) | ||
| 565 | flags |= SSHMUX_FLAG_TTY; | ||
| 566 | if (subsystem_flag) | ||
| 567 | flags |= SSHMUX_FLAG_SUBSYS; | ||
| 568 | if (options.forward_x11) | ||
| 569 | flags |= SSHMUX_FLAG_X11_FWD; | ||
| 570 | if (options.forward_agent) | ||
| 571 | flags |= SSHMUX_FLAG_AGENT_FWD; | ||
| 572 | |||
| 573 | signal(SIGPIPE, SIG_IGN); | ||
| 574 | |||
| 575 | buffer_init(&m); | ||
| 576 | |||
| 577 | /* Send our command to server */ | ||
| 578 | buffer_put_int(&m, muxclient_command); | ||
| 579 | buffer_put_int(&m, flags); | ||
| 580 | if (ssh_msg_send(sock, SSHMUX_VER, &m) == -1) { | ||
| 581 | error("%s: msg_send", __func__); | ||
| 582 | muxerr: | ||
| 583 | close(sock); | ||
| 584 | buffer_free(&m); | ||
| 585 | if (muxclient_command != SSHMUX_COMMAND_OPEN) | ||
| 586 | cleanup_exit(255); | ||
| 587 | logit("Falling back to non-multiplexed connection"); | ||
| 588 | xfree(options.control_path); | ||
| 589 | options.control_path = NULL; | ||
| 590 | options.control_master = SSHCTL_MASTER_NO; | ||
| 591 | return; | ||
| 592 | } | ||
| 593 | buffer_clear(&m); | ||
| 594 | |||
| 595 | /* Get authorisation status and PID of controlee */ | ||
| 596 | if (ssh_msg_recv(sock, &m) == -1) { | ||
| 597 | error("%s: Did not receive reply from master", __func__); | ||
| 598 | goto muxerr; | ||
| 599 | } | ||
| 600 | if (buffer_get_char(&m) != SSHMUX_VER) { | ||
| 601 | error("%s: Master replied with wrong version", __func__); | ||
| 602 | goto muxerr; | ||
| 603 | } | ||
| 604 | if (buffer_get_int_ret(&allowed, &m) != 0) { | ||
| 605 | error("%s: bad server reply", __func__); | ||
| 606 | goto muxerr; | ||
| 607 | } | ||
| 608 | if (allowed != 1) { | ||
| 609 | error("Connection to master denied"); | ||
| 610 | goto muxerr; | ||
| 611 | } | ||
| 612 | muxserver_pid = buffer_get_int(&m); | ||
| 613 | |||
| 614 | buffer_clear(&m); | ||
| 615 | |||
| 616 | switch (muxclient_command) { | ||
| 617 | case SSHMUX_COMMAND_ALIVE_CHECK: | ||
| 618 | fprintf(stderr, "Master running (pid=%d)\r\n", | ||
| 619 | muxserver_pid); | ||
| 620 | exit(0); | ||
| 621 | case SSHMUX_COMMAND_TERMINATE: | ||
| 622 | fprintf(stderr, "Exit request sent.\r\n"); | ||
| 623 | exit(0); | ||
| 624 | case SSHMUX_COMMAND_OPEN: | ||
| 625 | buffer_put_cstring(&m, term ? term : ""); | ||
| 626 | if (options.escape_char == SSH_ESCAPECHAR_NONE) | ||
| 627 | buffer_put_int(&m, 0xffffffff); | ||
| 628 | else | ||
| 629 | buffer_put_int(&m, options.escape_char); | ||
| 630 | buffer_append(&command, "\0", 1); | ||
| 631 | buffer_put_cstring(&m, buffer_ptr(&command)); | ||
| 632 | |||
| 633 | if (options.num_send_env == 0 || environ == NULL) { | ||
| 634 | buffer_put_int(&m, 0); | ||
| 635 | } else { | ||
| 636 | /* Pass environment */ | ||
| 637 | num_env = 0; | ||
| 638 | for (i = 0; environ[i] != NULL; i++) { | ||
| 639 | if (env_permitted(environ[i])) | ||
| 640 | num_env++; /* Count */ | ||
| 641 | } | ||
| 642 | buffer_put_int(&m, num_env); | ||
| 643 | for (i = 0; environ[i] != NULL && num_env >= 0; i++) { | ||
| 644 | if (env_permitted(environ[i])) { | ||
| 645 | num_env--; | ||
| 646 | buffer_put_cstring(&m, environ[i]); | ||
| 647 | } | ||
| 648 | } | ||
| 649 | } | ||
| 650 | break; | ||
| 651 | default: | ||
| 652 | fatal("unrecognised muxclient_command %d", muxclient_command); | ||
| 653 | } | ||
| 654 | |||
| 655 | if (ssh_msg_send(sock, SSHMUX_VER, &m) == -1) { | ||
| 656 | error("%s: msg_send", __func__); | ||
| 657 | goto muxerr; | ||
| 658 | } | ||
| 659 | |||
| 660 | if (mm_send_fd(sock, STDIN_FILENO) == -1 || | ||
| 661 | mm_send_fd(sock, STDOUT_FILENO) == -1 || | ||
| 662 | mm_send_fd(sock, STDERR_FILENO) == -1) { | ||
| 663 | error("%s: send fds failed", __func__); | ||
| 664 | goto muxerr; | ||
| 665 | } | ||
| 666 | |||
| 667 | /* | ||
| 668 | * Mux errors are non-recoverable from this point as the master | ||
| 669 | * has ownership of the session now. | ||
| 670 | */ | ||
| 671 | |||
| 672 | /* Wait for reply, so master has a chance to gather ttymodes */ | ||
| 673 | buffer_clear(&m); | ||
| 674 | if (ssh_msg_recv(sock, &m) == -1) | ||
| 675 | fatal("%s: msg_recv", __func__); | ||
| 676 | if (buffer_get_char(&m) != SSHMUX_VER) | ||
| 677 | fatal("%s: wrong version", __func__); | ||
| 678 | buffer_free(&m); | ||
| 679 | |||
| 680 | signal(SIGHUP, control_client_sighandler); | ||
| 681 | signal(SIGINT, control_client_sighandler); | ||
| 682 | signal(SIGTERM, control_client_sighandler); | ||
| 683 | signal(SIGWINCH, control_client_sigrelay); | ||
| 684 | |||
| 685 | if (tty_flag) | ||
| 686 | enter_raw_mode(); | ||
| 687 | |||
| 688 | /* | ||
| 689 | * Stick around until the controlee closes the client_fd. | ||
| 690 | * Before it does, it is expected to write this process' exit | ||
| 691 | * value (one int). This process must read the value and wait for | ||
| 692 | * the closure of the client_fd; if this one closes early, the | ||
| 693 | * multiplex master will terminate early too (possibly losing data). | ||
| 694 | */ | ||
| 695 | exitval[0] = 0; | ||
| 696 | for (i = 0; !muxclient_terminate && i < (int)sizeof(exitval);) { | ||
| 697 | r = read(sock, (char *)exitval + i, sizeof(exitval) - i); | ||
| 698 | if (r == 0) { | ||
| 699 | debug2("Received EOF from master"); | ||
| 700 | break; | ||
| 701 | } | ||
| 702 | if (r == -1) { | ||
| 703 | if (errno == EINTR) | ||
| 704 | continue; | ||
| 705 | fatal("%s: read %s", __func__, strerror(errno)); | ||
| 706 | } | ||
| 707 | i += r; | ||
| 708 | } | ||
| 709 | |||
| 710 | close(sock); | ||
| 711 | leave_raw_mode(); | ||
| 712 | if (i > (int)sizeof(int)) | ||
| 713 | fatal("%s: master returned too much data (%d > %lu)", | ||
| 714 | __func__, i, (u_long)sizeof(int)); | ||
| 715 | if (muxclient_terminate) { | ||
| 716 | debug2("Exiting on signal %d", muxclient_terminate); | ||
| 717 | exitval[0] = 255; | ||
| 718 | } else if (i < (int)sizeof(int)) { | ||
| 719 | debug2("Control master terminated unexpectedly"); | ||
| 720 | exitval[0] = 255; | ||
| 721 | } else | ||
| 722 | debug2("Received exit status from master %d", exitval[0]); | ||
| 723 | |||
| 724 | if (tty_flag && options.log_level > SYSLOG_LEVEL_QUIET) | ||
| 725 | fprintf(stderr, "Shared connection to %s closed.\r\n", host); | ||
| 726 | |||
| 727 | exit(exitval[0]); | ||
| 728 | } | ||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: nchan.c,v 1.57 2006/08/03 03:34:42 deraadt Exp $ */ | 1 | /* $OpenBSD: nchan.c,v 1.60 2008/06/30 12:16:02 djm Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl. All rights reserved. | 3 | * Copyright (c) 1999, 2000, 2001, 2002 Markus Friedl. All rights reserved. |
| 4 | * | 4 | * |
| @@ -32,6 +32,7 @@ | |||
| 32 | #include <string.h> | 32 | #include <string.h> |
| 33 | #include <stdarg.h> | 33 | #include <stdarg.h> |
| 34 | 34 | ||
| 35 | #include "openbsd-compat/sys-queue.h" | ||
| 35 | #include "ssh1.h" | 36 | #include "ssh1.h" |
| 36 | #include "ssh2.h" | 37 | #include "ssh2.h" |
| 37 | #include "buffer.h" | 38 | #include "buffer.h" |
| @@ -77,6 +78,7 @@ static void chan_send_ieof1(Channel *); | |||
| 77 | static void chan_send_oclose1(Channel *); | 78 | static void chan_send_oclose1(Channel *); |
| 78 | static void chan_send_close2(Channel *); | 79 | static void chan_send_close2(Channel *); |
| 79 | static void chan_send_eof2(Channel *); | 80 | static void chan_send_eof2(Channel *); |
| 81 | static void chan_send_eow2(Channel *); | ||
| 80 | 82 | ||
| 81 | /* helper */ | 83 | /* helper */ |
| 82 | static void chan_shutdown_write(Channel *); | 84 | static void chan_shutdown_write(Channel *); |
| @@ -305,6 +307,17 @@ chan_rcvd_close2(Channel *c) | |||
| 305 | break; | 307 | break; |
| 306 | } | 308 | } |
| 307 | } | 309 | } |
| 310 | void | ||
| 311 | chan_rcvd_eow(Channel *c) | ||
| 312 | { | ||
| 313 | debug2("channel %d: rcvd eow", c->self); | ||
| 314 | switch (c->istate) { | ||
| 315 | case CHAN_INPUT_OPEN: | ||
| 316 | chan_shutdown_read(c); | ||
| 317 | chan_set_istate(c, CHAN_INPUT_CLOSED); | ||
| 318 | break; | ||
| 319 | } | ||
| 320 | } | ||
| 308 | static void | 321 | static void |
| 309 | chan_rcvd_eof2(Channel *c) | 322 | chan_rcvd_eof2(Channel *c) |
| 310 | { | 323 | { |
| @@ -321,6 +334,8 @@ chan_write_failed2(Channel *c) | |||
| 321 | case CHAN_OUTPUT_OPEN: | 334 | case CHAN_OUTPUT_OPEN: |
| 322 | case CHAN_OUTPUT_WAIT_DRAIN: | 335 | case CHAN_OUTPUT_WAIT_DRAIN: |
| 323 | chan_shutdown_write(c); | 336 | chan_shutdown_write(c); |
| 337 | if (strcmp(c->ctype, "session") == 0) | ||
| 338 | chan_send_eow2(c); | ||
| 324 | chan_set_ostate(c, CHAN_OUTPUT_CLOSED); | 339 | chan_set_ostate(c, CHAN_OUTPUT_CLOSED); |
| 325 | break; | 340 | break; |
| 326 | default: | 341 | default: |
| @@ -363,6 +378,21 @@ chan_send_close2(Channel *c) | |||
| 363 | c->flags |= CHAN_CLOSE_SENT; | 378 | c->flags |= CHAN_CLOSE_SENT; |
| 364 | } | 379 | } |
| 365 | } | 380 | } |
| 381 | static void | ||
| 382 | chan_send_eow2(Channel *c) | ||
| 383 | { | ||
| 384 | debug2("channel %d: send eow", c->self); | ||
| 385 | if (c->ostate == CHAN_OUTPUT_CLOSED) { | ||
| 386 | error("channel %d: must not sent eow on closed output", | ||
| 387 | c->self); | ||
| 388 | return; | ||
| 389 | } | ||
| 390 | packet_start(SSH2_MSG_CHANNEL_REQUEST); | ||
| 391 | packet_put_int(c->remote_id); | ||
| 392 | packet_put_cstring("eow@openssh.com"); | ||
| 393 | packet_put_char(0); | ||
| 394 | packet_send(); | ||
| 395 | } | ||
| 366 | 396 | ||
| 367 | /* shared */ | 397 | /* shared */ |
| 368 | 398 | ||
| @@ -1,4 +1,4 @@ | |||
| 1 | .\" $OpenBSD: nchan2.ms,v 1.3 2003/11/21 11:57:03 djm Exp $ | 1 | .\" $OpenBSD: nchan2.ms,v 1.4 2008/05/15 23:52:24 djm Exp $ |
| 2 | .\" | 2 | .\" |
| 3 | .\" Copyright (c) 2000 Markus Friedl. All rights reserved. | 3 | .\" Copyright (c) 2000 Markus Friedl. All rights reserved. |
| 4 | .\" | 4 | .\" |
| @@ -44,7 +44,7 @@ arrow from S1.e to S4.n | |||
| 44 | box invis "rcvd CLOSE/" "shutdown_read" with .sw at last arrow.c | 44 | box invis "rcvd CLOSE/" "shutdown_read" with .sw at last arrow.c |
| 45 | arrow "ibuf_empty ||" "rcvd CLOSE/" "send EOF" "" from S2.e to S4.w | 45 | arrow "ibuf_empty ||" "rcvd CLOSE/" "send EOF" "" from S2.e to S4.w |
| 46 | arrow from S1.s to S2.n | 46 | arrow from S1.s to S2.n |
| 47 | box invis "read_failed/" "shutdown_read" with .e at last arrow.c | 47 | box invis "read_failed ||" "rcvd EOW/" "shutdown_read" with .e at last arrow.c |
| 48 | ellipse wid .9*ellipsewid ht .9*ellipseht at S4 | 48 | ellipse wid .9*ellipsewid ht .9*ellipseht at S4 |
| 49 | arrow "start" "" from S1.w+(-0.5,0) to S1.w | 49 | arrow "start" "" from S1.w+(-0.5,0) to S1.w |
| 50 | .PE | 50 | .PE |
| @@ -59,7 +59,7 @@ S4: ellipse "OUTPUT" "CLOSED" | |||
| 59 | move down l from 1st ellipse.s | 59 | move down l from 1st ellipse.s |
| 60 | S2: ellipse "OUTPUT" "WAIT" "DRAIN" | 60 | S2: ellipse "OUTPUT" "WAIT" "DRAIN" |
| 61 | arrow from S1.e to S4.n | 61 | arrow from S1.e to S4.n |
| 62 | box invis "write_failed/" "shutdown_write" with .sw at last arrow.c | 62 | box invis "write_failed/" "shutdown_write" "send EOW" with .sw at last arrow.c |
| 63 | arrow "obuf_empty ||" "write_failed/" "shutdown_write" "" from S2.e to S4.w | 63 | arrow "obuf_empty ||" "write_failed/" "shutdown_write" "" from S2.e to S4.w |
| 64 | arrow from S1.s to S2.n | 64 | arrow from S1.s to S2.n |
| 65 | box invis "rcvd EOF ||" "rcvd CLOSE/" "-" with .e at last arrow.c | 65 | box invis "rcvd EOF ||" "rcvd CLOSE/" "-" with .e at last arrow.c |
diff --git a/openbsd-compat/Makefile.in b/openbsd-compat/Makefile.in index b44a7851e..a60e5a68d 100644 --- a/openbsd-compat/Makefile.in +++ b/openbsd-compat/Makefile.in | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | # $Id: Makefile.in,v 1.41 2007/06/25 12:15:13 dtucker Exp $ | 1 | # $Id: Makefile.in,v 1.43 2008/06/08 17:32:29 dtucker Exp $ |
| 2 | 2 | ||
| 3 | sysconfdir=@sysconfdir@ | 3 | sysconfdir=@sysconfdir@ |
| 4 | piddir=@piddir@ | 4 | piddir=@piddir@ |
| @@ -16,9 +16,9 @@ RANLIB=@RANLIB@ | |||
| 16 | INSTALL=@INSTALL@ | 16 | INSTALL=@INSTALL@ |
| 17 | LDFLAGS=-L. @LDFLAGS@ | 17 | LDFLAGS=-L. @LDFLAGS@ |
| 18 | 18 | ||
| 19 | OPENBSD=base64.o basename.o bindresvport.o daemon.o dirname.o getcwd.o getgrouplist.o getopt.o getrrsetbyname.o glob.o inet_aton.o inet_ntoa.o inet_ntop.o mktemp.o readpassphrase.o realpath.o rresvport.o setenv.o setproctitle.o sha2.o sigact.o strlcat.o strlcpy.o strmode.o strsep.o strtonum.o strtoll.o strtoul.o vis.o | 19 | OPENBSD=base64.o basename.o bindresvport.o daemon.o dirname.o fmt_scaled.o getcwd.o getgrouplist.o getopt.o getrrsetbyname.o glob.o inet_aton.o inet_ntoa.o inet_ntop.o mktemp.o readpassphrase.o realpath.o rresvport.o setenv.o setproctitle.o sha2.o sigact.o strlcat.o strlcpy.o strmode.o strsep.o strtonum.o strtoll.o strtoul.o vis.o |
| 20 | 20 | ||
| 21 | COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-snprintf.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o | 21 | COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o |
| 22 | 22 | ||
| 23 | PORTS=port-aix.o port-irix.o port-linux.o port-solaris.o port-tun.o port-uw.o | 23 | PORTS=port-aix.o port-irix.o port-linux.o port-solaris.o port-tun.o port-uw.o |
| 24 | 24 | ||
diff --git a/openbsd-compat/base64.c b/openbsd-compat/base64.c index 9a60f583b..9e7466716 100644 --- a/openbsd-compat/base64.c +++ b/openbsd-compat/base64.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: base64.c,v 1.4 2002/01/02 23:00:10 deraadt Exp $ */ | 1 | /* $OpenBSD: base64.c,v 1.5 2006/10/21 09:55:03 otto Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Copyright (c) 1996 by Internet Software Consortium. | 4 | * Copyright (c) 1996 by Internet Software Consortium. |
| @@ -62,9 +62,6 @@ | |||
| 62 | 62 | ||
| 63 | #include "base64.h" | 63 | #include "base64.h" |
| 64 | 64 | ||
| 65 | /* XXX abort illegal in library */ | ||
| 66 | #define Assert(Cond) if (!(Cond)) abort() | ||
| 67 | |||
| 68 | static const char Base64[] = | 65 | static const char Base64[] = |
| 69 | "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; | 66 | "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; |
| 70 | static const char Pad64 = '='; | 67 | static const char Pad64 = '='; |
| @@ -151,10 +148,6 @@ b64_ntop(u_char const *src, size_t srclength, char *target, size_t targsize) | |||
| 151 | output[1] = ((input[0] & 0x03) << 4) + (input[1] >> 4); | 148 | output[1] = ((input[0] & 0x03) << 4) + (input[1] >> 4); |
| 152 | output[2] = ((input[1] & 0x0f) << 2) + (input[2] >> 6); | 149 | output[2] = ((input[1] & 0x0f) << 2) + (input[2] >> 6); |
| 153 | output[3] = input[2] & 0x3f; | 150 | output[3] = input[2] & 0x3f; |
| 154 | Assert(output[0] < 64); | ||
| 155 | Assert(output[1] < 64); | ||
| 156 | Assert(output[2] < 64); | ||
| 157 | Assert(output[3] < 64); | ||
| 158 | 151 | ||
| 159 | if (datalength + 4 > targsize) | 152 | if (datalength + 4 > targsize) |
| 160 | return (-1); | 153 | return (-1); |
| @@ -174,9 +167,6 @@ b64_ntop(u_char const *src, size_t srclength, char *target, size_t targsize) | |||
| 174 | output[0] = input[0] >> 2; | 167 | output[0] = input[0] >> 2; |
| 175 | output[1] = ((input[0] & 0x03) << 4) + (input[1] >> 4); | 168 | output[1] = ((input[0] & 0x03) << 4) + (input[1] >> 4); |
| 176 | output[2] = ((input[1] & 0x0f) << 2) + (input[2] >> 6); | 169 | output[2] = ((input[1] & 0x0f) << 2) + (input[2] >> 6); |
| 177 | Assert(output[0] < 64); | ||
| 178 | Assert(output[1] < 64); | ||
| 179 | Assert(output[2] < 64); | ||
| 180 | 170 | ||
| 181 | if (datalength + 4 > targsize) | 171 | if (datalength + 4 > targsize) |
| 182 | return (-1); | 172 | return (-1); |
diff --git a/openbsd-compat/bindresvport.c b/openbsd-compat/bindresvport.c index 65afed1e3..c0d5bdb5c 100644 --- a/openbsd-compat/bindresvport.c +++ b/openbsd-compat/bindresvport.c | |||
| @@ -1,6 +1,6 @@ | |||
| 1 | /* This file has be substantially modified from the original OpenBSD source */ | 1 | /* This file has be substantially modified from the original OpenBSD source */ |
| 2 | 2 | ||
| 3 | /* $OpenBSD: bindresvport.c,v 1.16 2005/04/01 07:44:03 otto Exp $ */ | 3 | /* $OpenBSD: bindresvport.c,v 1.17 2005/12/21 01:40:22 millert Exp $ */ |
| 4 | 4 | ||
| 5 | /* | 5 | /* |
| 6 | * Copyright 1996, Jason Downs. All rights reserved. | 6 | * Copyright 1996, Jason Downs. All rights reserved. |
| @@ -54,8 +54,8 @@ bindresvport_sa(int sd, struct sockaddr *sa) | |||
| 54 | { | 54 | { |
| 55 | int error, af; | 55 | int error, af; |
| 56 | struct sockaddr_storage myaddr; | 56 | struct sockaddr_storage myaddr; |
| 57 | struct sockaddr_in *sin; | 57 | struct sockaddr_in *in; |
| 58 | struct sockaddr_in6 *sin6; | 58 | struct sockaddr_in6 *in6; |
| 59 | u_int16_t *portp; | 59 | u_int16_t *portp; |
| 60 | u_int16_t port; | 60 | u_int16_t port; |
| 61 | socklen_t salen; | 61 | socklen_t salen; |
| @@ -74,13 +74,13 @@ bindresvport_sa(int sd, struct sockaddr *sa) | |||
| 74 | af = sa->sa_family; | 74 | af = sa->sa_family; |
| 75 | 75 | ||
| 76 | if (af == AF_INET) { | 76 | if (af == AF_INET) { |
| 77 | sin = (struct sockaddr_in *)sa; | 77 | in = (struct sockaddr_in *)sa; |
| 78 | salen = sizeof(struct sockaddr_in); | 78 | salen = sizeof(struct sockaddr_in); |
| 79 | portp = &sin->sin_port; | 79 | portp = &in->sin_port; |
| 80 | } else if (af == AF_INET6) { | 80 | } else if (af == AF_INET6) { |
| 81 | sin6 = (struct sockaddr_in6 *)sa; | 81 | in6 = (struct sockaddr_in6 *)sa; |
| 82 | salen = sizeof(struct sockaddr_in6); | 82 | salen = sizeof(struct sockaddr_in6); |
| 83 | portp = &sin6->sin6_port; | 83 | portp = &in6->sin6_port; |
| 84 | } else { | 84 | } else { |
| 85 | errno = EPFNOSUPPORT; | 85 | errno = EPFNOSUPPORT; |
| 86 | return (-1); | 86 | return (-1); |
diff --git a/openbsd-compat/bsd-arc4random.c b/openbsd-compat/bsd-arc4random.c index d45fb182a..9d4c8690e 100644 --- a/openbsd-compat/bsd-arc4random.c +++ b/openbsd-compat/bsd-arc4random.c | |||
| @@ -19,6 +19,7 @@ | |||
| 19 | #include <sys/types.h> | 19 | #include <sys/types.h> |
| 20 | 20 | ||
| 21 | #include <string.h> | 21 | #include <string.h> |
| 22 | #include <stdlib.h> | ||
| 22 | #include <stdarg.h> | 23 | #include <stdarg.h> |
| 23 | 24 | ||
| 24 | #include "log.h" | 25 | #include "log.h" |
| @@ -82,3 +83,68 @@ arc4random_stir(void) | |||
| 82 | rc4_ready = REKEY_BYTES; | 83 | rc4_ready = REKEY_BYTES; |
| 83 | } | 84 | } |
| 84 | #endif /* !HAVE_ARC4RANDOM */ | 85 | #endif /* !HAVE_ARC4RANDOM */ |
| 86 | |||
| 87 | #ifndef ARC4RANDOM_BUF | ||
| 88 | void | ||
| 89 | arc4random_buf(void *_buf, size_t n) | ||
| 90 | { | ||
| 91 | size_t i; | ||
| 92 | u_int32_t r = 0; | ||
| 93 | char *buf = (char *)_buf; | ||
| 94 | |||
| 95 | for (i = 0; i < n; i++) { | ||
| 96 | if (i % 4 == 0) | ||
| 97 | r = arc4random(); | ||
| 98 | buf[i] = r & 0xff; | ||
| 99 | r >>= 8; | ||
| 100 | } | ||
| 101 | i = r = 0; | ||
| 102 | } | ||
| 103 | #endif /* !HAVE_ARC4RANDOM_BUF */ | ||
| 104 | |||
| 105 | #ifndef ARC4RANDOM_UNIFORM | ||
| 106 | /* | ||
| 107 | * Calculate a uniformly distributed random number less than upper_bound | ||
| 108 | * avoiding "modulo bias". | ||
| 109 | * | ||
| 110 | * Uniformity is achieved by generating new random numbers until the one | ||
| 111 | * returned is outside the range [0, 2**32 % upper_bound). This | ||
| 112 | * guarantees the selected random number will be inside | ||
| 113 | * [2**32 % upper_bound, 2**32) which maps back to [0, upper_bound) | ||
| 114 | * after reduction modulo upper_bound. | ||
| 115 | */ | ||
| 116 | u_int32_t | ||
| 117 | arc4random_uniform(u_int32_t upper_bound) | ||
| 118 | { | ||
| 119 | u_int32_t r, min; | ||
| 120 | |||
| 121 | if (upper_bound < 2) | ||
| 122 | return 0; | ||
| 123 | |||
| 124 | #if (ULONG_MAX > 0xffffffffUL) | ||
| 125 | min = 0x100000000UL % upper_bound; | ||
| 126 | #else | ||
| 127 | /* Calculate (2**32 % upper_bound) avoiding 64-bit math */ | ||
| 128 | if (upper_bound > 0x80000000) | ||
| 129 | min = 1 + ~upper_bound; /* 2**32 - upper_bound */ | ||
| 130 | else { | ||
| 131 | /* (2**32 - (x * 2)) % x == 2**32 % x when x <= 2**31 */ | ||
| 132 | min = ((0xffffffff - (upper_bound * 2)) + 1) % upper_bound; | ||
| 133 | } | ||
| 134 | #endif | ||
| 135 | |||
| 136 | /* | ||
| 137 | * This could theoretically loop forever but each retry has | ||
| 138 | * p > 0.5 (worst case, usually far better) of selecting a | ||
| 139 | * number inside the range we need, so it should rarely need | ||
| 140 | * to re-roll. | ||
| 141 | */ | ||
| 142 | for (;;) { | ||
| 143 | r = arc4random(); | ||
| 144 | if (r >= min) | ||
| 145 | break; | ||
| 146 | } | ||
| 147 | |||
| 148 | return r % upper_bound; | ||
| 149 | } | ||
| 150 | #endif /* !HAVE_ARC4RANDOM_UNIFORM */ | ||
diff --git a/openbsd-compat/bsd-asprintf.c b/openbsd-compat/bsd-asprintf.c index 00fa0dfd8..3368195d4 100644 --- a/openbsd-compat/bsd-asprintf.c +++ b/openbsd-compat/bsd-asprintf.c | |||
| @@ -55,6 +55,7 @@ vasprintf(char **str, const char *fmt, va_list ap) | |||
| 55 | if (ret >= 0 && ret < INIT_SZ) { /* succeeded with initial alloc */ | 55 | if (ret >= 0 && ret < INIT_SZ) { /* succeeded with initial alloc */ |
| 56 | *str = string; | 56 | *str = string; |
| 57 | } else if (ret == INT_MAX || ret < 0) { /* Bad length */ | 57 | } else if (ret == INT_MAX || ret < 0) { /* Bad length */ |
| 58 | free(string); | ||
| 58 | goto fail; | 59 | goto fail; |
| 59 | } else { /* bigger than initial, realloc allowing for nul */ | 60 | } else { /* bigger than initial, realloc allowing for nul */ |
| 60 | len = (size_t)ret + 1; | 61 | len = (size_t)ret + 1; |
diff --git a/openbsd-compat/bsd-cygwin_util.c b/openbsd-compat/bsd-cygwin_util.c index dbf8176b6..38be7e350 100644 --- a/openbsd-compat/bsd-cygwin_util.c +++ b/openbsd-compat/bsd-cygwin_util.c | |||
| @@ -175,45 +175,7 @@ check_nt_auth(int pwd_authenticated, struct passwd *pw) | |||
| 175 | int | 175 | int |
| 176 | check_ntsec(const char *filename) | 176 | check_ntsec(const char *filename) |
| 177 | { | 177 | { |
| 178 | char *cygwin; | 178 | return (pathconf(filename, _PC_POSIX_PERMISSIONS)); |
| 179 | int allow_ntea = 0, allow_ntsec = 0; | ||
| 180 | struct statfs fsstat; | ||
| 181 | |||
| 182 | /* Windows 95/98/ME don't support file system security at all. */ | ||
| 183 | if (!is_winnt) | ||
| 184 | return (0); | ||
| 185 | |||
| 186 | /* Evaluate current CYGWIN settings. */ | ||
| 187 | cygwin = getenv("CYGWIN"); | ||
| 188 | allow_ntea = ntea_on(cygwin); | ||
| 189 | allow_ntsec = ntsec_on(cygwin) || | ||
| 190 | (has_capability(HAS_NTSEC_BY_DEFAULT) && !ntsec_off(cygwin)); | ||
| 191 | |||
| 192 | /* | ||
| 193 | * `ntea' is an emulation of POSIX attributes. It doesn't support | ||
| 194 | * real file level security as ntsec on NTFS file systems does | ||
| 195 | * but it supports FAT filesystems. `ntea' is minimum requirement | ||
| 196 | * for security checks. | ||
| 197 | */ | ||
| 198 | if (allow_ntea) | ||
| 199 | return (1); | ||
| 200 | |||
| 201 | /* | ||
| 202 | * Retrieve file system flags. In Cygwin, file system flags are | ||
| 203 | * copied to f_type which has no meaning in Win32 itself. | ||
| 204 | */ | ||
| 205 | if (statfs(filename, &fsstat)) | ||
| 206 | return (1); | ||
| 207 | |||
| 208 | /* | ||
| 209 | * Only file systems supporting ACLs are able to set permissions. | ||
| 210 | * `ntsec' is the setting in Cygwin which switches using of NTFS | ||
| 211 | * ACLs to support POSIX permissions on files. | ||
| 212 | */ | ||
| 213 | if (fsstat.f_type & FS_PERSISTENT_ACLS) | ||
| 214 | return (allow_ntsec); | ||
| 215 | |||
| 216 | return (0); | ||
| 217 | } | 179 | } |
| 218 | 180 | ||
| 219 | void | 181 | void |
diff --git a/openbsd-compat/bsd-poll.c b/openbsd-compat/bsd-poll.c index 836882eea..284db3a1f 100644 --- a/openbsd-compat/bsd-poll.c +++ b/openbsd-compat/bsd-poll.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $Id: bsd-poll.c,v 1.1 2007/06/25 12:15:13 dtucker Exp $ */ | 1 | /* $Id: bsd-poll.c,v 1.3 2008/04/04 05:16:36 djm Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Copyright (c) 2004, 2005, 2007 Darren Tucker (dtucker at zip com au). | 4 | * Copyright (c) 2004, 2005, 2007 Darren Tucker (dtucker at zip com au). |
| @@ -17,12 +17,13 @@ | |||
| 17 | */ | 17 | */ |
| 18 | 18 | ||
| 19 | #include "includes.h" | 19 | #include "includes.h" |
| 20 | #if !defined(HAVE_POLL) && defined(HAVE_SELECT) | 20 | #if !defined(HAVE_POLL) |
| 21 | 21 | ||
| 22 | #ifdef HAVE_SYS_SELECT_H | 22 | #ifdef HAVE_SYS_SELECT_H |
| 23 | # include <sys/select.h> | 23 | # include <sys/select.h> |
| 24 | #endif | 24 | #endif |
| 25 | 25 | ||
| 26 | #include <stdlib.h> | ||
| 26 | #include <errno.h> | 27 | #include <errno.h> |
| 27 | #include "bsd-poll.h" | 28 | #include "bsd-poll.h" |
| 28 | 29 | ||
diff --git a/openbsd-compat/bsd-statvfs.c b/openbsd-compat/bsd-statvfs.c new file mode 100644 index 000000000..844d5b464 --- /dev/null +++ b/openbsd-compat/bsd-statvfs.c | |||
| @@ -0,0 +1,37 @@ | |||
| 1 | /* $Id: bsd-statvfs.c,v 1.1 2008/06/08 17:32:29 dtucker Exp $ */ | ||
| 2 | |||
| 3 | /* | ||
| 4 | * Copyright (c) 2008 Darren Tucker <dtucker@zip.com.au> | ||
| 5 | * | ||
| 6 | * Permission to use, copy, modify, and distribute this software for any | ||
| 7 | * purpose with or without fee is hereby granted, provided that the above | ||
| 8 | * copyright notice and this permission notice appear in all copies. | ||
| 9 | * | ||
| 10 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES | ||
| 11 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF | ||
| 12 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR | ||
| 13 | * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES | ||
| 14 | * WHATSOEVER RESULTING FROM LOSS OF MIND, USE, DATA OR PROFITS, WHETHER | ||
| 15 | * IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING | ||
| 16 | * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. | ||
| 17 | */ | ||
| 18 | |||
| 19 | #include "includes.h" | ||
| 20 | |||
| 21 | #include <errno.h> | ||
| 22 | |||
| 23 | #ifndef HAVE_STATVFS | ||
| 24 | int statvfs(const char *path, struct statvfs *buf) | ||
| 25 | { | ||
| 26 | errno = ENOSYS; | ||
| 27 | return -1; | ||
| 28 | } | ||
| 29 | #endif | ||
| 30 | |||
| 31 | #ifndef HAVE_FSTATVFS | ||
| 32 | int fstatvfs(int fd, struct statvfs *buf) | ||
| 33 | { | ||
| 34 | errno = ENOSYS; | ||
| 35 | return -1; | ||
| 36 | } | ||
| 37 | #endif | ||
diff --git a/openbsd-compat/bsd-statvfs.h b/openbsd-compat/bsd-statvfs.h new file mode 100644 index 000000000..da215ffc6 --- /dev/null +++ b/openbsd-compat/bsd-statvfs.h | |||
| @@ -0,0 +1,68 @@ | |||
| 1 | /* $Id: bsd-statvfs.h,v 1.1 2008/06/08 17:32:29 dtucker Exp $ */ | ||
| 2 | |||
| 3 | /* | ||
| 4 | * Copyright (c) 2008 Darren Tucker <dtucker@zip.com.au> | ||
| 5 | * | ||
| 6 | * Permission to use, copy, modify, and distribute this software for any | ||
| 7 | * purpose with or without fee is hereby granted, provided that the above | ||
| 8 | * copyright notice and this permission notice appear in all copies. | ||
| 9 | * | ||
| 10 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES | ||
| 11 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF | ||
| 12 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR | ||
| 13 | * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES | ||
| 14 | * WHATSOEVER RESULTING FROM LOSS OF MIND, USE, DATA OR PROFITS, WHETHER | ||
| 15 | * IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING | ||
| 16 | * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. | ||
| 17 | */ | ||
| 18 | |||
| 19 | #include "includes.h" | ||
| 20 | |||
| 21 | #include <sys/types.h> | ||
| 22 | |||
| 23 | #ifdef HAVE_SYS_STATFS_H | ||
| 24 | #include <sys/statfs.h> | ||
| 25 | #endif | ||
| 26 | |||
| 27 | #ifndef HAVE_STATVFS | ||
| 28 | |||
| 29 | #ifndef HAVE_FSBLKCNT_T | ||
| 30 | typedef unsigned long fsblkcnt_t; | ||
| 31 | #endif | ||
| 32 | #ifndef HAVE_FSFILCNT_T | ||
| 33 | typedef unsigned long fsfilcnt_t; | ||
| 34 | #endif | ||
| 35 | |||
| 36 | #ifndef ST_RDONLY | ||
| 37 | #define ST_RDONLY 1 | ||
| 38 | #endif | ||
| 39 | #ifndef ST_NOSUID | ||
| 40 | #define ST_NOSUID 2 | ||
| 41 | #endif | ||
| 42 | |||
| 43 | /* as defined in IEEE Std 1003.1, 2004 Edition */ | ||
| 44 | struct statvfs { | ||
| 45 | unsigned long f_bsize; /* File system block size. */ | ||
| 46 | unsigned long f_frsize; /* Fundamental file system block size. */ | ||
| 47 | fsblkcnt_t f_blocks; /* Total number of blocks on file system in */ | ||
| 48 | /* units of f_frsize. */ | ||
| 49 | fsblkcnt_t f_bfree; /* Total number of free blocks. */ | ||
| 50 | fsblkcnt_t f_bavail; /* Number of free blocks available to */ | ||
| 51 | /* non-privileged process. */ | ||
| 52 | fsfilcnt_t f_files; /* Total number of file serial numbers. */ | ||
| 53 | fsfilcnt_t f_ffree; /* Total number of free file serial numbers. */ | ||
| 54 | fsfilcnt_t f_favail; /* Number of file serial numbers available to */ | ||
| 55 | /* non-privileged process. */ | ||
| 56 | unsigned long f_fsid; /* File system ID. */ | ||
| 57 | unsigned long f_flag; /* BBit mask of f_flag values. */ | ||
| 58 | unsigned long f_namemax;/* Maximum filename length. */ | ||
| 59 | }; | ||
| 60 | #endif | ||
| 61 | |||
| 62 | #ifndef HAVE_STATVFS | ||
| 63 | int statvfs(const char *, struct statvfs *); | ||
| 64 | #endif | ||
| 65 | |||
| 66 | #ifndef HAVE_FSTATVFS | ||
| 67 | int fstatvfs(int, struct statvfs *); | ||
| 68 | #endif | ||
diff --git a/openbsd-compat/fake-rfc2553.c b/openbsd-compat/fake-rfc2553.c index b6ea3d21e..096d9e092 100644 --- a/openbsd-compat/fake-rfc2553.c +++ b/openbsd-compat/fake-rfc2553.c | |||
| @@ -51,6 +51,8 @@ int getnameinfo(const struct sockaddr *sa, size_t salen, char *host, | |||
| 51 | struct hostent *hp; | 51 | struct hostent *hp; |
| 52 | char tmpserv[16]; | 52 | char tmpserv[16]; |
| 53 | 53 | ||
| 54 | if (sa->sa_family != AF_UNSPEC && sa->sa_family != AF_INET) | ||
| 55 | return (EAI_FAMILY); | ||
| 54 | if (serv != NULL) { | 56 | if (serv != NULL) { |
| 55 | snprintf(tmpserv, sizeof(tmpserv), "%d", ntohs(sin->sin_port)); | 57 | snprintf(tmpserv, sizeof(tmpserv), "%d", ntohs(sin->sin_port)); |
| 56 | if (strlcpy(serv, tmpserv, servlen) >= servlen) | 58 | if (strlcpy(serv, tmpserv, servlen) >= servlen) |
| @@ -95,6 +97,8 @@ gai_strerror(int err) | |||
| 95 | return ("memory allocation failure."); | 97 | return ("memory allocation failure."); |
| 96 | case EAI_NONAME: | 98 | case EAI_NONAME: |
| 97 | return ("nodename nor servname provided, or not known"); | 99 | return ("nodename nor servname provided, or not known"); |
| 100 | case EAI_FAMILY: | ||
| 101 | return ("ai_family not supported"); | ||
| 98 | default: | 102 | default: |
| 99 | return ("unknown/invalid error."); | 103 | return ("unknown/invalid error."); |
| 100 | } | 104 | } |
| @@ -159,6 +163,9 @@ getaddrinfo(const char *hostname, const char *servname, | |||
| 159 | u_long addr; | 163 | u_long addr; |
| 160 | 164 | ||
| 161 | port = 0; | 165 | port = 0; |
| 166 | if (hints && hints->ai_family != AF_UNSPEC && | ||
| 167 | hints->ai_family != AF_INET) | ||
| 168 | return (EAI_FAMILY); | ||
| 162 | if (servname != NULL) { | 169 | if (servname != NULL) { |
| 163 | char *cp; | 170 | char *cp; |
| 164 | 171 | ||
diff --git a/openbsd-compat/fake-rfc2553.h b/openbsd-compat/fake-rfc2553.h index 5c2ce5b1b..3e9090fc8 100644 --- a/openbsd-compat/fake-rfc2553.h +++ b/openbsd-compat/fake-rfc2553.h | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $Id: fake-rfc2553.h,v 1.13 2006/07/24 03:51:52 djm Exp $ */ | 1 | /* $Id: fake-rfc2553.h,v 1.16 2008/07/14 11:37:37 djm Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Copyright (C) 2000-2003 Damien Miller. All rights reserved. | 4 | * Copyright (C) 2000-2003 Damien Miller. All rights reserved. |
| @@ -77,6 +77,7 @@ struct sockaddr_in6 { | |||
| 77 | u_int16_t sin6_port; | 77 | u_int16_t sin6_port; |
| 78 | u_int32_t sin6_flowinfo; | 78 | u_int32_t sin6_flowinfo; |
| 79 | struct in6_addr sin6_addr; | 79 | struct in6_addr sin6_addr; |
| 80 | u_int32_t sin6_scope_id; | ||
| 80 | }; | 81 | }; |
| 81 | #endif /* !HAVE_STRUCT_SOCKADDR_IN6 */ | 82 | #endif /* !HAVE_STRUCT_SOCKADDR_IN6 */ |
| 82 | 83 | ||
| @@ -128,6 +129,9 @@ struct sockaddr_in6 { | |||
| 128 | #ifndef EAI_SYSTEM | 129 | #ifndef EAI_SYSTEM |
| 129 | # define EAI_SYSTEM (INT_MAX - 4) | 130 | # define EAI_SYSTEM (INT_MAX - 4) |
| 130 | #endif | 131 | #endif |
| 132 | #ifndef EAI_FAMILY | ||
| 133 | # define EAI_FAMILY (INT_MAX - 5) | ||
| 134 | #endif | ||
| 131 | 135 | ||
| 132 | #ifndef HAVE_STRUCT_ADDRINFO | 136 | #ifndef HAVE_STRUCT_ADDRINFO |
| 133 | struct addrinfo { | 137 | struct addrinfo { |
| @@ -152,7 +156,7 @@ int getaddrinfo(const char *, const char *, | |||
| 152 | #endif /* !HAVE_GETADDRINFO */ | 156 | #endif /* !HAVE_GETADDRINFO */ |
| 153 | 157 | ||
| 154 | #if !defined(HAVE_GAI_STRERROR) && !defined(HAVE_CONST_GAI_STRERROR_PROTO) | 158 | #if !defined(HAVE_GAI_STRERROR) && !defined(HAVE_CONST_GAI_STRERROR_PROTO) |
| 155 | #define gai_strerror(a) (ssh_gai_strerror(a)) | 159 | #define gai_strerror(a) (_ssh_compat_gai_strerror(a)) |
| 156 | char *gai_strerror(int); | 160 | char *gai_strerror(int); |
| 157 | #endif /* !HAVE_GAI_STRERROR */ | 161 | #endif /* !HAVE_GAI_STRERROR */ |
| 158 | 162 | ||
diff --git a/openbsd-compat/fmt_scaled.c b/openbsd-compat/fmt_scaled.c new file mode 100644 index 000000000..edd682a49 --- /dev/null +++ b/openbsd-compat/fmt_scaled.c | |||
| @@ -0,0 +1,274 @@ | |||
| 1 | /* $OpenBSD: fmt_scaled.c,v 1.9 2007/03/20 03:42:52 tedu Exp $ */ | ||
| 2 | |||
| 3 | /* | ||
| 4 | * Copyright (c) 2001, 2002, 2003 Ian F. Darwin. All rights reserved. | ||
| 5 | * | ||
| 6 | * Redistribution and use in source and binary forms, with or without | ||
| 7 | * modification, are permitted provided that the following conditions | ||
| 8 | * are met: | ||
| 9 | * 1. Redistributions of source code must retain the above copyright | ||
| 10 | * notice, this list of conditions and the following disclaimer. | ||
| 11 | * 2. Redistributions in binary form must reproduce the above copyright | ||
| 12 | * notice, this list of conditions and the following disclaimer in the | ||
| 13 | * documentation and/or other materials provided with the distribution. | ||
| 14 | * 3. The name of the author may not be used to endorse or promote products | ||
| 15 | * derived from this software without specific prior written permission. | ||
| 16 | * | ||
| 17 | * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR | ||
| 18 | * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES | ||
| 19 | * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. | ||
| 20 | * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, | ||
| 21 | * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT | ||
| 22 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, | ||
| 23 | * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY | ||
| 24 | * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT | ||
| 25 | * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | ||
| 26 | * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | ||
| 27 | */ | ||
| 28 | |||
| 29 | /* OPENBSD ORIGINAL: lib/libutil/fmt_scaled.c */ | ||
| 30 | |||
| 31 | /* | ||
| 32 | * fmt_scaled: Format numbers scaled for human comprehension | ||
| 33 | * scan_scaled: Scan numbers in this format. | ||
| 34 | * | ||
| 35 | * "Human-readable" output uses 4 digits max, and puts a unit suffix at | ||
| 36 | * the end. Makes output compact and easy-to-read esp. on huge disks. | ||
| 37 | * Formatting code was originally in OpenBSD "df", converted to library routine. | ||
| 38 | * Scanning code written for OpenBSD libutil. | ||
| 39 | */ | ||
| 40 | |||
| 41 | #include "includes.h" | ||
| 42 | |||
| 43 | #ifndef HAVE_FMT_SCALED | ||
| 44 | |||
| 45 | #include <stdio.h> | ||
| 46 | #include <stdlib.h> | ||
| 47 | #include <errno.h> | ||
| 48 | #include <string.h> | ||
| 49 | #include <ctype.h> | ||
| 50 | #include <limits.h> | ||
| 51 | |||
| 52 | typedef enum { | ||
| 53 | NONE = 0, KILO = 1, MEGA = 2, GIGA = 3, TERA = 4, PETA = 5, EXA = 6 | ||
| 54 | } unit_type; | ||
| 55 | |||
| 56 | /* These three arrays MUST be in sync! XXX make a struct */ | ||
| 57 | static unit_type units[] = { NONE, KILO, MEGA, GIGA, TERA, PETA, EXA }; | ||
| 58 | static char scale_chars[] = "BKMGTPE"; | ||
| 59 | static long long scale_factors[] = { | ||
| 60 | 1LL, | ||
| 61 | 1024LL, | ||
| 62 | 1024LL*1024, | ||
| 63 | 1024LL*1024*1024, | ||
| 64 | 1024LL*1024*1024*1024, | ||
| 65 | 1024LL*1024*1024*1024*1024, | ||
| 66 | 1024LL*1024*1024*1024*1024*1024, | ||
| 67 | }; | ||
| 68 | #define SCALE_LENGTH (sizeof(units)/sizeof(units[0])) | ||
| 69 | |||
| 70 | #define MAX_DIGITS (SCALE_LENGTH * 3) /* XXX strlen(sprintf("%lld", -1)? */ | ||
| 71 | |||
| 72 | /** Convert the given input string "scaled" into numeric in "result". | ||
| 73 | * Return 0 on success, -1 and errno set on error. | ||
| 74 | */ | ||
| 75 | int | ||
| 76 | scan_scaled(char *scaled, long long *result) | ||
| 77 | { | ||
| 78 | char *p = scaled; | ||
| 79 | int sign = 0; | ||
| 80 | unsigned int i, ndigits = 0, fract_digits = 0; | ||
| 81 | long long scale_fact = 1, whole = 0, fpart = 0; | ||
| 82 | |||
| 83 | /* Skip leading whitespace */ | ||
| 84 | while (isascii(*p) && isspace(*p)) | ||
| 85 | ++p; | ||
| 86 | |||
| 87 | /* Then at most one leading + or - */ | ||
| 88 | while (*p == '-' || *p == '+') { | ||
| 89 | if (*p == '-') { | ||
| 90 | if (sign) { | ||
| 91 | errno = EINVAL; | ||
| 92 | return -1; | ||
| 93 | } | ||
| 94 | sign = -1; | ||
| 95 | ++p; | ||
| 96 | } else if (*p == '+') { | ||
| 97 | if (sign) { | ||
| 98 | errno = EINVAL; | ||
| 99 | return -1; | ||
| 100 | } | ||
| 101 | sign = +1; | ||
| 102 | ++p; | ||
| 103 | } | ||
| 104 | } | ||
| 105 | |||
| 106 | /* Main loop: Scan digits, find decimal point, if present. | ||
| 107 | * We don't allow exponentials, so no scientific notation | ||
| 108 | * (but note that E for Exa might look like e to some!). | ||
| 109 | * Advance 'p' to end, to get scale factor. | ||
| 110 | */ | ||
| 111 | for (; isascii(*p) && (isdigit(*p) || *p=='.'); ++p) { | ||
| 112 | if (*p == '.') { | ||
| 113 | if (fract_digits > 0) { /* oops, more than one '.' */ | ||
| 114 | errno = EINVAL; | ||
| 115 | return -1; | ||
| 116 | } | ||
| 117 | fract_digits = 1; | ||
| 118 | continue; | ||
| 119 | } | ||
| 120 | |||
| 121 | i = (*p) - '0'; /* whew! finally a digit we can use */ | ||
| 122 | if (fract_digits > 0) { | ||
| 123 | if (fract_digits >= MAX_DIGITS-1) | ||
| 124 | /* ignore extra fractional digits */ | ||
| 125 | continue; | ||
| 126 | fract_digits++; /* for later scaling */ | ||
| 127 | fpart *= 10; | ||
| 128 | fpart += i; | ||
| 129 | } else { /* normal digit */ | ||
| 130 | if (++ndigits >= MAX_DIGITS) { | ||
| 131 | errno = ERANGE; | ||
| 132 | return -1; | ||
| 133 | } | ||
| 134 | whole *= 10; | ||
| 135 | whole += i; | ||
| 136 | } | ||
| 137 | } | ||
| 138 | |||
| 139 | if (sign) { | ||
| 140 | whole *= sign; | ||
| 141 | fpart *= sign; | ||
| 142 | } | ||
| 143 | |||
| 144 | /* If no scale factor given, we're done. fraction is discarded. */ | ||
| 145 | if (!*p) { | ||
| 146 | *result = whole; | ||
| 147 | return 0; | ||
| 148 | } | ||
| 149 | |||
| 150 | /* Validate scale factor, and scale whole and fraction by it. */ | ||
| 151 | for (i = 0; i < SCALE_LENGTH; i++) { | ||
| 152 | |||
| 153 | /** Are we there yet? */ | ||
| 154 | if (*p == scale_chars[i] || | ||
| 155 | *p == tolower(scale_chars[i])) { | ||
| 156 | |||
| 157 | /* If it ends with alphanumerics after the scale char, bad. */ | ||
| 158 | if (isalnum(*(p+1))) { | ||
| 159 | errno = EINVAL; | ||
| 160 | return -1; | ||
| 161 | } | ||
| 162 | scale_fact = scale_factors[i]; | ||
| 163 | |||
| 164 | /* scale whole part */ | ||
| 165 | whole *= scale_fact; | ||
| 166 | |||
| 167 | /* truncate fpart so it does't overflow. | ||
| 168 | * then scale fractional part. | ||
| 169 | */ | ||
| 170 | while (fpart >= LLONG_MAX / scale_fact) { | ||
| 171 | fpart /= 10; | ||
| 172 | fract_digits--; | ||
| 173 | } | ||
| 174 | fpart *= scale_fact; | ||
| 175 | if (fract_digits > 0) { | ||
| 176 | for (i = 0; i < fract_digits -1; i++) | ||
| 177 | fpart /= 10; | ||
| 178 | } | ||
| 179 | whole += fpart; | ||
| 180 | *result = whole; | ||
| 181 | return 0; | ||
| 182 | } | ||
| 183 | } | ||
| 184 | errno = ERANGE; | ||
| 185 | return -1; | ||
| 186 | } | ||
| 187 | |||
| 188 | /* Format the given "number" into human-readable form in "result". | ||
| 189 | * Result must point to an allocated buffer of length FMT_SCALED_STRSIZE. | ||
| 190 | * Return 0 on success, -1 and errno set if error. | ||
| 191 | */ | ||
| 192 | int | ||
| 193 | fmt_scaled(long long number, char *result) | ||
| 194 | { | ||
| 195 | long long abval, fract = 0; | ||
| 196 | unsigned int i; | ||
| 197 | unit_type unit = NONE; | ||
| 198 | |||
| 199 | abval = (number < 0LL) ? -number : number; /* no long long_abs yet */ | ||
| 200 | |||
| 201 | /* Not every negative long long has a positive representation. | ||
| 202 | * Also check for numbers that are just too darned big to format | ||
| 203 | */ | ||
| 204 | if (abval < 0 || abval / 1024 >= scale_factors[SCALE_LENGTH-1]) { | ||
| 205 | errno = ERANGE; | ||
| 206 | return -1; | ||
| 207 | } | ||
| 208 | |||
| 209 | /* scale whole part; get unscaled fraction */ | ||
| 210 | for (i = 0; i < SCALE_LENGTH; i++) { | ||
| 211 | if (abval/1024 < scale_factors[i]) { | ||
| 212 | unit = units[i]; | ||
| 213 | fract = (i == 0) ? 0 : abval % scale_factors[i]; | ||
| 214 | number /= scale_factors[i]; | ||
| 215 | if (i > 0) | ||
| 216 | fract /= scale_factors[i - 1]; | ||
| 217 | break; | ||
| 218 | } | ||
| 219 | } | ||
| 220 | |||
| 221 | fract = (10 * fract + 512) / 1024; | ||
| 222 | /* if the result would be >= 10, round main number */ | ||
| 223 | if (fract == 10) { | ||
| 224 | if (number >= 0) | ||
| 225 | number++; | ||
| 226 | else | ||
| 227 | number--; | ||
| 228 | fract = 0; | ||
| 229 | } | ||
| 230 | |||
| 231 | if (number == 0) | ||
| 232 | strlcpy(result, "0B", FMT_SCALED_STRSIZE); | ||
| 233 | else if (unit == NONE || number >= 100 || number <= -100) { | ||
| 234 | if (fract >= 5) { | ||
| 235 | if (number >= 0) | ||
| 236 | number++; | ||
| 237 | else | ||
| 238 | number--; | ||
| 239 | } | ||
| 240 | (void)snprintf(result, FMT_SCALED_STRSIZE, "%lld%c", | ||
| 241 | number, scale_chars[unit]); | ||
| 242 | } else | ||
| 243 | (void)snprintf(result, FMT_SCALED_STRSIZE, "%lld.%1lld%c", | ||
| 244 | number, fract, scale_chars[unit]); | ||
| 245 | |||
| 246 | return 0; | ||
| 247 | } | ||
| 248 | |||
| 249 | #ifdef MAIN | ||
| 250 | /* | ||
| 251 | * This is the original version of the program in the man page. | ||
| 252 | * Copy-and-paste whatever you need from it. | ||
| 253 | */ | ||
| 254 | int | ||
| 255 | main(int argc, char **argv) | ||
| 256 | { | ||
| 257 | char *cinput = "1.5K", buf[FMT_SCALED_STRSIZE]; | ||
| 258 | long long ninput = 10483892, result; | ||
| 259 | |||
| 260 | if (scan_scaled(cinput, &result) == 0) | ||
| 261 | printf("\"%s\" -> %lld\n", cinput, result); | ||
| 262 | else | ||
| 263 | perror(cinput); | ||
| 264 | |||
| 265 | if (fmt_scaled(ninput, buf) == 0) | ||
| 266 | printf("%lld -> \"%s\"\n", ninput, buf); | ||
| 267 | else | ||
| 268 | fprintf(stderr, "%lld invalid (%s)\n", ninput, strerror(errno)); | ||
| 269 | |||
| 270 | return 0; | ||
| 271 | } | ||
| 272 | #endif | ||
| 273 | |||
| 274 | #endif /* HAVE_FMT_SCALED */ | ||
diff --git a/openbsd-compat/getrrsetbyname.c b/openbsd-compat/getrrsetbyname.c index 80af3f542..785b22569 100644 --- a/openbsd-compat/getrrsetbyname.c +++ b/openbsd-compat/getrrsetbyname.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: getrrsetbyname.c,v 1.10 2005/03/30 02:58:28 tedu Exp $ */ | 1 | /* $OpenBSD: getrrsetbyname.c,v 1.11 2007/10/11 18:36:41 jakob Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Copyright (c) 2001 Jakob Schlyter. All rights reserved. | 4 | * Copyright (c) 2001 Jakob Schlyter. All rights reserved. |
| @@ -288,7 +288,7 @@ getrrsetbyname(const char *hostname, unsigned int rdclass, | |||
| 288 | rrset->rri_nrdatas = count_dns_rr(response->answer, rrset->rri_rdclass, | 288 | rrset->rri_nrdatas = count_dns_rr(response->answer, rrset->rri_rdclass, |
| 289 | rrset->rri_rdtype); | 289 | rrset->rri_rdtype); |
| 290 | rrset->rri_nsigs = count_dns_rr(response->answer, rrset->rri_rdclass, | 290 | rrset->rri_nsigs = count_dns_rr(response->answer, rrset->rri_rdclass, |
| 291 | T_SIG); | 291 | T_RRSIG); |
| 292 | 292 | ||
| 293 | /* allocate memory for answers */ | 293 | /* allocate memory for answers */ |
| 294 | rrset->rri_rdatas = calloc(rrset->rri_nrdatas, | 294 | rrset->rri_rdatas = calloc(rrset->rri_nrdatas, |
| @@ -318,7 +318,7 @@ getrrsetbyname(const char *hostname, unsigned int rdclass, | |||
| 318 | rdata = &rrset->rri_rdatas[index_ans++]; | 318 | rdata = &rrset->rri_rdatas[index_ans++]; |
| 319 | 319 | ||
| 320 | if (rr->class == rrset->rri_rdclass && | 320 | if (rr->class == rrset->rri_rdclass && |
| 321 | rr->type == T_SIG) | 321 | rr->type == T_RRSIG) |
| 322 | rdata = &rrset->rri_sigs[index_sig++]; | 322 | rdata = &rrset->rri_sigs[index_sig++]; |
| 323 | 323 | ||
| 324 | if (rdata) { | 324 | if (rdata) { |
diff --git a/openbsd-compat/getrrsetbyname.h b/openbsd-compat/getrrsetbyname.h index 39995b63f..1283f5506 100644 --- a/openbsd-compat/getrrsetbyname.h +++ b/openbsd-compat/getrrsetbyname.h | |||
| @@ -62,8 +62,8 @@ | |||
| 62 | #define HFIXEDSZ 12 | 62 | #define HFIXEDSZ 12 |
| 63 | #endif | 63 | #endif |
| 64 | 64 | ||
| 65 | #ifndef T_SIG | 65 | #ifndef T_RRSIG |
| 66 | #define T_SIG 24 | 66 | #define T_RRSIG 46 |
| 67 | #endif | 67 | #endif |
| 68 | 68 | ||
| 69 | /* | 69 | /* |
diff --git a/openbsd-compat/glob.c b/openbsd-compat/glob.c index b3dd2b171..74b506403 100644 --- a/openbsd-compat/glob.c +++ b/openbsd-compat/glob.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: glob.c,v 1.25 2005/08/08 08:05:34 espie Exp $ */ | 1 | /* $OpenBSD: glob.c,v 1.26 2005/11/28 17:50:12 deraadt Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Copyright (c) 1989, 1993 | 3 | * Copyright (c) 1989, 1993 |
| 4 | * The Regents of the University of California. All rights reserved. | 4 | * The Regents of the University of California. All rights reserved. |
| @@ -48,7 +48,8 @@ | |||
| 48 | 48 | ||
| 49 | #if !defined(HAVE_GLOB) || !defined(GLOB_HAS_ALTDIRFUNC) || \ | 49 | #if !defined(HAVE_GLOB) || !defined(GLOB_HAS_ALTDIRFUNC) || \ |
| 50 | !defined(GLOB_HAS_GL_MATCHC) || \ | 50 | !defined(GLOB_HAS_GL_MATCHC) || \ |
| 51 | !defined(HAVE_DECL_GLOB_NOMATCH) || HAVE_DECL_GLOB_NOMATCH == 0 | 51 | !defined(HAVE_DECL_GLOB_NOMATCH) || HAVE_DECL_GLOB_NOMATCH == 0 || \ |
| 52 | defined(BROKEN_GLOB) | ||
| 52 | 53 | ||
| 53 | static long | 54 | static long |
| 54 | get_arg_max(void) | 55 | get_arg_max(void) |
| @@ -149,7 +150,7 @@ static int glob0(const Char *, glob_t *); | |||
| 149 | static int glob1(Char *, Char *, glob_t *, size_t *); | 150 | static int glob1(Char *, Char *, glob_t *, size_t *); |
| 150 | static int glob2(Char *, Char *, Char *, Char *, Char *, Char *, | 151 | static int glob2(Char *, Char *, Char *, Char *, Char *, Char *, |
| 151 | glob_t *, size_t *); | 152 | glob_t *, size_t *); |
| 152 | static int glob3(Char *, Char *, Char *, Char *, Char *, Char *, | 153 | static int glob3(Char *, Char *, Char *, Char *, Char *, |
| 153 | Char *, Char *, glob_t *, size_t *); | 154 | Char *, Char *, glob_t *, size_t *); |
| 154 | static int globextend(const Char *, glob_t *, size_t *); | 155 | static int globextend(const Char *, glob_t *, size_t *); |
| 155 | static const Char * | 156 | static const Char * |
| @@ -571,16 +572,16 @@ glob2(Char *pathbuf, Char *pathbuf_last, Char *pathend, Char *pathend_last, | |||
| 571 | } else | 572 | } else |
| 572 | /* Need expansion, recurse. */ | 573 | /* Need expansion, recurse. */ |
| 573 | return(glob3(pathbuf, pathbuf_last, pathend, | 574 | return(glob3(pathbuf, pathbuf_last, pathend, |
| 574 | pathend_last, pattern, pattern_last, | 575 | pathend_last, pattern, p, pattern_last, |
| 575 | p, pattern_last, pglob, limitp)); | 576 | pglob, limitp)); |
| 576 | } | 577 | } |
| 577 | /* NOTREACHED */ | 578 | /* NOTREACHED */ |
| 578 | } | 579 | } |
| 579 | 580 | ||
| 580 | static int | 581 | static int |
| 581 | glob3(Char *pathbuf, Char *pathbuf_last, Char *pathend, Char *pathend_last, | 582 | glob3(Char *pathbuf, Char *pathbuf_last, Char *pathend, Char *pathend_last, |
| 582 | Char *pattern, Char *pattern_last, Char *restpattern, | 583 | Char *pattern, Char *restpattern, Char *restpattern_last, glob_t *pglob, |
| 583 | Char *restpattern_last, glob_t *pglob, size_t *limitp) | 584 | size_t *limitp) |
| 584 | { | 585 | { |
| 585 | struct dirent *dp; | 586 | struct dirent *dp; |
| 586 | DIR *dirp; | 587 | DIR *dirp; |
diff --git a/openbsd-compat/glob.h b/openbsd-compat/glob.h index 9ba07f76e..a2b36f974 100644 --- a/openbsd-compat/glob.h +++ b/openbsd-compat/glob.h | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: glob.h,v 1.9 2004/10/07 16:56:11 millert Exp $ */ | 1 | /* $OpenBSD: glob.h,v 1.10 2005/12/13 00:35:22 millert Exp $ */ |
| 2 | /* $NetBSD: glob.h,v 1.5 1994/10/26 00:55:56 cgd Exp $ */ | 2 | /* $NetBSD: glob.h,v 1.5 1994/10/26 00:55:56 cgd Exp $ */ |
| 3 | 3 | ||
| 4 | /* | 4 | /* |
| @@ -39,7 +39,8 @@ | |||
| 39 | 39 | ||
| 40 | #if !defined(HAVE_GLOB_H) || !defined(GLOB_HAS_ALTDIRFUNC) || \ | 40 | #if !defined(HAVE_GLOB_H) || !defined(GLOB_HAS_ALTDIRFUNC) || \ |
| 41 | !defined(GLOB_HAS_GL_MATCHC) || \ | 41 | !defined(GLOB_HAS_GL_MATCHC) || \ |
| 42 | !defined(HAVE_DECL_GLOB_NOMATCH) || HAVE_DECL_GLOB_NOMATCH == 0 | 42 | !defined(HAVE_DECL_GLOB_NOMATCH) || HAVE_DECL_GLOB_NOMATCH == 0 || \ |
| 43 | defined(BROKEN_GLOB) | ||
| 43 | 44 | ||
| 44 | #ifndef _GLOB_H_ | 45 | #ifndef _GLOB_H_ |
| 45 | #define _GLOB_H_ | 46 | #define _GLOB_H_ |
| @@ -66,7 +67,6 @@ typedef struct { | |||
| 66 | int (*gl_stat)(const char *, struct stat *); | 67 | int (*gl_stat)(const char *, struct stat *); |
| 67 | } glob_t; | 68 | } glob_t; |
| 68 | 69 | ||
| 69 | /* Flags */ | ||
| 70 | #define GLOB_APPEND 0x0001 /* Append to output from previous call. */ | 70 | #define GLOB_APPEND 0x0001 /* Append to output from previous call. */ |
| 71 | #define GLOB_DOOFFS 0x0002 /* Use gl_offs. */ | 71 | #define GLOB_DOOFFS 0x0002 /* Use gl_offs. */ |
| 72 | #define GLOB_ERR 0x0004 /* Return on error. */ | 72 | #define GLOB_ERR 0x0004 /* Return on error. */ |
| @@ -75,6 +75,13 @@ typedef struct { | |||
| 75 | #define GLOB_NOSORT 0x0020 /* Don't sort. */ | 75 | #define GLOB_NOSORT 0x0020 /* Don't sort. */ |
| 76 | #define GLOB_NOESCAPE 0x1000 /* Disable backslash escaping. */ | 76 | #define GLOB_NOESCAPE 0x1000 /* Disable backslash escaping. */ |
| 77 | 77 | ||
| 78 | /* Error values returned by glob(3) */ | ||
| 79 | #define GLOB_NOSPACE (-1) /* Malloc call failed. */ | ||
| 80 | #define GLOB_ABORTED (-2) /* Unignored error. */ | ||
| 81 | #define GLOB_NOMATCH (-3) /* No match and GLOB_NOCHECK not set. */ | ||
| 82 | #define GLOB_NOSYS (-4) /* Function not supported. */ | ||
| 83 | #define GLOB_ABEND GLOB_ABORTED | ||
| 84 | |||
| 78 | #define GLOB_ALTDIRFUNC 0x0040 /* Use alternately specified directory funcs. */ | 85 | #define GLOB_ALTDIRFUNC 0x0040 /* Use alternately specified directory funcs. */ |
| 79 | #define GLOB_BRACE 0x0080 /* Expand braces ala csh. */ | 86 | #define GLOB_BRACE 0x0080 /* Expand braces ala csh. */ |
| 80 | #define GLOB_MAGCHAR 0x0100 /* Pattern had globbing characters. */ | 87 | #define GLOB_MAGCHAR 0x0100 /* Pattern had globbing characters. */ |
| @@ -83,13 +90,6 @@ typedef struct { | |||
| 83 | #define GLOB_TILDE 0x0800 /* Expand tilde names from the passwd file. */ | 90 | #define GLOB_TILDE 0x0800 /* Expand tilde names from the passwd file. */ |
| 84 | #define GLOB_LIMIT 0x2000 /* Limit pattern match output to ARG_MAX */ | 91 | #define GLOB_LIMIT 0x2000 /* Limit pattern match output to ARG_MAX */ |
| 85 | 92 | ||
| 86 | /* Error values returned by glob(3) */ | ||
| 87 | #define GLOB_NOSPACE (-1) /* Malloc call failed. */ | ||
| 88 | #define GLOB_ABORTED (-2) /* Unignored error. */ | ||
| 89 | #define GLOB_NOMATCH (-3) /* No match and GLOB_NOCHECK not set. */ | ||
| 90 | #define GLOB_NOSYS (-4) /* Function not supported. */ | ||
| 91 | #define GLOB_ABEND GLOB_ABORTED | ||
| 92 | |||
| 93 | int glob(const char *, int, int (*)(const char *, int), glob_t *); | 93 | int glob(const char *, int, int (*)(const char *, int), glob_t *); |
| 94 | void globfree(glob_t *); | 94 | void globfree(glob_t *); |
| 95 | 95 | ||
diff --git a/openbsd-compat/openbsd-compat.h b/openbsd-compat/openbsd-compat.h index 6406af19d..50c6d990b 100644 --- a/openbsd-compat/openbsd-compat.h +++ b/openbsd-compat/openbsd-compat.h | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $Id: openbsd-compat.h,v 1.43 2007/06/25 12:15:13 dtucker Exp $ */ | 1 | /* $Id: openbsd-compat.h,v 1.46 2008/06/08 17:32:29 dtucker Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Copyright (c) 1999-2003 Damien Miller. All rights reserved. | 4 | * Copyright (c) 1999-2003 Damien Miller. All rights reserved. |
| @@ -101,6 +101,11 @@ int daemon(int nochdir, int noclose); | |||
| 101 | char *dirname(const char *path); | 101 | char *dirname(const char *path); |
| 102 | #endif | 102 | #endif |
| 103 | 103 | ||
| 104 | #ifndef HAVE_FMT_SCALED | ||
| 105 | #define FMT_SCALED_STRSIZE 7 | ||
| 106 | int fmt_scaled(long long number, char *result); | ||
| 107 | #endif | ||
| 108 | |||
| 104 | #if defined(BROKEN_INET_NTOA) || !defined(HAVE_INET_NTOA) | 109 | #if defined(BROKEN_INET_NTOA) || !defined(HAVE_INET_NTOA) |
| 105 | char *inet_ntoa(struct in_addr in); | 110 | char *inet_ntoa(struct in_addr in); |
| 106 | #endif | 111 | #endif |
| @@ -139,6 +144,7 @@ int writev(int, struct iovec *, int); | |||
| 139 | 144 | ||
| 140 | /* Home grown routines */ | 145 | /* Home grown routines */ |
| 141 | #include "bsd-misc.h" | 146 | #include "bsd-misc.h" |
| 147 | #include "bsd-statvfs.h" | ||
| 142 | #include "bsd-waitpid.h" | 148 | #include "bsd-waitpid.h" |
| 143 | #include "bsd-poll.h" | 149 | #include "bsd-poll.h" |
| 144 | 150 | ||
| @@ -151,6 +157,14 @@ unsigned int arc4random(void); | |||
| 151 | void arc4random_stir(void); | 157 | void arc4random_stir(void); |
| 152 | #endif /* !HAVE_ARC4RANDOM */ | 158 | #endif /* !HAVE_ARC4RANDOM */ |
| 153 | 159 | ||
| 160 | #ifndef HAVE_ARC4RANDOM_BUF | ||
| 161 | void arc4random_buf(void *, size_t); | ||
| 162 | #endif | ||
| 163 | |||
| 164 | #ifndef HAVE_ARC4RANDOM_UNIFORM | ||
| 165 | u_int32_t arc4random_uniform(u_int32_t); | ||
| 166 | #endif | ||
| 167 | |||
| 154 | #ifndef HAVE_ASPRINTF | 168 | #ifndef HAVE_ASPRINTF |
| 155 | int asprintf(char **, const char *, ...); | 169 | int asprintf(char **, const char *, ...); |
| 156 | #endif | 170 | #endif |
diff --git a/openbsd-compat/openssl-compat.c b/openbsd-compat/openssl-compat.c index 45ebd3f66..49238ba80 100644 --- a/openbsd-compat/openssl-compat.c +++ b/openbsd-compat/openssl-compat.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $Id: openssl-compat.c,v 1.4 2006/02/22 11:24:47 dtucker Exp $ */ | 1 | /* $Id: openssl-compat.c,v 1.6 2008/02/28 08:13:52 dtucker Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Copyright (c) 2005 Darren Tucker <dtucker@zip.com.au> | 4 | * Copyright (c) 2005 Darren Tucker <dtucker@zip.com.au> |
diff --git a/openbsd-compat/openssl-compat.h b/openbsd-compat/openssl-compat.h index f1d2f19fc..6a1bed5b2 100644 --- a/openbsd-compat/openssl-compat.h +++ b/openbsd-compat/openssl-compat.h | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $Id: openssl-compat.h,v 1.10 2007/06/14 13:47:31 dtucker Exp $ */ | 1 | /* $Id: openssl-compat.h,v 1.12 2008/02/28 08:22:04 dtucker Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Copyright (c) 2005 Darren Tucker <dtucker@zip.com.au> | 4 | * Copyright (c) 2005 Darren Tucker <dtucker@zip.com.au> |
| @@ -19,6 +19,11 @@ | |||
| 19 | #include "includes.h" | 19 | #include "includes.h" |
| 20 | #include <openssl/evp.h> | 20 | #include <openssl/evp.h> |
| 21 | 21 | ||
| 22 | /* OPENSSL_free() is Free() in versions before OpenSSL 0.9.6 */ | ||
| 23 | #if !defined(OPENSSL_VERSION_NUMBER) || (OPENSSL_VERSION_NUMBER < 0x0090600f) | ||
| 24 | # define OPENSSL_free(x) Free(x) | ||
| 25 | #endif | ||
| 26 | |||
| 22 | #if OPENSSL_VERSION_NUMBER < 0x00906000L | 27 | #if OPENSSL_VERSION_NUMBER < 0x00906000L |
| 23 | # define SSH_OLD_EVP | 28 | # define SSH_OLD_EVP |
| 24 | # define EVP_CIPHER_CTX_get_app_data(e) ((e)->app_data) | 29 | # define EVP_CIPHER_CTX_get_app_data(e) ((e)->app_data) |
| @@ -79,8 +84,8 @@ extern const EVP_CIPHER *evp_acss(void); | |||
| 79 | # ifdef SSLeay_add_all_algorithms | 84 | # ifdef SSLeay_add_all_algorithms |
| 80 | # undef SSLeay_add_all_algorithms | 85 | # undef SSLeay_add_all_algorithms |
| 81 | # endif | 86 | # endif |
| 82 | # define SSLeay_add_all_algorithms() ssh_SSLeay_add_all_algorithms() | 87 | # define SSLeay_add_all_algorithms() ssh_SSLeay_add_all_algorithms() |
| 83 | #endif | 88 | # endif |
| 84 | 89 | ||
| 85 | int ssh_EVP_CipherInit(EVP_CIPHER_CTX *, const EVP_CIPHER *, unsigned char *, | 90 | int ssh_EVP_CipherInit(EVP_CIPHER_CTX *, const EVP_CIPHER *, unsigned char *, |
| 86 | unsigned char *, int); | 91 | unsigned char *, int); |
diff --git a/openbsd-compat/port-aix.c b/openbsd-compat/port-aix.c index 94faec670..5b1cb7387 100644 --- a/openbsd-compat/port-aix.c +++ b/openbsd-compat/port-aix.c | |||
| @@ -1,7 +1,7 @@ | |||
| 1 | /* | 1 | /* |
| 2 | * | 2 | * |
| 3 | * Copyright (c) 2001 Gert Doering. All rights reserved. | 3 | * Copyright (c) 2001 Gert Doering. All rights reserved. |
| 4 | * Copyright (c) 2003,2004,2005 Darren Tucker. All rights reserved. | 4 | * Copyright (c) 2003,2004,2005,2006 Darren Tucker. All rights reserved. |
| 5 | * | 5 | * |
| 6 | * Redistribution and use in source and binary forms, with or without | 6 | * Redistribution and use in source and binary forms, with or without |
| 7 | * modification, are permitted provided that the following conditions | 7 | * modification, are permitted provided that the following conditions |
| @@ -394,4 +394,47 @@ sshaix_getnameinfo(const struct sockaddr *sa, size_t salen, char *host, | |||
| 394 | } | 394 | } |
| 395 | # endif /* AIX_GETNAMEINFO_HACK */ | 395 | # endif /* AIX_GETNAMEINFO_HACK */ |
| 396 | 396 | ||
| 397 | # if defined(USE_GETGRSET) | ||
| 398 | # include <stdlib.h> | ||
| 399 | int | ||
| 400 | getgrouplist(const char *user, gid_t pgid, gid_t *groups, int *grpcnt) | ||
| 401 | { | ||
| 402 | char *cp, *grplist, *grp; | ||
| 403 | gid_t gid; | ||
| 404 | int ret = 0, ngroups = 0, maxgroups; | ||
| 405 | long l; | ||
| 406 | |||
| 407 | maxgroups = *grpcnt; | ||
| 408 | |||
| 409 | if ((cp = grplist = getgrset(user)) == NULL) | ||
| 410 | return -1; | ||
| 411 | |||
| 412 | /* handle zero-length case */ | ||
| 413 | if (maxgroups <= 0) { | ||
| 414 | *grpcnt = 0; | ||
| 415 | return -1; | ||
| 416 | } | ||
| 417 | |||
| 418 | /* copy primary group */ | ||
| 419 | groups[ngroups++] = pgid; | ||
| 420 | |||
| 421 | /* copy each entry from getgrset into group list */ | ||
| 422 | while ((grp = strsep(&grplist, ",")) != NULL) { | ||
| 423 | l = strtol(grp, NULL, 10); | ||
| 424 | if (ngroups >= maxgroups || l == LONG_MIN || l == LONG_MAX) { | ||
| 425 | ret = -1; | ||
| 426 | goto out; | ||
| 427 | } | ||
| 428 | gid = (gid_t)l; | ||
| 429 | if (gid == pgid) | ||
| 430 | continue; /* we have already added primary gid */ | ||
| 431 | groups[ngroups++] = gid; | ||
| 432 | } | ||
| 433 | out: | ||
| 434 | free(cp); | ||
| 435 | *grpcnt = ngroups; | ||
| 436 | return ret; | ||
| 437 | } | ||
| 438 | # endif /* USE_GETGRSET */ | ||
| 439 | |||
| 397 | #endif /* _AIX */ | 440 | #endif /* _AIX */ |
diff --git a/openbsd-compat/port-aix.h b/openbsd-compat/port-aix.h index 5a04bedad..ecb9feae8 100644 --- a/openbsd-compat/port-aix.h +++ b/openbsd-compat/port-aix.h | |||
| @@ -1,9 +1,9 @@ | |||
| 1 | /* $Id: port-aix.h,v 1.27 2006/09/18 13:54:33 dtucker Exp $ */ | 1 | /* $Id: port-aix.h,v 1.29 2008/03/09 05:36:55 dtucker Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * | 4 | * |
| 5 | * Copyright (c) 2001 Gert Doering. All rights reserved. | 5 | * Copyright (c) 2001 Gert Doering. All rights reserved. |
| 6 | * Copyright (c) 2004, 2005 Darren Tucker. All rights reserved. | 6 | * Copyright (c) 2004,2005,2006 Darren Tucker. All rights reserved. |
| 7 | * | 7 | * |
| 8 | * Redistribution and use in source and binary forms, with or without | 8 | * Redistribution and use in source and binary forms, with or without |
| 9 | * modification, are permitted provided that the following conditions | 9 | * modification, are permitted provided that the following conditions |
| @@ -103,4 +103,14 @@ int sshaix_getnameinfo(const struct sockaddr *, size_t, char *, size_t, | |||
| 103 | # define getnameinfo(a,b,c,d,e,f,g) (sshaix_getnameinfo(a,b,c,d,e,f,g)) | 103 | # define getnameinfo(a,b,c,d,e,f,g) (sshaix_getnameinfo(a,b,c,d,e,f,g)) |
| 104 | #endif | 104 | #endif |
| 105 | 105 | ||
| 106 | /* | ||
| 107 | * We use getgrset in preference to multiple getgrent calls for efficiency | ||
| 108 | * plus it supports NIS and LDAP groups. | ||
| 109 | */ | ||
| 110 | #if !defined(HAVE_GETGROUPLIST) && defined(HAVE_GETGRSET) | ||
| 111 | # define HAVE_GETGROUPLIST | ||
| 112 | # define USE_GETGRSET | ||
| 113 | int getgrouplist(const char *, gid_t, gid_t *, int *); | ||
| 114 | #endif | ||
| 115 | |||
| 106 | #endif /* _AIX */ | 116 | #endif /* _AIX */ |
diff --git a/openbsd-compat/port-linux.c b/openbsd-compat/port-linux.c index a9aa773ef..bc4924727 100644 --- a/openbsd-compat/port-linux.c +++ b/openbsd-compat/port-linux.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $Id: port-linux.c,v 1.4 2007/06/27 22:48:03 djm Exp $ */ | 1 | /* $Id: port-linux.c,v 1.5 2008/03/26 20:27:21 dtucker Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Copyright (c) 2005 Daniel Walsh <dwalsh@redhat.com> | 4 | * Copyright (c) 2005 Daniel Walsh <dwalsh@redhat.com> |
| @@ -52,7 +52,7 @@ | |||
| 52 | extern Authctxt *the_authctxt; | 52 | extern Authctxt *the_authctxt; |
| 53 | 53 | ||
| 54 | /* Wrapper around is_selinux_enabled() to log its return value once only */ | 54 | /* Wrapper around is_selinux_enabled() to log its return value once only */ |
| 55 | static int | 55 | int |
| 56 | ssh_selinux_enabled(void) | 56 | ssh_selinux_enabled(void) |
| 57 | { | 57 | { |
| 58 | static int enabled = -1; | 58 | static int enabled = -1; |
diff --git a/openbsd-compat/port-linux.h b/openbsd-compat/port-linux.h index cb8a253c4..2a3271a93 100644 --- a/openbsd-compat/port-linux.h +++ b/openbsd-compat/port-linux.h | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $Id: port-linux.h,v 1.1 2006/04/22 11:26:08 djm Exp $ */ | 1 | /* $Id: port-linux.h,v 1.2 2008/03/26 20:27:21 dtucker Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Copyright (c) 2006 Damien Miller <djm@openbsd.org> | 4 | * Copyright (c) 2006 Damien Miller <djm@openbsd.org> |
| @@ -20,6 +20,7 @@ | |||
| 20 | #define _PORT_LINUX_H | 20 | #define _PORT_LINUX_H |
| 21 | 21 | ||
| 22 | #ifdef WITH_SELINUX | 22 | #ifdef WITH_SELINUX |
| 23 | int ssh_selinux_enabled(void); | ||
| 23 | void ssh_selinux_setup_pty(char *, const char *); | 24 | void ssh_selinux_setup_pty(char *, const char *); |
| 24 | void ssh_selinux_setup_exec_context(char *); | 25 | void ssh_selinux_setup_exec_context(char *); |
| 25 | #endif | 26 | #endif |
diff --git a/openbsd-compat/port-tun.c b/openbsd-compat/port-tun.c index 276474db8..ddc92d0f3 100644 --- a/openbsd-compat/port-tun.c +++ b/openbsd-compat/port-tun.c | |||
| @@ -29,6 +29,7 @@ | |||
| 29 | #include <string.h> | 29 | #include <string.h> |
| 30 | #include <unistd.h> | 30 | #include <unistd.h> |
| 31 | 31 | ||
| 32 | #include "openbsd-compat/sys-queue.h" | ||
| 32 | #include "log.h" | 33 | #include "log.h" |
| 33 | #include "misc.h" | 34 | #include "misc.h" |
| 34 | #include "buffer.h" | 35 | #include "buffer.h" |
diff --git a/openbsd-compat/regress/closefromtest.c b/openbsd-compat/regress/closefromtest.c index bb129fa16..145b09d7b 100644 --- a/openbsd-compat/regress/closefromtest.c +++ b/openbsd-compat/regress/closefromtest.c | |||
| @@ -57,4 +57,5 @@ main(void) | |||
| 57 | for (i = 0; i < NUM_OPENS; i++) | 57 | for (i = 0; i < NUM_OPENS; i++) |
| 58 | if (close(fds[i]) != -1) | 58 | if (close(fds[i]) != -1) |
| 59 | fail("failed to close from lowest fd"); | 59 | fail("failed to close from lowest fd"); |
| 60 | return 0; | ||
| 60 | } | 61 | } |
diff --git a/openbsd-compat/regress/strtonumtest.c b/openbsd-compat/regress/strtonumtest.c index cb8585129..50ca5bd22 100644 --- a/openbsd-compat/regress/strtonumtest.c +++ b/openbsd-compat/regress/strtonumtest.c | |||
| @@ -21,6 +21,20 @@ | |||
| 21 | #include <stdio.h> | 21 | #include <stdio.h> |
| 22 | #include <stdlib.h> | 22 | #include <stdlib.h> |
| 23 | 23 | ||
| 24 | /* LLONG_MAX is known as LONGLONG_MAX on AIX */ | ||
| 25 | #if defined(LONGLONG_MAX) && !defined(LLONG_MAX) | ||
| 26 | # define LLONG_MAX LONGLONG_MAX | ||
| 27 | # define LLONG_MIN LONGLONG_MIN | ||
| 28 | #endif | ||
| 29 | |||
| 30 | /* LLONG_MAX is known as LONG_LONG_MAX on HP-UX */ | ||
| 31 | #if defined(LONG_LONG_MAX) && !defined(LLONG_MAX) | ||
| 32 | # define LLONG_MAX LONG_LONG_MAX | ||
| 33 | # define LLONG_MIN LONG_LONG_MIN | ||
| 34 | #endif | ||
| 35 | |||
| 36 | long long strtonum(const char *, long long, long long, const char **); | ||
| 37 | |||
| 24 | int fail; | 38 | int fail; |
| 25 | 39 | ||
| 26 | void | 40 | void |
diff --git a/openbsd-compat/rresvport.c b/openbsd-compat/rresvport.c index 5b0275ce0..1cd61e58d 100644 --- a/openbsd-compat/rresvport.c +++ b/openbsd-compat/rresvport.c | |||
| @@ -44,6 +44,7 @@ | |||
| 44 | #include <errno.h> | 44 | #include <errno.h> |
| 45 | #include <stdlib.h> | 45 | #include <stdlib.h> |
| 46 | #include <string.h> | 46 | #include <string.h> |
| 47 | #include <unistd.h> | ||
| 47 | 48 | ||
| 48 | #if 0 | 49 | #if 0 |
| 49 | int | 50 | int |
diff --git a/openbsd-compat/setenv.c b/openbsd-compat/setenv.c index b52a99c2c..e2a8b6dd3 100644 --- a/openbsd-compat/setenv.c +++ b/openbsd-compat/setenv.c | |||
| @@ -47,7 +47,7 @@ extern char **environ; | |||
| 47 | * Explicitly removes '=' in argument name. | 47 | * Explicitly removes '=' in argument name. |
| 48 | */ | 48 | */ |
| 49 | static char * | 49 | static char * |
| 50 | __findenv(const char *name, int *offset) | 50 | __findenv(const char *name, size_t *offset) |
| 51 | { | 51 | { |
| 52 | extern char **environ; | 52 | extern char **environ; |
| 53 | int len, i; | 53 | int len, i; |
| @@ -82,7 +82,7 @@ setenv(const char *name, const char *value, int rewrite) | |||
| 82 | { | 82 | { |
| 83 | static char **lastenv; /* last value of environ */ | 83 | static char **lastenv; /* last value of environ */ |
| 84 | char *C; | 84 | char *C; |
| 85 | int l_value, offset; | 85 | size_t l_value, offset; |
| 86 | 86 | ||
| 87 | if (*value == '=') /* no `=' in value */ | 87 | if (*value == '=') /* no `=' in value */ |
| 88 | ++value; | 88 | ++value; |
| @@ -133,7 +133,7 @@ void | |||
| 133 | unsetenv(const char *name) | 133 | unsetenv(const char *name) |
| 134 | { | 134 | { |
| 135 | char **P; | 135 | char **P; |
| 136 | int offset; | 136 | size_t offset; |
| 137 | 137 | ||
| 138 | while (__findenv(name, &offset)) /* if set multiple times */ | 138 | while (__findenv(name, &offset)) /* if set multiple times */ |
| 139 | for (P = &environ[offset];; ++P) | 139 | for (P = &environ[offset];; ++P) |
diff --git a/openbsd-compat/setproctitle.c b/openbsd-compat/setproctitle.c index b511f6649..2965f689e 100644 --- a/openbsd-compat/setproctitle.c +++ b/openbsd-compat/setproctitle.c | |||
| @@ -43,6 +43,8 @@ | |||
| 43 | #endif | 43 | #endif |
| 44 | #include <string.h> | 44 | #include <string.h> |
| 45 | 45 | ||
| 46 | #include <vis.h> | ||
| 47 | |||
| 46 | #define SPT_NONE 0 /* don't use it at all */ | 48 | #define SPT_NONE 0 /* don't use it at all */ |
| 47 | #define SPT_PSTAT 1 /* use pstat(PSTAT_SETCMD, ...) */ | 49 | #define SPT_PSTAT 1 /* use pstat(PSTAT_SETCMD, ...) */ |
| 48 | #define SPT_REUSEARGV 2 /* cover argv with title information */ | 50 | #define SPT_REUSEARGV 2 /* cover argv with title information */ |
| @@ -121,7 +123,7 @@ setproctitle(const char *fmt, ...) | |||
| 121 | { | 123 | { |
| 122 | #if SPT_TYPE != SPT_NONE | 124 | #if SPT_TYPE != SPT_NONE |
| 123 | va_list ap; | 125 | va_list ap; |
| 124 | char buf[1024]; | 126 | char buf[1024], ptitle[1024]; |
| 125 | size_t len; | 127 | size_t len; |
| 126 | extern char *__progname; | 128 | extern char *__progname; |
| 127 | #if SPT_TYPE == SPT_PSTAT | 129 | #if SPT_TYPE == SPT_PSTAT |
| @@ -142,14 +144,16 @@ setproctitle(const char *fmt, ...) | |||
| 142 | vsnprintf(buf + len, sizeof(buf) - len , fmt, ap); | 144 | vsnprintf(buf + len, sizeof(buf) - len , fmt, ap); |
| 143 | } | 145 | } |
| 144 | va_end(ap); | 146 | va_end(ap); |
| 147 | strnvis(ptitle, buf, sizeof(ptitle), | ||
| 148 | VIS_CSTYLE|VIS_NL|VIS_TAB|VIS_OCTAL); | ||
| 145 | 149 | ||
| 146 | #if SPT_TYPE == SPT_PSTAT | 150 | #if SPT_TYPE == SPT_PSTAT |
| 147 | pst.pst_command = buf; | 151 | pst.pst_command = ptitle; |
| 148 | pstat(PSTAT_SETCMD, pst, strlen(buf), 0, 0); | 152 | pstat(PSTAT_SETCMD, pst, strlen(ptitle), 0, 0); |
| 149 | #elif SPT_TYPE == SPT_REUSEARGV | 153 | #elif SPT_TYPE == SPT_REUSEARGV |
| 150 | /* debug("setproctitle: copy \"%s\" into len %d", | 154 | /* debug("setproctitle: copy \"%s\" into len %d", |
| 151 | buf, argv_env_len); */ | 155 | buf, argv_env_len); */ |
| 152 | len = strlcpy(argv_start, buf, argv_env_len); | 156 | len = strlcpy(argv_start, ptitle, argv_env_len); |
| 153 | for(; len < argv_env_len; len++) | 157 | for(; len < argv_env_len; len++) |
| 154 | argv_start[len] = SPT_PADCHAR; | 158 | argv_start[len] = SPT_PADCHAR; |
| 155 | #endif | 159 | #endif |
diff --git a/openbsd-compat/sigact.c b/openbsd-compat/sigact.c index 8b8e4dd2c..d67845cf1 100644 --- a/openbsd-compat/sigact.c +++ b/openbsd-compat/sigact.c | |||
| @@ -36,6 +36,7 @@ | |||
| 36 | /* OPENBSD ORIGINAL: lib/libcurses/base/sigaction.c */ | 36 | /* OPENBSD ORIGINAL: lib/libcurses/base/sigaction.c */ |
| 37 | 37 | ||
| 38 | #include "includes.h" | 38 | #include "includes.h" |
| 39 | #include <errno.h> | ||
| 39 | #include <signal.h> | 40 | #include <signal.h> |
| 40 | #include "sigact.h" | 41 | #include "sigact.h" |
| 41 | 42 | ||
| @@ -47,28 +48,39 @@ | |||
| 47 | int | 48 | int |
| 48 | sigaction(int sig, struct sigaction *sigact, struct sigaction *osigact) | 49 | sigaction(int sig, struct sigaction *sigact, struct sigaction *osigact) |
| 49 | { | 50 | { |
| 50 | return sigvec(sig, &(sigact->sv), &(osigact->sv)); | 51 | return sigvec(sig, sigact ? &sigact->sv : NULL, |
| 52 | osigact ? &osigact->sv : NULL); | ||
| 51 | } | 53 | } |
| 52 | 54 | ||
| 53 | int | 55 | int |
| 54 | sigemptyset (sigset_t * mask) | 56 | sigemptyset (sigset_t *mask) |
| 55 | { | 57 | { |
| 58 | if (!mask) { | ||
| 59 | errno = EINVAL; | ||
| 60 | return -1; | ||
| 61 | } | ||
| 56 | *mask = 0; | 62 | *mask = 0; |
| 57 | return 0; | 63 | return 0; |
| 58 | } | 64 | } |
| 59 | 65 | ||
| 60 | int | 66 | int |
| 61 | sigprocmask (int mode, sigset_t * mask, sigset_t * omask) | 67 | sigprocmask (int mode, sigset_t *mask, sigset_t *omask) |
| 62 | { | 68 | { |
| 63 | sigset_t current = sigsetmask(0); | 69 | sigset_t current = sigsetmask(0); |
| 64 | 70 | ||
| 65 | if (omask) *omask = current; | 71 | if (!mask) { |
| 72 | errno = EINVAL; | ||
| 73 | return -1; | ||
| 74 | } | ||
| 66 | 75 | ||
| 67 | if (mode==SIG_BLOCK) | 76 | if (omask) |
| 77 | *omask = current; | ||
| 78 | |||
| 79 | if (mode == SIG_BLOCK) | ||
| 68 | current |= *mask; | 80 | current |= *mask; |
| 69 | else if (mode==SIG_UNBLOCK) | 81 | else if (mode == SIG_UNBLOCK) |
| 70 | current &= ~*mask; | 82 | current &= ~*mask; |
| 71 | else if (mode==SIG_SETMASK) | 83 | else if (mode == SIG_SETMASK) |
| 72 | current = *mask; | 84 | current = *mask; |
| 73 | 85 | ||
| 74 | sigsetmask(current); | 86 | sigsetmask(current); |
| @@ -76,28 +88,44 @@ sigprocmask (int mode, sigset_t * mask, sigset_t * omask) | |||
| 76 | } | 88 | } |
| 77 | 89 | ||
| 78 | int | 90 | int |
| 79 | sigsuspend (sigset_t * mask) | 91 | sigsuspend (sigset_t *mask) |
| 80 | { | 92 | { |
| 93 | if (!mask) { | ||
| 94 | errno = EINVAL; | ||
| 95 | return -1; | ||
| 96 | } | ||
| 81 | return sigpause(*mask); | 97 | return sigpause(*mask); |
| 82 | } | 98 | } |
| 83 | 99 | ||
| 84 | int | 100 | int |
| 85 | sigdelset (sigset_t * mask, int sig) | 101 | sigdelset (sigset_t *mask, int sig) |
| 86 | { | 102 | { |
| 103 | if (!mask) { | ||
| 104 | errno = EINVAL; | ||
| 105 | return -1; | ||
| 106 | } | ||
| 87 | *mask &= ~sigmask(sig); | 107 | *mask &= ~sigmask(sig); |
| 88 | return 0; | 108 | return 0; |
| 89 | } | 109 | } |
| 90 | 110 | ||
| 91 | int | 111 | int |
| 92 | sigaddset (sigset_t * mask, int sig) | 112 | sigaddset (sigset_t *mask, int sig) |
| 93 | { | 113 | { |
| 114 | if (!mask) { | ||
| 115 | errno = EINVAL; | ||
| 116 | return -1; | ||
| 117 | } | ||
| 94 | *mask |= sigmask(sig); | 118 | *mask |= sigmask(sig); |
| 95 | return 0; | 119 | return 0; |
| 96 | } | 120 | } |
| 97 | 121 | ||
| 98 | int | 122 | int |
| 99 | sigismember (sigset_t * mask, int sig) | 123 | sigismember (sigset_t *mask, int sig) |
| 100 | { | 124 | { |
| 125 | if (!mask) { | ||
| 126 | errno = EINVAL; | ||
| 127 | return -1; | ||
| 128 | } | ||
| 101 | return (*mask & sigmask(sig)) != 0; | 129 | return (*mask & sigmask(sig)) != 0; |
| 102 | } | 130 | } |
| 103 | 131 | ||
diff --git a/openbsd-compat/sys-queue.h b/openbsd-compat/sys-queue.h index 402343324..5cf0587bd 100644 --- a/openbsd-compat/sys-queue.h +++ b/openbsd-compat/sys-queue.h | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: queue.h,v 1.25 2004/04/08 16:08:21 henning Exp $ */ | 1 | /* $OpenBSD: queue.h,v 1.32 2007/04/30 18:42:34 pedro Exp $ */ |
| 2 | /* $NetBSD: queue.h,v 1.11 1996/05/16 05:17:14 mycroft Exp $ */ | 2 | /* $NetBSD: queue.h,v 1.11 1996/05/16 05:17:14 mycroft Exp $ */ |
| 3 | 3 | ||
| 4 | /* | 4 | /* |
| @@ -167,6 +167,12 @@ | |||
| 167 | * For details on the use of these macros, see the queue(3) manual page. | 167 | * For details on the use of these macros, see the queue(3) manual page. |
| 168 | */ | 168 | */ |
| 169 | 169 | ||
| 170 | #if defined(QUEUE_MACRO_DEBUG) || (defined(_KERNEL) && defined(DIAGNOSTIC)) | ||
| 171 | #define _Q_INVALIDATE(a) (a) = ((void *)-1) | ||
| 172 | #else | ||
| 173 | #define _Q_INVALIDATE(a) | ||
| 174 | #endif | ||
| 175 | |||
| 170 | /* | 176 | /* |
| 171 | * Singly-linked List definitions. | 177 | * Singly-linked List definitions. |
| 172 | */ | 178 | */ |
| @@ -229,13 +235,14 @@ struct { \ | |||
| 229 | #define SLIST_REMOVE(head, elm, type, field) do { \ | 235 | #define SLIST_REMOVE(head, elm, type, field) do { \ |
| 230 | if ((head)->slh_first == (elm)) { \ | 236 | if ((head)->slh_first == (elm)) { \ |
| 231 | SLIST_REMOVE_HEAD((head), field); \ | 237 | SLIST_REMOVE_HEAD((head), field); \ |
| 232 | } \ | 238 | } else { \ |
| 233 | else { \ | ||
| 234 | struct type *curelm = (head)->slh_first; \ | 239 | struct type *curelm = (head)->slh_first; \ |
| 235 | while( curelm->field.sle_next != (elm) ) \ | 240 | \ |
| 241 | while (curelm->field.sle_next != (elm)) \ | ||
| 236 | curelm = curelm->field.sle_next; \ | 242 | curelm = curelm->field.sle_next; \ |
| 237 | curelm->field.sle_next = \ | 243 | curelm->field.sle_next = \ |
| 238 | curelm->field.sle_next->field.sle_next; \ | 244 | curelm->field.sle_next->field.sle_next; \ |
| 245 | _Q_INVALIDATE((elm)->field.sle_next); \ | ||
| 239 | } \ | 246 | } \ |
| 240 | } while (0) | 247 | } while (0) |
| 241 | 248 | ||
| @@ -303,6 +310,8 @@ struct { \ | |||
| 303 | (elm)->field.le_next->field.le_prev = \ | 310 | (elm)->field.le_next->field.le_prev = \ |
| 304 | (elm)->field.le_prev; \ | 311 | (elm)->field.le_prev; \ |
| 305 | *(elm)->field.le_prev = (elm)->field.le_next; \ | 312 | *(elm)->field.le_prev = (elm)->field.le_next; \ |
| 313 | _Q_INVALIDATE((elm)->field.le_prev); \ | ||
| 314 | _Q_INVALIDATE((elm)->field.le_next); \ | ||
| 306 | } while (0) | 315 | } while (0) |
| 307 | 316 | ||
| 308 | #define LIST_REPLACE(elm, elm2, field) do { \ | 317 | #define LIST_REPLACE(elm, elm2, field) do { \ |
| @@ -311,6 +320,8 @@ struct { \ | |||
| 311 | &(elm2)->field.le_next; \ | 320 | &(elm2)->field.le_next; \ |
| 312 | (elm2)->field.le_prev = (elm)->field.le_prev; \ | 321 | (elm2)->field.le_prev = (elm)->field.le_prev; \ |
| 313 | *(elm2)->field.le_prev = (elm2); \ | 322 | *(elm2)->field.le_prev = (elm2); \ |
| 323 | _Q_INVALIDATE((elm)->field.le_prev); \ | ||
| 324 | _Q_INVALIDATE((elm)->field.le_next); \ | ||
| 314 | } while (0) | 325 | } while (0) |
| 315 | 326 | ||
| 316 | /* | 327 | /* |
| @@ -369,8 +380,8 @@ struct { \ | |||
| 369 | (listelm)->field.sqe_next = (elm); \ | 380 | (listelm)->field.sqe_next = (elm); \ |
| 370 | } while (0) | 381 | } while (0) |
| 371 | 382 | ||
| 372 | #define SIMPLEQ_REMOVE_HEAD(head, elm, field) do { \ | 383 | #define SIMPLEQ_REMOVE_HEAD(head, field) do { \ |
| 373 | if (((head)->sqh_first = (elm)->field.sqe_next) == NULL) \ | 384 | if (((head)->sqh_first = (head)->sqh_first->field.sqe_next) == NULL) \ |
| 374 | (head)->sqh_last = &(head)->sqh_first; \ | 385 | (head)->sqh_last = &(head)->sqh_first; \ |
| 375 | } while (0) | 386 | } while (0) |
| 376 | 387 | ||
| @@ -465,6 +476,8 @@ struct { \ | |||
| 465 | else \ | 476 | else \ |
| 466 | (head)->tqh_last = (elm)->field.tqe_prev; \ | 477 | (head)->tqh_last = (elm)->field.tqe_prev; \ |
| 467 | *(elm)->field.tqe_prev = (elm)->field.tqe_next; \ | 478 | *(elm)->field.tqe_prev = (elm)->field.tqe_next; \ |
| 479 | _Q_INVALIDATE((elm)->field.tqe_prev); \ | ||
| 480 | _Q_INVALIDATE((elm)->field.tqe_next); \ | ||
| 468 | } while (0) | 481 | } while (0) |
| 469 | 482 | ||
| 470 | #define TAILQ_REPLACE(head, elm, elm2, field) do { \ | 483 | #define TAILQ_REPLACE(head, elm, elm2, field) do { \ |
| @@ -475,6 +488,8 @@ struct { \ | |||
| 475 | (head)->tqh_last = &(elm2)->field.tqe_next; \ | 488 | (head)->tqh_last = &(elm2)->field.tqe_next; \ |
| 476 | (elm2)->field.tqe_prev = (elm)->field.tqe_prev; \ | 489 | (elm2)->field.tqe_prev = (elm)->field.tqe_prev; \ |
| 477 | *(elm2)->field.tqe_prev = (elm2); \ | 490 | *(elm2)->field.tqe_prev = (elm2); \ |
| 491 | _Q_INVALIDATE((elm)->field.tqe_prev); \ | ||
| 492 | _Q_INVALIDATE((elm)->field.tqe_next); \ | ||
| 478 | } while (0) | 493 | } while (0) |
| 479 | 494 | ||
| 480 | /* | 495 | /* |
| @@ -575,6 +590,8 @@ struct { \ | |||
| 575 | else \ | 590 | else \ |
| 576 | (elm)->field.cqe_prev->field.cqe_next = \ | 591 | (elm)->field.cqe_prev->field.cqe_next = \ |
| 577 | (elm)->field.cqe_next; \ | 592 | (elm)->field.cqe_next; \ |
| 593 | _Q_INVALIDATE((elm)->field.cqe_prev); \ | ||
| 594 | _Q_INVALIDATE((elm)->field.cqe_next); \ | ||
| 578 | } while (0) | 595 | } while (0) |
| 579 | 596 | ||
| 580 | #define CIRCLEQ_REPLACE(head, elm, elm2, field) do { \ | 597 | #define CIRCLEQ_REPLACE(head, elm, elm2, field) do { \ |
| @@ -588,6 +605,8 @@ struct { \ | |||
| 588 | (head).cqh_first = (elm2); \ | 605 | (head).cqh_first = (elm2); \ |
| 589 | else \ | 606 | else \ |
| 590 | (elm2)->field.cqe_prev->field.cqe_next = (elm2); \ | 607 | (elm2)->field.cqe_prev->field.cqe_next = (elm2); \ |
| 608 | _Q_INVALIDATE((elm)->field.cqe_prev); \ | ||
| 609 | _Q_INVALIDATE((elm)->field.cqe_next); \ | ||
| 591 | } while (0) | 610 | } while (0) |
| 592 | 611 | ||
| 593 | #endif /* !_FAKE_QUEUE_H_ */ | 612 | #endif /* !_FAKE_QUEUE_H_ */ |
diff --git a/openbsd-compat/sys-tree.h b/openbsd-compat/sys-tree.h index c80b90b21..d4949b5e7 100644 --- a/openbsd-compat/sys-tree.h +++ b/openbsd-compat/sys-tree.h | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: tree.h,v 1.7 2002/10/17 21:51:54 art Exp $ */ | 1 | /* $OpenBSD: tree.h,v 1.10 2007/10/29 23:49:41 djm Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Copyright 2002 Niels Provos <provos@citi.umich.edu> | 3 | * Copyright 2002 Niels Provos <provos@citi.umich.edu> |
| 4 | * All rights reserved. | 4 | * All rights reserved. |
| @@ -289,7 +289,7 @@ void name##_SPLAY_MINMAX(struct name *head, int __comp) \ | |||
| 289 | (x) != NULL; \ | 289 | (x) != NULL; \ |
| 290 | (x) = SPLAY_NEXT(name, head, x)) | 290 | (x) = SPLAY_NEXT(name, head, x)) |
| 291 | 291 | ||
| 292 | /* Macros that define a red-back tree */ | 292 | /* Macros that define a red-black tree */ |
| 293 | #define RB_HEAD(name, type) \ | 293 | #define RB_HEAD(name, type) \ |
| 294 | struct name { \ | 294 | struct name { \ |
| 295 | struct type *rbh_root; /* root of the tree */ \ | 295 | struct type *rbh_root; /* root of the tree */ \ |
| @@ -381,9 +381,9 @@ void name##_RB_REMOVE_COLOR(struct name *, struct type *, struct type *);\ | |||
| 381 | struct type *name##_RB_REMOVE(struct name *, struct type *); \ | 381 | struct type *name##_RB_REMOVE(struct name *, struct type *); \ |
| 382 | struct type *name##_RB_INSERT(struct name *, struct type *); \ | 382 | struct type *name##_RB_INSERT(struct name *, struct type *); \ |
| 383 | struct type *name##_RB_FIND(struct name *, struct type *); \ | 383 | struct type *name##_RB_FIND(struct name *, struct type *); \ |
| 384 | struct type *name##_RB_NEXT(struct name *, struct type *); \ | 384 | struct type *name##_RB_NEXT(struct type *); \ |
| 385 | struct type *name##_RB_MINMAX(struct name *, int); \ | 385 | struct type *name##_RB_MINMAX(struct name *, int); |
| 386 | \ | 386 | |
| 387 | 387 | ||
| 388 | /* Main rb operation. | 388 | /* Main rb operation. |
| 389 | * Moves node close to the key of elm to top | 389 | * Moves node close to the key of elm to top |
| @@ -626,7 +626,7 @@ name##_RB_FIND(struct name *head, struct type *elm) \ | |||
| 626 | } \ | 626 | } \ |
| 627 | \ | 627 | \ |
| 628 | struct type * \ | 628 | struct type * \ |
| 629 | name##_RB_NEXT(struct name *head, struct type *elm) \ | 629 | name##_RB_NEXT(struct type *elm) \ |
| 630 | { \ | 630 | { \ |
| 631 | if (RB_RIGHT(elm, field)) { \ | 631 | if (RB_RIGHT(elm, field)) { \ |
| 632 | elm = RB_RIGHT(elm, field); \ | 632 | elm = RB_RIGHT(elm, field); \ |
| @@ -667,13 +667,13 @@ name##_RB_MINMAX(struct name *head, int val) \ | |||
| 667 | #define RB_INSERT(name, x, y) name##_RB_INSERT(x, y) | 667 | #define RB_INSERT(name, x, y) name##_RB_INSERT(x, y) |
| 668 | #define RB_REMOVE(name, x, y) name##_RB_REMOVE(x, y) | 668 | #define RB_REMOVE(name, x, y) name##_RB_REMOVE(x, y) |
| 669 | #define RB_FIND(name, x, y) name##_RB_FIND(x, y) | 669 | #define RB_FIND(name, x, y) name##_RB_FIND(x, y) |
| 670 | #define RB_NEXT(name, x, y) name##_RB_NEXT(x, y) | 670 | #define RB_NEXT(name, x, y) name##_RB_NEXT(y) |
| 671 | #define RB_MIN(name, x) name##_RB_MINMAX(x, RB_NEGINF) | 671 | #define RB_MIN(name, x) name##_RB_MINMAX(x, RB_NEGINF) |
| 672 | #define RB_MAX(name, x) name##_RB_MINMAX(x, RB_INF) | 672 | #define RB_MAX(name, x) name##_RB_MINMAX(x, RB_INF) |
| 673 | 673 | ||
| 674 | #define RB_FOREACH(x, name, head) \ | 674 | #define RB_FOREACH(x, name, head) \ |
| 675 | for ((x) = RB_MIN(name, head); \ | 675 | for ((x) = RB_MIN(name, head); \ |
| 676 | (x) != NULL; \ | 676 | (x) != NULL; \ |
| 677 | (x) = name##_RB_NEXT(head, x)) | 677 | (x) = name##_RB_NEXT(x)) |
| 678 | 678 | ||
| 679 | #endif /* _SYS_TREE_H_ */ | 679 | #endif /* _SYS_TREE_H_ */ |
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: packet.c,v 1.148 2007/06/07 19:37:34 pvalchev Exp $ */ | 1 | /* $OpenBSD: packet.c,v 1.157 2008/07/10 18:08:11 markus Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
| @@ -93,8 +93,6 @@ | |||
| 93 | static int connection_in = -1; | 93 | static int connection_in = -1; |
| 94 | static int connection_out = -1; | 94 | static int connection_out = -1; |
| 95 | 95 | ||
| 96 | static int setup_timeout = -1; | ||
| 97 | |||
| 98 | /* Protocol flags for the remote side. */ | 96 | /* Protocol flags for the remote side. */ |
| 99 | static u_int remote_protocol_flags = 0; | 97 | static u_int remote_protocol_flags = 0; |
| 100 | 98 | ||
| @@ -138,12 +136,18 @@ static int server_side = 0; | |||
| 138 | /* Set to true if we are authenticated. */ | 136 | /* Set to true if we are authenticated. */ |
| 139 | static int after_authentication = 0; | 137 | static int after_authentication = 0; |
| 140 | 138 | ||
| 139 | int keep_alive_timeouts = 0; | ||
| 140 | |||
| 141 | /* Set to the maximum time that we will wait to send or receive a packet */ | ||
| 142 | static int packet_timeout_ms = -1; | ||
| 143 | |||
| 141 | /* Session key information for Encryption and MAC */ | 144 | /* Session key information for Encryption and MAC */ |
| 142 | Newkeys *newkeys[MODE_MAX]; | 145 | Newkeys *newkeys[MODE_MAX]; |
| 143 | static struct packet_state { | 146 | static struct packet_state { |
| 144 | u_int32_t seqnr; | 147 | u_int32_t seqnr; |
| 145 | u_int32_t packets; | 148 | u_int32_t packets; |
| 146 | u_int64_t blocks; | 149 | u_int64_t blocks; |
| 150 | u_int64_t bytes; | ||
| 147 | } p_read, p_send; | 151 | } p_read, p_send; |
| 148 | 152 | ||
| 149 | static u_int64_t max_blocks_in, max_blocks_out; | 153 | static u_int64_t max_blocks_in, max_blocks_out; |
| @@ -168,7 +172,7 @@ TAILQ_HEAD(, packet) outgoing; | |||
| 168 | * packet_set_encryption_key is called. | 172 | * packet_set_encryption_key is called. |
| 169 | */ | 173 | */ |
| 170 | void | 174 | void |
| 171 | packet_set_connection(int fd_in, int fd_out, int new_setup_timeout) | 175 | packet_set_connection(int fd_in, int fd_out) |
| 172 | { | 176 | { |
| 173 | Cipher *none = cipher_by_name("none"); | 177 | Cipher *none = cipher_by_name("none"); |
| 174 | 178 | ||
| @@ -176,7 +180,6 @@ packet_set_connection(int fd_in, int fd_out, int new_setup_timeout) | |||
| 176 | fatal("packet_set_connection: cannot load cipher 'none'"); | 180 | fatal("packet_set_connection: cannot load cipher 'none'"); |
| 177 | connection_in = fd_in; | 181 | connection_in = fd_in; |
| 178 | connection_out = fd_out; | 182 | connection_out = fd_out; |
| 179 | setup_timeout = new_setup_timeout; | ||
| 180 | cipher_init(&send_context, none, (const u_char *)"", | 183 | cipher_init(&send_context, none, (const u_char *)"", |
| 181 | 0, NULL, 0, CIPHER_ENCRYPT); | 184 | 0, NULL, 0, CIPHER_ENCRYPT); |
| 182 | cipher_init(&receive_context, none, (const u_char *)"", | 185 | cipher_init(&receive_context, none, (const u_char *)"", |
| @@ -189,9 +192,23 @@ packet_set_connection(int fd_in, int fd_out, int new_setup_timeout) | |||
| 189 | buffer_init(&outgoing_packet); | 192 | buffer_init(&outgoing_packet); |
| 190 | buffer_init(&incoming_packet); | 193 | buffer_init(&incoming_packet); |
| 191 | TAILQ_INIT(&outgoing); | 194 | TAILQ_INIT(&outgoing); |
| 195 | p_send.packets = p_read.packets = 0; | ||
| 192 | } | 196 | } |
| 193 | } | 197 | } |
| 194 | 198 | ||
| 199 | void | ||
| 200 | packet_set_timeout(int timeout, int count) | ||
| 201 | { | ||
| 202 | if (timeout == 0 || count == 0) { | ||
| 203 | packet_timeout_ms = -1; | ||
| 204 | return; | ||
| 205 | } | ||
| 206 | if ((INT_MAX / 1000) / count < timeout) | ||
| 207 | packet_timeout_ms = INT_MAX; | ||
| 208 | else | ||
| 209 | packet_timeout_ms = timeout * count * 1000; | ||
| 210 | } | ||
| 211 | |||
| 195 | /* Returns 1 if remote host is connected via socket, 0 if not. */ | 212 | /* Returns 1 if remote host is connected via socket, 0 if not. */ |
| 196 | 213 | ||
| 197 | int | 214 | int |
| @@ -296,18 +313,25 @@ packet_get_ssh1_cipher(void) | |||
| 296 | } | 313 | } |
| 297 | 314 | ||
| 298 | void | 315 | void |
| 299 | packet_get_state(int mode, u_int32_t *seqnr, u_int64_t *blocks, u_int32_t *packets) | 316 | packet_get_state(int mode, u_int32_t *seqnr, u_int64_t *blocks, u_int32_t *packets, |
| 317 | u_int64_t *bytes) | ||
| 300 | { | 318 | { |
| 301 | struct packet_state *state; | 319 | struct packet_state *state; |
| 302 | 320 | ||
| 303 | state = (mode == MODE_IN) ? &p_read : &p_send; | 321 | state = (mode == MODE_IN) ? &p_read : &p_send; |
| 304 | *seqnr = state->seqnr; | 322 | if (seqnr) |
| 305 | *blocks = state->blocks; | 323 | *seqnr = state->seqnr; |
| 306 | *packets = state->packets; | 324 | if (blocks) |
| 325 | *blocks = state->blocks; | ||
| 326 | if (packets) | ||
| 327 | *packets = state->packets; | ||
| 328 | if (bytes) | ||
| 329 | *bytes = state->bytes; | ||
| 307 | } | 330 | } |
| 308 | 331 | ||
| 309 | void | 332 | void |
| 310 | packet_set_state(int mode, u_int32_t seqnr, u_int64_t blocks, u_int32_t packets) | 333 | packet_set_state(int mode, u_int32_t seqnr, u_int64_t blocks, u_int32_t packets, |
| 334 | u_int64_t bytes) | ||
| 311 | { | 335 | { |
| 312 | struct packet_state *state; | 336 | struct packet_state *state; |
| 313 | 337 | ||
| @@ -315,6 +339,7 @@ packet_set_state(int mode, u_int32_t seqnr, u_int64_t blocks, u_int32_t packets) | |||
| 315 | state->seqnr = seqnr; | 339 | state->seqnr = seqnr; |
| 316 | state->blocks = blocks; | 340 | state->blocks = blocks; |
| 317 | state->packets = packets; | 341 | state->packets = packets; |
| 342 | state->bytes = bytes; | ||
| 318 | } | 343 | } |
| 319 | 344 | ||
| 320 | /* returns 1 if connection is via ipv4 */ | 345 | /* returns 1 if connection is via ipv4 */ |
| @@ -593,7 +618,8 @@ packet_send1(void) | |||
| 593 | fprintf(stderr, "encrypted: "); | 618 | fprintf(stderr, "encrypted: "); |
| 594 | buffer_dump(&output); | 619 | buffer_dump(&output); |
| 595 | #endif | 620 | #endif |
| 596 | 621 | p_send.packets++; | |
| 622 | p_send.bytes += len + buffer_len(&outgoing_packet); | ||
| 597 | buffer_clear(&outgoing_packet); | 623 | buffer_clear(&outgoing_packet); |
| 598 | 624 | ||
| 599 | /* | 625 | /* |
| @@ -819,6 +845,7 @@ packet_send2_wrapped(void) | |||
| 819 | if (!(datafellows & SSH_BUG_NOREKEY)) | 845 | if (!(datafellows & SSH_BUG_NOREKEY)) |
| 820 | fatal("XXX too many packets with same key"); | 846 | fatal("XXX too many packets with same key"); |
| 821 | p_send.blocks += (packet_length + 4) / block_size; | 847 | p_send.blocks += (packet_length + 4) / block_size; |
| 848 | p_send.bytes += packet_length + 4; | ||
| 822 | buffer_clear(&outgoing_packet); | 849 | buffer_clear(&outgoing_packet); |
| 823 | 850 | ||
| 824 | if (type == SSH2_MSG_NEWKEYS) | 851 | if (type == SSH2_MSG_NEWKEYS) |
| @@ -892,10 +919,11 @@ packet_send(void) | |||
| 892 | int | 919 | int |
| 893 | packet_read_seqnr(u_int32_t *seqnr_p) | 920 | packet_read_seqnr(u_int32_t *seqnr_p) |
| 894 | { | 921 | { |
| 895 | int type, len; | 922 | int type, len, ret, ms_remain; |
| 896 | fd_set *setp; | 923 | fd_set *setp; |
| 897 | char buf[8192]; | 924 | char buf[8192]; |
| 898 | struct timeval tv, *tvp; | 925 | struct timeval timeout, start, *timeoutp = NULL; |
| 926 | |||
| 899 | DBG(debug("packet_read()")); | 927 | DBG(debug("packet_read()")); |
| 900 | 928 | ||
| 901 | setp = (fd_set *)xcalloc(howmany(connection_in+1, NFDBITS), | 929 | setp = (fd_set *)xcalloc(howmany(connection_in+1, NFDBITS), |
| @@ -927,21 +955,35 @@ packet_read_seqnr(u_int32_t *seqnr_p) | |||
| 927 | sizeof(fd_mask)); | 955 | sizeof(fd_mask)); |
| 928 | FD_SET(connection_in, setp); | 956 | FD_SET(connection_in, setp); |
| 929 | 957 | ||
| 930 | if (setup_timeout > 0) { | 958 | if (packet_timeout_ms > 0) { |
| 931 | tvp = &tv; | 959 | ms_remain = packet_timeout_ms; |
| 932 | tv.tv_sec = setup_timeout; | 960 | timeoutp = &timeout; |
| 933 | tv.tv_usec = 0; | 961 | } |
| 934 | } else | ||
| 935 | tvp = NULL; | ||
| 936 | |||
| 937 | /* Wait for some data to arrive. */ | 962 | /* Wait for some data to arrive. */ |
| 938 | while (select(connection_in + 1, setp, NULL, NULL, tvp) == -1 && | 963 | for (;;) { |
| 939 | (errno == EAGAIN || errno == EINTR)) | 964 | if (packet_timeout_ms != -1) { |
| 940 | ; | 965 | ms_to_timeval(&timeout, ms_remain); |
| 941 | 966 | gettimeofday(&start, NULL); | |
| 942 | if (!FD_ISSET(connection_in, setp)) | 967 | } |
| 943 | fatal("packet_read: Setup timeout expired, giving up"); | 968 | if ((ret = select(connection_in + 1, setp, NULL, |
| 944 | 969 | NULL, timeoutp)) >= 0) | |
| 970 | break; | ||
| 971 | if (errno != EAGAIN && errno != EINTR && | ||
| 972 | errno != EWOULDBLOCK) | ||
| 973 | break; | ||
| 974 | if (packet_timeout_ms == -1) | ||
| 975 | continue; | ||
| 976 | ms_subtract_diff(&start, &ms_remain); | ||
| 977 | if (ms_remain <= 0) { | ||
| 978 | ret = 0; | ||
| 979 | break; | ||
| 980 | } | ||
| 981 | } | ||
| 982 | if (ret == 0) { | ||
| 983 | logit("Connection to %.200s timed out while " | ||
| 984 | "waiting to read", get_remote_ipaddr()); | ||
| 985 | cleanup_exit(255); | ||
| 986 | } | ||
| 945 | /* Read data from the socket. */ | 987 | /* Read data from the socket. */ |
| 946 | len = read(connection_in, buf, sizeof(buf)); | 988 | len = read(connection_in, buf, sizeof(buf)); |
| 947 | if (len == 0) { | 989 | if (len == 0) { |
| @@ -1066,6 +1108,8 @@ packet_read_poll1(void) | |||
| 1066 | buffer_append(&incoming_packet, buffer_ptr(&compression_buffer), | 1108 | buffer_append(&incoming_packet, buffer_ptr(&compression_buffer), |
| 1067 | buffer_len(&compression_buffer)); | 1109 | buffer_len(&compression_buffer)); |
| 1068 | } | 1110 | } |
| 1111 | p_read.packets++; | ||
| 1112 | p_read.bytes += padded_len + 4; | ||
| 1069 | type = buffer_get_char(&incoming_packet); | 1113 | type = buffer_get_char(&incoming_packet); |
| 1070 | if (type < SSH_MSG_MIN || type > SSH_MSG_MAX) | 1114 | if (type < SSH_MSG_MIN || type > SSH_MSG_MAX) |
| 1071 | packet_disconnect("Invalid ssh1 packet type: %d", type); | 1115 | packet_disconnect("Invalid ssh1 packet type: %d", type); |
| @@ -1154,6 +1198,7 @@ packet_read_poll2(u_int32_t *seqnr_p) | |||
| 1154 | if (!(datafellows & SSH_BUG_NOREKEY)) | 1198 | if (!(datafellows & SSH_BUG_NOREKEY)) |
| 1155 | fatal("XXX too many packets with same key"); | 1199 | fatal("XXX too many packets with same key"); |
| 1156 | p_read.blocks += (packet_length + 4) / block_size; | 1200 | p_read.blocks += (packet_length + 4) / block_size; |
| 1201 | p_read.bytes += packet_length + 4; | ||
| 1157 | 1202 | ||
| 1158 | /* get padlen */ | 1203 | /* get padlen */ |
| 1159 | cp = buffer_ptr(&incoming_packet); | 1204 | cp = buffer_ptr(&incoming_packet); |
| @@ -1206,10 +1251,13 @@ packet_read_poll_seqnr(u_int32_t *seqnr_p) | |||
| 1206 | for (;;) { | 1251 | for (;;) { |
| 1207 | if (compat20) { | 1252 | if (compat20) { |
| 1208 | type = packet_read_poll2(seqnr_p); | 1253 | type = packet_read_poll2(seqnr_p); |
| 1209 | if (type) | 1254 | if (type) { |
| 1255 | keep_alive_timeouts = 0; | ||
| 1210 | DBG(debug("received packet type %d", type)); | 1256 | DBG(debug("received packet type %d", type)); |
| 1257 | } | ||
| 1211 | switch (type) { | 1258 | switch (type) { |
| 1212 | case SSH2_MSG_IGNORE: | 1259 | case SSH2_MSG_IGNORE: |
| 1260 | debug3("Received SSH2_MSG_IGNORE"); | ||
| 1213 | break; | 1261 | break; |
| 1214 | case SSH2_MSG_DEBUG: | 1262 | case SSH2_MSG_DEBUG: |
| 1215 | packet_get_char(); | 1263 | packet_get_char(); |
| @@ -1342,6 +1390,12 @@ packet_get_string(u_int *length_ptr) | |||
| 1342 | return buffer_get_string(&incoming_packet, length_ptr); | 1390 | return buffer_get_string(&incoming_packet, length_ptr); |
| 1343 | } | 1391 | } |
| 1344 | 1392 | ||
| 1393 | void * | ||
| 1394 | packet_get_string_ptr(u_int *length_ptr) | ||
| 1395 | { | ||
| 1396 | return buffer_get_string_ptr(&incoming_packet, length_ptr); | ||
| 1397 | } | ||
| 1398 | |||
| 1345 | /* | 1399 | /* |
| 1346 | * Sends a diagnostic message from the server to the client. This message | 1400 | * Sends a diagnostic message from the server to the client. This message |
| 1347 | * can be sent at any time (but not while constructing another message). The | 1401 | * can be sent at any time (but not while constructing another message). The |
| @@ -1436,16 +1490,19 @@ packet_write_poll(void) | |||
| 1436 | 1490 | ||
| 1437 | if (len > 0) { | 1491 | if (len > 0) { |
| 1438 | len = write(connection_out, buffer_ptr(&output), len); | 1492 | len = write(connection_out, buffer_ptr(&output), len); |
| 1439 | if (len <= 0) { | 1493 | if (len == -1) { |
| 1440 | if (errno == EAGAIN) | 1494 | if (errno == EINTR || errno == EAGAIN || |
| 1495 | errno == EWOULDBLOCK) | ||
| 1441 | return; | 1496 | return; |
| 1442 | else | 1497 | fatal("Write failed: %.100s", strerror(errno)); |
| 1443 | fatal("Write failed: %.100s", strerror(errno)); | ||
| 1444 | } | 1498 | } |
| 1499 | if (len == 0) | ||
| 1500 | fatal("Write connection closed"); | ||
| 1445 | buffer_consume(&output, len); | 1501 | buffer_consume(&output, len); |
| 1446 | } | 1502 | } |
| 1447 | } | 1503 | } |
| 1448 | 1504 | ||
| 1505 | |||
| 1449 | /* | 1506 | /* |
| 1450 | * Calls packet_write_poll repeatedly until all pending output data has been | 1507 | * Calls packet_write_poll repeatedly until all pending output data has been |
| 1451 | * written. | 1508 | * written. |
| @@ -1455,6 +1512,8 @@ void | |||
| 1455 | packet_write_wait(void) | 1512 | packet_write_wait(void) |
| 1456 | { | 1513 | { |
| 1457 | fd_set *setp; | 1514 | fd_set *setp; |
| 1515 | int ret, ms_remain; | ||
| 1516 | struct timeval start, timeout, *timeoutp = NULL; | ||
| 1458 | 1517 | ||
| 1459 | setp = (fd_set *)xcalloc(howmany(connection_out + 1, NFDBITS), | 1518 | setp = (fd_set *)xcalloc(howmany(connection_out + 1, NFDBITS), |
| 1460 | sizeof(fd_mask)); | 1519 | sizeof(fd_mask)); |
| @@ -1463,9 +1522,35 @@ packet_write_wait(void) | |||
| 1463 | memset(setp, 0, howmany(connection_out + 1, NFDBITS) * | 1522 | memset(setp, 0, howmany(connection_out + 1, NFDBITS) * |
| 1464 | sizeof(fd_mask)); | 1523 | sizeof(fd_mask)); |
| 1465 | FD_SET(connection_out, setp); | 1524 | FD_SET(connection_out, setp); |
| 1466 | while (select(connection_out + 1, NULL, setp, NULL, NULL) == -1 && | 1525 | |
| 1467 | (errno == EAGAIN || errno == EINTR)) | 1526 | if (packet_timeout_ms > 0) { |
| 1468 | ; | 1527 | ms_remain = packet_timeout_ms; |
| 1528 | timeoutp = &timeout; | ||
| 1529 | } | ||
| 1530 | for (;;) { | ||
| 1531 | if (packet_timeout_ms != -1) { | ||
| 1532 | ms_to_timeval(&timeout, ms_remain); | ||
| 1533 | gettimeofday(&start, NULL); | ||
| 1534 | } | ||
| 1535 | if ((ret = select(connection_out + 1, NULL, setp, | ||
| 1536 | NULL, timeoutp)) >= 0) | ||
| 1537 | break; | ||
| 1538 | if (errno != EAGAIN && errno != EINTR && | ||
| 1539 | errno != EWOULDBLOCK) | ||
| 1540 | break; | ||
| 1541 | if (packet_timeout_ms == -1) | ||
| 1542 | continue; | ||
| 1543 | ms_subtract_diff(&start, &ms_remain); | ||
| 1544 | if (ms_remain <= 0) { | ||
| 1545 | ret = 0; | ||
| 1546 | break; | ||
| 1547 | } | ||
| 1548 | } | ||
| 1549 | if (ret == 0) { | ||
| 1550 | logit("Connection to %.200s timed out while " | ||
| 1551 | "waiting to write", get_remote_ipaddr()); | ||
| 1552 | cleanup_exit(255); | ||
| 1553 | } | ||
| 1469 | packet_write_poll(); | 1554 | packet_write_poll(); |
| 1470 | } | 1555 | } |
| 1471 | xfree(setp); | 1556 | xfree(setp); |
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: packet.h,v 1.45 2006/03/25 22:22:43 djm Exp $ */ | 1 | /* $OpenBSD: packet.h,v 1.49 2008/07/10 18:08:11 markus Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| @@ -20,7 +20,8 @@ | |||
| 20 | 20 | ||
| 21 | #include <openssl/bn.h> | 21 | #include <openssl/bn.h> |
| 22 | 22 | ||
| 23 | void packet_set_connection(int, int, int); | 23 | void packet_set_connection(int, int); |
| 24 | void packet_set_timeout(int, int); | ||
| 24 | void packet_set_nonblocking(void); | 25 | void packet_set_nonblocking(void); |
| 25 | int packet_get_connection_in(void); | 26 | int packet_get_connection_in(void); |
| 26 | int packet_get_connection_out(void); | 27 | int packet_get_connection_out(void); |
| @@ -58,6 +59,7 @@ void packet_get_bignum(BIGNUM * value); | |||
| 58 | void packet_get_bignum2(BIGNUM * value); | 59 | void packet_get_bignum2(BIGNUM * value); |
| 59 | void *packet_get_raw(u_int *length_ptr); | 60 | void *packet_get_raw(u_int *length_ptr); |
| 60 | void *packet_get_string(u_int *length_ptr); | 61 | void *packet_get_string(u_int *length_ptr); |
| 62 | void *packet_get_string_ptr(u_int *length_ptr); | ||
| 61 | void packet_disconnect(const char *fmt,...) __attribute__((format(printf, 1, 2))); | 63 | void packet_disconnect(const char *fmt,...) __attribute__((format(printf, 1, 2))); |
| 62 | void packet_send_debug(const char *fmt,...) __attribute__((format(printf, 1, 2))); | 64 | void packet_send_debug(const char *fmt,...) __attribute__((format(printf, 1, 2))); |
| 63 | 65 | ||
| @@ -66,8 +68,8 @@ int packet_get_keyiv_len(int); | |||
| 66 | void packet_get_keyiv(int, u_char *, u_int); | 68 | void packet_get_keyiv(int, u_char *, u_int); |
| 67 | int packet_get_keycontext(int, u_char *); | 69 | int packet_get_keycontext(int, u_char *); |
| 68 | void packet_set_keycontext(int, u_char *); | 70 | void packet_set_keycontext(int, u_char *); |
| 69 | void packet_get_state(int, u_int32_t *, u_int64_t *, u_int32_t *); | 71 | void packet_get_state(int, u_int32_t *, u_int64_t *, u_int32_t *, u_int64_t *); |
| 70 | void packet_set_state(int, u_int32_t, u_int64_t, u_int32_t); | 72 | void packet_set_state(int, u_int32_t, u_int64_t, u_int32_t, u_int64_t); |
| 71 | int packet_get_ssh1_cipher(void); | 73 | int packet_get_ssh1_cipher(void); |
| 72 | void packet_set_iv(int, u_char *); | 74 | void packet_set_iv(int, u_char *); |
| 73 | 75 | ||
| @@ -86,6 +88,7 @@ void tty_make_modes(int, struct termios *); | |||
| 86 | void tty_parse_modes(int, int *); | 88 | void tty_parse_modes(int, int *); |
| 87 | 89 | ||
| 88 | extern u_int max_packet_size; | 90 | extern u_int max_packet_size; |
| 91 | extern int keep_alive_timeouts; | ||
| 89 | int packet_set_maxsize(u_int); | 92 | int packet_set_maxsize(u_int); |
| 90 | #define packet_get_maxsize() max_packet_size | 93 | #define packet_get_maxsize() max_packet_size |
| 91 | 94 | ||
diff --git a/readconf.c b/readconf.c index 07f5775d5..7ad5a8e18 100644 --- a/readconf.c +++ b/readconf.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: readconf.c,v 1.162 2007/03/20 03:56:12 tedu Exp $ */ | 1 | /* $OpenBSD: readconf.c,v 1.167 2008/06/26 11:46:31 grunk Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
| @@ -135,6 +135,7 @@ typedef enum { | |||
| 135 | oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly, | 135 | oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly, |
| 136 | oSendEnv, oControlPath, oControlMaster, oHashKnownHosts, | 136 | oSendEnv, oControlPath, oControlMaster, oHashKnownHosts, |
| 137 | oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand, | 137 | oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand, |
| 138 | oVisualHostKey, | ||
| 138 | oProtocolKeepAlives, oSetupTimeOut, | 139 | oProtocolKeepAlives, oSetupTimeOut, |
| 139 | oDeprecated, oUnsupported | 140 | oDeprecated, oUnsupported |
| 140 | } OpCodes; | 141 | } OpCodes; |
| @@ -237,6 +238,7 @@ static struct { | |||
| 237 | { "tunneldevice", oTunnelDevice }, | 238 | { "tunneldevice", oTunnelDevice }, |
| 238 | { "localcommand", oLocalCommand }, | 239 | { "localcommand", oLocalCommand }, |
| 239 | { "permitlocalcommand", oPermitLocalCommand }, | 240 | { "permitlocalcommand", oPermitLocalCommand }, |
| 241 | { "visualhostkey", oVisualHostKey }, | ||
| 240 | { "protocolkeepalives", oProtocolKeepAlives }, | 242 | { "protocolkeepalives", oProtocolKeepAlives }, |
| 241 | { "setuptimeout", oSetupTimeOut }, | 243 | { "setuptimeout", oSetupTimeOut }, |
| 242 | { NULL, oBadOption } | 244 | { NULL, oBadOption } |
| @@ -339,6 +341,7 @@ process_config_line(Options *options, const char *host, | |||
| 339 | { | 341 | { |
| 340 | char *s, **charptr, *endofnumber, *keyword, *arg, *arg2, fwdarg[256]; | 342 | char *s, **charptr, *endofnumber, *keyword, *arg, *arg2, fwdarg[256]; |
| 341 | int opcode, *intptr, value, value2, scale; | 343 | int opcode, *intptr, value, value2, scale; |
| 344 | LogLevel *log_level_ptr; | ||
| 342 | long long orig, val64; | 345 | long long orig, val64; |
| 343 | size_t len; | 346 | size_t len; |
| 344 | Forward fwd; | 347 | Forward fwd; |
| @@ -523,7 +526,6 @@ parse_yesnoask: | |||
| 523 | goto parse_int; | 526 | goto parse_int; |
| 524 | 527 | ||
| 525 | case oRekeyLimit: | 528 | case oRekeyLimit: |
| 526 | intptr = &options->rekey_limit; | ||
| 527 | arg = strdelim(&s); | 529 | arg = strdelim(&s); |
| 528 | if (!arg || *arg == '\0') | 530 | if (!arg || *arg == '\0') |
| 529 | fatal("%.200s line %d: Missing argument.", filename, linenum); | 531 | fatal("%.200s line %d: Missing argument.", filename, linenum); |
| @@ -551,14 +553,14 @@ parse_yesnoask: | |||
| 551 | } | 553 | } |
| 552 | val64 *= scale; | 554 | val64 *= scale; |
| 553 | /* detect integer wrap and too-large limits */ | 555 | /* detect integer wrap and too-large limits */ |
| 554 | if ((val64 / scale) != orig || val64 > INT_MAX) | 556 | if ((val64 / scale) != orig || val64 > UINT_MAX) |
| 555 | fatal("%.200s line %d: RekeyLimit too large", | 557 | fatal("%.200s line %d: RekeyLimit too large", |
| 556 | filename, linenum); | 558 | filename, linenum); |
| 557 | if (val64 < 16) | 559 | if (val64 < 16) |
| 558 | fatal("%.200s line %d: RekeyLimit too small", | 560 | fatal("%.200s line %d: RekeyLimit too small", |
| 559 | filename, linenum); | 561 | filename, linenum); |
| 560 | if (*activep && *intptr == -1) | 562 | if (*activep && options->rekey_limit == -1) |
| 561 | *intptr = (int)val64; | 563 | options->rekey_limit = (u_int32_t)val64; |
| 562 | break; | 564 | break; |
| 563 | 565 | ||
| 564 | case oIdentityFile: | 566 | case oIdentityFile: |
| @@ -717,14 +719,14 @@ parse_int: | |||
| 717 | break; | 719 | break; |
| 718 | 720 | ||
| 719 | case oLogLevel: | 721 | case oLogLevel: |
| 720 | intptr = (int *) &options->log_level; | 722 | log_level_ptr = &options->log_level; |
| 721 | arg = strdelim(&s); | 723 | arg = strdelim(&s); |
| 722 | value = log_level_number(arg); | 724 | value = log_level_number(arg); |
| 723 | if (value == SYSLOG_LEVEL_NOT_SET) | 725 | if (value == SYSLOG_LEVEL_NOT_SET) |
| 724 | fatal("%.200s line %d: unsupported log level '%s'", | 726 | fatal("%.200s line %d: unsupported log level '%s'", |
| 725 | filename, linenum, arg ? arg : "<NONE>"); | 727 | filename, linenum, arg ? arg : "<NONE>"); |
| 726 | if (*activep && (LogLevel) *intptr == SYSLOG_LEVEL_NOT_SET) | 728 | if (*activep && *log_level_ptr == SYSLOG_LEVEL_NOT_SET) |
| 727 | *intptr = (LogLevel) value; | 729 | *log_level_ptr = (LogLevel) value; |
| 728 | break; | 730 | break; |
| 729 | 731 | ||
| 730 | case oLocalForward: | 732 | case oLocalForward: |
| @@ -844,6 +846,7 @@ parse_int: | |||
| 844 | 846 | ||
| 845 | case oServerAliveInterval: | 847 | case oServerAliveInterval: |
| 846 | case oProtocolKeepAlives: /* Debian-specific compatibility alias */ | 848 | case oProtocolKeepAlives: /* Debian-specific compatibility alias */ |
| 849 | case oSetupTimeOut: /* Debian-specific compatibility alias */ | ||
| 847 | intptr = &options->server_alive_interval; | 850 | intptr = &options->server_alive_interval; |
| 848 | goto parse_time; | 851 | goto parse_time; |
| 849 | 852 | ||
| @@ -941,9 +944,9 @@ parse_int: | |||
| 941 | intptr = &options->permit_local_command; | 944 | intptr = &options->permit_local_command; |
| 942 | goto parse_flag; | 945 | goto parse_flag; |
| 943 | 946 | ||
| 944 | case oSetupTimeOut: | 947 | case oVisualHostKey: |
| 945 | intptr = &options->setuptimeout; | 948 | intptr = &options->visual_host_key; |
| 946 | goto parse_int; | 949 | goto parse_flag; |
| 947 | 950 | ||
| 948 | case oDeprecated: | 951 | case oDeprecated: |
| 949 | debug("%s line %d: Deprecated option \"%s\"", | 952 | debug("%s line %d: Deprecated option \"%s\"", |
| @@ -1073,7 +1076,6 @@ initialize_options(Options * options) | |||
| 1073 | options->strict_host_key_checking = -1; | 1076 | options->strict_host_key_checking = -1; |
| 1074 | options->compression = -1; | 1077 | options->compression = -1; |
| 1075 | options->tcp_keep_alive = -1; | 1078 | options->tcp_keep_alive = -1; |
| 1076 | options->setuptimeout = -1; | ||
| 1077 | options->compression_level = -1; | 1079 | options->compression_level = -1; |
| 1078 | options->port = -1; | 1080 | options->port = -1; |
| 1079 | options->address_family = -1; | 1081 | options->address_family = -1; |
| @@ -1118,6 +1120,7 @@ initialize_options(Options * options) | |||
| 1118 | options->tun_remote = -1; | 1120 | options->tun_remote = -1; |
| 1119 | options->local_command = NULL; | 1121 | options->local_command = NULL; |
| 1120 | options->permit_local_command = -1; | 1122 | options->permit_local_command = -1; |
| 1123 | options->visual_host_key = -1; | ||
| 1121 | } | 1124 | } |
| 1122 | 1125 | ||
| 1123 | /* | 1126 | /* |
| @@ -1263,13 +1266,8 @@ fill_default_options(Options * options) | |||
| 1263 | options->tun_remote = SSH_TUNID_ANY; | 1266 | options->tun_remote = SSH_TUNID_ANY; |
| 1264 | if (options->permit_local_command == -1) | 1267 | if (options->permit_local_command == -1) |
| 1265 | options->permit_local_command = 0; | 1268 | options->permit_local_command = 0; |
| 1266 | if (options->setuptimeout == -1) { | 1269 | if (options->visual_host_key == -1) |
| 1267 | /* in batch mode, default is 5mins */ | 1270 | options->visual_host_key = 0; |
| 1268 | if (options->batch_mode == 1) | ||
| 1269 | options->setuptimeout = 300; | ||
| 1270 | else | ||
| 1271 | options->setuptimeout = 0; | ||
| 1272 | } | ||
| 1273 | /* options->local_command should not be set by default */ | 1271 | /* options->local_command should not be set by default */ |
| 1274 | /* options->proxy_command should not be set by default */ | 1272 | /* options->proxy_command should not be set by default */ |
| 1275 | /* options->user will be set in the main program if appropriate */ | 1273 | /* options->user will be set in the main program if appropriate */ |
| @@ -1326,7 +1324,7 @@ parse_forward(Forward *fwd, const char *fwdspec) | |||
| 1326 | 1324 | ||
| 1327 | xfree(p); | 1325 | xfree(p); |
| 1328 | 1326 | ||
| 1329 | if (fwd->listen_port == 0 && fwd->connect_port == 0) | 1327 | if (fwd->listen_port == 0 || fwd->connect_port == 0) |
| 1330 | goto fail_free; | 1328 | goto fail_free; |
| 1331 | 1329 | ||
| 1332 | if (fwd->connect_host != NULL && | 1330 | if (fwd->connect_host != NULL && |
diff --git a/readconf.h b/readconf.h index eb236fc5c..42bfdf662 100644 --- a/readconf.h +++ b/readconf.h | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: readconf.h,v 1.71 2006/08/03 03:34:42 deraadt Exp $ */ | 1 | /* $OpenBSD: readconf.h,v 1.74 2008/06/26 11:46:31 grunk Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| @@ -59,7 +59,6 @@ typedef struct { | |||
| 59 | int compression_level; /* Compression level 1 (fast) to 9 | 59 | int compression_level; /* Compression level 1 (fast) to 9 |
| 60 | * (best). */ | 60 | * (best). */ |
| 61 | int tcp_keep_alive; /* Set SO_KEEPALIVE. */ | 61 | int tcp_keep_alive; /* Set SO_KEEPALIVE. */ |
| 62 | int setuptimeout; /* timeout in the protocol banner exchange */ | ||
| 63 | LogLevel log_level; /* Level for logging. */ | 62 | LogLevel log_level; /* Level for logging. */ |
| 64 | 63 | ||
| 65 | int port; /* Port to connect. */ | 64 | int port; /* Port to connect. */ |
| @@ -104,7 +103,7 @@ typedef struct { | |||
| 104 | int clear_forwardings; | 103 | int clear_forwardings; |
| 105 | 104 | ||
| 106 | int enable_ssh_keysign; | 105 | int enable_ssh_keysign; |
| 107 | int rekey_limit; | 106 | int64_t rekey_limit; |
| 108 | int no_host_authentication_for_localhost; | 107 | int no_host_authentication_for_localhost; |
| 109 | int identities_only; | 108 | int identities_only; |
| 110 | int server_alive_interval; | 109 | int server_alive_interval; |
| @@ -124,6 +123,7 @@ typedef struct { | |||
| 124 | 123 | ||
| 125 | char *local_command; | 124 | char *local_command; |
| 126 | int permit_local_command; | 125 | int permit_local_command; |
| 126 | int visual_host_key; | ||
| 127 | 127 | ||
| 128 | } Options; | 128 | } Options; |
| 129 | 129 | ||
diff --git a/regress/Makefile b/regress/Makefile index 539956398..3b8ea245b 100644 --- a/regress/Makefile +++ b/regress/Makefile | |||
| @@ -1,10 +1,15 @@ | |||
| 1 | # $OpenBSD: Makefile,v 1.42 2006/07/19 13:34:52 dtucker Exp $ | 1 | # $OpenBSD: Makefile,v 1.48 2008/06/28 13:57:25 djm Exp $ |
| 2 | 2 | ||
| 3 | REGRESS_TARGETS= t1 t2 t3 t4 t5 t6 t7 t-exec | 3 | REGRESS_TARGETS= t1 t2 t3 t4 t5 t6 t7 t-exec |
| 4 | tests: $(REGRESS_TARGETS) | 4 | tests: $(REGRESS_TARGETS) |
| 5 | 5 | ||
| 6 | # Interop tests are not run by default | ||
| 7 | interop interop-tests: t-exec-interop | ||
| 8 | |||
| 6 | clean: | 9 | clean: |
| 7 | for F in $(CLEANFILES); do rm -f $(OBJ)$$F; done | 10 | for F in $(CLEANFILES); do rm -f $(OBJ)$$F; done |
| 11 | rm -rf $(OBJ).putty | ||
| 12 | |||
| 8 | distclean: clean | 13 | distclean: clean |
| 9 | 14 | ||
| 10 | LTESTS= connect \ | 15 | LTESTS= connect \ |
| @@ -29,6 +34,7 @@ LTESTS= connect \ | |||
| 29 | agent-ptrace \ | 34 | agent-ptrace \ |
| 30 | keyscan \ | 35 | keyscan \ |
| 31 | keygen-change \ | 36 | keygen-change \ |
| 37 | key-options \ | ||
| 32 | scp \ | 38 | scp \ |
| 33 | sftp \ | 39 | sftp \ |
| 34 | sftp-cmds \ | 40 | sftp-cmds \ |
| @@ -42,8 +48,13 @@ LTESTS= connect \ | |||
| 42 | reexec \ | 48 | reexec \ |
| 43 | brokenkeys \ | 49 | brokenkeys \ |
| 44 | cfgmatch \ | 50 | cfgmatch \ |
| 51 | addrmatch \ | ||
| 52 | localcommand \ | ||
| 45 | forcecommand | 53 | forcecommand |
| 46 | 54 | ||
| 55 | INTEROP_TESTS= putty-transfer putty-ciphers putty-kex conch-ciphers | ||
| 56 | #INTEROP_TESTS+=ssh-com ssh-com-client ssh-com-keygen ssh-com-sftp | ||
| 57 | |||
| 47 | USER!= id -un | 58 | USER!= id -un |
| 48 | CLEANFILES= t2.out t6.out1 t6.out2 t7.out t7.out.pub copy.1 copy.2 \ | 59 | CLEANFILES= t2.out t6.out1 t6.out2 t7.out t7.out.pub copy.1 copy.2 \ |
| 49 | authorized_keys_${USER} known_hosts pidfile \ | 60 | authorized_keys_${USER} known_hosts pidfile \ |
| @@ -52,9 +63,8 @@ CLEANFILES= t2.out t6.out1 t6.out2 t7.out t7.out.pub copy.1 copy.2 \ | |||
| 52 | rsa-agent rsa-agent.pub rsa1-agent rsa1-agent.pub \ | 63 | rsa-agent rsa-agent.pub rsa1-agent rsa1-agent.pub \ |
| 53 | ls.copy banner.in banner.out empty.in \ | 64 | ls.copy banner.in banner.out empty.in \ |
| 54 | scp-ssh-wrapper.scp ssh_proxy_envpass remote_pid \ | 65 | scp-ssh-wrapper.scp ssh_proxy_envpass remote_pid \ |
| 55 | sshd_proxy_bak rsa_ssh2_cr.prv rsa_ssh2_crnl.prv | 66 | sshd_proxy_bak rsa_ssh2_cr.prv rsa_ssh2_crnl.prv \ |
| 56 | 67 | putty.rsa2 | |
| 57 | #LTESTS += ssh-com ssh-com-client ssh-com-keygen ssh-com-sftp | ||
| 58 | 68 | ||
| 59 | t1: | 69 | t1: |
| 60 | ssh-keygen -if ${.CURDIR}/rsa_ssh2.prv | diff - ${.CURDIR}/rsa_openssh.prv | 70 | ssh-keygen -if ${.CURDIR}/rsa_ssh2.prv | diff - ${.CURDIR}/rsa_openssh.prv |
| @@ -96,3 +106,11 @@ t-exec: ${LTESTS:=.sh} | |||
| 96 | echo "run test $${TEST}" ... 1>&2; \ | 106 | echo "run test $${TEST}" ... 1>&2; \ |
| 97 | (env SUDO=${SUDO} sh ${.CURDIR}/test-exec.sh ${.OBJDIR} ${.CURDIR}/$${TEST}) || exit $$?; \ | 107 | (env SUDO=${SUDO} sh ${.CURDIR}/test-exec.sh ${.OBJDIR} ${.CURDIR}/$${TEST}) || exit $$?; \ |
| 98 | done | 108 | done |
| 109 | |||
| 110 | t-exec-interop: ${INTEROP_TESTS:=.sh} | ||
| 111 | @if [ "x$?" = "x" ]; then exit 0; fi; \ | ||
| 112 | for TEST in ""$?; do \ | ||
| 113 | echo "run test $${TEST}" ... 1>&2; \ | ||
| 114 | (env SUDO=${SUDO} sh ${.CURDIR}/test-exec.sh ${.OBJDIR} ${.CURDIR}/$${TEST}) || exit $$?; \ | ||
| 115 | done | ||
| 116 | |||
diff --git a/regress/addrmatch.sh b/regress/addrmatch.sh new file mode 100644 index 000000000..a258f7bb4 --- /dev/null +++ b/regress/addrmatch.sh | |||
| @@ -0,0 +1,42 @@ | |||
| 1 | # $OpenBSD: addrmatch.sh,v 1.1 2008/06/10 05:23:32 dtucker Exp $ | ||
| 2 | # Placed in the Public Domain. | ||
| 3 | |||
| 4 | tid="address match" | ||
| 5 | |||
| 6 | mv $OBJ/sshd_proxy $OBJ/sshd_proxy_orig | ||
| 7 | |||
| 8 | run_trial() | ||
| 9 | { | ||
| 10 | user="$1"; addr="$2"; host="$3"; expected="$4"; descr="$5" | ||
| 11 | |||
| 12 | verbose "test $descr for $user $addr $host" | ||
| 13 | result=`${SSHD} -f $OBJ/sshd_proxy -T \ | ||
| 14 | -C user=${user},addr=${addr},host=${host} | \ | ||
| 15 | awk '/passwordauthentication/ {print $2}'` | ||
| 16 | if [ "$result" != "$expected" ]; then | ||
| 17 | fail "failed for $user $addr $host: expected $expected, got $result" | ||
| 18 | fi | ||
| 19 | } | ||
| 20 | |||
| 21 | cp $OBJ/sshd_proxy_orig $OBJ/sshd_proxy | ||
| 22 | cat >>$OBJ/sshd_proxy <<EOD | ||
| 23 | PasswordAuthentication no | ||
| 24 | Match Address 192.168.0.0/16,!192.168.30.0/24,10.0.0.0/8,host.example.com | ||
| 25 | PasswordAuthentication yes | ||
| 26 | Match Address 1.1.1.1,::1,!::3,2000::/16 | ||
| 27 | PasswordAuthentication yes | ||
| 28 | EOD | ||
| 29 | |||
| 30 | run_trial user 192.168.0.1 somehost yes "permit, first entry" | ||
| 31 | run_trial user 192.168.30.1 somehost no "deny, negative match" | ||
| 32 | run_trial user 19.0.0.1 somehost no "deny, no match" | ||
| 33 | run_trial user 10.255.255.254 somehost yes "permit, list middle" | ||
| 34 | run_trial user 192.168.30.1 192.168.0.1 no "deny, faked IP in hostname" | ||
| 35 | run_trial user 1.1.1.1 somehost.example.com yes "permit, bare IP4 address" | ||
| 36 | test "$TEST_SSH_IPV6" = "no" && exit | ||
| 37 | run_trial user ::1 somehost.example.com yes "permit, bare IP6 address" | ||
| 38 | run_trial user ::2 somehost.exaple.com no "deny IPv6" | ||
| 39 | run_trial user ::3 somehost no "deny IP6 negated" | ||
| 40 | run_trial user ::4 somehost no "deny, IP6 no match" | ||
| 41 | run_trial user 2000::1 somehost yes "permit, IP6 network" | ||
| 42 | run_trial user 2001::1 somehost no "deny, IP6 network" | ||
diff --git a/regress/agent-getpeereid.sh b/regress/agent-getpeereid.sh index d71324241..5d7f73291 100644 --- a/regress/agent-getpeereid.sh +++ b/regress/agent-getpeereid.sh | |||
| @@ -1,11 +1,11 @@ | |||
| 1 | # $OpenBSD: agent-getpeereid.sh,v 1.3 2006/07/06 12:01:53 grunk Exp $ | 1 | # $OpenBSD: agent-getpeereid.sh,v 1.4 2007/11/25 15:35:09 jmc Exp $ |
| 2 | # Placed in the Public Domain. | 2 | # Placed in the Public Domain. |
| 3 | 3 | ||
| 4 | tid="disallow agent attach from other uid" | 4 | tid="disallow agent attach from other uid" |
| 5 | 5 | ||
| 6 | UNPRIV=nobody | 6 | UNPRIV=nobody |
| 7 | ASOCK=${OBJ}/agent | 7 | ASOCK=${OBJ}/agent |
| 8 | SSH_AUTH_SOCK=/nonexistant | 8 | SSH_AUTH_SOCK=/nonexistent |
| 9 | 9 | ||
| 10 | if grep "#undef.*HAVE_GETPEEREID" ${BUILDDIR}/config.h >/dev/null 2>&1 && \ | 10 | if grep "#undef.*HAVE_GETPEEREID" ${BUILDDIR}/config.h >/dev/null 2>&1 && \ |
| 11 | grep "#undef.*HAVE_GETPEERUCRED" ${BUILDDIR}/config.h >/dev/null && \ | 11 | grep "#undef.*HAVE_GETPEERUCRED" ${BUILDDIR}/config.h >/dev/null && \ |
diff --git a/regress/agent.sh b/regress/agent.sh index b34487767..094cf694b 100644 --- a/regress/agent.sh +++ b/regress/agent.sh | |||
| @@ -1,9 +1,9 @@ | |||
| 1 | # $OpenBSD: agent.sh,v 1.6 2002/03/15 13:08:56 markus Exp $ | 1 | # $OpenBSD: agent.sh,v 1.7 2007/11/25 15:35:09 jmc Exp $ |
| 2 | # Placed in the Public Domain. | 2 | # Placed in the Public Domain. |
| 3 | 3 | ||
| 4 | tid="simple agent test" | 4 | tid="simple agent test" |
| 5 | 5 | ||
| 6 | SSH_AUTH_SOCK=/nonexistant ${SSHADD} -l > /dev/null 2>&1 | 6 | SSH_AUTH_SOCK=/nonexistent ${SSHADD} -l > /dev/null 2>&1 |
| 7 | if [ $? -ne 2 ]; then | 7 | if [ $? -ne 2 ]; then |
| 8 | fail "ssh-add -l did not fail with exit code 2" | 8 | fail "ssh-add -l did not fail with exit code 2" |
| 9 | fi | 9 | fi |
diff --git a/regress/cfgmatch.sh b/regress/cfgmatch.sh index d987dcb97..35c5e52a1 100644 --- a/regress/cfgmatch.sh +++ b/regress/cfgmatch.sh | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | # $OpenBSD: cfgmatch.sh,v 1.2 2006/07/22 01:50:00 dtucker Exp $ | 1 | # $OpenBSD: cfgmatch.sh,v 1.4 2006/12/13 08:36:36 dtucker Exp $ |
| 2 | # Placed in the Public Domain. | 2 | # Placed in the Public Domain. |
| 3 | 3 | ||
| 4 | tid="sshd_config match" | 4 | tid="sshd_config match" |
| @@ -35,7 +35,7 @@ for p in 1 2; do | |||
| 35 | rm -f $pidfile | 35 | rm -f $pidfile |
| 36 | trace "match permitopen localhost proto $p" | 36 | trace "match permitopen localhost proto $p" |
| 37 | ${SSH} -$p $fwd -F $OBJ/ssh_config -f somehost \ | 37 | ${SSH} -$p $fwd -F $OBJ/ssh_config -f somehost \ |
| 38 | "echo \$\$ > $pidfile; exec sleep 100" >>$TEST_SSH_LOGFILE 2>&1 ||\ | 38 | exec sh -c \'"echo \$\$ > $pidfile; exec sleep 100"\' >>$TEST_SSH_LOGFILE 2>&1 ||\ |
| 39 | fail "match permitopen proto $p sshd failed" | 39 | fail "match permitopen proto $p sshd failed" |
| 40 | sleep 1; | 40 | sleep 1; |
| 41 | ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \ | 41 | ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \ |
| @@ -48,7 +48,7 @@ for p in 1 2; do | |||
| 48 | rm -f $pidfile | 48 | rm -f $pidfile |
| 49 | trace "match permitopen proxy proto $p" | 49 | trace "match permitopen proxy proto $p" |
| 50 | ${SSH} -q -$p $fwd -F $OBJ/ssh_proxy -f somehost \ | 50 | ${SSH} -q -$p $fwd -F $OBJ/ssh_proxy -f somehost \ |
| 51 | "echo \$\$ > $pidfile; exec sleep 100" >>$TEST_SSH_LOGFILE 2>&1 ||\ | 51 | exec sh -c \'"echo \$\$ > $pidfile; exec sleep 100"\' >>$TEST_SSH_LOGFILE 2>&1 ||\ |
| 52 | fail "match permitopen proxy proto $p sshd failed" | 52 | fail "match permitopen proxy proto $p sshd failed" |
| 53 | sleep 1; | 53 | sleep 1; |
| 54 | ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \ | 54 | ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \ |
| @@ -65,7 +65,7 @@ for p in 1 2; do | |||
| 65 | rm -f $pidfile | 65 | rm -f $pidfile |
| 66 | trace "match permitopen proxy w/key opts proto $p" | 66 | trace "match permitopen proxy w/key opts proto $p" |
| 67 | ${SSH} -q -$p $fwd -F $OBJ/ssh_proxy -f somehost \ | 67 | ${SSH} -q -$p $fwd -F $OBJ/ssh_proxy -f somehost \ |
| 68 | "echo \$\$ > $pidfile; exec sleep 100" >>$TEST_SSH_LOGFILE 2>&1 ||\ | 68 | exec sh -c \'"echo \$\$ > $pidfile; exec sleep 100"\' >>$TEST_SSH_LOGFILE 2>&1 ||\ |
| 69 | fail "match permitopen w/key opt proto $p sshd failed" | 69 | fail "match permitopen w/key opt proto $p sshd failed" |
| 70 | sleep 1; | 70 | sleep 1; |
| 71 | ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \ | 71 | ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \ |
| @@ -79,7 +79,7 @@ for p in 1 2; do | |||
| 79 | rm -f $pidfile | 79 | rm -f $pidfile |
| 80 | trace "match permitopen localhost proto $p" | 80 | trace "match permitopen localhost proto $p" |
| 81 | ${SSH} -$p $fwd -F $OBJ/ssh_config -f somehost \ | 81 | ${SSH} -$p $fwd -F $OBJ/ssh_config -f somehost \ |
| 82 | "echo \$\$ > $pidfile; exec sleep 100" >>$TEST_SSH_LOGFILE 2>&1 ||\ | 82 | exec sh -c \'"echo \$\$ > $pidfile; exec sleep 100"\' >>$TEST_SSH_LOGFILE 2>&1 ||\ |
| 83 | fail "match permitopen proto $p sshd failed" | 83 | fail "match permitopen proto $p sshd failed" |
| 84 | sleep 1; | 84 | sleep 1; |
| 85 | ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \ | 85 | ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \ |
| @@ -97,10 +97,29 @@ for p in 1 2; do | |||
| 97 | rm -f $pidfile | 97 | rm -f $pidfile |
| 98 | trace "match permitopen proxy w/key opts proto $p" | 98 | trace "match permitopen proxy w/key opts proto $p" |
| 99 | ${SSH} -q -$p $fwd -F $OBJ/ssh_proxy -f somehost \ | 99 | ${SSH} -q -$p $fwd -F $OBJ/ssh_proxy -f somehost \ |
| 100 | "echo \$\$ > $pidfile; exec sleep 100" >>$TEST_SSH_LOGFILE 2>&1 ||\ | 100 | exec sh -c \'"echo \$\$ > $pidfile; exec sleep 100"\' >>$TEST_SSH_LOGFILE 2>&1 ||\ |
| 101 | fail "match override permitopen proto $p sshd failed" | 101 | fail "match override permitopen proto $p sshd failed" |
| 102 | sleep 1; | 102 | sleep 1; |
| 103 | ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \ | 103 | ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true && \ |
| 104 | fail "match override permitopen proto $p" | 104 | fail "match override permitopen proto $p" |
| 105 | stop_client | 105 | stop_client |
| 106 | done | 106 | done |
| 107 | |||
| 108 | cp $OBJ/sshd_proxy_bak $OBJ/sshd_proxy | ||
| 109 | echo "PermitOpen 127.0.0.1:1 127.0.0.1:$PORT 127.0.0.2:2" >>$OBJ/sshd_proxy | ||
| 110 | echo "Match User NoSuchUser" >>$OBJ/sshd_proxy | ||
| 111 | echo "PermitOpen 127.0.0.1:1 127.0.0.1:2" >>$OBJ/sshd_proxy | ||
| 112 | |||
| 113 | # Test that a rule that doesn't match doesn't override, plus test a | ||
| 114 | # PermitOpen entry that's not at the start of the list | ||
| 115 | for p in 1 2; do | ||
| 116 | rm -f $pidfile | ||
| 117 | trace "nomatch permitopen proxy w/key opts proto $p" | ||
| 118 | ${SSH} -q -$p $fwd -F $OBJ/ssh_proxy -f somehost \ | ||
| 119 | exec sh -c \'"echo \$\$ > $pidfile; exec sleep 100"\' >>$TEST_SSH_LOGFILE 2>&1 ||\ | ||
| 120 | fail "nomatch override permitopen proto $p sshd failed" | ||
| 121 | sleep 1; | ||
| 122 | ${SSH} -q -$p -p $fwdport -F $OBJ/ssh_config somehost true || \ | ||
| 123 | fail "nomatch override permitopen proto $p" | ||
| 124 | stop_client | ||
| 125 | done | ||
diff --git a/regress/cipher-speed.sh b/regress/cipher-speed.sh index 592511143..d39a829d4 100644 --- a/regress/cipher-speed.sh +++ b/regress/cipher-speed.sh | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | # $OpenBSD: cipher-speed.sh,v 1.2 2005/05/24 04:09:54 djm Exp $ | 1 | # $OpenBSD: cipher-speed.sh,v 1.3 2007/06/07 19:41:46 pvalchev Exp $ |
| 2 | # Placed in the Public Domain. | 2 | # Placed in the Public Domain. |
| 3 | 3 | ||
| 4 | tid="cipher speed" | 4 | tid="cipher speed" |
| @@ -12,7 +12,7 @@ tries="1 2" | |||
| 12 | DATA=/bin/ls | 12 | DATA=/bin/ls |
| 13 | DATA=/bsd | 13 | DATA=/bsd |
| 14 | 14 | ||
| 15 | macs="hmac-sha1 hmac-md5 hmac-sha1-96 hmac-md5-96" | 15 | macs="hmac-sha1 hmac-md5 umac-64@openssh.com hmac-sha1-96 hmac-md5-96" |
| 16 | ciphers="aes128-cbc 3des-cbc blowfish-cbc cast128-cbc | 16 | ciphers="aes128-cbc 3des-cbc blowfish-cbc cast128-cbc |
| 17 | arcfour128 arcfour256 arcfour aes192-cbc aes256-cbc aes128-ctr" | 17 | arcfour128 arcfour256 arcfour aes192-cbc aes256-cbc aes128-ctr" |
| 18 | 18 | ||
diff --git a/regress/conch-ciphers.sh b/regress/conch-ciphers.sh new file mode 100644 index 000000000..84b190618 --- /dev/null +++ b/regress/conch-ciphers.sh | |||
| @@ -0,0 +1,30 @@ | |||
| 1 | # $OpenBSD: conch-ciphers.sh,v 1.2 2008/06/30 10:43:03 djm Exp $ | ||
| 2 | # Placed in the Public Domain. | ||
| 3 | |||
| 4 | tid="conch ciphers" | ||
| 5 | |||
| 6 | DATA=/bin/ls | ||
| 7 | COPY=${OBJ}/copy | ||
| 8 | |||
| 9 | if test "x$REGRESS_INTEROP_CONCH" != "xyes" ; then | ||
| 10 | fatal "conch interop tests not enabled" | ||
| 11 | fi | ||
| 12 | |||
| 13 | start_sshd | ||
| 14 | |||
| 15 | for c in aes256-ctr aes256-cbc aes192-ctr aes192-cbc aes128-ctr aes128-cbc \ | ||
| 16 | cast128-cbc blowfish 3des-cbc ; do | ||
| 17 | verbose "$tid: cipher $c" | ||
| 18 | rm -f ${COPY} | ||
| 19 | # XXX the 2nd "cat" seems to be needed because of buggy FD handling | ||
| 20 | # in conch | ||
| 21 | ${CONCH} --identity $OBJ/rsa --port $PORT --user $USER -e none \ | ||
| 22 | --known-hosts $OBJ/known_hosts --notty --noagent --nox11 -n \ | ||
| 23 | 127.0.0.1 "cat ${DATA}" 2>/dev/null | cat > ${COPY} | ||
| 24 | if [ $? -ne 0 ]; then | ||
| 25 | fail "ssh cat $DATA failed" | ||
| 26 | fi | ||
| 27 | cmp ${DATA} ${COPY} || fail "corrupted copy" | ||
| 28 | done | ||
| 29 | rm -f ${COPY} | ||
| 30 | |||
diff --git a/regress/key-options.sh b/regress/key-options.sh new file mode 100644 index 000000000..f98d78b30 --- /dev/null +++ b/regress/key-options.sh | |||
| @@ -0,0 +1,71 @@ | |||
| 1 | # $OpenBSD: key-options.sh,v 1.2 2008/06/30 08:07:34 djm Exp $ | ||
| 2 | # Placed in the Public Domain. | ||
| 3 | |||
| 4 | tid="key options" | ||
| 5 | |||
| 6 | origkeys="$OBJ/authkeys_orig" | ||
| 7 | authkeys="$OBJ/authorized_keys_${USER}" | ||
| 8 | cp $authkeys $origkeys | ||
| 9 | |||
| 10 | # Test command= forced command | ||
| 11 | for p in 1 2; do | ||
| 12 | for c in 'command="echo bar"' 'no-pty,command="echo bar"'; do | ||
| 13 | sed "s/.*/$c &/" $origkeys >$authkeys | ||
| 14 | verbose "key option proto $p $c" | ||
| 15 | r=`${SSH} -$p -q -F $OBJ/ssh_proxy somehost echo foo` | ||
| 16 | if [ "$r" = "foo" ]; then | ||
| 17 | fail "key option forced command not restricted" | ||
| 18 | fi | ||
| 19 | if [ "$r" != "bar" ]; then | ||
| 20 | fail "key option forced command not executed" | ||
| 21 | fi | ||
| 22 | done | ||
| 23 | done | ||
| 24 | |||
| 25 | # Test no-pty | ||
| 26 | sed 's/.*/no-pty &/' $origkeys >$authkeys | ||
| 27 | for p in 1 2; do | ||
| 28 | verbose "key option proto $p no-pty" | ||
| 29 | r=`${SSH} -$p -q -F $OBJ/ssh_proxy somehost tty` | ||
| 30 | if [ -f "$r" ]; then | ||
| 31 | fail "key option failed proto $p no-pty (pty $r)" | ||
| 32 | fi | ||
| 33 | done | ||
| 34 | |||
| 35 | # Test environment= | ||
| 36 | echo 'PermitUserEnvironment yes' >> $OBJ/sshd_proxy | ||
| 37 | sed 's/.*/environment="FOO=bar" &/' $origkeys >$authkeys | ||
| 38 | for p in 1 2; do | ||
| 39 | verbose "key option proto $p environment" | ||
| 40 | r=`${SSH} -$p -q -F $OBJ/ssh_proxy somehost 'echo $FOO'` | ||
| 41 | if [ "$r" != "bar" ]; then | ||
| 42 | fail "key option environment not set" | ||
| 43 | fi | ||
| 44 | done | ||
| 45 | |||
| 46 | # Test from= restriction | ||
| 47 | start_sshd | ||
| 48 | for p in 1 2; do | ||
| 49 | for f in 127.0.0.1 '127.0.0.0\/8'; do | ||
| 50 | cat $origkeys >$authkeys | ||
| 51 | ${SSH} -$p -q -F $OBJ/ssh_proxy somehost true | ||
| 52 | if [ $? -ne 0 ]; then | ||
| 53 | fail "key option proto $p failed without restriction" | ||
| 54 | fi | ||
| 55 | |||
| 56 | sed 's/.*/from="'"$f"'" &/' $origkeys >$authkeys | ||
| 57 | from=`head -1 $authkeys | cut -f1 -d ' '` | ||
| 58 | verbose "key option proto $p $from" | ||
| 59 | r=`${SSH} -$p -q -F $OBJ/ssh_proxy somehost 'echo true'` | ||
| 60 | if [ "$r" = "true" ]; then | ||
| 61 | fail "key option proto $p $from not restricted" | ||
| 62 | fi | ||
| 63 | |||
| 64 | r=`${SSH} -$p -q -F $OBJ/ssh_config somehost 'echo true'` | ||
| 65 | if [ "$r" != "true" ]; then | ||
| 66 | fail "key option proto $p $from not allowed but should be" | ||
| 67 | fi | ||
| 68 | done | ||
| 69 | done | ||
| 70 | |||
| 71 | rm -f "$origkeys" | ||
diff --git a/regress/localcommand.sh b/regress/localcommand.sh new file mode 100644 index 000000000..feade7a9d --- /dev/null +++ b/regress/localcommand.sh | |||
| @@ -0,0 +1,15 @@ | |||
| 1 | # $OpenBSD: localcommand.sh,v 1.1 2007/10/29 06:57:13 dtucker Exp $ | ||
| 2 | # Placed in the Public Domain. | ||
| 3 | |||
| 4 | tid="localcommand" | ||
| 5 | |||
| 6 | echo 'PermitLocalCommand yes' >> $OBJ/ssh_proxy | ||
| 7 | echo 'LocalCommand echo foo' >> $OBJ/ssh_proxy | ||
| 8 | |||
| 9 | for p in 1 2; do | ||
| 10 | verbose "test $tid: proto $p localcommand" | ||
| 11 | a=`${SSH} -F $OBJ/ssh_proxy -$p somehost true` | ||
| 12 | if [ "$a" != "foo" ] ; then | ||
| 13 | fail "$tid proto $p" | ||
| 14 | fi | ||
| 15 | done | ||
diff --git a/regress/putty-ciphers.sh b/regress/putty-ciphers.sh new file mode 100644 index 000000000..40435ef41 --- /dev/null +++ b/regress/putty-ciphers.sh | |||
| @@ -0,0 +1,28 @@ | |||
| 1 | # $OpenBSD: putty-ciphers.sh,v 1.2 2008/06/30 10:31:11 djm Exp $ | ||
| 2 | # Placed in the Public Domain. | ||
| 3 | |||
| 4 | tid="putty ciphers" | ||
| 5 | |||
| 6 | DATA=/bin/ls | ||
| 7 | COPY=${OBJ}/copy | ||
| 8 | |||
| 9 | if test "x$REGRESS_INTEROP_PUTTY" != "xyes" ; then | ||
| 10 | fatal "putty interop tests not enabled" | ||
| 11 | fi | ||
| 12 | |||
| 13 | for c in aes blowfish 3des arcfour ; do | ||
| 14 | verbose "$tid: cipher $c" | ||
| 15 | cp ${OBJ}/.putty/sessions/localhost_proxy \ | ||
| 16 | ${OBJ}/.putty/sessions/cipher_$c | ||
| 17 | echo "Cipher=$c" >> ${OBJ}/.putty/sessions/cipher_$c | ||
| 18 | |||
| 19 | rm -f ${COPY} | ||
| 20 | env HOME=$PWD ${PLINK} -load cipher_$c -batch -i putty.rsa2 \ | ||
| 21 | 127.0.0.1 cat ${DATA} > ${COPY} | ||
| 22 | if [ $? -ne 0 ]; then | ||
| 23 | fail "ssh cat $DATA failed" | ||
| 24 | fi | ||
| 25 | cmp ${DATA} ${COPY} || fail "corrupted copy" | ||
| 26 | done | ||
| 27 | rm -f ${COPY} | ||
| 28 | |||
diff --git a/regress/putty-kex.sh b/regress/putty-kex.sh new file mode 100644 index 000000000..2534b8575 --- /dev/null +++ b/regress/putty-kex.sh | |||
| @@ -0,0 +1,25 @@ | |||
| 1 | # $OpenBSD: putty-kex.sh,v 1.2 2008/06/30 10:31:11 djm Exp $ | ||
| 2 | # Placed in the Public Domain. | ||
| 3 | |||
| 4 | tid="putty KEX" | ||
| 5 | |||
| 6 | DATA=/bin/ls | ||
| 7 | COPY=${OBJ}/copy | ||
| 8 | |||
| 9 | if test "x$REGRESS_INTEROP_PUTTY" != "xyes" ; then | ||
| 10 | fatal "putty interop tests not enabled" | ||
| 11 | fi | ||
| 12 | |||
| 13 | for k in dh-gex-sha1 dh-group1-sha1 dh-group14-sha1 ; do | ||
| 14 | verbose "$tid: kex $k" | ||
| 15 | cp ${OBJ}/.putty/sessions/localhost_proxy \ | ||
| 16 | ${OBJ}/.putty/sessions/kex_$k | ||
| 17 | echo "KEX=$k" >> ${OBJ}/.putty/sessions/kex_$k | ||
| 18 | |||
| 19 | env HOME=$PWD ${PLINK} -load kex_$k -batch -i putty.rsa2 \ | ||
| 20 | 127.0.0.1 true | ||
| 21 | if [ $? -ne 0 ]; then | ||
| 22 | fail "KEX $k failed" | ||
| 23 | fi | ||
| 24 | done | ||
| 25 | |||
diff --git a/regress/putty-transfer.sh b/regress/putty-transfer.sh new file mode 100644 index 000000000..6b21f3be7 --- /dev/null +++ b/regress/putty-transfer.sh | |||
| @@ -0,0 +1,43 @@ | |||
| 1 | # $OpenBSD: putty-transfer.sh,v 1.2 2008/06/30 10:31:11 djm Exp $ | ||
| 2 | # Placed in the Public Domain. | ||
| 3 | |||
| 4 | tid="putty transfer data" | ||
| 5 | |||
| 6 | DATA=/bin/ls | ||
| 7 | COPY=${OBJ}/copy | ||
| 8 | |||
| 9 | if test "x$REGRESS_INTEROP_PUTTY" != "xyes" ; then | ||
| 10 | fatal "putty interop tests not enabled" | ||
| 11 | fi | ||
| 12 | |||
| 13 | # XXX support protocol 1 too | ||
| 14 | for p in 2; do | ||
| 15 | for c in 0 1 ; do | ||
| 16 | verbose "$tid: proto $p compression $c" | ||
| 17 | rm -f ${COPY} | ||
| 18 | cp ${OBJ}/.putty/sessions/localhost_proxy \ | ||
| 19 | ${OBJ}/.putty/sessions/compression_$c | ||
| 20 | echo "Compression=$c" >> ${OBJ}/.putty/sessions/kex_$k | ||
| 21 | env HOME=$PWD ${PLINK} -load compression_$c -batch \ | ||
| 22 | -i putty.rsa$p 127.0.0.1 cat ${DATA} > ${COPY} | ||
| 23 | if [ $? -ne 0 ]; then | ||
| 24 | fail "ssh cat $DATA failed" | ||
| 25 | fi | ||
| 26 | cmp ${DATA} ${COPY} || fail "corrupted copy" | ||
| 27 | |||
| 28 | for s in 10 100 1k 32k 64k 128k 256k; do | ||
| 29 | trace "proto $p compression $c dd-size ${s}" | ||
| 30 | rm -f ${COPY} | ||
| 31 | dd if=$DATA obs=${s} 2> /dev/null | \ | ||
| 32 | env HOME=$PWD ${PLINK} -load compression_$c \ | ||
| 33 | -batch -i putty.rsa$p 127.0.0.1 \ | ||
| 34 | "cat > ${COPY}" | ||
| 35 | if [ $? -ne 0 ]; then | ||
| 36 | fail "ssh cat $DATA failed" | ||
| 37 | fi | ||
| 38 | cmp $DATA ${COPY} || fail "corrupted copy" | ||
| 39 | done | ||
| 40 | done | ||
| 41 | done | ||
| 42 | rm -f ${COPY} | ||
| 43 | |||
diff --git a/regress/sftp-badcmds.sh b/regress/sftp-badcmds.sh index eac189aaf..b48b1cb01 100644 --- a/regress/sftp-badcmds.sh +++ b/regress/sftp-badcmds.sh | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | # $OpenBSD: sftp-badcmds.sh,v 1.2 2003/05/15 04:07:12 mouring Exp $ | 1 | # $OpenBSD: sftp-badcmds.sh,v 1.3 2008/03/24 21:46:54 djm Exp $ |
| 2 | # Placed in the Public Domain. | 2 | # Placed in the Public Domain. |
| 3 | 3 | ||
| 4 | tid="sftp invalid commands" | 4 | tid="sftp invalid commands" |
| @@ -45,17 +45,6 @@ echo "rename $NONEXIST ${COPY}.1" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \ | |||
| 45 | || fail "rename nonexist failed" | 45 | || fail "rename nonexist failed" |
| 46 | test -f ${COPY}.1 && fail "file exists after rename nonexistent" | 46 | test -f ${COPY}.1 && fail "file exists after rename nonexistent" |
| 47 | 47 | ||
| 48 | rm -f ${COPY} ${COPY}.1 | ||
| 49 | cp $DATA $COPY | ||
| 50 | cp $DATA2 ${COPY}.1 | ||
| 51 | verbose "$tid: rename target exists" | ||
| 52 | echo "rename $COPY ${COPY}.1" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \ | ||
| 53 | || fail "rename target exists failed" | ||
| 54 | test -f ${COPY} || fail "oldname missing after rename target exists" | ||
| 55 | test -f ${COPY}.1 || fail "newname missing after rename target exists" | ||
| 56 | cmp $DATA ${COPY} >/dev/null 2>&1 || fail "corrupted oldname after rename target exists" | ||
| 57 | cmp $DATA2 ${COPY}.1 >/dev/null 2>&1 || fail "corrupted newname after rename target exists" | ||
| 58 | |||
| 59 | rm -rf ${COPY} ${COPY}.dd | 48 | rm -rf ${COPY} ${COPY}.dd |
| 60 | cp $DATA $COPY | 49 | cp $DATA $COPY |
| 61 | mkdir ${COPY}.dd | 50 | mkdir ${COPY}.dd |
diff --git a/regress/sftp-cmds.sh b/regress/sftp-cmds.sh index 31b21d1f2..3b453c5e8 100644 --- a/regress/sftp-cmds.sh +++ b/regress/sftp-cmds.sh | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | # $OpenBSD: sftp-cmds.sh,v 1.6 2003/10/07 07:04:52 djm Exp $ | 1 | # $OpenBSD: sftp-cmds.sh,v 1.9 2007/12/12 05:04:03 djm Exp $ |
| 2 | # Placed in the Public Domain. | 2 | # Placed in the Public Domain. |
| 3 | 3 | ||
| 4 | # XXX - TODO: | 4 | # XXX - TODO: |
| @@ -34,14 +34,22 @@ fi | |||
| 34 | # Path with embedded quote | 34 | # Path with embedded quote |
| 35 | QUOTECOPY=${COPY}".\"blah\"" | 35 | QUOTECOPY=${COPY}".\"blah\"" |
| 36 | QUOTECOPY_ARG=${COPY}'.\"blah\"' | 36 | QUOTECOPY_ARG=${COPY}'.\"blah\"' |
| 37 | # File with spaces | ||
| 38 | SPACECOPY="${COPY} this has spaces.txt" | ||
| 39 | SPACECOPY_ARG="${COPY}\ this\ has\ spaces.txt" | ||
| 40 | # File with glob metacharacters | ||
| 41 | GLOBMETACOPY="${COPY} [metachar].txt" | ||
| 37 | 42 | ||
| 38 | rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${COPY}.dd2 | 43 | rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${COPY}.dd2 |
| 39 | mkdir ${COPY}.dd | 44 | mkdir ${COPY}.dd |
| 40 | 45 | ||
| 41 | verbose "$tid: lls" | 46 | verbose "$tid: lls" |
| 42 | echo "lls ${OBJ}" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \ | 47 | (echo "lcd ${OBJ}" ; echo "lls") | ${SFTP} -P ${SFTPSERVER} 2>&1 | \ |
| 43 | || fail "lls failed" | 48 | grep copy.dd >/dev/null 2>&1 || fail "lls failed" |
| 44 | # XXX always successful | 49 | |
| 50 | verbose "$tid: lls w/path" | ||
| 51 | echo "lls ${OBJ}" | ${SFTP} -P ${SFTPSERVER} 2>&1 | \ | ||
| 52 | grep copy.dd >/dev/null 2>&1 || fail "lls w/path failed" | ||
| 45 | 53 | ||
| 46 | verbose "$tid: ls" | 54 | verbose "$tid: ls" |
| 47 | echo "ls ${OBJ}" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \ | 55 | echo "ls ${OBJ}" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \ |
| @@ -89,12 +97,27 @@ if [ "$os" != "cygwin" ]; then | |||
| 89 | rm -f ${QUOTECOPY} | 97 | rm -f ${QUOTECOPY} |
| 90 | cp $DATA ${QUOTECOPY} | 98 | cp $DATA ${QUOTECOPY} |
| 91 | verbose "$tid: get filename with quotes" | 99 | verbose "$tid: get filename with quotes" |
| 92 | echo "get \"$QUOTECOPY_ARG\" ${COPY}" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \ | 100 | echo "get \"$QUOTECOPY_ARG\" ${COPY}" | \ |
| 93 | || fail "put failed" | 101 | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \ || fail "get failed" |
| 94 | cmp ${COPY} ${QUOTECOPY} || fail "corrupted copy after get with quotes" | 102 | cmp ${COPY} ${QUOTECOPY} || fail "corrupted copy after get with quotes" |
| 95 | rm -f ${QUOTECOPY} ${COPY} | 103 | rm -f ${QUOTECOPY} ${COPY} |
| 96 | fi | 104 | fi |
| 97 | 105 | ||
| 106 | rm -f "$SPACECOPY" ${COPY} | ||
| 107 | cp $DATA "$SPACECOPY" | ||
| 108 | verbose "$tid: get filename with spaces" | ||
| 109 | echo "get ${SPACECOPY_ARG} ${COPY}" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \ | ||
| 110 | || fail "get failed" | ||
| 111 | cmp ${COPY} "$SPACECOPY" || fail "corrupted copy after get with spaces" | ||
| 112 | |||
| 113 | rm -f "$GLOBMETACOPY" ${COPY} | ||
| 114 | cp $DATA "$GLOBMETACOPY" | ||
| 115 | verbose "$tid: get filename with glob metacharacters" | ||
| 116 | echo "get \"${GLOBMETACOPY}\" ${COPY}" | \ | ||
| 117 | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 || fail "get failed" | ||
| 118 | cmp ${COPY} "$GLOBMETACOPY" || \ | ||
| 119 | fail "corrupted copy after get with glob metacharacters" | ||
| 120 | |||
| 98 | rm -f ${COPY}.dd/* | 121 | rm -f ${COPY}.dd/* |
| 99 | verbose "$tid: get to directory" | 122 | verbose "$tid: get to directory" |
| 100 | echo "get $DATA ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \ | 123 | echo "get $DATA ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \ |
| @@ -125,18 +148,24 @@ done | |||
| 125 | 148 | ||
| 126 | rm -f ${COPY} | 149 | rm -f ${COPY} |
| 127 | verbose "$tid: put" | 150 | verbose "$tid: put" |
| 128 | echo "put $DATA $COPY" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \ | 151 | echo "put $DATA $COPY" | \ |
| 129 | || fail "put failed" | 152 | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 || fail "put failed" |
| 130 | cmp $DATA ${COPY} || fail "corrupted copy after put" | 153 | cmp $DATA ${COPY} || fail "corrupted copy after put" |
| 131 | 154 | ||
| 132 | if [ "$os" != "cygwin" ]; then | 155 | if [ "$os" != "cygwin" ]; then |
| 133 | rm -f ${QUOTECOPY} | 156 | rm -f ${QUOTECOPY} |
| 134 | verbose "$tid: put filename with quotes" | 157 | verbose "$tid: put filename with quotes" |
| 135 | echo "put $DATA \"$QUOTECOPY_ARG\"" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \ | 158 | echo "put $DATA \"$QUOTECOPY_ARG\"" | \ |
| 136 | || fail "put failed" | 159 | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 || fail "put failed" |
| 137 | cmp $DATA ${QUOTECOPY} || fail "corrupted copy after put with quotes" | 160 | cmp $DATA ${QUOTECOPY} || fail "corrupted copy after put with quotes" |
| 138 | fi | 161 | fi |
| 139 | 162 | ||
| 163 | rm -f "$SPACECOPY" | ||
| 164 | verbose "$tid: put filename with spaces" | ||
| 165 | echo "put $DATA ${SPACECOPY_ARG}" | \ | ||
| 166 | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 || fail "put failed" | ||
| 167 | cmp $DATA "$SPACECOPY" || fail "corrupted copy after put with spaces" | ||
| 168 | |||
| 140 | rm -f ${COPY}.dd/* | 169 | rm -f ${COPY}.dd/* |
| 141 | verbose "$tid: put to directory" | 170 | verbose "$tid: put to directory" |
| 142 | echo "put $DATA ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \ | 171 | echo "put $DATA ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \ |
| @@ -145,7 +174,7 @@ cmp $DATA ${COPY}.dd/`basename $DATA` || fail "corrupted copy after put" | |||
| 145 | 174 | ||
| 146 | rm -f ${COPY}.dd/* | 175 | rm -f ${COPY}.dd/* |
| 147 | verbose "$tid: glob put to directory" | 176 | verbose "$tid: glob put to directory" |
| 148 | echo "put /bin/l* ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \ | 177 | echo "put /bin/l? ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \ |
| 149 | || fail "put failed" | 178 | || fail "put failed" |
| 150 | for x in $GLOBFILES; do | 179 | for x in $GLOBFILES; do |
| 151 | cmp /bin/$x ${COPY}.dd/$x || fail "corrupted copy after put" | 180 | cmp /bin/$x ${COPY}.dd/$x || fail "corrupted copy after put" |
| @@ -159,7 +188,7 @@ cmp $DATA ${COPY}.dd/`basename $DATA` || fail "corrupted copy after put" | |||
| 159 | 188 | ||
| 160 | rm -f ${COPY}.dd/* | 189 | rm -f ${COPY}.dd/* |
| 161 | verbose "$tid: glob put to local dir" | 190 | verbose "$tid: glob put to local dir" |
| 162 | (echo "cd ${COPY}.dd"; echo "put /bin/l*") | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \ | 191 | (echo "cd ${COPY}.dd"; echo "put /bin/l?") | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \ |
| 163 | || fail "put failed" | 192 | || fail "put failed" |
| 164 | for x in $GLOBFILES; do | 193 | for x in $GLOBFILES; do |
| 165 | cmp /bin/$x ${COPY}.dd/$x || fail "corrupted copy after put" | 194 | cmp /bin/$x ${COPY}.dd/$x || fail "corrupted copy after put" |
| @@ -172,8 +201,9 @@ test -f ${COPY}.1 || fail "missing file after rename" | |||
| 172 | cmp $DATA ${COPY}.1 >/dev/null 2>&1 || fail "corrupted copy after rename" | 201 | cmp $DATA ${COPY}.1 >/dev/null 2>&1 || fail "corrupted copy after rename" |
| 173 | 202 | ||
| 174 | verbose "$tid: rename directory" | 203 | verbose "$tid: rename directory" |
| 175 | echo "rename ${COPY}.dd ${COPY}.dd2" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \ | 204 | echo "rename ${COPY}.dd ${COPY}.dd2" | \ |
| 176 | || fail "rename directory failed" | 205 | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 || \ |
| 206 | fail "rename directory failed" | ||
| 177 | test -d ${COPY}.dd && fail "oldname exists after rename directory" | 207 | test -d ${COPY}.dd && fail "oldname exists after rename directory" |
| 178 | test -d ${COPY}.dd2 || fail "missing newname after rename directory" | 208 | test -d ${COPY}.dd2 || fail "missing newname after rename directory" |
| 179 | 209 | ||
| @@ -207,5 +237,5 @@ echo "lchdir ${COPY}.dd" | ${SFTP} -P ${SFTPSERVER} >/dev/null 2>&1 \ | |||
| 207 | || fail "lchdir failed" | 237 | || fail "lchdir failed" |
| 208 | 238 | ||
| 209 | rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${COPY}.dd2 | 239 | rm -rf ${COPY} ${COPY}.1 ${COPY}.2 ${COPY}.dd ${COPY}.dd2 |
| 210 | 240 | rm -rf ${QUOTECOPY} "$SPACECOPY" "$GLOBMETACOPY" | |
| 211 | 241 | ||
diff --git a/regress/sftp-glob.sh b/regress/sftp-glob.sh index e238356a2..60116a748 100644 --- a/regress/sftp-glob.sh +++ b/regress/sftp-glob.sh | |||
| @@ -1,28 +1,68 @@ | |||
| 1 | # $OpenBSD: sftp-glob.sh,v 1.1 2004/12/10 01:31:30 fgsch Exp $ | 1 | # $OpenBSD: sftp-glob.sh,v 1.3 2007/10/26 05:30:01 djm Exp $ |
| 2 | # Placed in the Public Domain. | 2 | # Placed in the Public Domain. |
| 3 | 3 | ||
| 4 | tid="sftp glob" | 4 | tid="sftp glob" |
| 5 | 5 | ||
| 6 | sftp_ls() { | ||
| 7 | target=$1 | ||
| 8 | errtag=$2 | ||
| 9 | expected=$3 | ||
| 10 | unexpected=$4 | ||
| 11 | verbose "$tid: $errtag" | ||
| 12 | printf "ls -l %s" "${target}" | \ | ||
| 13 | ${SFTP} -b - -P ${SFTPSERVER} 2>/dev/null | \ | ||
| 14 | grep -v "^sftp>" > ${RESULTS} | ||
| 15 | if [ $? -ne 0 ]; then | ||
| 16 | fail "$errtag failed" | ||
| 17 | fi | ||
| 18 | if test "x$expected" != "x" ; then | ||
| 19 | if fgrep "$expected" ${RESULTS} >/dev/null 2>&1 ; then | ||
| 20 | : | ||
| 21 | else | ||
| 22 | fail "$expected missing from $errtag results" | ||
| 23 | fi | ||
| 24 | fi | ||
| 25 | if test "x$unexpected" != "x" && \ | ||
| 26 | fgrep "$unexpected" ${RESULTS} >/dev/null 2>&1 ; then | ||
| 27 | fail "$unexpected present in $errtag results" | ||
| 28 | fi | ||
| 29 | rm -f ${RESULTS} | ||
| 30 | } | ||
| 31 | |||
| 6 | BASE=${OBJ}/glob | 32 | BASE=${OBJ}/glob |
| 33 | RESULTS=${OBJ}/results | ||
| 7 | DIR=${BASE}/dir | 34 | DIR=${BASE}/dir |
| 8 | DATA=${DIR}/file | 35 | DATA=${DIR}/file |
| 9 | 36 | ||
| 37 | GLOB1="${DIR}/g-wild*" | ||
| 38 | GLOB2="${DIR}/g-wildx" | ||
| 39 | QUOTE="${DIR}/g-quote\"" | ||
| 40 | SLASH="${DIR}/g-sl\\ash" | ||
| 41 | ESLASH="${DIR}/g-slash\\" | ||
| 42 | QSLASH="${DIR}/g-qs\\\"" | ||
| 43 | SPACE="${DIR}/g-q space" | ||
| 44 | |||
| 10 | rm -rf ${BASE} | 45 | rm -rf ${BASE} |
| 11 | mkdir -p ${DIR} | 46 | mkdir -p ${DIR} |
| 12 | touch ${DATA} | 47 | touch "${DATA}" "${GLOB1}" "${GLOB2}" "${QUOTE}" |
| 13 | 48 | touch "${QSLASH}" "${ESLASH}" "${SLASH}" "${SPACE}" | |
| 14 | verbose "$tid: ls file" | 49 | |
| 15 | echo "ls -l ${DIR}/fil*" | ${SFTP} -P ${SFTPSERVER} 2>/dev/null | \ | 50 | # target message expected unexpected |
| 16 | grep ${DATA} >/dev/null 2>&1 | 51 | sftp_ls "${DIR}/fil*" "file glob" "${DATA}" "" |
| 17 | if [ $? -ne 0 ]; then | 52 | sftp_ls "${BASE}/d*" "dir glob" "`basename ${DATA}`" "" |
| 18 | fail "globbed ls file failed" | 53 | sftp_ls "${DIR}/g-wild\"*\"" "quoted glob" "g-wild*" "g-wildx" |
| 19 | fi | 54 | sftp_ls "${DIR}/g-wild\*" "escaped glob" "g-wild*" "g-wildx" |
| 20 | 55 | sftp_ls "${DIR}/g-quote\\\"" "escaped quote" "g-quote\"" "" | |
| 21 | verbose "$tid: ls dir" | 56 | sftp_ls "\"${DIR}/g-quote\\\"\"" "quoted quote" "g-quote\"" "" |
| 22 | echo "ls -l ${BASE}/d*" | ${SFTP} -P ${SFTPSERVER} 2>/dev/null | \ | 57 | sftp_ls "'${DIR}/g-quote\"'" "single-quoted quote" "g-quote\"" "" |
| 23 | grep file >/dev/null 2>&1 | 58 | sftp_ls "${DIR}/g-sl\\\\ash" "escaped slash" "g-sl\\ash" "" |
| 24 | if [ $? -ne 0 ]; then | 59 | sftp_ls "'${DIR}/g-sl\\\\ash'" "quoted slash" "g-sl\\ash" "" |
| 25 | fail "globbed ls dir failed" | 60 | sftp_ls "${DIR}/g-slash\\\\" "escaped slash at EOL" "g-slash\\" "" |
| 26 | fi | 61 | sftp_ls "'${DIR}/g-slash\\\\'" "quoted slash at EOL" "g-slash\\" "" |
| 62 | sftp_ls "${DIR}/g-qs\\\\\\\"" "escaped slash+quote" "g-qs\\\"" "" | ||
| 63 | sftp_ls "'${DIR}/g-qs\\\\\"'" "quoted slash+quote" "g-qs\\\"" "" | ||
| 64 | sftp_ls "${DIR}/g-q\\ space" "escaped space" "g-q space" "" | ||
| 65 | sftp_ls "'${DIR}/g-q space'" "quoted space" "g-q space" "" | ||
| 27 | 66 | ||
| 28 | rm -rf ${BASE} | 67 | rm -rf ${BASE} |
| 68 | |||
diff --git a/regress/ssh2putty.sh b/regress/ssh2putty.sh new file mode 100755 index 000000000..dfdeeff4a --- /dev/null +++ b/regress/ssh2putty.sh | |||
| @@ -0,0 +1,33 @@ | |||
| 1 | #!/bin/sh | ||
| 2 | |||
| 3 | if test "x$1" = "x" -o "x$2" = "x" -o "x$3" = "x" ; then | ||
| 4 | echo "Usage: ssh2putty hostname port ssh-private-key" | ||
| 5 | exit 1 | ||
| 6 | fi | ||
| 7 | |||
| 8 | HOST=$1 | ||
| 9 | PORT=$2 | ||
| 10 | KEYFILE=$3 | ||
| 11 | |||
| 12 | # XXX - support DSA keys too | ||
| 13 | if grep "BEGIN RSA PRIVATE KEY" $KEYFILE >/dev/null 2>&1 ; then | ||
| 14 | : | ||
| 15 | else | ||
| 16 | echo "Unsupported private key format" | ||
| 17 | exit 1 | ||
| 18 | fi | ||
| 19 | |||
| 20 | public_exponent=` | ||
| 21 | openssl rsa -noout -text -in $KEYFILE | grep ^publicExponent | | ||
| 22 | sed 's/.*(//;s/).*//' | ||
| 23 | ` | ||
| 24 | test $? -ne 0 && exit 1 | ||
| 25 | |||
| 26 | modulus=` | ||
| 27 | openssl rsa -noout -modulus -in $KEYFILE | grep ^Modulus= | | ||
| 28 | sed 's/^Modulus=/0x/' | tr A-Z a-z | ||
| 29 | ` | ||
| 30 | test $? -ne 0 && exit 1 | ||
| 31 | |||
| 32 | echo "rsa2@$PORT:$HOST $public_exponent,$modulus" | ||
| 33 | |||
diff --git a/regress/test-exec.sh b/regress/test-exec.sh index 59ae33c08..b54448912 100644 --- a/regress/test-exec.sh +++ b/regress/test-exec.sh | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | # $OpenBSD: test-exec.sh,v 1.28 2005/05/20 23:14:15 djm Exp $ | 1 | # $OpenBSD: test-exec.sh,v 1.35 2008/06/28 13:57:25 djm Exp $ |
| 2 | # Placed in the Public Domain. | 2 | # Placed in the Public Domain. |
| 3 | 3 | ||
| 4 | #SUDO=sudo | 4 | #SUDO=sudo |
| @@ -69,6 +69,11 @@ SFTP=sftp | |||
| 69 | SFTPSERVER=/usr/libexec/openssh/sftp-server | 69 | SFTPSERVER=/usr/libexec/openssh/sftp-server |
| 70 | SCP=scp | 70 | SCP=scp |
| 71 | 71 | ||
| 72 | # Interop testing | ||
| 73 | PLINK=plink | ||
| 74 | PUTTYGEN=puttygen | ||
| 75 | CONCH=conch | ||
| 76 | |||
| 72 | if [ "x$TEST_SSH_SSH" != "x" ]; then | 77 | if [ "x$TEST_SSH_SSH" != "x" ]; then |
| 73 | SSH="${TEST_SSH_SSH}" | 78 | SSH="${TEST_SSH_SSH}" |
| 74 | fi | 79 | fi |
| @@ -96,6 +101,27 @@ fi | |||
| 96 | if [ "x$TEST_SSH_SCP" != "x" ]; then | 101 | if [ "x$TEST_SSH_SCP" != "x" ]; then |
| 97 | SCP="${TEST_SSH_SCP}" | 102 | SCP="${TEST_SSH_SCP}" |
| 98 | fi | 103 | fi |
| 104 | if [ "x$TEST_SSH_PLINK" != "x" ]; then | ||
| 105 | # Find real binary, if it exists | ||
| 106 | case "${TEST_SSH_PLINK}" in | ||
| 107 | /*) PLINK="${TEST_SSH_PLINK}" ;; | ||
| 108 | *) PLINK=`which ${TEST_SSH_PLINK} 2>/dev/null` ;; | ||
| 109 | esac | ||
| 110 | fi | ||
| 111 | if [ "x$TEST_SSH_PUTTYGEN" != "x" ]; then | ||
| 112 | # Find real binary, if it exists | ||
| 113 | case "${TEST_SSH_PUTTYGEN}" in | ||
| 114 | /*) PUTTYGEN="${TEST_SSH_PUTTYGEN}" ;; | ||
| 115 | *) PUTTYGEN=`which ${TEST_SSH_PUTTYGEN} 2>/dev/null` ;; | ||
| 116 | esac | ||
| 117 | fi | ||
| 118 | if [ "x$TEST_SSH_CONCH" != "x" ]; then | ||
| 119 | # Find real binary, if it exists | ||
| 120 | case "${TEST_SSH_CONCH}" in | ||
| 121 | /*) CONCH="${TEST_SSH_CONCH}" ;; | ||
| 122 | *) CONCH=`which ${TEST_SSH_CONCH} 2>/dev/null` ;; | ||
| 123 | esac | ||
| 124 | fi | ||
| 99 | 125 | ||
| 100 | # Path to sshd must be absolute for rexec | 126 | # Path to sshd must be absolute for rexec |
| 101 | case "$SSHD" in | 127 | case "$SSHD" in |
| @@ -269,6 +295,49 @@ for t in rsa rsa1; do | |||
| 269 | done | 295 | done |
| 270 | chmod 644 $OBJ/authorized_keys_$USER | 296 | chmod 644 $OBJ/authorized_keys_$USER |
| 271 | 297 | ||
| 298 | # Activate Twisted Conch tests if the binary is present | ||
| 299 | REGRESS_INTEROP_CONCH=no | ||
| 300 | if test -x "$CONCH" ; then | ||
| 301 | REGRESS_INTEROP_CONCH=yes | ||
| 302 | fi | ||
| 303 | |||
| 304 | # If PuTTY is present and we are running a PuTTY test, prepare keys and | ||
| 305 | # configuration | ||
| 306 | REGRESS_INTEROP_PUTTY=no | ||
| 307 | if test -x "$PUTTYGEN" -a -x "$PLINK" ; then | ||
| 308 | REGRESS_INTEROP_PUTTY=yes | ||
| 309 | fi | ||
| 310 | case "$SCRIPT" in | ||
| 311 | *putty*) ;; | ||
| 312 | *) REGRESS_INTEROP_PUTTY=no ;; | ||
| 313 | esac | ||
| 314 | |||
| 315 | if test "$REGRESS_INTEROP_PUTTY" = "yes" ; then | ||
| 316 | mkdir -p ${OBJ}/.putty | ||
| 317 | |||
| 318 | # Add a PuTTY key to authorized_keys | ||
| 319 | rm -f ${OBJ}/putty.rsa2 | ||
| 320 | puttygen -t rsa -o ${OBJ}/putty.rsa2 < /dev/null > /dev/null | ||
| 321 | puttygen -O public-openssh ${OBJ}/putty.rsa2 \ | ||
| 322 | >> $OBJ/authorized_keys_$USER | ||
| 323 | |||
| 324 | # Convert rsa2 host key to PuTTY format | ||
| 325 | ${SRC}/ssh2putty.sh 127.0.0.1 $PORT $OBJ/rsa > \ | ||
| 326 | ${OBJ}/.putty/sshhostkeys | ||
| 327 | ${SRC}/ssh2putty.sh 127.0.0.1 22 $OBJ/rsa >> \ | ||
| 328 | ${OBJ}/.putty/sshhostkeys | ||
| 329 | |||
| 330 | # Setup proxied session | ||
| 331 | mkdir -p ${OBJ}/.putty/sessions | ||
| 332 | rm -f ${OBJ}/.putty/sessions/localhost_proxy | ||
| 333 | echo "Hostname=127.0.0.1" >> ${OBJ}/.putty/sessions/localhost_proxy | ||
| 334 | echo "PortNumber=$PORT" >> ${OBJ}/.putty/sessions/localhost_proxy | ||
| 335 | echo "ProxyMethod=5" >> ${OBJ}/.putty/sessions/localhost_proxy | ||
| 336 | echo "ProxyTelnetCommand=sh ${SRC}/sshd-log-wrapper.sh ${SSHD} ${TEST_SSH_LOGFILE} -i -f $OBJ/sshd_proxy" >> ${OBJ}/.putty/sessions/localhost_proxy | ||
| 337 | |||
| 338 | REGRESS_INTEROP_PUTTY=yes | ||
| 339 | fi | ||
| 340 | |||
| 272 | # create a proxy version of the client config | 341 | # create a proxy version of the client config |
| 273 | ( | 342 | ( |
| 274 | cat $OBJ/ssh_config | 343 | cat $OBJ/ssh_config |
| @@ -281,8 +350,8 @@ ${SSHD} -t -f $OBJ/sshd_proxy || fatal "sshd_proxy broken" | |||
| 281 | start_sshd () | 350 | start_sshd () |
| 282 | { | 351 | { |
| 283 | # start sshd | 352 | # start sshd |
| 284 | $SUDO ${SSHD} -f $OBJ/sshd_config -t || fatal "sshd_config broken" | 353 | $SUDO ${SSHD} -f $OBJ/sshd_config "$@" -t || fatal "sshd_config broken" |
| 285 | $SUDO ${SSHD} -f $OBJ/sshd_config -e >>$TEST_SSH_LOGFILE 2>&1 | 354 | $SUDO ${SSHD} -f $OBJ/sshd_config -e "$@" >>$TEST_SSH_LOGFILE 2>&1 |
| 286 | 355 | ||
| 287 | trace "wait for sshd" | 356 | trace "wait for sshd" |
| 288 | i=0; | 357 | i=0; |
diff --git a/regress/try-ciphers.sh b/regress/try-ciphers.sh index 379fe353a..ef776d2ee 100644 --- a/regress/try-ciphers.sh +++ b/regress/try-ciphers.sh | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | # $OpenBSD: try-ciphers.sh,v 1.10 2005/05/24 04:10:54 djm Exp $ | 1 | # $OpenBSD: try-ciphers.sh,v 1.11 2007/06/07 19:41:46 pvalchev Exp $ |
| 2 | # Placed in the Public Domain. | 2 | # Placed in the Public Domain. |
| 3 | 3 | ||
| 4 | tid="try ciphers" | 4 | tid="try ciphers" |
| @@ -7,7 +7,7 @@ ciphers="aes128-cbc 3des-cbc blowfish-cbc cast128-cbc | |||
| 7 | arcfour128 arcfour256 arcfour | 7 | arcfour128 arcfour256 arcfour |
| 8 | aes192-cbc aes256-cbc rijndael-cbc@lysator.liu.se | 8 | aes192-cbc aes256-cbc rijndael-cbc@lysator.liu.se |
| 9 | aes128-ctr aes192-ctr aes256-ctr" | 9 | aes128-ctr aes192-ctr aes256-ctr" |
| 10 | macs="hmac-sha1 hmac-md5 hmac-sha1-96 hmac-md5-96" | 10 | macs="hmac-sha1 hmac-md5 umac-64@openssh.com hmac-sha1-96 hmac-md5-96" |
| 11 | 11 | ||
| 12 | for c in $ciphers; do | 12 | for c in $ciphers; do |
| 13 | for m in $macs; do | 13 | for m in $macs; do |
| @@ -14,9 +14,11 @@ DESCRIPTION | |||
| 14 | as ssh(1). Unlike rcp(1), scp will ask for passwords or passphrases if | 14 | as ssh(1). Unlike rcp(1), scp will ask for passwords or passphrases if |
| 15 | they are needed for authentication. | 15 | they are needed for authentication. |
| 16 | 16 | ||
| 17 | Any file name may contain a host and user specification to indicate that | 17 | File names may contain a user and host specification to indicate that the |
| 18 | the file is to be copied to/from that host. Copies between two remote | 18 | file is to be copied to/from that host. Local file names can be made ex- |
| 19 | hosts are permitted. | 19 | plicit using absolute or relative pathnames to avoid scp treating file |
| 20 | names containing `:' as host specifiers. Copies between two remote hosts | ||
| 21 | are also permitted. | ||
| 20 | 22 | ||
| 21 | The options are as follows: | 23 | The options are as follows: |
| 22 | 24 | ||
| @@ -43,8 +45,8 @@ DESCRIPTION | |||
| 43 | This option is directly passed to ssh(1). | 45 | This option is directly passed to ssh(1). |
| 44 | 46 | ||
| 45 | -i identity_file | 47 | -i identity_file |
| 46 | Selects the file from which the identity (private key) for RSA | 48 | Selects the file from which the identity (private key) for public |
| 47 | authentication is read. This option is directly passed to | 49 | key authentication is read. This option is directly passed to |
| 48 | ssh(1). | 50 | ssh(1). |
| 49 | 51 | ||
| 50 | -l limit | 52 | -l limit |
| @@ -115,9 +117,11 @@ DESCRIPTION | |||
| 115 | -p Preserves modification times, access times, and modes from the | 117 | -p Preserves modification times, access times, and modes from the |
| 116 | original file. | 118 | original file. |
| 117 | 119 | ||
| 118 | -q Disables the progress meter. | 120 | -q Quiet mode: disables the progress meter as well as warning and |
| 121 | diagnostic messages from ssh(1). | ||
| 119 | 122 | ||
| 120 | -r Recursively copy entire directories. | 123 | -r Recursively copy entire directories. Note that scp follows sym- |
| 124 | bolic links encountered in the tree traversal. | ||
| 121 | 125 | ||
| 122 | -S program | 126 | -S program |
| 123 | Name of program to use for the encrypted connection. The program | 127 | Name of program to use for the encrypted connection. The program |
| @@ -141,4 +145,4 @@ AUTHORS | |||
| 141 | Timo Rinne <tri@iki.fi> | 145 | Timo Rinne <tri@iki.fi> |
| 142 | Tatu Ylonen <ylo@cs.hut.fi> | 146 | Tatu Ylonen <ylo@cs.hut.fi> |
| 143 | 147 | ||
| 144 | OpenBSD 4.2 August 8, 2007 3 | 148 | OpenBSD 4.4 July 12, 2008 3 |
| @@ -9,9 +9,9 @@ | |||
| 9 | .\" | 9 | .\" |
| 10 | .\" Created: Sun May 7 00:14:37 1995 ylo | 10 | .\" Created: Sun May 7 00:14:37 1995 ylo |
| 11 | .\" | 11 | .\" |
| 12 | .\" $OpenBSD: scp.1,v 1.42 2007/08/06 19:16:06 sobrado Exp $ | 12 | .\" $OpenBSD: scp.1,v 1.46 2008/07/12 05:33:41 djm Exp $ |
| 13 | .\" | 13 | .\" |
| 14 | .Dd $Mdocdate: August 8 2007 $ | 14 | .Dd $Mdocdate: July 12 2008 $ |
| 15 | .Dt SCP 1 | 15 | .Dt SCP 1 |
| 16 | .Os | 16 | .Os |
| 17 | .Sh NAME | 17 | .Sh NAME |
| @@ -56,9 +56,15 @@ Unlike | |||
| 56 | will ask for passwords or passphrases if they are needed for | 56 | will ask for passwords or passphrases if they are needed for |
| 57 | authentication. | 57 | authentication. |
| 58 | .Pp | 58 | .Pp |
| 59 | Any file name may contain a host and user specification to indicate | 59 | File names may contain a user and host specification to indicate |
| 60 | that the file is to be copied to/from that host. | 60 | that the file is to be copied to/from that host. |
| 61 | Copies between two remote hosts are permitted. | 61 | Local file names can be made explicit using absolute or relative pathnames |
| 62 | to avoid | ||
| 63 | .Nm | ||
| 64 | treating file names containing | ||
| 65 | .Sq :\& | ||
| 66 | as host specifiers. | ||
| 67 | Copies between two remote hosts are also permitted. | ||
| 62 | .Pp | 68 | .Pp |
| 63 | The options are as follows: | 69 | The options are as follows: |
| 64 | .Bl -tag -width Ds | 70 | .Bl -tag -width Ds |
| @@ -98,7 +104,7 @@ per-user configuration file for | |||
| 98 | This option is directly passed to | 104 | This option is directly passed to |
| 99 | .Xr ssh 1 . | 105 | .Xr ssh 1 . |
| 100 | .It Fl i Ar identity_file | 106 | .It Fl i Ar identity_file |
| 101 | Selects the file from which the identity (private key) for RSA | 107 | Selects the file from which the identity (private key) for public key |
| 102 | authentication is read. | 108 | authentication is read. |
| 103 | This option is directly passed to | 109 | This option is directly passed to |
| 104 | .Xr ssh 1 . | 110 | .Xr ssh 1 . |
| @@ -178,9 +184,14 @@ is already reserved for preserving the times and modes of the file in | |||
| 178 | Preserves modification times, access times, and modes from the | 184 | Preserves modification times, access times, and modes from the |
| 179 | original file. | 185 | original file. |
| 180 | .It Fl q | 186 | .It Fl q |
| 181 | Disables the progress meter. | 187 | Quiet mode: disables the progress meter as well as warning and diagnostic |
| 188 | messages from | ||
| 189 | .Xr ssh 1 . | ||
| 182 | .It Fl r | 190 | .It Fl r |
| 183 | Recursively copy entire directories. | 191 | Recursively copy entire directories. |
| 192 | Note that | ||
| 193 | .Nm | ||
| 194 | follows symbolic links encountered in the tree traversal. | ||
| 184 | .It Fl S Ar program | 195 | .It Fl S Ar program |
| 185 | Name of | 196 | Name of |
| 186 | .Ar program | 197 | .Ar program |
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: scp.c,v 1.160 2007/08/06 19:16:06 sobrado Exp $ */ | 1 | /* $OpenBSD: scp.c,v 1.163 2008/06/13 18:55:22 dtucker Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * scp - secure remote copy. This is basically patched BSD rcp which | 3 | * scp - secure remote copy. This is basically patched BSD rcp which |
| 4 | * uses ssh to do the data transfer (instead of using rcmd). | 4 | * uses ssh to do the data transfer (instead of using rcmd). |
| @@ -78,6 +78,13 @@ | |||
| 78 | #ifdef HAVE_SYS_STAT_H | 78 | #ifdef HAVE_SYS_STAT_H |
| 79 | # include <sys/stat.h> | 79 | # include <sys/stat.h> |
| 80 | #endif | 80 | #endif |
| 81 | #ifdef HAVE_POLL_H | ||
| 82 | #include <poll.h> | ||
| 83 | #else | ||
| 84 | # ifdef HAVE_SYS_POLL_H | ||
| 85 | # include <sys/poll.h> | ||
| 86 | # endif | ||
| 87 | #endif | ||
| 81 | #ifdef HAVE_SYS_TIME_H | 88 | #ifdef HAVE_SYS_TIME_H |
| 82 | # include <sys/time.h> | 89 | # include <sys/time.h> |
| 83 | #endif | 90 | #endif |
| @@ -109,6 +116,8 @@ | |||
| 109 | 116 | ||
| 110 | extern char *__progname; | 117 | extern char *__progname; |
| 111 | 118 | ||
| 119 | #define COPY_BUFLEN 16384 | ||
| 120 | |||
| 112 | int do_cmd(char *host, char *remuser, char *cmd, int *fdin, int *fdout); | 121 | int do_cmd(char *host, char *remuser, char *cmd, int *fdin, int *fdout); |
| 113 | 122 | ||
| 114 | void bwlimit(int); | 123 | void bwlimit(int); |
| @@ -290,6 +299,7 @@ void sink(int, char *[]); | |||
| 290 | void source(int, char *[]); | 299 | void source(int, char *[]); |
| 291 | void tolocal(int, char *[]); | 300 | void tolocal(int, char *[]); |
| 292 | void toremote(char *, int, char *[]); | 301 | void toremote(char *, int, char *[]); |
| 302 | size_t scpio(ssize_t (*)(int, void *, size_t), int, void *, size_t, off_t *); | ||
| 293 | void usage(void); | 303 | void usage(void); |
| 294 | 304 | ||
| 295 | int | 305 | int |
| @@ -449,6 +459,43 @@ main(int argc, char **argv) | |||
| 449 | exit(errs != 0); | 459 | exit(errs != 0); |
| 450 | } | 460 | } |
| 451 | 461 | ||
| 462 | /* | ||
| 463 | * atomicio-like wrapper that also applies bandwidth limits and updates | ||
| 464 | * the progressmeter counter. | ||
| 465 | */ | ||
| 466 | size_t | ||
| 467 | scpio(ssize_t (*f)(int, void *, size_t), int fd, void *_p, size_t l, off_t *c) | ||
| 468 | { | ||
| 469 | u_char *p = (u_char *)_p; | ||
| 470 | size_t offset; | ||
| 471 | ssize_t r; | ||
| 472 | struct pollfd pfd; | ||
| 473 | |||
| 474 | pfd.fd = fd; | ||
| 475 | pfd.events = f == read ? POLLIN : POLLOUT; | ||
| 476 | for (offset = 0; offset < l;) { | ||
| 477 | r = f(fd, p + offset, l - offset); | ||
| 478 | if (r == 0) { | ||
| 479 | errno = EPIPE; | ||
| 480 | return offset; | ||
| 481 | } | ||
| 482 | if (r < 0) { | ||
| 483 | if (errno == EINTR) | ||
| 484 | continue; | ||
| 485 | if (errno == EAGAIN || errno == EWOULDBLOCK) { | ||
| 486 | (void)poll(&pfd, 1, -1); /* Ignore errors */ | ||
| 487 | continue; | ||
| 488 | } | ||
| 489 | return offset; | ||
| 490 | } | ||
| 491 | offset += (size_t)r; | ||
| 492 | *c += (off_t)r; | ||
| 493 | if (limit_rate) | ||
| 494 | bwlimit(r); | ||
| 495 | } | ||
| 496 | return offset; | ||
| 497 | } | ||
| 498 | |||
| 452 | void | 499 | void |
| 453 | toremote(char *targ, int argc, char **argv) | 500 | toremote(char *targ, int argc, char **argv) |
| 454 | { | 501 | { |
| @@ -590,8 +637,8 @@ source(int argc, char **argv) | |||
| 590 | struct stat stb; | 637 | struct stat stb; |
| 591 | static BUF buffer; | 638 | static BUF buffer; |
| 592 | BUF *bp; | 639 | BUF *bp; |
| 593 | off_t i, amt, statbytes; | 640 | off_t i, statbytes; |
| 594 | size_t result; | 641 | size_t amt; |
| 595 | int fd = -1, haderr, indx; | 642 | int fd = -1, haderr, indx; |
| 596 | char *last, *name, buf[2048], encname[MAXPATHLEN]; | 643 | char *last, *name, buf[2048], encname[MAXPATHLEN]; |
| 597 | int len; | 644 | int len; |
| @@ -612,6 +659,10 @@ source(int argc, char **argv) | |||
| 612 | syserr: run_err("%s: %s", name, strerror(errno)); | 659 | syserr: run_err("%s: %s", name, strerror(errno)); |
| 613 | goto next; | 660 | goto next; |
| 614 | } | 661 | } |
| 662 | if (stb.st_size < 0) { | ||
| 663 | run_err("%s: %s", name, "Negative file size"); | ||
| 664 | goto next; | ||
| 665 | } | ||
| 615 | unset_nonblock(fd); | 666 | unset_nonblock(fd); |
| 616 | switch (stb.st_mode & S_IFMT) { | 667 | switch (stb.st_mode & S_IFMT) { |
| 617 | case S_IFREG: | 668 | case S_IFREG: |
| @@ -637,8 +688,14 @@ syserr: run_err("%s: %s", name, strerror(errno)); | |||
| 637 | * versions expecting microseconds. | 688 | * versions expecting microseconds. |
| 638 | */ | 689 | */ |
| 639 | (void) snprintf(buf, sizeof buf, "T%lu 0 %lu 0\n", | 690 | (void) snprintf(buf, sizeof buf, "T%lu 0 %lu 0\n", |
| 640 | (u_long) stb.st_mtime, | 691 | (u_long) (stb.st_mtime < 0 ? 0 : stb.st_mtime), |
| 641 | (u_long) stb.st_atime); | 692 | (u_long) (stb.st_atime < 0 ? 0 : stb.st_atime)); |
| 693 | if (verbose_mode) { | ||
| 694 | fprintf(stderr, "File mtime %ld atime %ld\n", | ||
| 695 | (long)stb.st_mtime, (long)stb.st_atime); | ||
| 696 | fprintf(stderr, "Sending file timestamps: %s", | ||
| 697 | buf); | ||
| 698 | } | ||
| 642 | (void) atomicio(vwrite, remout, buf, strlen(buf)); | 699 | (void) atomicio(vwrite, remout, buf, strlen(buf)); |
| 643 | if (response() < 0) | 700 | if (response() < 0) |
| 644 | goto next; | 701 | goto next; |
| @@ -653,7 +710,7 @@ syserr: run_err("%s: %s", name, strerror(errno)); | |||
| 653 | (void) atomicio(vwrite, remout, buf, strlen(buf)); | 710 | (void) atomicio(vwrite, remout, buf, strlen(buf)); |
| 654 | if (response() < 0) | 711 | if (response() < 0) |
| 655 | goto next; | 712 | goto next; |
| 656 | if ((bp = allocbuf(&buffer, fd, 2048)) == NULL) { | 713 | if ((bp = allocbuf(&buffer, fd, COPY_BUFLEN)) == NULL) { |
| 657 | next: if (fd != -1) { | 714 | next: if (fd != -1) { |
| 658 | (void) close(fd); | 715 | (void) close(fd); |
| 659 | fd = -1; | 716 | fd = -1; |
| @@ -662,27 +719,25 @@ next: if (fd != -1) { | |||
| 662 | } | 719 | } |
| 663 | if (showprogress) | 720 | if (showprogress) |
| 664 | start_progress_meter(curfile, stb.st_size, &statbytes); | 721 | start_progress_meter(curfile, stb.st_size, &statbytes); |
| 665 | /* Keep writing after an error so that we stay sync'd up. */ | 722 | set_nonblock(remout); |
| 666 | for (haderr = i = 0; i < stb.st_size; i += bp->cnt) { | 723 | for (haderr = i = 0; i < stb.st_size; i += bp->cnt) { |
| 667 | amt = bp->cnt; | 724 | amt = bp->cnt; |
| 668 | if (i + amt > stb.st_size) | 725 | if (i + (off_t)amt > stb.st_size) |
| 669 | amt = stb.st_size - i; | 726 | amt = stb.st_size - i; |
| 670 | if (!haderr) { | 727 | if (!haderr) { |
| 671 | result = atomicio(read, fd, bp->buf, amt); | 728 | if (atomicio(read, fd, bp->buf, amt) != amt) |
| 672 | if (result != amt) | ||
| 673 | haderr = errno; | 729 | haderr = errno; |
| 674 | } | 730 | } |
| 675 | if (haderr) | 731 | /* Keep writing after error to retain sync */ |
| 676 | (void) atomicio(vwrite, remout, bp->buf, amt); | 732 | if (haderr) { |
| 677 | else { | 733 | (void)atomicio(vwrite, remout, bp->buf, amt); |
| 678 | result = atomicio(vwrite, remout, bp->buf, amt); | 734 | continue; |
| 679 | if (result != amt) | ||
| 680 | haderr = errno; | ||
| 681 | statbytes += result; | ||
| 682 | } | 735 | } |
| 683 | if (limit_rate) | 736 | if (scpio(vwrite, remout, bp->buf, amt, |
| 684 | bwlimit(amt); | 737 | &statbytes) != amt) |
| 738 | haderr = errno; | ||
| 685 | } | 739 | } |
| 740 | unset_nonblock(remout); | ||
| 686 | if (showprogress) | 741 | if (showprogress) |
| 687 | stop_progress_meter(); | 742 | stop_progress_meter(); |
| 688 | 743 | ||
| @@ -788,10 +843,10 @@ bwlimit(int amount) | |||
| 788 | thresh /= 2; | 843 | thresh /= 2; |
| 789 | if (thresh < 2048) | 844 | if (thresh < 2048) |
| 790 | thresh = 2048; | 845 | thresh = 2048; |
| 791 | } else if (bwend.tv_usec < 100) { | 846 | } else if (bwend.tv_usec < 10000) { |
| 792 | thresh *= 2; | 847 | thresh *= 2; |
| 793 | if (thresh > 32768) | 848 | if (thresh > COPY_BUFLEN * 4) |
| 794 | thresh = 32768; | 849 | thresh = COPY_BUFLEN * 4; |
| 795 | } | 850 | } |
| 796 | 851 | ||
| 797 | TIMEVAL_TO_TIMESPEC(&bwend, &ts); | 852 | TIMEVAL_TO_TIMESPEC(&bwend, &ts); |
| @@ -982,7 +1037,7 @@ bad: run_err("%s: %s", np, strerror(errno)); | |||
| 982 | continue; | 1037 | continue; |
| 983 | } | 1038 | } |
| 984 | (void) atomicio(vwrite, remout, "", 1); | 1039 | (void) atomicio(vwrite, remout, "", 1); |
| 985 | if ((bp = allocbuf(&buffer, ofd, 4096)) == NULL) { | 1040 | if ((bp = allocbuf(&buffer, ofd, COPY_BUFLEN)) == NULL) { |
| 986 | (void) close(ofd); | 1041 | (void) close(ofd); |
| 987 | continue; | 1042 | continue; |
| 988 | } | 1043 | } |
| @@ -992,26 +1047,24 @@ bad: run_err("%s: %s", np, strerror(errno)); | |||
| 992 | statbytes = 0; | 1047 | statbytes = 0; |
| 993 | if (showprogress) | 1048 | if (showprogress) |
| 994 | start_progress_meter(curfile, size, &statbytes); | 1049 | start_progress_meter(curfile, size, &statbytes); |
| 995 | for (count = i = 0; i < size; i += 4096) { | 1050 | set_nonblock(remin); |
| 996 | amt = 4096; | 1051 | for (count = i = 0; i < size; i += bp->cnt) { |
| 1052 | amt = bp->cnt; | ||
| 997 | if (i + amt > size) | 1053 | if (i + amt > size) |
| 998 | amt = size - i; | 1054 | amt = size - i; |
| 999 | count += amt; | 1055 | count += amt; |
| 1000 | do { | 1056 | do { |
| 1001 | j = atomicio(read, remin, cp, amt); | 1057 | j = scpio(read, remin, cp, amt, &statbytes); |
| 1002 | if (j == 0) { | 1058 | if (j == 0) { |
| 1003 | run_err("%s", j ? strerror(errno) : | 1059 | run_err("%s", j != EPIPE ? |
| 1060 | strerror(errno) : | ||
| 1004 | "dropped connection"); | 1061 | "dropped connection"); |
| 1005 | exit(1); | 1062 | exit(1); |
| 1006 | } | 1063 | } |
| 1007 | amt -= j; | 1064 | amt -= j; |
| 1008 | cp += j; | 1065 | cp += j; |
| 1009 | statbytes += j; | ||
| 1010 | } while (amt > 0); | 1066 | } while (amt > 0); |
| 1011 | 1067 | ||
| 1012 | if (limit_rate) | ||
| 1013 | bwlimit(4096); | ||
| 1014 | |||
| 1015 | if (count == bp->cnt) { | 1068 | if (count == bp->cnt) { |
| 1016 | /* Keep reading so we stay sync'd up. */ | 1069 | /* Keep reading so we stay sync'd up. */ |
| 1017 | if (wrerr == NO) { | 1070 | if (wrerr == NO) { |
| @@ -1025,6 +1078,7 @@ bad: run_err("%s: %s", np, strerror(errno)); | |||
| 1025 | cp = bp->buf; | 1078 | cp = bp->buf; |
| 1026 | } | 1079 | } |
| 1027 | } | 1080 | } |
| 1081 | unset_nonblock(remin); | ||
| 1028 | if (showprogress) | 1082 | if (showprogress) |
| 1029 | stop_progress_meter(); | 1083 | stop_progress_meter(); |
| 1030 | if (count != 0 && wrerr == NO && | 1084 | if (count != 0 && wrerr == NO && |
diff --git a/servconf.c b/servconf.c index c5688912d..6760401ff 100644 --- a/servconf.c +++ b/servconf.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: servconf.c,v 1.172 2007/04/23 10:15:39 dtucker Exp $ */ | 1 | /* $OpenBSD: servconf.c,v 1.186 2008/07/04 03:44:59 djm Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 3 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
| 4 | * All rights reserved | 4 | * All rights reserved |
| @@ -23,7 +23,9 @@ | |||
| 23 | #include <signal.h> | 23 | #include <signal.h> |
| 24 | #include <unistd.h> | 24 | #include <unistd.h> |
| 25 | #include <stdarg.h> | 25 | #include <stdarg.h> |
| 26 | #include <errno.h> | ||
| 26 | 27 | ||
| 28 | #include "openbsd-compat/sys-queue.h" | ||
| 27 | #include "xmalloc.h" | 29 | #include "xmalloc.h" |
| 28 | #include "ssh.h" | 30 | #include "ssh.h" |
| 29 | #include "log.h" | 31 | #include "log.h" |
| @@ -102,6 +104,7 @@ initialize_server_options(ServerOptions *options) | |||
| 102 | options->use_login = -1; | 104 | options->use_login = -1; |
| 103 | options->compression = -1; | 105 | options->compression = -1; |
| 104 | options->allow_tcp_forwarding = -1; | 106 | options->allow_tcp_forwarding = -1; |
| 107 | options->allow_agent_forwarding = -1; | ||
| 105 | options->num_allow_users = 0; | 108 | options->num_allow_users = 0; |
| 106 | options->num_deny_users = 0; | 109 | options->num_deny_users = 0; |
| 107 | options->num_allow_groups = 0; | 110 | options->num_allow_groups = 0; |
| @@ -115,6 +118,7 @@ initialize_server_options(ServerOptions *options) | |||
| 115 | options->max_startups_rate = -1; | 118 | options->max_startups_rate = -1; |
| 116 | options->max_startups = -1; | 119 | options->max_startups = -1; |
| 117 | options->max_authtries = -1; | 120 | options->max_authtries = -1; |
| 121 | options->max_sessions = -1; | ||
| 118 | options->banner = NULL; | 122 | options->banner = NULL; |
| 119 | options->use_dns = -1; | 123 | options->use_dns = -1; |
| 120 | options->client_alive_interval = -1; | 124 | options->client_alive_interval = -1; |
| @@ -125,6 +129,7 @@ initialize_server_options(ServerOptions *options) | |||
| 125 | options->permit_tun = -1; | 129 | options->permit_tun = -1; |
| 126 | options->num_permitted_opens = -1; | 130 | options->num_permitted_opens = -1; |
| 127 | options->adm_forced_command = NULL; | 131 | options->adm_forced_command = NULL; |
| 132 | options->chroot_directory = NULL; | ||
| 128 | } | 133 | } |
| 129 | 134 | ||
| 130 | void | 135 | void |
| @@ -156,7 +161,7 @@ fill_default_server_options(ServerOptions *options) | |||
| 156 | if (options->pid_file == NULL) | 161 | if (options->pid_file == NULL) |
| 157 | options->pid_file = _PATH_SSH_DAEMON_PID_FILE; | 162 | options->pid_file = _PATH_SSH_DAEMON_PID_FILE; |
| 158 | if (options->server_key_bits == -1) | 163 | if (options->server_key_bits == -1) |
| 159 | options->server_key_bits = 768; | 164 | options->server_key_bits = 1024; |
| 160 | if (options->login_grace_time == -1) | 165 | if (options->login_grace_time == -1) |
| 161 | options->login_grace_time = 120; | 166 | options->login_grace_time = 120; |
| 162 | if (options->key_regeneration_time == -1) | 167 | if (options->key_regeneration_time == -1) |
| @@ -231,6 +236,8 @@ fill_default_server_options(ServerOptions *options) | |||
| 231 | options->compression = COMP_DELAYED; | 236 | options->compression = COMP_DELAYED; |
| 232 | if (options->allow_tcp_forwarding == -1) | 237 | if (options->allow_tcp_forwarding == -1) |
| 233 | options->allow_tcp_forwarding = 1; | 238 | options->allow_tcp_forwarding = 1; |
| 239 | if (options->allow_agent_forwarding == -1) | ||
| 240 | options->allow_agent_forwarding = 1; | ||
| 234 | if (options->gateway_ports == -1) | 241 | if (options->gateway_ports == -1) |
| 235 | options->gateway_ports = 0; | 242 | options->gateway_ports = 0; |
| 236 | if (options->max_startups == -1) | 243 | if (options->max_startups == -1) |
| @@ -241,6 +248,8 @@ fill_default_server_options(ServerOptions *options) | |||
| 241 | options->max_startups_begin = options->max_startups; | 248 | options->max_startups_begin = options->max_startups; |
| 242 | if (options->max_authtries == -1) | 249 | if (options->max_authtries == -1) |
| 243 | options->max_authtries = DEFAULT_AUTH_FAIL_MAX; | 250 | options->max_authtries = DEFAULT_AUTH_FAIL_MAX; |
| 251 | if (options->max_sessions == -1) | ||
| 252 | options->max_sessions = DEFAULT_SESSIONS_MAX; | ||
| 244 | if (options->use_dns == -1) | 253 | if (options->use_dns == -1) |
| 245 | options->use_dns = 1; | 254 | options->use_dns = 1; |
| 246 | if (options->client_alive_interval == -1) | 255 | if (options->client_alive_interval == -1) |
| @@ -295,15 +304,15 @@ typedef enum { | |||
| 295 | sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups, | 304 | sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups, |
| 296 | sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile, | 305 | sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile, |
| 297 | sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem, | 306 | sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem, |
| 298 | sMaxStartups, sMaxAuthTries, | 307 | sMaxStartups, sMaxAuthTries, sMaxSessions, |
| 299 | sBanner, sUseDNS, sHostbasedAuthentication, | 308 | sBanner, sUseDNS, sHostbasedAuthentication, |
| 300 | sHostbasedUsesNameFromPacketOnly, sClientAliveInterval, | 309 | sHostbasedUsesNameFromPacketOnly, sClientAliveInterval, |
| 301 | sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2, | 310 | sClientAliveCountMax, sAuthorizedKeysFile, sAuthorizedKeysFile2, |
| 302 | sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor, | 311 | sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor, |
| 303 | sGssKeyEx, | 312 | sGssKeyEx, |
| 304 | sAcceptEnv, sPermitTunnel, | 313 | sAcceptEnv, sPermitTunnel, |
| 305 | sMatch, sPermitOpen, sForceCommand, | 314 | sMatch, sPermitOpen, sForceCommand, sChrootDirectory, |
| 306 | sUsePrivilegeSeparation, | 315 | sUsePrivilegeSeparation, sAllowAgentForwarding, |
| 307 | sDeprecated, sUnsupported | 316 | sDeprecated, sUnsupported |
| 308 | } ServerOpCodes; | 317 | } ServerOpCodes; |
| 309 | 318 | ||
| @@ -332,7 +341,7 @@ static struct { | |||
| 332 | { "serverkeybits", sServerKeyBits, SSHCFG_GLOBAL }, | 341 | { "serverkeybits", sServerKeyBits, SSHCFG_GLOBAL }, |
| 333 | { "logingracetime", sLoginGraceTime, SSHCFG_GLOBAL }, | 342 | { "logingracetime", sLoginGraceTime, SSHCFG_GLOBAL }, |
| 334 | { "keyregenerationinterval", sKeyRegenerationTime, SSHCFG_GLOBAL }, | 343 | { "keyregenerationinterval", sKeyRegenerationTime, SSHCFG_GLOBAL }, |
| 335 | { "permitrootlogin", sPermitRootLogin, SSHCFG_GLOBAL }, | 344 | { "permitrootlogin", sPermitRootLogin, SSHCFG_ALL }, |
| 336 | { "syslogfacility", sLogFacility, SSHCFG_GLOBAL }, | 345 | { "syslogfacility", sLogFacility, SSHCFG_GLOBAL }, |
| 337 | { "loglevel", sLogLevel, SSHCFG_GLOBAL }, | 346 | { "loglevel", sLogLevel, SSHCFG_GLOBAL }, |
| 338 | { "rhostsauthentication", sDeprecated, SSHCFG_GLOBAL }, | 347 | { "rhostsauthentication", sDeprecated, SSHCFG_GLOBAL }, |
| @@ -398,6 +407,7 @@ static struct { | |||
| 398 | { "tcpkeepalive", sTCPKeepAlive, SSHCFG_GLOBAL }, | 407 | { "tcpkeepalive", sTCPKeepAlive, SSHCFG_GLOBAL }, |
| 399 | { "keepalive", sTCPKeepAlive, SSHCFG_GLOBAL }, /* obsolete alias */ | 408 | { "keepalive", sTCPKeepAlive, SSHCFG_GLOBAL }, /* obsolete alias */ |
| 400 | { "allowtcpforwarding", sAllowTcpForwarding, SSHCFG_ALL }, | 409 | { "allowtcpforwarding", sAllowTcpForwarding, SSHCFG_ALL }, |
| 410 | { "allowagentforwarding", sAllowAgentForwarding, SSHCFG_ALL }, | ||
| 401 | { "allowusers", sAllowUsers, SSHCFG_GLOBAL }, | 411 | { "allowusers", sAllowUsers, SSHCFG_GLOBAL }, |
| 402 | { "denyusers", sDenyUsers, SSHCFG_GLOBAL }, | 412 | { "denyusers", sDenyUsers, SSHCFG_GLOBAL }, |
| 403 | { "allowgroups", sAllowGroups, SSHCFG_GLOBAL }, | 413 | { "allowgroups", sAllowGroups, SSHCFG_GLOBAL }, |
| @@ -408,7 +418,8 @@ static struct { | |||
| 408 | { "gatewayports", sGatewayPorts, SSHCFG_ALL }, | 418 | { "gatewayports", sGatewayPorts, SSHCFG_ALL }, |
| 409 | { "subsystem", sSubsystem, SSHCFG_GLOBAL }, | 419 | { "subsystem", sSubsystem, SSHCFG_GLOBAL }, |
| 410 | { "maxstartups", sMaxStartups, SSHCFG_GLOBAL }, | 420 | { "maxstartups", sMaxStartups, SSHCFG_GLOBAL }, |
| 411 | { "maxauthtries", sMaxAuthTries, SSHCFG_GLOBAL }, | 421 | { "maxauthtries", sMaxAuthTries, SSHCFG_ALL }, |
| 422 | { "maxsessions", sMaxSessions, SSHCFG_ALL }, | ||
| 412 | { "banner", sBanner, SSHCFG_ALL }, | 423 | { "banner", sBanner, SSHCFG_ALL }, |
| 413 | { "usedns", sUseDNS, SSHCFG_GLOBAL }, | 424 | { "usedns", sUseDNS, SSHCFG_GLOBAL }, |
| 414 | { "verifyreversemapping", sDeprecated, SSHCFG_GLOBAL }, | 425 | { "verifyreversemapping", sDeprecated, SSHCFG_GLOBAL }, |
| @@ -423,9 +434,21 @@ static struct { | |||
| 423 | { "match", sMatch, SSHCFG_ALL }, | 434 | { "match", sMatch, SSHCFG_ALL }, |
| 424 | { "permitopen", sPermitOpen, SSHCFG_ALL }, | 435 | { "permitopen", sPermitOpen, SSHCFG_ALL }, |
| 425 | { "forcecommand", sForceCommand, SSHCFG_ALL }, | 436 | { "forcecommand", sForceCommand, SSHCFG_ALL }, |
| 437 | { "chrootdirectory", sChrootDirectory, SSHCFG_ALL }, | ||
| 426 | { NULL, sBadOption, 0 } | 438 | { NULL, sBadOption, 0 } |
| 427 | }; | 439 | }; |
| 428 | 440 | ||
| 441 | static struct { | ||
| 442 | int val; | ||
| 443 | char *text; | ||
| 444 | } tunmode_desc[] = { | ||
| 445 | { SSH_TUNMODE_NO, "no" }, | ||
| 446 | { SSH_TUNMODE_POINTOPOINT, "point-to-point" }, | ||
| 447 | { SSH_TUNMODE_ETHERNET, "ethernet" }, | ||
| 448 | { SSH_TUNMODE_YES, "yes" }, | ||
| 449 | { -1, NULL } | ||
| 450 | }; | ||
| 451 | |||
| 429 | /* | 452 | /* |
| 430 | * Returns the number of the token pointed to by cp or sBadOption. | 453 | * Returns the number of the token pointed to by cp or sBadOption. |
| 431 | */ | 454 | */ |
| @@ -478,7 +501,7 @@ add_one_listen_addr(ServerOptions *options, char *addr, u_short port) | |||
| 478 | if ((gaierr = getaddrinfo(addr, strport, &hints, &aitop)) != 0) | 501 | if ((gaierr = getaddrinfo(addr, strport, &hints, &aitop)) != 0) |
| 479 | fatal("bad addr or host: %s (%s)", | 502 | fatal("bad addr or host: %s (%s)", |
| 480 | addr ? addr : "<NULL>", | 503 | addr ? addr : "<NULL>", |
| 481 | gai_strerror(gaierr)); | 504 | ssh_gai_strerror(gaierr)); |
| 482 | for (ai = aitop; ai->ai_next; ai = ai->ai_next) | 505 | for (ai = aitop; ai->ai_next; ai = ai->ai_next) |
| 483 | ; | 506 | ; |
| 484 | ai->ai_next = options->listen_addrs; | 507 | ai->ai_next = options->listen_addrs; |
| @@ -522,24 +545,8 @@ static int | |||
| 522 | match_cfg_line_group(const char *grps, int line, const char *user) | 545 | match_cfg_line_group(const char *grps, int line, const char *user) |
| 523 | { | 546 | { |
| 524 | int result = 0; | 547 | int result = 0; |
| 525 | u_int ngrps = 0; | ||
| 526 | char *arg, *p, *cp, *grplist[MAX_MATCH_GROUPS]; | ||
| 527 | struct passwd *pw; | 548 | struct passwd *pw; |
| 528 | 549 | ||
| 529 | /* | ||
| 530 | * Even if we do not have a user yet, we still need to check for | ||
| 531 | * valid syntax. | ||
| 532 | */ | ||
| 533 | arg = cp = xstrdup(grps); | ||
| 534 | while ((p = strsep(&cp, ",")) != NULL && *p != '\0') { | ||
| 535 | if (ngrps >= MAX_MATCH_GROUPS) { | ||
| 536 | error("line %d: too many groups in Match Group", line); | ||
| 537 | result = -1; | ||
| 538 | goto out; | ||
| 539 | } | ||
| 540 | grplist[ngrps++] = p; | ||
| 541 | } | ||
| 542 | |||
| 543 | if (user == NULL) | 550 | if (user == NULL) |
| 544 | goto out; | 551 | goto out; |
| 545 | 552 | ||
| @@ -549,17 +556,16 @@ match_cfg_line_group(const char *grps, int line, const char *user) | |||
| 549 | } else if (ga_init(pw->pw_name, pw->pw_gid) == 0) { | 556 | } else if (ga_init(pw->pw_name, pw->pw_gid) == 0) { |
| 550 | debug("Can't Match group because user %.100s not in any group " | 557 | debug("Can't Match group because user %.100s not in any group " |
| 551 | "at line %d", user, line); | 558 | "at line %d", user, line); |
| 552 | } else if (ga_match(grplist, ngrps) != 1) { | 559 | } else if (ga_match_pattern_list(grps) != 1) { |
| 553 | debug("user %.100s does not match group %.100s at line %d", | 560 | debug("user %.100s does not match group list %.100s at line %d", |
| 554 | user, arg, line); | 561 | user, grps, line); |
| 555 | } else { | 562 | } else { |
| 556 | debug("user %.100s matched group %.100s at line %d", user, | 563 | debug("user %.100s matched group list %.100s at line %d", user, |
| 557 | arg, line); | 564 | grps, line); |
| 558 | result = 1; | 565 | result = 1; |
| 559 | } | 566 | } |
| 560 | out: | 567 | out: |
| 561 | ga_free(); | 568 | ga_free(); |
| 562 | xfree(arg); | ||
| 563 | return result; | 569 | return result; |
| 564 | } | 570 | } |
| 565 | 571 | ||
| @@ -612,15 +618,18 @@ match_cfg_line(char **condition, int line, const char *user, const char *host, | |||
| 612 | debug("connection from %.100s matched 'Host " | 618 | debug("connection from %.100s matched 'Host " |
| 613 | "%.100s' at line %d", host, arg, line); | 619 | "%.100s' at line %d", host, arg, line); |
| 614 | } else if (strcasecmp(attrib, "address") == 0) { | 620 | } else if (strcasecmp(attrib, "address") == 0) { |
| 615 | if (!address) { | 621 | switch (addr_match_list(address, arg)) { |
| 616 | result = 0; | 622 | case 1: |
| 617 | continue; | ||
| 618 | } | ||
| 619 | if (match_hostname(address, arg, len) != 1) | ||
| 620 | result = 0; | ||
| 621 | else | ||
| 622 | debug("connection from %.100s matched 'Address " | 623 | debug("connection from %.100s matched 'Address " |
| 623 | "%.100s' at line %d", address, arg, line); | 624 | "%.100s' at line %d", address, arg, line); |
| 625 | break; | ||
| 626 | case 0: | ||
| 627 | case -1: | ||
| 628 | result = 0; | ||
| 629 | break; | ||
| 630 | case -2: | ||
| 631 | return -1; | ||
| 632 | } | ||
| 624 | } else { | 633 | } else { |
| 625 | error("Unsupported Match attribute %s", attrib); | 634 | error("Unsupported Match attribute %s", attrib); |
| 626 | return -1; | 635 | return -1; |
| @@ -641,6 +650,8 @@ process_server_config_line(ServerOptions *options, char *line, | |||
| 641 | { | 650 | { |
| 642 | char *cp, **charptr, *arg, *p; | 651 | char *cp, **charptr, *arg, *p; |
| 643 | int cmdline = 0, *intptr, value, n; | 652 | int cmdline = 0, *intptr, value, n; |
| 653 | SyslogFacility *log_facility_ptr; | ||
| 654 | LogLevel *log_level_ptr; | ||
| 644 | ServerOpCodes opcode; | 655 | ServerOpCodes opcode; |
| 645 | u_short port; | 656 | u_short port; |
| 646 | u_int i, flags = 0; | 657 | u_int i, flags = 0; |
| @@ -706,7 +717,7 @@ process_server_config_line(ServerOptions *options, char *line, | |||
| 706 | 717 | ||
| 707 | case sServerKeyBits: | 718 | case sServerKeyBits: |
| 708 | intptr = &options->server_key_bits; | 719 | intptr = &options->server_key_bits; |
| 709 | parse_int: | 720 | parse_int: |
| 710 | arg = strdelim(&cp); | 721 | arg = strdelim(&cp); |
| 711 | if (!arg || *arg == '\0') | 722 | if (!arg || *arg == '\0') |
| 712 | fatal("%s line %d: missing integer value.", | 723 | fatal("%s line %d: missing integer value.", |
| @@ -718,7 +729,7 @@ parse_int: | |||
| 718 | 729 | ||
| 719 | case sLoginGraceTime: | 730 | case sLoginGraceTime: |
| 720 | intptr = &options->login_grace_time; | 731 | intptr = &options->login_grace_time; |
| 721 | parse_time: | 732 | parse_time: |
| 722 | arg = strdelim(&cp); | 733 | arg = strdelim(&cp); |
| 723 | if (!arg || *arg == '\0') | 734 | if (!arg || *arg == '\0') |
| 724 | fatal("%s line %d: missing time value.", | 735 | fatal("%s line %d: missing time value.", |
| @@ -787,7 +798,7 @@ parse_time: | |||
| 787 | fatal("%s line %d: too many host keys specified (max %d).", | 798 | fatal("%s line %d: too many host keys specified (max %d).", |
| 788 | filename, linenum, MAX_HOSTKEYS); | 799 | filename, linenum, MAX_HOSTKEYS); |
| 789 | charptr = &options->host_key_files[*intptr]; | 800 | charptr = &options->host_key_files[*intptr]; |
| 790 | parse_filename: | 801 | parse_filename: |
| 791 | arg = strdelim(&cp); | 802 | arg = strdelim(&cp); |
| 792 | if (!arg || *arg == '\0') | 803 | if (!arg || *arg == '\0') |
| 793 | fatal("%s line %d: missing file name.", | 804 | fatal("%s line %d: missing file name.", |
| @@ -824,13 +835,13 @@ parse_filename: | |||
| 824 | fatal("%s line %d: Bad yes/" | 835 | fatal("%s line %d: Bad yes/" |
| 825 | "without-password/forced-commands-only/no " | 836 | "without-password/forced-commands-only/no " |
| 826 | "argument: %s", filename, linenum, arg); | 837 | "argument: %s", filename, linenum, arg); |
| 827 | if (*intptr == -1) | 838 | if (*activep && *intptr == -1) |
| 828 | *intptr = value; | 839 | *intptr = value; |
| 829 | break; | 840 | break; |
| 830 | 841 | ||
| 831 | case sIgnoreRhosts: | 842 | case sIgnoreRhosts: |
| 832 | intptr = &options->ignore_rhosts; | 843 | intptr = &options->ignore_rhosts; |
| 833 | parse_flag: | 844 | parse_flag: |
| 834 | arg = strdelim(&cp); | 845 | arg = strdelim(&cp); |
| 835 | if (!arg || *arg == '\0') | 846 | if (!arg || *arg == '\0') |
| 836 | fatal("%s line %d: missing yes/no argument.", | 847 | fatal("%s line %d: missing yes/no argument.", |
| @@ -1008,31 +1019,35 @@ parse_flag: | |||
| 1008 | goto parse_flag; | 1019 | goto parse_flag; |
| 1009 | 1020 | ||
| 1010 | case sLogFacility: | 1021 | case sLogFacility: |
| 1011 | intptr = (int *) &options->log_facility; | 1022 | log_facility_ptr = &options->log_facility; |
| 1012 | arg = strdelim(&cp); | 1023 | arg = strdelim(&cp); |
| 1013 | value = log_facility_number(arg); | 1024 | value = log_facility_number(arg); |
| 1014 | if (value == SYSLOG_FACILITY_NOT_SET) | 1025 | if (value == SYSLOG_FACILITY_NOT_SET) |
| 1015 | fatal("%.200s line %d: unsupported log facility '%s'", | 1026 | fatal("%.200s line %d: unsupported log facility '%s'", |
| 1016 | filename, linenum, arg ? arg : "<NONE>"); | 1027 | filename, linenum, arg ? arg : "<NONE>"); |
| 1017 | if (*intptr == -1) | 1028 | if (*log_facility_ptr == -1) |
| 1018 | *intptr = (SyslogFacility) value; | 1029 | *log_facility_ptr = (SyslogFacility) value; |
| 1019 | break; | 1030 | break; |
| 1020 | 1031 | ||
| 1021 | case sLogLevel: | 1032 | case sLogLevel: |
| 1022 | intptr = (int *) &options->log_level; | 1033 | log_level_ptr = &options->log_level; |
| 1023 | arg = strdelim(&cp); | 1034 | arg = strdelim(&cp); |
| 1024 | value = log_level_number(arg); | 1035 | value = log_level_number(arg); |
| 1025 | if (value == SYSLOG_LEVEL_NOT_SET) | 1036 | if (value == SYSLOG_LEVEL_NOT_SET) |
| 1026 | fatal("%.200s line %d: unsupported log level '%s'", | 1037 | fatal("%.200s line %d: unsupported log level '%s'", |
| 1027 | filename, linenum, arg ? arg : "<NONE>"); | 1038 | filename, linenum, arg ? arg : "<NONE>"); |
| 1028 | if (*intptr == -1) | 1039 | if (*log_level_ptr == -1) |
| 1029 | *intptr = (LogLevel) value; | 1040 | *log_level_ptr = (LogLevel) value; |
| 1030 | break; | 1041 | break; |
| 1031 | 1042 | ||
| 1032 | case sAllowTcpForwarding: | 1043 | case sAllowTcpForwarding: |
| 1033 | intptr = &options->allow_tcp_forwarding; | 1044 | intptr = &options->allow_tcp_forwarding; |
| 1034 | goto parse_flag; | 1045 | goto parse_flag; |
| 1035 | 1046 | ||
| 1047 | case sAllowAgentForwarding: | ||
| 1048 | intptr = &options->allow_agent_forwarding; | ||
| 1049 | goto parse_flag; | ||
| 1050 | |||
| 1036 | case sUsePrivilegeSeparation: | 1051 | case sUsePrivilegeSeparation: |
| 1037 | intptr = &use_privsep; | 1052 | intptr = &use_privsep; |
| 1038 | goto parse_flag; | 1053 | goto parse_flag; |
| @@ -1174,9 +1189,14 @@ parse_flag: | |||
| 1174 | intptr = &options->max_authtries; | 1189 | intptr = &options->max_authtries; |
| 1175 | goto parse_int; | 1190 | goto parse_int; |
| 1176 | 1191 | ||
| 1192 | case sMaxSessions: | ||
| 1193 | intptr = &options->max_sessions; | ||
| 1194 | goto parse_int; | ||
| 1195 | |||
| 1177 | case sBanner: | 1196 | case sBanner: |
| 1178 | charptr = &options->banner; | 1197 | charptr = &options->banner; |
| 1179 | goto parse_filename; | 1198 | goto parse_filename; |
| 1199 | |||
| 1180 | /* | 1200 | /* |
| 1181 | * These options can contain %X options expanded at | 1201 | * These options can contain %X options expanded at |
| 1182 | * connect time, so that you can specify paths like: | 1202 | * connect time, so that you can specify paths like: |
| @@ -1219,16 +1239,13 @@ parse_flag: | |||
| 1219 | if (!arg || *arg == '\0') | 1239 | if (!arg || *arg == '\0') |
| 1220 | fatal("%s line %d: Missing yes/point-to-point/" | 1240 | fatal("%s line %d: Missing yes/point-to-point/" |
| 1221 | "ethernet/no argument.", filename, linenum); | 1241 | "ethernet/no argument.", filename, linenum); |
| 1222 | value = 0; /* silence compiler */ | 1242 | value = -1; |
| 1223 | if (strcasecmp(arg, "ethernet") == 0) | 1243 | for (i = 0; tunmode_desc[i].val != -1; i++) |
| 1224 | value = SSH_TUNMODE_ETHERNET; | 1244 | if (strcmp(tunmode_desc[i].text, arg) == 0) { |
| 1225 | else if (strcasecmp(arg, "point-to-point") == 0) | 1245 | value = tunmode_desc[i].val; |
| 1226 | value = SSH_TUNMODE_POINTOPOINT; | 1246 | break; |
| 1227 | else if (strcasecmp(arg, "yes") == 0) | 1247 | } |
| 1228 | value = SSH_TUNMODE_YES; | 1248 | if (value == -1) |
| 1229 | else if (strcasecmp(arg, "no") == 0) | ||
| 1230 | value = SSH_TUNMODE_NO; | ||
| 1231 | else | ||
| 1232 | fatal("%s line %d: Bad yes/point-to-point/ethernet/" | 1249 | fatal("%s line %d: Bad yes/point-to-point/ethernet/" |
| 1233 | "no argument: %s", filename, linenum, arg); | 1250 | "no argument: %s", filename, linenum, arg); |
| 1234 | if (*intptr == -1) | 1251 | if (*intptr == -1) |
| @@ -1285,6 +1302,17 @@ parse_flag: | |||
| 1285 | options->adm_forced_command = xstrdup(cp + len); | 1302 | options->adm_forced_command = xstrdup(cp + len); |
| 1286 | return 0; | 1303 | return 0; |
| 1287 | 1304 | ||
| 1305 | case sChrootDirectory: | ||
| 1306 | charptr = &options->chroot_directory; | ||
| 1307 | |||
| 1308 | arg = strdelim(&cp); | ||
| 1309 | if (!arg || *arg == '\0') | ||
| 1310 | fatal("%s line %d: missing file name.", | ||
| 1311 | filename, linenum); | ||
| 1312 | if (*activep && *charptr == NULL) | ||
| 1313 | *charptr = xstrdup(arg); | ||
| 1314 | break; | ||
| 1315 | |||
| 1288 | case sDeprecated: | 1316 | case sDeprecated: |
| 1289 | logit("%s line %d: Deprecated option %s", | 1317 | logit("%s line %d: Deprecated option %s", |
| 1290 | filename, linenum, arg); | 1318 | filename, linenum, arg); |
| @@ -1381,17 +1409,22 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth) | |||
| 1381 | M_CP_INTOPT(kerberos_authentication); | 1409 | M_CP_INTOPT(kerberos_authentication); |
| 1382 | M_CP_INTOPT(hostbased_authentication); | 1410 | M_CP_INTOPT(hostbased_authentication); |
| 1383 | M_CP_INTOPT(kbd_interactive_authentication); | 1411 | M_CP_INTOPT(kbd_interactive_authentication); |
| 1412 | M_CP_INTOPT(permit_root_login); | ||
| 1384 | 1413 | ||
| 1385 | M_CP_INTOPT(allow_tcp_forwarding); | 1414 | M_CP_INTOPT(allow_tcp_forwarding); |
| 1415 | M_CP_INTOPT(allow_agent_forwarding); | ||
| 1386 | M_CP_INTOPT(gateway_ports); | 1416 | M_CP_INTOPT(gateway_ports); |
| 1387 | M_CP_INTOPT(x11_display_offset); | 1417 | M_CP_INTOPT(x11_display_offset); |
| 1388 | M_CP_INTOPT(x11_forwarding); | 1418 | M_CP_INTOPT(x11_forwarding); |
| 1389 | M_CP_INTOPT(x11_use_localhost); | 1419 | M_CP_INTOPT(x11_use_localhost); |
| 1420 | M_CP_INTOPT(max_sessions); | ||
| 1421 | M_CP_INTOPT(max_authtries); | ||
| 1390 | 1422 | ||
| 1391 | M_CP_STROPT(banner); | 1423 | M_CP_STROPT(banner); |
| 1392 | if (preauth) | 1424 | if (preauth) |
| 1393 | return; | 1425 | return; |
| 1394 | M_CP_STROPT(adm_forced_command); | 1426 | M_CP_STROPT(adm_forced_command); |
| 1427 | M_CP_STROPT(chroot_directory); | ||
| 1395 | } | 1428 | } |
| 1396 | 1429 | ||
| 1397 | #undef M_CP_INTOPT | 1430 | #undef M_CP_INTOPT |
| @@ -1419,3 +1452,213 @@ parse_server_config(ServerOptions *options, const char *filename, Buffer *conf, | |||
| 1419 | fatal("%s: terminating, %d bad configuration options", | 1452 | fatal("%s: terminating, %d bad configuration options", |
| 1420 | filename, bad_options); | 1453 | filename, bad_options); |
| 1421 | } | 1454 | } |
| 1455 | |||
| 1456 | static const char * | ||
| 1457 | fmt_intarg(ServerOpCodes code, int val) | ||
| 1458 | { | ||
| 1459 | if (code == sAddressFamily) { | ||
| 1460 | switch (val) { | ||
| 1461 | case AF_INET: | ||
| 1462 | return "inet"; | ||
| 1463 | case AF_INET6: | ||
| 1464 | return "inet6"; | ||
| 1465 | case AF_UNSPEC: | ||
| 1466 | return "any"; | ||
| 1467 | default: | ||
| 1468 | return "UNKNOWN"; | ||
| 1469 | } | ||
| 1470 | } | ||
| 1471 | if (code == sPermitRootLogin) { | ||
| 1472 | switch (val) { | ||
| 1473 | case PERMIT_NO_PASSWD: | ||
| 1474 | return "without-passord"; | ||
| 1475 | case PERMIT_FORCED_ONLY: | ||
| 1476 | return "forced-commands-only"; | ||
| 1477 | case PERMIT_YES: | ||
| 1478 | return "yes"; | ||
| 1479 | } | ||
| 1480 | } | ||
| 1481 | if (code == sProtocol) { | ||
| 1482 | switch (val) { | ||
| 1483 | case SSH_PROTO_1: | ||
| 1484 | return "1"; | ||
| 1485 | case SSH_PROTO_2: | ||
| 1486 | return "2"; | ||
| 1487 | case (SSH_PROTO_1|SSH_PROTO_2): | ||
| 1488 | return "2,1"; | ||
| 1489 | default: | ||
| 1490 | return "UNKNOWN"; | ||
| 1491 | } | ||
| 1492 | } | ||
| 1493 | if (code == sGatewayPorts && val == 2) | ||
| 1494 | return "clientspecified"; | ||
| 1495 | if (code == sCompression && val == COMP_DELAYED) | ||
| 1496 | return "delayed"; | ||
| 1497 | switch (val) { | ||
| 1498 | case -1: | ||
| 1499 | return "unset"; | ||
| 1500 | case 0: | ||
| 1501 | return "no"; | ||
| 1502 | case 1: | ||
| 1503 | return "yes"; | ||
| 1504 | } | ||
| 1505 | return "UNKNOWN"; | ||
| 1506 | } | ||
| 1507 | |||
| 1508 | static const char * | ||
| 1509 | lookup_opcode_name(ServerOpCodes code) | ||
| 1510 | { | ||
| 1511 | u_int i; | ||
| 1512 | |||
| 1513 | for (i = 0; keywords[i].name != NULL; i++) | ||
| 1514 | if (keywords[i].opcode == code) | ||
| 1515 | return(keywords[i].name); | ||
| 1516 | return "UNKNOWN"; | ||
| 1517 | } | ||
| 1518 | |||
| 1519 | static void | ||
| 1520 | dump_cfg_int(ServerOpCodes code, int val) | ||
| 1521 | { | ||
| 1522 | printf("%s %d\n", lookup_opcode_name(code), val); | ||
| 1523 | } | ||
| 1524 | |||
| 1525 | static void | ||
| 1526 | dump_cfg_fmtint(ServerOpCodes code, int val) | ||
| 1527 | { | ||
| 1528 | printf("%s %s\n", lookup_opcode_name(code), fmt_intarg(code, val)); | ||
| 1529 | } | ||
| 1530 | |||
| 1531 | static void | ||
| 1532 | dump_cfg_string(ServerOpCodes code, const char *val) | ||
| 1533 | { | ||
| 1534 | if (val == NULL) | ||
| 1535 | return; | ||
| 1536 | printf("%s %s\n", lookup_opcode_name(code), val); | ||
| 1537 | } | ||
| 1538 | |||
| 1539 | static void | ||
| 1540 | dump_cfg_strarray(ServerOpCodes code, u_int count, char **vals) | ||
| 1541 | { | ||
| 1542 | u_int i; | ||
| 1543 | |||
| 1544 | for (i = 0; i < count; i++) | ||
| 1545 | printf("%s %s\n", lookup_opcode_name(code), vals[i]); | ||
| 1546 | } | ||
| 1547 | |||
| 1548 | void | ||
| 1549 | dump_config(ServerOptions *o) | ||
| 1550 | { | ||
| 1551 | u_int i; | ||
| 1552 | int ret; | ||
| 1553 | struct addrinfo *ai; | ||
| 1554 | char addr[NI_MAXHOST], port[NI_MAXSERV], *s = NULL; | ||
| 1555 | |||
| 1556 | /* these are usually at the top of the config */ | ||
| 1557 | for (i = 0; i < o->num_ports; i++) | ||
| 1558 | printf("port %d\n", o->ports[i]); | ||
| 1559 | dump_cfg_fmtint(sProtocol, o->protocol); | ||
| 1560 | dump_cfg_fmtint(sAddressFamily, o->address_family); | ||
| 1561 | |||
| 1562 | /* ListenAddress must be after Port */ | ||
| 1563 | for (ai = o->listen_addrs; ai; ai = ai->ai_next) { | ||
| 1564 | if ((ret = getnameinfo(ai->ai_addr, ai->ai_addrlen, addr, | ||
| 1565 | sizeof(addr), port, sizeof(port), | ||
| 1566 | NI_NUMERICHOST|NI_NUMERICSERV)) != 0) { | ||
| 1567 | error("getnameinfo failed: %.100s", | ||
| 1568 | (ret != EAI_SYSTEM) ? gai_strerror(ret) : | ||
| 1569 | strerror(errno)); | ||
| 1570 | } else { | ||
| 1571 | if (ai->ai_family == AF_INET6) | ||
| 1572 | printf("listenaddress [%s]:%s\n", addr, port); | ||
| 1573 | else | ||
| 1574 | printf("listenaddress %s:%s\n", addr, port); | ||
| 1575 | } | ||
| 1576 | } | ||
| 1577 | |||
| 1578 | /* integer arguments */ | ||
| 1579 | dump_cfg_int(sServerKeyBits, o->server_key_bits); | ||
| 1580 | dump_cfg_int(sLoginGraceTime, o->login_grace_time); | ||
| 1581 | dump_cfg_int(sKeyRegenerationTime, o->key_regeneration_time); | ||
| 1582 | dump_cfg_int(sX11DisplayOffset, o->x11_display_offset); | ||
| 1583 | dump_cfg_int(sMaxAuthTries, o->max_authtries); | ||
| 1584 | dump_cfg_int(sClientAliveInterval, o->client_alive_interval); | ||
| 1585 | dump_cfg_int(sClientAliveCountMax, o->client_alive_count_max); | ||
| 1586 | |||
| 1587 | /* formatted integer arguments */ | ||
| 1588 | dump_cfg_fmtint(sPermitRootLogin, o->permit_root_login); | ||
| 1589 | dump_cfg_fmtint(sIgnoreRhosts, o->ignore_rhosts); | ||
| 1590 | dump_cfg_fmtint(sIgnoreUserKnownHosts, o->ignore_user_known_hosts); | ||
| 1591 | dump_cfg_fmtint(sRhostsRSAAuthentication, o->rhosts_rsa_authentication); | ||
| 1592 | dump_cfg_fmtint(sHostbasedAuthentication, o->hostbased_authentication); | ||
| 1593 | dump_cfg_fmtint(sHostbasedUsesNameFromPacketOnly, | ||
| 1594 | o->hostbased_uses_name_from_packet_only); | ||
| 1595 | dump_cfg_fmtint(sRSAAuthentication, o->rsa_authentication); | ||
| 1596 | dump_cfg_fmtint(sPubkeyAuthentication, o->pubkey_authentication); | ||
| 1597 | dump_cfg_fmtint(sKerberosAuthentication, o->kerberos_authentication); | ||
| 1598 | dump_cfg_fmtint(sKerberosOrLocalPasswd, o->kerberos_or_local_passwd); | ||
| 1599 | dump_cfg_fmtint(sKerberosTicketCleanup, o->kerberos_ticket_cleanup); | ||
| 1600 | dump_cfg_fmtint(sKerberosGetAFSToken, o->kerberos_get_afs_token); | ||
| 1601 | dump_cfg_fmtint(sGssAuthentication, o->gss_authentication); | ||
| 1602 | dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds); | ||
| 1603 | dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication); | ||
| 1604 | dump_cfg_fmtint(sKbdInteractiveAuthentication, | ||
| 1605 | o->kbd_interactive_authentication); | ||
| 1606 | dump_cfg_fmtint(sChallengeResponseAuthentication, | ||
| 1607 | o->challenge_response_authentication); | ||
| 1608 | dump_cfg_fmtint(sPrintMotd, o->print_motd); | ||
| 1609 | dump_cfg_fmtint(sPrintLastLog, o->print_lastlog); | ||
| 1610 | dump_cfg_fmtint(sX11Forwarding, o->x11_forwarding); | ||
| 1611 | dump_cfg_fmtint(sX11UseLocalhost, o->x11_use_localhost); | ||
| 1612 | dump_cfg_fmtint(sStrictModes, o->strict_modes); | ||
| 1613 | dump_cfg_fmtint(sTCPKeepAlive, o->tcp_keep_alive); | ||
| 1614 | dump_cfg_fmtint(sEmptyPasswd, o->permit_empty_passwd); | ||
| 1615 | dump_cfg_fmtint(sPermitUserEnvironment, o->permit_user_env); | ||
| 1616 | dump_cfg_fmtint(sUseLogin, o->use_login); | ||
| 1617 | dump_cfg_fmtint(sCompression, o->compression); | ||
| 1618 | dump_cfg_fmtint(sGatewayPorts, o->gateway_ports); | ||
| 1619 | dump_cfg_fmtint(sUseDNS, o->use_dns); | ||
| 1620 | dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding); | ||
| 1621 | dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep); | ||
| 1622 | |||
| 1623 | /* string arguments */ | ||
| 1624 | dump_cfg_string(sPidFile, o->pid_file); | ||
| 1625 | dump_cfg_string(sXAuthLocation, o->xauth_location); | ||
| 1626 | dump_cfg_string(sCiphers, o->ciphers); | ||
| 1627 | dump_cfg_string(sMacs, o->macs); | ||
| 1628 | dump_cfg_string(sBanner, o->banner); | ||
| 1629 | dump_cfg_string(sAuthorizedKeysFile, o->authorized_keys_file); | ||
| 1630 | dump_cfg_string(sAuthorizedKeysFile2, o->authorized_keys_file2); | ||
| 1631 | dump_cfg_string(sForceCommand, o->adm_forced_command); | ||
| 1632 | |||
| 1633 | /* string arguments requiring a lookup */ | ||
| 1634 | dump_cfg_string(sLogLevel, log_level_name(o->log_level)); | ||
| 1635 | dump_cfg_string(sLogFacility, log_facility_name(o->log_facility)); | ||
| 1636 | |||
| 1637 | /* string array arguments */ | ||
| 1638 | dump_cfg_strarray(sHostKeyFile, o->num_host_key_files, | ||
| 1639 | o->host_key_files); | ||
| 1640 | dump_cfg_strarray(sAllowUsers, o->num_allow_users, o->allow_users); | ||
| 1641 | dump_cfg_strarray(sDenyUsers, o->num_deny_users, o->deny_users); | ||
| 1642 | dump_cfg_strarray(sAllowGroups, o->num_allow_groups, o->allow_groups); | ||
| 1643 | dump_cfg_strarray(sDenyGroups, o->num_deny_groups, o->deny_groups); | ||
| 1644 | dump_cfg_strarray(sAcceptEnv, o->num_accept_env, o->accept_env); | ||
| 1645 | |||
| 1646 | /* other arguments */ | ||
| 1647 | for (i = 0; i < o->num_subsystems; i++) | ||
| 1648 | printf("subsystem %s %s\n", o->subsystem_name[i], | ||
| 1649 | o->subsystem_args[i]); | ||
| 1650 | |||
| 1651 | printf("maxstartups %d:%d:%d\n", o->max_startups_begin, | ||
| 1652 | o->max_startups_rate, o->max_startups); | ||
| 1653 | |||
| 1654 | for (i = 0; tunmode_desc[i].val != -1; i++) | ||
| 1655 | if (tunmode_desc[i].val == o->permit_tun) { | ||
| 1656 | s = tunmode_desc[i].text; | ||
| 1657 | break; | ||
| 1658 | } | ||
| 1659 | dump_cfg_string(sPermitTunnel, s); | ||
| 1660 | |||
| 1661 | printf("permitopen"); | ||
| 1662 | channel_print_adm_permitted_opens(); | ||
| 1663 | printf("\n"); | ||
| 1664 | } | ||
diff --git a/servconf.h b/servconf.h index be42e9f60..cb91b7629 100644 --- a/servconf.h +++ b/servconf.h | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: servconf.h,v 1.80 2007/02/19 10:45:58 dtucker Exp $ */ | 1 | /* $OpenBSD: servconf.h,v 1.85 2008/06/10 04:50:25 dtucker Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| @@ -35,6 +35,10 @@ | |||
| 35 | #define PERMIT_YES 3 | 35 | #define PERMIT_YES 3 |
| 36 | 36 | ||
| 37 | #define DEFAULT_AUTH_FAIL_MAX 6 /* Default for MaxAuthTries */ | 37 | #define DEFAULT_AUTH_FAIL_MAX 6 /* Default for MaxAuthTries */ |
| 38 | #define DEFAULT_SESSIONS_MAX 10 /* Default for MaxSessions */ | ||
| 39 | |||
| 40 | /* Magic name for internal sftp-server */ | ||
| 41 | #define INTERNAL_SFTP_NAME "internal-sftp" | ||
| 38 | 42 | ||
| 39 | typedef struct { | 43 | typedef struct { |
| 40 | u_int num_ports; | 44 | u_int num_ports; |
| @@ -101,6 +105,7 @@ typedef struct { | |||
| 101 | int use_login; /* If true, login(1) is used */ | 105 | int use_login; /* If true, login(1) is used */ |
| 102 | int compression; /* If true, compression is allowed */ | 106 | int compression; /* If true, compression is allowed */ |
| 103 | int allow_tcp_forwarding; | 107 | int allow_tcp_forwarding; |
| 108 | int allow_agent_forwarding; | ||
| 104 | u_int num_allow_users; | 109 | u_int num_allow_users; |
| 105 | char *allow_users[MAX_ALLOW_USERS]; | 110 | char *allow_users[MAX_ALLOW_USERS]; |
| 106 | u_int num_deny_users; | 111 | u_int num_deny_users; |
| @@ -122,6 +127,7 @@ typedef struct { | |||
| 122 | int max_startups_rate; | 127 | int max_startups_rate; |
| 123 | int max_startups; | 128 | int max_startups; |
| 124 | int max_authtries; | 129 | int max_authtries; |
| 130 | int max_sessions; | ||
| 125 | char *banner; /* SSH-2 banner message */ | 131 | char *banner; /* SSH-2 banner message */ |
| 126 | int use_dns; | 132 | int use_dns; |
| 127 | int client_alive_interval; /* | 133 | int client_alive_interval; /* |
| @@ -144,6 +150,8 @@ typedef struct { | |||
| 144 | int permit_tun; | 150 | int permit_tun; |
| 145 | 151 | ||
| 146 | int num_permitted_opens; | 152 | int num_permitted_opens; |
| 153 | |||
| 154 | char *chroot_directory; | ||
| 147 | } ServerOptions; | 155 | } ServerOptions; |
| 148 | 156 | ||
| 149 | void initialize_server_options(ServerOptions *); | 157 | void initialize_server_options(ServerOptions *); |
| @@ -156,5 +164,6 @@ void parse_server_config(ServerOptions *, const char *, Buffer *, | |||
| 156 | void parse_server_match_config(ServerOptions *, const char *, const char *, | 164 | void parse_server_match_config(ServerOptions *, const char *, const char *, |
| 157 | const char *); | 165 | const char *); |
| 158 | void copy_set_server_options(ServerOptions *, ServerOptions *, int); | 166 | void copy_set_server_options(ServerOptions *, ServerOptions *, int); |
| 167 | void dump_config(ServerOptions *); | ||
| 159 | 168 | ||
| 160 | #endif /* SERVCONF_H */ | 169 | #endif /* SERVCONF_H */ |
diff --git a/serverloop.c b/serverloop.c index 29ffcfee1..6a3e2af10 100644 --- a/serverloop.c +++ b/serverloop.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: serverloop.c,v 1.145 2006/10/11 12:38:03 markus Exp $ */ | 1 | /* $OpenBSD: serverloop.c,v 1.153 2008/06/30 12:15:39 djm Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
| @@ -56,6 +56,7 @@ | |||
| 56 | #include <unistd.h> | 56 | #include <unistd.h> |
| 57 | #include <stdarg.h> | 57 | #include <stdarg.h> |
| 58 | 58 | ||
| 59 | #include "openbsd-compat/sys-queue.h" | ||
| 59 | #include "xmalloc.h" | 60 | #include "xmalloc.h" |
| 60 | #include "packet.h" | 61 | #include "packet.h" |
| 61 | #include "buffer.h" | 62 | #include "buffer.h" |
| @@ -104,7 +105,7 @@ static int connection_in; /* Connection to client (input). */ | |||
| 104 | static int connection_out; /* Connection to client (output). */ | 105 | static int connection_out; /* Connection to client (output). */ |
| 105 | static int connection_closed = 0; /* Connection to client closed. */ | 106 | static int connection_closed = 0; /* Connection to client closed. */ |
| 106 | static u_int buffer_high; /* "Soft" max buffer size. */ | 107 | static u_int buffer_high; /* "Soft" max buffer size. */ |
| 107 | static int client_alive_timeouts = 0; | 108 | static int no_more_sessions = 0; /* Disallow further sessions. */ |
| 108 | 109 | ||
| 109 | /* | 110 | /* |
| 110 | * This SIGCHLD kludge is used to detect when the child exits. The server | 111 | * This SIGCHLD kludge is used to detect when the child exits. The server |
| @@ -248,7 +249,7 @@ client_alive_check(void) | |||
| 248 | int channel_id; | 249 | int channel_id; |
| 249 | 250 | ||
| 250 | /* timeout, check to see how many we have had */ | 251 | /* timeout, check to see how many we have had */ |
| 251 | if (++client_alive_timeouts > options.client_alive_count_max) { | 252 | if (++keep_alive_timeouts > options.client_alive_count_max) { |
| 252 | logit("Timeout, client not responding."); | 253 | logit("Timeout, client not responding."); |
| 253 | cleanup_exit(255); | 254 | cleanup_exit(255); |
| 254 | } | 255 | } |
| @@ -399,7 +400,8 @@ process_input(fd_set *readset) | |||
| 399 | return; | 400 | return; |
| 400 | cleanup_exit(255); | 401 | cleanup_exit(255); |
| 401 | } else if (len < 0) { | 402 | } else if (len < 0) { |
| 402 | if (errno != EINTR && errno != EAGAIN) { | 403 | if (errno != EINTR && errno != EAGAIN && |
| 404 | errno != EWOULDBLOCK) { | ||
| 403 | verbose("Read error from remote host " | 405 | verbose("Read error from remote host " |
| 404 | "%.100s: %.100s", | 406 | "%.100s: %.100s", |
| 405 | get_remote_ipaddr(), strerror(errno)); | 407 | get_remote_ipaddr(), strerror(errno)); |
| @@ -417,8 +419,8 @@ process_input(fd_set *readset) | |||
| 417 | if (!fdout_eof && FD_ISSET(fdout, readset)) { | 419 | if (!fdout_eof && FD_ISSET(fdout, readset)) { |
| 418 | errno = 0; | 420 | errno = 0; |
| 419 | len = read(fdout, buf, sizeof(buf)); | 421 | len = read(fdout, buf, sizeof(buf)); |
| 420 | if (len < 0 && (errno == EINTR || | 422 | if (len < 0 && (errno == EINTR || ((errno == EAGAIN || |
| 421 | (errno == EAGAIN && !child_terminated))) { | 423 | errno == EWOULDBLOCK) && !child_terminated))) { |
| 422 | /* do nothing */ | 424 | /* do nothing */ |
| 423 | #ifndef PTY_ZEROREAD | 425 | #ifndef PTY_ZEROREAD |
| 424 | } else if (len <= 0) { | 426 | } else if (len <= 0) { |
| @@ -436,8 +438,8 @@ process_input(fd_set *readset) | |||
| 436 | if (!fderr_eof && FD_ISSET(fderr, readset)) { | 438 | if (!fderr_eof && FD_ISSET(fderr, readset)) { |
| 437 | errno = 0; | 439 | errno = 0; |
| 438 | len = read(fderr, buf, sizeof(buf)); | 440 | len = read(fderr, buf, sizeof(buf)); |
| 439 | if (len < 0 && (errno == EINTR || | 441 | if (len < 0 && (errno == EINTR || ((errno == EAGAIN || |
| 440 | (errno == EAGAIN && !child_terminated))) { | 442 | errno == EWOULDBLOCK) && !child_terminated))) { |
| 441 | /* do nothing */ | 443 | /* do nothing */ |
| 442 | #ifndef PTY_ZEROREAD | 444 | #ifndef PTY_ZEROREAD |
| 443 | } else if (len <= 0) { | 445 | } else if (len <= 0) { |
| @@ -468,7 +470,8 @@ process_output(fd_set *writeset) | |||
| 468 | data = buffer_ptr(&stdin_buffer); | 470 | data = buffer_ptr(&stdin_buffer); |
| 469 | dlen = buffer_len(&stdin_buffer); | 471 | dlen = buffer_len(&stdin_buffer); |
| 470 | len = write(fdin, data, dlen); | 472 | len = write(fdin, data, dlen); |
| 471 | if (len < 0 && (errno == EINTR || errno == EAGAIN)) { | 473 | if (len < 0 && |
| 474 | (errno == EINTR || errno == EAGAIN || errno == EWOULDBLOCK)) { | ||
| 472 | /* do nothing */ | 475 | /* do nothing */ |
| 473 | } else if (len <= 0) { | 476 | } else if (len <= 0) { |
| 474 | if (fdin != fdout) | 477 | if (fdin != fdout) |
| @@ -887,7 +890,7 @@ server_input_keep_alive(int type, u_int32_t seq, void *ctxt) | |||
| 887 | * even if this was generated by something other than | 890 | * even if this was generated by something other than |
| 888 | * the bogus CHANNEL_REQUEST we send for keepalives. | 891 | * the bogus CHANNEL_REQUEST we send for keepalives. |
| 889 | */ | 892 | */ |
| 890 | client_alive_timeouts = 0; | 893 | keep_alive_timeouts = 0; |
| 891 | } | 894 | } |
| 892 | 895 | ||
| 893 | static void | 896 | static void |
| @@ -938,7 +941,6 @@ static Channel * | |||
| 938 | server_request_direct_tcpip(void) | 941 | server_request_direct_tcpip(void) |
| 939 | { | 942 | { |
| 940 | Channel *c; | 943 | Channel *c; |
| 941 | int sock; | ||
| 942 | char *target, *originator; | 944 | char *target, *originator; |
| 943 | int target_port, originator_port; | 945 | int target_port, originator_port; |
| 944 | 946 | ||
| @@ -948,18 +950,16 @@ server_request_direct_tcpip(void) | |||
| 948 | originator_port = packet_get_int(); | 950 | originator_port = packet_get_int(); |
| 949 | packet_check_eom(); | 951 | packet_check_eom(); |
| 950 | 952 | ||
| 951 | debug("server_request_direct_tcpip: originator %s port %d, target %s port %d", | 953 | debug("server_request_direct_tcpip: originator %s port %d, target %s " |
| 952 | originator, originator_port, target, target_port); | 954 | "port %d", originator, originator_port, target, target_port); |
| 953 | 955 | ||
| 954 | /* XXX check permission */ | 956 | /* XXX check permission */ |
| 955 | sock = channel_connect_to(target, target_port); | 957 | c = channel_connect_to(target, target_port, |
| 956 | xfree(target); | 958 | "direct-tcpip", "direct-tcpip"); |
| 959 | |||
| 957 | xfree(originator); | 960 | xfree(originator); |
| 958 | if (sock < 0) | 961 | xfree(target); |
| 959 | return NULL; | 962 | |
| 960 | c = channel_new("direct-tcpip", SSH_CHANNEL_CONNECTING, | ||
| 961 | sock, sock, -1, CHAN_TCP_WINDOW_DEFAULT, | ||
| 962 | CHAN_TCP_PACKET_DEFAULT, 0, "direct-tcpip", 1); | ||
| 963 | return c; | 963 | return c; |
| 964 | } | 964 | } |
| 965 | 965 | ||
| @@ -1000,7 +1000,7 @@ server_request_tun(void) | |||
| 1000 | #if defined(SSH_TUN_FILTER) | 1000 | #if defined(SSH_TUN_FILTER) |
| 1001 | if (mode == SSH_TUNMODE_POINTOPOINT) | 1001 | if (mode == SSH_TUNMODE_POINTOPOINT) |
| 1002 | channel_register_filter(c->self, sys_tun_infilter, | 1002 | channel_register_filter(c->self, sys_tun_infilter, |
| 1003 | sys_tun_outfilter); | 1003 | sys_tun_outfilter, NULL, NULL); |
| 1004 | #endif | 1004 | #endif |
| 1005 | 1005 | ||
| 1006 | done: | 1006 | done: |
| @@ -1016,6 +1016,12 @@ server_request_session(void) | |||
| 1016 | 1016 | ||
| 1017 | debug("input_session_request"); | 1017 | debug("input_session_request"); |
| 1018 | packet_check_eom(); | 1018 | packet_check_eom(); |
| 1019 | |||
| 1020 | if (no_more_sessions) { | ||
| 1021 | packet_disconnect("Possible attack: attempt to open a session " | ||
| 1022 | "after additional sessions disabled"); | ||
| 1023 | } | ||
| 1024 | |||
| 1019 | /* | 1025 | /* |
| 1020 | * A server session has no fd to read or write until a | 1026 | * A server session has no fd to read or write until a |
| 1021 | * CHANNEL_REQUEST for a shell is made, so we set the type to | 1027 | * CHANNEL_REQUEST for a shell is made, so we set the type to |
| @@ -1136,6 +1142,9 @@ server_input_global_request(int type, u_int32_t seq, void *ctxt) | |||
| 1136 | success = channel_cancel_rport_listener(cancel_address, | 1142 | success = channel_cancel_rport_listener(cancel_address, |
| 1137 | cancel_port); | 1143 | cancel_port); |
| 1138 | xfree(cancel_address); | 1144 | xfree(cancel_address); |
| 1145 | } else if (strcmp(rtype, "no-more-sessions@openssh.com") == 0) { | ||
| 1146 | no_more_sessions = 1; | ||
| 1147 | success = 1; | ||
| 1139 | } | 1148 | } |
| 1140 | if (want_reply) { | 1149 | if (want_reply) { |
| 1141 | packet_start(success ? | 1150 | packet_start(success ? |
| @@ -1163,7 +1172,11 @@ server_input_channel_req(int type, u_int32_t seq, void *ctxt) | |||
| 1163 | if ((c = channel_lookup(id)) == NULL) | 1172 | if ((c = channel_lookup(id)) == NULL) |
| 1164 | packet_disconnect("server_input_channel_req: " | 1173 | packet_disconnect("server_input_channel_req: " |
| 1165 | "unknown channel %d", id); | 1174 | "unknown channel %d", id); |
| 1166 | if (c->type == SSH_CHANNEL_LARVAL || c->type == SSH_CHANNEL_OPEN) | 1175 | if (!strcmp(rtype, "eow@openssh.com")) { |
| 1176 | packet_check_eom(); | ||
| 1177 | chan_rcvd_eow(c); | ||
| 1178 | } else if ((c->type == SSH_CHANNEL_LARVAL || | ||
| 1179 | c->type == SSH_CHANNEL_OPEN) && strcmp(c->ctype, "session") == 0) | ||
| 1167 | success = session_input_channel_req(c, rtype); | 1180 | success = session_input_channel_req(c, rtype); |
| 1168 | if (reply) { | 1181 | if (reply) { |
| 1169 | packet_start(success ? | 1182 | packet_start(success ? |
| @@ -1189,8 +1202,9 @@ server_init_dispatch_20(void) | |||
| 1189 | dispatch_set(SSH2_MSG_CHANNEL_REQUEST, &server_input_channel_req); | 1202 | dispatch_set(SSH2_MSG_CHANNEL_REQUEST, &server_input_channel_req); |
| 1190 | dispatch_set(SSH2_MSG_CHANNEL_WINDOW_ADJUST, &channel_input_window_adjust); | 1203 | dispatch_set(SSH2_MSG_CHANNEL_WINDOW_ADJUST, &channel_input_window_adjust); |
| 1191 | dispatch_set(SSH2_MSG_GLOBAL_REQUEST, &server_input_global_request); | 1204 | dispatch_set(SSH2_MSG_GLOBAL_REQUEST, &server_input_global_request); |
| 1205 | dispatch_set(SSH2_MSG_CHANNEL_SUCCESS, &channel_input_status_confirm); | ||
| 1206 | dispatch_set(SSH2_MSG_CHANNEL_FAILURE, &channel_input_status_confirm); | ||
| 1192 | /* client_alive */ | 1207 | /* client_alive */ |
| 1193 | dispatch_set(SSH2_MSG_CHANNEL_FAILURE, &server_input_keep_alive); | ||
| 1194 | dispatch_set(SSH2_MSG_REQUEST_SUCCESS, &server_input_keep_alive); | 1208 | dispatch_set(SSH2_MSG_REQUEST_SUCCESS, &server_input_keep_alive); |
| 1195 | dispatch_set(SSH2_MSG_REQUEST_FAILURE, &server_input_keep_alive); | 1209 | dispatch_set(SSH2_MSG_REQUEST_FAILURE, &server_input_keep_alive); |
| 1196 | /* rekeying */ | 1210 | /* rekeying */ |
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: session.c,v 1.221 2007/01/21 01:41:54 stevesk Exp $ */ | 1 | /* $OpenBSD: session.c,v 1.241 2008/06/16 13:22:53 dtucker Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 3 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
| 4 | * All rights reserved | 4 | * All rights reserved |
| @@ -59,6 +59,7 @@ | |||
| 59 | #include <string.h> | 59 | #include <string.h> |
| 60 | #include <unistd.h> | 60 | #include <unistd.h> |
| 61 | 61 | ||
| 62 | #include "openbsd-compat/sys-queue.h" | ||
| 62 | #include "xmalloc.h" | 63 | #include "xmalloc.h" |
| 63 | #include "ssh.h" | 64 | #include "ssh.h" |
| 64 | #include "ssh1.h" | 65 | #include "ssh1.h" |
| @@ -84,9 +85,11 @@ | |||
| 84 | #include "sshlogin.h" | 85 | #include "sshlogin.h" |
| 85 | #include "serverloop.h" | 86 | #include "serverloop.h" |
| 86 | #include "canohost.h" | 87 | #include "canohost.h" |
| 88 | #include "misc.h" | ||
| 87 | #include "session.h" | 89 | #include "session.h" |
| 88 | #include "kex.h" | 90 | #include "kex.h" |
| 89 | #include "monitor_wrap.h" | 91 | #include "monitor_wrap.h" |
| 92 | #include "sftp.h" | ||
| 90 | 93 | ||
| 91 | #if defined(KRB5) && defined(USE_AFS) | 94 | #if defined(KRB5) && defined(USE_AFS) |
| 92 | #include <kafs.h> | 95 | #include <kafs.h> |
| @@ -95,13 +98,13 @@ | |||
| 95 | /* func */ | 98 | /* func */ |
| 96 | 99 | ||
| 97 | Session *session_new(void); | 100 | Session *session_new(void); |
| 98 | void session_set_fds(Session *, int, int, int); | 101 | void session_set_fds(Session *, int, int, int, int); |
| 99 | void session_pty_cleanup(Session *); | 102 | void session_pty_cleanup(Session *); |
| 100 | void session_proctitle(Session *); | 103 | void session_proctitle(Session *); |
| 101 | int session_setup_x11fwd(Session *); | 104 | int session_setup_x11fwd(Session *); |
| 102 | void do_exec_pty(Session *, const char *); | 105 | int do_exec_pty(Session *, const char *); |
| 103 | void do_exec_no_pty(Session *, const char *); | 106 | int do_exec_no_pty(Session *, const char *); |
| 104 | void do_exec(Session *, const char *); | 107 | int do_exec(Session *, const char *); |
| 105 | void do_login(Session *, const char *); | 108 | void do_login(Session *, const char *); |
| 106 | #ifdef LOGIN_NEEDS_UTMPX | 109 | #ifdef LOGIN_NEEDS_UTMPX |
| 107 | static void do_pre_login(Session *s); | 110 | static void do_pre_login(Session *s); |
| @@ -129,8 +132,13 @@ extern Buffer loginmsg; | |||
| 129 | const char *original_command = NULL; | 132 | const char *original_command = NULL; |
| 130 | 133 | ||
| 131 | /* data */ | 134 | /* data */ |
| 132 | #define MAX_SESSIONS 64 | 135 | static int sessions_first_unused = -1; |
| 133 | Session sessions[MAX_SESSIONS]; | 136 | static int sessions_nalloc = 0; |
| 137 | static Session *sessions = NULL; | ||
| 138 | |||
| 139 | #define SUBSYSTEM_NONE 0 | ||
| 140 | #define SUBSYSTEM_EXT 1 | ||
| 141 | #define SUBSYSTEM_INT_SFTP 2 | ||
| 134 | 142 | ||
| 135 | #ifdef HAVE_LOGIN_CAP | 143 | #ifdef HAVE_LOGIN_CAP |
| 136 | login_cap_t *lc; | 144 | login_cap_t *lc; |
| @@ -160,7 +168,7 @@ static int | |||
| 160 | auth_input_request_forwarding(struct passwd * pw) | 168 | auth_input_request_forwarding(struct passwd * pw) |
| 161 | { | 169 | { |
| 162 | Channel *nc; | 170 | Channel *nc; |
| 163 | int sock; | 171 | int sock = -1; |
| 164 | struct sockaddr_un sunaddr; | 172 | struct sockaddr_un sunaddr; |
| 165 | 173 | ||
| 166 | if (auth_sock_name != NULL) { | 174 | if (auth_sock_name != NULL) { |
| @@ -172,43 +180,48 @@ auth_input_request_forwarding(struct passwd * pw) | |||
| 172 | temporarily_use_uid(pw); | 180 | temporarily_use_uid(pw); |
| 173 | 181 | ||
| 174 | /* Allocate a buffer for the socket name, and format the name. */ | 182 | /* Allocate a buffer for the socket name, and format the name. */ |
| 175 | auth_sock_name = xmalloc(MAXPATHLEN); | 183 | auth_sock_dir = xstrdup("/tmp/ssh-XXXXXXXXXX"); |
| 176 | auth_sock_dir = xmalloc(MAXPATHLEN); | ||
| 177 | strlcpy(auth_sock_dir, "/tmp/ssh-XXXXXXXXXX", MAXPATHLEN); | ||
| 178 | 184 | ||
| 179 | /* Create private directory for socket */ | 185 | /* Create private directory for socket */ |
| 180 | if (mkdtemp(auth_sock_dir) == NULL) { | 186 | if (mkdtemp(auth_sock_dir) == NULL) { |
| 181 | packet_send_debug("Agent forwarding disabled: " | 187 | packet_send_debug("Agent forwarding disabled: " |
| 182 | "mkdtemp() failed: %.100s", strerror(errno)); | 188 | "mkdtemp() failed: %.100s", strerror(errno)); |
| 183 | restore_uid(); | 189 | restore_uid(); |
| 184 | xfree(auth_sock_name); | ||
| 185 | xfree(auth_sock_dir); | 190 | xfree(auth_sock_dir); |
| 186 | auth_sock_name = NULL; | ||
| 187 | auth_sock_dir = NULL; | 191 | auth_sock_dir = NULL; |
| 188 | return 0; | 192 | goto authsock_err; |
| 189 | } | 193 | } |
| 190 | snprintf(auth_sock_name, MAXPATHLEN, "%s/agent.%ld", | 194 | |
| 191 | auth_sock_dir, (long) getpid()); | 195 | xasprintf(&auth_sock_name, "%s/agent.%ld", |
| 196 | auth_sock_dir, (long) getpid()); | ||
| 192 | 197 | ||
| 193 | /* Create the socket. */ | 198 | /* Create the socket. */ |
| 194 | sock = socket(AF_UNIX, SOCK_STREAM, 0); | 199 | sock = socket(AF_UNIX, SOCK_STREAM, 0); |
| 195 | if (sock < 0) | 200 | if (sock < 0) { |
| 196 | packet_disconnect("socket: %.100s", strerror(errno)); | 201 | error("socket: %.100s", strerror(errno)); |
| 202 | restore_uid(); | ||
| 203 | goto authsock_err; | ||
| 204 | } | ||
| 197 | 205 | ||
| 198 | /* Bind it to the name. */ | 206 | /* Bind it to the name. */ |
| 199 | memset(&sunaddr, 0, sizeof(sunaddr)); | 207 | memset(&sunaddr, 0, sizeof(sunaddr)); |
| 200 | sunaddr.sun_family = AF_UNIX; | 208 | sunaddr.sun_family = AF_UNIX; |
| 201 | strlcpy(sunaddr.sun_path, auth_sock_name, sizeof(sunaddr.sun_path)); | 209 | strlcpy(sunaddr.sun_path, auth_sock_name, sizeof(sunaddr.sun_path)); |
| 202 | 210 | ||
| 203 | if (bind(sock, (struct sockaddr *)&sunaddr, sizeof(sunaddr)) < 0) | 211 | if (bind(sock, (struct sockaddr *)&sunaddr, sizeof(sunaddr)) < 0) { |
| 204 | packet_disconnect("bind: %.100s", strerror(errno)); | 212 | error("bind: %.100s", strerror(errno)); |
| 213 | restore_uid(); | ||
| 214 | goto authsock_err; | ||
| 215 | } | ||
| 205 | 216 | ||
| 206 | /* Restore the privileged uid. */ | 217 | /* Restore the privileged uid. */ |
| 207 | restore_uid(); | 218 | restore_uid(); |
| 208 | 219 | ||
| 209 | /* Start listening on the socket. */ | 220 | /* Start listening on the socket. */ |
| 210 | if (listen(sock, SSH_LISTEN_BACKLOG) < 0) | 221 | if (listen(sock, SSH_LISTEN_BACKLOG) < 0) { |
| 211 | packet_disconnect("listen: %.100s", strerror(errno)); | 222 | error("listen: %.100s", strerror(errno)); |
| 223 | goto authsock_err; | ||
| 224 | } | ||
| 212 | 225 | ||
| 213 | /* Allocate a channel for the authentication agent socket. */ | 226 | /* Allocate a channel for the authentication agent socket. */ |
| 214 | nc = channel_new("auth socket", | 227 | nc = channel_new("auth socket", |
| @@ -217,6 +230,19 @@ auth_input_request_forwarding(struct passwd * pw) | |||
| 217 | 0, "auth socket", 1); | 230 | 0, "auth socket", 1); |
| 218 | strlcpy(nc->path, auth_sock_name, sizeof(nc->path)); | 231 | strlcpy(nc->path, auth_sock_name, sizeof(nc->path)); |
| 219 | return 1; | 232 | return 1; |
| 233 | |||
| 234 | authsock_err: | ||
| 235 | if (auth_sock_name != NULL) | ||
| 236 | xfree(auth_sock_name); | ||
| 237 | if (auth_sock_dir != NULL) { | ||
| 238 | rmdir(auth_sock_dir); | ||
| 239 | xfree(auth_sock_dir); | ||
| 240 | } | ||
| 241 | if (sock != -1) | ||
| 242 | close(sock); | ||
| 243 | auth_sock_name = NULL; | ||
| 244 | auth_sock_dir = NULL; | ||
| 245 | return 0; | ||
| 220 | } | 246 | } |
| 221 | 247 | ||
| 222 | static void | 248 | static void |
| @@ -329,7 +355,8 @@ do_authenticated1(Authctxt *authctxt) | |||
| 329 | break; | 355 | break; |
| 330 | 356 | ||
| 331 | case SSH_CMSG_AGENT_REQUEST_FORWARDING: | 357 | case SSH_CMSG_AGENT_REQUEST_FORWARDING: |
| 332 | if (no_agent_forwarding_flag || compat13) { | 358 | if (!options.allow_agent_forwarding || |
| 359 | no_agent_forwarding_flag || compat13) { | ||
| 333 | debug("Authentication agent forwarding not permitted for this authentication."); | 360 | debug("Authentication agent forwarding not permitted for this authentication."); |
| 334 | break; | 361 | break; |
| 335 | } | 362 | } |
| @@ -365,10 +392,14 @@ do_authenticated1(Authctxt *authctxt) | |||
| 365 | if (type == SSH_CMSG_EXEC_CMD) { | 392 | if (type == SSH_CMSG_EXEC_CMD) { |
| 366 | command = packet_get_string(&dlen); | 393 | command = packet_get_string(&dlen); |
| 367 | debug("Exec command '%.500s'", command); | 394 | debug("Exec command '%.500s'", command); |
| 368 | do_exec(s, command); | 395 | if (do_exec(s, command) != 0) |
| 396 | packet_disconnect( | ||
| 397 | "command execution failed"); | ||
| 369 | xfree(command); | 398 | xfree(command); |
| 370 | } else { | 399 | } else { |
| 371 | do_exec(s, NULL); | 400 | if (do_exec(s, NULL) != 0) |
| 401 | packet_disconnect( | ||
| 402 | "shell execution failed"); | ||
| 372 | } | 403 | } |
| 373 | packet_check_eom(); | 404 | packet_check_eom(); |
| 374 | session_close(s); | 405 | session_close(s); |
| @@ -393,46 +424,84 @@ do_authenticated1(Authctxt *authctxt) | |||
| 393 | } | 424 | } |
| 394 | } | 425 | } |
| 395 | 426 | ||
| 427 | #define USE_PIPES | ||
| 396 | /* | 428 | /* |
| 397 | * This is called to fork and execute a command when we have no tty. This | 429 | * This is called to fork and execute a command when we have no tty. This |
| 398 | * will call do_child from the child, and server_loop from the parent after | 430 | * will call do_child from the child, and server_loop from the parent after |
| 399 | * setting up file descriptors and such. | 431 | * setting up file descriptors and such. |
| 400 | */ | 432 | */ |
| 401 | void | 433 | int |
| 402 | do_exec_no_pty(Session *s, const char *command) | 434 | do_exec_no_pty(Session *s, const char *command) |
| 403 | { | 435 | { |
| 404 | pid_t pid; | 436 | pid_t pid; |
| 405 | 437 | ||
| 406 | #ifdef USE_PIPES | 438 | #ifdef USE_PIPES |
| 407 | int pin[2], pout[2], perr[2]; | 439 | int pin[2], pout[2], perr[2]; |
| 440 | |||
| 408 | /* Allocate pipes for communicating with the program. */ | 441 | /* Allocate pipes for communicating with the program. */ |
| 409 | if (pipe(pin) < 0 || pipe(pout) < 0 || pipe(perr) < 0) | 442 | if (pipe(pin) < 0) { |
| 410 | packet_disconnect("Could not create pipes: %.100s", | 443 | error("%s: pipe in: %.100s", __func__, strerror(errno)); |
| 411 | strerror(errno)); | 444 | return -1; |
| 412 | #else /* USE_PIPES */ | 445 | } |
| 446 | if (pipe(pout) < 0) { | ||
| 447 | error("%s: pipe out: %.100s", __func__, strerror(errno)); | ||
| 448 | close(pin[0]); | ||
| 449 | close(pin[1]); | ||
| 450 | return -1; | ||
| 451 | } | ||
| 452 | if (pipe(perr) < 0) { | ||
| 453 | error("%s: pipe err: %.100s", __func__, strerror(errno)); | ||
| 454 | close(pin[0]); | ||
| 455 | close(pin[1]); | ||
| 456 | close(pout[0]); | ||
| 457 | close(pout[1]); | ||
| 458 | return -1; | ||
| 459 | } | ||
| 460 | #else | ||
| 413 | int inout[2], err[2]; | 461 | int inout[2], err[2]; |
| 462 | |||
| 414 | /* Uses socket pairs to communicate with the program. */ | 463 | /* Uses socket pairs to communicate with the program. */ |
| 415 | if (socketpair(AF_UNIX, SOCK_STREAM, 0, inout) < 0 || | 464 | if (socketpair(AF_UNIX, SOCK_STREAM, 0, inout) < 0) { |
| 416 | socketpair(AF_UNIX, SOCK_STREAM, 0, err) < 0) | 465 | error("%s: socketpair #1: %.100s", __func__, strerror(errno)); |
| 417 | packet_disconnect("Could not create socket pairs: %.100s", | 466 | return -1; |
| 418 | strerror(errno)); | 467 | } |
| 419 | #endif /* USE_PIPES */ | 468 | if (socketpair(AF_UNIX, SOCK_STREAM, 0, err) < 0) { |
| 469 | error("%s: socketpair #2: %.100s", __func__, strerror(errno)); | ||
| 470 | close(inout[0]); | ||
| 471 | close(inout[1]); | ||
| 472 | return -1; | ||
| 473 | } | ||
| 474 | #endif | ||
| 475 | |||
| 420 | if (s == NULL) | 476 | if (s == NULL) |
| 421 | fatal("do_exec_no_pty: no session"); | 477 | fatal("do_exec_no_pty: no session"); |
| 422 | 478 | ||
| 423 | session_proctitle(s); | 479 | session_proctitle(s); |
| 424 | 480 | ||
| 425 | #if defined(USE_PAM) | ||
| 426 | if (options.use_pam && !use_privsep) | ||
| 427 | do_pam_setcred(1); | ||
| 428 | #endif /* USE_PAM */ | ||
| 429 | |||
| 430 | /* Fork the child. */ | 481 | /* Fork the child. */ |
| 431 | if ((pid = fork()) == 0) { | 482 | switch ((pid = fork())) { |
| 483 | case -1: | ||
| 484 | error("%s: fork: %.100s", __func__, strerror(errno)); | ||
| 485 | #ifdef USE_PIPES | ||
| 486 | close(pin[0]); | ||
| 487 | close(pin[1]); | ||
| 488 | close(pout[0]); | ||
| 489 | close(pout[1]); | ||
| 490 | close(perr[0]); | ||
| 491 | close(perr[1]); | ||
| 492 | #else | ||
| 493 | close(inout[0]); | ||
| 494 | close(inout[1]); | ||
| 495 | close(err[0]); | ||
| 496 | close(err[1]); | ||
| 497 | #endif | ||
| 498 | return -1; | ||
| 499 | case 0: | ||
| 432 | is_child = 1; | 500 | is_child = 1; |
| 433 | 501 | ||
| 434 | /* Child. Reinitialize the log since the pid has changed. */ | 502 | /* Child. Reinitialize the log since the pid has changed. */ |
| 435 | log_init(__progname, options.log_level, options.log_facility, log_stderr); | 503 | log_init(__progname, options.log_level, |
| 504 | options.log_facility, log_stderr); | ||
| 436 | 505 | ||
| 437 | /* | 506 | /* |
| 438 | * Create a new session and process group since the 4.4BSD | 507 | * Create a new session and process group since the 4.4BSD |
| @@ -462,7 +531,7 @@ do_exec_no_pty(Session *s, const char *command) | |||
| 462 | if (dup2(perr[1], 2) < 0) | 531 | if (dup2(perr[1], 2) < 0) |
| 463 | perror("dup2 stderr"); | 532 | perror("dup2 stderr"); |
| 464 | close(perr[1]); | 533 | close(perr[1]); |
| 465 | #else /* USE_PIPES */ | 534 | #else |
| 466 | /* | 535 | /* |
| 467 | * Redirect stdin, stdout, and stderr. Stdin and stdout will | 536 | * Redirect stdin, stdout, and stderr. Stdin and stdout will |
| 468 | * use the same socket, as some programs (particularly rdist) | 537 | * use the same socket, as some programs (particularly rdist) |
| @@ -472,11 +541,14 @@ do_exec_no_pty(Session *s, const char *command) | |||
| 472 | close(err[1]); | 541 | close(err[1]); |
| 473 | if (dup2(inout[0], 0) < 0) /* stdin */ | 542 | if (dup2(inout[0], 0) < 0) /* stdin */ |
| 474 | perror("dup2 stdin"); | 543 | perror("dup2 stdin"); |
| 475 | if (dup2(inout[0], 1) < 0) /* stdout. Note: same socket as stdin. */ | 544 | if (dup2(inout[0], 1) < 0) /* stdout (same as stdin) */ |
| 476 | perror("dup2 stdout"); | 545 | perror("dup2 stdout"); |
| 546 | close(inout[0]); | ||
| 477 | if (dup2(err[0], 2) < 0) /* stderr */ | 547 | if (dup2(err[0], 2) < 0) /* stderr */ |
| 478 | perror("dup2 stderr"); | 548 | perror("dup2 stderr"); |
| 479 | #endif /* USE_PIPES */ | 549 | close(err[0]); |
| 550 | #endif | ||
| 551 | |||
| 480 | 552 | ||
| 481 | #ifdef _UNICOS | 553 | #ifdef _UNICOS |
| 482 | cray_init_job(s->pw); /* set up cray jid and tmpdir */ | 554 | cray_init_job(s->pw); /* set up cray jid and tmpdir */ |
| @@ -485,7 +557,10 @@ do_exec_no_pty(Session *s, const char *command) | |||
| 485 | /* Do processing for the child (exec command etc). */ | 557 | /* Do processing for the child (exec command etc). */ |
| 486 | do_child(s, command); | 558 | do_child(s, command); |
| 487 | /* NOTREACHED */ | 559 | /* NOTREACHED */ |
| 560 | default: | ||
| 561 | break; | ||
| 488 | } | 562 | } |
| 563 | |||
| 489 | #ifdef _UNICOS | 564 | #ifdef _UNICOS |
| 490 | signal(WJSIGNAL, cray_job_termination_handler); | 565 | signal(WJSIGNAL, cray_job_termination_handler); |
| 491 | #endif /* _UNICOS */ | 566 | #endif /* _UNICOS */ |
| @@ -493,11 +568,18 @@ do_exec_no_pty(Session *s, const char *command) | |||
| 493 | if (is_winnt) | 568 | if (is_winnt) |
| 494 | cygwin_set_impersonation_token(INVALID_HANDLE_VALUE); | 569 | cygwin_set_impersonation_token(INVALID_HANDLE_VALUE); |
| 495 | #endif | 570 | #endif |
| 496 | if (pid < 0) | 571 | |
| 497 | packet_disconnect("fork failed: %.100s", strerror(errno)); | ||
| 498 | s->pid = pid; | 572 | s->pid = pid; |
| 499 | /* Set interactive/non-interactive mode. */ | 573 | /* Set interactive/non-interactive mode. */ |
| 500 | packet_set_interactive(s->display != NULL); | 574 | packet_set_interactive(s->display != NULL); |
| 575 | |||
| 576 | /* | ||
| 577 | * Clear loginmsg, since it's the child's responsibility to display | ||
| 578 | * it to the user, otherwise multiple sessions may accumulate | ||
| 579 | * multiple copies of the login messages. | ||
| 580 | */ | ||
| 581 | buffer_clear(&loginmsg); | ||
| 582 | |||
| 501 | #ifdef USE_PIPES | 583 | #ifdef USE_PIPES |
| 502 | /* We are the parent. Close the child sides of the pipes. */ | 584 | /* We are the parent. Close the child sides of the pipes. */ |
| 503 | close(pin[0]); | 585 | close(pin[0]); |
| @@ -509,35 +591,32 @@ do_exec_no_pty(Session *s, const char *command) | |||
| 509 | close(perr[0]); | 591 | close(perr[0]); |
| 510 | perr[0] = -1; | 592 | perr[0] = -1; |
| 511 | } | 593 | } |
| 512 | session_set_fds(s, pin[1], pout[0], perr[0]); | 594 | session_set_fds(s, pin[1], pout[0], perr[0], 0); |
| 513 | } else { | 595 | } else { |
| 514 | /* Enter the interactive session. */ | 596 | /* Enter the interactive session. */ |
| 515 | server_loop(pid, pin[1], pout[0], perr[0]); | 597 | server_loop(pid, pin[1], pout[0], perr[0]); |
| 516 | /* server_loop has closed pin[1], pout[0], and perr[0]. */ | 598 | /* server_loop has closed pin[1], pout[0], and perr[0]. */ |
| 517 | } | 599 | } |
| 518 | #else /* USE_PIPES */ | 600 | #else |
| 519 | /* We are the parent. Close the child sides of the socket pairs. */ | 601 | /* We are the parent. Close the child sides of the socket pairs. */ |
| 520 | close(inout[0]); | 602 | close(inout[0]); |
| 521 | close(err[0]); | 603 | close(err[0]); |
| 522 | 604 | ||
| 523 | /* | 605 | /* |
| 524 | * Clear loginmsg, since it's the child's responsibility to display | ||
| 525 | * it to the user, otherwise multiple sessions may accumulate | ||
| 526 | * multiple copies of the login messages. | ||
| 527 | */ | ||
| 528 | buffer_clear(&loginmsg); | ||
| 529 | |||
| 530 | /* | ||
| 531 | * Enter the interactive session. Note: server_loop must be able to | 606 | * Enter the interactive session. Note: server_loop must be able to |
| 532 | * handle the case that fdin and fdout are the same. | 607 | * handle the case that fdin and fdout are the same. |
| 533 | */ | 608 | */ |
| 534 | if (compat20) { | 609 | if (compat20) { |
| 535 | session_set_fds(s, inout[1], inout[1], s->is_subsystem ? -1 : err[1]); | 610 | session_set_fds(s, inout[1], inout[1], |
| 611 | s->is_subsystem ? -1 : err[1], 0); | ||
| 612 | if (s->is_subsystem) | ||
| 613 | close(err[1]); | ||
| 536 | } else { | 614 | } else { |
| 537 | server_loop(pid, inout[1], inout[1], err[1]); | 615 | server_loop(pid, inout[1], inout[1], err[1]); |
| 538 | /* server_loop has closed inout[1] and err[1]. */ | 616 | /* server_loop has closed inout[1] and err[1]. */ |
| 539 | } | 617 | } |
| 540 | #endif /* USE_PIPES */ | 618 | #endif |
| 619 | return 0; | ||
| 541 | } | 620 | } |
| 542 | 621 | ||
| 543 | /* | 622 | /* |
| @@ -546,7 +625,7 @@ do_exec_no_pty(Session *s, const char *command) | |||
| 546 | * setting up file descriptors, controlling tty, updating wtmp, utmp, | 625 | * setting up file descriptors, controlling tty, updating wtmp, utmp, |
| 547 | * lastlog, and other such operations. | 626 | * lastlog, and other such operations. |
| 548 | */ | 627 | */ |
| 549 | void | 628 | int |
| 550 | do_exec_pty(Session *s, const char *command) | 629 | do_exec_pty(Session *s, const char *command) |
| 551 | { | 630 | { |
| 552 | int fdout, ptyfd, ttyfd, ptymaster; | 631 | int fdout, ptyfd, ttyfd, ptymaster; |
| @@ -557,20 +636,46 @@ do_exec_pty(Session *s, const char *command) | |||
| 557 | ptyfd = s->ptyfd; | 636 | ptyfd = s->ptyfd; |
| 558 | ttyfd = s->ttyfd; | 637 | ttyfd = s->ttyfd; |
| 559 | 638 | ||
| 560 | #if defined(USE_PAM) | 639 | /* |
| 561 | if (options.use_pam) { | 640 | * Create another descriptor of the pty master side for use as the |
| 562 | do_pam_set_tty(s->tty); | 641 | * standard input. We could use the original descriptor, but this |
| 563 | if (!use_privsep) | 642 | * simplifies code in server_loop. The descriptor is bidirectional. |
| 564 | do_pam_setcred(1); | 643 | * Do this before forking (and cleanup in the child) so as to |
| 644 | * detect and gracefully fail out-of-fd conditions. | ||
| 645 | */ | ||
| 646 | if ((fdout = dup(ptyfd)) < 0) { | ||
| 647 | error("%s: dup #1: %s", __func__, strerror(errno)); | ||
| 648 | close(ttyfd); | ||
| 649 | close(ptyfd); | ||
| 650 | return -1; | ||
| 651 | } | ||
| 652 | /* we keep a reference to the pty master */ | ||
| 653 | if ((ptymaster = dup(ptyfd)) < 0) { | ||
| 654 | error("%s: dup #2: %s", __func__, strerror(errno)); | ||
| 655 | close(ttyfd); | ||
| 656 | close(ptyfd); | ||
| 657 | close(fdout); | ||
| 658 | return -1; | ||
| 565 | } | 659 | } |
| 566 | #endif | ||
| 567 | 660 | ||
| 568 | /* Fork the child. */ | 661 | /* Fork the child. */ |
| 569 | if ((pid = fork()) == 0) { | 662 | switch ((pid = fork())) { |
| 663 | case -1: | ||
| 664 | error("%s: fork: %.100s", __func__, strerror(errno)); | ||
| 665 | close(fdout); | ||
| 666 | close(ptymaster); | ||
| 667 | close(ttyfd); | ||
| 668 | close(ptyfd); | ||
| 669 | return -1; | ||
| 670 | case 0: | ||
| 570 | is_child = 1; | 671 | is_child = 1; |
| 571 | 672 | ||
| 673 | close(fdout); | ||
| 674 | close(ptymaster); | ||
| 675 | |||
| 572 | /* Child. Reinitialize the log because the pid has changed. */ | 676 | /* Child. Reinitialize the log because the pid has changed. */ |
| 573 | log_init(__progname, options.log_level, options.log_facility, log_stderr); | 677 | log_init(__progname, options.log_level, |
| 678 | options.log_facility, log_stderr); | ||
| 574 | /* Close the master side of the pseudo tty. */ | 679 | /* Close the master side of the pseudo tty. */ |
| 575 | close(ptyfd); | 680 | close(ptyfd); |
| 576 | 681 | ||
| @@ -601,11 +706,16 @@ do_exec_pty(Session *s, const char *command) | |||
| 601 | do_pre_login(s); | 706 | do_pre_login(s); |
| 602 | # endif | 707 | # endif |
| 603 | #endif | 708 | #endif |
| 604 | 709 | /* | |
| 605 | /* Do common processing for the child, such as execing the command. */ | 710 | * Do common processing for the child, such as execing |
| 606 | do_child(s, command); | 711 | * the command. |
| 607 | /* NOTREACHED */ | 712 | */ |
| 713 | do_child(s, command); | ||
| 714 | /* NOTREACHED */ | ||
| 715 | default: | ||
| 716 | break; | ||
| 608 | } | 717 | } |
| 718 | |||
| 609 | #ifdef _UNICOS | 719 | #ifdef _UNICOS |
| 610 | signal(WJSIGNAL, cray_job_termination_handler); | 720 | signal(WJSIGNAL, cray_job_termination_handler); |
| 611 | #endif /* _UNICOS */ | 721 | #endif /* _UNICOS */ |
| @@ -613,36 +723,22 @@ do_exec_pty(Session *s, const char *command) | |||
| 613 | if (is_winnt) | 723 | if (is_winnt) |
| 614 | cygwin_set_impersonation_token(INVALID_HANDLE_VALUE); | 724 | cygwin_set_impersonation_token(INVALID_HANDLE_VALUE); |
| 615 | #endif | 725 | #endif |
| 616 | if (pid < 0) | 726 | |
| 617 | packet_disconnect("fork failed: %.100s", strerror(errno)); | ||
| 618 | s->pid = pid; | 727 | s->pid = pid; |
| 619 | 728 | ||
| 620 | /* Parent. Close the slave side of the pseudo tty. */ | 729 | /* Parent. Close the slave side of the pseudo tty. */ |
| 621 | close(ttyfd); | 730 | close(ttyfd); |
| 622 | 731 | ||
| 623 | /* | ||
| 624 | * Create another descriptor of the pty master side for use as the | ||
| 625 | * standard input. We could use the original descriptor, but this | ||
| 626 | * simplifies code in server_loop. The descriptor is bidirectional. | ||
| 627 | */ | ||
| 628 | fdout = dup(ptyfd); | ||
| 629 | if (fdout < 0) | ||
| 630 | packet_disconnect("dup #1 failed: %.100s", strerror(errno)); | ||
| 631 | |||
| 632 | /* we keep a reference to the pty master */ | ||
| 633 | ptymaster = dup(ptyfd); | ||
| 634 | if (ptymaster < 0) | ||
| 635 | packet_disconnect("dup #2 failed: %.100s", strerror(errno)); | ||
| 636 | s->ptymaster = ptymaster; | ||
| 637 | |||
| 638 | /* Enter interactive session. */ | 732 | /* Enter interactive session. */ |
| 733 | s->ptymaster = ptymaster; | ||
| 639 | packet_set_interactive(1); | 734 | packet_set_interactive(1); |
| 640 | if (compat20) { | 735 | if (compat20) { |
| 641 | session_set_fds(s, ptyfd, fdout, -1); | 736 | session_set_fds(s, ptyfd, fdout, -1, 1); |
| 642 | } else { | 737 | } else { |
| 643 | server_loop(pid, ptyfd, fdout, -1); | 738 | server_loop(pid, ptyfd, fdout, -1); |
| 644 | /* server_loop _has_ closed ptyfd and fdout. */ | 739 | /* server_loop _has_ closed ptyfd and fdout. */ |
| 645 | } | 740 | } |
| 741 | return 0; | ||
| 646 | } | 742 | } |
| 647 | 743 | ||
| 648 | #ifdef LOGIN_NEEDS_UTMPX | 744 | #ifdef LOGIN_NEEDS_UTMPX |
| @@ -677,16 +773,26 @@ do_pre_login(Session *s) | |||
| 677 | * This is called to fork and execute a command. If another command is | 773 | * This is called to fork and execute a command. If another command is |
| 678 | * to be forced, execute that instead. | 774 | * to be forced, execute that instead. |
| 679 | */ | 775 | */ |
| 680 | void | 776 | int |
| 681 | do_exec(Session *s, const char *command) | 777 | do_exec(Session *s, const char *command) |
| 682 | { | 778 | { |
| 779 | int ret; | ||
| 780 | |||
| 683 | if (options.adm_forced_command) { | 781 | if (options.adm_forced_command) { |
| 684 | original_command = command; | 782 | original_command = command; |
| 685 | command = options.adm_forced_command; | 783 | command = options.adm_forced_command; |
| 784 | if (strcmp(INTERNAL_SFTP_NAME, command) == 0) | ||
| 785 | s->is_subsystem = SUBSYSTEM_INT_SFTP; | ||
| 786 | else if (s->is_subsystem) | ||
| 787 | s->is_subsystem = SUBSYSTEM_EXT; | ||
| 686 | debug("Forced command (config) '%.900s'", command); | 788 | debug("Forced command (config) '%.900s'", command); |
| 687 | } else if (forced_command) { | 789 | } else if (forced_command) { |
| 688 | original_command = command; | 790 | original_command = command; |
| 689 | command = forced_command; | 791 | command = forced_command; |
| 792 | if (strcmp(INTERNAL_SFTP_NAME, command) == 0) | ||
| 793 | s->is_subsystem = SUBSYSTEM_INT_SFTP; | ||
| 794 | else if (s->is_subsystem) | ||
| 795 | s->is_subsystem = SUBSYSTEM_EXT; | ||
| 690 | debug("Forced command (key option) '%.900s'", command); | 796 | debug("Forced command (key option) '%.900s'", command); |
| 691 | } | 797 | } |
| 692 | 798 | ||
| @@ -701,11 +807,10 @@ do_exec(Session *s, const char *command) | |||
| 701 | PRIVSEP(audit_run_command(shell)); | 807 | PRIVSEP(audit_run_command(shell)); |
| 702 | } | 808 | } |
| 703 | #endif | 809 | #endif |
| 704 | |||
| 705 | if (s->ttyfd != -1) | 810 | if (s->ttyfd != -1) |
| 706 | do_exec_pty(s, command); | 811 | ret = do_exec_pty(s, command); |
| 707 | else | 812 | else |
| 708 | do_exec_no_pty(s, command); | 813 | ret = do_exec_no_pty(s, command); |
| 709 | 814 | ||
| 710 | original_command = NULL; | 815 | original_command = NULL; |
| 711 | 816 | ||
| @@ -715,6 +820,8 @@ do_exec(Session *s, const char *command) | |||
| 715 | * multiple copies of the login messages. | 820 | * multiple copies of the login messages. |
| 716 | */ | 821 | */ |
| 717 | buffer_clear(&loginmsg); | 822 | buffer_clear(&loginmsg); |
| 823 | |||
| 824 | return ret; | ||
| 718 | } | 825 | } |
| 719 | 826 | ||
| 720 | /* administrative, login(1)-like work */ | 827 | /* administrative, login(1)-like work */ |
| @@ -897,8 +1004,9 @@ read_environment_file(char ***env, u_int *envsize, | |||
| 897 | ; | 1004 | ; |
| 898 | if (!*cp || *cp == '#' || *cp == '\n') | 1005 | if (!*cp || *cp == '#' || *cp == '\n') |
| 899 | continue; | 1006 | continue; |
| 900 | if (strchr(cp, '\n')) | 1007 | |
| 901 | *strchr(cp, '\n') = '\0'; | 1008 | cp[strcspn(cp, "\n")] = '\0'; |
| 1009 | |||
| 902 | value = strchr(cp, '='); | 1010 | value = strchr(cp, '='); |
| 903 | if (value == NULL) { | 1011 | if (value == NULL) { |
| 904 | fprintf(stderr, "Bad line %u in %.100s\n", lineno, | 1012 | fprintf(stderr, "Bad line %u in %.100s\n", lineno, |
| @@ -1203,7 +1311,7 @@ do_rc_files(Session *s, const char *shell) | |||
| 1203 | 1311 | ||
| 1204 | /* ignore _PATH_SSH_USER_RC for subsystems and admin forced commands */ | 1312 | /* ignore _PATH_SSH_USER_RC for subsystems and admin forced commands */ |
| 1205 | if (!s->is_subsystem && options.adm_forced_command == NULL && | 1313 | if (!s->is_subsystem && options.adm_forced_command == NULL && |
| 1206 | !no_user_rc && (stat(_PATH_SSH_USER_RC, &st) >= 0)) { | 1314 | !no_user_rc && stat(_PATH_SSH_USER_RC, &st) >= 0) { |
| 1207 | snprintf(cmd, sizeof cmd, "%s -c '%s %s'", | 1315 | snprintf(cmd, sizeof cmd, "%s -c '%s %s'", |
| 1208 | shell, _PATH_BSHELL, _PATH_SSH_USER_RC); | 1316 | shell, _PATH_BSHELL, _PATH_SSH_USER_RC); |
| 1209 | if (debug_flag) | 1317 | if (debug_flag) |
| @@ -1284,10 +1392,72 @@ do_nologin(struct passwd *pw) | |||
| 1284 | } | 1392 | } |
| 1285 | } | 1393 | } |
| 1286 | 1394 | ||
| 1395 | /* | ||
| 1396 | * Chroot into a directory after checking it for safety: all path components | ||
| 1397 | * must be root-owned directories with strict permissions. | ||
| 1398 | */ | ||
| 1399 | static void | ||
| 1400 | safely_chroot(const char *path, uid_t uid) | ||
| 1401 | { | ||
| 1402 | const char *cp; | ||
| 1403 | char component[MAXPATHLEN]; | ||
| 1404 | struct stat st; | ||
| 1405 | |||
| 1406 | if (*path != '/') | ||
| 1407 | fatal("chroot path does not begin at root"); | ||
| 1408 | if (strlen(path) >= sizeof(component)) | ||
| 1409 | fatal("chroot path too long"); | ||
| 1410 | |||
| 1411 | /* | ||
| 1412 | * Descend the path, checking that each component is a | ||
| 1413 | * root-owned directory with strict permissions. | ||
| 1414 | */ | ||
| 1415 | for (cp = path; cp != NULL;) { | ||
| 1416 | if ((cp = strchr(cp, '/')) == NULL) | ||
| 1417 | strlcpy(component, path, sizeof(component)); | ||
| 1418 | else { | ||
| 1419 | cp++; | ||
| 1420 | memcpy(component, path, cp - path); | ||
| 1421 | component[cp - path] = '\0'; | ||
| 1422 | } | ||
| 1423 | |||
| 1424 | debug3("%s: checking '%s'", __func__, component); | ||
| 1425 | |||
| 1426 | if (stat(component, &st) != 0) | ||
| 1427 | fatal("%s: stat(\"%s\"): %s", __func__, | ||
| 1428 | component, strerror(errno)); | ||
| 1429 | if (st.st_uid != 0 || (st.st_mode & 022) != 0) | ||
| 1430 | fatal("bad ownership or modes for chroot " | ||
| 1431 | "directory %s\"%s\"", | ||
| 1432 | cp == NULL ? "" : "component ", component); | ||
| 1433 | if (!S_ISDIR(st.st_mode)) | ||
| 1434 | fatal("chroot path %s\"%s\" is not a directory", | ||
| 1435 | cp == NULL ? "" : "component ", component); | ||
| 1436 | |||
| 1437 | } | ||
| 1438 | |||
| 1439 | if (chdir(path) == -1) | ||
| 1440 | fatal("Unable to chdir to chroot path \"%s\": " | ||
| 1441 | "%s", path, strerror(errno)); | ||
| 1442 | if (chroot(path) == -1) | ||
| 1443 | fatal("chroot(\"%s\"): %s", path, strerror(errno)); | ||
| 1444 | if (chdir("/") == -1) | ||
| 1445 | fatal("%s: chdir(/) after chroot: %s", | ||
| 1446 | __func__, strerror(errno)); | ||
| 1447 | verbose("Changed root directory to \"%s\"", path); | ||
| 1448 | } | ||
| 1449 | |||
| 1287 | /* Set login name, uid, gid, and groups. */ | 1450 | /* Set login name, uid, gid, and groups. */ |
| 1288 | void | 1451 | void |
| 1289 | do_setusercontext(struct passwd *pw) | 1452 | do_setusercontext(struct passwd *pw) |
| 1290 | { | 1453 | { |
| 1454 | char *chroot_path, *tmp; | ||
| 1455 | |||
| 1456 | #ifdef WITH_SELINUX | ||
| 1457 | /* Cache selinux status for later use */ | ||
| 1458 | (void)ssh_selinux_enabled(); | ||
| 1459 | #endif | ||
| 1460 | |||
| 1291 | #ifndef HAVE_CYGWIN | 1461 | #ifndef HAVE_CYGWIN |
| 1292 | if (getuid() == 0 || geteuid() == 0) | 1462 | if (getuid() == 0 || geteuid() == 0) |
| 1293 | #endif /* HAVE_CYGWIN */ | 1463 | #endif /* HAVE_CYGWIN */ |
| @@ -1301,21 +1471,13 @@ do_setusercontext(struct passwd *pw) | |||
| 1301 | # ifdef __bsdi__ | 1471 | # ifdef __bsdi__ |
| 1302 | setpgid(0, 0); | 1472 | setpgid(0, 0); |
| 1303 | # endif | 1473 | # endif |
| 1304 | #ifdef GSSAPI | ||
| 1305 | if (options.gss_authentication) { | ||
| 1306 | temporarily_use_uid(pw); | ||
| 1307 | ssh_gssapi_storecreds(); | ||
| 1308 | restore_uid(); | ||
| 1309 | } | ||
| 1310 | #endif | ||
| 1311 | # ifdef USE_PAM | 1474 | # ifdef USE_PAM |
| 1312 | if (options.use_pam) { | 1475 | if (options.use_pam) { |
| 1313 | do_pam_session(); | ||
| 1314 | do_pam_setcred(use_privsep); | 1476 | do_pam_setcred(use_privsep); |
| 1315 | } | 1477 | } |
| 1316 | # endif /* USE_PAM */ | 1478 | # endif /* USE_PAM */ |
| 1317 | if (setusercontext(lc, pw, pw->pw_uid, | 1479 | if (setusercontext(lc, pw, pw->pw_uid, |
| 1318 | (LOGIN_SETALL & ~LOGIN_SETPATH)) < 0) { | 1480 | (LOGIN_SETALL & ~(LOGIN_SETPATH|LOGIN_SETUSER))) < 0) { |
| 1319 | perror("unable to set user context"); | 1481 | perror("unable to set user context"); |
| 1320 | exit(1); | 1482 | exit(1); |
| 1321 | } | 1483 | } |
| @@ -1338,13 +1500,6 @@ do_setusercontext(struct passwd *pw) | |||
| 1338 | exit(1); | 1500 | exit(1); |
| 1339 | } | 1501 | } |
| 1340 | endgrent(); | 1502 | endgrent(); |
| 1341 | #ifdef GSSAPI | ||
| 1342 | if (options.gss_authentication) { | ||
| 1343 | temporarily_use_uid(pw); | ||
| 1344 | ssh_gssapi_storecreds(); | ||
| 1345 | restore_uid(); | ||
| 1346 | } | ||
| 1347 | #endif | ||
| 1348 | # ifdef USE_PAM | 1503 | # ifdef USE_PAM |
| 1349 | /* | 1504 | /* |
| 1350 | * PAM credentials may take the form of supplementary groups. | 1505 | * PAM credentials may take the form of supplementary groups. |
| @@ -1352,21 +1507,39 @@ do_setusercontext(struct passwd *pw) | |||
| 1352 | * Reestablish them here. | 1507 | * Reestablish them here. |
| 1353 | */ | 1508 | */ |
| 1354 | if (options.use_pam) { | 1509 | if (options.use_pam) { |
| 1355 | do_pam_session(); | ||
| 1356 | do_pam_setcred(use_privsep); | 1510 | do_pam_setcred(use_privsep); |
| 1357 | } | 1511 | } |
| 1358 | # endif /* USE_PAM */ | 1512 | # endif /* USE_PAM */ |
| 1359 | # if defined(WITH_IRIX_PROJECT) || defined(WITH_IRIX_JOBS) || defined(WITH_IRIX_ARRAY) | 1513 | # if defined(WITH_IRIX_PROJECT) || defined(WITH_IRIX_JOBS) || defined(WITH_IRIX_ARRAY) |
| 1360 | irix_setusercontext(pw); | 1514 | irix_setusercontext(pw); |
| 1361 | # endif /* defined(WITH_IRIX_PROJECT) || defined(WITH_IRIX_JOBS) || defined(WITH_IRIX_ARRAY) */ | 1515 | # endif /* defined(WITH_IRIX_PROJECT) || defined(WITH_IRIX_JOBS) || defined(WITH_IRIX_ARRAY) */ |
| 1362 | # ifdef _AIX | 1516 | # ifdef _AIX |
| 1363 | aix_usrinfo(pw); | 1517 | aix_usrinfo(pw); |
| 1364 | # endif /* _AIX */ | 1518 | # endif /* _AIX */ |
| 1365 | #ifdef USE_LIBIAF | 1519 | # ifdef USE_LIBIAF |
| 1366 | if (set_id(pw->pw_name) != 0) { | 1520 | if (set_id(pw->pw_name) != 0) { |
| 1367 | exit(1); | 1521 | exit(1); |
| 1368 | } | 1522 | } |
| 1369 | #endif /* USE_LIBIAF */ | 1523 | # endif /* USE_LIBIAF */ |
| 1524 | #endif | ||
| 1525 | |||
| 1526 | if (options.chroot_directory != NULL && | ||
| 1527 | strcasecmp(options.chroot_directory, "none") != 0) { | ||
| 1528 | tmp = tilde_expand_filename(options.chroot_directory, | ||
| 1529 | pw->pw_uid); | ||
| 1530 | chroot_path = percent_expand(tmp, "h", pw->pw_dir, | ||
| 1531 | "u", pw->pw_name, (char *)NULL); | ||
| 1532 | safely_chroot(chroot_path, pw->pw_uid); | ||
| 1533 | free(tmp); | ||
| 1534 | free(chroot_path); | ||
| 1535 | } | ||
| 1536 | |||
| 1537 | #ifdef HAVE_LOGIN_CAP | ||
| 1538 | if (setusercontext(lc, pw, pw->pw_uid, LOGIN_SETUSER) < 0) { | ||
| 1539 | perror("unable to set user context (setuser)"); | ||
| 1540 | exit(1); | ||
| 1541 | } | ||
| 1542 | #else | ||
| 1370 | /* Permanently switch to the desired uid. */ | 1543 | /* Permanently switch to the desired uid. */ |
| 1371 | permanently_set_uid(pw); | 1544 | permanently_set_uid(pw); |
| 1372 | #endif | 1545 | #endif |
| @@ -1465,14 +1638,16 @@ child_close_fds(void) | |||
| 1465 | * environment, closing extra file descriptors, setting the user and group | 1638 | * environment, closing extra file descriptors, setting the user and group |
| 1466 | * ids, and executing the command or shell. | 1639 | * ids, and executing the command or shell. |
| 1467 | */ | 1640 | */ |
| 1641 | #define ARGV_MAX 10 | ||
| 1468 | void | 1642 | void |
| 1469 | do_child(Session *s, const char *command) | 1643 | do_child(Session *s, const char *command) |
| 1470 | { | 1644 | { |
| 1471 | extern char **environ; | 1645 | extern char **environ; |
| 1472 | char **env; | 1646 | char **env; |
| 1473 | char *argv[10]; | 1647 | char *argv[ARGV_MAX]; |
| 1474 | const char *shell, *shell0, *hostname = NULL; | 1648 | const char *shell, *shell0, *hostname = NULL; |
| 1475 | struct passwd *pw = s->pw; | 1649 | struct passwd *pw = s->pw; |
| 1650 | int r = 0; | ||
| 1476 | 1651 | ||
| 1477 | /* remove hostkey from the child's memory */ | 1652 | /* remove hostkey from the child's memory */ |
| 1478 | destroy_sensitive_data(); | 1653 | destroy_sensitive_data(); |
| @@ -1588,20 +1763,42 @@ do_child(Session *s, const char *command) | |||
| 1588 | 1763 | ||
| 1589 | /* Change current directory to the user's home directory. */ | 1764 | /* Change current directory to the user's home directory. */ |
| 1590 | if (chdir(pw->pw_dir) < 0) { | 1765 | if (chdir(pw->pw_dir) < 0) { |
| 1591 | fprintf(stderr, "Could not chdir to home directory %s: %s\n", | 1766 | /* Suppress missing homedir warning for chroot case */ |
| 1592 | pw->pw_dir, strerror(errno)); | ||
| 1593 | #ifdef HAVE_LOGIN_CAP | 1767 | #ifdef HAVE_LOGIN_CAP |
| 1594 | if (login_getcapbool(lc, "requirehome", 0)) | 1768 | r = login_getcapbool(lc, "requirehome", 0); |
| 1595 | exit(1); | ||
| 1596 | #endif | 1769 | #endif |
| 1770 | if (r || options.chroot_directory == NULL) | ||
| 1771 | fprintf(stderr, "Could not chdir to home " | ||
| 1772 | "directory %s: %s\n", pw->pw_dir, | ||
| 1773 | strerror(errno)); | ||
| 1774 | if (r) | ||
| 1775 | exit(1); | ||
| 1597 | } | 1776 | } |
| 1598 | 1777 | ||
| 1778 | closefrom(STDERR_FILENO + 1); | ||
| 1779 | |||
| 1599 | if (!options.use_login) | 1780 | if (!options.use_login) |
| 1600 | do_rc_files(s, shell); | 1781 | do_rc_files(s, shell); |
| 1601 | 1782 | ||
| 1602 | /* restore SIGPIPE for child */ | 1783 | /* restore SIGPIPE for child */ |
| 1603 | signal(SIGPIPE, SIG_DFL); | 1784 | signal(SIGPIPE, SIG_DFL); |
| 1604 | 1785 | ||
| 1786 | if (s->is_subsystem == SUBSYSTEM_INT_SFTP) { | ||
| 1787 | extern int optind, optreset; | ||
| 1788 | int i; | ||
| 1789 | char *p, *args; | ||
| 1790 | |||
| 1791 | setproctitle("%s@internal-sftp-server", s->pw->pw_name); | ||
| 1792 | args = strdup(command ? command : "sftp-server"); | ||
| 1793 | for (i = 0, (p = strtok(args, " ")); p; (p = strtok(NULL, " "))) | ||
| 1794 | if (i < ARGV_MAX - 1) | ||
| 1795 | argv[i++] = p; | ||
| 1796 | argv[i] = NULL; | ||
| 1797 | optind = optreset = 1; | ||
| 1798 | __progname = argv[0]; | ||
| 1799 | exit(sftp_server_main(i, argv, s->pw)); | ||
| 1800 | } | ||
| 1801 | |||
| 1605 | if (options.use_login) { | 1802 | if (options.use_login) { |
| 1606 | launch_login(pw, hostname); | 1803 | launch_login(pw, hostname); |
| 1607 | /* NEVERREACHED */ | 1804 | /* NEVERREACHED */ |
| @@ -1653,43 +1850,79 @@ do_child(Session *s, const char *command) | |||
| 1653 | exit(1); | 1850 | exit(1); |
| 1654 | } | 1851 | } |
| 1655 | 1852 | ||
| 1853 | void | ||
| 1854 | session_unused(int id) | ||
| 1855 | { | ||
| 1856 | debug3("%s: session id %d unused", __func__, id); | ||
| 1857 | if (id >= options.max_sessions || | ||
| 1858 | id >= sessions_nalloc) { | ||
| 1859 | fatal("%s: insane session id %d (max %d nalloc %d)", | ||
| 1860 | __func__, id, options.max_sessions, sessions_nalloc); | ||
| 1861 | } | ||
| 1862 | bzero(&sessions[id], sizeof(*sessions)); | ||
| 1863 | sessions[id].self = id; | ||
| 1864 | sessions[id].used = 0; | ||
| 1865 | sessions[id].chanid = -1; | ||
| 1866 | sessions[id].ptyfd = -1; | ||
| 1867 | sessions[id].ttyfd = -1; | ||
| 1868 | sessions[id].ptymaster = -1; | ||
| 1869 | sessions[id].x11_chanids = NULL; | ||
| 1870 | sessions[id].next_unused = sessions_first_unused; | ||
| 1871 | sessions_first_unused = id; | ||
| 1872 | } | ||
| 1873 | |||
| 1656 | Session * | 1874 | Session * |
| 1657 | session_new(void) | 1875 | session_new(void) |
| 1658 | { | 1876 | { |
| 1659 | int i; | 1877 | Session *s, *tmp; |
| 1660 | static int did_init = 0; | 1878 | |
| 1661 | if (!did_init) { | 1879 | if (sessions_first_unused == -1) { |
| 1662 | debug("session_new: init"); | 1880 | if (sessions_nalloc >= options.max_sessions) |
| 1663 | for (i = 0; i < MAX_SESSIONS; i++) { | 1881 | return NULL; |
| 1664 | sessions[i].used = 0; | 1882 | debug2("%s: allocate (allocated %d max %d)", |
| 1883 | __func__, sessions_nalloc, options.max_sessions); | ||
| 1884 | tmp = xrealloc(sessions, sessions_nalloc + 1, | ||
| 1885 | sizeof(*sessions)); | ||
| 1886 | if (tmp == NULL) { | ||
| 1887 | error("%s: cannot allocate %d sessions", | ||
| 1888 | __func__, sessions_nalloc + 1); | ||
| 1889 | return NULL; | ||
| 1665 | } | 1890 | } |
| 1666 | did_init = 1; | 1891 | sessions = tmp; |
| 1892 | session_unused(sessions_nalloc++); | ||
| 1667 | } | 1893 | } |
| 1668 | for (i = 0; i < MAX_SESSIONS; i++) { | 1894 | |
| 1669 | Session *s = &sessions[i]; | 1895 | if (sessions_first_unused >= sessions_nalloc || |
| 1670 | if (! s->used) { | 1896 | sessions_first_unused < 0) { |
| 1671 | memset(s, 0, sizeof(*s)); | 1897 | fatal("%s: insane first_unused %d max %d nalloc %d", |
| 1672 | s->chanid = -1; | 1898 | __func__, sessions_first_unused, options.max_sessions, |
| 1673 | s->ptyfd = -1; | 1899 | sessions_nalloc); |
| 1674 | s->ttyfd = -1; | ||
| 1675 | s->used = 1; | ||
| 1676 | s->self = i; | ||
| 1677 | s->x11_chanids = NULL; | ||
| 1678 | debug("session_new: session %d", i); | ||
| 1679 | return s; | ||
| 1680 | } | ||
| 1681 | } | 1900 | } |
| 1682 | return NULL; | 1901 | |
| 1902 | s = &sessions[sessions_first_unused]; | ||
| 1903 | if (s->used) { | ||
| 1904 | fatal("%s: session %d already used", | ||
| 1905 | __func__, sessions_first_unused); | ||
| 1906 | } | ||
| 1907 | sessions_first_unused = s->next_unused; | ||
| 1908 | s->used = 1; | ||
| 1909 | s->next_unused = -1; | ||
| 1910 | debug("session_new: session %d", s->self); | ||
| 1911 | |||
| 1912 | return s; | ||
| 1683 | } | 1913 | } |
| 1684 | 1914 | ||
| 1685 | static void | 1915 | static void |
| 1686 | session_dump(void) | 1916 | session_dump(void) |
| 1687 | { | 1917 | { |
| 1688 | int i; | 1918 | int i; |
| 1689 | for (i = 0; i < MAX_SESSIONS; i++) { | 1919 | for (i = 0; i < sessions_nalloc; i++) { |
| 1690 | Session *s = &sessions[i]; | 1920 | Session *s = &sessions[i]; |
| 1691 | debug("dump: used %d session %d %p channel %d pid %ld", | 1921 | |
| 1922 | debug("dump: used %d next_unused %d session %d %p " | ||
| 1923 | "channel %d pid %ld", | ||
| 1692 | s->used, | 1924 | s->used, |
| 1925 | s->next_unused, | ||
| 1693 | s->self, | 1926 | s->self, |
| 1694 | s, | 1927 | s, |
| 1695 | s->chanid, | 1928 | s->chanid, |
| @@ -1719,7 +1952,7 @@ Session * | |||
| 1719 | session_by_tty(char *tty) | 1952 | session_by_tty(char *tty) |
| 1720 | { | 1953 | { |
| 1721 | int i; | 1954 | int i; |
| 1722 | for (i = 0; i < MAX_SESSIONS; i++) { | 1955 | for (i = 0; i < sessions_nalloc; i++) { |
| 1723 | Session *s = &sessions[i]; | 1956 | Session *s = &sessions[i]; |
| 1724 | if (s->used && s->ttyfd != -1 && strcmp(s->tty, tty) == 0) { | 1957 | if (s->used && s->ttyfd != -1 && strcmp(s->tty, tty) == 0) { |
| 1725 | debug("session_by_tty: session %d tty %s", i, tty); | 1958 | debug("session_by_tty: session %d tty %s", i, tty); |
| @@ -1735,10 +1968,11 @@ static Session * | |||
| 1735 | session_by_channel(int id) | 1968 | session_by_channel(int id) |
| 1736 | { | 1969 | { |
| 1737 | int i; | 1970 | int i; |
| 1738 | for (i = 0; i < MAX_SESSIONS; i++) { | 1971 | for (i = 0; i < sessions_nalloc; i++) { |
| 1739 | Session *s = &sessions[i]; | 1972 | Session *s = &sessions[i]; |
| 1740 | if (s->used && s->chanid == id) { | 1973 | if (s->used && s->chanid == id) { |
| 1741 | debug("session_by_channel: session %d channel %d", i, id); | 1974 | debug("session_by_channel: session %d channel %d", |
| 1975 | i, id); | ||
| 1742 | return s; | 1976 | return s; |
| 1743 | } | 1977 | } |
| 1744 | } | 1978 | } |
| @@ -1752,7 +1986,7 @@ session_by_x11_channel(int id) | |||
| 1752 | { | 1986 | { |
| 1753 | int i, j; | 1987 | int i, j; |
| 1754 | 1988 | ||
| 1755 | for (i = 0; i < MAX_SESSIONS; i++) { | 1989 | for (i = 0; i < sessions_nalloc; i++) { |
| 1756 | Session *s = &sessions[i]; | 1990 | Session *s = &sessions[i]; |
| 1757 | 1991 | ||
| 1758 | if (s->x11_chanids == NULL || !s->used) | 1992 | if (s->x11_chanids == NULL || !s->used) |
| @@ -1775,7 +2009,7 @@ session_by_pid(pid_t pid) | |||
| 1775 | { | 2009 | { |
| 1776 | int i; | 2010 | int i; |
| 1777 | debug("session_by_pid: pid %ld", (long)pid); | 2011 | debug("session_by_pid: pid %ld", (long)pid); |
| 1778 | for (i = 0; i < MAX_SESSIONS; i++) { | 2012 | for (i = 0; i < sessions_nalloc; i++) { |
| 1779 | Session *s = &sessions[i]; | 2013 | Session *s = &sessions[i]; |
| 1780 | if (s->used && s->pid == pid) | 2014 | if (s->used && s->pid == pid) |
| 1781 | return s; | 2015 | return s; |
| @@ -1831,7 +2065,8 @@ session_pty_req(Session *s) | |||
| 1831 | 2065 | ||
| 1832 | /* Allocate a pty and open it. */ | 2066 | /* Allocate a pty and open it. */ |
| 1833 | debug("Allocating pty."); | 2067 | debug("Allocating pty."); |
| 1834 | if (!PRIVSEP(pty_allocate(&s->ptyfd, &s->ttyfd, s->tty, sizeof(s->tty)))) { | 2068 | if (!PRIVSEP(pty_allocate(&s->ptyfd, &s->ttyfd, s->tty, |
| 2069 | sizeof(s->tty)))) { | ||
| 1835 | if (s->term) | 2070 | if (s->term) |
| 1836 | xfree(s->term); | 2071 | xfree(s->term); |
| 1837 | s->term = NULL; | 2072 | s->term = NULL; |
| @@ -1874,15 +2109,17 @@ session_subsystem_req(Session *s) | |||
| 1874 | if (strcmp(subsys, options.subsystem_name[i]) == 0) { | 2109 | if (strcmp(subsys, options.subsystem_name[i]) == 0) { |
| 1875 | prog = options.subsystem_command[i]; | 2110 | prog = options.subsystem_command[i]; |
| 1876 | cmd = options.subsystem_args[i]; | 2111 | cmd = options.subsystem_args[i]; |
| 1877 | if (stat(prog, &st) < 0) { | 2112 | if (!strcmp(INTERNAL_SFTP_NAME, prog)) { |
| 2113 | s->is_subsystem = SUBSYSTEM_INT_SFTP; | ||
| 2114 | } else if (stat(prog, &st) < 0) { | ||
| 1878 | error("subsystem: cannot stat %s: %s", prog, | 2115 | error("subsystem: cannot stat %s: %s", prog, |
| 1879 | strerror(errno)); | 2116 | strerror(errno)); |
| 1880 | break; | 2117 | break; |
| 2118 | } else { | ||
| 2119 | s->is_subsystem = SUBSYSTEM_EXT; | ||
| 1881 | } | 2120 | } |
| 1882 | debug("subsystem: exec() %s", cmd); | 2121 | debug("subsystem: exec() %s", cmd); |
| 1883 | s->is_subsystem = 1; | 2122 | success = do_exec(s, cmd) == 0; |
| 1884 | do_exec(s, cmd); | ||
| 1885 | success = 1; | ||
| 1886 | break; | 2123 | break; |
| 1887 | } | 2124 | } |
| 1888 | } | 2125 | } |
| @@ -1925,19 +2162,19 @@ static int | |||
| 1925 | session_shell_req(Session *s) | 2162 | session_shell_req(Session *s) |
| 1926 | { | 2163 | { |
| 1927 | packet_check_eom(); | 2164 | packet_check_eom(); |
| 1928 | do_exec(s, NULL); | 2165 | return do_exec(s, NULL) == 0; |
| 1929 | return 1; | ||
| 1930 | } | 2166 | } |
| 1931 | 2167 | ||
| 1932 | static int | 2168 | static int |
| 1933 | session_exec_req(Session *s) | 2169 | session_exec_req(Session *s) |
| 1934 | { | 2170 | { |
| 1935 | u_int len; | 2171 | u_int len, success; |
| 2172 | |||
| 1936 | char *command = packet_get_string(&len); | 2173 | char *command = packet_get_string(&len); |
| 1937 | packet_check_eom(); | 2174 | packet_check_eom(); |
| 1938 | do_exec(s, command); | 2175 | success = do_exec(s, command) == 0; |
| 1939 | xfree(command); | 2176 | xfree(command); |
| 1940 | return 1; | 2177 | return success; |
| 1941 | } | 2178 | } |
| 1942 | 2179 | ||
| 1943 | static int | 2180 | static int |
| @@ -1947,8 +2184,7 @@ session_break_req(Session *s) | |||
| 1947 | packet_get_int(); /* ignored */ | 2184 | packet_get_int(); /* ignored */ |
| 1948 | packet_check_eom(); | 2185 | packet_check_eom(); |
| 1949 | 2186 | ||
| 1950 | if (s->ttyfd == -1 || | 2187 | if (s->ttyfd == -1 || tcsendbreak(s->ttyfd, 0) < 0) |
| 1951 | tcsendbreak(s->ttyfd, 0) < 0) | ||
| 1952 | return 0; | 2188 | return 0; |
| 1953 | return 1; | 2189 | return 1; |
| 1954 | } | 2190 | } |
| @@ -1993,7 +2229,7 @@ session_auth_agent_req(Session *s) | |||
| 1993 | { | 2229 | { |
| 1994 | static int called = 0; | 2230 | static int called = 0; |
| 1995 | packet_check_eom(); | 2231 | packet_check_eom(); |
| 1996 | if (no_agent_forwarding_flag) { | 2232 | if (no_agent_forwarding_flag || !options.allow_agent_forwarding) { |
| 1997 | debug("session_auth_agent_req: no_agent_forwarding_flag"); | 2233 | debug("session_auth_agent_req: no_agent_forwarding_flag"); |
| 1998 | return 0; | 2234 | return 0; |
| 1999 | } | 2235 | } |
| @@ -2049,7 +2285,7 @@ session_input_channel_req(Channel *c, const char *rtype) | |||
| 2049 | } | 2285 | } |
| 2050 | 2286 | ||
| 2051 | void | 2287 | void |
| 2052 | session_set_fds(Session *s, int fdin, int fdout, int fderr) | 2288 | session_set_fds(Session *s, int fdin, int fdout, int fderr, int is_tty) |
| 2053 | { | 2289 | { |
| 2054 | if (!compat20) | 2290 | if (!compat20) |
| 2055 | fatal("session_set_fds: called for proto != 2.0"); | 2291 | fatal("session_set_fds: called for proto != 2.0"); |
| @@ -2062,8 +2298,7 @@ session_set_fds(Session *s, int fdin, int fdout, int fderr) | |||
| 2062 | channel_set_fds(s->chanid, | 2298 | channel_set_fds(s->chanid, |
| 2063 | fdout, fdin, fderr, | 2299 | fdout, fdin, fderr, |
| 2064 | fderr == -1 ? CHAN_EXTENDED_IGNORE : CHAN_EXTENDED_READ, | 2300 | fderr == -1 ? CHAN_EXTENDED_IGNORE : CHAN_EXTENDED_READ, |
| 2065 | 1, | 2301 | 1, is_tty, CHAN_SES_WINDOW_DEFAULT); |
| 2066 | CHAN_SES_WINDOW_DEFAULT); | ||
| 2067 | } | 2302 | } |
| 2068 | 2303 | ||
| 2069 | /* | 2304 | /* |
| @@ -2095,8 +2330,9 @@ session_pty_cleanup2(Session *s) | |||
| 2095 | * the pty cleanup, so that another process doesn't get this pty | 2330 | * the pty cleanup, so that another process doesn't get this pty |
| 2096 | * while we're still cleaning up. | 2331 | * while we're still cleaning up. |
| 2097 | */ | 2332 | */ |
| 2098 | if (close(s->ptymaster) < 0) | 2333 | if (s->ptymaster != -1 && close(s->ptymaster) < 0) |
| 2099 | error("close(s->ptymaster/%d): %s", s->ptymaster, strerror(errno)); | 2334 | error("close(s->ptymaster/%d): %s", |
| 2335 | s->ptymaster, strerror(errno)); | ||
| 2100 | 2336 | ||
| 2101 | /* unlink pty from session */ | 2337 | /* unlink pty from session */ |
| 2102 | s->ttyfd = -1; | 2338 | s->ttyfd = -1; |
| @@ -2204,7 +2440,7 @@ session_exit_message(Session *s, int status) | |||
| 2204 | channel_request_start(s->chanid, "exit-signal", 0); | 2440 | channel_request_start(s->chanid, "exit-signal", 0); |
| 2205 | packet_put_cstring(sig2name(WTERMSIG(status))); | 2441 | packet_put_cstring(sig2name(WTERMSIG(status))); |
| 2206 | #ifdef WCOREDUMP | 2442 | #ifdef WCOREDUMP |
| 2207 | packet_put_char(WCOREDUMP(status)); | 2443 | packet_put_char(WCOREDUMP(status)? 1 : 0); |
| 2208 | #else /* WCOREDUMP */ | 2444 | #else /* WCOREDUMP */ |
| 2209 | packet_put_char(0); | 2445 | packet_put_char(0); |
| 2210 | #endif /* WCOREDUMP */ | 2446 | #endif /* WCOREDUMP */ |
| @@ -2256,7 +2492,6 @@ session_close(Session *s) | |||
| 2256 | xfree(s->auth_data); | 2492 | xfree(s->auth_data); |
| 2257 | if (s->auth_proto) | 2493 | if (s->auth_proto) |
| 2258 | xfree(s->auth_proto); | 2494 | xfree(s->auth_proto); |
| 2259 | s->used = 0; | ||
| 2260 | if (s->env != NULL) { | 2495 | if (s->env != NULL) { |
| 2261 | for (i = 0; i < s->num_env; i++) { | 2496 | for (i = 0; i < s->num_env; i++) { |
| 2262 | xfree(s->env[i].name); | 2497 | xfree(s->env[i].name); |
| @@ -2265,6 +2500,7 @@ session_close(Session *s) | |||
| 2265 | xfree(s->env); | 2500 | xfree(s->env); |
| 2266 | } | 2501 | } |
| 2267 | session_proctitle(s); | 2502 | session_proctitle(s); |
| 2503 | session_unused(s->self); | ||
| 2268 | } | 2504 | } |
| 2269 | 2505 | ||
| 2270 | void | 2506 | void |
| @@ -2328,7 +2564,7 @@ void | |||
| 2328 | session_destroy_all(void (*closefunc)(Session *)) | 2564 | session_destroy_all(void (*closefunc)(Session *)) |
| 2329 | { | 2565 | { |
| 2330 | int i; | 2566 | int i; |
| 2331 | for (i = 0; i < MAX_SESSIONS; i++) { | 2567 | for (i = 0; i < sessions_nalloc; i++) { |
| 2332 | Session *s = &sessions[i]; | 2568 | Session *s = &sessions[i]; |
| 2333 | if (s->used) { | 2569 | if (s->used) { |
| 2334 | if (closefunc != NULL) | 2570 | if (closefunc != NULL) |
| @@ -2347,7 +2583,7 @@ session_tty_list(void) | |||
| 2347 | char *cp; | 2583 | char *cp; |
| 2348 | 2584 | ||
| 2349 | buf[0] = '\0'; | 2585 | buf[0] = '\0'; |
| 2350 | for (i = 0; i < MAX_SESSIONS; i++) { | 2586 | for (i = 0; i < sessions_nalloc; i++) { |
| 2351 | Session *s = &sessions[i]; | 2587 | Session *s = &sessions[i]; |
| 2352 | if (s->used && s->ttyfd != -1) { | 2588 | if (s->used && s->ttyfd != -1) { |
| 2353 | 2589 | ||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: session.h,v 1.29 2006/08/03 03:34:42 deraadt Exp $ */ | 1 | /* $OpenBSD: session.h,v 1.30 2008/05/08 12:21:16 djm Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. | 4 | * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. |
| @@ -31,6 +31,7 @@ typedef struct Session Session; | |||
| 31 | struct Session { | 31 | struct Session { |
| 32 | int used; | 32 | int used; |
| 33 | int self; | 33 | int self; |
| 34 | int next_unused; | ||
| 34 | struct passwd *pw; | 35 | struct passwd *pw; |
| 35 | Authctxt *authctxt; | 36 | Authctxt *authctxt; |
| 36 | pid_t pid; | 37 | pid_t pid; |
| @@ -65,6 +66,7 @@ void do_authenticated(Authctxt *); | |||
| 65 | void do_cleanup(Authctxt *); | 66 | void do_cleanup(Authctxt *); |
| 66 | 67 | ||
| 67 | int session_open(Authctxt *, int); | 68 | int session_open(Authctxt *, int); |
| 69 | void session_unused(int); | ||
| 68 | int session_input_channel_req(Channel *, const char *); | 70 | int session_input_channel_req(Channel *, const char *); |
| 69 | void session_close_by_pid(pid_t, int); | 71 | void session_close_by_pid(pid_t, int); |
| 70 | void session_close_by_channel(int, void *); | 72 | void session_close_by_channel(int, void *); |
diff --git a/sftp-client.c b/sftp-client.c index 2746f3245..5e39aa7d2 100644 --- a/sftp-client.c +++ b/sftp-client.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: sftp-client.c,v 1.76 2007/01/22 11:32:50 djm Exp $ */ | 1 | /* $OpenBSD: sftp-client.c,v 1.86 2008/06/26 06:10:09 djm Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Copyright (c) 2001-2004 Damien Miller <djm@openbsd.org> | 3 | * Copyright (c) 2001-2004 Damien Miller <djm@openbsd.org> |
| 4 | * | 4 | * |
| @@ -24,6 +24,9 @@ | |||
| 24 | 24 | ||
| 25 | #include <sys/types.h> | 25 | #include <sys/types.h> |
| 26 | #include <sys/param.h> | 26 | #include <sys/param.h> |
| 27 | #ifdef HAVE_SYS_STATVFS_H | ||
| 28 | #include <sys/statvfs.h> | ||
| 29 | #endif | ||
| 27 | #include "openbsd-compat/sys-queue.h" | 30 | #include "openbsd-compat/sys-queue.h" |
| 28 | #ifdef HAVE_SYS_STAT_H | 31 | #ifdef HAVE_SYS_STAT_H |
| 29 | # include <sys/stat.h> | 32 | # include <sys/stat.h> |
| @@ -65,6 +68,10 @@ struct sftp_conn { | |||
| 65 | u_int num_requests; | 68 | u_int num_requests; |
| 66 | u_int version; | 69 | u_int version; |
| 67 | u_int msg_id; | 70 | u_int msg_id; |
| 71 | #define SFTP_EXT_POSIX_RENAME 0x00000001 | ||
| 72 | #define SFTP_EXT_STATVFS 0x00000002 | ||
| 73 | #define SFTP_EXT_FSTATVFS 0x00000004 | ||
| 74 | u_int exts; | ||
| 68 | }; | 75 | }; |
| 69 | 76 | ||
| 70 | static void | 77 | static void |
| @@ -236,10 +243,61 @@ get_decode_stat(int fd, u_int expected_id, int quiet) | |||
| 236 | return(a); | 243 | return(a); |
| 237 | } | 244 | } |
| 238 | 245 | ||
| 246 | static int | ||
| 247 | get_decode_statvfs(int fd, struct sftp_statvfs *st, u_int expected_id, | ||
| 248 | int quiet) | ||
| 249 | { | ||
| 250 | Buffer msg; | ||
| 251 | u_int type, id, flag; | ||
| 252 | |||
| 253 | buffer_init(&msg); | ||
| 254 | get_msg(fd, &msg); | ||
| 255 | |||
| 256 | type = buffer_get_char(&msg); | ||
| 257 | id = buffer_get_int(&msg); | ||
| 258 | |||
| 259 | debug3("Received statvfs reply T:%u I:%u", type, id); | ||
| 260 | if (id != expected_id) | ||
| 261 | fatal("ID mismatch (%u != %u)", id, expected_id); | ||
| 262 | if (type == SSH2_FXP_STATUS) { | ||
| 263 | int status = buffer_get_int(&msg); | ||
| 264 | |||
| 265 | if (quiet) | ||
| 266 | debug("Couldn't statvfs: %s", fx2txt(status)); | ||
| 267 | else | ||
| 268 | error("Couldn't statvfs: %s", fx2txt(status)); | ||
| 269 | buffer_free(&msg); | ||
| 270 | return -1; | ||
| 271 | } else if (type != SSH2_FXP_EXTENDED_REPLY) { | ||
| 272 | fatal("Expected SSH2_FXP_EXTENDED_REPLY(%u) packet, got %u", | ||
| 273 | SSH2_FXP_EXTENDED_REPLY, type); | ||
| 274 | } | ||
| 275 | |||
| 276 | bzero(st, sizeof(*st)); | ||
| 277 | st->f_bsize = buffer_get_int64(&msg); | ||
| 278 | st->f_frsize = buffer_get_int64(&msg); | ||
| 279 | st->f_blocks = buffer_get_int64(&msg); | ||
| 280 | st->f_bfree = buffer_get_int64(&msg); | ||
| 281 | st->f_bavail = buffer_get_int64(&msg); | ||
| 282 | st->f_files = buffer_get_int64(&msg); | ||
| 283 | st->f_ffree = buffer_get_int64(&msg); | ||
| 284 | st->f_favail = buffer_get_int64(&msg); | ||
| 285 | st->f_fsid = buffer_get_int64(&msg); | ||
| 286 | flag = buffer_get_int64(&msg); | ||
| 287 | st->f_namemax = buffer_get_int64(&msg); | ||
| 288 | |||
| 289 | st->f_flag = (flag & SSH2_FXE_STATVFS_ST_RDONLY) ? ST_RDONLY : 0; | ||
| 290 | st->f_flag |= (flag & SSH2_FXE_STATVFS_ST_NOSUID) ? ST_NOSUID : 0; | ||
| 291 | |||
| 292 | buffer_free(&msg); | ||
| 293 | |||
| 294 | return 0; | ||
| 295 | } | ||
| 296 | |||
| 239 | struct sftp_conn * | 297 | struct sftp_conn * |
| 240 | do_init(int fd_in, int fd_out, u_int transfer_buflen, u_int num_requests) | 298 | do_init(int fd_in, int fd_out, u_int transfer_buflen, u_int num_requests) |
| 241 | { | 299 | { |
| 242 | u_int type; | 300 | u_int type, exts = 0; |
| 243 | int version; | 301 | int version; |
| 244 | Buffer msg; | 302 | Buffer msg; |
| 245 | struct sftp_conn *ret; | 303 | struct sftp_conn *ret; |
| @@ -268,8 +326,27 @@ do_init(int fd_in, int fd_out, u_int transfer_buflen, u_int num_requests) | |||
| 268 | while (buffer_len(&msg) > 0) { | 326 | while (buffer_len(&msg) > 0) { |
| 269 | char *name = buffer_get_string(&msg, NULL); | 327 | char *name = buffer_get_string(&msg, NULL); |
| 270 | char *value = buffer_get_string(&msg, NULL); | 328 | char *value = buffer_get_string(&msg, NULL); |
| 271 | 329 | int known = 0; | |
| 272 | debug2("Init extension: \"%s\"", name); | 330 | |
| 331 | if (strcmp(name, "posix-rename@openssh.com") == 0 && | ||
| 332 | strcmp(value, "1") == 0) { | ||
| 333 | exts |= SFTP_EXT_POSIX_RENAME; | ||
| 334 | known = 1; | ||
| 335 | } else if (strcmp(name, "statvfs@openssh.com") == 0 && | ||
| 336 | strcmp(value, "2") == 0) { | ||
| 337 | exts |= SFTP_EXT_STATVFS; | ||
| 338 | known = 1; | ||
| 339 | } if (strcmp(name, "fstatvfs@openssh.com") == 0 && | ||
| 340 | strcmp(value, "2") == 0) { | ||
| 341 | exts |= SFTP_EXT_FSTATVFS; | ||
| 342 | known = 1; | ||
| 343 | } | ||
| 344 | if (known) { | ||
| 345 | debug2("Server supports extension \"%s\" revision %s", | ||
| 346 | name, value); | ||
| 347 | } else { | ||
| 348 | debug2("Unrecognised server extension \"%s\"", name); | ||
| 349 | } | ||
| 273 | xfree(name); | 350 | xfree(name); |
| 274 | xfree(value); | 351 | xfree(value); |
| 275 | } | 352 | } |
| @@ -283,6 +360,7 @@ do_init(int fd_in, int fd_out, u_int transfer_buflen, u_int num_requests) | |||
| 283 | ret->num_requests = num_requests; | 360 | ret->num_requests = num_requests; |
| 284 | ret->version = version; | 361 | ret->version = version; |
| 285 | ret->msg_id = 1; | 362 | ret->msg_id = 1; |
| 363 | ret->exts = exts; | ||
| 286 | 364 | ||
| 287 | /* Some filexfer v.0 servers don't support large packets */ | 365 | /* Some filexfer v.0 servers don't support large packets */ |
| 288 | if (version == 0) | 366 | if (version == 0) |
| @@ -534,6 +612,7 @@ do_lstat(struct sftp_conn *conn, char *path, int quiet) | |||
| 534 | return(get_decode_stat(conn->fd_in, id, quiet)); | 612 | return(get_decode_stat(conn->fd_in, id, quiet)); |
| 535 | } | 613 | } |
| 536 | 614 | ||
| 615 | #ifdef notyet | ||
| 537 | Attrib * | 616 | Attrib * |
| 538 | do_fstat(struct sftp_conn *conn, char *handle, u_int handle_len, int quiet) | 617 | do_fstat(struct sftp_conn *conn, char *handle, u_int handle_len, int quiet) |
| 539 | { | 618 | { |
| @@ -545,6 +624,7 @@ do_fstat(struct sftp_conn *conn, char *handle, u_int handle_len, int quiet) | |||
| 545 | 624 | ||
| 546 | return(get_decode_stat(conn->fd_in, id, quiet)); | 625 | return(get_decode_stat(conn->fd_in, id, quiet)); |
| 547 | } | 626 | } |
| 627 | #endif | ||
| 548 | 628 | ||
| 549 | int | 629 | int |
| 550 | do_setstat(struct sftp_conn *conn, char *path, Attrib *a) | 630 | do_setstat(struct sftp_conn *conn, char *path, Attrib *a) |
| @@ -637,13 +717,20 @@ do_rename(struct sftp_conn *conn, char *oldpath, char *newpath) | |||
| 637 | 717 | ||
| 638 | /* Send rename request */ | 718 | /* Send rename request */ |
| 639 | id = conn->msg_id++; | 719 | id = conn->msg_id++; |
| 640 | buffer_put_char(&msg, SSH2_FXP_RENAME); | 720 | if ((conn->exts & SFTP_EXT_POSIX_RENAME)) { |
| 641 | buffer_put_int(&msg, id); | 721 | buffer_put_char(&msg, SSH2_FXP_EXTENDED); |
| 722 | buffer_put_int(&msg, id); | ||
| 723 | buffer_put_cstring(&msg, "posix-rename@openssh.com"); | ||
| 724 | } else { | ||
| 725 | buffer_put_char(&msg, SSH2_FXP_RENAME); | ||
| 726 | buffer_put_int(&msg, id); | ||
| 727 | } | ||
| 642 | buffer_put_cstring(&msg, oldpath); | 728 | buffer_put_cstring(&msg, oldpath); |
| 643 | buffer_put_cstring(&msg, newpath); | 729 | buffer_put_cstring(&msg, newpath); |
| 644 | send_msg(conn->fd_out, &msg); | 730 | send_msg(conn->fd_out, &msg); |
| 645 | debug3("Sent message SSH2_FXP_RENAME \"%s\" -> \"%s\"", oldpath, | 731 | debug3("Sent message %s \"%s\" -> \"%s\"", |
| 646 | newpath); | 732 | (conn->exts & SFTP_EXT_POSIX_RENAME) ? "posix-rename@openssh.com" : |
| 733 | "SSH2_FXP_RENAME", oldpath, newpath); | ||
| 647 | buffer_free(&msg); | 734 | buffer_free(&msg); |
| 648 | 735 | ||
| 649 | status = get_status(conn->fd_in, id); | 736 | status = get_status(conn->fd_in, id); |
| @@ -686,6 +773,7 @@ do_symlink(struct sftp_conn *conn, char *oldpath, char *newpath) | |||
| 686 | return(status); | 773 | return(status); |
| 687 | } | 774 | } |
| 688 | 775 | ||
| 776 | #ifdef notyet | ||
| 689 | char * | 777 | char * |
| 690 | do_readlink(struct sftp_conn *conn, char *path) | 778 | do_readlink(struct sftp_conn *conn, char *path) |
| 691 | { | 779 | { |
| @@ -732,6 +820,61 @@ do_readlink(struct sftp_conn *conn, char *path) | |||
| 732 | 820 | ||
| 733 | return(filename); | 821 | return(filename); |
| 734 | } | 822 | } |
| 823 | #endif | ||
| 824 | |||
| 825 | int | ||
| 826 | do_statvfs(struct sftp_conn *conn, const char *path, struct sftp_statvfs *st, | ||
| 827 | int quiet) | ||
| 828 | { | ||
| 829 | Buffer msg; | ||
| 830 | u_int id; | ||
| 831 | |||
| 832 | if ((conn->exts & SFTP_EXT_STATVFS) == 0) { | ||
| 833 | error("Server does not support statvfs@openssh.com extension"); | ||
| 834 | return -1; | ||
| 835 | } | ||
| 836 | |||
| 837 | id = conn->msg_id++; | ||
| 838 | |||
| 839 | buffer_init(&msg); | ||
| 840 | buffer_clear(&msg); | ||
| 841 | buffer_put_char(&msg, SSH2_FXP_EXTENDED); | ||
| 842 | buffer_put_int(&msg, id); | ||
| 843 | buffer_put_cstring(&msg, "statvfs@openssh.com"); | ||
| 844 | buffer_put_cstring(&msg, path); | ||
| 845 | send_msg(conn->fd_out, &msg); | ||
| 846 | buffer_free(&msg); | ||
| 847 | |||
| 848 | return get_decode_statvfs(conn->fd_in, st, id, quiet); | ||
| 849 | } | ||
| 850 | |||
| 851 | #ifdef notyet | ||
| 852 | int | ||
| 853 | do_fstatvfs(struct sftp_conn *conn, const char *handle, u_int handle_len, | ||
| 854 | struct sftp_statvfs *st, int quiet) | ||
| 855 | { | ||
| 856 | Buffer msg; | ||
| 857 | u_int id; | ||
| 858 | |||
| 859 | if ((conn->exts & SFTP_EXT_FSTATVFS) == 0) { | ||
| 860 | error("Server does not support fstatvfs@openssh.com extension"); | ||
| 861 | return -1; | ||
| 862 | } | ||
| 863 | |||
| 864 | id = conn->msg_id++; | ||
| 865 | |||
| 866 | buffer_init(&msg); | ||
| 867 | buffer_clear(&msg); | ||
| 868 | buffer_put_char(&msg, SSH2_FXP_EXTENDED); | ||
| 869 | buffer_put_int(&msg, id); | ||
| 870 | buffer_put_cstring(&msg, "fstatvfs@openssh.com"); | ||
| 871 | buffer_put_string(&msg, handle, handle_len); | ||
| 872 | send_msg(conn->fd_out, &msg); | ||
| 873 | buffer_free(&msg); | ||
| 874 | |||
| 875 | return get_decode_statvfs(conn->fd_in, st, id, quiet); | ||
| 876 | } | ||
| 877 | #endif | ||
| 735 | 878 | ||
| 736 | static void | 879 | static void |
| 737 | send_read_request(int fd_out, u_int id, u_int64_t offset, u_int len, | 880 | send_read_request(int fd_out, u_int id, u_int64_t offset, u_int len, |
| @@ -777,7 +920,7 @@ do_download(struct sftp_conn *conn, char *remote_path, char *local_path, | |||
| 777 | if (a == NULL) | 920 | if (a == NULL) |
| 778 | return(-1); | 921 | return(-1); |
| 779 | 922 | ||
| 780 | /* XXX: should we preserve set[ug]id? */ | 923 | /* Do not preserve set[ug]id here, as we do not preserve ownership */ |
| 781 | if (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) | 924 | if (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) |
| 782 | mode = a->perm & 0777; | 925 | mode = a->perm & 0777; |
| 783 | else | 926 | else |
| @@ -819,6 +962,7 @@ do_download(struct sftp_conn *conn, char *remote_path, char *local_path, | |||
| 819 | if (local_fd == -1) { | 962 | if (local_fd == -1) { |
| 820 | error("Couldn't open local file \"%s\" for writing: %s", | 963 | error("Couldn't open local file \"%s\" for writing: %s", |
| 821 | local_path, strerror(errno)); | 964 | local_path, strerror(errno)); |
| 965 | do_close(conn, handle, handle_len); | ||
| 822 | buffer_free(&msg); | 966 | buffer_free(&msg); |
| 823 | xfree(handle); | 967 | xfree(handle); |
| 824 | return(-1); | 968 | return(-1); |
| @@ -992,9 +1136,10 @@ int | |||
| 992 | do_upload(struct sftp_conn *conn, char *local_path, char *remote_path, | 1136 | do_upload(struct sftp_conn *conn, char *local_path, char *remote_path, |
| 993 | int pflag) | 1137 | int pflag) |
| 994 | { | 1138 | { |
| 995 | int local_fd, status; | 1139 | int local_fd; |
| 1140 | int status = SSH2_FX_OK; | ||
| 996 | u_int handle_len, id, type; | 1141 | u_int handle_len, id, type; |
| 997 | u_int64_t offset; | 1142 | off_t offset; |
| 998 | char *handle, *data; | 1143 | char *handle, *data; |
| 999 | Buffer msg; | 1144 | Buffer msg; |
| 1000 | struct stat sb; | 1145 | struct stat sb; |
| @@ -1004,7 +1149,7 @@ do_upload(struct sftp_conn *conn, char *local_path, char *remote_path, | |||
| 1004 | struct outstanding_ack { | 1149 | struct outstanding_ack { |
| 1005 | u_int id; | 1150 | u_int id; |
| 1006 | u_int len; | 1151 | u_int len; |
| 1007 | u_int64_t offset; | 1152 | off_t offset; |
| 1008 | TAILQ_ENTRY(outstanding_ack) tq; | 1153 | TAILQ_ENTRY(outstanding_ack) tq; |
| 1009 | }; | 1154 | }; |
| 1010 | TAILQ_HEAD(ackhead, outstanding_ack) acks; | 1155 | TAILQ_HEAD(ackhead, outstanding_ack) acks; |
| @@ -1054,7 +1199,7 @@ do_upload(struct sftp_conn *conn, char *local_path, char *remote_path, | |||
| 1054 | if (handle == NULL) { | 1199 | if (handle == NULL) { |
| 1055 | close(local_fd); | 1200 | close(local_fd); |
| 1056 | buffer_free(&msg); | 1201 | buffer_free(&msg); |
| 1057 | return(-1); | 1202 | return -1; |
| 1058 | } | 1203 | } |
| 1059 | 1204 | ||
| 1060 | startid = ackid = id + 1; | 1205 | startid = ackid = id + 1; |
| @@ -1074,11 +1219,12 @@ do_upload(struct sftp_conn *conn, char *local_path, char *remote_path, | |||
| 1074 | * Simulate an EOF on interrupt, allowing ACKs from the | 1219 | * Simulate an EOF on interrupt, allowing ACKs from the |
| 1075 | * server to drain. | 1220 | * server to drain. |
| 1076 | */ | 1221 | */ |
| 1077 | if (interrupted) | 1222 | if (interrupted || status != SSH2_FX_OK) |
| 1078 | len = 0; | 1223 | len = 0; |
| 1079 | else do | 1224 | else do |
| 1080 | len = read(local_fd, data, conn->transfer_buflen); | 1225 | len = read(local_fd, data, conn->transfer_buflen); |
| 1081 | while ((len == -1) && (errno == EINTR || errno == EAGAIN)); | 1226 | while ((len == -1) && |
| 1227 | (errno == EINTR || errno == EAGAIN || errno == EWOULDBLOCK)); | ||
| 1082 | 1228 | ||
| 1083 | if (len == -1) | 1229 | if (len == -1) |
| 1084 | fatal("Couldn't read from \"%s\": %s", local_path, | 1230 | fatal("Couldn't read from \"%s\": %s", local_path, |
| @@ -1130,46 +1276,40 @@ do_upload(struct sftp_conn *conn, char *local_path, char *remote_path, | |||
| 1130 | if (ack == NULL) | 1276 | if (ack == NULL) |
| 1131 | fatal("Can't find request for ID %u", r_id); | 1277 | fatal("Can't find request for ID %u", r_id); |
| 1132 | TAILQ_REMOVE(&acks, ack, tq); | 1278 | TAILQ_REMOVE(&acks, ack, tq); |
| 1133 | 1279 | debug3("In write loop, ack for %u %u bytes at %lld", | |
| 1134 | if (status != SSH2_FX_OK) { | 1280 | ack->id, ack->len, (long long)ack->offset); |
| 1135 | error("Couldn't write to remote file \"%s\": %s", | ||
| 1136 | remote_path, fx2txt(status)); | ||
| 1137 | if (showprogress) | ||
| 1138 | stop_progress_meter(); | ||
| 1139 | do_close(conn, handle, handle_len); | ||
| 1140 | close(local_fd); | ||
| 1141 | xfree(data); | ||
| 1142 | xfree(ack); | ||
| 1143 | status = -1; | ||
| 1144 | goto done; | ||
| 1145 | } | ||
| 1146 | debug3("In write loop, ack for %u %u bytes at %llu", | ||
| 1147 | ack->id, ack->len, (unsigned long long)ack->offset); | ||
| 1148 | ++ackid; | 1281 | ++ackid; |
| 1149 | xfree(ack); | 1282 | xfree(ack); |
| 1150 | } | 1283 | } |
| 1151 | offset += len; | 1284 | offset += len; |
| 1285 | if (offset < 0) | ||
| 1286 | fatal("%s: offset < 0", __func__); | ||
| 1152 | } | 1287 | } |
| 1288 | buffer_free(&msg); | ||
| 1289 | |||
| 1153 | if (showprogress) | 1290 | if (showprogress) |
| 1154 | stop_progress_meter(); | 1291 | stop_progress_meter(); |
| 1155 | xfree(data); | 1292 | xfree(data); |
| 1156 | 1293 | ||
| 1294 | if (status != SSH2_FX_OK) { | ||
| 1295 | error("Couldn't write to remote file \"%s\": %s", | ||
| 1296 | remote_path, fx2txt(status)); | ||
| 1297 | status = -1; | ||
| 1298 | } | ||
| 1299 | |||
| 1157 | if (close(local_fd) == -1) { | 1300 | if (close(local_fd) == -1) { |
| 1158 | error("Couldn't close local file \"%s\": %s", local_path, | 1301 | error("Couldn't close local file \"%s\": %s", local_path, |
| 1159 | strerror(errno)); | 1302 | strerror(errno)); |
| 1160 | do_close(conn, handle, handle_len); | ||
| 1161 | status = -1; | 1303 | status = -1; |
| 1162 | goto done; | ||
| 1163 | } | 1304 | } |
| 1164 | 1305 | ||
| 1165 | /* Override umask and utimes if asked */ | 1306 | /* Override umask and utimes if asked */ |
| 1166 | if (pflag) | 1307 | if (pflag) |
| 1167 | do_fsetstat(conn, handle, handle_len, &a); | 1308 | do_fsetstat(conn, handle, handle_len, &a); |
| 1168 | 1309 | ||
| 1169 | status = do_close(conn, handle, handle_len); | 1310 | if (do_close(conn, handle, handle_len) != SSH2_FX_OK) |
| 1170 | 1311 | status = -1; | |
| 1171 | done: | ||
| 1172 | xfree(handle); | 1312 | xfree(handle); |
| 1173 | buffer_free(&msg); | 1313 | |
| 1174 | return(status); | 1314 | return status; |
| 1175 | } | 1315 | } |
diff --git a/sftp-client.h b/sftp-client.h index c8a41f377..edb46790f 100644 --- a/sftp-client.h +++ b/sftp-client.h | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: sftp-client.h,v 1.14 2005/04/26 12:59:02 jmc Exp $ */ | 1 | /* $OpenBSD: sftp-client.h,v 1.17 2008/06/08 20:15:29 dtucker Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Copyright (c) 2001-2004 Damien Miller <djm@openbsd.org> | 4 | * Copyright (c) 2001-2004 Damien Miller <djm@openbsd.org> |
| @@ -30,6 +30,24 @@ struct SFTP_DIRENT { | |||
| 30 | }; | 30 | }; |
| 31 | 31 | ||
| 32 | /* | 32 | /* |
| 33 | * Used for statvfs responses on the wire from the server, because the | ||
| 34 | * server's native format may be larger than the client's. | ||
| 35 | */ | ||
| 36 | struct sftp_statvfs { | ||
| 37 | u_int64_t f_bsize; | ||
| 38 | u_int64_t f_frsize; | ||
| 39 | u_int64_t f_blocks; | ||
| 40 | u_int64_t f_bfree; | ||
| 41 | u_int64_t f_bavail; | ||
| 42 | u_int64_t f_files; | ||
| 43 | u_int64_t f_ffree; | ||
| 44 | u_int64_t f_favail; | ||
| 45 | u_int64_t f_fsid; | ||
| 46 | u_int64_t f_flag; | ||
| 47 | u_int64_t f_namemax; | ||
| 48 | }; | ||
| 49 | |||
| 50 | /* | ||
| 33 | * Initialise a SSH filexfer connection. Returns NULL on error or | 51 | * Initialise a SSH filexfer connection. Returns NULL on error or |
| 34 | * a pointer to a initialized sftp_conn struct on success. | 52 | * a pointer to a initialized sftp_conn struct on success. |
| 35 | */ | 53 | */ |
| @@ -61,9 +79,6 @@ Attrib *do_stat(struct sftp_conn *, char *, int); | |||
| 61 | /* Get file attributes of 'path' (does not follow symlinks) */ | 79 | /* Get file attributes of 'path' (does not follow symlinks) */ |
| 62 | Attrib *do_lstat(struct sftp_conn *, char *, int); | 80 | Attrib *do_lstat(struct sftp_conn *, char *, int); |
| 63 | 81 | ||
| 64 | /* Get file attributes of open file 'handle' */ | ||
| 65 | Attrib *do_fstat(struct sftp_conn *, char *, u_int, int); | ||
| 66 | |||
| 67 | /* Set file attributes of 'path' */ | 82 | /* Set file attributes of 'path' */ |
| 68 | int do_setstat(struct sftp_conn *, char *, Attrib *); | 83 | int do_setstat(struct sftp_conn *, char *, Attrib *); |
| 69 | 84 | ||
| @@ -73,15 +88,15 @@ int do_fsetstat(struct sftp_conn *, char *, u_int, Attrib *); | |||
| 73 | /* Canonicalise 'path' - caller must free result */ | 88 | /* Canonicalise 'path' - caller must free result */ |
| 74 | char *do_realpath(struct sftp_conn *, char *); | 89 | char *do_realpath(struct sftp_conn *, char *); |
| 75 | 90 | ||
| 91 | /* Get statistics for filesystem hosting file at "path" */ | ||
| 92 | int do_statvfs(struct sftp_conn *, const char *, struct sftp_statvfs *, int); | ||
| 93 | |||
| 76 | /* Rename 'oldpath' to 'newpath' */ | 94 | /* Rename 'oldpath' to 'newpath' */ |
| 77 | int do_rename(struct sftp_conn *, char *, char *); | 95 | int do_rename(struct sftp_conn *, char *, char *); |
| 78 | 96 | ||
| 79 | /* Rename 'oldpath' to 'newpath' */ | 97 | /* Rename 'oldpath' to 'newpath' */ |
| 80 | int do_symlink(struct sftp_conn *, char *, char *); | 98 | int do_symlink(struct sftp_conn *, char *, char *); |
| 81 | 99 | ||
| 82 | /* Return target of symlink 'path' - caller must free result */ | ||
| 83 | char *do_readlink(struct sftp_conn *, char *); | ||
| 84 | |||
| 85 | /* XXX: add callbacks to do_download/do_upload so we can do progress meter */ | 100 | /* XXX: add callbacks to do_download/do_upload so we can do progress meter */ |
| 86 | 101 | ||
| 87 | /* | 102 | /* |
diff --git a/sftp-server-main.c b/sftp-server-main.c new file mode 100644 index 000000000..2b14569e4 --- /dev/null +++ b/sftp-server-main.c | |||
| @@ -0,0 +1,50 @@ | |||
| 1 | /* $OpenBSD: sftp-server-main.c,v 1.3 2008/03/26 23:44:41 djm Exp $ */ | ||
| 2 | /* | ||
| 3 | * Copyright (c) 2008 Markus Friedl. All rights reserved. | ||
| 4 | * | ||
| 5 | * Permission to use, copy, modify, and distribute this software for any | ||
| 6 | * purpose with or without fee is hereby granted, provided that the above | ||
| 7 | * copyright notice and this permission notice appear in all copies. | ||
| 8 | * | ||
| 9 | * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES | ||
| 10 | * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF | ||
| 11 | * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR | ||
| 12 | * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES | ||
| 13 | * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN | ||
| 14 | * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF | ||
| 15 | * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. | ||
| 16 | */ | ||
| 17 | |||
| 18 | #include "includes.h" | ||
| 19 | |||
| 20 | #include <sys/types.h> | ||
| 21 | #include <pwd.h> | ||
| 22 | #include <stdarg.h> | ||
| 23 | #include <stdio.h> | ||
| 24 | #include <unistd.h> | ||
| 25 | |||
| 26 | #include "log.h" | ||
| 27 | #include "sftp.h" | ||
| 28 | #include "misc.h" | ||
| 29 | |||
| 30 | void | ||
| 31 | cleanup_exit(int i) | ||
| 32 | { | ||
| 33 | sftp_server_cleanup_exit(i); | ||
| 34 | } | ||
| 35 | |||
| 36 | int | ||
| 37 | main(int argc, char **argv) | ||
| 38 | { | ||
| 39 | struct passwd *user_pw; | ||
| 40 | |||
| 41 | /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */ | ||
| 42 | sanitise_stdfd(); | ||
| 43 | |||
| 44 | if ((user_pw = getpwuid(getuid())) == NULL) { | ||
| 45 | fprintf(stderr, "No user found for uid %lu", (u_long)getuid()); | ||
| 46 | return 1; | ||
| 47 | } | ||
| 48 | |||
| 49 | return (sftp_server_main(argc, argv, user_pw)); | ||
| 50 | } | ||
diff --git a/sftp-server.0 b/sftp-server.0 index 0837fff9b..941e99e14 100644 --- a/sftp-server.0 +++ b/sftp-server.0 | |||
| @@ -31,6 +31,10 @@ DESCRIPTION | |||
| 31 | are equivalent. DEBUG2 and DEBUG3 each specify higher levels of | 31 | are equivalent. DEBUG2 and DEBUG3 each specify higher levels of |
| 32 | debugging output. The default is ERROR. | 32 | debugging output. The default is ERROR. |
| 33 | 33 | ||
| 34 | For logging to work, sftp-server must be able to access /dev/log. Use of | ||
| 35 | sftp-server in a chroot configuation therefore requires that syslogd(8) | ||
| 36 | establish a logging socket inside the chroot directory. | ||
| 37 | |||
| 34 | SEE ALSO | 38 | SEE ALSO |
| 35 | sftp(1), ssh(1), sshd_config(5), sshd(8) | 39 | sftp(1), ssh(1), sshd_config(5), sshd(8) |
| 36 | 40 | ||
| @@ -43,4 +47,4 @@ HISTORY | |||
| 43 | AUTHORS | 47 | AUTHORS |
| 44 | Markus Friedl <markus@openbsd.org> | 48 | Markus Friedl <markus@openbsd.org> |
| 45 | 49 | ||
| 46 | OpenBSD 4.2 June 5, 2007 1 | 50 | OpenBSD 4.4 July 18, 2008 1 |
diff --git a/sftp-server.8 b/sftp-server.8 index 41c0f7664..161773597 100644 --- a/sftp-server.8 +++ b/sftp-server.8 | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | .\" $OpenBSD: sftp-server.8,v 1.12 2007/05/31 19:20:16 jmc Exp $ | 1 | .\" $OpenBSD: sftp-server.8,v 1.14 2008/07/18 22:51:01 jmc Exp $ |
| 2 | .\" | 2 | .\" |
| 3 | .\" Copyright (c) 2000 Markus Friedl. All rights reserved. | 3 | .\" Copyright (c) 2000 Markus Friedl. All rights reserved. |
| 4 | .\" | 4 | .\" |
| @@ -22,7 +22,7 @@ | |||
| 22 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | 22 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
| 23 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | 23 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| 24 | .\" | 24 | .\" |
| 25 | .Dd $Mdocdate: June 5 2007 $ | 25 | .Dd $Mdocdate: July 18 2008 $ |
| 26 | .Dt SFTP-SERVER 8 | 26 | .Dt SFTP-SERVER 8 |
| 27 | .Os | 27 | .Os |
| 28 | .Sh NAME | 28 | .Sh NAME |
| @@ -72,6 +72,16 @@ DEBUG and DEBUG1 are equivalent. | |||
| 72 | DEBUG2 and DEBUG3 each specify higher levels of debugging output. | 72 | DEBUG2 and DEBUG3 each specify higher levels of debugging output. |
| 73 | The default is ERROR. | 73 | The default is ERROR. |
| 74 | .El | 74 | .El |
| 75 | .Pp | ||
| 76 | For logging to work, | ||
| 77 | .Nm | ||
| 78 | must be able to access | ||
| 79 | .Pa /dev/log . | ||
| 80 | Use of | ||
| 81 | .Nm | ||
| 82 | in a chroot configuation therefore requires that | ||
| 83 | .Xr syslogd 8 | ||
| 84 | establish a logging socket inside the chroot directory. | ||
| 75 | .Sh SEE ALSO | 85 | .Sh SEE ALSO |
| 76 | .Xr sftp 1 , | 86 | .Xr sftp 1 , |
| 77 | .Xr ssh 1 , | 87 | .Xr ssh 1 , |
diff --git a/sftp-server.c b/sftp-server.c index 76edebc5a..24c4ff717 100644 --- a/sftp-server.c +++ b/sftp-server.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: sftp-server.c,v 1.73 2007/05/17 07:55:29 djm Exp $ */ | 1 | /* $OpenBSD: sftp-server.c,v 1.84 2008/06/26 06:10:09 djm Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Copyright (c) 2000-2004 Markus Friedl. All rights reserved. | 3 | * Copyright (c) 2000-2004 Markus Friedl. All rights reserved. |
| 4 | * | 4 | * |
| @@ -23,6 +23,12 @@ | |||
| 23 | #ifdef HAVE_SYS_TIME_H | 23 | #ifdef HAVE_SYS_TIME_H |
| 24 | # include <sys/time.h> | 24 | # include <sys/time.h> |
| 25 | #endif | 25 | #endif |
| 26 | #ifdef HAVE_SYS_MOUNT_H | ||
| 27 | #include <sys/mount.h> | ||
| 28 | #endif | ||
| 29 | #ifdef HAVE_SYS_STATVFS_H | ||
| 30 | #include <sys/statvfs.h> | ||
| 31 | #endif | ||
| 26 | 32 | ||
| 27 | #include <dirent.h> | 33 | #include <dirent.h> |
| 28 | #include <errno.h> | 34 | #include <errno.h> |
| @@ -98,6 +104,9 @@ errno_to_portable(int unixerrno) | |||
| 98 | case EINVAL: | 104 | case EINVAL: |
| 99 | ret = SSH2_FX_BAD_MESSAGE; | 105 | ret = SSH2_FX_BAD_MESSAGE; |
| 100 | break; | 106 | break; |
| 107 | case ENOSYS: | ||
| 108 | ret = SSH2_FX_OP_UNSUPPORTED; | ||
| 109 | break; | ||
| 101 | default: | 110 | default: |
| 102 | ret = SSH2_FX_FAILURE; | 111 | ret = SSH2_FX_FAILURE; |
| 103 | break; | 112 | break; |
| @@ -169,6 +178,7 @@ struct Handle { | |||
| 169 | int fd; | 178 | int fd; |
| 170 | char *name; | 179 | char *name; |
| 171 | u_int64_t bytes_read, bytes_write; | 180 | u_int64_t bytes_read, bytes_write; |
| 181 | int next_unused; | ||
| 172 | }; | 182 | }; |
| 173 | 183 | ||
| 174 | enum { | 184 | enum { |
| @@ -177,40 +187,46 @@ enum { | |||
| 177 | HANDLE_FILE | 187 | HANDLE_FILE |
| 178 | }; | 188 | }; |
| 179 | 189 | ||
| 180 | Handle handles[100]; | 190 | Handle *handles = NULL; |
| 191 | u_int num_handles = 0; | ||
| 192 | int first_unused_handle = -1; | ||
| 181 | 193 | ||
| 182 | static void | 194 | static void handle_unused(int i) |
| 183 | handle_init(void) | ||
| 184 | { | 195 | { |
| 185 | u_int i; | 196 | handles[i].use = HANDLE_UNUSED; |
| 186 | 197 | handles[i].next_unused = first_unused_handle; | |
| 187 | for (i = 0; i < sizeof(handles)/sizeof(Handle); i++) | 198 | first_unused_handle = i; |
| 188 | handles[i].use = HANDLE_UNUSED; | ||
| 189 | } | 199 | } |
| 190 | 200 | ||
| 191 | static int | 201 | static int |
| 192 | handle_new(int use, const char *name, int fd, DIR *dirp) | 202 | handle_new(int use, const char *name, int fd, DIR *dirp) |
| 193 | { | 203 | { |
| 194 | u_int i; | 204 | int i; |
| 195 | 205 | ||
| 196 | for (i = 0; i < sizeof(handles)/sizeof(Handle); i++) { | 206 | if (first_unused_handle == -1) { |
| 197 | if (handles[i].use == HANDLE_UNUSED) { | 207 | if (num_handles + 1 <= num_handles) |
| 198 | handles[i].use = use; | 208 | return -1; |
| 199 | handles[i].dirp = dirp; | 209 | num_handles++; |
| 200 | handles[i].fd = fd; | 210 | handles = xrealloc(handles, num_handles, sizeof(Handle)); |
| 201 | handles[i].name = xstrdup(name); | 211 | handle_unused(num_handles - 1); |
| 202 | handles[i].bytes_read = handles[i].bytes_write = 0; | ||
| 203 | return i; | ||
| 204 | } | ||
| 205 | } | 212 | } |
| 206 | return -1; | 213 | |
| 214 | i = first_unused_handle; | ||
| 215 | first_unused_handle = handles[i].next_unused; | ||
| 216 | |||
| 217 | handles[i].use = use; | ||
| 218 | handles[i].dirp = dirp; | ||
| 219 | handles[i].fd = fd; | ||
| 220 | handles[i].name = xstrdup(name); | ||
| 221 | handles[i].bytes_read = handles[i].bytes_write = 0; | ||
| 222 | |||
| 223 | return i; | ||
| 207 | } | 224 | } |
| 208 | 225 | ||
| 209 | static int | 226 | static int |
| 210 | handle_is_ok(int i, int type) | 227 | handle_is_ok(int i, int type) |
| 211 | { | 228 | { |
| 212 | return i >= 0 && (u_int)i < sizeof(handles)/sizeof(Handle) && | 229 | return i >= 0 && (u_int)i < num_handles && handles[i].use == type; |
| 213 | handles[i].use == type; | ||
| 214 | } | 230 | } |
| 215 | 231 | ||
| 216 | static int | 232 | static int |
| @@ -300,12 +316,12 @@ handle_close(int handle) | |||
| 300 | 316 | ||
| 301 | if (handle_is_ok(handle, HANDLE_FILE)) { | 317 | if (handle_is_ok(handle, HANDLE_FILE)) { |
| 302 | ret = close(handles[handle].fd); | 318 | ret = close(handles[handle].fd); |
| 303 | handles[handle].use = HANDLE_UNUSED; | ||
| 304 | xfree(handles[handle].name); | 319 | xfree(handles[handle].name); |
| 320 | handle_unused(handle); | ||
| 305 | } else if (handle_is_ok(handle, HANDLE_DIR)) { | 321 | } else if (handle_is_ok(handle, HANDLE_DIR)) { |
| 306 | ret = closedir(handles[handle].dirp); | 322 | ret = closedir(handles[handle].dirp); |
| 307 | handles[handle].use = HANDLE_UNUSED; | ||
| 308 | xfree(handles[handle].name); | 323 | xfree(handles[handle].name); |
| 324 | handle_unused(handle); | ||
| 309 | } else { | 325 | } else { |
| 310 | errno = ENOENT; | 326 | errno = ENOENT; |
| 311 | } | 327 | } |
| @@ -333,7 +349,7 @@ handle_log_exit(void) | |||
| 333 | { | 349 | { |
| 334 | u_int i; | 350 | u_int i; |
| 335 | 351 | ||
| 336 | for (i = 0; i < sizeof(handles)/sizeof(Handle); i++) | 352 | for (i = 0; i < num_handles; i++) |
| 337 | if (handles[i].use != HANDLE_UNUSED) | 353 | if (handles[i].use != HANDLE_UNUSED) |
| 338 | handle_log_close(i, "forced"); | 354 | handle_log_close(i, "forced"); |
| 339 | } | 355 | } |
| @@ -468,6 +484,33 @@ send_attrib(u_int32_t id, const Attrib *a) | |||
| 468 | buffer_free(&msg); | 484 | buffer_free(&msg); |
| 469 | } | 485 | } |
| 470 | 486 | ||
| 487 | static void | ||
| 488 | send_statvfs(u_int32_t id, struct statvfs *st) | ||
| 489 | { | ||
| 490 | Buffer msg; | ||
| 491 | u_int64_t flag; | ||
| 492 | |||
| 493 | flag = (st->f_flag & ST_RDONLY) ? SSH2_FXE_STATVFS_ST_RDONLY : 0; | ||
| 494 | flag |= (st->f_flag & ST_NOSUID) ? SSH2_FXE_STATVFS_ST_NOSUID : 0; | ||
| 495 | |||
| 496 | buffer_init(&msg); | ||
| 497 | buffer_put_char(&msg, SSH2_FXP_EXTENDED_REPLY); | ||
| 498 | buffer_put_int(&msg, id); | ||
| 499 | buffer_put_int64(&msg, st->f_bsize); | ||
| 500 | buffer_put_int64(&msg, st->f_frsize); | ||
| 501 | buffer_put_int64(&msg, st->f_blocks); | ||
| 502 | buffer_put_int64(&msg, st->f_bfree); | ||
| 503 | buffer_put_int64(&msg, st->f_bavail); | ||
| 504 | buffer_put_int64(&msg, st->f_files); | ||
| 505 | buffer_put_int64(&msg, st->f_ffree); | ||
| 506 | buffer_put_int64(&msg, st->f_favail); | ||
| 507 | buffer_put_int64(&msg, FSID_TO_ULONG(st->f_fsid)); | ||
| 508 | buffer_put_int64(&msg, flag); | ||
| 509 | buffer_put_int64(&msg, st->f_namemax); | ||
| 510 | send_msg(&msg); | ||
| 511 | buffer_free(&msg); | ||
| 512 | } | ||
| 513 | |||
| 471 | /* parse incoming */ | 514 | /* parse incoming */ |
| 472 | 515 | ||
| 473 | static void | 516 | static void |
| @@ -480,6 +523,15 @@ process_init(void) | |||
| 480 | buffer_init(&msg); | 523 | buffer_init(&msg); |
| 481 | buffer_put_char(&msg, SSH2_FXP_VERSION); | 524 | buffer_put_char(&msg, SSH2_FXP_VERSION); |
| 482 | buffer_put_int(&msg, SSH2_FILEXFER_VERSION); | 525 | buffer_put_int(&msg, SSH2_FILEXFER_VERSION); |
| 526 | /* POSIX rename extension */ | ||
| 527 | buffer_put_cstring(&msg, "posix-rename@openssh.com"); | ||
| 528 | buffer_put_cstring(&msg, "1"); /* version */ | ||
| 529 | /* statvfs extension */ | ||
| 530 | buffer_put_cstring(&msg, "statvfs@openssh.com"); | ||
| 531 | buffer_put_cstring(&msg, "2"); /* version */ | ||
| 532 | /* fstatvfs extension */ | ||
| 533 | buffer_put_cstring(&msg, "fstatvfs@openssh.com"); | ||
| 534 | buffer_put_cstring(&msg, "2"); /* version */ | ||
| 483 | send_msg(&msg); | 535 | send_msg(&msg); |
| 484 | buffer_free(&msg); | 536 | buffer_free(&msg); |
| 485 | } | 537 | } |
| @@ -711,7 +763,7 @@ process_setstat(void) | |||
| 711 | } | 763 | } |
| 712 | if (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) { | 764 | if (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) { |
| 713 | logit("set \"%s\" mode %04o", name, a->perm); | 765 | logit("set \"%s\" mode %04o", name, a->perm); |
| 714 | ret = chmod(name, a->perm & 0777); | 766 | ret = chmod(name, a->perm & 07777); |
| 715 | if (ret == -1) | 767 | if (ret == -1) |
| 716 | status = errno_to_portable(errno); | 768 | status = errno_to_portable(errno); |
| 717 | } | 769 | } |
| @@ -765,9 +817,9 @@ process_fsetstat(void) | |||
| 765 | if (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) { | 817 | if (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) { |
| 766 | logit("set \"%s\" mode %04o", name, a->perm); | 818 | logit("set \"%s\" mode %04o", name, a->perm); |
| 767 | #ifdef HAVE_FCHMOD | 819 | #ifdef HAVE_FCHMOD |
| 768 | ret = fchmod(fd, a->perm & 0777); | 820 | ret = fchmod(fd, a->perm & 07777); |
| 769 | #else | 821 | #else |
| 770 | ret = chmod(name, a->perm & 0777); | 822 | ret = chmod(name, a->perm & 07777); |
| 771 | #endif | 823 | #endif |
| 772 | if (ret == -1) | 824 | if (ret == -1) |
| 773 | status = errno_to_portable(errno); | 825 | status = errno_to_portable(errno); |
| @@ -918,7 +970,7 @@ process_mkdir(void) | |||
| 918 | name = get_string(NULL); | 970 | name = get_string(NULL); |
| 919 | a = get_attrib(); | 971 | a = get_attrib(); |
| 920 | mode = (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? | 972 | mode = (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? |
| 921 | a->perm & 0777 : 0777; | 973 | a->perm & 07777 : 0777; |
| 922 | debug3("request %u: mkdir", id); | 974 | debug3("request %u: mkdir", id); |
| 923 | logit("mkdir name \"%s\" mode 0%o", name, mode); | 975 | logit("mkdir name \"%s\" mode 0%o", name, mode); |
| 924 | ret = mkdir(name, mode); | 976 | ret = mkdir(name, mode); |
| @@ -990,6 +1042,9 @@ process_rename(void) | |||
| 990 | /* Race-free rename of regular files */ | 1042 | /* Race-free rename of regular files */ |
| 991 | if (link(oldpath, newpath) == -1) { | 1043 | if (link(oldpath, newpath) == -1) { |
| 992 | if (errno == EOPNOTSUPP | 1044 | if (errno == EOPNOTSUPP |
| 1045 | #ifdef EXDEV | ||
| 1046 | || errno == EXDEV | ||
| 1047 | #endif | ||
| 993 | #ifdef LINK_OPNOTSUPP_ERRNO | 1048 | #ifdef LINK_OPNOTSUPP_ERRNO |
| 994 | || errno == LINK_OPNOTSUPP_ERRNO | 1049 | || errno == LINK_OPNOTSUPP_ERRNO |
| 995 | #endif | 1050 | #endif |
| @@ -1073,6 +1128,59 @@ process_symlink(void) | |||
| 1073 | } | 1128 | } |
| 1074 | 1129 | ||
| 1075 | static void | 1130 | static void |
| 1131 | process_extended_posix_rename(u_int32_t id) | ||
| 1132 | { | ||
| 1133 | char *oldpath, *newpath; | ||
| 1134 | |||
| 1135 | oldpath = get_string(NULL); | ||
| 1136 | newpath = get_string(NULL); | ||
| 1137 | debug3("request %u: posix-rename", id); | ||
| 1138 | logit("posix-rename old \"%s\" new \"%s\"", oldpath, newpath); | ||
| 1139 | if (rename(oldpath, newpath) == -1) | ||
| 1140 | send_status(id, errno_to_portable(errno)); | ||
| 1141 | else | ||
| 1142 | send_status(id, SSH2_FX_OK); | ||
| 1143 | xfree(oldpath); | ||
| 1144 | xfree(newpath); | ||
| 1145 | } | ||
| 1146 | |||
| 1147 | static void | ||
| 1148 | process_extended_statvfs(u_int32_t id) | ||
| 1149 | { | ||
| 1150 | char *path; | ||
| 1151 | struct statvfs st; | ||
| 1152 | |||
| 1153 | path = get_string(NULL); | ||
| 1154 | debug3("request %u: statfs", id); | ||
| 1155 | logit("statfs \"%s\"", path); | ||
| 1156 | |||
| 1157 | if (statvfs(path, &st) != 0) | ||
| 1158 | send_status(id, errno_to_portable(errno)); | ||
| 1159 | else | ||
| 1160 | send_statvfs(id, &st); | ||
| 1161 | xfree(path); | ||
| 1162 | } | ||
| 1163 | |||
| 1164 | static void | ||
| 1165 | process_extended_fstatvfs(u_int32_t id) | ||
| 1166 | { | ||
| 1167 | int handle, fd; | ||
| 1168 | struct statvfs st; | ||
| 1169 | |||
| 1170 | handle = get_handle(); | ||
| 1171 | debug("request %u: fstatvfs \"%s\" (handle %u)", | ||
| 1172 | id, handle_to_name(handle), handle); | ||
| 1173 | if ((fd = handle_to_fd(handle)) < 0) { | ||
| 1174 | send_status(id, SSH2_FX_FAILURE); | ||
| 1175 | return; | ||
| 1176 | } | ||
| 1177 | if (fstatvfs(fd, &st) != 0) | ||
| 1178 | send_status(id, errno_to_portable(errno)); | ||
| 1179 | else | ||
| 1180 | send_statvfs(id, &st); | ||
| 1181 | } | ||
| 1182 | |||
| 1183 | static void | ||
| 1076 | process_extended(void) | 1184 | process_extended(void) |
| 1077 | { | 1185 | { |
| 1078 | u_int32_t id; | 1186 | u_int32_t id; |
| @@ -1080,7 +1188,14 @@ process_extended(void) | |||
| 1080 | 1188 | ||
| 1081 | id = get_int(); | 1189 | id = get_int(); |
| 1082 | request = get_string(NULL); | 1190 | request = get_string(NULL); |
| 1083 | send_status(id, SSH2_FX_OP_UNSUPPORTED); /* MUST */ | 1191 | if (strcmp(request, "posix-rename@openssh.com") == 0) |
| 1192 | process_extended_posix_rename(id); | ||
| 1193 | else if (strcmp(request, "statvfs@openssh.com") == 0) | ||
| 1194 | process_extended_statvfs(id); | ||
| 1195 | else if (strcmp(request, "fstatvfs@openssh.com") == 0) | ||
| 1196 | process_extended_fstatvfs(id); | ||
| 1197 | else | ||
| 1198 | send_status(id, SSH2_FX_OP_UNSUPPORTED); /* MUST */ | ||
| 1084 | xfree(request); | 1199 | xfree(request); |
| 1085 | } | 1200 | } |
| 1086 | 1201 | ||
| @@ -1103,7 +1218,7 @@ process(void) | |||
| 1103 | if (msg_len > SFTP_MAX_MSG_LENGTH) { | 1218 | if (msg_len > SFTP_MAX_MSG_LENGTH) { |
| 1104 | error("bad message from %s local user %s", | 1219 | error("bad message from %s local user %s", |
| 1105 | client_addr, pw->pw_name); | 1220 | client_addr, pw->pw_name); |
| 1106 | cleanup_exit(11); | 1221 | sftp_server_cleanup_exit(11); |
| 1107 | } | 1222 | } |
| 1108 | if (buf_len < msg_len + 4) | 1223 | if (buf_len < msg_len + 4) |
| 1109 | return; | 1224 | return; |
| @@ -1176,18 +1291,22 @@ process(void) | |||
| 1176 | break; | 1291 | break; |
| 1177 | } | 1292 | } |
| 1178 | /* discard the remaining bytes from the current packet */ | 1293 | /* discard the remaining bytes from the current packet */ |
| 1179 | if (buf_len < buffer_len(&iqueue)) | 1294 | if (buf_len < buffer_len(&iqueue)) { |
| 1180 | fatal("iqueue grew unexpectedly"); | 1295 | error("iqueue grew unexpectedly"); |
| 1296 | sftp_server_cleanup_exit(255); | ||
| 1297 | } | ||
| 1181 | consumed = buf_len - buffer_len(&iqueue); | 1298 | consumed = buf_len - buffer_len(&iqueue); |
| 1182 | if (msg_len < consumed) | 1299 | if (msg_len < consumed) { |
| 1183 | fatal("msg_len %d < consumed %d", msg_len, consumed); | 1300 | error("msg_len %d < consumed %d", msg_len, consumed); |
| 1301 | sftp_server_cleanup_exit(255); | ||
| 1302 | } | ||
| 1184 | if (msg_len > consumed) | 1303 | if (msg_len > consumed) |
| 1185 | buffer_consume(&iqueue, msg_len - consumed); | 1304 | buffer_consume(&iqueue, msg_len - consumed); |
| 1186 | } | 1305 | } |
| 1187 | 1306 | ||
| 1188 | /* Cleanup handler that logs active handles upon normal exit */ | 1307 | /* Cleanup handler that logs active handles upon normal exit */ |
| 1189 | void | 1308 | void |
| 1190 | cleanup_exit(int i) | 1309 | sftp_server_cleanup_exit(int i) |
| 1191 | { | 1310 | { |
| 1192 | if (pw != NULL && client_addr != NULL) { | 1311 | if (pw != NULL && client_addr != NULL) { |
| 1193 | handle_log_exit(); | 1312 | handle_log_exit(); |
| @@ -1198,7 +1317,7 @@ cleanup_exit(int i) | |||
| 1198 | } | 1317 | } |
| 1199 | 1318 | ||
| 1200 | static void | 1319 | static void |
| 1201 | usage(void) | 1320 | sftp_server_usage(void) |
| 1202 | { | 1321 | { |
| 1203 | extern char *__progname; | 1322 | extern char *__progname; |
| 1204 | 1323 | ||
| @@ -1208,7 +1327,7 @@ usage(void) | |||
| 1208 | } | 1327 | } |
| 1209 | 1328 | ||
| 1210 | int | 1329 | int |
| 1211 | main(int argc, char **argv) | 1330 | sftp_server_main(int argc, char **argv, struct passwd *user_pw) |
| 1212 | { | 1331 | { |
| 1213 | fd_set *rset, *wset; | 1332 | fd_set *rset, *wset; |
| 1214 | int in, out, max, ch, skipargs = 0, log_stderr = 0; | 1333 | int in, out, max, ch, skipargs = 0, log_stderr = 0; |
| @@ -1219,9 +1338,6 @@ main(int argc, char **argv) | |||
| 1219 | extern char *optarg; | 1338 | extern char *optarg; |
| 1220 | extern char *__progname; | 1339 | extern char *__progname; |
| 1221 | 1340 | ||
| 1222 | /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */ | ||
| 1223 | sanitise_stdfd(); | ||
| 1224 | |||
| 1225 | __progname = ssh_get_progname(argv[0]); | 1341 | __progname = ssh_get_progname(argv[0]); |
| 1226 | log_init(__progname, log_level, log_facility, log_stderr); | 1342 | log_init(__progname, log_level, log_facility, log_stderr); |
| 1227 | 1343 | ||
| @@ -1244,12 +1360,12 @@ main(int argc, char **argv) | |||
| 1244 | break; | 1360 | break; |
| 1245 | case 'f': | 1361 | case 'f': |
| 1246 | log_facility = log_facility_number(optarg); | 1362 | log_facility = log_facility_number(optarg); |
| 1247 | if (log_level == SYSLOG_FACILITY_NOT_SET) | 1363 | if (log_facility == SYSLOG_FACILITY_NOT_SET) |
| 1248 | error("Invalid log facility \"%s\"", optarg); | 1364 | error("Invalid log facility \"%s\"", optarg); |
| 1249 | break; | 1365 | break; |
| 1250 | case 'h': | 1366 | case 'h': |
| 1251 | default: | 1367 | default: |
| 1252 | usage(); | 1368 | sftp_server_usage(); |
| 1253 | } | 1369 | } |
| 1254 | } | 1370 | } |
| 1255 | 1371 | ||
| @@ -1257,22 +1373,20 @@ main(int argc, char **argv) | |||
| 1257 | 1373 | ||
| 1258 | if ((cp = getenv("SSH_CONNECTION")) != NULL) { | 1374 | if ((cp = getenv("SSH_CONNECTION")) != NULL) { |
| 1259 | client_addr = xstrdup(cp); | 1375 | client_addr = xstrdup(cp); |
| 1260 | if ((cp = strchr(client_addr, ' ')) == NULL) | 1376 | if ((cp = strchr(client_addr, ' ')) == NULL) { |
| 1261 | fatal("Malformed SSH_CONNECTION variable: \"%s\"", | 1377 | error("Malformed SSH_CONNECTION variable: \"%s\"", |
| 1262 | getenv("SSH_CONNECTION")); | 1378 | getenv("SSH_CONNECTION")); |
| 1379 | sftp_server_cleanup_exit(255); | ||
| 1380 | } | ||
| 1263 | *cp = '\0'; | 1381 | *cp = '\0'; |
| 1264 | } else | 1382 | } else |
| 1265 | client_addr = xstrdup("UNKNOWN"); | 1383 | client_addr = xstrdup("UNKNOWN"); |
| 1266 | 1384 | ||
| 1267 | if ((pw = getpwuid(getuid())) == NULL) | 1385 | pw = pwcopy(user_pw); |
| 1268 | fatal("No user found for uid %lu", (u_long)getuid()); | ||
| 1269 | pw = pwcopy(pw); | ||
| 1270 | 1386 | ||
| 1271 | logit("session opened for local user %s from [%s]", | 1387 | logit("session opened for local user %s from [%s]", |
| 1272 | pw->pw_name, client_addr); | 1388 | pw->pw_name, client_addr); |
| 1273 | 1389 | ||
| 1274 | handle_init(); | ||
| 1275 | |||
| 1276 | in = dup(STDIN_FILENO); | 1390 | in = dup(STDIN_FILENO); |
| 1277 | out = dup(STDOUT_FILENO); | 1391 | out = dup(STDOUT_FILENO); |
| 1278 | 1392 | ||
| @@ -1315,7 +1429,7 @@ main(int argc, char **argv) | |||
| 1315 | if (errno == EINTR) | 1429 | if (errno == EINTR) |
| 1316 | continue; | 1430 | continue; |
| 1317 | error("select: %s", strerror(errno)); | 1431 | error("select: %s", strerror(errno)); |
| 1318 | cleanup_exit(2); | 1432 | sftp_server_cleanup_exit(2); |
| 1319 | } | 1433 | } |
| 1320 | 1434 | ||
| 1321 | /* copy stdin to iqueue */ | 1435 | /* copy stdin to iqueue */ |
| @@ -1323,10 +1437,10 @@ main(int argc, char **argv) | |||
| 1323 | len = read(in, buf, sizeof buf); | 1437 | len = read(in, buf, sizeof buf); |
| 1324 | if (len == 0) { | 1438 | if (len == 0) { |
| 1325 | debug("read eof"); | 1439 | debug("read eof"); |
| 1326 | cleanup_exit(0); | 1440 | sftp_server_cleanup_exit(0); |
| 1327 | } else if (len < 0) { | 1441 | } else if (len < 0) { |
| 1328 | error("read: %s", strerror(errno)); | 1442 | error("read: %s", strerror(errno)); |
| 1329 | cleanup_exit(1); | 1443 | sftp_server_cleanup_exit(1); |
| 1330 | } else { | 1444 | } else { |
| 1331 | buffer_append(&iqueue, buf, len); | 1445 | buffer_append(&iqueue, buf, len); |
| 1332 | } | 1446 | } |
| @@ -1336,7 +1450,7 @@ main(int argc, char **argv) | |||
| 1336 | len = write(out, buffer_ptr(&oqueue), olen); | 1450 | len = write(out, buffer_ptr(&oqueue), olen); |
| 1337 | if (len < 0) { | 1451 | if (len < 0) { |
| 1338 | error("write: %s", strerror(errno)); | 1452 | error("write: %s", strerror(errno)); |
| 1339 | cleanup_exit(1); | 1453 | sftp_server_cleanup_exit(1); |
| 1340 | } else { | 1454 | } else { |
| 1341 | buffer_consume(&oqueue, len); | 1455 | buffer_consume(&oqueue, len); |
| 1342 | } | 1456 | } |
| @@ -43,8 +43,8 @@ DESCRIPTION | |||
| 43 | batchfile of `-' may be used to indicate standard input. sftp | 43 | batchfile of `-' may be used to indicate standard input. sftp |
| 44 | will abort if any of the following commands fail: get, put, | 44 | will abort if any of the following commands fail: get, put, |
| 45 | rename, ln, rm, mkdir, chdir, ls, lchdir, chmod, chown, chgrp, | 45 | rename, ln, rm, mkdir, chdir, ls, lchdir, chmod, chown, chgrp, |
| 46 | lpwd and lmkdir. Termination on error can be suppressed on a | 46 | lpwd, df, and lmkdir. Termination on error can be suppressed on |
| 47 | command by command basis by prefixing the command with a `-' | 47 | a command by command basis by prefixing the command with a `-' |
| 48 | character (for example, -rm /tmp/blah*). | 48 | character (for example, -rm /tmp/blah*). |
| 49 | 49 | ||
| 50 | -C Enables compression (via ssh's -C flag). | 50 | -C Enables compression (via ssh's -C flag). |
| @@ -117,7 +117,7 @@ DESCRIPTION | |||
| 117 | -R num_requests | 117 | -R num_requests |
| 118 | Specify how many requests may be outstanding at any one time. | 118 | Specify how many requests may be outstanding at any one time. |
| 119 | Increasing this may slightly improve file transfer speed but will | 119 | Increasing this may slightly improve file transfer speed but will |
| 120 | increase memory usage. The default is 16 outstanding requests. | 120 | increase memory usage. The default is 64 outstanding requests. |
| 121 | 121 | ||
| 122 | -S program | 122 | -S program |
| 123 | Name of the program to use for the encrypted connection. The | 123 | Name of the program to use for the encrypted connection. The |
| @@ -155,6 +155,14 @@ INTERACTIVE COMMANDS | |||
| 155 | Change owner of file path to own. path may contain glob(3) char- | 155 | Change owner of file path to own. path may contain glob(3) char- |
| 156 | acters and may match multiple files. own must be a numeric UID. | 156 | acters and may match multiple files. own must be a numeric UID. |
| 157 | 157 | ||
| 158 | df [-hi] [path] | ||
| 159 | Display usage information for the filesystem holding the current | ||
| 160 | directory (or path if specified). If the -h flag is specified, | ||
| 161 | the capacity information will be displayed using "human-readable" | ||
| 162 | suffixes. The -i flag requests display of inode information in | ||
| 163 | addition to capacity information. This command is only supported | ||
| 164 | on servers that implement the ``statvfs@openssh.com'' extension. | ||
| 165 | |||
| 158 | exit Quit sftp. | 166 | exit Quit sftp. |
| 159 | 167 | ||
| 160 | get [-P] remote-path [local-path] | 168 | get [-P] remote-path [local-path] |
| @@ -263,4 +271,4 @@ SEE ALSO | |||
| 263 | T. Ylonen and S. Lehtinen, SSH File Transfer Protocol, draft-ietf-secsh- | 271 | T. Ylonen and S. Lehtinen, SSH File Transfer Protocol, draft-ietf-secsh- |
| 264 | filexfer-00.txt, January 2001, work in progress material. | 272 | filexfer-00.txt, January 2001, work in progress material. |
| 265 | 273 | ||
| 266 | OpenBSD 4.2 June 5, 2007 4 | 274 | OpenBSD 4.4 July 15, 2008 5 |
| @@ -1,4 +1,4 @@ | |||
| 1 | .\" $OpenBSD: sftp.1,v 1.64 2007/05/31 19:20:16 jmc Exp $ | 1 | .\" $OpenBSD: sftp.1,v 1.67 2008/07/15 02:23:14 djm Exp $ |
| 2 | .\" | 2 | .\" |
| 3 | .\" Copyright (c) 2001 Damien Miller. All rights reserved. | 3 | .\" Copyright (c) 2001 Damien Miller. All rights reserved. |
| 4 | .\" | 4 | .\" |
| @@ -22,7 +22,7 @@ | |||
| 22 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | 22 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
| 23 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | 23 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| 24 | .\" | 24 | .\" |
| 25 | .Dd $Mdocdate: June 5 2007 $ | 25 | .Dd $Mdocdate: July 15 2008 $ |
| 26 | .Dt SFTP 1 | 26 | .Dt SFTP 1 |
| 27 | .Os | 27 | .Os |
| 28 | .Sh NAME | 28 | .Sh NAME |
| @@ -112,7 +112,8 @@ will abort if any of the following | |||
| 112 | commands fail: | 112 | commands fail: |
| 113 | .Ic get , put , rename , ln , | 113 | .Ic get , put , rename , ln , |
| 114 | .Ic rm , mkdir , chdir , ls , | 114 | .Ic rm , mkdir , chdir , ls , |
| 115 | .Ic lchdir , chmod , chown , chgrp , lpwd | 115 | .Ic lchdir , chmod , chown , |
| 116 | .Ic chgrp , lpwd , df , | ||
| 116 | and | 117 | and |
| 117 | .Ic lmkdir . | 118 | .Ic lmkdir . |
| 118 | Termination on error can be suppressed on a command by command basis by | 119 | Termination on error can be suppressed on a command by command basis by |
| @@ -203,7 +204,7 @@ This option may be useful in debugging the client and server. | |||
| 203 | Specify how many requests may be outstanding at any one time. | 204 | Specify how many requests may be outstanding at any one time. |
| 204 | Increasing this may slightly improve file transfer speed | 205 | Increasing this may slightly improve file transfer speed |
| 205 | but will increase memory usage. | 206 | but will increase memory usage. |
| 206 | The default is 16 outstanding requests. | 207 | The default is 64 outstanding requests. |
| 207 | .It Fl S Ar program | 208 | .It Fl S Ar program |
| 208 | Name of the | 209 | Name of the |
| 209 | .Ar program | 210 | .Ar program |
| @@ -272,6 +273,24 @@ may contain | |||
| 272 | characters and may match multiple files. | 273 | characters and may match multiple files. |
| 273 | .Ar own | 274 | .Ar own |
| 274 | must be a numeric UID. | 275 | must be a numeric UID. |
| 276 | .It Xo Ic df | ||
| 277 | .Op Fl hi | ||
| 278 | .Op Ar path | ||
| 279 | .Xc | ||
| 280 | Display usage information for the filesystem holding the current directory | ||
| 281 | (or | ||
| 282 | .Ar path | ||
| 283 | if specified). | ||
| 284 | If the | ||
| 285 | .Fl h | ||
| 286 | flag is specified, the capacity information will be displayed using | ||
| 287 | "human-readable" suffixes. | ||
| 288 | The | ||
| 289 | .Fl i | ||
| 290 | flag requests display of inode information in addition to capacity information. | ||
| 291 | This command is only supported on servers that implement the | ||
| 292 | .Dq statvfs@openssh.com | ||
| 293 | extension. | ||
| 275 | .It Ic exit | 294 | .It Ic exit |
| 276 | Quit | 295 | Quit |
| 277 | .Nm sftp . | 296 | .Nm sftp . |
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: sftp.c,v 1.96 2007/01/03 04:09:15 stevesk Exp $ */ | 1 | /* $OpenBSD: sftp.c,v 1.103 2008/07/13 22:16:03 djm Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Copyright (c) 2001-2004 Damien Miller <djm@openbsd.org> | 3 | * Copyright (c) 2001-2004 Damien Miller <djm@openbsd.org> |
| 4 | * | 4 | * |
| @@ -25,7 +25,11 @@ | |||
| 25 | #include <sys/param.h> | 25 | #include <sys/param.h> |
| 26 | #include <sys/socket.h> | 26 | #include <sys/socket.h> |
| 27 | #include <sys/wait.h> | 27 | #include <sys/wait.h> |
| 28 | #ifdef HAVE_SYS_STATVFS_H | ||
| 29 | #include <sys/statvfs.h> | ||
| 30 | #endif | ||
| 28 | 31 | ||
| 32 | #include <ctype.h> | ||
| 29 | #include <errno.h> | 33 | #include <errno.h> |
| 30 | 34 | ||
| 31 | #ifdef HAVE_PATHS_H | 35 | #ifdef HAVE_PATHS_H |
| @@ -43,6 +47,14 @@ typedef void EditLine; | |||
| 43 | #include <unistd.h> | 47 | #include <unistd.h> |
| 44 | #include <stdarg.h> | 48 | #include <stdarg.h> |
| 45 | 49 | ||
| 50 | #ifdef HAVE_UTIL_H | ||
| 51 | # include <util.h> | ||
| 52 | #endif | ||
| 53 | |||
| 54 | #ifdef HAVE_LIBUTIL_H | ||
| 55 | # include <libutil.h> | ||
| 56 | #endif | ||
| 57 | |||
| 46 | #include "xmalloc.h" | 58 | #include "xmalloc.h" |
| 47 | #include "log.h" | 59 | #include "log.h" |
| 48 | #include "pathnames.h" | 60 | #include "pathnames.h" |
| @@ -63,7 +75,7 @@ int batchmode = 0; | |||
| 63 | size_t copy_buffer_len = 32768; | 75 | size_t copy_buffer_len = 32768; |
| 64 | 76 | ||
| 65 | /* Number of concurrent outstanding requests */ | 77 | /* Number of concurrent outstanding requests */ |
| 66 | size_t num_requests = 16; | 78 | size_t num_requests = 64; |
| 67 | 79 | ||
| 68 | /* PID of ssh transport process */ | 80 | /* PID of ssh transport process */ |
| 69 | static pid_t sshpid = -1; | 81 | static pid_t sshpid = -1; |
| @@ -103,6 +115,7 @@ extern char *__progname; | |||
| 103 | #define I_CHGRP 2 | 115 | #define I_CHGRP 2 |
| 104 | #define I_CHMOD 3 | 116 | #define I_CHMOD 3 |
| 105 | #define I_CHOWN 4 | 117 | #define I_CHOWN 4 |
| 118 | #define I_DF 24 | ||
| 106 | #define I_GET 5 | 119 | #define I_GET 5 |
| 107 | #define I_HELP 6 | 120 | #define I_HELP 6 |
| 108 | #define I_LCHDIR 7 | 121 | #define I_LCHDIR 7 |
| @@ -135,6 +148,7 @@ static const struct CMD cmds[] = { | |||
| 135 | { "chgrp", I_CHGRP }, | 148 | { "chgrp", I_CHGRP }, |
| 136 | { "chmod", I_CHMOD }, | 149 | { "chmod", I_CHMOD }, |
| 137 | { "chown", I_CHOWN }, | 150 | { "chown", I_CHOWN }, |
| 151 | { "df", I_DF }, | ||
| 138 | { "dir", I_LS }, | 152 | { "dir", I_LS }, |
| 139 | { "exit", I_QUIT }, | 153 | { "exit", I_QUIT }, |
| 140 | { "get", I_GET }, | 154 | { "get", I_GET }, |
| @@ -199,6 +213,8 @@ help(void) | |||
| 199 | printf("chgrp grp path Change group of file 'path' to 'grp'\n"); | 213 | printf("chgrp grp path Change group of file 'path' to 'grp'\n"); |
| 200 | printf("chmod mode path Change permissions of file 'path' to 'mode'\n"); | 214 | printf("chmod mode path Change permissions of file 'path' to 'mode'\n"); |
| 201 | printf("chown own path Change owner of file 'path' to 'own'\n"); | 215 | printf("chown own path Change owner of file 'path' to 'own'\n"); |
| 216 | printf("df [path] Display statistics for current directory or\n"); | ||
| 217 | printf(" filesystem containing 'path'\n"); | ||
| 202 | printf("help Display this help text\n"); | 218 | printf("help Display this help text\n"); |
| 203 | printf("get remote-path [local-path] Download file\n"); | 219 | printf("get remote-path [local-path] Download file\n"); |
| 204 | printf("lls [ls-options [path]] Display local directory listing\n"); | 220 | printf("lls [ls-options [path]] Display local directory listing\n"); |
| @@ -346,144 +362,105 @@ infer_path(const char *p, char **ifp) | |||
| 346 | } | 362 | } |
| 347 | 363 | ||
| 348 | static int | 364 | static int |
| 349 | parse_getput_flags(const char **cpp, int *pflag) | 365 | parse_getput_flags(const char *cmd, char **argv, int argc, int *pflag) |
| 350 | { | 366 | { |
| 351 | const char *cp = *cpp; | 367 | extern int opterr, optind, optopt, optreset; |
| 368 | int ch; | ||
| 352 | 369 | ||
| 353 | /* Check for flags */ | 370 | optind = optreset = 1; |
| 354 | if (cp[0] == '-' && cp[1] && strchr(WHITESPACE, cp[2])) { | 371 | opterr = 0; |
| 355 | switch (cp[1]) { | 372 | |
| 373 | *pflag = 0; | ||
| 374 | while ((ch = getopt(argc, argv, "Pp")) != -1) { | ||
| 375 | switch (ch) { | ||
| 356 | case 'p': | 376 | case 'p': |
| 357 | case 'P': | 377 | case 'P': |
| 358 | *pflag = 1; | 378 | *pflag = 1; |
| 359 | break; | 379 | break; |
| 360 | default: | 380 | default: |
| 361 | error("Invalid flag -%c", cp[1]); | 381 | error("%s: Invalid flag -%c", cmd, optopt); |
| 362 | return(-1); | 382 | return -1; |
| 363 | } | 383 | } |
| 364 | cp += 2; | ||
| 365 | *cpp = cp + strspn(cp, WHITESPACE); | ||
| 366 | } | 384 | } |
| 367 | 385 | ||
| 368 | return(0); | 386 | return optind; |
| 369 | } | 387 | } |
| 370 | 388 | ||
| 371 | static int | 389 | static int |
| 372 | parse_ls_flags(const char **cpp, int *lflag) | 390 | parse_ls_flags(char **argv, int argc, int *lflag) |
| 373 | { | 391 | { |
| 374 | const char *cp = *cpp; | 392 | extern int opterr, optind, optopt, optreset; |
| 393 | int ch; | ||
| 375 | 394 | ||
| 376 | /* Defaults */ | 395 | optind = optreset = 1; |
| 377 | *lflag = LS_NAME_SORT; | 396 | opterr = 0; |
| 378 | 397 | ||
| 379 | /* Check for flags */ | 398 | *lflag = LS_NAME_SORT; |
| 380 | if (cp++[0] == '-') { | 399 | while ((ch = getopt(argc, argv, "1Saflnrt")) != -1) { |
| 381 | for (; strchr(WHITESPACE, *cp) == NULL; cp++) { | 400 | switch (ch) { |
| 382 | switch (*cp) { | 401 | case '1': |
| 383 | case 'l': | 402 | *lflag &= ~VIEW_FLAGS; |
| 384 | *lflag &= ~VIEW_FLAGS; | 403 | *lflag |= LS_SHORT_VIEW; |
| 385 | *lflag |= LS_LONG_VIEW; | 404 | break; |
| 386 | break; | 405 | case 'S': |
| 387 | case '1': | 406 | *lflag &= ~SORT_FLAGS; |
| 388 | *lflag &= ~VIEW_FLAGS; | 407 | *lflag |= LS_SIZE_SORT; |
| 389 | *lflag |= LS_SHORT_VIEW; | 408 | break; |
| 390 | break; | 409 | case 'a': |
| 391 | case 'n': | 410 | *lflag |= LS_SHOW_ALL; |
| 392 | *lflag &= ~VIEW_FLAGS; | 411 | break; |
| 393 | *lflag |= LS_NUMERIC_VIEW|LS_LONG_VIEW; | 412 | case 'f': |
| 394 | break; | 413 | *lflag &= ~SORT_FLAGS; |
| 395 | case 'S': | 414 | break; |
| 396 | *lflag &= ~SORT_FLAGS; | 415 | case 'l': |
| 397 | *lflag |= LS_SIZE_SORT; | 416 | *lflag &= ~VIEW_FLAGS; |
| 398 | break; | 417 | *lflag |= LS_LONG_VIEW; |
| 399 | case 't': | 418 | break; |
| 400 | *lflag &= ~SORT_FLAGS; | 419 | case 'n': |
| 401 | *lflag |= LS_TIME_SORT; | 420 | *lflag &= ~VIEW_FLAGS; |
| 402 | break; | 421 | *lflag |= LS_NUMERIC_VIEW|LS_LONG_VIEW; |
| 403 | case 'r': | 422 | break; |
| 404 | *lflag |= LS_REVERSE_SORT; | 423 | case 'r': |
| 405 | break; | 424 | *lflag |= LS_REVERSE_SORT; |
| 406 | case 'f': | 425 | break; |
| 407 | *lflag &= ~SORT_FLAGS; | 426 | case 't': |
| 408 | break; | 427 | *lflag &= ~SORT_FLAGS; |
| 409 | case 'a': | 428 | *lflag |= LS_TIME_SORT; |
| 410 | *lflag |= LS_SHOW_ALL; | 429 | break; |
| 411 | break; | 430 | default: |
| 412 | default: | 431 | error("ls: Invalid flag -%c", optopt); |
| 413 | error("Invalid flag -%c", *cp); | 432 | return -1; |
| 414 | return(-1); | ||
| 415 | } | ||
| 416 | } | 433 | } |
| 417 | *cpp = cp + strspn(cp, WHITESPACE); | ||
| 418 | } | 434 | } |
| 419 | 435 | ||
| 420 | return(0); | 436 | return optind; |
| 421 | } | 437 | } |
| 422 | 438 | ||
| 423 | static int | 439 | static int |
| 424 | get_pathname(const char **cpp, char **path) | 440 | parse_df_flags(const char *cmd, char **argv, int argc, int *hflag, int *iflag) |
| 425 | { | 441 | { |
| 426 | const char *cp = *cpp, *end; | 442 | extern int opterr, optind, optopt, optreset; |
| 427 | char quot; | 443 | int ch; |
| 428 | u_int i, j; | ||
| 429 | |||
| 430 | cp += strspn(cp, WHITESPACE); | ||
| 431 | if (!*cp) { | ||
| 432 | *cpp = cp; | ||
| 433 | *path = NULL; | ||
| 434 | return (0); | ||
| 435 | } | ||
| 436 | |||
| 437 | *path = xmalloc(strlen(cp) + 1); | ||
| 438 | |||
| 439 | /* Check for quoted filenames */ | ||
| 440 | if (*cp == '\"' || *cp == '\'') { | ||
| 441 | quot = *cp++; | ||
| 442 | 444 | ||
| 443 | /* Search for terminating quote, unescape some chars */ | 445 | optind = optreset = 1; |
| 444 | for (i = j = 0; i <= strlen(cp); i++) { | 446 | opterr = 0; |
| 445 | if (cp[i] == quot) { /* Found quote */ | ||
| 446 | i++; | ||
| 447 | (*path)[j] = '\0'; | ||
| 448 | break; | ||
| 449 | } | ||
| 450 | if (cp[i] == '\0') { /* End of string */ | ||
| 451 | error("Unterminated quote"); | ||
| 452 | goto fail; | ||
| 453 | } | ||
| 454 | if (cp[i] == '\\') { /* Escaped characters */ | ||
| 455 | i++; | ||
| 456 | if (cp[i] != '\'' && cp[i] != '\"' && | ||
| 457 | cp[i] != '\\') { | ||
| 458 | error("Bad escaped character '\\%c'", | ||
| 459 | cp[i]); | ||
| 460 | goto fail; | ||
| 461 | } | ||
| 462 | } | ||
| 463 | (*path)[j++] = cp[i]; | ||
| 464 | } | ||
| 465 | 447 | ||
| 466 | if (j == 0) { | 448 | *hflag = *iflag = 0; |
| 467 | error("Empty quotes"); | 449 | while ((ch = getopt(argc, argv, "hi")) != -1) { |
| 468 | goto fail; | 450 | switch (ch) { |
| 451 | case 'h': | ||
| 452 | *hflag = 1; | ||
| 453 | break; | ||
| 454 | case 'i': | ||
| 455 | *iflag = 1; | ||
| 456 | break; | ||
| 457 | default: | ||
| 458 | error("%s: Invalid flag -%c", cmd, optopt); | ||
| 459 | return -1; | ||
| 469 | } | 460 | } |
| 470 | *cpp = cp + i + strspn(cp + i, WHITESPACE); | ||
| 471 | } else { | ||
| 472 | /* Read to end of filename */ | ||
| 473 | end = strpbrk(cp, WHITESPACE); | ||
| 474 | if (end == NULL) | ||
| 475 | end = strchr(cp, '\0'); | ||
| 476 | *cpp = end + strspn(end, WHITESPACE); | ||
| 477 | |||
| 478 | memcpy(*path, cp, end - cp); | ||
| 479 | (*path)[end - cp] = '\0'; | ||
| 480 | } | 461 | } |
| 481 | return (0); | ||
| 482 | 462 | ||
| 483 | fail: | 463 | return optind; |
| 484 | xfree(*path); | ||
| 485 | *path = NULL; | ||
| 486 | return (-1); | ||
| 487 | } | 464 | } |
| 488 | 465 | ||
| 489 | static int | 466 | static int |
| @@ -499,17 +476,6 @@ is_dir(char *path) | |||
| 499 | } | 476 | } |
| 500 | 477 | ||
| 501 | static int | 478 | static int |
| 502 | is_reg(char *path) | ||
| 503 | { | ||
| 504 | struct stat sb; | ||
| 505 | |||
| 506 | if (stat(path, &sb) == -1) | ||
| 507 | fatal("stat %s: %s", path, strerror(errno)); | ||
| 508 | |||
| 509 | return(S_ISREG(sb.st_mode)); | ||
| 510 | } | ||
| 511 | |||
| 512 | static int | ||
| 513 | remote_is_dir(struct sftp_conn *conn, char *path) | 479 | remote_is_dir(struct sftp_conn *conn, char *path) |
| 514 | { | 480 | { |
| 515 | Attrib *a; | 481 | Attrib *a; |
| @@ -597,6 +563,7 @@ process_put(struct sftp_conn *conn, char *src, char *dst, char *pwd, int pflag) | |||
| 597 | glob_t g; | 563 | glob_t g; |
| 598 | int err = 0; | 564 | int err = 0; |
| 599 | int i; | 565 | int i; |
| 566 | struct stat sb; | ||
| 600 | 567 | ||
| 601 | if (dst) { | 568 | if (dst) { |
| 602 | tmp_dst = xstrdup(dst); | 569 | tmp_dst = xstrdup(dst); |
| @@ -605,7 +572,7 @@ process_put(struct sftp_conn *conn, char *src, char *dst, char *pwd, int pflag) | |||
| 605 | 572 | ||
| 606 | memset(&g, 0, sizeof(g)); | 573 | memset(&g, 0, sizeof(g)); |
| 607 | debug3("Looking up %s", src); | 574 | debug3("Looking up %s", src); |
| 608 | if (glob(src, 0, NULL, &g)) { | 575 | if (glob(src, GLOB_NOCHECK, NULL, &g)) { |
| 609 | error("File \"%s\" not found.", src); | 576 | error("File \"%s\" not found.", src); |
| 610 | err = -1; | 577 | err = -1; |
| 611 | goto out; | 578 | goto out; |
| @@ -620,7 +587,13 @@ process_put(struct sftp_conn *conn, char *src, char *dst, char *pwd, int pflag) | |||
| 620 | } | 587 | } |
| 621 | 588 | ||
| 622 | for (i = 0; g.gl_pathv[i] && !interrupted; i++) { | 589 | for (i = 0; g.gl_pathv[i] && !interrupted; i++) { |
| 623 | if (!is_reg(g.gl_pathv[i])) { | 590 | if (stat(g.gl_pathv[i], &sb) == -1) { |
| 591 | err = -1; | ||
| 592 | error("stat %s: %s", g.gl_pathv[i], strerror(errno)); | ||
| 593 | continue; | ||
| 594 | } | ||
| 595 | |||
| 596 | if (!S_ISREG(sb.st_mode)) { | ||
| 624 | error("skipping non-regular file %s", | 597 | error("skipping non-regular file %s", |
| 625 | g.gl_pathv[i]); | 598 | g.gl_pathv[i]); |
| 626 | continue; | 599 | continue; |
| @@ -867,14 +840,238 @@ do_globbed_ls(struct sftp_conn *conn, char *path, char *strip_path, | |||
| 867 | } | 840 | } |
| 868 | 841 | ||
| 869 | static int | 842 | static int |
| 870 | parse_args(const char **cpp, int *pflag, int *lflag, int *iflag, | 843 | do_df(struct sftp_conn *conn, char *path, int hflag, int iflag) |
| 844 | { | ||
| 845 | struct sftp_statvfs st; | ||
| 846 | char s_used[FMT_SCALED_STRSIZE]; | ||
| 847 | char s_avail[FMT_SCALED_STRSIZE]; | ||
| 848 | char s_root[FMT_SCALED_STRSIZE]; | ||
| 849 | char s_total[FMT_SCALED_STRSIZE]; | ||
| 850 | |||
| 851 | if (do_statvfs(conn, path, &st, 1) == -1) | ||
| 852 | return -1; | ||
| 853 | if (iflag) { | ||
| 854 | printf(" Inodes Used Avail " | ||
| 855 | "(root) %%Capacity\n"); | ||
| 856 | printf("%11llu %11llu %11llu %11llu %3llu%%\n", | ||
| 857 | (unsigned long long)st.f_files, | ||
| 858 | (unsigned long long)(st.f_files - st.f_ffree), | ||
| 859 | (unsigned long long)st.f_favail, | ||
| 860 | (unsigned long long)st.f_ffree, | ||
| 861 | (unsigned long long)(100 * (st.f_files - st.f_ffree) / | ||
| 862 | st.f_files)); | ||
| 863 | } else if (hflag) { | ||
| 864 | strlcpy(s_used, "error", sizeof(s_used)); | ||
| 865 | strlcpy(s_avail, "error", sizeof(s_avail)); | ||
| 866 | strlcpy(s_root, "error", sizeof(s_root)); | ||
| 867 | strlcpy(s_total, "error", sizeof(s_total)); | ||
| 868 | fmt_scaled((st.f_blocks - st.f_bfree) * st.f_frsize, s_used); | ||
| 869 | fmt_scaled(st.f_bavail * st.f_frsize, s_avail); | ||
| 870 | fmt_scaled(st.f_bfree * st.f_frsize, s_root); | ||
| 871 | fmt_scaled(st.f_blocks * st.f_frsize, s_total); | ||
| 872 | printf(" Size Used Avail (root) %%Capacity\n"); | ||
| 873 | printf("%7sB %7sB %7sB %7sB %3llu%%\n", | ||
| 874 | s_total, s_used, s_avail, s_root, | ||
| 875 | (unsigned long long)(100 * (st.f_blocks - st.f_bfree) / | ||
| 876 | st.f_blocks)); | ||
| 877 | } else { | ||
| 878 | printf(" Size Used Avail " | ||
| 879 | "(root) %%Capacity\n"); | ||
| 880 | printf("%12llu %12llu %12llu %12llu %3llu%%\n", | ||
| 881 | (unsigned long long)(st.f_frsize * st.f_blocks / 1024), | ||
| 882 | (unsigned long long)(st.f_frsize * | ||
| 883 | (st.f_blocks - st.f_bfree) / 1024), | ||
| 884 | (unsigned long long)(st.f_frsize * st.f_bavail / 1024), | ||
| 885 | (unsigned long long)(st.f_frsize * st.f_bfree / 1024), | ||
| 886 | (unsigned long long)(100 * (st.f_blocks - st.f_bfree) / | ||
| 887 | st.f_blocks)); | ||
| 888 | } | ||
| 889 | return 0; | ||
| 890 | } | ||
| 891 | |||
| 892 | /* | ||
| 893 | * Undo escaping of glob sequences in place. Used to undo extra escaping | ||
| 894 | * applied in makeargv() when the string is destined for a function that | ||
| 895 | * does not glob it. | ||
| 896 | */ | ||
| 897 | static void | ||
| 898 | undo_glob_escape(char *s) | ||
| 899 | { | ||
| 900 | size_t i, j; | ||
| 901 | |||
| 902 | for (i = j = 0;;) { | ||
| 903 | if (s[i] == '\0') { | ||
| 904 | s[j] = '\0'; | ||
| 905 | return; | ||
| 906 | } | ||
| 907 | if (s[i] != '\\') { | ||
| 908 | s[j++] = s[i++]; | ||
| 909 | continue; | ||
| 910 | } | ||
| 911 | /* s[i] == '\\' */ | ||
| 912 | ++i; | ||
| 913 | switch (s[i]) { | ||
| 914 | case '?': | ||
| 915 | case '[': | ||
| 916 | case '*': | ||
| 917 | case '\\': | ||
| 918 | s[j++] = s[i++]; | ||
| 919 | break; | ||
| 920 | case '\0': | ||
| 921 | s[j++] = '\\'; | ||
| 922 | s[j] = '\0'; | ||
| 923 | return; | ||
| 924 | default: | ||
| 925 | s[j++] = '\\'; | ||
| 926 | s[j++] = s[i++]; | ||
| 927 | break; | ||
| 928 | } | ||
| 929 | } | ||
| 930 | } | ||
| 931 | |||
| 932 | /* | ||
| 933 | * Split a string into an argument vector using sh(1)-style quoting, | ||
| 934 | * comment and escaping rules, but with some tweaks to handle glob(3) | ||
| 935 | * wildcards. | ||
| 936 | * Returns NULL on error or a NULL-terminated array of arguments. | ||
| 937 | */ | ||
| 938 | #define MAXARGS 128 | ||
| 939 | #define MAXARGLEN 8192 | ||
| 940 | static char ** | ||
| 941 | makeargv(const char *arg, int *argcp) | ||
| 942 | { | ||
| 943 | int argc, quot; | ||
| 944 | size_t i, j; | ||
| 945 | static char argvs[MAXARGLEN]; | ||
| 946 | static char *argv[MAXARGS + 1]; | ||
| 947 | enum { MA_START, MA_SQUOTE, MA_DQUOTE, MA_UNQUOTED } state, q; | ||
| 948 | |||
| 949 | *argcp = argc = 0; | ||
| 950 | if (strlen(arg) > sizeof(argvs) - 1) { | ||
| 951 | args_too_longs: | ||
| 952 | error("string too long"); | ||
| 953 | return NULL; | ||
| 954 | } | ||
| 955 | state = MA_START; | ||
| 956 | i = j = 0; | ||
| 957 | for (;;) { | ||
| 958 | if (isspace(arg[i])) { | ||
| 959 | if (state == MA_UNQUOTED) { | ||
| 960 | /* Terminate current argument */ | ||
| 961 | argvs[j++] = '\0'; | ||
| 962 | argc++; | ||
| 963 | state = MA_START; | ||
| 964 | } else if (state != MA_START) | ||
| 965 | argvs[j++] = arg[i]; | ||
| 966 | } else if (arg[i] == '"' || arg[i] == '\'') { | ||
| 967 | q = arg[i] == '"' ? MA_DQUOTE : MA_SQUOTE; | ||
| 968 | if (state == MA_START) { | ||
| 969 | argv[argc] = argvs + j; | ||
| 970 | state = q; | ||
| 971 | } else if (state == MA_UNQUOTED) | ||
| 972 | state = q; | ||
| 973 | else if (state == q) | ||
| 974 | state = MA_UNQUOTED; | ||
| 975 | else | ||
| 976 | argvs[j++] = arg[i]; | ||
| 977 | } else if (arg[i] == '\\') { | ||
| 978 | if (state == MA_SQUOTE || state == MA_DQUOTE) { | ||
| 979 | quot = state == MA_SQUOTE ? '\'' : '"'; | ||
| 980 | /* Unescape quote we are in */ | ||
| 981 | /* XXX support \n and friends? */ | ||
| 982 | if (arg[i + 1] == quot) { | ||
| 983 | i++; | ||
| 984 | argvs[j++] = arg[i]; | ||
| 985 | } else if (arg[i + 1] == '?' || | ||
| 986 | arg[i + 1] == '[' || arg[i + 1] == '*') { | ||
| 987 | /* | ||
| 988 | * Special case for sftp: append | ||
| 989 | * double-escaped glob sequence - | ||
| 990 | * glob will undo one level of | ||
| 991 | * escaping. NB. string can grow here. | ||
| 992 | */ | ||
| 993 | if (j >= sizeof(argvs) - 5) | ||
| 994 | goto args_too_longs; | ||
| 995 | argvs[j++] = '\\'; | ||
| 996 | argvs[j++] = arg[i++]; | ||
| 997 | argvs[j++] = '\\'; | ||
| 998 | argvs[j++] = arg[i]; | ||
| 999 | } else { | ||
| 1000 | argvs[j++] = arg[i++]; | ||
| 1001 | argvs[j++] = arg[i]; | ||
| 1002 | } | ||
| 1003 | } else { | ||
| 1004 | if (state == MA_START) { | ||
| 1005 | argv[argc] = argvs + j; | ||
| 1006 | state = MA_UNQUOTED; | ||
| 1007 | } | ||
| 1008 | if (arg[i + 1] == '?' || arg[i + 1] == '[' || | ||
| 1009 | arg[i + 1] == '*' || arg[i + 1] == '\\') { | ||
| 1010 | /* | ||
| 1011 | * Special case for sftp: append | ||
| 1012 | * escaped glob sequence - | ||
| 1013 | * glob will undo one level of | ||
| 1014 | * escaping. | ||
| 1015 | */ | ||
| 1016 | argvs[j++] = arg[i++]; | ||
| 1017 | argvs[j++] = arg[i]; | ||
| 1018 | } else { | ||
| 1019 | /* Unescape everything */ | ||
| 1020 | /* XXX support \n and friends? */ | ||
| 1021 | i++; | ||
| 1022 | argvs[j++] = arg[i]; | ||
| 1023 | } | ||
| 1024 | } | ||
| 1025 | } else if (arg[i] == '#') { | ||
| 1026 | if (state == MA_SQUOTE || state == MA_DQUOTE) | ||
| 1027 | argvs[j++] = arg[i]; | ||
| 1028 | else | ||
| 1029 | goto string_done; | ||
| 1030 | } else if (arg[i] == '\0') { | ||
| 1031 | if (state == MA_SQUOTE || state == MA_DQUOTE) { | ||
| 1032 | error("Unterminated quoted argument"); | ||
| 1033 | return NULL; | ||
| 1034 | } | ||
| 1035 | string_done: | ||
| 1036 | if (state == MA_UNQUOTED) { | ||
| 1037 | argvs[j++] = '\0'; | ||
| 1038 | argc++; | ||
| 1039 | } | ||
| 1040 | break; | ||
| 1041 | } else { | ||
| 1042 | if (state == MA_START) { | ||
| 1043 | argv[argc] = argvs + j; | ||
| 1044 | state = MA_UNQUOTED; | ||
| 1045 | } | ||
| 1046 | if ((state == MA_SQUOTE || state == MA_DQUOTE) && | ||
| 1047 | (arg[i] == '?' || arg[i] == '[' || arg[i] == '*')) { | ||
| 1048 | /* | ||
| 1049 | * Special case for sftp: escape quoted | ||
| 1050 | * glob(3) wildcards. NB. string can grow | ||
| 1051 | * here. | ||
| 1052 | */ | ||
| 1053 | if (j >= sizeof(argvs) - 3) | ||
| 1054 | goto args_too_longs; | ||
| 1055 | argvs[j++] = '\\'; | ||
| 1056 | argvs[j++] = arg[i]; | ||
| 1057 | } else | ||
| 1058 | argvs[j++] = arg[i]; | ||
| 1059 | } | ||
| 1060 | i++; | ||
| 1061 | } | ||
| 1062 | *argcp = argc; | ||
| 1063 | return argv; | ||
| 1064 | } | ||
| 1065 | |||
| 1066 | static int | ||
| 1067 | parse_args(const char **cpp, int *pflag, int *lflag, int *iflag, int *hflag, | ||
| 871 | unsigned long *n_arg, char **path1, char **path2) | 1068 | unsigned long *n_arg, char **path1, char **path2) |
| 872 | { | 1069 | { |
| 873 | const char *cmd, *cp = *cpp; | 1070 | const char *cmd, *cp = *cpp; |
| 874 | char *cp2; | 1071 | char *cp2, **argv; |
| 875 | int base = 0; | 1072 | int base = 0; |
| 876 | long l; | 1073 | long l; |
| 877 | int i, cmdnum; | 1074 | int i, cmdnum, optidx, argc; |
| 878 | 1075 | ||
| 879 | /* Skip leading whitespace */ | 1076 | /* Skip leading whitespace */ |
| 880 | cp = cp + strspn(cp, WHITESPACE); | 1077 | cp = cp + strspn(cp, WHITESPACE); |
| @@ -890,17 +1087,13 @@ parse_args(const char **cpp, int *pflag, int *lflag, int *iflag, | |||
| 890 | cp++; | 1087 | cp++; |
| 891 | } | 1088 | } |
| 892 | 1089 | ||
| 1090 | if ((argv = makeargv(cp, &argc)) == NULL) | ||
| 1091 | return -1; | ||
| 1092 | |||
| 893 | /* Figure out which command we have */ | 1093 | /* Figure out which command we have */ |
| 894 | for (i = 0; cmds[i].c; i++) { | 1094 | for (i = 0; cmds[i].c != NULL; i++) { |
| 895 | int cmdlen = strlen(cmds[i].c); | 1095 | if (strcasecmp(cmds[i].c, argv[0]) == 0) |
| 896 | |||
| 897 | /* Check for command followed by whitespace */ | ||
| 898 | if (!strncasecmp(cp, cmds[i].c, cmdlen) && | ||
| 899 | strchr(WHITESPACE, cp[cmdlen])) { | ||
| 900 | cp += cmdlen; | ||
| 901 | cp = cp + strspn(cp, WHITESPACE); | ||
| 902 | break; | 1096 | break; |
| 903 | } | ||
| 904 | } | 1097 | } |
| 905 | cmdnum = cmds[i].n; | 1098 | cmdnum = cmds[i].n; |
| 906 | cmd = cmds[i].c; | 1099 | cmd = cmds[i].c; |
| @@ -911,40 +1104,44 @@ parse_args(const char **cpp, int *pflag, int *lflag, int *iflag, | |||
| 911 | cmdnum = I_SHELL; | 1104 | cmdnum = I_SHELL; |
| 912 | } else if (cmdnum == -1) { | 1105 | } else if (cmdnum == -1) { |
| 913 | error("Invalid command."); | 1106 | error("Invalid command."); |
| 914 | return (-1); | 1107 | return -1; |
| 915 | } | 1108 | } |
| 916 | 1109 | ||
| 917 | /* Get arguments and parse flags */ | 1110 | /* Get arguments and parse flags */ |
| 918 | *lflag = *pflag = *n_arg = 0; | 1111 | *lflag = *pflag = *hflag = *n_arg = 0; |
| 919 | *path1 = *path2 = NULL; | 1112 | *path1 = *path2 = NULL; |
| 1113 | optidx = 1; | ||
| 920 | switch (cmdnum) { | 1114 | switch (cmdnum) { |
| 921 | case I_GET: | 1115 | case I_GET: |
| 922 | case I_PUT: | 1116 | case I_PUT: |
| 923 | if (parse_getput_flags(&cp, pflag)) | 1117 | if ((optidx = parse_getput_flags(cmd, argv, argc, pflag)) == -1) |
| 924 | return(-1); | 1118 | return -1; |
| 925 | /* Get first pathname (mandatory) */ | 1119 | /* Get first pathname (mandatory) */ |
| 926 | if (get_pathname(&cp, path1)) | 1120 | if (argc - optidx < 1) { |
| 927 | return(-1); | ||
| 928 | if (*path1 == NULL) { | ||
| 929 | error("You must specify at least one path after a " | 1121 | error("You must specify at least one path after a " |
| 930 | "%s command.", cmd); | 1122 | "%s command.", cmd); |
| 931 | return(-1); | 1123 | return -1; |
| 1124 | } | ||
| 1125 | *path1 = xstrdup(argv[optidx]); | ||
| 1126 | /* Get second pathname (optional) */ | ||
| 1127 | if (argc - optidx > 1) { | ||
| 1128 | *path2 = xstrdup(argv[optidx + 1]); | ||
| 1129 | /* Destination is not globbed */ | ||
| 1130 | undo_glob_escape(*path2); | ||
| 932 | } | 1131 | } |
| 933 | /* Try to get second pathname (optional) */ | ||
| 934 | if (get_pathname(&cp, path2)) | ||
| 935 | return(-1); | ||
| 936 | break; | 1132 | break; |
| 937 | case I_RENAME: | 1133 | case I_RENAME: |
| 938 | case I_SYMLINK: | 1134 | case I_SYMLINK: |
| 939 | if (get_pathname(&cp, path1)) | 1135 | if (argc - optidx < 2) { |
| 940 | return(-1); | ||
| 941 | if (get_pathname(&cp, path2)) | ||
| 942 | return(-1); | ||
| 943 | if (!*path1 || !*path2) { | ||
| 944 | error("You must specify two paths after a %s " | 1136 | error("You must specify two paths after a %s " |
| 945 | "command.", cmd); | 1137 | "command.", cmd); |
| 946 | return(-1); | 1138 | return -1; |
| 947 | } | 1139 | } |
| 1140 | *path1 = xstrdup(argv[optidx]); | ||
| 1141 | *path2 = xstrdup(argv[optidx + 1]); | ||
| 1142 | /* Paths are not globbed */ | ||
| 1143 | undo_glob_escape(*path1); | ||
| 1144 | undo_glob_escape(*path2); | ||
| 948 | break; | 1145 | break; |
| 949 | case I_RM: | 1146 | case I_RM: |
| 950 | case I_MKDIR: | 1147 | case I_MKDIR: |
| @@ -953,59 +1150,69 @@ parse_args(const char **cpp, int *pflag, int *lflag, int *iflag, | |||
| 953 | case I_LCHDIR: | 1150 | case I_LCHDIR: |
| 954 | case I_LMKDIR: | 1151 | case I_LMKDIR: |
| 955 | /* Get pathname (mandatory) */ | 1152 | /* Get pathname (mandatory) */ |
| 956 | if (get_pathname(&cp, path1)) | 1153 | if (argc - optidx < 1) { |
| 957 | return(-1); | ||
| 958 | if (*path1 == NULL) { | ||
| 959 | error("You must specify a path after a %s command.", | 1154 | error("You must specify a path after a %s command.", |
| 960 | cmd); | 1155 | cmd); |
| 961 | return(-1); | 1156 | return -1; |
| 1157 | } | ||
| 1158 | *path1 = xstrdup(argv[optidx]); | ||
| 1159 | /* Only "rm" globs */ | ||
| 1160 | if (cmdnum != I_RM) | ||
| 1161 | undo_glob_escape(*path1); | ||
| 1162 | break; | ||
| 1163 | case I_DF: | ||
| 1164 | if ((optidx = parse_df_flags(cmd, argv, argc, hflag, | ||
| 1165 | iflag)) == -1) | ||
| 1166 | return -1; | ||
| 1167 | /* Default to current directory if no path specified */ | ||
| 1168 | if (argc - optidx < 1) | ||
| 1169 | *path1 = NULL; | ||
| 1170 | else { | ||
| 1171 | *path1 = xstrdup(argv[optidx]); | ||
| 1172 | undo_glob_escape(*path1); | ||
| 962 | } | 1173 | } |
| 963 | break; | 1174 | break; |
| 964 | case I_LS: | 1175 | case I_LS: |
| 965 | if (parse_ls_flags(&cp, lflag)) | 1176 | if ((optidx = parse_ls_flags(argv, argc, lflag)) == -1) |
| 966 | return(-1); | 1177 | return(-1); |
| 967 | /* Path is optional */ | 1178 | /* Path is optional */ |
| 968 | if (get_pathname(&cp, path1)) | 1179 | if (argc - optidx > 0) |
| 969 | return(-1); | 1180 | *path1 = xstrdup(argv[optidx]); |
| 970 | break; | 1181 | break; |
| 971 | case I_LLS: | 1182 | case I_LLS: |
| 1183 | /* Skip ls command and following whitespace */ | ||
| 1184 | cp = cp + strlen(cmd) + strspn(cp, WHITESPACE); | ||
| 972 | case I_SHELL: | 1185 | case I_SHELL: |
| 973 | /* Uses the rest of the line */ | 1186 | /* Uses the rest of the line */ |
| 974 | break; | 1187 | break; |
| 975 | case I_LUMASK: | 1188 | case I_LUMASK: |
| 976 | base = 8; | ||
| 977 | case I_CHMOD: | 1189 | case I_CHMOD: |
| 978 | base = 8; | 1190 | base = 8; |
| 979 | case I_CHOWN: | 1191 | case I_CHOWN: |
| 980 | case I_CHGRP: | 1192 | case I_CHGRP: |
| 981 | /* Get numeric arg (mandatory) */ | 1193 | /* Get numeric arg (mandatory) */ |
| 1194 | if (argc - optidx < 1) | ||
| 1195 | goto need_num_arg; | ||
| 982 | errno = 0; | 1196 | errno = 0; |
| 983 | l = strtol(cp, &cp2, base); | 1197 | l = strtol(argv[optidx], &cp2, base); |
| 984 | if (cp2 == cp || ((l == LONG_MIN || l == LONG_MAX) && | 1198 | if (cp2 == argv[optidx] || *cp2 != '\0' || |
| 985 | errno == ERANGE) || l < 0) { | 1199 | ((l == LONG_MIN || l == LONG_MAX) && errno == ERANGE) || |
| 1200 | l < 0) { | ||
| 1201 | need_num_arg: | ||
| 986 | error("You must supply a numeric argument " | 1202 | error("You must supply a numeric argument " |
| 987 | "to the %s command.", cmd); | 1203 | "to the %s command.", cmd); |
| 988 | return(-1); | 1204 | return -1; |
| 989 | } | 1205 | } |
| 990 | cp = cp2; | ||
| 991 | *n_arg = l; | 1206 | *n_arg = l; |
| 992 | if (cmdnum == I_LUMASK && strchr(WHITESPACE, *cp)) | 1207 | if (cmdnum == I_LUMASK) |
| 993 | break; | 1208 | break; |
| 994 | if (cmdnum == I_LUMASK || !strchr(WHITESPACE, *cp)) { | ||
| 995 | error("You must supply a numeric argument " | ||
| 996 | "to the %s command.", cmd); | ||
| 997 | return(-1); | ||
| 998 | } | ||
| 999 | cp += strspn(cp, WHITESPACE); | ||
| 1000 | |||
| 1001 | /* Get pathname (mandatory) */ | 1209 | /* Get pathname (mandatory) */ |
| 1002 | if (get_pathname(&cp, path1)) | 1210 | if (argc - optidx < 2) { |
| 1003 | return(-1); | ||
| 1004 | if (*path1 == NULL) { | ||
| 1005 | error("You must specify a path after a %s command.", | 1211 | error("You must specify a path after a %s command.", |
| 1006 | cmd); | 1212 | cmd); |
| 1007 | return(-1); | 1213 | return -1; |
| 1008 | } | 1214 | } |
| 1215 | *path1 = xstrdup(argv[optidx + 1]); | ||
| 1009 | break; | 1216 | break; |
| 1010 | case I_QUIT: | 1217 | case I_QUIT: |
| 1011 | case I_PWD: | 1218 | case I_PWD: |
| @@ -1027,7 +1234,7 @@ parse_dispatch_command(struct sftp_conn *conn, const char *cmd, char **pwd, | |||
| 1027 | int err_abort) | 1234 | int err_abort) |
| 1028 | { | 1235 | { |
| 1029 | char *path1, *path2, *tmp; | 1236 | char *path1, *path2, *tmp; |
| 1030 | int pflag, lflag, iflag, cmdnum, i; | 1237 | int pflag, lflag, iflag, hflag, cmdnum, i; |
| 1031 | unsigned long n_arg; | 1238 | unsigned long n_arg; |
| 1032 | Attrib a, *aa; | 1239 | Attrib a, *aa; |
| 1033 | char path_buf[MAXPATHLEN]; | 1240 | char path_buf[MAXPATHLEN]; |
| @@ -1035,7 +1242,7 @@ parse_dispatch_command(struct sftp_conn *conn, const char *cmd, char **pwd, | |||
| 1035 | glob_t g; | 1242 | glob_t g; |
| 1036 | 1243 | ||
| 1037 | path1 = path2 = NULL; | 1244 | path1 = path2 = NULL; |
| 1038 | cmdnum = parse_args(&cmd, &pflag, &lflag, &iflag, &n_arg, | 1245 | cmdnum = parse_args(&cmd, &pflag, &lflag, &iflag, &hflag, &n_arg, |
| 1039 | &path1, &path2); | 1246 | &path1, &path2); |
| 1040 | 1247 | ||
| 1041 | if (iflag != 0) | 1248 | if (iflag != 0) |
| @@ -1129,6 +1336,13 @@ parse_dispatch_command(struct sftp_conn *conn, const char *cmd, char **pwd, | |||
| 1129 | path1 = make_absolute(path1, *pwd); | 1336 | path1 = make_absolute(path1, *pwd); |
| 1130 | err = do_globbed_ls(conn, path1, tmp, lflag); | 1337 | err = do_globbed_ls(conn, path1, tmp, lflag); |
| 1131 | break; | 1338 | break; |
| 1339 | case I_DF: | ||
| 1340 | /* Default to current directory if no path specified */ | ||
| 1341 | if (path1 == NULL) | ||
| 1342 | path1 = xstrdup(*pwd); | ||
| 1343 | path1 = make_absolute(path1, *pwd); | ||
| 1344 | err = do_df(conn, path1, hflag, iflag); | ||
| 1345 | break; | ||
| 1132 | case I_LCHDIR: | 1346 | case I_LCHDIR: |
| 1133 | if (chdir(path1) == -1) { | 1347 | if (chdir(path1) == -1) { |
| 1134 | error("Couldn't change local directory to " | 1348 | error("Couldn't change local directory to " |
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: sftp.h,v 1.5 2006/03/25 22:22:43 djm Exp $ */ | 1 | /* $OpenBSD: sftp.h,v 1.9 2008/06/13 00:12:02 dtucker Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Copyright (c) 2001 Markus Friedl. All rights reserved. | 4 | * Copyright (c) 2001 Markus Friedl. All rights reserved. |
| @@ -79,6 +79,10 @@ | |||
| 79 | #define SSH2_FXF_TRUNC 0x00000010 | 79 | #define SSH2_FXF_TRUNC 0x00000010 |
| 80 | #define SSH2_FXF_EXCL 0x00000020 | 80 | #define SSH2_FXF_EXCL 0x00000020 |
| 81 | 81 | ||
| 82 | /* statvfs@openssh.com f_flag flags */ | ||
| 83 | #define SSH2_FXE_STATVFS_ST_RDONLY 0x00000001 | ||
| 84 | #define SSH2_FXE_STATVFS_ST_NOSUID 0x00000002 | ||
| 85 | |||
| 82 | /* status messages */ | 86 | /* status messages */ |
| 83 | #define SSH2_FX_OK 0 | 87 | #define SSH2_FX_OK 0 |
| 84 | #define SSH2_FX_EOF 1 | 88 | #define SSH2_FX_EOF 1 |
| @@ -90,3 +94,8 @@ | |||
| 90 | #define SSH2_FX_CONNECTION_LOST 7 | 94 | #define SSH2_FX_CONNECTION_LOST 7 |
| 91 | #define SSH2_FX_OP_UNSUPPORTED 8 | 95 | #define SSH2_FX_OP_UNSUPPORTED 8 |
| 92 | #define SSH2_FX_MAX 8 | 96 | #define SSH2_FX_MAX 8 |
| 97 | |||
| 98 | struct passwd; | ||
| 99 | |||
| 100 | int sftp_server_main(int, char **, struct passwd *); | ||
| 101 | void sftp_server_cleanup_exit(int) __attribute__((noreturn)); | ||
| @@ -103,4 +103,4 @@ AUTHORS | |||
| 103 | ated OpenSSH. Markus Friedl contributed the support for SSH protocol | 103 | ated OpenSSH. Markus Friedl contributed the support for SSH protocol |
| 104 | versions 1.5 and 2.0. | 104 | versions 1.5 and 2.0. |
| 105 | 105 | ||
| 106 | OpenBSD 4.2 June 12, 2007 2 | 106 | OpenBSD 4.4 June 12, 2007 2 |
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: ssh-add.c,v 1.89 2006/08/03 03:34:42 deraadt Exp $ */ | 1 | /* $OpenBSD: ssh-add.c,v 1.90 2007/09/09 11:38:01 sobrado Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
| @@ -42,6 +42,7 @@ | |||
| 42 | #include <sys/param.h> | 42 | #include <sys/param.h> |
| 43 | 43 | ||
| 44 | #include <openssl/evp.h> | 44 | #include <openssl/evp.h> |
| 45 | #include "openbsd-compat/openssl-compat.h" | ||
| 45 | 46 | ||
| 46 | #include <fcntl.h> | 47 | #include <fcntl.h> |
| 47 | #include <pwd.h> | 48 | #include <pwd.h> |
| @@ -317,7 +318,7 @@ do_file(AuthenticationConnection *ac, int deleting, char *file) | |||
| 317 | static void | 318 | static void |
| 318 | usage(void) | 319 | usage(void) |
| 319 | { | 320 | { |
| 320 | fprintf(stderr, "Usage: %s [options] [file ...]\n", __progname); | 321 | fprintf(stderr, "usage: %s [options] [file ...]\n", __progname); |
| 321 | fprintf(stderr, "Options:\n"); | 322 | fprintf(stderr, "Options:\n"); |
| 322 | fprintf(stderr, " -l List fingerprints of all identities.\n"); | 323 | fprintf(stderr, " -l List fingerprints of all identities.\n"); |
| 323 | fprintf(stderr, " -L List public key parameters of all identities.\n"); | 324 | fprintf(stderr, " -L List public key parameters of all identities.\n"); |
diff --git a/ssh-agent.0 b/ssh-agent.0 index 823456a26..90348a6b2 100644 --- a/ssh-agent.0 +++ b/ssh-agent.0 | |||
| @@ -4,7 +4,7 @@ NAME | |||
| 4 | ssh-agent - authentication agent | 4 | ssh-agent - authentication agent |
| 5 | 5 | ||
| 6 | SYNOPSIS | 6 | SYNOPSIS |
| 7 | ssh-agent [-a bind_address] [-c | -s] [-t life] [-d] [command [args ...]] | 7 | ssh-agent [-c | -s] [-d] [-a bind_address] [-t life] [command [arg ...]] |
| 8 | ssh-agent [-c | -s] -k | 8 | ssh-agent [-c | -s] -k |
| 9 | 9 | ||
| 10 | DESCRIPTION | 10 | DESCRIPTION |
| @@ -24,12 +24,15 @@ DESCRIPTION | |||
| 24 | -c Generate C-shell commands on stdout. This is the default if | 24 | -c Generate C-shell commands on stdout. This is the default if |
| 25 | SHELL looks like it's a csh style of shell. | 25 | SHELL looks like it's a csh style of shell. |
| 26 | 26 | ||
| 27 | -s Generate Bourne shell commands on stdout. This is the default if | 27 | -d Debug mode. When this option is specified ssh-agent will not |
| 28 | SHELL does not look like it's a csh style of shell. | 28 | fork. |
| 29 | 29 | ||
| 30 | -k Kill the current agent (given by the SSH_AGENT_PID environment | 30 | -k Kill the current agent (given by the SSH_AGENT_PID environment |
| 31 | variable). | 31 | variable). |
| 32 | 32 | ||
| 33 | -s Generate Bourne shell commands on stdout. This is the default if | ||
| 34 | SHELL does not look like it's a csh style of shell. | ||
| 35 | |||
| 33 | -t life | 36 | -t life |
| 34 | Set a default value for the maximum lifetime of identities added | 37 | Set a default value for the maximum lifetime of identities added |
| 35 | to the agent. The lifetime may be specified in seconds or in a | 38 | to the agent. The lifetime may be specified in seconds or in a |
| @@ -37,9 +40,6 @@ DESCRIPTION | |||
| 37 | for an identity with ssh-add(1) overrides this value. Without | 40 | for an identity with ssh-add(1) overrides this value. Without |
| 38 | this option the default maximum lifetime is forever. | 41 | this option the default maximum lifetime is forever. |
| 39 | 42 | ||
| 40 | -d Debug mode. When this option is specified ssh-agent will not | ||
| 41 | fork. | ||
| 42 | |||
| 43 | If a commandline is given, this is executed as a subprocess of the agent. | 43 | If a commandline is given, this is executed as a subprocess of the agent. |
| 44 | When the command dies, so does the agent. | 44 | When the command dies, so does the agent. |
| 45 | 45 | ||
| @@ -114,4 +114,4 @@ AUTHORS | |||
| 114 | ated OpenSSH. Markus Friedl contributed the support for SSH protocol | 114 | ated OpenSSH. Markus Friedl contributed the support for SSH protocol |
| 115 | versions 1.5 and 2.0. | 115 | versions 1.5 and 2.0. |
| 116 | 116 | ||
| 117 | OpenBSD 4.2 June 5, 2007 2 | 117 | OpenBSD 4.4 June 5, 2007 2 |
diff --git a/ssh-agent.1 b/ssh-agent.1 index 1b5a5bb2a..6a5dc62af 100644 --- a/ssh-agent.1 +++ b/ssh-agent.1 | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | .\" $OpenBSD: ssh-agent.1,v 1.45 2007/05/31 19:20:16 jmc Exp $ | 1 | .\" $OpenBSD: ssh-agent.1,v 1.46 2007/09/09 11:38:01 sobrado Exp $ |
| 2 | .\" | 2 | .\" |
| 3 | .\" Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | .\" Author: Tatu Ylonen <ylo@cs.hut.fi> |
| 4 | .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | .\" Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
| @@ -42,11 +42,11 @@ | |||
| 42 | .Nd authentication agent | 42 | .Nd authentication agent |
| 43 | .Sh SYNOPSIS | 43 | .Sh SYNOPSIS |
| 44 | .Nm ssh-agent | 44 | .Nm ssh-agent |
| 45 | .Op Fl a Ar bind_address | ||
| 46 | .Op Fl c Li | Fl s | 45 | .Op Fl c Li | Fl s |
| 47 | .Op Fl t Ar life | ||
| 48 | .Op Fl d | 46 | .Op Fl d |
| 49 | .Op Ar command Op Ar args ... | 47 | .Op Fl a Ar bind_address |
| 48 | .Op Fl t Ar life | ||
| 49 | .Op Ar command Op Ar arg ... | ||
| 50 | .Nm ssh-agent | 50 | .Nm ssh-agent |
| 51 | .Op Fl c Li | Fl s | 51 | .Op Fl c Li | Fl s |
| 52 | .Fl k | 52 | .Fl k |
| @@ -77,16 +77,21 @@ Generate C-shell commands on | |||
| 77 | This is the default if | 77 | This is the default if |
| 78 | .Ev SHELL | 78 | .Ev SHELL |
| 79 | looks like it's a csh style of shell. | 79 | looks like it's a csh style of shell. |
| 80 | .It Fl d | ||
| 81 | Debug mode. | ||
| 82 | When this option is specified | ||
| 83 | .Nm | ||
| 84 | will not fork. | ||
| 85 | .It Fl k | ||
| 86 | Kill the current agent (given by the | ||
| 87 | .Ev SSH_AGENT_PID | ||
| 88 | environment variable). | ||
| 80 | .It Fl s | 89 | .It Fl s |
| 81 | Generate Bourne shell commands on | 90 | Generate Bourne shell commands on |
| 82 | .Dv stdout . | 91 | .Dv stdout . |
| 83 | This is the default if | 92 | This is the default if |
| 84 | .Ev SHELL | 93 | .Ev SHELL |
| 85 | does not look like it's a csh style of shell. | 94 | does not look like it's a csh style of shell. |
| 86 | .It Fl k | ||
| 87 | Kill the current agent (given by the | ||
| 88 | .Ev SSH_AGENT_PID | ||
| 89 | environment variable). | ||
| 90 | .It Fl t Ar life | 95 | .It Fl t Ar life |
| 91 | Set a default value for the maximum lifetime of identities added to the agent. | 96 | Set a default value for the maximum lifetime of identities added to the agent. |
| 92 | The lifetime may be specified in seconds or in a time format specified in | 97 | The lifetime may be specified in seconds or in a time format specified in |
| @@ -95,11 +100,6 @@ A lifetime specified for an identity with | |||
| 95 | .Xr ssh-add 1 | 100 | .Xr ssh-add 1 |
| 96 | overrides this value. | 101 | overrides this value. |
| 97 | Without this option the default maximum lifetime is forever. | 102 | Without this option the default maximum lifetime is forever. |
| 98 | .It Fl d | ||
| 99 | Debug mode. | ||
| 100 | When this option is specified | ||
| 101 | .Nm | ||
| 102 | will not fork. | ||
| 103 | .El | 103 | .El |
| 104 | .Pp | 104 | .Pp |
| 105 | If a commandline is given, this is executed as a subprocess of the agent. | 105 | If a commandline is given, this is executed as a subprocess of the agent. |
diff --git a/ssh-agent.c b/ssh-agent.c index c3d5e5a75..9123cfe6b 100644 --- a/ssh-agent.c +++ b/ssh-agent.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: ssh-agent.c,v 1.155 2007/03/19 12:16:42 dtucker Exp $ */ | 1 | /* $OpenBSD: ssh-agent.c,v 1.159 2008/06/28 14:05:15 djm Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
| @@ -51,6 +51,7 @@ | |||
| 51 | 51 | ||
| 52 | #include <openssl/evp.h> | 52 | #include <openssl/evp.h> |
| 53 | #include <openssl/md5.h> | 53 | #include <openssl/md5.h> |
| 54 | #include "openbsd-compat/openssl-compat.h" | ||
| 54 | 55 | ||
| 55 | #include <errno.h> | 56 | #include <errno.h> |
| 56 | #include <fcntl.h> | 57 | #include <fcntl.h> |
| @@ -311,6 +312,7 @@ process_sign_request2(SocketEntry *e) | |||
| 311 | u_char *blob, *data, *signature = NULL; | 312 | u_char *blob, *data, *signature = NULL; |
| 312 | u_int blen, dlen, slen = 0; | 313 | u_int blen, dlen, slen = 0; |
| 313 | extern int datafellows; | 314 | extern int datafellows; |
| 315 | int odatafellows; | ||
| 314 | int ok = -1, flags; | 316 | int ok = -1, flags; |
| 315 | Buffer msg; | 317 | Buffer msg; |
| 316 | Key *key; | 318 | Key *key; |
| @@ -321,6 +323,7 @@ process_sign_request2(SocketEntry *e) | |||
| 321 | data = buffer_get_string(&e->request, &dlen); | 323 | data = buffer_get_string(&e->request, &dlen); |
| 322 | 324 | ||
| 323 | flags = buffer_get_int(&e->request); | 325 | flags = buffer_get_int(&e->request); |
| 326 | odatafellows = datafellows; | ||
| 324 | if (flags & SSH_AGENT_OLD_SIGNATURE) | 327 | if (flags & SSH_AGENT_OLD_SIGNATURE) |
| 325 | datafellows = SSH_BUG_SIGBLOB; | 328 | datafellows = SSH_BUG_SIGBLOB; |
| 326 | 329 | ||
| @@ -346,6 +349,7 @@ process_sign_request2(SocketEntry *e) | |||
| 346 | xfree(blob); | 349 | xfree(blob); |
| 347 | if (signature != NULL) | 350 | if (signature != NULL) |
| 348 | xfree(signature); | 351 | xfree(signature); |
| 352 | datafellows = odatafellows; | ||
| 349 | } | 353 | } |
| 350 | 354 | ||
| 351 | /* shared */ | 355 | /* shared */ |
| @@ -457,6 +461,7 @@ static void | |||
| 457 | process_add_identity(SocketEntry *e, int version) | 461 | process_add_identity(SocketEntry *e, int version) |
| 458 | { | 462 | { |
| 459 | Idtab *tab = idtab_lookup(version); | 463 | Idtab *tab = idtab_lookup(version); |
| 464 | Identity *id; | ||
| 460 | int type, success = 0, death = 0, confirm = 0; | 465 | int type, success = 0, death = 0, confirm = 0; |
| 461 | char *type_name, *comment; | 466 | char *type_name, *comment; |
| 462 | Key *k = NULL; | 467 | Key *k = NULL; |
| @@ -524,9 +529,8 @@ process_add_identity(SocketEntry *e, int version) | |||
| 524 | xfree(comment); | 529 | xfree(comment); |
| 525 | goto send; | 530 | goto send; |
| 526 | } | 531 | } |
| 527 | success = 1; | ||
| 528 | while (buffer_len(&e->request)) { | 532 | while (buffer_len(&e->request)) { |
| 529 | switch (buffer_get_char(&e->request)) { | 533 | switch ((type = buffer_get_char(&e->request))) { |
| 530 | case SSH_AGENT_CONSTRAIN_LIFETIME: | 534 | case SSH_AGENT_CONSTRAIN_LIFETIME: |
| 531 | death = time(NULL) + buffer_get_int(&e->request); | 535 | death = time(NULL) + buffer_get_int(&e->request); |
| 532 | break; | 536 | break; |
| @@ -534,24 +538,29 @@ process_add_identity(SocketEntry *e, int version) | |||
| 534 | confirm = 1; | 538 | confirm = 1; |
| 535 | break; | 539 | break; |
| 536 | default: | 540 | default: |
| 537 | break; | 541 | error("process_add_identity: " |
| 542 | "Unknown constraint type %d", type); | ||
| 543 | xfree(comment); | ||
| 544 | key_free(k); | ||
| 545 | goto send; | ||
| 538 | } | 546 | } |
| 539 | } | 547 | } |
| 548 | success = 1; | ||
| 540 | if (lifetime && !death) | 549 | if (lifetime && !death) |
| 541 | death = time(NULL) + lifetime; | 550 | death = time(NULL) + lifetime; |
| 542 | if (lookup_identity(k, version) == NULL) { | 551 | if ((id = lookup_identity(k, version)) == NULL) { |
| 543 | Identity *id = xmalloc(sizeof(Identity)); | 552 | id = xmalloc(sizeof(Identity)); |
| 544 | id->key = k; | 553 | id->key = k; |
| 545 | id->comment = comment; | ||
| 546 | id->death = death; | ||
| 547 | id->confirm = confirm; | ||
| 548 | TAILQ_INSERT_TAIL(&tab->idlist, id, next); | 554 | TAILQ_INSERT_TAIL(&tab->idlist, id, next); |
| 549 | /* Increment the number of identities. */ | 555 | /* Increment the number of identities. */ |
| 550 | tab->nentries++; | 556 | tab->nentries++; |
| 551 | } else { | 557 | } else { |
| 552 | key_free(k); | 558 | key_free(k); |
| 553 | xfree(comment); | 559 | xfree(id->comment); |
| 554 | } | 560 | } |
| 561 | id->comment = comment; | ||
| 562 | id->death = death; | ||
| 563 | id->confirm = confirm; | ||
| 555 | send: | 564 | send: |
| 556 | buffer_put_int(&e->output, 1); | 565 | buffer_put_int(&e->output, 1); |
| 557 | buffer_put_char(&e->output, | 566 | buffer_put_char(&e->output, |
| @@ -602,10 +611,10 @@ no_identities(SocketEntry *e, u_int type) | |||
| 602 | 611 | ||
| 603 | #ifdef SMARTCARD | 612 | #ifdef SMARTCARD |
| 604 | static void | 613 | static void |
| 605 | process_add_smartcard_key (SocketEntry *e) | 614 | process_add_smartcard_key(SocketEntry *e) |
| 606 | { | 615 | { |
| 607 | char *sc_reader_id = NULL, *pin; | 616 | char *sc_reader_id = NULL, *pin; |
| 608 | int i, version, success = 0, death = 0, confirm = 0; | 617 | int i, type, version, success = 0, death = 0, confirm = 0; |
| 609 | Key **keys, *k; | 618 | Key **keys, *k; |
| 610 | Identity *id; | 619 | Identity *id; |
| 611 | Idtab *tab; | 620 | Idtab *tab; |
| @@ -614,7 +623,7 @@ process_add_smartcard_key (SocketEntry *e) | |||
| 614 | pin = buffer_get_string(&e->request, NULL); | 623 | pin = buffer_get_string(&e->request, NULL); |
| 615 | 624 | ||
| 616 | while (buffer_len(&e->request)) { | 625 | while (buffer_len(&e->request)) { |
| 617 | switch (buffer_get_char(&e->request)) { | 626 | switch ((type = buffer_get_char(&e->request))) { |
| 618 | case SSH_AGENT_CONSTRAIN_LIFETIME: | 627 | case SSH_AGENT_CONSTRAIN_LIFETIME: |
| 619 | death = time(NULL) + buffer_get_int(&e->request); | 628 | death = time(NULL) + buffer_get_int(&e->request); |
| 620 | break; | 629 | break; |
| @@ -622,7 +631,11 @@ process_add_smartcard_key (SocketEntry *e) | |||
| 622 | confirm = 1; | 631 | confirm = 1; |
| 623 | break; | 632 | break; |
| 624 | default: | 633 | default: |
| 625 | break; | 634 | error("process_add_smartcard_key: " |
| 635 | "Unknown constraint type %d", type); | ||
| 636 | xfree(sc_reader_id); | ||
| 637 | xfree(pin); | ||
| 638 | goto send; | ||
| 626 | } | 639 | } |
| 627 | } | 640 | } |
| 628 | if (lifetime && !death) | 641 | if (lifetime && !death) |
| @@ -948,7 +961,8 @@ after_select(fd_set *readset, fd_set *writeset) | |||
| 948 | buffer_ptr(&sockets[i].output), | 961 | buffer_ptr(&sockets[i].output), |
| 949 | buffer_len(&sockets[i].output)); | 962 | buffer_len(&sockets[i].output)); |
| 950 | if (len == -1 && (errno == EAGAIN || | 963 | if (len == -1 && (errno == EAGAIN || |
| 951 | errno == EINTR)) | 964 | errno == EINTR || |
| 965 | errno == EWOULDBLOCK)) | ||
| 952 | continue; | 966 | continue; |
| 953 | break; | 967 | break; |
| 954 | } while (1); | 968 | } while (1); |
| @@ -962,7 +976,8 @@ after_select(fd_set *readset, fd_set *writeset) | |||
| 962 | do { | 976 | do { |
| 963 | len = read(sockets[i].fd, buf, sizeof(buf)); | 977 | len = read(sockets[i].fd, buf, sizeof(buf)); |
| 964 | if (len == -1 && (errno == EAGAIN || | 978 | if (len == -1 && (errno == EAGAIN || |
| 965 | errno == EINTR)) | 979 | errno == EINTR || |
| 980 | errno == EWOULDBLOCK)) | ||
| 966 | continue; | 981 | continue; |
| 967 | break; | 982 | break; |
| 968 | } while (1); | 983 | } while (1); |
| @@ -1016,7 +1031,7 @@ check_parent_exists(void) | |||
| 1016 | static void | 1031 | static void |
| 1017 | usage(void) | 1032 | usage(void) |
| 1018 | { | 1033 | { |
| 1019 | fprintf(stderr, "Usage: %s [options] [command [args ...]]\n", | 1034 | fprintf(stderr, "usage: %s [options] [command [arg ...]]\n", |
| 1020 | __progname); | 1035 | __progname); |
| 1021 | fprintf(stderr, "Options:\n"); | 1036 | fprintf(stderr, "Options:\n"); |
| 1022 | fprintf(stderr, " -c Generate C-shell commands on stdout.\n"); | 1037 | fprintf(stderr, " -c Generate C-shell commands on stdout.\n"); |
diff --git a/ssh-keygen.0 b/ssh-keygen.0 index 2f8ee264e..ca8b5cf8c 100644 --- a/ssh-keygen.0 +++ b/ssh-keygen.0 | |||
| @@ -130,7 +130,9 @@ DESCRIPTION | |||
| 130 | 130 | ||
| 131 | -l Show fingerprint of specified public key file. Private RSA1 keys | 131 | -l Show fingerprint of specified public key file. Private RSA1 keys |
| 132 | are also supported. For RSA and DSA keys ssh-keygen tries to | 132 | are also supported. For RSA and DSA keys ssh-keygen tries to |
| 133 | find the matching public key file and prints its fingerprint. | 133 | find the matching public key file and prints its fingerprint. If |
| 134 | combined with -v, an ASCII art representation of the key is sup- | ||
| 135 | plied with the fingerprint. | ||
| 134 | 136 | ||
| 135 | -M memory | 137 | -M memory |
| 136 | Specify the amount of memory to use (in megabytes) when generat- | 138 | Specify the amount of memory to use (in megabytes) when generat- |
| @@ -284,4 +286,4 @@ AUTHORS | |||
| 284 | created OpenSSH. Markus Friedl contributed the support for SSH protocol | 286 | created OpenSSH. Markus Friedl contributed the support for SSH protocol |
| 285 | versions 1.5 and 2.0. | 287 | versions 1.5 and 2.0. |
| 286 | 288 | ||
| 287 | OpenBSD 4.2 June 5, 2007 5 | 289 | OpenBSD 4.4 June 12, 2008 5 |
diff --git a/ssh-keygen.1 b/ssh-keygen.1 index fc460b5ac..cd6064f37 100644 --- a/ssh-keygen.1 +++ b/ssh-keygen.1 | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | .\" $OpenBSD: ssh-keygen.1,v 1.75 2007/05/31 19:20:16 jmc Exp $ | 1 | .\" $OpenBSD: ssh-keygen.1,v 1.78 2008/06/12 19:10:09 jmc Exp $ |
| 2 | .\" | 2 | .\" |
| 3 | .\" -*- nroff -*- | 3 | .\" -*- nroff -*- |
| 4 | .\" | 4 | .\" |
| @@ -37,7 +37,7 @@ | |||
| 37 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | 37 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
| 38 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | 38 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| 39 | .\" | 39 | .\" |
| 40 | .Dd $Mdocdate: June 5 2007 $ | 40 | .Dd $Mdocdate: June 12 2008 $ |
| 41 | .Dt SSH-KEYGEN 1 | 41 | .Dt SSH-KEYGEN 1 |
| 42 | .Os | 42 | .Os |
| 43 | .Sh NAME | 43 | .Sh NAME |
| @@ -262,6 +262,9 @@ Private RSA1 keys are also supported. | |||
| 262 | For RSA and DSA keys | 262 | For RSA and DSA keys |
| 263 | .Nm | 263 | .Nm |
| 264 | tries to find the matching public key file and prints its fingerprint. | 264 | tries to find the matching public key file and prints its fingerprint. |
| 265 | If combined with | ||
| 266 | .Fl v , | ||
| 267 | an ASCII art representation of the key is supplied with the fingerprint. | ||
| 265 | .It Fl M Ar memory | 268 | .It Fl M Ar memory |
| 266 | Specify the amount of memory to use (in megabytes) when generating | 269 | Specify the amount of memory to use (in megabytes) when generating |
| 267 | candidate moduli for DH-GEX. | 270 | candidate moduli for DH-GEX. |
diff --git a/ssh-keygen.c b/ssh-keygen.c index 04a9b939a..f7e284062 100644 --- a/ssh-keygen.c +++ b/ssh-keygen.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: ssh-keygen.c,v 1.160 2007/01/21 01:41:54 stevesk Exp $ */ | 1 | /* $OpenBSD: ssh-keygen.c,v 1.171 2008/07/13 21:22:52 sthen Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| 4 | * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
| @@ -21,6 +21,7 @@ | |||
| 21 | 21 | ||
| 22 | #include <openssl/evp.h> | 22 | #include <openssl/evp.h> |
| 23 | #include <openssl/pem.h> | 23 | #include <openssl/pem.h> |
| 24 | #include "openbsd-compat/openssl-compat.h" | ||
| 24 | 25 | ||
| 25 | #include <errno.h> | 26 | #include <errno.h> |
| 26 | #include <fcntl.h> | 27 | #include <fcntl.h> |
| @@ -71,6 +72,8 @@ int change_comment = 0; | |||
| 71 | 72 | ||
| 72 | int quiet = 0; | 73 | int quiet = 0; |
| 73 | 74 | ||
| 75 | int log_level = SYSLOG_LEVEL_INFO; | ||
| 76 | |||
| 74 | /* Flag indicating that we want to hash a known_hosts file */ | 77 | /* Flag indicating that we want to hash a known_hosts file */ |
| 75 | int hash_hosts = 0; | 78 | int hash_hosts = 0; |
| 76 | /* Flag indicating that we want lookup a host in known_hosts file */ | 79 | /* Flag indicating that we want lookup a host in known_hosts file */ |
| @@ -141,8 +144,7 @@ ask_filename(struct passwd *pw, const char *prompt) | |||
| 141 | fprintf(stderr, "%s (%s): ", prompt, identity_file); | 144 | fprintf(stderr, "%s (%s): ", prompt, identity_file); |
| 142 | if (fgets(buf, sizeof(buf), stdin) == NULL) | 145 | if (fgets(buf, sizeof(buf), stdin) == NULL) |
| 143 | exit(1); | 146 | exit(1); |
| 144 | if (strchr(buf, '\n')) | 147 | buf[strcspn(buf, "\n")] = '\0'; |
| 145 | *strchr(buf, '\n') = 0; | ||
| 146 | if (strcmp(buf, "") != 0) | 148 | if (strcmp(buf, "") != 0) |
| 147 | strlcpy(identity_file, buf, sizeof(identity_file)); | 149 | strlcpy(identity_file, buf, sizeof(identity_file)); |
| 148 | have_identity = 1; | 150 | have_identity = 1; |
| @@ -504,8 +506,8 @@ do_fingerprint(struct passwd *pw) | |||
| 504 | { | 506 | { |
| 505 | FILE *f; | 507 | FILE *f; |
| 506 | Key *public; | 508 | Key *public; |
| 507 | char *comment = NULL, *cp, *ep, line[16*1024], *fp; | 509 | char *comment = NULL, *cp, *ep, line[16*1024], *fp, *ra; |
| 508 | int i, skip = 0, num = 1, invalid = 1; | 510 | int i, skip = 0, num = 0, invalid = 1; |
| 509 | enum fp_rep rep; | 511 | enum fp_rep rep; |
| 510 | enum fp_type fptype; | 512 | enum fp_type fptype; |
| 511 | struct stat st; | 513 | struct stat st; |
| @@ -522,9 +524,14 @@ do_fingerprint(struct passwd *pw) | |||
| 522 | public = key_load_public(identity_file, &comment); | 524 | public = key_load_public(identity_file, &comment); |
| 523 | if (public != NULL) { | 525 | if (public != NULL) { |
| 524 | fp = key_fingerprint(public, fptype, rep); | 526 | fp = key_fingerprint(public, fptype, rep); |
| 525 | printf("%u %s %s\n", key_size(public), fp, comment); | 527 | ra = key_fingerprint(public, fptype, SSH_FP_RANDOMART); |
| 528 | printf("%u %s %s (%s)\n", key_size(public), fp, comment, | ||
| 529 | key_type(public)); | ||
| 530 | if (log_level >= SYSLOG_LEVEL_VERBOSE) | ||
| 531 | printf("%s\n", ra); | ||
| 526 | key_free(public); | 532 | key_free(public); |
| 527 | xfree(comment); | 533 | xfree(comment); |
| 534 | xfree(ra); | ||
| 528 | xfree(fp); | 535 | xfree(fp); |
| 529 | exit(0); | 536 | exit(0); |
| 530 | } | 537 | } |
| @@ -536,9 +543,9 @@ do_fingerprint(struct passwd *pw) | |||
| 536 | f = fopen(identity_file, "r"); | 543 | f = fopen(identity_file, "r"); |
| 537 | if (f != NULL) { | 544 | if (f != NULL) { |
| 538 | while (fgets(line, sizeof(line), f)) { | 545 | while (fgets(line, sizeof(line), f)) { |
| 539 | i = strlen(line) - 1; | 546 | if ((cp = strchr(line, '\n')) == NULL) { |
| 540 | if (line[i] != '\n') { | 547 | error("line %d too long: %.40s...", |
| 541 | error("line %d too long: %.40s...", num, line); | 548 | num + 1, line); |
| 542 | skip = 1; | 549 | skip = 1; |
| 543 | continue; | 550 | continue; |
| 544 | } | 551 | } |
| @@ -547,7 +554,7 @@ do_fingerprint(struct passwd *pw) | |||
| 547 | skip = 0; | 554 | skip = 0; |
| 548 | continue; | 555 | continue; |
| 549 | } | 556 | } |
| 550 | line[i] = '\0'; | 557 | *cp = '\0'; |
| 551 | 558 | ||
| 552 | /* Skip leading whitespace, empty and comment lines. */ | 559 | /* Skip leading whitespace, empty and comment lines. */ |
| 553 | for (cp = line; *cp == ' ' || *cp == '\t'; cp++) | 560 | for (cp = line; *cp == ' ' || *cp == '\t'; cp++) |
| @@ -582,8 +589,12 @@ do_fingerprint(struct passwd *pw) | |||
| 582 | } | 589 | } |
| 583 | comment = *cp ? cp : comment; | 590 | comment = *cp ? cp : comment; |
| 584 | fp = key_fingerprint(public, fptype, rep); | 591 | fp = key_fingerprint(public, fptype, rep); |
| 585 | printf("%u %s %s\n", key_size(public), fp, | 592 | ra = key_fingerprint(public, fptype, SSH_FP_RANDOMART); |
| 586 | comment ? comment : "no comment"); | 593 | printf("%u %s %s (%s)\n", key_size(public), fp, |
| 594 | comment ? comment : "no comment", key_type(public)); | ||
| 595 | if (log_level >= SYSLOG_LEVEL_VERBOSE) | ||
| 596 | printf("%s\n", ra); | ||
| 597 | xfree(ra); | ||
| 587 | xfree(fp); | 598 | xfree(fp); |
| 588 | key_free(public); | 599 | key_free(public); |
| 589 | invalid = 0; | 600 | invalid = 0; |
| @@ -598,14 +609,31 @@ do_fingerprint(struct passwd *pw) | |||
| 598 | } | 609 | } |
| 599 | 610 | ||
| 600 | static void | 611 | static void |
| 601 | print_host(FILE *f, char *name, Key *public, int hash) | 612 | print_host(FILE *f, const char *name, Key *public, int hash) |
| 602 | { | 613 | { |
| 603 | if (hash && (name = host_hash(name, NULL, 0)) == NULL) | 614 | if (print_fingerprint) { |
| 604 | fatal("hash_host failed"); | 615 | enum fp_rep rep; |
| 605 | fprintf(f, "%s ", name); | 616 | enum fp_type fptype; |
| 606 | if (!key_write(public, f)) | 617 | char *fp, *ra; |
| 607 | fatal("key_write failed"); | 618 | |
| 608 | fprintf(f, "\n"); | 619 | fptype = print_bubblebabble ? SSH_FP_SHA1 : SSH_FP_MD5; |
| 620 | rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX; | ||
| 621 | fp = key_fingerprint(public, fptype, rep); | ||
| 622 | ra = key_fingerprint(public, fptype, SSH_FP_RANDOMART); | ||
| 623 | printf("%u %s %s (%s)\n", key_size(public), fp, name, | ||
| 624 | key_type(public)); | ||
| 625 | if (log_level >= SYSLOG_LEVEL_VERBOSE) | ||
| 626 | printf("%s\n", ra); | ||
| 627 | xfree(ra); | ||
| 628 | xfree(fp); | ||
| 629 | } else { | ||
| 630 | if (hash && (name = host_hash(name, NULL, 0)) == NULL) | ||
| 631 | fatal("hash_host failed"); | ||
| 632 | fprintf(f, "%s ", name); | ||
| 633 | if (!key_write(public, f)) | ||
| 634 | fatal("key_write failed"); | ||
| 635 | fprintf(f, "\n"); | ||
| 636 | } | ||
| 609 | } | 637 | } |
| 610 | 638 | ||
| 611 | static void | 639 | static void |
| @@ -615,7 +643,7 @@ do_known_hosts(struct passwd *pw, const char *name) | |||
| 615 | Key *public; | 643 | Key *public; |
| 616 | char *cp, *cp2, *kp, *kp2; | 644 | char *cp, *cp2, *kp, *kp2; |
| 617 | char line[16*1024], tmp[MAXPATHLEN], old[MAXPATHLEN]; | 645 | char line[16*1024], tmp[MAXPATHLEN], old[MAXPATHLEN]; |
| 618 | int c, i, skip = 0, inplace = 0, num = 0, invalid = 0, has_unhashed = 0; | 646 | int c, skip = 0, inplace = 0, num = 0, invalid = 0, has_unhashed = 0; |
| 619 | 647 | ||
| 620 | if (!have_identity) { | 648 | if (!have_identity) { |
| 621 | cp = tilde_expand_filename(_PATH_SSH_USER_HOSTFILE, pw->pw_uid); | 649 | cp = tilde_expand_filename(_PATH_SSH_USER_HOSTFILE, pw->pw_uid); |
| @@ -650,19 +678,18 @@ do_known_hosts(struct passwd *pw, const char *name) | |||
| 650 | } | 678 | } |
| 651 | 679 | ||
| 652 | while (fgets(line, sizeof(line), in)) { | 680 | while (fgets(line, sizeof(line), in)) { |
| 653 | num++; | 681 | if ((cp = strchr(line, '\n')) == NULL) { |
| 654 | i = strlen(line) - 1; | 682 | error("line %d too long: %.40s...", num + 1, line); |
| 655 | if (line[i] != '\n') { | ||
| 656 | error("line %d too long: %.40s...", num, line); | ||
| 657 | skip = 1; | 683 | skip = 1; |
| 658 | invalid = 1; | 684 | invalid = 1; |
| 659 | continue; | 685 | continue; |
| 660 | } | 686 | } |
| 687 | num++; | ||
| 661 | if (skip) { | 688 | if (skip) { |
| 662 | skip = 0; | 689 | skip = 0; |
| 663 | continue; | 690 | continue; |
| 664 | } | 691 | } |
| 665 | line[i] = '\0'; | 692 | *cp = '\0'; |
| 666 | 693 | ||
| 667 | /* Skip leading whitespace, empty and comment lines. */ | 694 | /* Skip leading whitespace, empty and comment lines. */ |
| 668 | for (cp = line; *cp == ' ' || *cp == '\t'; cp++) | 695 | for (cp = line; *cp == ' ' || *cp == '\t'; cp++) |
| @@ -726,7 +753,8 @@ do_known_hosts(struct passwd *pw, const char *name) | |||
| 726 | printf("# Host %s found: " | 753 | printf("# Host %s found: " |
| 727 | "line %d type %s\n", name, | 754 | "line %d type %s\n", name, |
| 728 | num, key_type(public)); | 755 | num, key_type(public)); |
| 729 | print_host(out, cp, public, hash_hosts); | 756 | print_host(out, name, public, |
| 757 | hash_hosts); | ||
| 730 | } | 758 | } |
| 731 | if (delete_host && !c) | 759 | if (delete_host && !c) |
| 732 | print_host(out, cp, public, 0); | 760 | print_host(out, cp, public, 0); |
| @@ -750,7 +778,7 @@ do_known_hosts(struct passwd *pw, const char *name) | |||
| 750 | fclose(in); | 778 | fclose(in); |
| 751 | 779 | ||
| 752 | if (invalid) { | 780 | if (invalid) { |
| 753 | fprintf(stderr, "%s is not a valid known_host file.\n", | 781 | fprintf(stderr, "%s is not a valid known_hosts file.\n", |
| 754 | identity_file); | 782 | identity_file); |
| 755 | if (inplace) { | 783 | if (inplace) { |
| 756 | fprintf(stderr, "Not replacing existing known_hosts " | 784 | fprintf(stderr, "Not replacing existing known_hosts " |
| @@ -962,8 +990,7 @@ do_change_comment(struct passwd *pw) | |||
| 962 | key_free(private); | 990 | key_free(private); |
| 963 | exit(1); | 991 | exit(1); |
| 964 | } | 992 | } |
| 965 | if (strchr(new_comment, '\n')) | 993 | new_comment[strcspn(new_comment, "\n")] = '\0'; |
| 966 | *strchr(new_comment, '\n') = 0; | ||
| 967 | } | 994 | } |
| 968 | 995 | ||
| 969 | /* Save the file using the new passphrase. */ | 996 | /* Save the file using the new passphrase. */ |
| @@ -1006,7 +1033,7 @@ do_change_comment(struct passwd *pw) | |||
| 1006 | static void | 1033 | static void |
| 1007 | usage(void) | 1034 | usage(void) |
| 1008 | { | 1035 | { |
| 1009 | fprintf(stderr, "Usage: %s [options]\n", __progname); | 1036 | fprintf(stderr, "usage: %s [options]\n", __progname); |
| 1010 | fprintf(stderr, "Options:\n"); | 1037 | fprintf(stderr, "Options:\n"); |
| 1011 | fprintf(stderr, " -a trials Number of trials for screening DH-GEX moduli.\n"); | 1038 | fprintf(stderr, " -a trials Number of trials for screening DH-GEX moduli.\n"); |
| 1012 | fprintf(stderr, " -B Show bubblebabble digest of key file.\n"); | 1039 | fprintf(stderr, " -B Show bubblebabble digest of key file.\n"); |
| @@ -1059,7 +1086,6 @@ main(int argc, char **argv) | |||
| 1059 | int opt, type, fd, download = 0; | 1086 | int opt, type, fd, download = 0; |
| 1060 | u_int32_t memory = 0, generator_wanted = 0, trials = 100; | 1087 | u_int32_t memory = 0, generator_wanted = 0, trials = 100; |
| 1061 | int do_gen_candidates = 0, do_screen_candidates = 0; | 1088 | int do_gen_candidates = 0, do_screen_candidates = 0; |
| 1062 | int log_level = SYSLOG_LEVEL_INFO; | ||
| 1063 | BIGNUM *start = NULL; | 1089 | BIGNUM *start = NULL; |
| 1064 | FILE *f; | 1090 | FILE *f; |
| 1065 | const char *errstr; | 1091 | const char *errstr; |
| @@ -1232,6 +1258,10 @@ main(int argc, char **argv) | |||
| 1232 | printf("Can only have one of -p and -c.\n"); | 1258 | printf("Can only have one of -p and -c.\n"); |
| 1233 | usage(); | 1259 | usage(); |
| 1234 | } | 1260 | } |
| 1261 | if (print_fingerprint && (delete_host || hash_hosts)) { | ||
| 1262 | printf("Cannot use -l with -D or -R.\n"); | ||
| 1263 | usage(); | ||
| 1264 | } | ||
| 1235 | if (delete_host || hash_hosts || find_host) | 1265 | if (delete_host || hash_hosts || find_host) |
| 1236 | do_known_hosts(pw, rr_hostname); | 1266 | do_known_hosts(pw, rr_hostname); |
| 1237 | if (print_fingerprint || print_bubblebabble) | 1267 | if (print_fingerprint || print_bubblebabble) |
| @@ -1436,10 +1466,15 @@ passphrase_again: | |||
| 1436 | 1466 | ||
| 1437 | if (!quiet) { | 1467 | if (!quiet) { |
| 1438 | char *fp = key_fingerprint(public, SSH_FP_MD5, SSH_FP_HEX); | 1468 | char *fp = key_fingerprint(public, SSH_FP_MD5, SSH_FP_HEX); |
| 1469 | char *ra = key_fingerprint(public, SSH_FP_MD5, | ||
| 1470 | SSH_FP_RANDOMART); | ||
| 1439 | printf("Your public key has been saved in %s.\n", | 1471 | printf("Your public key has been saved in %s.\n", |
| 1440 | identity_file); | 1472 | identity_file); |
| 1441 | printf("The key fingerprint is:\n"); | 1473 | printf("The key fingerprint is:\n"); |
| 1442 | printf("%s %s\n", fp, comment); | 1474 | printf("%s %s\n", fp, comment); |
| 1475 | printf("The key's randomart image is:\n"); | ||
| 1476 | printf("%s\n", ra); | ||
| 1477 | xfree(ra); | ||
| 1443 | xfree(fp); | 1478 | xfree(fp); |
| 1444 | } | 1479 | } |
| 1445 | 1480 | ||
diff --git a/ssh-keyscan.0 b/ssh-keyscan.0 index 64d23c436..5cd68816c 100644 --- a/ssh-keyscan.0 +++ b/ssh-keyscan.0 | |||
| @@ -50,7 +50,7 @@ DESCRIPTION | |||
| 50 | The possible values are ``rsa1'' for protocol version 1 and | 50 | The possible values are ``rsa1'' for protocol version 1 and |
| 51 | ``rsa'' or ``dsa'' for protocol version 2. Multiple values may | 51 | ``rsa'' or ``dsa'' for protocol version 2. Multiple values may |
| 52 | be specified by separating them with commas. The default is | 52 | be specified by separating them with commas. The default is |
| 53 | ``rsa1''. | 53 | ``rsa''. |
| 54 | 54 | ||
| 55 | -v Verbose mode. Causes ssh-keyscan to print debugging messages | 55 | -v Verbose mode. Causes ssh-keyscan to print debugging messages |
| 56 | about its progress. | 56 | about its progress. |
| @@ -104,4 +104,4 @@ BUGS | |||
| 104 | This is because it opens a connection to the ssh port, reads the public | 104 | This is because it opens a connection to the ssh port, reads the public |
| 105 | key, and drops the connection as soon as it gets the key. | 105 | key, and drops the connection as soon as it gets the key. |
| 106 | 106 | ||
| 107 | OpenBSD 4.2 June 5, 2007 2 | 107 | OpenBSD 4.4 April 30, 2008 2 |
diff --git a/ssh-keyscan.1 b/ssh-keyscan.1 index 005e57a2b..8a4f3bcba 100644 --- a/ssh-keyscan.1 +++ b/ssh-keyscan.1 | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | .\" $OpenBSD: ssh-keyscan.1,v 1.23 2007/05/31 19:20:16 jmc Exp $ | 1 | .\" $OpenBSD: ssh-keyscan.1,v 1.24 2008/04/30 10:14:03 djm Exp $ |
| 2 | .\" | 2 | .\" |
| 3 | .\" Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>. | 3 | .\" Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>. |
| 4 | .\" | 4 | .\" |
| @@ -6,7 +6,7 @@ | |||
| 6 | .\" permitted provided that due credit is given to the author and the | 6 | .\" permitted provided that due credit is given to the author and the |
| 7 | .\" OpenBSD project by leaving this copyright notice intact. | 7 | .\" OpenBSD project by leaving this copyright notice intact. |
| 8 | .\" | 8 | .\" |
| 9 | .Dd $Mdocdate: June 5 2007 $ | 9 | .Dd $Mdocdate: April 30 2008 $ |
| 10 | .Dt SSH-KEYSCAN 1 | 10 | .Dt SSH-KEYSCAN 1 |
| 11 | .Os | 11 | .Os |
| 12 | .Sh NAME | 12 | .Sh NAME |
| @@ -94,7 +94,7 @@ or | |||
| 94 | for protocol version 2. | 94 | for protocol version 2. |
| 95 | Multiple values may be specified by separating them with commas. | 95 | Multiple values may be specified by separating them with commas. |
| 96 | The default is | 96 | The default is |
| 97 | .Dq rsa1 . | 97 | .Dq rsa . |
| 98 | .It Fl v | 98 | .It Fl v |
| 99 | Verbose mode. | 99 | Verbose mode. |
| 100 | Causes | 100 | Causes |
diff --git a/ssh-keyscan.c b/ssh-keyscan.c index 7ffbda421..d81077764 100644 --- a/ssh-keyscan.c +++ b/ssh-keyscan.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: ssh-keyscan.c,v 1.74 2006/10/06 02:29:19 djm Exp $ */ | 1 | /* $OpenBSD: ssh-keyscan.c,v 1.76 2008/04/30 10:14:03 djm Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>. | 3 | * Copyright 1995, 1996 by David Mazieres <dm@lcs.mit.edu>. |
| 4 | * | 4 | * |
| @@ -56,7 +56,7 @@ int ssh_port = SSH_DEFAULT_PORT; | |||
| 56 | #define KT_DSA 2 | 56 | #define KT_DSA 2 |
| 57 | #define KT_RSA 4 | 57 | #define KT_RSA 4 |
| 58 | 58 | ||
| 59 | int get_keytypes = KT_RSA1; /* Get only RSA1 keys by default */ | 59 | int get_keytypes = KT_RSA; /* Get only RSA keys by default */ |
| 60 | 60 | ||
| 61 | int hash_hosts = 0; /* Hash hostname on output */ | 61 | int hash_hosts = 0; /* Hash hostname on output */ |
| 62 | 62 | ||
| @@ -358,7 +358,7 @@ keygrab_ssh2(con *c) | |||
| 358 | { | 358 | { |
| 359 | int j; | 359 | int j; |
| 360 | 360 | ||
| 361 | packet_set_connection(c->c_fd, c->c_fd, timeout); | 361 | packet_set_connection(c->c_fd, c->c_fd); |
| 362 | enable_compat20(); | 362 | enable_compat20(); |
| 363 | myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = c->c_keytype == KT_DSA? | 363 | myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = c->c_keytype == KT_DSA? |
| 364 | "ssh-dss": "ssh-rsa"; | 364 | "ssh-dss": "ssh-rsa"; |
| @@ -410,7 +410,7 @@ tcpconnect(char *host) | |||
| 410 | hints.ai_family = IPv4or6; | 410 | hints.ai_family = IPv4or6; |
| 411 | hints.ai_socktype = SOCK_STREAM; | 411 | hints.ai_socktype = SOCK_STREAM; |
| 412 | if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0) | 412 | if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0) |
| 413 | fatal("getaddrinfo %s: %s", host, gai_strerror(gaierr)); | 413 | fatal("getaddrinfo %s: %s", host, ssh_gai_strerror(gaierr)); |
| 414 | for (ai = aitop; ai; ai = ai->ai_next) { | 414 | for (ai = aitop; ai; ai = ai->ai_next) { |
| 415 | s = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol); | 415 | s = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol); |
| 416 | if (s < 0) { | 416 | if (s < 0) { |
| @@ -656,7 +656,7 @@ conloop(void) | |||
| 656 | memcpy(e, read_wait, read_wait_nfdset * sizeof(fd_mask)); | 656 | memcpy(e, read_wait, read_wait_nfdset * sizeof(fd_mask)); |
| 657 | 657 | ||
| 658 | while (select(maxfd, r, NULL, e, &seltime) == -1 && | 658 | while (select(maxfd, r, NULL, e, &seltime) == -1 && |
| 659 | (errno == EAGAIN || errno == EINTR)) | 659 | (errno == EAGAIN || errno == EINTR || errno == EWOULDBLOCK)) |
| 660 | ; | 660 | ; |
| 661 | 661 | ||
| 662 | for (i = 0; i < maxfd; i++) { | 662 | for (i = 0; i < maxfd; i++) { |
diff --git a/ssh-keysign.0 b/ssh-keysign.0 index 32d3c6a7a..07ffeca5c 100644 --- a/ssh-keysign.0 +++ b/ssh-keysign.0 | |||
| @@ -39,4 +39,4 @@ HISTORY | |||
| 39 | AUTHORS | 39 | AUTHORS |
| 40 | Markus Friedl <markus@openbsd.org> | 40 | Markus Friedl <markus@openbsd.org> |
| 41 | 41 | ||
| 42 | OpenBSD 4.2 June 5, 2007 1 | 42 | OpenBSD 4.4 May 31, 2007 1 |
diff --git a/ssh-keysign.8 b/ssh-keysign.8 index 814bcb66e..3ba54b935 100644 --- a/ssh-keysign.8 +++ b/ssh-keysign.8 | |||
| @@ -22,7 +22,7 @@ | |||
| 22 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | 22 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
| 23 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | 23 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| 24 | .\" | 24 | .\" |
| 25 | .Dd $Mdocdate: June 5 2007 $ | 25 | .Dd $Mdocdate: May 31 2007 $ |
| 26 | .Dt SSH-KEYSIGN 8 | 26 | .Dt SSH-KEYSIGN 8 |
| 27 | .Os | 27 | .Os |
| 28 | .Sh NAME | 28 | .Sh NAME |
diff --git a/ssh-rand-helper.0 b/ssh-rand-helper.0 index 131e0bf3a..e1d31c1cd 100644 --- a/ssh-rand-helper.0 +++ b/ssh-rand-helper.0 | |||
| @@ -48,4 +48,4 @@ AUTHORS | |||
| 48 | SEE ALSO | 48 | SEE ALSO |
| 49 | ssh(1), ssh-add(1), ssh-keygen(1), sshd(8) | 49 | ssh(1), ssh-add(1), ssh-keygen(1), sshd(8) |
| 50 | 50 | ||
| 51 | OpenBSD 4.2 April 14, 2002 1 | 51 | OpenBSD 4.4 April 14, 2002 1 |
| @@ -130,6 +130,11 @@ DESCRIPTION | |||
| 130 | The recommended way to start X11 programs at a remote site is | 130 | The recommended way to start X11 programs at a remote site is |
| 131 | with something like ssh -f host xterm. | 131 | with something like ssh -f host xterm. |
| 132 | 132 | ||
| 133 | If the ExitOnForwardFailure configuration option is set to | ||
| 134 | ``yes'', then a client started with -f will wait for all remote | ||
| 135 | port forwards to be successfully established before placing it- | ||
| 136 | self in the background. | ||
| 137 | |||
| 133 | -g Allows remote hosts to connect to local forwarded ports. | 138 | -g Allows remote hosts to connect to local forwarded ports. |
| 134 | 139 | ||
| 135 | -I smartcard_device | 140 | -I smartcard_device |
| @@ -274,13 +279,14 @@ DESCRIPTION | |||
| 274 | User | 279 | User |
| 275 | UserKnownHostsFile | 280 | UserKnownHostsFile |
| 276 | VerifyHostKeyDNS | 281 | VerifyHostKeyDNS |
| 282 | VisualHostKey | ||
| 277 | XAuthLocation | 283 | XAuthLocation |
| 278 | 284 | ||
| 279 | -p port | 285 | -p port |
| 280 | Port to connect to on the remote host. This can be specified on | 286 | Port to connect to on the remote host. This can be specified on |
| 281 | a per-host basis in the configuration file. | 287 | a per-host basis in the configuration file. |
| 282 | 288 | ||
| 283 | -q Quiet mode. Causes all warning and diagnostic messages to be | 289 | -q Quiet mode. Causes most warning and diagnostic messages to be |
| 284 | suppressed. | 290 | suppressed. |
| 285 | 291 | ||
| 286 | -R [bind_address:]port:host:hostport | 292 | -R [bind_address:]port:host:hostport |
| @@ -571,12 +577,27 @@ VERIFYING HOST KEYS | |||
| 571 | 577 | ||
| 572 | $ ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key | 578 | $ ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key |
| 573 | 579 | ||
| 574 | If the fingerprint is already known, it can be matched and verified, and | 580 | If the fingerprint is already known, it can be matched and the key can be |
| 575 | the key can be accepted. If the fingerprint is unknown, an alternative | 581 | accepted or rejected. Because of the difficulty of comparing host keys |
| 576 | method of verification is available: SSH fingerprints verified by DNS. | 582 | just by looking at hex strings, there is also support to compare host |
| 577 | An additional resource record (RR), SSHFP, is added to a zonefile and the | 583 | keys visually, using random art. By setting the VisualHostKey option to |
| 578 | connecting client is able to match the fingerprint with that of the key | 584 | ``yes'', a small ASCII graphic gets displayed on every login to a server, |
| 579 | presented. | 585 | no matter if the session itself is interactive or not. By learning the |
| 586 | pattern a known server produces, a user can easily find out that the host | ||
| 587 | key has changed when a completely different pattern is displayed. Be- | ||
| 588 | cause these patterns are not unambiguous however, a pattern that looks | ||
| 589 | similar to the pattern remembered only gives a good probability that the | ||
| 590 | host key is the same, not guaranteed proof. | ||
| 591 | |||
| 592 | To get a listing of the fingerprints along with their random art for all | ||
| 593 | known hosts, the following command line can be used: | ||
| 594 | |||
| 595 | $ ssh-keygen -lv -f ~/.ssh/known_hosts | ||
| 596 | |||
| 597 | If the fingerprint is unknown, an alternative method of verification is | ||
| 598 | available: SSH fingerprints verified by DNS. An additional resource | ||
| 599 | record (RR), SSHFP, is added to a zonefile and the connecting client is | ||
| 600 | able to match the fingerprint with that of the key presented. | ||
| 580 | 601 | ||
| 581 | In this example, we are connecting a client to a server, | 602 | In this example, we are connecting a client to a server, |
| 582 | ``host.example.com''. The SSHFP resource records should first be added | 603 | ``host.example.com''. The SSHFP resource records should first be added |
| @@ -714,6 +735,13 @@ FILES | |||
| 714 | host-based authentication without permitting login with | 735 | host-based authentication without permitting login with |
| 715 | rlogin/rsh. | 736 | rlogin/rsh. |
| 716 | 737 | ||
| 738 | ~/.ssh/ | ||
| 739 | This directory is the default location for all user-specific con- | ||
| 740 | figuration and authentication information. There is no general | ||
| 741 | requirement to keep the entire contents of this directory secret, | ||
| 742 | but the recommended permissions are read/write/execute for the | ||
| 743 | user, and not accessible by others. | ||
| 744 | |||
| 717 | ~/.ssh/authorized_keys | 745 | ~/.ssh/authorized_keys |
| 718 | Lists the public keys (RSA/DSA) that can be used for logging in | 746 | Lists the public keys (RSA/DSA) that can be used for logging in |
| 719 | as this user. The format of this file is described in the | 747 | as this user. The format of this file is described in the |
| @@ -825,6 +853,10 @@ SEE ALSO | |||
| 825 | 853 | ||
| 826 | The Secure Shell (SSH) Public Key File Format, RFC 4716, 2006. | 854 | The Secure Shell (SSH) Public Key File Format, RFC 4716, 2006. |
| 827 | 855 | ||
| 856 | A. Perrig and D. Song, Hash Visualization: a New Technique to improve | ||
| 857 | Real-World Security, 1999, International Workshop on Cryptographic | ||
| 858 | Techniques and E-Commerce (CrypTEC '99). | ||
| 859 | |||
| 828 | AUTHORS | 860 | AUTHORS |
| 829 | OpenSSH is a derivative of the original and free ssh 1.2.12 release by | 861 | OpenSSH is a derivative of the original and free ssh 1.2.12 release by |
| 830 | Tatu Ylonen. Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, Theo | 862 | Tatu Ylonen. Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, Theo |
| @@ -832,4 +864,4 @@ AUTHORS | |||
| 832 | created OpenSSH. Markus Friedl contributed the support for SSH protocol | 864 | created OpenSSH. Markus Friedl contributed the support for SSH protocol |
| 833 | versions 1.5 and 2.0. | 865 | versions 1.5 and 2.0. |
| 834 | 866 | ||
| 835 | OpenBSD 4.2 June 12, 2007 13 | 867 | OpenBSD 4.4 July 2, 2008 14 |
| @@ -34,8 +34,8 @@ | |||
| 34 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | 34 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
| 35 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | 35 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| 36 | .\" | 36 | .\" |
| 37 | .\" $OpenBSD: ssh.1,v 1.270 2007/06/12 13:43:55 jmc Exp $ | 37 | .\" $OpenBSD: ssh.1,v 1.277 2008/07/02 13:47:39 djm Exp $ |
| 38 | .Dd $Mdocdate: June 12 2007 $ | 38 | .Dd $Mdocdate: July 2 2008 $ |
| 39 | .Dt SSH 1 | 39 | .Dt SSH 1 |
| 40 | .Os | 40 | .Os |
| 41 | .Sh NAME | 41 | .Sh NAME |
| @@ -290,6 +290,15 @@ This implies | |||
| 290 | The recommended way to start X11 programs at a remote site is with | 290 | The recommended way to start X11 programs at a remote site is with |
| 291 | something like | 291 | something like |
| 292 | .Ic ssh -f host xterm . | 292 | .Ic ssh -f host xterm . |
| 293 | .Pp | ||
| 294 | If the | ||
| 295 | .Cm ExitOnForwardFailure | ||
| 296 | configuration option is set to | ||
| 297 | .Dq yes , | ||
| 298 | then a client started with | ||
| 299 | .Fl f | ||
| 300 | will wait for all remote port forwards to be successfully established | ||
| 301 | before placing itself in the background. | ||
| 293 | .It Fl g | 302 | .It Fl g |
| 294 | Allows remote hosts to connect to local forwarded ports. | 303 | Allows remote hosts to connect to local forwarded ports. |
| 295 | .It Fl I Ar smartcard_device | 304 | .It Fl I Ar smartcard_device |
| @@ -498,6 +507,7 @@ For full details of the options listed below, and their possible values, see | |||
| 498 | .It User | 507 | .It User |
| 499 | .It UserKnownHostsFile | 508 | .It UserKnownHostsFile |
| 500 | .It VerifyHostKeyDNS | 509 | .It VerifyHostKeyDNS |
| 510 | .It VisualHostKey | ||
| 501 | .It XAuthLocation | 511 | .It XAuthLocation |
| 502 | .El | 512 | .El |
| 503 | .It Fl p Ar port | 513 | .It Fl p Ar port |
| @@ -506,7 +516,7 @@ This can be specified on a | |||
| 506 | per-host basis in the configuration file. | 516 | per-host basis in the configuration file. |
| 507 | .It Fl q | 517 | .It Fl q |
| 508 | Quiet mode. | 518 | Quiet mode. |
| 509 | Causes all warning and diagnostic messages to be suppressed. | 519 | Causes most warning and diagnostic messages to be suppressed. |
| 510 | Only fatal errors are displayed. | 520 | Only fatal errors are displayed. |
| 511 | If a second | 521 | If a second |
| 512 | .Fl q | 522 | .Fl q |
| @@ -1035,9 +1045,31 @@ Fingerprints can be determined using | |||
| 1035 | .Pp | 1045 | .Pp |
| 1036 | .Dl $ ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key | 1046 | .Dl $ ssh-keygen -l -f /etc/ssh/ssh_host_rsa_key |
| 1037 | .Pp | 1047 | .Pp |
| 1038 | If the fingerprint is already known, | 1048 | If the fingerprint is already known, it can be matched |
| 1039 | it can be matched and verified, | 1049 | and the key can be accepted or rejected. |
| 1040 | and the key can be accepted. | 1050 | Because of the difficulty of comparing host keys |
| 1051 | just by looking at hex strings, | ||
| 1052 | there is also support to compare host keys visually, | ||
| 1053 | using | ||
| 1054 | .Em random art . | ||
| 1055 | By setting the | ||
| 1056 | .Cm VisualHostKey | ||
| 1057 | option to | ||
| 1058 | .Dq yes , | ||
| 1059 | a small ASCII graphic gets displayed on every login to a server, no matter | ||
| 1060 | if the session itself is interactive or not. | ||
| 1061 | By learning the pattern a known server produces, a user can easily | ||
| 1062 | find out that the host key has changed when a completely different pattern | ||
| 1063 | is displayed. | ||
| 1064 | Because these patterns are not unambiguous however, a pattern that looks | ||
| 1065 | similar to the pattern remembered only gives a good probability that the | ||
| 1066 | host key is the same, not guaranteed proof. | ||
| 1067 | .Pp | ||
| 1068 | To get a listing of the fingerprints along with their random art for | ||
| 1069 | all known hosts, the following command line can be used: | ||
| 1070 | .Pp | ||
| 1071 | .Dl $ ssh-keygen -lv -f ~/.ssh/known_hosts | ||
| 1072 | .Pp | ||
| 1041 | If the fingerprint is unknown, | 1073 | If the fingerprint is unknown, |
| 1042 | an alternative method of verification is available: | 1074 | an alternative method of verification is available: |
| 1043 | SSH fingerprints verified by DNS. | 1075 | SSH fingerprints verified by DNS. |
| @@ -1253,6 +1285,13 @@ This file is used in exactly the same way as | |||
| 1253 | but allows host-based authentication without permitting login with | 1285 | but allows host-based authentication without permitting login with |
| 1254 | rlogin/rsh. | 1286 | rlogin/rsh. |
| 1255 | .Pp | 1287 | .Pp |
| 1288 | .It ~/.ssh/ | ||
| 1289 | This directory is the default location for all user-specific configuration | ||
| 1290 | and authentication information. | ||
| 1291 | There is no general requirement to keep the entire contents of this directory | ||
| 1292 | secret, but the recommended permissions are read/write/execute for the user, | ||
| 1293 | and not accessible by others. | ||
| 1294 | .Pp | ||
| 1256 | .It ~/.ssh/authorized_keys | 1295 | .It ~/.ssh/authorized_keys |
| 1257 | Lists the public keys (RSA/DSA) that can be used for logging in as this user. | 1296 | Lists the public keys (RSA/DSA) that can be used for logging in as this user. |
| 1258 | The format of this file is described in the | 1297 | The format of this file is described in the |
| @@ -1438,6 +1477,13 @@ manual page for more information. | |||
| 1438 | .%T "The Secure Shell (SSH) Public Key File Format" | 1477 | .%T "The Secure Shell (SSH) Public Key File Format" |
| 1439 | .%D 2006 | 1478 | .%D 2006 |
| 1440 | .Re | 1479 | .Re |
| 1480 | .Rs | ||
| 1481 | .%T "Hash Visualization: a New Technique to improve Real-World Security" | ||
| 1482 | .%A A. Perrig | ||
| 1483 | .%A D. Song | ||
| 1484 | .%D 1999 | ||
| 1485 | .%O "International Workshop on Cryptographic Techniques and E-Commerce (CrypTEC '99)" | ||
| 1486 | .Re | ||
| 1441 | .Sh AUTHORS | 1487 | .Sh AUTHORS |
| 1442 | OpenSSH is a derivative of the original and free | 1488 | OpenSSH is a derivative of the original and free |
| 1443 | ssh 1.2.12 release by Tatu Ylonen. | 1489 | ssh 1.2.12 release by Tatu Ylonen. |
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: ssh.c,v 1.301 2007/08/07 07:32:53 djm Exp $ */ | 1 | /* $OpenBSD: ssh.c,v 1.318 2008/07/02 13:47:39 djm Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
| @@ -49,7 +49,6 @@ | |||
| 49 | #include <sys/resource.h> | 49 | #include <sys/resource.h> |
| 50 | #include <sys/ioctl.h> | 50 | #include <sys/ioctl.h> |
| 51 | #include <sys/socket.h> | 51 | #include <sys/socket.h> |
| 52 | #include <sys/un.h> | ||
| 53 | 52 | ||
| 54 | #include <ctype.h> | 53 | #include <ctype.h> |
| 55 | #include <errno.h> | 54 | #include <errno.h> |
| @@ -72,6 +71,8 @@ | |||
| 72 | 71 | ||
| 73 | #include <openssl/evp.h> | 72 | #include <openssl/evp.h> |
| 74 | #include <openssl/err.h> | 73 | #include <openssl/err.h> |
| 74 | #include "openbsd-compat/openssl-compat.h" | ||
| 75 | #include "openbsd-compat/sys-queue.h" | ||
| 75 | 76 | ||
| 76 | #include "xmalloc.h" | 77 | #include "xmalloc.h" |
| 77 | #include "ssh.h" | 78 | #include "ssh.h" |
| @@ -97,7 +98,6 @@ | |||
| 97 | #include "sshpty.h" | 98 | #include "sshpty.h" |
| 98 | #include "match.h" | 99 | #include "match.h" |
| 99 | #include "msg.h" | 100 | #include "msg.h" |
| 100 | #include "monitor_fdpass.h" | ||
| 101 | #include "uidswap.h" | 101 | #include "uidswap.h" |
| 102 | #include "version.h" | 102 | #include "version.h" |
| 103 | 103 | ||
| @@ -107,7 +107,7 @@ | |||
| 107 | 107 | ||
| 108 | extern char *__progname; | 108 | extern char *__progname; |
| 109 | 109 | ||
| 110 | /* Flag indicating whether debug mode is on. This can be set on the command line. */ | 110 | /* Flag indicating whether debug mode is on. May be set on the command line. */ |
| 111 | int debug_flag = 0; | 111 | int debug_flag = 0; |
| 112 | 112 | ||
| 113 | /* Flag indicating whether a tty should be allocated */ | 113 | /* Flag indicating whether a tty should be allocated */ |
| @@ -164,20 +164,14 @@ Buffer command; | |||
| 164 | int subsystem_flag = 0; | 164 | int subsystem_flag = 0; |
| 165 | 165 | ||
| 166 | /* # of replies received for global requests */ | 166 | /* # of replies received for global requests */ |
| 167 | static int client_global_request_id = 0; | 167 | static int remote_forward_confirms_received = 0; |
| 168 | 168 | ||
| 169 | /* pid of proxycommand child process */ | 169 | /* pid of proxycommand child process */ |
| 170 | pid_t proxy_command_pid = 0; | 170 | pid_t proxy_command_pid = 0; |
| 171 | 171 | ||
| 172 | /* fd to control socket */ | 172 | /* mux.c */ |
| 173 | int control_fd = -1; | 173 | extern int muxserver_sock; |
| 174 | 174 | extern u_int muxclient_command; | |
| 175 | /* Multiplexing control command */ | ||
| 176 | static u_int mux_command = 0; | ||
| 177 | |||
| 178 | /* Only used in control client mode */ | ||
| 179 | volatile sig_atomic_t control_client_terminate = 0; | ||
| 180 | u_int control_server_pid = 0; | ||
| 181 | 175 | ||
| 182 | /* Prints a help message to the user. This function never returns. */ | 176 | /* Prints a help message to the user. This function never returns. */ |
| 183 | 177 | ||
| @@ -198,7 +192,10 @@ usage(void) | |||
| 198 | static int ssh_session(void); | 192 | static int ssh_session(void); |
| 199 | static int ssh_session2(void); | 193 | static int ssh_session2(void); |
| 200 | static void load_public_identity_files(void); | 194 | static void load_public_identity_files(void); |
| 201 | static void control_client(const char *path); | 195 | |
| 196 | /* from muxclient.c */ | ||
| 197 | void muxclient(const char *); | ||
| 198 | void muxserver_listen(void); | ||
| 202 | 199 | ||
| 203 | /* | 200 | /* |
| 204 | * Main program for the ssh client. | 201 | * Main program for the ssh client. |
| @@ -210,7 +207,7 @@ main(int ac, char **av) | |||
| 210 | char *p, *cp, *line, buf[256]; | 207 | char *p, *cp, *line, buf[256]; |
| 211 | struct stat st; | 208 | struct stat st; |
| 212 | struct passwd *pw; | 209 | struct passwd *pw; |
| 213 | int dummy; | 210 | int dummy, timeout_ms; |
| 214 | extern int optind, optreset; | 211 | extern int optind, optreset; |
| 215 | extern char *optarg; | 212 | extern char *optarg; |
| 216 | struct servent *sp; | 213 | struct servent *sp; |
| @@ -264,15 +261,18 @@ main(int ac, char **av) | |||
| 264 | */ | 261 | */ |
| 265 | umask(022); | 262 | umask(022); |
| 266 | 263 | ||
| 267 | /* Initialize option structure to indicate that no values have been set. */ | 264 | /* |
| 265 | * Initialize option structure to indicate that no values have been | ||
| 266 | * set. | ||
| 267 | */ | ||
| 268 | initialize_options(&options); | 268 | initialize_options(&options); |
| 269 | 269 | ||
| 270 | /* Parse command-line arguments. */ | 270 | /* Parse command-line arguments. */ |
| 271 | host = NULL; | 271 | host = NULL; |
| 272 | 272 | ||
| 273 | again: | 273 | again: |
| 274 | while ((opt = getopt(ac, av, | 274 | while ((opt = getopt(ac, av, "1246ab:c:e:fgi:kl:m:no:p:qstvx" |
| 275 | "1246ab:c:e:fgi:kl:m:no:p:qstvxACD:F:I:KL:MNO:PR:S:TVw:XY")) != -1) { | 275 | "ACD:F:I:KL:MNO:PR:S:TVw:XY")) != -1) { |
| 276 | switch (opt) { | 276 | switch (opt) { |
| 277 | case '1': | 277 | case '1': |
| 278 | options.protocol = SSH_PROTO_1; | 278 | options.protocol = SSH_PROTO_1; |
| @@ -308,9 +308,9 @@ main(int ac, char **av) | |||
| 308 | break; | 308 | break; |
| 309 | case 'O': | 309 | case 'O': |
| 310 | if (strcmp(optarg, "check") == 0) | 310 | if (strcmp(optarg, "check") == 0) |
| 311 | mux_command = SSHMUX_COMMAND_ALIVE_CHECK; | 311 | muxclient_command = SSHMUX_COMMAND_ALIVE_CHECK; |
| 312 | else if (strcmp(optarg, "exit") == 0) | 312 | else if (strcmp(optarg, "exit") == 0) |
| 313 | mux_command = SSHMUX_COMMAND_TERMINATE; | 313 | muxclient_command = SSHMUX_COMMAND_TERMINATE; |
| 314 | else | 314 | else |
| 315 | fatal("Invalid multiplex command."); | 315 | fatal("Invalid multiplex command."); |
| 316 | break; | 316 | break; |
| @@ -377,7 +377,8 @@ main(int ac, char **av) | |||
| 377 | options.tun_open = SSH_TUNMODE_DEFAULT; | 377 | options.tun_open = SSH_TUNMODE_DEFAULT; |
| 378 | options.tun_local = a2tun(optarg, &options.tun_remote); | 378 | options.tun_local = a2tun(optarg, &options.tun_remote); |
| 379 | if (options.tun_local == SSH_TUNID_ERR) { | 379 | if (options.tun_local == SSH_TUNID_ERR) { |
| 380 | fprintf(stderr, "Bad tun device '%s'\n", optarg); | 380 | fprintf(stderr, |
| 381 | "Bad tun device '%s'\n", optarg); | ||
| 381 | exit(255); | 382 | exit(255); |
| 382 | } | 383 | } |
| 383 | break; | 384 | break; |
| @@ -485,7 +486,8 @@ main(int ac, char **av) | |||
| 485 | } | 486 | } |
| 486 | if (cp != NULL) { | 487 | if (cp != NULL) { |
| 487 | fwd.listen_port = a2port(cp); | 488 | fwd.listen_port = a2port(cp); |
| 488 | fwd.listen_host = cleanhostname(fwd.listen_host); | 489 | fwd.listen_host = |
| 490 | cleanhostname(fwd.listen_host); | ||
| 489 | } else { | 491 | } else { |
| 490 | fwd.listen_port = a2port(fwd.listen_host); | 492 | fwd.listen_port = a2port(fwd.listen_host); |
| 491 | fwd.listen_host = NULL; | 493 | fwd.listen_host = NULL; |
| @@ -591,8 +593,10 @@ main(int ac, char **av) | |||
| 591 | } | 593 | } |
| 592 | 594 | ||
| 593 | /* Cannot fork to background if no command. */ | 595 | /* Cannot fork to background if no command. */ |
| 594 | if (fork_after_authentication_flag && buffer_len(&command) == 0 && !no_shell_flag) | 596 | if (fork_after_authentication_flag && buffer_len(&command) == 0 && |
| 595 | fatal("Cannot fork into background without a command to execute."); | 597 | !no_shell_flag) |
| 598 | fatal("Cannot fork into background without a command " | ||
| 599 | "to execute."); | ||
| 596 | 600 | ||
| 597 | /* Allocate a tty by default if no command specified. */ | 601 | /* Allocate a tty by default if no command specified. */ |
| 598 | if (buffer_len(&command) == 0) | 602 | if (buffer_len(&command) == 0) |
| @@ -604,7 +608,8 @@ main(int ac, char **av) | |||
| 604 | /* Do not allocate a tty if stdin is not a tty. */ | 608 | /* Do not allocate a tty if stdin is not a tty. */ |
| 605 | if ((!isatty(fileno(stdin)) || stdin_null_flag) && !force_tty_flag) { | 609 | if ((!isatty(fileno(stdin)) || stdin_null_flag) && !force_tty_flag) { |
| 606 | if (tty_flag && options.log_level > SYSLOG_LEVEL_QUIET) | 610 | if (tty_flag && options.log_level > SYSLOG_LEVEL_QUIET) |
| 607 | logit("Pseudo-terminal will not be allocated because stdin is not a terminal."); | 611 | logit("Pseudo-terminal will not be allocated because " |
| 612 | "stdin is not a terminal."); | ||
| 608 | tty_flag = 0; | 613 | tty_flag = 0; |
| 609 | } | 614 | } |
| 610 | 615 | ||
| @@ -612,7 +617,8 @@ main(int ac, char **av) | |||
| 612 | * Initialize "log" output. Since we are the client all output | 617 | * Initialize "log" output. Since we are the client all output |
| 613 | * actually goes to stderr. | 618 | * actually goes to stderr. |
| 614 | */ | 619 | */ |
| 615 | log_init(av[0], options.log_level == -1 ? SYSLOG_LEVEL_INFO : options.log_level, | 620 | log_init(av[0], |
| 621 | options.log_level == -1 ? SYSLOG_LEVEL_INFO : options.log_level, | ||
| 616 | SYSLOG_FACILITY_USER, 1); | 622 | SYSLOG_FACILITY_USER, 1); |
| 617 | 623 | ||
| 618 | /* | 624 | /* |
| @@ -646,6 +652,28 @@ main(int ac, char **av) | |||
| 646 | if (options.user == NULL) | 652 | if (options.user == NULL) |
| 647 | options.user = xstrdup(pw->pw_name); | 653 | options.user = xstrdup(pw->pw_name); |
| 648 | 654 | ||
| 655 | /* Get default port if port has not been set. */ | ||
| 656 | if (options.port == 0) { | ||
| 657 | sp = getservbyname(SSH_SERVICE_NAME, "tcp"); | ||
| 658 | options.port = sp ? ntohs(sp->s_port) : SSH_DEFAULT_PORT; | ||
| 659 | } | ||
| 660 | |||
| 661 | if (options.local_command != NULL) { | ||
| 662 | char thishost[NI_MAXHOST]; | ||
| 663 | |||
| 664 | if (gethostname(thishost, sizeof(thishost)) == -1) | ||
| 665 | fatal("gethostname: %s", strerror(errno)); | ||
| 666 | snprintf(buf, sizeof(buf), "%d", options.port); | ||
| 667 | debug3("expanding LocalCommand: %s", options.local_command); | ||
| 668 | cp = options.local_command; | ||
| 669 | options.local_command = percent_expand(cp, "d", pw->pw_dir, | ||
| 670 | "h", options.hostname? options.hostname : host, | ||
| 671 | "l", thishost, "n", host, "r", options.user, "p", buf, | ||
| 672 | "u", pw->pw_name, (char *)NULL); | ||
| 673 | debug3("expanded LocalCommand: %s", options.local_command); | ||
| 674 | xfree(cp); | ||
| 675 | } | ||
| 676 | |||
| 649 | if (options.hostname != NULL) | 677 | if (options.hostname != NULL) |
| 650 | host = options.hostname; | 678 | host = options.hostname; |
| 651 | 679 | ||
| @@ -656,18 +684,16 @@ main(int ac, char **av) | |||
| 656 | *p = (char)tolower(*p); | 684 | *p = (char)tolower(*p); |
| 657 | } | 685 | } |
| 658 | 686 | ||
| 659 | /* Get default port if port has not been set. */ | ||
| 660 | if (options.port == 0) { | ||
| 661 | sp = getservbyname(SSH_SERVICE_NAME, "tcp"); | ||
| 662 | options.port = sp ? ntohs(sp->s_port) : SSH_DEFAULT_PORT; | ||
| 663 | } | ||
| 664 | |||
| 665 | if (options.proxy_command != NULL && | 687 | if (options.proxy_command != NULL && |
| 666 | strcmp(options.proxy_command, "none") == 0) | 688 | strcmp(options.proxy_command, "none") == 0) { |
| 689 | xfree(options.proxy_command); | ||
| 667 | options.proxy_command = NULL; | 690 | options.proxy_command = NULL; |
| 691 | } | ||
| 668 | if (options.control_path != NULL && | 692 | if (options.control_path != NULL && |
| 669 | strcmp(options.control_path, "none") == 0) | 693 | strcmp(options.control_path, "none") == 0) { |
| 694 | xfree(options.control_path); | ||
| 670 | options.control_path = NULL; | 695 | options.control_path = NULL; |
| 696 | } | ||
| 671 | 697 | ||
| 672 | if (options.control_path != NULL) { | 698 | if (options.control_path != NULL) { |
| 673 | char thishost[NI_MAXHOST]; | 699 | char thishost[NI_MAXHOST]; |
| @@ -677,18 +703,22 @@ main(int ac, char **av) | |||
| 677 | snprintf(buf, sizeof(buf), "%d", options.port); | 703 | snprintf(buf, sizeof(buf), "%d", options.port); |
| 678 | cp = tilde_expand_filename(options.control_path, | 704 | cp = tilde_expand_filename(options.control_path, |
| 679 | original_real_uid); | 705 | original_real_uid); |
| 706 | xfree(options.control_path); | ||
| 680 | options.control_path = percent_expand(cp, "p", buf, "h", host, | 707 | options.control_path = percent_expand(cp, "p", buf, "h", host, |
| 681 | "r", options.user, "l", thishost, (char *)NULL); | 708 | "r", options.user, "l", thishost, (char *)NULL); |
| 682 | xfree(cp); | 709 | xfree(cp); |
| 683 | } | 710 | } |
| 684 | if (mux_command != 0 && options.control_path == NULL) | 711 | if (muxclient_command != 0 && options.control_path == NULL) |
| 685 | fatal("No ControlPath specified for \"-O\" command"); | 712 | fatal("No ControlPath specified for \"-O\" command"); |
| 686 | if (options.control_path != NULL) | 713 | if (options.control_path != NULL) |
| 687 | control_client(options.control_path); | 714 | muxclient(options.control_path); |
| 715 | |||
| 716 | timeout_ms = options.connection_timeout * 1000; | ||
| 688 | 717 | ||
| 689 | /* Open a connection to the remote host. */ | 718 | /* Open a connection to the remote host. */ |
| 690 | if (ssh_connect(host, &hostaddr, options.port, | 719 | if (ssh_connect(host, &hostaddr, options.port, |
| 691 | options.address_family, options.connection_attempts, | 720 | options.address_family, options.connection_attempts, &timeout_ms, |
| 721 | options.tcp_keep_alive, | ||
| 692 | #ifdef HAVE_CYGWIN | 722 | #ifdef HAVE_CYGWIN |
| 693 | options.use_privileged_port, | 723 | options.use_privileged_port, |
| 694 | #else | 724 | #else |
| @@ -697,6 +727,9 @@ main(int ac, char **av) | |||
| 697 | options.proxy_command) != 0) | 727 | options.proxy_command) != 0) |
| 698 | exit(255); | 728 | exit(255); |
| 699 | 729 | ||
| 730 | if (timeout_ms > 0) | ||
| 731 | debug3("timeout: %d ms remain after connect", timeout_ms); | ||
| 732 | |||
| 700 | /* | 733 | /* |
| 701 | * If we successfully made the connection, load the host private key | 734 | * If we successfully made the connection, load the host private key |
| 702 | * in case we will need it later for combined rsa-rhosts | 735 | * in case we will need it later for combined rsa-rhosts |
| @@ -750,7 +783,8 @@ main(int ac, char **av) | |||
| 750 | * Now that we are back to our own permissions, create ~/.ssh | 783 | * Now that we are back to our own permissions, create ~/.ssh |
| 751 | * directory if it doesn't already exist. | 784 | * directory if it doesn't already exist. |
| 752 | */ | 785 | */ |
| 753 | snprintf(buf, sizeof buf, "%.100s%s%.100s", pw->pw_dir, strcmp(pw->pw_dir, "/") ? "/" : "", _PATH_SSH_USER_DIR); | 786 | snprintf(buf, sizeof buf, "%.100s%s%.100s", pw->pw_dir, |
| 787 | strcmp(pw->pw_dir, "/") ? "/" : "", _PATH_SSH_USER_DIR); | ||
| 754 | if (stat(buf, &st) < 0) | 788 | if (stat(buf, &st) < 0) |
| 755 | if (mkdir(buf, 0700) < 0) | 789 | if (mkdir(buf, 0700) < 0) |
| 756 | error("Could not create directory '%.200s'.", buf); | 790 | error("Could not create directory '%.200s'.", buf); |
| @@ -771,8 +805,9 @@ main(int ac, char **av) | |||
| 771 | 805 | ||
| 772 | signal(SIGPIPE, SIG_IGN); /* ignore SIGPIPE early */ | 806 | signal(SIGPIPE, SIG_IGN); /* ignore SIGPIPE early */ |
| 773 | 807 | ||
| 774 | /* Log into the remote system. This never returns if the login fails. */ | 808 | /* Log into the remote system. Never returns if the login fails. */ |
| 775 | ssh_login(&sensitive_data, host, (struct sockaddr *)&hostaddr, pw); | 809 | ssh_login(&sensitive_data, host, (struct sockaddr *)&hostaddr, |
| 810 | pw, timeout_ms); | ||
| 776 | 811 | ||
| 777 | /* We no longer need the private host keys. Clear them now. */ | 812 | /* We no longer need the private host keys. Clear them now. */ |
| 778 | if (sensitive_data.nkeys != 0) { | 813 | if (sensitive_data.nkeys != 0) { |
| @@ -800,7 +835,7 @@ main(int ac, char **av) | |||
| 800 | exit_status = compat20 ? ssh_session2() : ssh_session(); | 835 | exit_status = compat20 ? ssh_session2() : ssh_session(); |
| 801 | packet_close(); | 836 | packet_close(); |
| 802 | 837 | ||
| 803 | if (options.control_path != NULL && control_fd != -1) | 838 | if (options.control_path != NULL && muxserver_sock != -1) |
| 804 | unlink(options.control_path); | 839 | unlink(options.control_path); |
| 805 | 840 | ||
| 806 | /* | 841 | /* |
| @@ -813,6 +848,34 @@ main(int ac, char **av) | |||
| 813 | return exit_status; | 848 | return exit_status; |
| 814 | } | 849 | } |
| 815 | 850 | ||
| 851 | /* Callback for remote forward global requests */ | ||
| 852 | static void | ||
| 853 | ssh_confirm_remote_forward(int type, u_int32_t seq, void *ctxt) | ||
| 854 | { | ||
| 855 | Forward *rfwd = (Forward *)ctxt; | ||
| 856 | |||
| 857 | debug("remote forward %s for: listen %d, connect %s:%d", | ||
| 858 | type == SSH2_MSG_REQUEST_SUCCESS ? "success" : "failure", | ||
| 859 | rfwd->listen_port, rfwd->connect_host, rfwd->connect_port); | ||
| 860 | if (type == SSH2_MSG_REQUEST_FAILURE) { | ||
| 861 | if (options.exit_on_forward_failure) | ||
| 862 | fatal("Error: remote port forwarding failed for " | ||
| 863 | "listen port %d", rfwd->listen_port); | ||
| 864 | else | ||
| 865 | logit("Warning: remote port forwarding failed for " | ||
| 866 | "listen port %d", rfwd->listen_port); | ||
| 867 | } | ||
| 868 | if (++remote_forward_confirms_received == options.num_remote_forwards) { | ||
| 869 | debug("All remote forwarding requests processed"); | ||
| 870 | if (fork_after_authentication_flag) { | ||
| 871 | fork_after_authentication_flag = 0; | ||
| 872 | if (daemon(1, 1) < 0) | ||
| 873 | fatal("daemon() failed: %.200s", | ||
| 874 | strerror(errno)); | ||
| 875 | } | ||
| 876 | } | ||
| 877 | } | ||
| 878 | |||
| 816 | static void | 879 | static void |
| 817 | ssh_init_forwarding(void) | 880 | ssh_init_forwarding(void) |
| 818 | { | 881 | { |
| @@ -861,6 +924,8 @@ ssh_init_forwarding(void) | |||
| 861 | logit("Warning: Could not request remote " | 924 | logit("Warning: Could not request remote " |
| 862 | "forwarding."); | 925 | "forwarding."); |
| 863 | } | 926 | } |
| 927 | client_register_global_confirm(ssh_confirm_remote_forward, | ||
| 928 | &options.remote_forwards[i]); | ||
| 864 | } | 929 | } |
| 865 | 930 | ||
| 866 | /* Initiate tunnel forwarding. */ | 931 | /* Initiate tunnel forwarding. */ |
| @@ -897,10 +962,13 @@ ssh_session(void) | |||
| 897 | 962 | ||
| 898 | /* Enable compression if requested. */ | 963 | /* Enable compression if requested. */ |
| 899 | if (options.compression) { | 964 | if (options.compression) { |
| 900 | debug("Requesting compression at level %d.", options.compression_level); | 965 | debug("Requesting compression at level %d.", |
| 966 | options.compression_level); | ||
| 901 | 967 | ||
| 902 | if (options.compression_level < 1 || options.compression_level > 9) | 968 | if (options.compression_level < 1 || |
| 903 | fatal("Compression level must be from 1 (fast) to 9 (slow, best)."); | 969 | options.compression_level > 9) |
| 970 | fatal("Compression level must be from 1 (fast) to " | ||
| 971 | "9 (slow, best)."); | ||
| 904 | 972 | ||
| 905 | /* Send the request. */ | 973 | /* Send the request. */ |
| 906 | packet_start(SSH_CMSG_REQUEST_COMPRESSION); | 974 | packet_start(SSH_CMSG_REQUEST_COMPRESSION); |
| @@ -913,7 +981,8 @@ ssh_session(void) | |||
| 913 | else if (type == SSH_SMSG_FAILURE) | 981 | else if (type == SSH_SMSG_FAILURE) |
| 914 | logit("Warning: Remote host refused compression."); | 982 | logit("Warning: Remote host refused compression."); |
| 915 | else | 983 | else |
| 916 | packet_disconnect("Protocol error waiting for compression response."); | 984 | packet_disconnect("Protocol error waiting for " |
| 985 | "compression response."); | ||
| 917 | } | 986 | } |
| 918 | /* Allocate a pseudo tty if appropriate. */ | 987 | /* Allocate a pseudo tty if appropriate. */ |
| 919 | if (tty_flag) { | 988 | if (tty_flag) { |
| @@ -950,9 +1019,11 @@ ssh_session(void) | |||
| 950 | interactive = 1; | 1019 | interactive = 1; |
| 951 | have_tty = 1; | 1020 | have_tty = 1; |
| 952 | } else if (type == SSH_SMSG_FAILURE) | 1021 | } else if (type == SSH_SMSG_FAILURE) |
| 953 | logit("Warning: Remote host failed or refused to allocate a pseudo tty."); | 1022 | logit("Warning: Remote host failed or refused to " |
| 1023 | "allocate a pseudo tty."); | ||
| 954 | else | 1024 | else |
| 955 | packet_disconnect("Protocol error waiting for pty request response."); | 1025 | packet_disconnect("Protocol error waiting for pty " |
| 1026 | "request response."); | ||
| 956 | } | 1027 | } |
| 957 | /* Request X11 forwarding if enabled and DISPLAY is set. */ | 1028 | /* Request X11 forwarding if enabled and DISPLAY is set. */ |
| 958 | display = getenv("DISPLAY"); | 1029 | display = getenv("DISPLAY"); |
| @@ -962,7 +1033,8 @@ ssh_session(void) | |||
| 962 | client_x11_get_proto(display, options.xauth_location, | 1033 | client_x11_get_proto(display, options.xauth_location, |
| 963 | options.forward_x11_trusted, &proto, &data); | 1034 | options.forward_x11_trusted, &proto, &data); |
| 964 | /* Request forwarding with authentication spoofing. */ | 1035 | /* Request forwarding with authentication spoofing. */ |
| 965 | debug("Requesting X11 forwarding with authentication spoofing."); | 1036 | debug("Requesting X11 forwarding with authentication " |
| 1037 | "spoofing."); | ||
| 966 | x11_request_forwarding_with_spoofing(0, display, proto, data); | 1038 | x11_request_forwarding_with_spoofing(0, display, proto, data); |
| 967 | 1039 | ||
| 968 | /* Read response from the server. */ | 1040 | /* Read response from the server. */ |
| @@ -972,7 +1044,8 @@ ssh_session(void) | |||
| 972 | } else if (type == SSH_SMSG_FAILURE) { | 1044 | } else if (type == SSH_SMSG_FAILURE) { |
| 973 | logit("Warning: Remote host denied X11 forwarding."); | 1045 | logit("Warning: Remote host denied X11 forwarding."); |
| 974 | } else { | 1046 | } else { |
| 975 | packet_disconnect("Protocol error waiting for X11 forwarding"); | 1047 | packet_disconnect("Protocol error waiting for X11 " |
| 1048 | "forwarding"); | ||
| 976 | } | 1049 | } |
| 977 | } | 1050 | } |
| 978 | /* Tell the packet module whether this is an interactive session. */ | 1051 | /* Tell the packet module whether this is an interactive session. */ |
| @@ -995,10 +1068,22 @@ ssh_session(void) | |||
| 995 | /* Initiate port forwardings. */ | 1068 | /* Initiate port forwardings. */ |
| 996 | ssh_init_forwarding(); | 1069 | ssh_init_forwarding(); |
| 997 | 1070 | ||
| 998 | /* If requested, let ssh continue in the background. */ | 1071 | /* Execute a local command */ |
| 999 | if (fork_after_authentication_flag) | 1072 | if (options.local_command != NULL && |
| 1073 | options.permit_local_command) | ||
| 1074 | ssh_local_cmd(options.local_command); | ||
| 1075 | |||
| 1076 | /* | ||
| 1077 | * If requested and we are not interested in replies to remote | ||
| 1078 | * forwarding requests, then let ssh continue in the background. | ||
| 1079 | */ | ||
| 1080 | if (fork_after_authentication_flag && | ||
| 1081 | (!options.exit_on_forward_failure || | ||
| 1082 | options.num_remote_forwards == 0)) { | ||
| 1083 | fork_after_authentication_flag = 0; | ||
| 1000 | if (daemon(1, 1) < 0) | 1084 | if (daemon(1, 1) < 0) |
| 1001 | fatal("daemon() failed: %.200s", strerror(errno)); | 1085 | fatal("daemon() failed: %.200s", strerror(errno)); |
| 1086 | } | ||
| 1002 | 1087 | ||
| 1003 | /* | 1088 | /* |
| 1004 | * If a command was specified on the command line, execute the | 1089 | * If a command was specified on the command line, execute the |
| @@ -1008,7 +1093,8 @@ ssh_session(void) | |||
| 1008 | int len = buffer_len(&command); | 1093 | int len = buffer_len(&command); |
| 1009 | if (len > 900) | 1094 | if (len > 900) |
| 1010 | len = 900; | 1095 | len = 900; |
| 1011 | debug("Sending command: %.*s", len, (u_char *)buffer_ptr(&command)); | 1096 | debug("Sending command: %.*s", len, |
| 1097 | (u_char *)buffer_ptr(&command)); | ||
| 1012 | packet_start(SSH_CMSG_EXEC_CMD); | 1098 | packet_start(SSH_CMSG_EXEC_CMD); |
| 1013 | packet_put_string(buffer_ptr(&command), buffer_len(&command)); | 1099 | packet_put_string(buffer_ptr(&command), buffer_len(&command)); |
| 1014 | packet_send(); | 1100 | packet_send(); |
| @@ -1025,88 +1111,6 @@ ssh_session(void) | |||
| 1025 | options.escape_char : SSH_ESCAPECHAR_NONE, 0); | 1111 | options.escape_char : SSH_ESCAPECHAR_NONE, 0); |
| 1026 | } | 1112 | } |
| 1027 | 1113 | ||
| 1028 | static void | ||
| 1029 | ssh_subsystem_reply(int type, u_int32_t seq, void *ctxt) | ||
| 1030 | { | ||
| 1031 | int id, len; | ||
| 1032 | |||
| 1033 | id = packet_get_int(); | ||
| 1034 | len = buffer_len(&command); | ||
| 1035 | if (len > 900) | ||
| 1036 | len = 900; | ||
| 1037 | packet_check_eom(); | ||
| 1038 | if (type == SSH2_MSG_CHANNEL_FAILURE) | ||
| 1039 | fatal("Request for subsystem '%.*s' failed on channel %d", | ||
| 1040 | len, (u_char *)buffer_ptr(&command), id); | ||
| 1041 | } | ||
| 1042 | |||
| 1043 | void | ||
| 1044 | client_global_request_reply_fwd(int type, u_int32_t seq, void *ctxt) | ||
| 1045 | { | ||
| 1046 | int i; | ||
| 1047 | |||
| 1048 | i = client_global_request_id++; | ||
| 1049 | if (i >= options.num_remote_forwards) | ||
| 1050 | return; | ||
| 1051 | debug("remote forward %s for: listen %d, connect %s:%d", | ||
| 1052 | type == SSH2_MSG_REQUEST_SUCCESS ? "success" : "failure", | ||
| 1053 | options.remote_forwards[i].listen_port, | ||
| 1054 | options.remote_forwards[i].connect_host, | ||
| 1055 | options.remote_forwards[i].connect_port); | ||
| 1056 | if (type == SSH2_MSG_REQUEST_FAILURE) { | ||
| 1057 | if (options.exit_on_forward_failure) | ||
| 1058 | fatal("Error: remote port forwarding failed for " | ||
| 1059 | "listen port %d", | ||
| 1060 | options.remote_forwards[i].listen_port); | ||
| 1061 | else | ||
| 1062 | logit("Warning: remote port forwarding failed for " | ||
| 1063 | "listen port %d", | ||
| 1064 | options.remote_forwards[i].listen_port); | ||
| 1065 | } | ||
| 1066 | } | ||
| 1067 | |||
| 1068 | static void | ||
| 1069 | ssh_control_listener(void) | ||
| 1070 | { | ||
| 1071 | struct sockaddr_un addr; | ||
| 1072 | mode_t old_umask; | ||
| 1073 | int addr_len; | ||
| 1074 | |||
| 1075 | if (options.control_path == NULL || | ||
| 1076 | options.control_master == SSHCTL_MASTER_NO) | ||
| 1077 | return; | ||
| 1078 | |||
| 1079 | debug("setting up multiplex master socket"); | ||
| 1080 | |||
| 1081 | memset(&addr, '\0', sizeof(addr)); | ||
| 1082 | addr.sun_family = AF_UNIX; | ||
| 1083 | addr_len = offsetof(struct sockaddr_un, sun_path) + | ||
| 1084 | strlen(options.control_path) + 1; | ||
| 1085 | |||
| 1086 | if (strlcpy(addr.sun_path, options.control_path, | ||
| 1087 | sizeof(addr.sun_path)) >= sizeof(addr.sun_path)) | ||
| 1088 | fatal("ControlPath too long"); | ||
| 1089 | |||
| 1090 | if ((control_fd = socket(PF_UNIX, SOCK_STREAM, 0)) < 0) | ||
| 1091 | fatal("%s socket(): %s", __func__, strerror(errno)); | ||
| 1092 | |||
| 1093 | old_umask = umask(0177); | ||
| 1094 | if (bind(control_fd, (struct sockaddr *)&addr, addr_len) == -1) { | ||
| 1095 | control_fd = -1; | ||
| 1096 | if (errno == EINVAL || errno == EADDRINUSE) | ||
| 1097 | fatal("ControlSocket %s already exists", | ||
| 1098 | options.control_path); | ||
| 1099 | else | ||
| 1100 | fatal("%s bind(): %s", __func__, strerror(errno)); | ||
| 1101 | } | ||
| 1102 | umask(old_umask); | ||
| 1103 | |||
| 1104 | if (listen(control_fd, 64) == -1) | ||
| 1105 | fatal("%s listen(): %s", __func__, strerror(errno)); | ||
| 1106 | |||
| 1107 | set_nonblock(control_fd); | ||
| 1108 | } | ||
| 1109 | |||
| 1110 | /* request pty/x11/agent/tcpfwd/shell for channel */ | 1114 | /* request pty/x11/agent/tcpfwd/shell for channel */ |
| 1111 | static void | 1115 | static void |
| 1112 | ssh_session2_setup(int id, void *arg) | 1116 | ssh_session2_setup(int id, void *arg) |
| @@ -1122,7 +1126,8 @@ ssh_session2_setup(int id, void *arg) | |||
| 1122 | client_x11_get_proto(display, options.xauth_location, | 1126 | client_x11_get_proto(display, options.xauth_location, |
| 1123 | options.forward_x11_trusted, &proto, &data); | 1127 | options.forward_x11_trusted, &proto, &data); |
| 1124 | /* Request forwarding with authentication spoofing. */ | 1128 | /* Request forwarding with authentication spoofing. */ |
| 1125 | debug("Requesting X11 forwarding with authentication spoofing."); | 1129 | debug("Requesting X11 forwarding with authentication " |
| 1130 | "spoofing."); | ||
| 1126 | x11_request_forwarding_with_spoofing(id, display, proto, data); | 1131 | x11_request_forwarding_with_spoofing(id, display, proto, data); |
| 1127 | interactive = 1; | 1132 | interactive = 1; |
| 1128 | /* XXX wait for reply */ | 1133 | /* XXX wait for reply */ |
| @@ -1136,7 +1141,7 @@ ssh_session2_setup(int id, void *arg) | |||
| 1136 | } | 1141 | } |
| 1137 | 1142 | ||
| 1138 | client_session2_setup(id, tty_flag, subsystem_flag, getenv("TERM"), | 1143 | client_session2_setup(id, tty_flag, subsystem_flag, getenv("TERM"), |
| 1139 | NULL, fileno(stdin), &command, environ, &ssh_subsystem_reply); | 1144 | NULL, fileno(stdin), &command, environ); |
| 1140 | 1145 | ||
| 1141 | packet_set_interactive(interactive); | 1146 | packet_set_interactive(interactive); |
| 1142 | } | 1147 | } |
| @@ -1182,7 +1187,8 @@ ssh_session2_open(void) | |||
| 1182 | 1187 | ||
| 1183 | channel_send_open(c->self); | 1188 | channel_send_open(c->self); |
| 1184 | if (!no_shell_flag) | 1189 | if (!no_shell_flag) |
| 1185 | channel_register_confirm(c->self, ssh_session2_setup, NULL); | 1190 | channel_register_open_confirm(c->self, |
| 1191 | ssh_session2_setup, NULL); | ||
| 1186 | 1192 | ||
| 1187 | return c->self; | 1193 | return c->self; |
| 1188 | } | 1194 | } |
| @@ -1198,18 +1204,29 @@ ssh_session2(void) | |||
| 1198 | if (!no_shell_flag || (datafellows & SSH_BUG_DUMMYCHAN)) | 1204 | if (!no_shell_flag || (datafellows & SSH_BUG_DUMMYCHAN)) |
| 1199 | id = ssh_session2_open(); | 1205 | id = ssh_session2_open(); |
| 1200 | 1206 | ||
| 1207 | /* If we don't expect to open a new session, then disallow it */ | ||
| 1208 | if (options.control_master == SSHCTL_MASTER_NO) { | ||
| 1209 | debug("Requesting no-more-sessions@openssh.com"); | ||
| 1210 | packet_start(SSH2_MSG_GLOBAL_REQUEST); | ||
| 1211 | packet_put_cstring("no-more-sessions@openssh.com"); | ||
| 1212 | packet_put_char(0); | ||
| 1213 | packet_send(); | ||
| 1214 | } | ||
| 1215 | |||
| 1201 | /* Execute a local command */ | 1216 | /* Execute a local command */ |
| 1202 | if (options.local_command != NULL && | 1217 | if (options.local_command != NULL && |
| 1203 | options.permit_local_command) | 1218 | options.permit_local_command) |
| 1204 | ssh_local_cmd(options.local_command); | 1219 | ssh_local_cmd(options.local_command); |
| 1205 | 1220 | ||
| 1206 | /* Start listening for multiplex clients */ | 1221 | /* Start listening for multiplex clients */ |
| 1207 | ssh_control_listener(); | 1222 | muxserver_listen(); |
| 1208 | 1223 | ||
| 1209 | /* If requested, let ssh continue in the background. */ | 1224 | /* If requested, let ssh continue in the background. */ |
| 1210 | if (fork_after_authentication_flag) | 1225 | if (fork_after_authentication_flag) { |
| 1226 | fork_after_authentication_flag = 0; | ||
| 1211 | if (daemon(1, 1) < 0) | 1227 | if (daemon(1, 1) < 0) |
| 1212 | fatal("daemon() failed: %.200s", strerror(errno)); | 1228 | fatal("daemon() failed: %.200s", strerror(errno)); |
| 1229 | } | ||
| 1213 | 1230 | ||
| 1214 | return client_loop(tty_flag, tty_flag ? | 1231 | return client_loop(tty_flag, tty_flag ? |
| 1215 | options.escape_char : SSH_ESCAPECHAR_NONE, id); | 1232 | options.escape_char : SSH_ESCAPECHAR_NONE, id); |
| @@ -1219,6 +1236,7 @@ static void | |||
| 1219 | load_public_identity_files(void) | 1236 | load_public_identity_files(void) |
| 1220 | { | 1237 | { |
| 1221 | char *filename, *cp, thishost[NI_MAXHOST], *fp; | 1238 | char *filename, *cp, thishost[NI_MAXHOST], *fp; |
| 1239 | char *pwdir = NULL, *pwname = NULL; | ||
| 1222 | int i = 0; | 1240 | int i = 0; |
| 1223 | Key *public; | 1241 | Key *public; |
| 1224 | struct passwd *pw; | 1242 | struct passwd *pw; |
| @@ -1231,9 +1249,11 @@ load_public_identity_files(void) | |||
| 1231 | int count = 0; | 1249 | int count = 0; |
| 1232 | for (i = 0; keys[i] != NULL; i++) { | 1250 | for (i = 0; keys[i] != NULL; i++) { |
| 1233 | count++; | 1251 | count++; |
| 1234 | memmove(&options.identity_files[1], &options.identity_files[0], | 1252 | memmove(&options.identity_files[1], |
| 1253 | &options.identity_files[0], | ||
| 1235 | sizeof(char *) * (SSH_MAX_IDENTITY_FILES - 1)); | 1254 | sizeof(char *) * (SSH_MAX_IDENTITY_FILES - 1)); |
| 1236 | memmove(&options.identity_keys[1], &options.identity_keys[0], | 1255 | memmove(&options.identity_keys[1], |
| 1256 | &options.identity_keys[0], | ||
| 1237 | sizeof(Key *) * (SSH_MAX_IDENTITY_FILES - 1)); | 1257 | sizeof(Key *) * (SSH_MAX_IDENTITY_FILES - 1)); |
| 1238 | options.num_identity_files++; | 1258 | options.num_identity_files++; |
| 1239 | options.identity_keys[0] = keys[i]; | 1259 | options.identity_keys[0] = keys[i]; |
| @@ -1247,14 +1267,16 @@ load_public_identity_files(void) | |||
| 1247 | #endif /* SMARTCARD */ | 1267 | #endif /* SMARTCARD */ |
| 1248 | if ((pw = getpwuid(original_real_uid)) == NULL) | 1268 | if ((pw = getpwuid(original_real_uid)) == NULL) |
| 1249 | fatal("load_public_identity_files: getpwuid failed"); | 1269 | fatal("load_public_identity_files: getpwuid failed"); |
| 1270 | pwname = xstrdup(pw->pw_name); | ||
| 1271 | pwdir = xstrdup(pw->pw_dir); | ||
| 1250 | if (gethostname(thishost, sizeof(thishost)) == -1) | 1272 | if (gethostname(thishost, sizeof(thishost)) == -1) |
| 1251 | fatal("load_public_identity_files: gethostname: %s", | 1273 | fatal("load_public_identity_files: gethostname: %s", |
| 1252 | strerror(errno)); | 1274 | strerror(errno)); |
| 1253 | for (; i < options.num_identity_files; i++) { | 1275 | for (; i < options.num_identity_files; i++) { |
| 1254 | cp = tilde_expand_filename(options.identity_files[i], | 1276 | cp = tilde_expand_filename(options.identity_files[i], |
| 1255 | original_real_uid); | 1277 | original_real_uid); |
| 1256 | filename = percent_expand(cp, "d", pw->pw_dir, | 1278 | filename = percent_expand(cp, "d", pwdir, |
| 1257 | "u", pw->pw_name, "l", thishost, "h", host, | 1279 | "u", pwname, "l", thishost, "h", host, |
| 1258 | "r", options.user, (char *)NULL); | 1280 | "r", options.user, (char *)NULL); |
| 1259 | xfree(cp); | 1281 | xfree(cp); |
| 1260 | public = key_load_public(filename, NULL); | 1282 | public = key_load_public(filename, NULL); |
| @@ -1280,231 +1302,8 @@ load_public_identity_files(void) | |||
| 1280 | options.identity_files[i] = filename; | 1302 | options.identity_files[i] = filename; |
| 1281 | options.identity_keys[i] = public; | 1303 | options.identity_keys[i] = public; |
| 1282 | } | 1304 | } |
| 1283 | } | 1305 | bzero(pwname, strlen(pwname)); |
| 1284 | 1306 | xfree(pwname); | |
| 1285 | static void | 1307 | bzero(pwdir, strlen(pwdir)); |
| 1286 | control_client_sighandler(int signo) | 1308 | xfree(pwdir); |
| 1287 | { | ||
| 1288 | control_client_terminate = signo; | ||
| 1289 | } | ||
| 1290 | |||
| 1291 | static void | ||
| 1292 | control_client_sigrelay(int signo) | ||
| 1293 | { | ||
| 1294 | if (control_server_pid > 1) | ||
| 1295 | kill(control_server_pid, signo); | ||
| 1296 | } | ||
| 1297 | |||
| 1298 | static int | ||
| 1299 | env_permitted(char *env) | ||
| 1300 | { | ||
| 1301 | int i, ret; | ||
| 1302 | char name[1024], *cp; | ||
| 1303 | |||
| 1304 | if ((cp = strchr(env, '=')) == NULL || cp == env) | ||
| 1305 | return (0); | ||
| 1306 | ret = snprintf(name, sizeof(name), "%.*s", (int)(cp - env), env); | ||
| 1307 | if (ret <= 0 || (size_t)ret >= sizeof(name)) | ||
| 1308 | fatal("env_permitted: name '%.100s...' too long", env); | ||
| 1309 | |||
| 1310 | for (i = 0; i < options.num_send_env; i++) | ||
| 1311 | if (match_pattern(name, options.send_env[i])) | ||
| 1312 | return (1); | ||
| 1313 | |||
| 1314 | return (0); | ||
| 1315 | } | ||
| 1316 | |||
| 1317 | static void | ||
| 1318 | control_client(const char *path) | ||
| 1319 | { | ||
| 1320 | struct sockaddr_un addr; | ||
| 1321 | int i, r, fd, sock, exitval[2], num_env, addr_len; | ||
| 1322 | Buffer m; | ||
| 1323 | char *term; | ||
| 1324 | extern char **environ; | ||
| 1325 | u_int flags; | ||
| 1326 | |||
| 1327 | if (mux_command == 0) | ||
| 1328 | mux_command = SSHMUX_COMMAND_OPEN; | ||
| 1329 | |||
| 1330 | switch (options.control_master) { | ||
| 1331 | case SSHCTL_MASTER_AUTO: | ||
| 1332 | case SSHCTL_MASTER_AUTO_ASK: | ||
| 1333 | debug("auto-mux: Trying existing master"); | ||
| 1334 | /* FALLTHROUGH */ | ||
| 1335 | case SSHCTL_MASTER_NO: | ||
| 1336 | break; | ||
| 1337 | default: | ||
| 1338 | return; | ||
| 1339 | } | ||
| 1340 | |||
| 1341 | memset(&addr, '\0', sizeof(addr)); | ||
| 1342 | addr.sun_family = AF_UNIX; | ||
| 1343 | addr_len = offsetof(struct sockaddr_un, sun_path) + | ||
| 1344 | strlen(path) + 1; | ||
| 1345 | |||
| 1346 | if (strlcpy(addr.sun_path, path, | ||
| 1347 | sizeof(addr.sun_path)) >= sizeof(addr.sun_path)) | ||
| 1348 | fatal("ControlPath too long"); | ||
| 1349 | |||
| 1350 | if ((sock = socket(PF_UNIX, SOCK_STREAM, 0)) < 0) | ||
| 1351 | fatal("%s socket(): %s", __func__, strerror(errno)); | ||
| 1352 | |||
| 1353 | if (connect(sock, (struct sockaddr *)&addr, addr_len) == -1) { | ||
| 1354 | if (mux_command != SSHMUX_COMMAND_OPEN) { | ||
| 1355 | fatal("Control socket connect(%.100s): %s", path, | ||
| 1356 | strerror(errno)); | ||
| 1357 | } | ||
| 1358 | if (errno == ENOENT) | ||
| 1359 | debug("Control socket \"%.100s\" does not exist", path); | ||
| 1360 | else { | ||
| 1361 | error("Control socket connect(%.100s): %s", path, | ||
| 1362 | strerror(errno)); | ||
| 1363 | } | ||
| 1364 | close(sock); | ||
| 1365 | return; | ||
| 1366 | } | ||
| 1367 | |||
| 1368 | if (stdin_null_flag) { | ||
| 1369 | if ((fd = open(_PATH_DEVNULL, O_RDONLY)) == -1) | ||
| 1370 | fatal("open(/dev/null): %s", strerror(errno)); | ||
| 1371 | if (dup2(fd, STDIN_FILENO) == -1) | ||
| 1372 | fatal("dup2: %s", strerror(errno)); | ||
| 1373 | if (fd > STDERR_FILENO) | ||
| 1374 | close(fd); | ||
| 1375 | } | ||
| 1376 | |||
| 1377 | term = getenv("TERM"); | ||
| 1378 | |||
| 1379 | flags = 0; | ||
| 1380 | if (tty_flag) | ||
| 1381 | flags |= SSHMUX_FLAG_TTY; | ||
| 1382 | if (subsystem_flag) | ||
| 1383 | flags |= SSHMUX_FLAG_SUBSYS; | ||
| 1384 | if (options.forward_x11) | ||
| 1385 | flags |= SSHMUX_FLAG_X11_FWD; | ||
| 1386 | if (options.forward_agent) | ||
| 1387 | flags |= SSHMUX_FLAG_AGENT_FWD; | ||
| 1388 | |||
| 1389 | buffer_init(&m); | ||
| 1390 | |||
| 1391 | /* Send our command to server */ | ||
| 1392 | buffer_put_int(&m, mux_command); | ||
| 1393 | buffer_put_int(&m, flags); | ||
| 1394 | if (ssh_msg_send(sock, SSHMUX_VER, &m) == -1) | ||
| 1395 | fatal("%s: msg_send", __func__); | ||
| 1396 | buffer_clear(&m); | ||
| 1397 | |||
| 1398 | /* Get authorisation status and PID of controlee */ | ||
| 1399 | if (ssh_msg_recv(sock, &m) == -1) | ||
| 1400 | fatal("%s: msg_recv", __func__); | ||
| 1401 | if (buffer_get_char(&m) != SSHMUX_VER) | ||
| 1402 | fatal("%s: wrong version", __func__); | ||
| 1403 | if (buffer_get_int(&m) != 1) | ||
| 1404 | fatal("Connection to master denied"); | ||
| 1405 | control_server_pid = buffer_get_int(&m); | ||
| 1406 | |||
| 1407 | buffer_clear(&m); | ||
| 1408 | |||
| 1409 | switch (mux_command) { | ||
| 1410 | case SSHMUX_COMMAND_ALIVE_CHECK: | ||
| 1411 | fprintf(stderr, "Master running (pid=%d)\r\n", | ||
| 1412 | control_server_pid); | ||
| 1413 | exit(0); | ||
| 1414 | case SSHMUX_COMMAND_TERMINATE: | ||
| 1415 | fprintf(stderr, "Exit request sent.\r\n"); | ||
| 1416 | exit(0); | ||
| 1417 | case SSHMUX_COMMAND_OPEN: | ||
| 1418 | /* continue below */ | ||
| 1419 | break; | ||
| 1420 | default: | ||
| 1421 | fatal("silly mux_command %d", mux_command); | ||
| 1422 | } | ||
| 1423 | |||
| 1424 | /* SSHMUX_COMMAND_OPEN */ | ||
| 1425 | buffer_put_cstring(&m, term ? term : ""); | ||
| 1426 | buffer_append(&command, "\0", 1); | ||
| 1427 | buffer_put_cstring(&m, buffer_ptr(&command)); | ||
| 1428 | |||
| 1429 | if (options.num_send_env == 0 || environ == NULL) { | ||
| 1430 | buffer_put_int(&m, 0); | ||
| 1431 | } else { | ||
| 1432 | /* Pass environment */ | ||
| 1433 | num_env = 0; | ||
| 1434 | for (i = 0; environ[i] != NULL; i++) | ||
| 1435 | if (env_permitted(environ[i])) | ||
| 1436 | num_env++; /* Count */ | ||
| 1437 | |||
| 1438 | buffer_put_int(&m, num_env); | ||
| 1439 | |||
| 1440 | for (i = 0; environ[i] != NULL && num_env >= 0; i++) | ||
| 1441 | if (env_permitted(environ[i])) { | ||
| 1442 | num_env--; | ||
| 1443 | buffer_put_cstring(&m, environ[i]); | ||
| 1444 | } | ||
| 1445 | } | ||
| 1446 | |||
| 1447 | if (ssh_msg_send(sock, SSHMUX_VER, &m) == -1) | ||
| 1448 | fatal("%s: msg_send", __func__); | ||
| 1449 | |||
| 1450 | mm_send_fd(sock, STDIN_FILENO); | ||
| 1451 | mm_send_fd(sock, STDOUT_FILENO); | ||
| 1452 | mm_send_fd(sock, STDERR_FILENO); | ||
| 1453 | |||
| 1454 | /* Wait for reply, so master has a chance to gather ttymodes */ | ||
| 1455 | buffer_clear(&m); | ||
| 1456 | if (ssh_msg_recv(sock, &m) == -1) | ||
| 1457 | fatal("%s: msg_recv", __func__); | ||
| 1458 | if (buffer_get_char(&m) != SSHMUX_VER) | ||
| 1459 | fatal("%s: wrong version", __func__); | ||
| 1460 | buffer_free(&m); | ||
| 1461 | |||
| 1462 | signal(SIGHUP, control_client_sighandler); | ||
| 1463 | signal(SIGINT, control_client_sighandler); | ||
| 1464 | signal(SIGTERM, control_client_sighandler); | ||
| 1465 | signal(SIGWINCH, control_client_sigrelay); | ||
| 1466 | |||
| 1467 | if (tty_flag) | ||
| 1468 | enter_raw_mode(); | ||
| 1469 | |||
| 1470 | /* | ||
| 1471 | * Stick around until the controlee closes the client_fd. | ||
| 1472 | * Before it does, it is expected to write this process' exit | ||
| 1473 | * value (one int). This process must read the value and wait for | ||
| 1474 | * the closure of the client_fd; if this one closes early, the | ||
| 1475 | * multiplex master will terminate early too (possibly losing data). | ||
| 1476 | */ | ||
| 1477 | exitval[0] = 0; | ||
| 1478 | for (i = 0; !control_client_terminate && i < (int)sizeof(exitval);) { | ||
| 1479 | r = read(sock, (char *)exitval + i, sizeof(exitval) - i); | ||
| 1480 | if (r == 0) { | ||
| 1481 | debug2("Received EOF from master"); | ||
| 1482 | break; | ||
| 1483 | } | ||
| 1484 | if (r == -1) { | ||
| 1485 | if (errno == EINTR) | ||
| 1486 | continue; | ||
| 1487 | fatal("%s: read %s", __func__, strerror(errno)); | ||
| 1488 | } | ||
| 1489 | i += r; | ||
| 1490 | } | ||
| 1491 | |||
| 1492 | close(sock); | ||
| 1493 | leave_raw_mode(); | ||
| 1494 | if (i > (int)sizeof(int)) | ||
| 1495 | fatal("%s: master returned too much data (%d > %lu)", | ||
| 1496 | __func__, i, sizeof(int)); | ||
| 1497 | if (control_client_terminate) { | ||
| 1498 | debug2("Exiting on signal %d", control_client_terminate); | ||
| 1499 | exitval[0] = 255; | ||
| 1500 | } else if (i < (int)sizeof(int)) { | ||
| 1501 | debug2("Control master terminated unexpectedly"); | ||
| 1502 | exitval[0] = 255; | ||
| 1503 | } else | ||
| 1504 | debug2("Received exit status from master %d", exitval[0]); | ||
| 1505 | |||
| 1506 | if (tty_flag && options.log_level > SYSLOG_LEVEL_QUIET) | ||
| 1507 | fprintf(stderr, "Shared connection to %s closed.\r\n", host); | ||
| 1508 | |||
| 1509 | exit(exitval[0]); | ||
| 1510 | } | 1309 | } |
diff --git a/ssh_config.0 b/ssh_config.0 index 381c1ba0a..e2e645854 100644 --- a/ssh_config.0 +++ b/ssh_config.0 | |||
| @@ -40,10 +40,12 @@ DESCRIPTION | |||
| 40 | 40 | ||
| 41 | Host Restricts the following declarations (up to the next Host key- | 41 | Host Restricts the following declarations (up to the next Host key- |
| 42 | word) to be only for those hosts that match one of the patterns | 42 | word) to be only for those hosts that match one of the patterns |
| 43 | given after the keyword. A single `*' as a pattern can be used | 43 | given after the keyword. If more than one pattern is provided, |
| 44 | to provide global defaults for all hosts. The host is the | 44 | they should be separated by whitepsace. A single `*' as a pat- |
| 45 | hostname argument given on the command line (i.e. the name is not | 45 | tern can be used to provide global defaults for all hosts. The |
| 46 | converted to a canonicalized host name before matching). | 46 | host is the hostname argument given on the command line (i.e. the |
| 47 | name is not converted to a canonicalized host name before match- | ||
| 48 | ing). | ||
| 47 | 49 | ||
| 48 | See PATTERNS for more information on patterns. | 50 | See PATTERNS for more information on patterns. |
| 49 | 51 | ||
| @@ -324,6 +326,11 @@ DESCRIPTION | |||
| 324 | It is possible to have multiple identity files specified in con- | 326 | It is possible to have multiple identity files specified in con- |
| 325 | figuration files; all these identities will be tried in sequence. | 327 | figuration files; all these identities will be tried in sequence. |
| 326 | 328 | ||
| 329 | KbdInteractiveAuthentication | ||
| 330 | Specifies whether to use keyboard-interactive authentication. | ||
| 331 | The argument to this keyword must be ``yes'' or ``no''. The de- | ||
| 332 | fault is ``yes''. | ||
| 333 | |||
| 327 | KbdInteractiveDevices | 334 | KbdInteractiveDevices |
| 328 | Specifies the list of methods to use in keyboard-interactive au- | 335 | Specifies the list of methods to use in keyboard-interactive au- |
| 329 | thentication. Multiple method names must be comma-separated. | 336 | thentication. Multiple method names must be comma-separated. |
| @@ -335,8 +342,13 @@ DESCRIPTION | |||
| 335 | LocalCommand | 342 | LocalCommand |
| 336 | Specifies a command to execute on the local machine after suc- | 343 | Specifies a command to execute on the local machine after suc- |
| 337 | cessfully connecting to the server. The command string extends | 344 | cessfully connecting to the server. The command string extends |
| 338 | to the end of the line, and is executed with /bin/sh. This di- | 345 | to the end of the line, and is executed with the user's shell. |
| 339 | rective is ignored unless PermitLocalCommand has been enabled. | 346 | The following escape character substitutions will be performed: |
| 347 | `%d' (local user's home directory), `%h' (remote host name), `%l' | ||
| 348 | (local host name), `%n' (host name as provided on the command | ||
| 349 | line), `%p' (remote port), `%r' (remote user name) or `%u' (local | ||
| 350 | user name). This directive is ignored unless PermitLocalCommand | ||
| 351 | has been enabled. | ||
| 340 | 352 | ||
| 341 | LocalForward | 353 | LocalForward |
| 342 | Specifies that a TCP port on the local machine be forwarded over | 354 | Specifies that a TCP port on the local machine be forwarded over |
| @@ -413,16 +425,16 @@ DESCRIPTION | |||
| 413 | ProxyCommand | 425 | ProxyCommand |
| 414 | Specifies the command to use to connect to the server. The com- | 426 | Specifies the command to use to connect to the server. The com- |
| 415 | mand string extends to the end of the line, and is executed with | 427 | mand string extends to the end of the line, and is executed with |
| 416 | /bin/sh. In the command string, `%h' will be substituted by the | 428 | the user's shell. In the command string, `%h' will be substitut- |
| 417 | host name to connect and `%p' by the port. The command can be | 429 | ed by the host name to connect and `%p' by the port. The command |
| 418 | basically anything, and should read from its standard input and | 430 | can be basically anything, and should read from its standard in- |
| 419 | write to its standard output. It should eventually connect an | 431 | put and write to its standard output. It should eventually con- |
| 420 | sshd(8) server running on some machine, or execute sshd -i some- | 432 | nect an sshd(8) server running on some machine, or execute sshd |
| 421 | where. Host key management will be done using the HostName of | 433 | -i somewhere. Host key management will be done using the Host- |
| 422 | the host being connected (defaulting to the name typed by the us- | 434 | Name of the host being connected (defaulting to the name typed by |
| 423 | er). Setting the command to ``none'' disables this option en- | 435 | the user). Setting the command to ``none'' disables this option |
| 424 | tirely. Note that CheckHostIP is not available for connects with | 436 | entirely. Note that CheckHostIP is not available for connects |
| 425 | a proxy command. | 437 | with a proxy command. |
| 426 | 438 | ||
| 427 | This directive is useful in conjunction with nc(1) and its proxy | 439 | This directive is useful in conjunction with nc(1) and its proxy |
| 428 | support. For example, the following directive would connect via | 440 | support. For example, the following directive would connect via |
| @@ -595,6 +607,12 @@ DESCRIPTION | |||
| 595 | 607 | ||
| 596 | See also VERIFYING HOST KEYS in ssh(1). | 608 | See also VERIFYING HOST KEYS in ssh(1). |
| 597 | 609 | ||
| 610 | VisualHostKey | ||
| 611 | If this flag is set to ``yes'', an ASCII art representation of | ||
| 612 | the remote host key fingerprint is printed additionally to the | ||
| 613 | hex fingerprint string. If this flag is set to ``no'', only the | ||
| 614 | hex fingerprint string will be printed. The default is ``no''. | ||
| 615 | |||
| 598 | XAuthLocation | 616 | XAuthLocation |
| 599 | Specifies the full pathname of the xauth(1) program. The default | 617 | Specifies the full pathname of the xauth(1) program. The default |
| 600 | is /usr/X11R6/bin/xauth. | 618 | is /usr/X11R6/bin/xauth. |
| @@ -644,4 +662,4 @@ AUTHORS | |||
| 644 | ated OpenSSH. Markus Friedl contributed the support for SSH protocol | 662 | ated OpenSSH. Markus Friedl contributed the support for SSH protocol |
| 645 | versions 1.5 and 2.0. | 663 | versions 1.5 and 2.0. |
| 646 | 664 | ||
| 647 | OpenBSD 4.2 August 15, 2007 10 | 665 | OpenBSD 4.4 June 26, 2008 11 |
diff --git a/ssh_config.5 b/ssh_config.5 index 411e9fd34..1b8b8da5d 100644 --- a/ssh_config.5 +++ b/ssh_config.5 | |||
| @@ -34,8 +34,8 @@ | |||
| 34 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | 34 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
| 35 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | 35 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| 36 | .\" | 36 | .\" |
| 37 | .\" $OpenBSD: ssh_config.5,v 1.102 2007/08/15 12:13:41 stevesk Exp $ | 37 | .\" $OpenBSD: ssh_config.5,v 1.111 2008/06/26 11:46:31 grunk Exp $ |
| 38 | .Dd $Mdocdate: August 15 2007 $ | 38 | .Dd $Mdocdate: June 26 2008 $ |
| 39 | .Dt SSH_CONFIG 5 | 39 | .Dt SSH_CONFIG 5 |
| 40 | .Os | 40 | .Os |
| 41 | .Sh NAME | 41 | .Sh NAME |
| @@ -119,6 +119,7 @@ Restricts the following declarations (up to the next | |||
| 119 | .Cm Host | 119 | .Cm Host |
| 120 | keyword) to be only for those hosts that match one of the patterns | 120 | keyword) to be only for those hosts that match one of the patterns |
| 121 | given after the keyword. | 121 | given after the keyword. |
| 122 | If more than one pattern is provided, they should be separated by whitepsace. | ||
| 122 | A single | 123 | A single |
| 123 | .Ql * | 124 | .Ql * |
| 124 | as a pattern can be used to provide global | 125 | as a pattern can be used to provide global |
| @@ -145,9 +146,7 @@ If set to | |||
| 145 | passphrase/password querying will be disabled. | 146 | passphrase/password querying will be disabled. |
| 146 | In addition, the | 147 | In addition, the |
| 147 | .Cm ServerAliveInterval | 148 | .Cm ServerAliveInterval |
| 148 | and | 149 | option will be set to 300 seconds by default. |
| 149 | .Cm SetupTimeOut | ||
| 150 | options will both be set to 300 seconds by default. | ||
| 151 | This option is useful in scripts and other batch jobs where no user | 150 | This option is useful in scripts and other batch jobs where no user |
| 152 | is present to supply the password, | 151 | is present to supply the password, |
| 153 | and where it is desirable to detect a broken network swiftly. | 152 | and where it is desirable to detect a broken network swiftly. |
| @@ -619,6 +618,14 @@ escape characters: | |||
| 619 | It is possible to have | 618 | It is possible to have |
| 620 | multiple identity files specified in configuration files; all these | 619 | multiple identity files specified in configuration files; all these |
| 621 | identities will be tried in sequence. | 620 | identities will be tried in sequence. |
| 621 | .It Cm KbdInteractiveAuthentication | ||
| 622 | Specifies whether to use keyboard-interactive authentication. | ||
| 623 | The argument to this keyword must be | ||
| 624 | .Dq yes | ||
| 625 | or | ||
| 626 | .Dq no . | ||
| 627 | The default is | ||
| 628 | .Dq yes . | ||
| 622 | .It Cm KbdInteractiveDevices | 629 | .It Cm KbdInteractiveDevices |
| 623 | Specifies the list of methods to use in keyboard-interactive authentication. | 630 | Specifies the list of methods to use in keyboard-interactive authentication. |
| 624 | Multiple method names must be comma-separated. | 631 | Multiple method names must be comma-separated. |
| @@ -634,7 +641,22 @@ and | |||
| 634 | Specifies a command to execute on the local machine after successfully | 641 | Specifies a command to execute on the local machine after successfully |
| 635 | connecting to the server. | 642 | connecting to the server. |
| 636 | The command string extends to the end of the line, and is executed with | 643 | The command string extends to the end of the line, and is executed with |
| 637 | .Pa /bin/sh . | 644 | the user's shell. |
| 645 | The following escape character substitutions will be performed: | ||
| 646 | .Ql %d | ||
| 647 | (local user's home directory), | ||
| 648 | .Ql %h | ||
| 649 | (remote host name), | ||
| 650 | .Ql %l | ||
| 651 | (local host name), | ||
| 652 | .Ql %n | ||
| 653 | (host name as provided on the command line), | ||
| 654 | .Ql %p | ||
| 655 | (remote port), | ||
| 656 | .Ql %r | ||
| 657 | (remote user name) or | ||
| 658 | .Ql %u | ||
| 659 | (local user name). | ||
| 638 | This directive is ignored unless | 660 | This directive is ignored unless |
| 639 | .Cm PermitLocalCommand | 661 | .Cm PermitLocalCommand |
| 640 | has been enabled. | 662 | has been enabled. |
| @@ -758,7 +780,7 @@ if version 2 is not available. | |||
| 758 | Specifies the command to use to connect to the server. | 780 | Specifies the command to use to connect to the server. |
| 759 | The command | 781 | The command |
| 760 | string extends to the end of the line, and is executed with | 782 | string extends to the end of the line, and is executed with |
| 761 | .Pa /bin/sh . | 783 | the user's shell. |
| 762 | In the command string, | 784 | In the command string, |
| 763 | .Ql %h | 785 | .Ql %h |
| 764 | will be substituted by the host name to | 786 | will be substituted by the host name to |
| @@ -936,24 +958,9 @@ or 300 if the | |||
| 936 | option is set. | 958 | option is set. |
| 937 | This option applies to protocol version 2 only. | 959 | This option applies to protocol version 2 only. |
| 938 | .Cm ProtocolKeepAlives | 960 | .Cm ProtocolKeepAlives |
| 939 | is a Debian-specific compatibility alias for this option. | 961 | and |
| 940 | .It Cm SetupTimeOut | 962 | .Cm SetupTimeOut |
| 941 | Normally, | 963 | are Debian-specific compatibility aliases for this option. |
| 942 | .Nm ssh | ||
| 943 | blocks indefinitely whilst waiting to receive the ssh banner and other | ||
| 944 | setup protocol from the server, during the session setup. | ||
| 945 | This can cause | ||
| 946 | .Nm ssh | ||
| 947 | to hang under certain circumstances. | ||
| 948 | If this option is set, | ||
| 949 | .Nm ssh | ||
| 950 | will give up if no data from the server is received for the specified | ||
| 951 | number of seconds. | ||
| 952 | The argument must be an integer. | ||
| 953 | The default is 0 (disabled), or 300 if | ||
| 954 | .Cm BatchMode | ||
| 955 | is set. | ||
| 956 | This is a Debian-specific option. | ||
| 957 | .It Cm SmartcardDevice | 964 | .It Cm SmartcardDevice |
| 958 | Specifies which smartcard device to use. | 965 | Specifies which smartcard device to use. |
| 959 | The argument to this keyword is the device | 966 | The argument to this keyword is the device |
| @@ -1127,6 +1134,16 @@ See also | |||
| 1127 | .Sx VERIFYING HOST KEYS | 1134 | .Sx VERIFYING HOST KEYS |
| 1128 | in | 1135 | in |
| 1129 | .Xr ssh 1 . | 1136 | .Xr ssh 1 . |
| 1137 | .It Cm VisualHostKey | ||
| 1138 | If this flag is set to | ||
| 1139 | .Dq yes , | ||
| 1140 | an ASCII art representation of the remote host key fingerprint is | ||
| 1141 | printed additionally to the hex fingerprint string. | ||
| 1142 | If this flag is set to | ||
| 1143 | .Dq no , | ||
| 1144 | only the hex fingerprint string will be printed. | ||
| 1145 | The default is | ||
| 1146 | .Dq no . | ||
| 1130 | .It Cm XAuthLocation | 1147 | .It Cm XAuthLocation |
| 1131 | Specifies the full pathname of the | 1148 | Specifies the full pathname of the |
| 1132 | .Xr xauth 1 | 1149 | .Xr xauth 1 |
diff --git a/sshconnect.c b/sshconnect.c index 3c888e36a..01337fe40 100644 --- a/sshconnect.c +++ b/sshconnect.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: sshconnect.c,v 1.200 2006/10/10 10:12:45 markus Exp $ */ | 1 | /* $OpenBSD: sshconnect.c,v 1.211 2008/07/01 07:24:22 dtucker Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
| @@ -74,13 +74,6 @@ extern pid_t proxy_command_pid; | |||
| 74 | #define INET6_ADDRSTRLEN 46 | 74 | #define INET6_ADDRSTRLEN 46 |
| 75 | #endif | 75 | #endif |
| 76 | 76 | ||
| 77 | static sig_atomic_t banner_timedout; | ||
| 78 | |||
| 79 | static void banner_alarm_catch (int signum) | ||
| 80 | { | ||
| 81 | banner_timedout = 1; | ||
| 82 | } | ||
| 83 | |||
| 84 | static int show_other_keys(const char *, Key *); | 77 | static int show_other_keys(const char *, Key *); |
| 85 | static void warn_changed_key(Key *); | 78 | static void warn_changed_key(Key *); |
| 86 | 79 | ||
| @@ -93,7 +86,10 @@ ssh_proxy_connect(const char *host, u_short port, const char *proxy_command) | |||
| 93 | char *command_string, *tmp; | 86 | char *command_string, *tmp; |
| 94 | int pin[2], pout[2]; | 87 | int pin[2], pout[2]; |
| 95 | pid_t pid; | 88 | pid_t pid; |
| 96 | char strport[NI_MAXSERV]; | 89 | char *shell, strport[NI_MAXSERV]; |
| 90 | |||
| 91 | if ((shell = getenv("SHELL")) == NULL) | ||
| 92 | shell = _PATH_BSHELL; | ||
| 97 | 93 | ||
| 98 | /* Convert the port number into a string. */ | 94 | /* Convert the port number into a string. */ |
| 99 | snprintf(strport, sizeof strport, "%hu", port); | 95 | snprintf(strport, sizeof strport, "%hu", port); |
| @@ -139,7 +135,7 @@ ssh_proxy_connect(const char *host, u_short port, const char *proxy_command) | |||
| 139 | 135 | ||
| 140 | /* Stderr is left as it is so that error messages get | 136 | /* Stderr is left as it is so that error messages get |
| 141 | printed on the user's terminal. */ | 137 | printed on the user's terminal. */ |
| 142 | argv[0] = _PATH_BSHELL; | 138 | argv[0] = shell; |
| 143 | argv[1] = "-c"; | 139 | argv[1] = "-c"; |
| 144 | argv[2] = command_string; | 140 | argv[2] = command_string; |
| 145 | argv[3] = NULL; | 141 | argv[3] = NULL; |
| @@ -164,7 +160,9 @@ ssh_proxy_connect(const char *host, u_short port, const char *proxy_command) | |||
| 164 | xfree(command_string); | 160 | xfree(command_string); |
| 165 | 161 | ||
| 166 | /* Set the connection file descriptors. */ | 162 | /* Set the connection file descriptors. */ |
| 167 | packet_set_connection(pout[0], pin[1], options.setuptimeout); | 163 | packet_set_connection(pout[0], pin[1]); |
| 164 | packet_set_timeout(options.server_alive_interval, | ||
| 165 | options.server_alive_count_max); | ||
| 168 | 166 | ||
| 169 | /* Indicate OK return */ | 167 | /* Indicate OK return */ |
| 170 | return 0; | 168 | return 0; |
| @@ -208,10 +206,10 @@ ssh_create_socket(int privileged, struct addrinfo *ai) | |||
| 208 | hints.ai_socktype = ai->ai_socktype; | 206 | hints.ai_socktype = ai->ai_socktype; |
| 209 | hints.ai_protocol = ai->ai_protocol; | 207 | hints.ai_protocol = ai->ai_protocol; |
| 210 | hints.ai_flags = AI_PASSIVE; | 208 | hints.ai_flags = AI_PASSIVE; |
| 211 | gaierr = getaddrinfo(options.bind_address, "0", &hints, &res); | 209 | gaierr = getaddrinfo(options.bind_address, NULL, &hints, &res); |
| 212 | if (gaierr) { | 210 | if (gaierr) { |
| 213 | error("getaddrinfo: %s: %s", options.bind_address, | 211 | error("getaddrinfo: %s: %s", options.bind_address, |
| 214 | gai_strerror(gaierr)); | 212 | ssh_gai_strerror(gaierr)); |
| 215 | close(sock); | 213 | close(sock); |
| 216 | return -1; | 214 | return -1; |
| 217 | } | 215 | } |
| @@ -227,30 +225,36 @@ ssh_create_socket(int privileged, struct addrinfo *ai) | |||
| 227 | 225 | ||
| 228 | static int | 226 | static int |
| 229 | timeout_connect(int sockfd, const struct sockaddr *serv_addr, | 227 | timeout_connect(int sockfd, const struct sockaddr *serv_addr, |
| 230 | socklen_t addrlen, int timeout) | 228 | socklen_t addrlen, int *timeoutp) |
| 231 | { | 229 | { |
| 232 | fd_set *fdset; | 230 | fd_set *fdset; |
| 233 | struct timeval tv; | 231 | struct timeval tv, t_start; |
| 234 | socklen_t optlen; | 232 | socklen_t optlen; |
| 235 | int optval, rc, result = -1; | 233 | int optval, rc, result = -1; |
| 236 | 234 | ||
| 237 | if (timeout <= 0) | 235 | gettimeofday(&t_start, NULL); |
| 238 | return (connect(sockfd, serv_addr, addrlen)); | 236 | |
| 237 | if (*timeoutp <= 0) { | ||
| 238 | result = connect(sockfd, serv_addr, addrlen); | ||
| 239 | goto done; | ||
| 240 | } | ||
| 239 | 241 | ||
| 240 | set_nonblock(sockfd); | 242 | set_nonblock(sockfd); |
| 241 | rc = connect(sockfd, serv_addr, addrlen); | 243 | rc = connect(sockfd, serv_addr, addrlen); |
| 242 | if (rc == 0) { | 244 | if (rc == 0) { |
| 243 | unset_nonblock(sockfd); | 245 | unset_nonblock(sockfd); |
| 244 | return (0); | 246 | result = 0; |
| 247 | goto done; | ||
| 248 | } | ||
| 249 | if (errno != EINPROGRESS) { | ||
| 250 | result = -1; | ||
| 251 | goto done; | ||
| 245 | } | 252 | } |
| 246 | if (errno != EINPROGRESS) | ||
| 247 | return (-1); | ||
| 248 | 253 | ||
| 249 | fdset = (fd_set *)xcalloc(howmany(sockfd + 1, NFDBITS), | 254 | fdset = (fd_set *)xcalloc(howmany(sockfd + 1, NFDBITS), |
| 250 | sizeof(fd_mask)); | 255 | sizeof(fd_mask)); |
| 251 | FD_SET(sockfd, fdset); | 256 | FD_SET(sockfd, fdset); |
| 252 | tv.tv_sec = timeout; | 257 | ms_to_timeval(&tv, *timeoutp); |
| 253 | tv.tv_usec = 0; | ||
| 254 | 258 | ||
| 255 | for (;;) { | 259 | for (;;) { |
| 256 | rc = select(sockfd + 1, NULL, fdset, NULL, &tv); | 260 | rc = select(sockfd + 1, NULL, fdset, NULL, &tv); |
| @@ -289,6 +293,16 @@ timeout_connect(int sockfd, const struct sockaddr *serv_addr, | |||
| 289 | } | 293 | } |
| 290 | 294 | ||
| 291 | xfree(fdset); | 295 | xfree(fdset); |
| 296 | |||
| 297 | done: | ||
| 298 | if (result == 0 && *timeoutp > 0) { | ||
| 299 | ms_subtract_diff(&t_start, timeoutp); | ||
| 300 | if (*timeoutp <= 0) { | ||
| 301 | errno = ETIMEDOUT; | ||
| 302 | result = -1; | ||
| 303 | } | ||
| 304 | } | ||
| 305 | |||
| 292 | return (result); | 306 | return (result); |
| 293 | } | 307 | } |
| 294 | 308 | ||
| @@ -305,8 +319,8 @@ timeout_connect(int sockfd, const struct sockaddr *serv_addr, | |||
| 305 | */ | 319 | */ |
| 306 | int | 320 | int |
| 307 | ssh_connect(const char *host, struct sockaddr_storage * hostaddr, | 321 | ssh_connect(const char *host, struct sockaddr_storage * hostaddr, |
| 308 | u_short port, int family, int connection_attempts, | 322 | u_short port, int family, int connection_attempts, int *timeout_ms, |
| 309 | int needpriv, const char *proxy_command) | 323 | int want_keepalive, int needpriv, const char *proxy_command) |
| 310 | { | 324 | { |
| 311 | int gaierr; | 325 | int gaierr; |
| 312 | int on = 1; | 326 | int on = 1; |
| @@ -327,8 +341,8 @@ ssh_connect(const char *host, struct sockaddr_storage * hostaddr, | |||
| 327 | hints.ai_socktype = SOCK_STREAM; | 341 | hints.ai_socktype = SOCK_STREAM; |
| 328 | snprintf(strport, sizeof strport, "%u", port); | 342 | snprintf(strport, sizeof strport, "%u", port); |
| 329 | if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0) | 343 | if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0) |
| 330 | fatal("%s: %.100s: %s", __progname, host, | 344 | fatal("%s: Could not resolve hostname %.100s: %s", __progname, |
| 331 | gai_strerror(gaierr)); | 345 | host, ssh_gai_strerror(gaierr)); |
| 332 | 346 | ||
| 333 | for (attempt = 0; attempt < connection_attempts; attempt++) { | 347 | for (attempt = 0; attempt < connection_attempts; attempt++) { |
| 334 | if (attempt > 0) { | 348 | if (attempt > 0) { |
| @@ -359,7 +373,7 @@ ssh_connect(const char *host, struct sockaddr_storage * hostaddr, | |||
| 359 | continue; | 373 | continue; |
| 360 | 374 | ||
| 361 | if (timeout_connect(sock, ai->ai_addr, ai->ai_addrlen, | 375 | if (timeout_connect(sock, ai->ai_addr, ai->ai_addrlen, |
| 362 | options.connection_timeout) >= 0) { | 376 | timeout_ms) >= 0) { |
| 363 | /* Successful connection. */ | 377 | /* Successful connection. */ |
| 364 | memcpy(hostaddr, ai->ai_addr, ai->ai_addrlen); | 378 | memcpy(hostaddr, ai->ai_addr, ai->ai_addrlen); |
| 365 | break; | 379 | break; |
| @@ -386,13 +400,15 @@ ssh_connect(const char *host, struct sockaddr_storage * hostaddr, | |||
| 386 | debug("Connection established."); | 400 | debug("Connection established."); |
| 387 | 401 | ||
| 388 | /* Set SO_KEEPALIVE if requested. */ | 402 | /* Set SO_KEEPALIVE if requested. */ |
| 389 | if (options.tcp_keep_alive && | 403 | if (want_keepalive && |
| 390 | setsockopt(sock, SOL_SOCKET, SO_KEEPALIVE, (void *)&on, | 404 | setsockopt(sock, SOL_SOCKET, SO_KEEPALIVE, (void *)&on, |
| 391 | sizeof(on)) < 0) | 405 | sizeof(on)) < 0) |
| 392 | error("setsockopt SO_KEEPALIVE: %.100s", strerror(errno)); | 406 | error("setsockopt SO_KEEPALIVE: %.100s", strerror(errno)); |
| 393 | 407 | ||
| 394 | /* Set the connection. */ | 408 | /* Set the connection. */ |
| 395 | packet_set_connection(sock, sock, options.setuptimeout); | 409 | packet_set_connection(sock, sock); |
| 410 | packet_set_timeout(options.server_alive_interval, | ||
| 411 | options.server_alive_count_max); | ||
| 396 | 412 | ||
| 397 | return 0; | 413 | return 0; |
| 398 | } | 414 | } |
| @@ -402,7 +418,7 @@ ssh_connect(const char *host, struct sockaddr_storage * hostaddr, | |||
| 402 | * identification string. | 418 | * identification string. |
| 403 | */ | 419 | */ |
| 404 | static void | 420 | static void |
| 405 | ssh_exchange_identification(void) | 421 | ssh_exchange_identification(int timeout_ms) |
| 406 | { | 422 | { |
| 407 | char buf[256], remote_version[256]; /* must be same size! */ | 423 | char buf[256], remote_version[256]; /* must be same size! */ |
| 408 | int remote_major, remote_minor, mismatch; | 424 | int remote_major, remote_minor, mismatch; |
| @@ -410,40 +426,44 @@ ssh_exchange_identification(void) | |||
| 410 | int connection_out = packet_get_connection_out(); | 426 | int connection_out = packet_get_connection_out(); |
| 411 | int minor1 = PROTOCOL_MINOR_1; | 427 | int minor1 = PROTOCOL_MINOR_1; |
| 412 | u_int i, n; | 428 | u_int i, n; |
| 413 | struct sigaction sa, osa; | 429 | size_t len; |
| 430 | int fdsetsz, remaining, rc; | ||
| 431 | struct timeval t_start, t_remaining; | ||
| 432 | fd_set *fdset; | ||
| 433 | |||
| 434 | fdsetsz = howmany(connection_in + 1, NFDBITS) * sizeof(fd_mask); | ||
| 435 | fdset = xcalloc(1, fdsetsz); | ||
| 414 | 436 | ||
| 415 | /* Read other side's version identification. | ||
| 416 | * If SetupTimeOut has been set, give up after the specified amount | ||
| 417 | * of time. | ||
| 418 | */ | ||
| 419 | if (options.setuptimeout > 0) { | ||
| 420 | memset(&sa, 0, sizeof(sa)); | ||
| 421 | sa.sa_handler = banner_alarm_catch; | ||
| 422 | /* throw away any pending alarms, since we'd block otherwise */ | ||
| 423 | alarm(0); | ||
| 424 | sigaction(SIGALRM, &sa, &osa); | ||
| 425 | alarm(options.setuptimeout); | ||
| 426 | } | ||
| 427 | /* Read other side's version identification. */ | 437 | /* Read other side's version identification. */ |
| 438 | remaining = timeout_ms; | ||
| 428 | for (n = 0;;) { | 439 | for (n = 0;;) { |
| 429 | for (i = 0; i < sizeof(buf) - 1; ) { | 440 | for (i = 0; i < sizeof(buf) - 1; i++) { |
| 430 | ssize_t len = read(connection_in, &buf[i], 1); | 441 | if (timeout_ms > 0) { |
| 431 | if (banner_timedout) | 442 | gettimeofday(&t_start, NULL); |
| 432 | fatal("ssh_exchange_identification: Timeout waiting for version information."); | 443 | ms_to_timeval(&t_remaining, remaining); |
| 433 | if (len == 0) | 444 | FD_SET(connection_in, fdset); |
| 434 | errno = EPIPE; | 445 | rc = select(connection_in + 1, fdset, NULL, |
| 446 | fdset, &t_remaining); | ||
| 447 | ms_subtract_diff(&t_start, &remaining); | ||
| 448 | if (rc == 0 || remaining <= 0) | ||
| 449 | fatal("Connection timed out during " | ||
| 450 | "banner exchange"); | ||
| 451 | if (rc == -1) { | ||
| 452 | if (errno == EINTR) | ||
| 453 | continue; | ||
| 454 | fatal("ssh_exchange_identification: " | ||
| 455 | "select: %s", strerror(errno)); | ||
| 456 | } | ||
| 457 | } | ||
| 458 | |||
| 459 | len = atomicio(read, connection_in, &buf[i], 1); | ||
| 435 | 460 | ||
| 436 | if (len != 1 && errno == EPIPE) | 461 | if (len != 1 && errno == EPIPE) |
| 437 | fatal("ssh_exchange_identification: Connection closed by remote host"); | 462 | fatal("ssh_exchange_identification: " |
| 438 | else if (len != 1) { | 463 | "Connection closed by remote host"); |
| 439 | #ifdef EWOULDBLOCK | 464 | else if (len != 1) |
| 440 | if (errno == EINTR || errno == EAGAIN || errno == EWOULDBLOCK) | 465 | fatal("ssh_exchange_identification: " |
| 441 | #else | 466 | "read: %.100s", strerror(errno)); |
| 442 | if (errno == EINTR || errno == EAGAIN) | ||
| 443 | #endif | ||
| 444 | continue; | ||
| 445 | fatal("ssh_exchange_identification: read: %.100s", strerror(errno)); | ||
| 446 | } | ||
| 447 | if (buf[i] == '\r') { | 467 | if (buf[i] == '\r') { |
| 448 | buf[i] = '\n'; | 468 | buf[i] = '\n'; |
| 449 | buf[i + 1] = 0; | 469 | buf[i + 1] = 0; |
| @@ -453,13 +473,9 @@ ssh_exchange_identification(void) | |||
| 453 | buf[i + 1] = 0; | 473 | buf[i + 1] = 0; |
| 454 | break; | 474 | break; |
| 455 | } | 475 | } |
| 456 | if (buf[i] == '\r') { | ||
| 457 | buf[i] = '\n'; | ||
| 458 | buf[i + 1] = 0; /**XXX wait for \n */ | ||
| 459 | } | ||
| 460 | if (++n > 65536) | 476 | if (++n > 65536) |
| 461 | fatal("ssh_exchange_identification: No banner received"); | 477 | fatal("ssh_exchange_identification: " |
| 462 | i++; | 478 | "No banner received"); |
| 463 | } | 479 | } |
| 464 | buf[sizeof(buf) - 1] = 0; | 480 | buf[sizeof(buf) - 1] = 0; |
| 465 | if (strncmp(buf, "SSH-", 4) == 0) | 481 | if (strncmp(buf, "SSH-", 4) == 0) |
| @@ -467,14 +483,7 @@ ssh_exchange_identification(void) | |||
| 467 | debug("ssh_exchange_identification: %s", buf); | 483 | debug("ssh_exchange_identification: %s", buf); |
| 468 | } | 484 | } |
| 469 | server_version_string = xstrdup(buf); | 485 | server_version_string = xstrdup(buf); |
| 470 | 486 | xfree(fdset); | |
| 471 | /* If SetupTimeOut has been set, unset the alarm now, and | ||
| 472 | * put the correct handler for SIGALRM back. | ||
| 473 | */ | ||
| 474 | if (options.setuptimeout > 0) { | ||
| 475 | alarm(0); | ||
| 476 | sigaction(SIGALRM, &osa, NULL); | ||
| 477 | } | ||
| 478 | 487 | ||
| 479 | /* | 488 | /* |
| 480 | * Check that the versions match. In future this might accept | 489 | * Check that the versions match. In future this might accept |
| @@ -528,10 +537,10 @@ ssh_exchange_identification(void) | |||
| 528 | (options.protocol & SSH_PROTO_2) ? PROTOCOL_MAJOR_2 : PROTOCOL_MAJOR_1, | 537 | (options.protocol & SSH_PROTO_2) ? PROTOCOL_MAJOR_2 : PROTOCOL_MAJOR_1, |
| 529 | remote_major); | 538 | remote_major); |
| 530 | /* Send our own protocol version identification. */ | 539 | /* Send our own protocol version identification. */ |
| 531 | snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s\n", | 540 | snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s%s", |
| 532 | compat20 ? PROTOCOL_MAJOR_2 : PROTOCOL_MAJOR_1, | 541 | compat20 ? PROTOCOL_MAJOR_2 : PROTOCOL_MAJOR_1, |
| 533 | compat20 ? PROTOCOL_MINOR_2 : minor1, | 542 | compat20 ? PROTOCOL_MINOR_2 : minor1, |
| 534 | SSH_RELEASE); | 543 | SSH_RELEASE, compat20 ? "\r\n" : "\n"); |
| 535 | if (atomicio(vwrite, connection_out, buf, strlen(buf)) != strlen(buf)) | 544 | if (atomicio(vwrite, connection_out, buf, strlen(buf)) != strlen(buf)) |
| 536 | fatal("write: %.100s", strerror(errno)); | 545 | fatal("write: %.100s", strerror(errno)); |
| 537 | client_version_string = xstrdup(buf); | 546 | client_version_string = xstrdup(buf); |
| @@ -580,14 +589,14 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port, | |||
| 580 | Key *file_key; | 589 | Key *file_key; |
| 581 | const char *type = key_type(host_key); | 590 | const char *type = key_type(host_key); |
| 582 | char *ip = NULL, *host = NULL; | 591 | char *ip = NULL, *host = NULL; |
| 583 | char hostline[1000], *hostp, *fp; | 592 | char hostline[1000], *hostp, *fp, *ra; |
| 584 | HostStatus host_status; | 593 | HostStatus host_status; |
| 585 | HostStatus ip_status; | 594 | HostStatus ip_status; |
| 586 | int r, local = 0, host_ip_differ = 0; | 595 | int r, local = 0, host_ip_differ = 0; |
| 587 | int salen; | 596 | int salen; |
| 588 | char ntop[NI_MAXHOST]; | 597 | char ntop[NI_MAXHOST]; |
| 589 | char msg[1024]; | 598 | char msg[1024]; |
| 590 | int len, host_line, ip_line; | 599 | int len, host_line, ip_line, cancelled_forwarding = 0; |
| 591 | const char *host_file = NULL, *ip_file = NULL; | 600 | const char *host_file = NULL, *ip_file = NULL; |
| 592 | 601 | ||
| 593 | /* | 602 | /* |
| @@ -634,6 +643,7 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port, | |||
| 634 | } else { | 643 | } else { |
| 635 | ip = xstrdup("<no hostip for proxy command>"); | 644 | ip = xstrdup("<no hostip for proxy command>"); |
| 636 | } | 645 | } |
| 646 | |||
| 637 | /* | 647 | /* |
| 638 | * Turn off check_host_ip if the connection is to localhost, via proxy | 648 | * Turn off check_host_ip if the connection is to localhost, via proxy |
| 639 | * command or if we don't have a hostname to compare with | 649 | * command or if we don't have a hostname to compare with |
| @@ -718,6 +728,13 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port, | |||
| 718 | logit("Warning: Permanently added the %s host " | 728 | logit("Warning: Permanently added the %s host " |
| 719 | "key for IP address '%.128s' to the list " | 729 | "key for IP address '%.128s' to the list " |
| 720 | "of known hosts.", type, ip); | 730 | "of known hosts.", type, ip); |
| 731 | } else if (options.visual_host_key) { | ||
| 732 | fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX); | ||
| 733 | ra = key_fingerprint(host_key, SSH_FP_MD5, | ||
| 734 | SSH_FP_RANDOMART); | ||
| 735 | logit("Host key fingerprint is %s\n%s\n", fp, ra); | ||
| 736 | xfree(ra); | ||
| 737 | xfree(fp); | ||
| 721 | } | 738 | } |
| 722 | break; | 739 | break; |
| 723 | case HOST_NEW: | 740 | case HOST_NEW: |
| @@ -753,6 +770,8 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port, | |||
| 753 | snprintf(msg1, sizeof(msg1), "."); | 770 | snprintf(msg1, sizeof(msg1), "."); |
| 754 | /* The default */ | 771 | /* The default */ |
| 755 | fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX); | 772 | fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX); |
| 773 | ra = key_fingerprint(host_key, SSH_FP_MD5, | ||
| 774 | SSH_FP_RANDOMART); | ||
| 756 | msg2[0] = '\0'; | 775 | msg2[0] = '\0'; |
| 757 | if (options.verify_host_key_dns) { | 776 | if (options.verify_host_key_dns) { |
| 758 | if (matching_host_key_dns) | 777 | if (matching_host_key_dns) |
| @@ -767,10 +786,14 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port, | |||
| 767 | snprintf(msg, sizeof(msg), | 786 | snprintf(msg, sizeof(msg), |
| 768 | "The authenticity of host '%.200s (%s)' can't be " | 787 | "The authenticity of host '%.200s (%s)' can't be " |
| 769 | "established%s\n" | 788 | "established%s\n" |
| 770 | "%s key fingerprint is %s.\n%s" | 789 | "%s key fingerprint is %s.%s%s\n%s" |
| 771 | "Are you sure you want to continue connecting " | 790 | "Are you sure you want to continue connecting " |
| 772 | "(yes/no)? ", | 791 | "(yes/no)? ", |
| 773 | host, ip, msg1, type, fp, msg2); | 792 | host, ip, msg1, type, fp, |
| 793 | options.visual_host_key ? "\n" : "", | ||
| 794 | options.visual_host_key ? ra : "", | ||
| 795 | msg2); | ||
| 796 | xfree(ra); | ||
| 774 | xfree(fp); | 797 | xfree(fp); |
| 775 | if (!confirm(msg)) | 798 | if (!confirm(msg)) |
| 776 | goto fail; | 799 | goto fail; |
| @@ -823,7 +846,7 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port, | |||
| 823 | error("@ WARNING: POSSIBLE DNS SPOOFING DETECTED! @"); | 846 | error("@ WARNING: POSSIBLE DNS SPOOFING DETECTED! @"); |
| 824 | error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@"); | 847 | error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@"); |
| 825 | error("The %s host key for %s has changed,", type, host); | 848 | error("The %s host key for %s has changed,", type, host); |
| 826 | error("and the key for the according IP address %s", ip); | 849 | error("and the key for the corresponding IP address %s", ip); |
| 827 | error("%s. This could either mean that", key_msg); | 850 | error("%s. This could either mean that", key_msg); |
| 828 | error("DNS SPOOFING is happening or the IP address for the host"); | 851 | error("DNS SPOOFING is happening or the IP address for the host"); |
| 829 | error("and its host key have changed at the same time."); | 852 | error("and its host key have changed at the same time."); |
| @@ -855,27 +878,32 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port, | |||
| 855 | error("Password authentication is disabled to avoid " | 878 | error("Password authentication is disabled to avoid " |
| 856 | "man-in-the-middle attacks."); | 879 | "man-in-the-middle attacks."); |
| 857 | options.password_authentication = 0; | 880 | options.password_authentication = 0; |
| 881 | cancelled_forwarding = 1; | ||
| 858 | } | 882 | } |
| 859 | if (options.kbd_interactive_authentication) { | 883 | if (options.kbd_interactive_authentication) { |
| 860 | error("Keyboard-interactive authentication is disabled" | 884 | error("Keyboard-interactive authentication is disabled" |
| 861 | " to avoid man-in-the-middle attacks."); | 885 | " to avoid man-in-the-middle attacks."); |
| 862 | options.kbd_interactive_authentication = 0; | 886 | options.kbd_interactive_authentication = 0; |
| 863 | options.challenge_response_authentication = 0; | 887 | options.challenge_response_authentication = 0; |
| 888 | cancelled_forwarding = 1; | ||
| 864 | } | 889 | } |
| 865 | if (options.challenge_response_authentication) { | 890 | if (options.challenge_response_authentication) { |
| 866 | error("Challenge/response authentication is disabled" | 891 | error("Challenge/response authentication is disabled" |
| 867 | " to avoid man-in-the-middle attacks."); | 892 | " to avoid man-in-the-middle attacks."); |
| 868 | options.challenge_response_authentication = 0; | 893 | options.challenge_response_authentication = 0; |
| 894 | cancelled_forwarding = 1; | ||
| 869 | } | 895 | } |
| 870 | if (options.forward_agent) { | 896 | if (options.forward_agent) { |
| 871 | error("Agent forwarding is disabled to avoid " | 897 | error("Agent forwarding is disabled to avoid " |
| 872 | "man-in-the-middle attacks."); | 898 | "man-in-the-middle attacks."); |
| 873 | options.forward_agent = 0; | 899 | options.forward_agent = 0; |
| 900 | cancelled_forwarding = 1; | ||
| 874 | } | 901 | } |
| 875 | if (options.forward_x11) { | 902 | if (options.forward_x11) { |
| 876 | error("X11 forwarding is disabled to avoid " | 903 | error("X11 forwarding is disabled to avoid " |
| 877 | "man-in-the-middle attacks."); | 904 | "man-in-the-middle attacks."); |
| 878 | options.forward_x11 = 0; | 905 | options.forward_x11 = 0; |
| 906 | cancelled_forwarding = 1; | ||
| 879 | } | 907 | } |
| 880 | if (options.num_local_forwards > 0 || | 908 | if (options.num_local_forwards > 0 || |
| 881 | options.num_remote_forwards > 0) { | 909 | options.num_remote_forwards > 0) { |
| @@ -883,12 +911,18 @@ check_host_key(char *hostname, struct sockaddr *hostaddr, u_short port, | |||
| 883 | "man-in-the-middle attacks."); | 911 | "man-in-the-middle attacks."); |
| 884 | options.num_local_forwards = | 912 | options.num_local_forwards = |
| 885 | options.num_remote_forwards = 0; | 913 | options.num_remote_forwards = 0; |
| 914 | cancelled_forwarding = 1; | ||
| 886 | } | 915 | } |
| 887 | if (options.tun_open != SSH_TUNMODE_NO) { | 916 | if (options.tun_open != SSH_TUNMODE_NO) { |
| 888 | error("Tunnel forwarding is disabled to avoid " | 917 | error("Tunnel forwarding is disabled to avoid " |
| 889 | "man-in-the-middle attacks."); | 918 | "man-in-the-middle attacks."); |
| 890 | options.tun_open = SSH_TUNMODE_NO; | 919 | options.tun_open = SSH_TUNMODE_NO; |
| 920 | cancelled_forwarding = 1; | ||
| 891 | } | 921 | } |
| 922 | if (options.exit_on_forward_failure && cancelled_forwarding) | ||
| 923 | fatal("Error: forwarding disabled due to host key " | ||
| 924 | "check failure"); | ||
| 925 | |||
| 892 | /* | 926 | /* |
| 893 | * XXX Should permit the user to change to use the new id. | 927 | * XXX Should permit the user to change to use the new id. |
| 894 | * This could be done by converting the host key to an | 928 | * This could be done by converting the host key to an |
| @@ -987,7 +1021,7 @@ verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key) | |||
| 987 | */ | 1021 | */ |
| 988 | void | 1022 | void |
| 989 | ssh_login(Sensitive *sensitive, const char *orighost, | 1023 | ssh_login(Sensitive *sensitive, const char *orighost, |
| 990 | struct sockaddr *hostaddr, struct passwd *pw) | 1024 | struct sockaddr *hostaddr, struct passwd *pw, int timeout_ms) |
| 991 | { | 1025 | { |
| 992 | char *host, *cp; | 1026 | char *host, *cp; |
| 993 | char *server_user, *local_user; | 1027 | char *server_user, *local_user; |
| @@ -1002,7 +1036,7 @@ ssh_login(Sensitive *sensitive, const char *orighost, | |||
| 1002 | *cp = (char)tolower(*cp); | 1036 | *cp = (char)tolower(*cp); |
| 1003 | 1037 | ||
| 1004 | /* Exchange protocol version identification strings with the server. */ | 1038 | /* Exchange protocol version identification strings with the server. */ |
| 1005 | ssh_exchange_identification(); | 1039 | ssh_exchange_identification(timeout_ms); |
| 1006 | 1040 | ||
| 1007 | /* Put the connection into non-blocking mode. */ | 1041 | /* Put the connection into non-blocking mode. */ |
| 1008 | packet_set_nonblocking(); | 1042 | packet_set_nonblocking(); |
| @@ -1041,18 +1075,20 @@ static int | |||
| 1041 | show_key_from_file(const char *file, const char *host, int keytype) | 1075 | show_key_from_file(const char *file, const char *host, int keytype) |
| 1042 | { | 1076 | { |
| 1043 | Key *found; | 1077 | Key *found; |
| 1044 | char *fp; | 1078 | char *fp, *ra; |
| 1045 | int line, ret; | 1079 | int line, ret; |
| 1046 | 1080 | ||
| 1047 | found = key_new(keytype); | 1081 | found = key_new(keytype); |
| 1048 | if ((ret = lookup_key_in_hostfile_by_type(file, host, | 1082 | if ((ret = lookup_key_in_hostfile_by_type(file, host, |
| 1049 | keytype, found, &line))) { | 1083 | keytype, found, &line))) { |
| 1050 | fp = key_fingerprint(found, SSH_FP_MD5, SSH_FP_HEX); | 1084 | fp = key_fingerprint(found, SSH_FP_MD5, SSH_FP_HEX); |
| 1085 | ra = key_fingerprint(found, SSH_FP_MD5, SSH_FP_RANDOMART); | ||
| 1051 | logit("WARNING: %s key found for host %s\n" | 1086 | logit("WARNING: %s key found for host %s\n" |
| 1052 | "in %s:%d\n" | 1087 | "in %s:%d\n" |
| 1053 | "%s key fingerprint %s.", | 1088 | "%s key fingerprint %s.\n%s\n", |
| 1054 | key_type(found), host, file, line, | 1089 | key_type(found), host, file, line, |
| 1055 | key_type(found), fp); | 1090 | key_type(found), fp, ra); |
| 1091 | xfree(ra); | ||
| 1056 | xfree(fp); | 1092 | xfree(fp); |
| 1057 | } | 1093 | } |
| 1058 | key_free(found); | 1094 | key_free(found); |
diff --git a/sshconnect.h b/sshconnect.h index 4e66bbffc..75bde1a4d 100644 --- a/sshconnect.h +++ b/sshconnect.h | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: sshconnect.h,v 1.23 2006/08/03 03:34:42 deraadt Exp $ */ | 1 | /* $OpenBSD: sshconnect.h,v 1.24 2007/09/04 11:15:56 djm Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Copyright (c) 2000 Markus Friedl. All rights reserved. | 4 | * Copyright (c) 2000 Markus Friedl. All rights reserved. |
| @@ -33,10 +33,10 @@ struct Sensitive { | |||
| 33 | 33 | ||
| 34 | int | 34 | int |
| 35 | ssh_connect(const char *, struct sockaddr_storage *, u_short, int, int, | 35 | ssh_connect(const char *, struct sockaddr_storage *, u_short, int, int, |
| 36 | int, const char *); | 36 | int *, int, int, const char *); |
| 37 | 37 | ||
| 38 | void | 38 | void |
| 39 | ssh_login(Sensitive *, const char *, struct sockaddr *, struct passwd *); | 39 | ssh_login(Sensitive *, const char *, struct sockaddr *, struct passwd *, int); |
| 40 | 40 | ||
| 41 | int verify_host_key(char *, struct sockaddr *, Key *); | 41 | int verify_host_key(char *, struct sockaddr *, Key *); |
| 42 | 42 | ||
diff --git a/sshconnect2.c b/sshconnect2.c index 97073e401..18cbbd9f9 100644 --- a/sshconnect2.c +++ b/sshconnect2.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: sshconnect2.c,v 1.164 2007/05/17 23:53:41 jolan Exp $ */ | 1 | /* $OpenBSD: sshconnect2.c,v 1.166 2008/07/17 08:48:00 djm Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Copyright (c) 2000 Markus Friedl. All rights reserved. | 3 | * Copyright (c) 2000 Markus Friedl. All rights reserved. |
| 4 | * | 4 | * |
| @@ -38,6 +38,9 @@ | |||
| 38 | #include <stdio.h> | 38 | #include <stdio.h> |
| 39 | #include <string.h> | 39 | #include <string.h> |
| 40 | #include <unistd.h> | 40 | #include <unistd.h> |
| 41 | #if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H) | ||
| 42 | #include <vis.h> | ||
| 43 | #endif | ||
| 41 | 44 | ||
| 42 | #include "openbsd-compat/sys-queue.h" | 45 | #include "openbsd-compat/sys-queue.h" |
| 43 | 46 | ||
| @@ -165,7 +168,7 @@ ssh_kex2(char *host, struct sockaddr *hostaddr) | |||
| 165 | #endif | 168 | #endif |
| 166 | 169 | ||
| 167 | if (options.rekey_limit) | 170 | if (options.rekey_limit) |
| 168 | packet_set_rekey_limit(options.rekey_limit); | 171 | packet_set_rekey_limit((u_int32_t)options.rekey_limit); |
| 169 | 172 | ||
| 170 | /* start key exchange */ | 173 | /* start key exchange */ |
| 171 | kex = kex_setup(myproposal); | 174 | kex = kex_setup(myproposal); |
| @@ -429,14 +432,21 @@ input_userauth_error(int type, u_int32_t seq, void *ctxt) | |||
| 429 | void | 432 | void |
| 430 | input_userauth_banner(int type, u_int32_t seq, void *ctxt) | 433 | input_userauth_banner(int type, u_int32_t seq, void *ctxt) |
| 431 | { | 434 | { |
| 432 | char *msg, *lang; | 435 | char *msg, *raw, *lang; |
| 436 | u_int len; | ||
| 433 | 437 | ||
| 434 | debug3("input_userauth_banner"); | 438 | debug3("input_userauth_banner"); |
| 435 | msg = packet_get_string(NULL); | 439 | raw = packet_get_string(&len); |
| 436 | lang = packet_get_string(NULL); | 440 | lang = packet_get_string(NULL); |
| 437 | if (options.log_level >= SYSLOG_LEVEL_INFO) | 441 | if (options.log_level >= SYSLOG_LEVEL_INFO) { |
| 442 | if (len > 65536) | ||
| 443 | len = 65536; | ||
| 444 | msg = xmalloc(len * 4); /* max expansion from strnvis() */ | ||
| 445 | strnvis(msg, raw, len * 4, VIS_SAFE|VIS_OCTAL); | ||
| 438 | fprintf(stderr, "%s", msg); | 446 | fprintf(stderr, "%s", msg); |
| 439 | xfree(msg); | 447 | xfree(msg); |
| 448 | } | ||
| 449 | xfree(raw); | ||
| 440 | xfree(lang); | 450 | xfree(lang); |
| 441 | } | 451 | } |
| 442 | 452 | ||
| @@ -4,8 +4,9 @@ NAME | |||
| 4 | sshd - OpenSSH SSH daemon | 4 | sshd - OpenSSH SSH daemon |
| 5 | 5 | ||
| 6 | SYNOPSIS | 6 | SYNOPSIS |
| 7 | sshd [-46Ddeiqt] [-b bits] [-f config_file] [-g login_grace_time] | 7 | sshd [-46DdeiqTt] [-b bits] [-C connection_spec] [-f config_file] |
| 8 | [-h host_key_file] [-k key_gen_time] [-o option] [-p port] [-u len] | 8 | [-g login_grace_time] [-h host_key_file] [-k key_gen_time] |
| 9 | [-o option] [-p port] [-u len] | ||
| 9 | 10 | ||
| 10 | DESCRIPTION | 11 | DESCRIPTION |
| 11 | sshd (OpenSSH Daemon) is the daemon program for ssh(1). Together these | 12 | sshd (OpenSSH Daemon) is the daemon program for ssh(1). Together these |
| @@ -31,7 +32,17 @@ DESCRIPTION | |||
| 31 | 32 | ||
| 32 | -b bits | 33 | -b bits |
| 33 | Specifies the number of bits in the ephemeral protocol version 1 | 34 | Specifies the number of bits in the ephemeral protocol version 1 |
| 34 | server key (default 768). | 35 | server key (default 1024). |
| 36 | |||
| 37 | -C connection_spec | ||
| 38 | Specify the connection parameters to use for the -T extended test | ||
| 39 | mode. If provided, any Match directives in the configuration | ||
| 40 | file that would apply to the specified user, host, and address | ||
| 41 | will be set before the configuration is written to standard out- | ||
| 42 | put. The connection parameters are supplied as keyword=value | ||
| 43 | pairs. The keywords are ``user'', ``host'', and ``addr''. All | ||
| 44 | are required and may be supplied in any order, either with multi- | ||
| 45 | ple -C options or as a comma-separated list. | ||
| 35 | 46 | ||
| 36 | -D When this option is specified, sshd will not detach and does not | 47 | -D When this option is specified, sshd will not detach and does not |
| 37 | become a daemon. This allows easy monitoring of sshd. | 48 | become a daemon. This allows easy monitoring of sshd. |
| @@ -98,6 +109,11 @@ DESCRIPTION | |||
| 98 | ginning, authentication, and termination of each connection is | 109 | ginning, authentication, and termination of each connection is |
| 99 | logged. | 110 | logged. |
| 100 | 111 | ||
| 112 | -T Extended test mode. Check the validity of the configuration | ||
| 113 | file, output the effective configuration to stdout and then exit. | ||
| 114 | Optionally, Match rules may be applied by specifying the connec- | ||
| 115 | tion parameters using one or more -C options. | ||
| 116 | |||
| 101 | -t Test mode. Only check the validity of the configuration file and | 117 | -t Test mode. Only check the validity of the configuration file and |
| 102 | sanity of the keys. This is useful for updating sshd reliably as | 118 | sanity of the keys. This is useful for updating sshd reliably as |
| 103 | configuration options may change. | 119 | configuration options may change. |
| @@ -289,18 +305,22 @@ AUTHORIZED_KEYS FILE FORMAT | |||
| 289 | This option is automatically disabled if UseLogin is enabled. | 305 | This option is automatically disabled if UseLogin is enabled. |
| 290 | 306 | ||
| 291 | from="pattern-list" | 307 | from="pattern-list" |
| 292 | Specifies that in addition to public key authentication, the | 308 | Specifies that in addition to public key authentication, either |
| 293 | canonical name of the remote host must be present in the comma- | 309 | the canonical name of the remote host or its IP address must be |
| 294 | separated list of patterns. The purpose of this option is to op- | 310 | present in the comma-separated list of patterns. See PATTERNS in |
| 295 | tionally increase security: public key authentication by itself | 311 | ssh_config(5) for more information on patterns. |
| 296 | does not trust the network or name servers or anything (but the | 312 | |
| 297 | key); however, if somebody somehow steals the key, the key per- | 313 | In addition to the wildcard matching that may be applied to host- |
| 298 | mits an intruder to log in from anywhere in the world. This ad- | 314 | names or addresses, a from stanza may match IP addressess using |
| 299 | ditional option makes using a stolen key more difficult (name | 315 | CIDR address/masklen notation. |
| 300 | servers and/or routers would have to be compromised in addition | 316 | |
| 301 | to just the key). | 317 | The purpose of this option is to optionally increase security: |
| 302 | 318 | public key authentication by itself does not trust the network or | |
| 303 | See PATTERNS in ssh_config(5) for more information on patterns. | 319 | name servers or anything (but the key); however, if somebody |
| 320 | somehow steals the key, the key permits an intruder to log in | ||
| 321 | from anywhere in the world. This additional option makes using a | ||
| 322 | stolen key more difficult (name servers and/or routers would have | ||
| 323 | to be compromised in addition to just the key). | ||
| 304 | 324 | ||
| 305 | no-agent-forwarding | 325 | no-agent-forwarding |
| 306 | Forbids authentication agent forwarding when this key is used for | 326 | Forbids authentication agent forwarding when this key is used for |
| @@ -313,6 +333,9 @@ AUTHORIZED_KEYS FILE FORMAT | |||
| 313 | 333 | ||
| 314 | no-pty Prevents tty allocation (a request to allocate a pty will fail). | 334 | no-pty Prevents tty allocation (a request to allocate a pty will fail). |
| 315 | 335 | ||
| 336 | no-user-rc | ||
| 337 | Disables execution of ~/.ssh/rc. | ||
| 338 | |||
| 316 | no-X11-forwarding | 339 | no-X11-forwarding |
| 317 | Forbids X11 forwarding when this key is used for authentication. | 340 | Forbids X11 forwarding when this key is used for authentication. |
| 318 | Any X11 forward requests by the client will return an error. | 341 | Any X11 forward requests by the client will return an error. |
| @@ -417,6 +440,13 @@ FILES | |||
| 417 | host-based authentication without permitting login with | 440 | host-based authentication without permitting login with |
| 418 | rlogin/rsh. | 441 | rlogin/rsh. |
| 419 | 442 | ||
| 443 | ~/.ssh/ | ||
| 444 | This directory is the default location for all user-specific con- | ||
| 445 | figuration and authentication information. There is no general | ||
| 446 | requirement to keep the entire contents of this directory secret, | ||
| 447 | but the recommended permissions are read/write/execute for the | ||
| 448 | user, and not accessible by others. | ||
| 449 | |||
| 420 | ~/.ssh/authorized_keys | 450 | ~/.ssh/authorized_keys |
| 421 | Lists the public keys (RSA/DSA) that can be used for logging in | 451 | Lists the public keys (RSA/DSA) that can be used for logging in |
| 422 | as this user. The format of this file is described above. The | 452 | as this user. The format of this file is described above. The |
| @@ -542,4 +572,4 @@ CAVEATS | |||
| 542 | System security is not improved unless rshd, rlogind, and rexecd are dis- | 572 | System security is not improved unless rshd, rlogind, and rexecd are dis- |
| 543 | abled (thus completely disabling rlogin and rsh into the machine). | 573 | abled (thus completely disabling rlogin and rsh into the machine). |
| 544 | 574 | ||
| 545 | OpenBSD 4.2 August 16, 2007 9 | 575 | OpenBSD 4.4 July 2, 2008 9 |
| @@ -34,8 +34,8 @@ | |||
| 34 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | 34 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
| 35 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | 35 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| 36 | .\" | 36 | .\" |
| 37 | .\" $OpenBSD: sshd.8,v 1.237 2007/06/07 19:37:34 pvalchev Exp $ | 37 | .\" $OpenBSD: sshd.8,v 1.246 2008/07/02 02:24:18 djm Exp $ |
| 38 | .Dd $Mdocdate: August 16 2007 $ | 38 | .Dd $Mdocdate: July 2 2008 $ |
| 39 | .Dt SSHD 8 | 39 | .Dt SSHD 8 |
| 40 | .Os | 40 | .Os |
| 41 | .Sh NAME | 41 | .Sh NAME |
| @@ -44,8 +44,9 @@ | |||
| 44 | .Sh SYNOPSIS | 44 | .Sh SYNOPSIS |
| 45 | .Nm sshd | 45 | .Nm sshd |
| 46 | .Bk -words | 46 | .Bk -words |
| 47 | .Op Fl 46Ddeiqt | 47 | .Op Fl 46DdeiqTt |
| 48 | .Op Fl b Ar bits | 48 | .Op Fl b Ar bits |
| 49 | .Op Fl C Ar connection_spec | ||
| 49 | .Op Fl f Ar config_file | 50 | .Op Fl f Ar config_file |
| 50 | .Op Fl g Ar login_grace_time | 51 | .Op Fl g Ar login_grace_time |
| 51 | .Op Fl h Ar host_key_file | 52 | .Op Fl h Ar host_key_file |
| @@ -99,7 +100,25 @@ Forces | |||
| 99 | to use IPv6 addresses only. | 100 | to use IPv6 addresses only. |
| 100 | .It Fl b Ar bits | 101 | .It Fl b Ar bits |
| 101 | Specifies the number of bits in the ephemeral protocol version 1 | 102 | Specifies the number of bits in the ephemeral protocol version 1 |
| 102 | server key (default 768). | 103 | server key (default 1024). |
| 104 | .It Fl C Ar connection_spec | ||
| 105 | Specify the connection parameters to use for the | ||
| 106 | .Fl T | ||
| 107 | extended test mode. | ||
| 108 | If provided, any | ||
| 109 | .Cm Match | ||
| 110 | directives in the configuration file | ||
| 111 | that would apply to the specified user, host, and address will be set before | ||
| 112 | the configuration is written to standard output. | ||
| 113 | The connection parameters are supplied as keyword=value pairs. | ||
| 114 | The keywords are | ||
| 115 | .Dq user , | ||
| 116 | .Dq host , | ||
| 117 | and | ||
| 118 | .Dq addr . | ||
| 119 | All are required and may be supplied in any order, either with multiple | ||
| 120 | .Fl C | ||
| 121 | options or as a comma-separated list. | ||
| 103 | .It Fl D | 122 | .It Fl D |
| 104 | When this option is specified, | 123 | When this option is specified, |
| 105 | .Nm | 124 | .Nm |
| @@ -194,6 +213,15 @@ authentication, and termination of each connection is logged. | |||
| 194 | If a second | 213 | If a second |
| 195 | .Fl q | 214 | .Fl q |
| 196 | is given then nothing is sent to the system log. | 215 | is given then nothing is sent to the system log. |
| 216 | .It Fl T | ||
| 217 | Extended test mode. | ||
| 218 | Check the validity of the configuration file, output the effective configuration | ||
| 219 | to stdout and then exit. | ||
| 220 | Optionally, | ||
| 221 | .Cm Match | ||
| 222 | rules may be applied by specifying the connection parameters using one or more | ||
| 223 | .Fl C | ||
| 224 | options. | ||
| 197 | .It Fl t | 225 | .It Fl t |
| 198 | Test mode. | 226 | Test mode. |
| 199 | Only check the validity of the configuration file and sanity of the keys. | 227 | Only check the validity of the configuration file and sanity of the keys. |
| @@ -506,23 +534,27 @@ This option is automatically disabled if | |||
| 506 | .Cm UseLogin | 534 | .Cm UseLogin |
| 507 | is enabled. | 535 | is enabled. |
| 508 | .It Cm from="pattern-list" | 536 | .It Cm from="pattern-list" |
| 509 | Specifies that in addition to public key authentication, the canonical name | 537 | Specifies that in addition to public key authentication, either the canonical |
| 510 | of the remote host must be present in the comma-separated list of | 538 | name of the remote host or its IP address must be present in the |
| 511 | patterns. | 539 | comma-separated list of patterns. |
| 512 | The purpose | ||
| 513 | of this option is to optionally increase security: public key authentication | ||
| 514 | by itself does not trust the network or name servers or anything (but | ||
| 515 | the key); however, if somebody somehow steals the key, the key | ||
| 516 | permits an intruder to log in from anywhere in the world. | ||
| 517 | This additional option makes using a stolen key more difficult (name | ||
| 518 | servers and/or routers would have to be compromised in addition to | ||
| 519 | just the key). | ||
| 520 | .Pp | ||
| 521 | See | 540 | See |
| 522 | .Sx PATTERNS | 541 | .Sx PATTERNS |
| 523 | in | 542 | in |
| 524 | .Xr ssh_config 5 | 543 | .Xr ssh_config 5 |
| 525 | for more information on patterns. | 544 | for more information on patterns. |
| 545 | .Pp | ||
| 546 | In addition to the wildcard matching that may be applied to hostnames or | ||
| 547 | addresses, a | ||
| 548 | .Cm from | ||
| 549 | stanza may match IP addressess using CIDR address/masklen notation. | ||
| 550 | .Pp | ||
| 551 | The purpose of this option is to optionally increase security: public key | ||
| 552 | authentication by itself does not trust the network or name servers or | ||
| 553 | anything (but the key); however, if somebody somehow steals the key, the key | ||
| 554 | permits an intruder to log in from anywhere in the world. | ||
| 555 | This additional option makes using a stolen key more difficult (name | ||
| 556 | servers and/or routers would have to be compromised in addition to | ||
| 557 | just the key). | ||
| 526 | .It Cm no-agent-forwarding | 558 | .It Cm no-agent-forwarding |
| 527 | Forbids authentication agent forwarding when this key is used for | 559 | Forbids authentication agent forwarding when this key is used for |
| 528 | authentication. | 560 | authentication. |
| @@ -535,7 +567,7 @@ option. | |||
| 535 | .It Cm no-pty | 567 | .It Cm no-pty |
| 536 | Prevents tty allocation (a request to allocate a pty will fail). | 568 | Prevents tty allocation (a request to allocate a pty will fail). |
| 537 | .It Cm no-user-rc | 569 | .It Cm no-user-rc |
| 538 | Disables execution of | 570 | Disables execution of |
| 539 | .Pa ~/.ssh/rc . | 571 | .Pa ~/.ssh/rc . |
| 540 | .It Cm no-X11-forwarding | 572 | .It Cm no-X11-forwarding |
| 541 | Forbids X11 forwarding when this key is used for authentication. | 573 | Forbids X11 forwarding when this key is used for authentication. |
| @@ -688,6 +720,13 @@ This file is used in exactly the same way as | |||
| 688 | but allows host-based authentication without permitting login with | 720 | but allows host-based authentication without permitting login with |
| 689 | rlogin/rsh. | 721 | rlogin/rsh. |
| 690 | .Pp | 722 | .Pp |
| 723 | .It ~/.ssh/ | ||
| 724 | This directory is the default location for all user-specific configuration | ||
| 725 | and authentication information. | ||
| 726 | There is no general requirement to keep the entire contents of this directory | ||
| 727 | secret, but the recommended permissions are read/write/execute for the user, | ||
| 728 | and not accessible by others. | ||
| 729 | .Pp | ||
| 691 | .It ~/.ssh/authorized_keys | 730 | .It ~/.ssh/authorized_keys |
| 692 | Lists the public keys (RSA/DSA) that can be used for logging in as this user. | 731 | Lists the public keys (RSA/DSA) that can be used for logging in as this user. |
| 693 | The format of this file is described above. | 732 | The format of this file is described above. |
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: sshd.c,v 1.351 2007/05/22 10:18:52 djm Exp $ */ | 1 | /* $OpenBSD: sshd.c,v 1.364 2008/07/10 18:08:11 markus Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
| @@ -54,6 +54,7 @@ | |||
| 54 | # include <sys/time.h> | 54 | # include <sys/time.h> |
| 55 | #endif | 55 | #endif |
| 56 | #include "openbsd-compat/sys-tree.h" | 56 | #include "openbsd-compat/sys-tree.h" |
| 57 | #include "openbsd-compat/sys-queue.h" | ||
| 57 | #include <sys/wait.h> | 58 | #include <sys/wait.h> |
| 58 | 59 | ||
| 59 | #include <errno.h> | 60 | #include <errno.h> |
| @@ -75,6 +76,8 @@ | |||
| 75 | #include <openssl/bn.h> | 76 | #include <openssl/bn.h> |
| 76 | #include <openssl/md5.h> | 77 | #include <openssl/md5.h> |
| 77 | #include <openssl/rand.h> | 78 | #include <openssl/rand.h> |
| 79 | #include "openbsd-compat/openssl-compat.h" | ||
| 80 | |||
| 78 | #ifdef HAVE_SECUREWARE | 81 | #ifdef HAVE_SECUREWARE |
| 79 | #include <sys/security.h> | 82 | #include <sys/security.h> |
| 80 | #include <prot.h> | 83 | #include <prot.h> |
| @@ -124,8 +127,8 @@ | |||
| 124 | #ifdef LIBWRAP | 127 | #ifdef LIBWRAP |
| 125 | #include <tcpd.h> | 128 | #include <tcpd.h> |
| 126 | #include <syslog.h> | 129 | #include <syslog.h> |
| 127 | int allow_severity = LOG_INFO; | 130 | int allow_severity; |
| 128 | int deny_severity = LOG_WARNING; | 131 | int deny_severity; |
| 129 | #endif /* LIBWRAP */ | 132 | #endif /* LIBWRAP */ |
| 130 | 133 | ||
| 131 | #ifndef O_NOCTTY | 134 | #ifndef O_NOCTTY |
| @@ -375,9 +378,6 @@ grace_alarm_handler(int sig) | |||
| 375 | static void | 378 | static void |
| 376 | generate_ephemeral_server_key(void) | 379 | generate_ephemeral_server_key(void) |
| 377 | { | 380 | { |
| 378 | u_int32_t rnd = 0; | ||
| 379 | int i; | ||
| 380 | |||
| 381 | verbose("Generating %s%d bit RSA key.", | 381 | verbose("Generating %s%d bit RSA key.", |
| 382 | sensitive_data.server_key ? "new " : "", options.server_key_bits); | 382 | sensitive_data.server_key ? "new " : "", options.server_key_bits); |
| 383 | if (sensitive_data.server_key != NULL) | 383 | if (sensitive_data.server_key != NULL) |
| @@ -386,12 +386,7 @@ generate_ephemeral_server_key(void) | |||
| 386 | options.server_key_bits); | 386 | options.server_key_bits); |
| 387 | verbose("RSA key generation complete."); | 387 | verbose("RSA key generation complete."); |
| 388 | 388 | ||
| 389 | for (i = 0; i < SSH_SESSION_KEY_LENGTH; i++) { | 389 | arc4random_buf(sensitive_data.ssh1_cookie, SSH_SESSION_KEY_LENGTH); |
| 390 | if (i % 4 == 0) | ||
| 391 | rnd = arc4random(); | ||
| 392 | sensitive_data.ssh1_cookie[i] = rnd & 0xff; | ||
| 393 | rnd >>= 8; | ||
| 394 | } | ||
| 395 | arc4random_stir(); | 390 | arc4random_stir(); |
| 396 | } | 391 | } |
| 397 | 392 | ||
| @@ -413,7 +408,7 @@ sshd_exchange_identification(int sock_in, int sock_out) | |||
| 413 | int mismatch; | 408 | int mismatch; |
| 414 | int remote_major, remote_minor; | 409 | int remote_major, remote_minor; |
| 415 | int major, minor; | 410 | int major, minor; |
| 416 | char *s; | 411 | char *s, *newline = "\n"; |
| 417 | char buf[256]; /* Must not be larger than remote_version. */ | 412 | char buf[256]; /* Must not be larger than remote_version. */ |
| 418 | char remote_version[256]; /* Must be at least as big as buf. */ | 413 | char remote_version[256]; /* Must be at least as big as buf. */ |
| 419 | 414 | ||
| @@ -424,11 +419,13 @@ sshd_exchange_identification(int sock_in, int sock_out) | |||
| 424 | } else if (options.protocol & SSH_PROTO_2) { | 419 | } else if (options.protocol & SSH_PROTO_2) { |
| 425 | major = PROTOCOL_MAJOR_2; | 420 | major = PROTOCOL_MAJOR_2; |
| 426 | minor = PROTOCOL_MINOR_2; | 421 | minor = PROTOCOL_MINOR_2; |
| 422 | newline = "\r\n"; | ||
| 427 | } else { | 423 | } else { |
| 428 | major = PROTOCOL_MAJOR_1; | 424 | major = PROTOCOL_MAJOR_1; |
| 429 | minor = PROTOCOL_MINOR_1; | 425 | minor = PROTOCOL_MINOR_1; |
| 430 | } | 426 | } |
| 431 | snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s\n", major, minor, SSH_RELEASE); | 427 | snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s%s", major, minor, |
| 428 | SSH_RELEASE, newline); | ||
| 432 | server_version_string = xstrdup(buf); | 429 | server_version_string = xstrdup(buf); |
| 433 | 430 | ||
| 434 | /* Send our protocol version identification. */ | 431 | /* Send our protocol version identification. */ |
| @@ -590,15 +587,14 @@ demote_sensitive_data(void) | |||
| 590 | static void | 587 | static void |
| 591 | privsep_preauth_child(void) | 588 | privsep_preauth_child(void) |
| 592 | { | 589 | { |
| 593 | u_int32_t rnd[256]; | 590 | u_int32_t rnd[256]; |
| 594 | gid_t gidset[1]; | 591 | gid_t gidset[1]; |
| 595 | int i; | ||
| 596 | 592 | ||
| 597 | /* Enable challenge-response authentication for privilege separation */ | 593 | /* Enable challenge-response authentication for privilege separation */ |
| 598 | privsep_challenge_enable(); | 594 | privsep_challenge_enable(); |
| 599 | 595 | ||
| 600 | for (i = 0; i < 256; i++) | 596 | arc4random_stir(); |
| 601 | rnd[i] = arc4random(); | 597 | arc4random_buf(rnd, sizeof(rnd)); |
| 602 | RAND_seed(rnd, sizeof(rnd)); | 598 | RAND_seed(rnd, sizeof(rnd)); |
| 603 | 599 | ||
| 604 | /* Demote the private keys to public keys. */ | 600 | /* Demote the private keys to public keys. */ |
| @@ -671,6 +667,8 @@ privsep_preauth(Authctxt *authctxt) | |||
| 671 | static void | 667 | static void |
| 672 | privsep_postauth(Authctxt *authctxt) | 668 | privsep_postauth(Authctxt *authctxt) |
| 673 | { | 669 | { |
| 670 | u_int32_t rnd[256]; | ||
| 671 | |||
| 674 | #ifdef DISABLE_FD_PASSING | 672 | #ifdef DISABLE_FD_PASSING |
| 675 | if (1) { | 673 | if (1) { |
| 676 | #else | 674 | #else |
| @@ -688,7 +686,7 @@ privsep_postauth(Authctxt *authctxt) | |||
| 688 | if (pmonitor->m_pid == -1) | 686 | if (pmonitor->m_pid == -1) |
| 689 | fatal("fork of unprivileged child failed"); | 687 | fatal("fork of unprivileged child failed"); |
| 690 | else if (pmonitor->m_pid != 0) { | 688 | else if (pmonitor->m_pid != 0) { |
| 691 | debug2("User child is on pid %ld", (long)pmonitor->m_pid); | 689 | verbose("User child is on pid %ld", (long)pmonitor->m_pid); |
| 692 | close(pmonitor->m_recvfd); | 690 | close(pmonitor->m_recvfd); |
| 693 | buffer_clear(&loginmsg); | 691 | buffer_clear(&loginmsg); |
| 694 | monitor_child_postauth(pmonitor); | 692 | monitor_child_postauth(pmonitor); |
| @@ -702,6 +700,10 @@ privsep_postauth(Authctxt *authctxt) | |||
| 702 | /* Demote the private keys to public keys. */ | 700 | /* Demote the private keys to public keys. */ |
| 703 | demote_sensitive_data(); | 701 | demote_sensitive_data(); |
| 704 | 702 | ||
| 703 | arc4random_stir(); | ||
| 704 | arc4random_buf(rnd, sizeof(rnd)); | ||
| 705 | RAND_seed(rnd, sizeof(rnd)); | ||
| 706 | |||
| 705 | /* Drop privileges */ | 707 | /* Drop privileges */ |
| 706 | do_setusercontext(authctxt->pw); | 708 | do_setusercontext(authctxt->pw); |
| 707 | 709 | ||
| @@ -801,7 +803,7 @@ drop_connection(int startups) | |||
| 801 | p *= startups - options.max_startups_begin; | 803 | p *= startups - options.max_startups_begin; |
| 802 | p /= options.max_startups - options.max_startups_begin; | 804 | p /= options.max_startups - options.max_startups_begin; |
| 803 | p += options.max_startups_rate; | 805 | p += options.max_startups_rate; |
| 804 | r = arc4random() % 100; | 806 | r = arc4random_uniform(100); |
| 805 | 807 | ||
| 806 | debug("drop_connection: p %d, r %d", p, r); | 808 | debug("drop_connection: p %d, r %d", p, r); |
| 807 | return (r < p) ? 1 : 0; | 809 | return (r < p) ? 1 : 0; |
| @@ -813,8 +815,9 @@ usage(void) | |||
| 813 | fprintf(stderr, "%s, %s\n", | 815 | fprintf(stderr, "%s, %s\n", |
| 814 | SSH_RELEASE, SSLeay_version(SSLEAY_VERSION)); | 816 | SSH_RELEASE, SSLeay_version(SSLEAY_VERSION)); |
| 815 | fprintf(stderr, | 817 | fprintf(stderr, |
| 816 | "usage: sshd [-46Ddeiqt] [-b bits] [-f config_file] [-g login_grace_time]\n" | 818 | "usage: sshd [-46DdeiqTt] [-b bits] [-C connection_spec] [-f config_file]\n" |
| 817 | " [-h host_key_file] [-k key_gen_time] [-o option] [-p port] [-u len]\n" | 819 | " [-g login_grace_time] [-h host_key_file] [-k key_gen_time]\n" |
| 820 | " [-o option] [-p port] [-u len]\n" | ||
| 818 | ); | 821 | ); |
| 819 | exit(1); | 822 | exit(1); |
| 820 | } | 823 | } |
| @@ -987,8 +990,7 @@ server_listen(void) | |||
| 987 | ntop, sizeof(ntop), strport, sizeof(strport), | 990 | ntop, sizeof(ntop), strport, sizeof(strport), |
| 988 | NI_NUMERICHOST|NI_NUMERICSERV)) != 0) { | 991 | NI_NUMERICHOST|NI_NUMERICSERV)) != 0) { |
| 989 | error("getnameinfo failed: %.100s", | 992 | error("getnameinfo failed: %.100s", |
| 990 | (ret != EAI_SYSTEM) ? gai_strerror(ret) : | 993 | ssh_gai_strerror(ret)); |
| 991 | strerror(errno)); | ||
| 992 | continue; | 994 | continue; |
| 993 | } | 995 | } |
| 994 | /* Create socket for listening. */ | 996 | /* Create socket for listening. */ |
| @@ -1011,6 +1013,16 @@ server_listen(void) | |||
| 1011 | &on, sizeof(on)) == -1) | 1013 | &on, sizeof(on)) == -1) |
| 1012 | error("setsockopt SO_REUSEADDR: %s", strerror(errno)); | 1014 | error("setsockopt SO_REUSEADDR: %s", strerror(errno)); |
| 1013 | 1015 | ||
| 1016 | #ifdef IPV6_V6ONLY | ||
| 1017 | /* Only communicate in IPv6 over AF_INET6 sockets. */ | ||
| 1018 | if (ai->ai_family == AF_INET6) { | ||
| 1019 | if (setsockopt(listen_sock, IPPROTO_IPV6, IPV6_V6ONLY, | ||
| 1020 | &on, sizeof(on)) == -1) | ||
| 1021 | error("setsockopt IPV6_V6ONLY: %s", | ||
| 1022 | strerror(errno)); | ||
| 1023 | } | ||
| 1024 | #endif | ||
| 1025 | |||
| 1014 | debug("Bind to port %s on %s.", strport, ntop); | 1026 | debug("Bind to port %s on %s.", strport, ntop); |
| 1015 | 1027 | ||
| 1016 | /* Bind the socket to the desired port. */ | 1028 | /* Bind the socket to the desired port. */ |
| @@ -1118,7 +1130,8 @@ server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s) | |||
| 1118 | *newsock = accept(listen_socks[i], | 1130 | *newsock = accept(listen_socks[i], |
| 1119 | (struct sockaddr *)&from, &fromlen); | 1131 | (struct sockaddr *)&from, &fromlen); |
| 1120 | if (*newsock < 0) { | 1132 | if (*newsock < 0) { |
| 1121 | if (errno != EINTR && errno != EWOULDBLOCK) | 1133 | if (errno != EINTR && errno != EAGAIN && |
| 1134 | errno != EWOULDBLOCK) | ||
| 1122 | error("accept: %.100s", strerror(errno)); | 1135 | error("accept: %.100s", strerror(errno)); |
| 1123 | continue; | 1136 | continue; |
| 1124 | } | 1137 | } |
| @@ -1265,9 +1278,12 @@ main(int ac, char **av) | |||
| 1265 | int opt, i, on = 1; | 1278 | int opt, i, on = 1; |
| 1266 | int sock_in = -1, sock_out = -1, newsock = -1; | 1279 | int sock_in = -1, sock_out = -1, newsock = -1; |
| 1267 | const char *remote_ip; | 1280 | const char *remote_ip; |
| 1281 | char *test_user = NULL, *test_host = NULL, *test_addr = NULL; | ||
| 1268 | int remote_port; | 1282 | int remote_port; |
| 1269 | char *line; | 1283 | char *line, *p, *cp; |
| 1270 | int config_s[2] = { -1 , -1 }; | 1284 | int config_s[2] = { -1 , -1 }; |
| 1285 | u_int64_t ibytes, obytes; | ||
| 1286 | mode_t new_umask; | ||
| 1271 | Key *key; | 1287 | Key *key; |
| 1272 | Authctxt *authctxt; | 1288 | Authctxt *authctxt; |
| 1273 | 1289 | ||
| @@ -1301,7 +1317,7 @@ main(int ac, char **av) | |||
| 1301 | initialize_server_options(&options); | 1317 | initialize_server_options(&options); |
| 1302 | 1318 | ||
| 1303 | /* Parse command-line arguments. */ | 1319 | /* Parse command-line arguments. */ |
| 1304 | while ((opt = getopt(ac, av, "f:p:b:k:h:g:u:o:dDeiqrtQR46")) != -1) { | 1320 | while ((opt = getopt(ac, av, "f:p:b:k:h:g:u:o:C:dDeiqrtQRT46")) != -1) { |
| 1305 | switch (opt) { | 1321 | switch (opt) { |
| 1306 | case '4': | 1322 | case '4': |
| 1307 | options.address_family = AF_INET; | 1323 | options.address_family = AF_INET; |
| @@ -1384,6 +1400,25 @@ main(int ac, char **av) | |||
| 1384 | case 't': | 1400 | case 't': |
| 1385 | test_flag = 1; | 1401 | test_flag = 1; |
| 1386 | break; | 1402 | break; |
| 1403 | case 'T': | ||
| 1404 | test_flag = 2; | ||
| 1405 | break; | ||
| 1406 | case 'C': | ||
| 1407 | cp = optarg; | ||
| 1408 | while ((p = strsep(&cp, ",")) && *p != '\0') { | ||
| 1409 | if (strncmp(p, "addr=", 5) == 0) | ||
| 1410 | test_addr = xstrdup(p + 5); | ||
| 1411 | else if (strncmp(p, "host=", 5) == 0) | ||
| 1412 | test_host = xstrdup(p + 5); | ||
| 1413 | else if (strncmp(p, "user=", 5) == 0) | ||
| 1414 | test_user = xstrdup(p + 5); | ||
| 1415 | else { | ||
| 1416 | fprintf(stderr, "Invalid test " | ||
| 1417 | "mode specification %s\n", p); | ||
| 1418 | exit(1); | ||
| 1419 | } | ||
| 1420 | } | ||
| 1421 | break; | ||
| 1387 | case 'u': | 1422 | case 'u': |
| 1388 | utmp_len = (u_int)strtonum(optarg, 0, MAXHOSTNAMELEN+1, NULL); | 1423 | utmp_len = (u_int)strtonum(optarg, 0, MAXHOSTNAMELEN+1, NULL); |
| 1389 | if (utmp_len > MAXHOSTNAMELEN) { | 1424 | if (utmp_len > MAXHOSTNAMELEN) { |
| @@ -1406,7 +1441,7 @@ main(int ac, char **av) | |||
| 1406 | } | 1441 | } |
| 1407 | if (rexeced_flag || inetd_flag) | 1442 | if (rexeced_flag || inetd_flag) |
| 1408 | rexec_flag = 0; | 1443 | rexec_flag = 0; |
| 1409 | if (rexec_flag && (av[0] == NULL || *av[0] != '/')) | 1444 | if (!test_flag && (rexec_flag && (av[0] == NULL || *av[0] != '/'))) |
| 1410 | fatal("sshd re-exec requires execution with an absolute path"); | 1445 | fatal("sshd re-exec requires execution with an absolute path"); |
| 1411 | if (rexeced_flag) | 1446 | if (rexeced_flag) |
| 1412 | closefrom(REEXEC_MIN_FREE_FD); | 1447 | closefrom(REEXEC_MIN_FREE_FD); |
| @@ -1445,6 +1480,21 @@ main(int ac, char **av) | |||
| 1445 | sensitive_data.have_ssh1_key = 0; | 1480 | sensitive_data.have_ssh1_key = 0; |
| 1446 | sensitive_data.have_ssh2_key = 0; | 1481 | sensitive_data.have_ssh2_key = 0; |
| 1447 | 1482 | ||
| 1483 | /* | ||
| 1484 | * If we're doing an extended config test, make sure we have all of | ||
| 1485 | * the parameters we need. If we're not doing an extended test, | ||
| 1486 | * do not silently ignore connection test params. | ||
| 1487 | */ | ||
| 1488 | if (test_flag >= 2 && | ||
| 1489 | (test_user != NULL || test_host != NULL || test_addr != NULL) | ||
| 1490 | && (test_user == NULL || test_host == NULL || test_addr == NULL)) | ||
| 1491 | fatal("user, host and addr are all required when testing " | ||
| 1492 | "Match configs"); | ||
| 1493 | if (test_flag < 2 && (test_user != NULL || test_host != NULL || | ||
| 1494 | test_addr != NULL)) | ||
| 1495 | fatal("Config test connection parameter (-C) provided without " | ||
| 1496 | "test mode (-T)"); | ||
| 1497 | |||
| 1448 | /* Fetch our configuration */ | 1498 | /* Fetch our configuration */ |
| 1449 | buffer_init(&cfg); | 1499 | buffer_init(&cfg); |
| 1450 | if (rexeced_flag) | 1500 | if (rexeced_flag) |
| @@ -1581,6 +1631,13 @@ main(int ac, char **av) | |||
| 1581 | "world-writable.", _PATH_PRIVSEP_CHROOT_DIR); | 1631 | "world-writable.", _PATH_PRIVSEP_CHROOT_DIR); |
| 1582 | } | 1632 | } |
| 1583 | 1633 | ||
| 1634 | if (test_flag > 1) { | ||
| 1635 | if (test_user != NULL && test_addr != NULL && test_host != NULL) | ||
| 1636 | parse_server_match_config(&options, test_user, | ||
| 1637 | test_host, test_addr); | ||
| 1638 | dump_config(&options); | ||
| 1639 | } | ||
| 1640 | |||
| 1584 | /* Configuration looks good, so exit if in test mode. */ | 1641 | /* Configuration looks good, so exit if in test mode. */ |
| 1585 | if (test_flag) | 1642 | if (test_flag) |
| 1586 | exit(0); | 1643 | exit(0); |
| @@ -1605,6 +1662,10 @@ main(int ac, char **av) | |||
| 1605 | rexec_argv[rexec_argc + 1] = NULL; | 1662 | rexec_argv[rexec_argc + 1] = NULL; |
| 1606 | } | 1663 | } |
| 1607 | 1664 | ||
| 1665 | /* Ensure that umask disallows at least group and world write */ | ||
| 1666 | new_umask = umask(0077) | 0022; | ||
| 1667 | (void) umask(new_umask); | ||
| 1668 | |||
| 1608 | /* Initialize the log (it is reinitialized below in case we forked). */ | 1669 | /* Initialize the log (it is reinitialized below in case we forked). */ |
| 1609 | if (debug_flag && (!inetd_flag || rexeced_flag)) | 1670 | if (debug_flag && (!inetd_flag || rexeced_flag)) |
| 1610 | log_stderr = 1; | 1671 | log_stderr = 1; |
| @@ -1652,10 +1713,6 @@ main(int ac, char **av) | |||
| 1652 | /* Get a connection, either from inetd or a listening TCP socket */ | 1713 | /* Get a connection, either from inetd or a listening TCP socket */ |
| 1653 | if (inetd_flag) { | 1714 | if (inetd_flag) { |
| 1654 | server_accept_inetd(&sock_in, &sock_out); | 1715 | server_accept_inetd(&sock_in, &sock_out); |
| 1655 | |||
| 1656 | if ((options.protocol & SSH_PROTO_1) && | ||
| 1657 | sensitive_data.server_key == NULL) | ||
| 1658 | generate_ephemeral_server_key(); | ||
| 1659 | } else { | 1716 | } else { |
| 1660 | server_listen(); | 1717 | server_listen(); |
| 1661 | 1718 | ||
| @@ -1767,7 +1824,7 @@ main(int ac, char **av) | |||
| 1767 | * Register our connection. This turns encryption off because we do | 1824 | * Register our connection. This turns encryption off because we do |
| 1768 | * not have a key. | 1825 | * not have a key. |
| 1769 | */ | 1826 | */ |
| 1770 | packet_set_connection(sock_in, sock_out, -1); | 1827 | packet_set_connection(sock_in, sock_out); |
| 1771 | packet_set_server(); | 1828 | packet_set_server(); |
| 1772 | 1829 | ||
| 1773 | /* Set SO_KEEPALIVE if requested. */ | 1830 | /* Set SO_KEEPALIVE if requested. */ |
| @@ -1796,6 +1853,8 @@ main(int ac, char **av) | |||
| 1796 | audit_connection_from(remote_ip, remote_port); | 1853 | audit_connection_from(remote_ip, remote_port); |
| 1797 | #endif | 1854 | #endif |
| 1798 | #ifdef LIBWRAP | 1855 | #ifdef LIBWRAP |
| 1856 | allow_severity = options.log_facility|LOG_INFO; | ||
| 1857 | deny_severity = options.log_facility|LOG_WARNING; | ||
| 1799 | /* Check whether logins are denied from this host. */ | 1858 | /* Check whether logins are denied from this host. */ |
| 1800 | if (packet_connection_is_on_socket()) { | 1859 | if (packet_connection_is_on_socket()) { |
| 1801 | struct request_info req; | 1860 | struct request_info req; |
| @@ -1883,6 +1942,10 @@ main(int ac, char **av) | |||
| 1883 | 1942 | ||
| 1884 | sshd_exchange_identification(sock_in, sock_out); | 1943 | sshd_exchange_identification(sock_in, sock_out); |
| 1885 | 1944 | ||
| 1945 | /* In inetd mode, generate ephemeral key only for proto 1 connections */ | ||
| 1946 | if (!compat20 && inetd_flag && sensitive_data.server_key == NULL) | ||
| 1947 | generate_ephemeral_server_key(); | ||
| 1948 | |||
| 1886 | packet_set_nonblocking(); | 1949 | packet_set_nonblocking(); |
| 1887 | 1950 | ||
| 1888 | /* allocate authentication context */ | 1951 | /* allocate authentication context */ |
| @@ -1935,6 +1998,20 @@ main(int ac, char **av) | |||
| 1935 | audit_event(SSH_AUTH_SUCCESS); | 1998 | audit_event(SSH_AUTH_SUCCESS); |
| 1936 | #endif | 1999 | #endif |
| 1937 | 2000 | ||
| 2001 | #ifdef GSSAPI | ||
| 2002 | if (options.gss_authentication) { | ||
| 2003 | temporarily_use_uid(authctxt->pw); | ||
| 2004 | ssh_gssapi_storecreds(); | ||
| 2005 | restore_uid(); | ||
| 2006 | } | ||
| 2007 | #endif | ||
| 2008 | #ifdef USE_PAM | ||
| 2009 | if (options.use_pam) { | ||
| 2010 | do_pam_setcred(1); | ||
| 2011 | do_pam_session(); | ||
| 2012 | } | ||
| 2013 | #endif | ||
| 2014 | |||
| 1938 | /* | 2015 | /* |
| 1939 | * In privilege separation, we fork another child and prepare | 2016 | * In privilege separation, we fork another child and prepare |
| 1940 | * file descriptor passing. | 2017 | * file descriptor passing. |
| @@ -1946,11 +2023,18 @@ main(int ac, char **av) | |||
| 1946 | destroy_sensitive_data(); | 2023 | destroy_sensitive_data(); |
| 1947 | } | 2024 | } |
| 1948 | 2025 | ||
| 2026 | packet_set_timeout(options.client_alive_interval, | ||
| 2027 | options.client_alive_count_max); | ||
| 2028 | |||
| 1949 | /* Start session. */ | 2029 | /* Start session. */ |
| 1950 | do_authenticated(authctxt); | 2030 | do_authenticated(authctxt); |
| 1951 | 2031 | ||
| 1952 | /* The connection has been terminated. */ | 2032 | /* The connection has been terminated. */ |
| 1953 | verbose("Closing connection to %.100s", remote_ip); | 2033 | packet_get_state(MODE_IN, NULL, NULL, NULL, &ibytes); |
| 2034 | packet_get_state(MODE_OUT, NULL, NULL, NULL, &obytes); | ||
| 2035 | verbose("Transferred: sent %llu, received %llu bytes", obytes, ibytes); | ||
| 2036 | |||
| 2037 | verbose("Closing connection to %.500s port %d", remote_ip, remote_port); | ||
| 1954 | 2038 | ||
| 1955 | #ifdef USE_PAM | 2039 | #ifdef USE_PAM |
| 1956 | if (options.use_pam) | 2040 | if (options.use_pam) |
| @@ -2030,7 +2114,6 @@ do_ssh1_kex(void) | |||
| 2030 | u_char session_key[SSH_SESSION_KEY_LENGTH]; | 2114 | u_char session_key[SSH_SESSION_KEY_LENGTH]; |
| 2031 | u_char cookie[8]; | 2115 | u_char cookie[8]; |
| 2032 | u_int cipher_type, auth_mask, protocol_flags; | 2116 | u_int cipher_type, auth_mask, protocol_flags; |
| 2033 | u_int32_t rnd = 0; | ||
| 2034 | 2117 | ||
| 2035 | /* | 2118 | /* |
| 2036 | * Generate check bytes that the client must send back in the user | 2119 | * Generate check bytes that the client must send back in the user |
| @@ -2041,12 +2124,7 @@ do_ssh1_kex(void) | |||
| 2041 | * cookie. This only affects rhosts authentication, and this is one | 2124 | * cookie. This only affects rhosts authentication, and this is one |
| 2042 | * of the reasons why it is inherently insecure. | 2125 | * of the reasons why it is inherently insecure. |
| 2043 | */ | 2126 | */ |
| 2044 | for (i = 0; i < 8; i++) { | 2127 | arc4random_buf(cookie, sizeof(cookie)); |
| 2045 | if (i % 4 == 0) | ||
| 2046 | rnd = arc4random(); | ||
| 2047 | cookie[i] = rnd & 0xff; | ||
| 2048 | rnd >>= 8; | ||
| 2049 | } | ||
| 2050 | 2128 | ||
| 2051 | /* | 2129 | /* |
| 2052 | * Send our public key. We include in the packet 64 bits of random | 2130 | * Send our public key. We include in the packet 64 bits of random |
diff --git a/sshd_config b/sshd_config index aa1e4abdf..e03b3b15f 100644 --- a/sshd_config +++ b/sshd_config | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | # $OpenBSD: sshd_config,v 1.75 2007/03/19 01:01:29 djm Exp $ | 1 | # $OpenBSD: sshd_config,v 1.80 2008/07/02 02:24:18 djm Exp $ |
| 2 | 2 | ||
| 3 | # This is the sshd server system-wide configuration file. See | 3 | # This is the sshd server system-wide configuration file. See |
| 4 | # sshd_config(5) for more information. | 4 | # sshd_config(5) for more information. |
| @@ -28,7 +28,7 @@ Protocol 2 | |||
| 28 | 28 | ||
| 29 | # Lifetime and size of ephemeral version 1 server key | 29 | # Lifetime and size of ephemeral version 1 server key |
| 30 | #KeyRegenerationInterval 1h | 30 | #KeyRegenerationInterval 1h |
| 31 | #ServerKeyBits 768 | 31 | #ServerKeyBits 1024 |
| 32 | 32 | ||
| 33 | # Logging | 33 | # Logging |
| 34 | # obsoletes QuietMode and FascistLogging | 34 | # obsoletes QuietMode and FascistLogging |
| @@ -41,6 +41,7 @@ Protocol 2 | |||
| 41 | #PermitRootLogin yes | 41 | #PermitRootLogin yes |
| 42 | #StrictModes yes | 42 | #StrictModes yes |
| 43 | #MaxAuthTries 6 | 43 | #MaxAuthTries 6 |
| 44 | #MaxSessions 10 | ||
| 44 | 45 | ||
| 45 | #RSAAuthentication yes | 46 | #RSAAuthentication yes |
| 46 | #PubkeyAuthentication yes | 47 | #PubkeyAuthentication yes |
| @@ -86,6 +87,7 @@ Protocol 2 | |||
| 86 | # and ChallengeResponseAuthentication to 'no'. | 87 | # and ChallengeResponseAuthentication to 'no'. |
| 87 | #UsePAM no | 88 | #UsePAM no |
| 88 | 89 | ||
| 90 | #AllowAgentForwarding yes | ||
| 89 | #AllowTcpForwarding yes | 91 | #AllowTcpForwarding yes |
| 90 | #GatewayPorts no | 92 | #GatewayPorts no |
| 91 | #X11Forwarding no | 93 | #X11Forwarding no |
| @@ -104,9 +106,10 @@ Protocol 2 | |||
| 104 | #PidFile /var/run/sshd.pid | 106 | #PidFile /var/run/sshd.pid |
| 105 | #MaxStartups 10 | 107 | #MaxStartups 10 |
| 106 | #PermitTunnel no | 108 | #PermitTunnel no |
| 109 | #ChrootDirectory none | ||
| 107 | 110 | ||
| 108 | # no default banner path | 111 | # no default banner path |
| 109 | #Banner /some/path | 112 | #Banner none |
| 110 | 113 | ||
| 111 | # override default of no subsystems | 114 | # override default of no subsystems |
| 112 | Subsystem sftp /usr/libexec/sftp-server | 115 | Subsystem sftp /usr/libexec/sftp-server |
diff --git a/sshd_config.0 b/sshd_config.0 index 0b340ad20..15a6c9004 100644 --- a/sshd_config.0 +++ b/sshd_config.0 | |||
| @@ -34,6 +34,12 @@ DESCRIPTION | |||
| 34 | arguments are ``any'', ``inet'' (use IPv4 only), or ``inet6'' | 34 | arguments are ``any'', ``inet'' (use IPv4 only), or ``inet6'' |
| 35 | (use IPv6 only). The default is ``any''. | 35 | (use IPv6 only). The default is ``any''. |
| 36 | 36 | ||
| 37 | AllowAgentForwarding | ||
| 38 | Specifies whether ssh-agent(1) forwarding is permitted. The de- | ||
| 39 | fault is ``yes''. Note that disabling agent forwarding does not | ||
| 40 | improve security unless users are also denied shell access, as | ||
| 41 | they can always install their own forwarders. | ||
| 42 | |||
| 37 | AllowGroups | 43 | AllowGroups |
| 38 | This keyword can be followed by a list of group name patterns, | 44 | This keyword can be followed by a list of group name patterns, |
| 39 | separated by spaces. If specified, login is allowed only for | 45 | separated by spaces. If specified, login is allowed only for |
| @@ -76,10 +82,9 @@ DESCRIPTION | |||
| 76 | path or one relative to the user's home directory. The default | 82 | path or one relative to the user's home directory. The default |
| 77 | is ``.ssh/authorized_keys''. | 83 | is ``.ssh/authorized_keys''. |
| 78 | 84 | ||
| 79 | Banner In some jurisdictions, sending a warning message before authenti- | 85 | Banner The contents of the specified file are sent to the remote user |
| 80 | cation may be relevant for getting legal protection. The con- | 86 | before authentication is allowed. If the argument is ``none'' |
| 81 | tents of the specified file are sent to the remote user before | 87 | then no banner is displayed. This option is only available for |
| 82 | authentication is allowed. This option is only available for | ||
| 83 | protocol version 2. By default, no banner is displayed. | 88 | protocol version 2. By default, no banner is displayed. |
| 84 | 89 | ||
| 85 | ChallengeResponseAuthentication | 90 | ChallengeResponseAuthentication |
| @@ -87,6 +92,28 @@ DESCRIPTION | |||
| 87 | All authentication styles from login.conf(5) are supported. The | 92 | All authentication styles from login.conf(5) are supported. The |
| 88 | default is ``yes''. | 93 | default is ``yes''. |
| 89 | 94 | ||
| 95 | ChrootDirectory | ||
| 96 | Specifies a path to chroot(2) to after authentication. This | ||
| 97 | path, and all its components, must be root-owned directories that | ||
| 98 | are not writable by any other user or group. | ||
| 99 | |||
| 100 | The path may contain the following tokens that are expanded at | ||
| 101 | runtime once the connecting user has been authenticated: %% is | ||
| 102 | replaced by a literal '%', %h is replaced by the home directory | ||
| 103 | of the user being authenticated, and %u is replaced by the user- | ||
| 104 | name of that user. | ||
| 105 | |||
| 106 | The ChrootDirectory must contain the necessary files and directo- | ||
| 107 | ries to support the users' session. For an interactive session | ||
| 108 | this requires at least a shell, typically sh(1), and basic /dev | ||
| 109 | nodes such as null(4), zero(4), stdin(4), stdout(4), stderr(4), | ||
| 110 | arandom(4) and tty(4) devices. For file transfer sessions using | ||
| 111 | ``sftp'', no additional configuration of the environment is nec- | ||
| 112 | essary if the in-process sftp server is used (see Subsystem for | ||
| 113 | details). | ||
| 114 | |||
| 115 | The default is not to chroot(2). | ||
| 116 | |||
| 90 | Ciphers | 117 | Ciphers |
| 91 | Specifies the ciphers allowed for protocol version 2. Multiple | 118 | Specifies the ciphers allowed for protocol version 2. Multiple |
| 92 | ciphers must be comma-separated. The supported ciphers are | 119 | ciphers must be comma-separated. The supported ciphers are |
| @@ -156,12 +183,15 @@ DESCRIPTION | |||
| 156 | 183 | ||
| 157 | ForceCommand | 184 | ForceCommand |
| 158 | Forces the execution of the command specified by ForceCommand, | 185 | Forces the execution of the command specified by ForceCommand, |
| 159 | ignoring any command supplied by the client. The command is in- | 186 | ignoring any command supplied by the client and ~/.ssh/rc if pre- |
| 160 | voked by using the user's login shell with the -c option. This | 187 | sent. The command is invoked by using the user's login shell |
| 161 | applies to shell, command, or subsystem execution. It is most | 188 | with the -c option. This applies to shell, command, or subsystem |
| 162 | useful inside a Match block. The command originally supplied by | 189 | execution. It is most useful inside a Match block. The command |
| 163 | the client is available in the SSH_ORIGINAL_COMMAND environment | 190 | originally supplied by the client is available in the |
| 164 | variable. | 191 | SSH_ORIGINAL_COMMAND environment variable. Specifying a command |
| 192 | of ``internal-sftp'' will force the use of an in-process sftp | ||
| 193 | server that requires no support files when used with | ||
| 194 | ChrootDirectory. | ||
| 165 | 195 | ||
| 166 | GatewayPorts | 196 | GatewayPorts |
| 167 | Specifies whether remote hosts are allowed to connect to ports | 197 | Specifies whether remote hosts are allowed to connect to ports |
| @@ -290,22 +320,40 @@ DESCRIPTION | |||
| 290 | Match Introduces a conditional block. If all of the criteria on the | 320 | Match Introduces a conditional block. If all of the criteria on the |
| 291 | Match line are satisfied, the keywords on the following lines | 321 | Match line are satisfied, the keywords on the following lines |
| 292 | override those set in the global section of the config file, un- | 322 | override those set in the global section of the config file, un- |
| 293 | til either another Match line or the end of the file. The argu- | 323 | til either another Match line or the end of the file. |
| 294 | ments to Match are one or more criteria-pattern pairs. The | 324 | |
| 295 | available criteria are User, Group, Host, and Address. Only a | 325 | The arguments to Match are one or more criteria-pattern pairs. |
| 296 | subset of keywords may be used on the lines following a Match | 326 | The available criteria are User, Group, Host, and Address. The |
| 297 | keyword. Available keywords are AllowTcpForwarding, Banner, | 327 | match patterns may consist of single entries or comma-separated |
| 298 | ForceCommand, GatewayPorts, GSSApiAuthentication, | 328 | lists and may use the wildcard and negation operators described |
| 329 | in the PATTERNS section of ssh_config(5). | ||
| 330 | |||
| 331 | The patterns in an Address criteria may additionally contain ad- | ||
| 332 | dresses to match in CIDR address/masklen format, e.g. | ||
| 333 | ``192.0.2.0/24'' or ``3ffe:ffff::/32''. Note that the mask | ||
| 334 | length provided must be consistent with the address - it is an | ||
| 335 | error to specify a mask length that is too long for the address | ||
| 336 | or one with bits set in this host portion of the address. For | ||
| 337 | example, ``192.0.2.0/33'' and ``192.0.2.0/8'' respectively. | ||
| 338 | |||
| 339 | Only a subset of keywords may be used on the lines following a | ||
| 340 | Match keyword. Available keywords are AllowTcpForwarding, | ||
| 341 | Banner, ChrootDirectory, ForceCommand, GatewayPorts, | ||
| 342 | GSSAPIAuthentication, HostbasedAuthentication, | ||
| 299 | KbdInteractiveAuthentication, KerberosAuthentication, | 343 | KbdInteractiveAuthentication, KerberosAuthentication, |
| 300 | PasswordAuthentication, PermitOpen, RhostsRSAAuthentication, | 344 | MaxAuthTries, MaxSessions, PasswordAuthentication, PermitOpen, |
| 301 | RSAAuthentication, X11DisplayOffset, X11Forwarding, and | 345 | PermitRootLogin, RhostsRSAAuthentication, RSAAuthentication, |
| 302 | X11UseLocalHost. | 346 | X11DisplayOffset, X11Forwarding, and X11UseLocalHost. |
| 303 | 347 | ||
| 304 | MaxAuthTries | 348 | MaxAuthTries |
| 305 | Specifies the maximum number of authentication attempts permitted | 349 | Specifies the maximum number of authentication attempts permitted |
| 306 | per connection. Once the number of failures reaches half this | 350 | per connection. Once the number of failures reaches half this |
| 307 | value, additional failures are logged. The default is 6. | 351 | value, additional failures are logged. The default is 6. |
| 308 | 352 | ||
| 353 | MaxSessions | ||
| 354 | Specifies the maximum number of open sessions permitted per net- | ||
| 355 | work connection. The default is 10. | ||
| 356 | |||
| 309 | MaxStartups | 357 | MaxStartups |
| 310 | Specifies the maximum number of concurrent unauthenticated con- | 358 | Specifies the maximum number of concurrent unauthenticated con- |
| 311 | nections to the SSH daemon. Additional connections will be | 359 | nections to the SSH daemon. Additional connections will be |
| @@ -416,7 +464,7 @@ DESCRIPTION | |||
| 416 | 464 | ||
| 417 | ServerKeyBits | 465 | ServerKeyBits |
| 418 | Defines the number of bits in the ephemeral protocol version 1 | 466 | Defines the number of bits in the ephemeral protocol version 1 |
| 419 | server key. The minimum value is 512, and the default is 768. | 467 | server key. The minimum value is 512, and the default is 1024. |
| 420 | 468 | ||
| 421 | StrictModes | 469 | StrictModes |
| 422 | Specifies whether sshd(8) should check file modes and ownership | 470 | Specifies whether sshd(8) should check file modes and ownership |
| @@ -428,8 +476,15 @@ DESCRIPTION | |||
| 428 | Subsystem | 476 | Subsystem |
| 429 | Configures an external subsystem (e.g. file transfer daemon). | 477 | Configures an external subsystem (e.g. file transfer daemon). |
| 430 | Arguments should be a subsystem name and a command (with optional | 478 | Arguments should be a subsystem name and a command (with optional |
| 431 | arguments) to execute upon subsystem request. The command | 479 | arguments) to execute upon subsystem request. |
| 432 | sftp-server(8) implements the ``sftp'' file transfer subsystem. | 480 | |
| 481 | The command sftp-server(8) implements the ``sftp'' file transfer | ||
| 482 | subsystem. | ||
| 483 | |||
| 484 | Alternately the name ``internal-sftp'' implements an in-process | ||
| 485 | ``sftp'' server. This may simplify configurations using | ||
| 486 | ChrootDirectory to force a different filesystem root on clients. | ||
| 487 | |||
| 433 | By default no subsystems are defined. Note that this option ap- | 488 | By default no subsystems are defined. Note that this option ap- |
| 434 | plies to protocol version 2 only. | 489 | plies to protocol version 2 only. |
| 435 | 490 | ||
| @@ -572,4 +627,4 @@ AUTHORS | |||
| 572 | versions 1.5 and 2.0. Niels Provos and Markus Friedl contributed support | 627 | versions 1.5 and 2.0. Niels Provos and Markus Friedl contributed support |
| 573 | for privilege separation. | 628 | for privilege separation. |
| 574 | 629 | ||
| 575 | OpenBSD 4.2 June 11, 2007 9 | 630 | OpenBSD 4.4 July 2, 2008 10 |
diff --git a/sshd_config.5 b/sshd_config.5 index dab26e079..d5f19ea3d 100644 --- a/sshd_config.5 +++ b/sshd_config.5 | |||
| @@ -34,8 +34,8 @@ | |||
| 34 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF | 34 | .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF |
| 35 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. | 35 | .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| 36 | .\" | 36 | .\" |
| 37 | .\" $OpenBSD: sshd_config.5,v 1.77 2007/06/08 07:48:09 jmc Exp $ | 37 | .\" $OpenBSD: sshd_config.5,v 1.96 2008/07/02 02:24:18 djm Exp $ |
| 38 | .Dd $Mdocdate: June 11 2007 $ | 38 | .Dd $Mdocdate: July 2 2008 $ |
| 39 | .Dt SSHD_CONFIG 5 | 39 | .Dt SSHD_CONFIG 5 |
| 40 | .Os | 40 | .Os |
| 41 | .Sh NAME | 41 | .Sh NAME |
| @@ -122,6 +122,15 @@ Valid arguments are | |||
| 122 | (use IPv6 only). | 122 | (use IPv6 only). |
| 123 | The default is | 123 | The default is |
| 124 | .Dq any . | 124 | .Dq any . |
| 125 | .It Cm AllowAgentForwarding | ||
| 126 | Specifies whether | ||
| 127 | .Xr ssh-agent 1 | ||
| 128 | forwarding is permitted. | ||
| 129 | The default is | ||
| 130 | .Dq yes . | ||
| 131 | Note that disabling agent forwarding does not improve security | ||
| 132 | unless users are also denied shell access, as they can always install | ||
| 133 | their own forwarders. | ||
| 125 | .It Cm AllowGroups | 134 | .It Cm AllowGroups |
| 126 | This keyword can be followed by a list of group name patterns, separated | 135 | This keyword can be followed by a list of group name patterns, separated |
| 127 | by spaces. | 136 | by spaces. |
| @@ -186,10 +195,11 @@ directory. | |||
| 186 | The default is | 195 | The default is |
| 187 | .Dq .ssh/authorized_keys . | 196 | .Dq .ssh/authorized_keys . |
| 188 | .It Cm Banner | 197 | .It Cm Banner |
| 189 | In some jurisdictions, sending a warning message before authentication | ||
| 190 | may be relevant for getting legal protection. | ||
| 191 | The contents of the specified file are sent to the remote user before | 198 | The contents of the specified file are sent to the remote user before |
| 192 | authentication is allowed. | 199 | authentication is allowed. |
| 200 | If the argument is | ||
| 201 | .Dq none | ||
| 202 | then no banner is displayed. | ||
| 193 | This option is only available for protocol version 2. | 203 | This option is only available for protocol version 2. |
| 194 | By default, no banner is displayed. | 204 | By default, no banner is displayed. |
| 195 | .It Cm ChallengeResponseAuthentication | 205 | .It Cm ChallengeResponseAuthentication |
| @@ -199,6 +209,45 @@ All authentication styles from | |||
| 199 | are supported. | 209 | are supported. |
| 200 | The default is | 210 | The default is |
| 201 | .Dq yes . | 211 | .Dq yes . |
| 212 | .It Cm ChrootDirectory | ||
| 213 | Specifies a path to | ||
| 214 | .Xr chroot 2 | ||
| 215 | to after authentication. | ||
| 216 | This path, and all its components, must be root-owned directories that are | ||
| 217 | not writable by any other user or group. | ||
| 218 | .Pp | ||
| 219 | The path may contain the following tokens that are expanded at runtime once | ||
| 220 | the connecting user has been authenticated: %% is replaced by a literal '%', | ||
| 221 | %h is replaced by the home directory of the user being authenticated, and | ||
| 222 | %u is replaced by the username of that user. | ||
| 223 | .Pp | ||
| 224 | The | ||
| 225 | .Cm ChrootDirectory | ||
| 226 | must contain the necessary files and directories to support the | ||
| 227 | users' session. | ||
| 228 | For an interactive session this requires at least a shell, typically | ||
| 229 | .Xr sh 1 , | ||
| 230 | and basic | ||
| 231 | .Pa /dev | ||
| 232 | nodes such as | ||
| 233 | .Xr null 4 , | ||
| 234 | .Xr zero 4 , | ||
| 235 | .Xr stdin 4 , | ||
| 236 | .Xr stdout 4 , | ||
| 237 | .Xr stderr 4 , | ||
| 238 | .Xr arandom 4 | ||
| 239 | and | ||
| 240 | .Xr tty 4 | ||
| 241 | devices. | ||
| 242 | For file transfer sessions using | ||
| 243 | .Dq sftp , | ||
| 244 | no additional configuration of the environment is necessary if the | ||
| 245 | in-process sftp server is used (see | ||
| 246 | .Cm Subsystem | ||
| 247 | for details). | ||
| 248 | .Pp | ||
| 249 | The default is not to | ||
| 250 | .Xr chroot 2 . | ||
| 202 | .It Cm Ciphers | 251 | .It Cm Ciphers |
| 203 | Specifies the ciphers allowed for protocol version 2. | 252 | Specifies the ciphers allowed for protocol version 2. |
| 204 | Multiple ciphers must be comma-separated. | 253 | Multiple ciphers must be comma-separated. |
| @@ -322,6 +371,11 @@ block. | |||
| 322 | The command originally supplied by the client is available in the | 371 | The command originally supplied by the client is available in the |
| 323 | .Ev SSH_ORIGINAL_COMMAND | 372 | .Ev SSH_ORIGINAL_COMMAND |
| 324 | environment variable. | 373 | environment variable. |
| 374 | Specifying a command of | ||
| 375 | .Dq internal-sftp | ||
| 376 | will force the use of an in-process sftp server that requires no support | ||
| 377 | files when used with | ||
| 378 | .Cm ChrootDirectory . | ||
| 325 | .It Cm GatewayPorts | 379 | .It Cm GatewayPorts |
| 326 | Specifies whether remote hosts are allowed to connect to ports | 380 | Specifies whether remote hosts are allowed to connect to ports |
| 327 | forwarded for the client. | 381 | forwarded for the client. |
| @@ -553,6 +607,7 @@ line are satisfied, the keywords on the following lines override those | |||
| 553 | set in the global section of the config file, until either another | 607 | set in the global section of the config file, until either another |
| 554 | .Cm Match | 608 | .Cm Match |
| 555 | line or the end of the file. | 609 | line or the end of the file. |
| 610 | .Pp | ||
| 556 | The arguments to | 611 | The arguments to |
| 557 | .Cm Match | 612 | .Cm Match |
| 558 | are one or more criteria-pattern pairs. | 613 | are one or more criteria-pattern pairs. |
| @@ -562,19 +617,46 @@ The available criteria are | |||
| 562 | .Cm Host , | 617 | .Cm Host , |
| 563 | and | 618 | and |
| 564 | .Cm Address . | 619 | .Cm Address . |
| 620 | The match patterns may consist of single entries or comma-separated | ||
| 621 | lists and may use the wildcard and negation operators described in the | ||
| 622 | .Sx PATTERNS | ||
| 623 | section of | ||
| 624 | .Xr ssh_config 5 . | ||
| 625 | .Pp | ||
| 626 | The patterns in an | ||
| 627 | .Cm Address | ||
| 628 | criteria may additionally contain addresses to match in CIDR | ||
| 629 | address/masklen format, e.g.\& | ||
| 630 | .Dq 192.0.2.0/24 | ||
| 631 | or | ||
| 632 | .Dq 3ffe:ffff::/32 . | ||
| 633 | Note that the mask length provided must be consistent with the address - | ||
| 634 | it is an error to specify a mask length that is too long for the address | ||
| 635 | or one with bits set in this host portion of the address. | ||
| 636 | For example, | ||
| 637 | .Dq 192.0.2.0/33 | ||
| 638 | and | ||
| 639 | .Dq 192.0.2.0/8 | ||
| 640 | respectively. | ||
| 641 | .Pp | ||
| 565 | Only a subset of keywords may be used on the lines following a | 642 | Only a subset of keywords may be used on the lines following a |
| 566 | .Cm Match | 643 | .Cm Match |
| 567 | keyword. | 644 | keyword. |
| 568 | Available keywords are | 645 | Available keywords are |
| 569 | .Cm AllowTcpForwarding , | 646 | .Cm AllowTcpForwarding , |
| 570 | .Cm Banner , | 647 | .Cm Banner , |
| 648 | .Cm ChrootDirectory , | ||
| 571 | .Cm ForceCommand , | 649 | .Cm ForceCommand , |
| 572 | .Cm GatewayPorts , | 650 | .Cm GatewayPorts , |
| 573 | .Cm GSSApiAuthentication , | 651 | .Cm GSSAPIAuthentication , |
| 652 | .Cm HostbasedAuthentication , | ||
| 574 | .Cm KbdInteractiveAuthentication , | 653 | .Cm KbdInteractiveAuthentication , |
| 575 | .Cm KerberosAuthentication , | 654 | .Cm KerberosAuthentication , |
| 655 | .Cm MaxAuthTries , | ||
| 656 | .Cm MaxSessions , | ||
| 576 | .Cm PasswordAuthentication , | 657 | .Cm PasswordAuthentication , |
| 577 | .Cm PermitOpen , | 658 | .Cm PermitOpen , |
| 659 | .Cm PermitRootLogin , | ||
| 578 | .Cm RhostsRSAAuthentication , | 660 | .Cm RhostsRSAAuthentication , |
| 579 | .Cm RSAAuthentication , | 661 | .Cm RSAAuthentication , |
| 580 | .Cm X11DisplayOffset , | 662 | .Cm X11DisplayOffset , |
| @@ -587,6 +669,9 @@ connection. | |||
| 587 | Once the number of failures reaches half this value, | 669 | Once the number of failures reaches half this value, |
| 588 | additional failures are logged. | 670 | additional failures are logged. |
| 589 | The default is 6. | 671 | The default is 6. |
| 672 | .It Cm MaxSessions | ||
| 673 | Specifies the maximum number of open sessions permitted per network connection. | ||
| 674 | The default is 10. | ||
| 590 | .It Cm MaxStartups | 675 | .It Cm MaxStartups |
| 591 | Specifies the maximum number of concurrent unauthenticated connections to the | 676 | Specifies the maximum number of concurrent unauthenticated connections to the |
| 592 | SSH daemon. | 677 | SSH daemon. |
| @@ -790,7 +875,7 @@ The default is | |||
| 790 | This option applies to protocol version 1 only. | 875 | This option applies to protocol version 1 only. |
| 791 | .It Cm ServerKeyBits | 876 | .It Cm ServerKeyBits |
| 792 | Defines the number of bits in the ephemeral protocol version 1 server key. | 877 | Defines the number of bits in the ephemeral protocol version 1 server key. |
| 793 | The minimum value is 512, and the default is 768. | 878 | The minimum value is 512, and the default is 1024. |
| 794 | .It Cm StrictModes | 879 | .It Cm StrictModes |
| 795 | Specifies whether | 880 | Specifies whether |
| 796 | .Xr sshd 8 | 881 | .Xr sshd 8 |
| @@ -804,11 +889,22 @@ The default is | |||
| 804 | Configures an external subsystem (e.g. file transfer daemon). | 889 | Configures an external subsystem (e.g. file transfer daemon). |
| 805 | Arguments should be a subsystem name and a command (with optional arguments) | 890 | Arguments should be a subsystem name and a command (with optional arguments) |
| 806 | to execute upon subsystem request. | 891 | to execute upon subsystem request. |
| 892 | .Pp | ||
| 807 | The command | 893 | The command |
| 808 | .Xr sftp-server 8 | 894 | .Xr sftp-server 8 |
| 809 | implements the | 895 | implements the |
| 810 | .Dq sftp | 896 | .Dq sftp |
| 811 | file transfer subsystem. | 897 | file transfer subsystem. |
| 898 | .Pp | ||
| 899 | Alternately the name | ||
| 900 | .Dq internal-sftp | ||
| 901 | implements an in-process | ||
| 902 | .Dq sftp | ||
| 903 | server. | ||
| 904 | This may simplify configurations using | ||
| 905 | .Cm ChrootDirectory | ||
| 906 | to force a different filesystem root on clients. | ||
| 907 | .Pp | ||
| 812 | By default no subsystems are defined. | 908 | By default no subsystems are defined. |
| 813 | Note that this option applies to protocol version 2 only. | 909 | Note that this option applies to protocol version 2 only. |
| 814 | .It Cm SyslogFacility | 910 | .It Cm SyslogFacility |
diff --git a/sshlogin.c b/sshlogin.c index 0059ff8d0..cc35d6024 100644 --- a/sshlogin.c +++ b/sshlogin.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: sshlogin.c,v 1.25 2006/08/03 03:34:42 deraadt Exp $ */ | 1 | /* $OpenBSD: sshlogin.c,v 1.26 2007/09/11 15:47:17 gilles Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
| @@ -98,8 +98,7 @@ store_lastlog_message(const char *user, uid_t uid) | |||
| 98 | 98 | ||
| 99 | if (last_login_time != 0) { | 99 | if (last_login_time != 0) { |
| 100 | time_string = ctime(&last_login_time); | 100 | time_string = ctime(&last_login_time); |
| 101 | if (strchr(time_string, '\n')) | 101 | time_string[strcspn(time_string, "\n")] = '\0'; |
| 102 | *strchr(time_string, '\n') = '\0'; | ||
| 103 | if (strcmp(hostname, "") == 0) | 102 | if (strcmp(hostname, "") == 0) |
| 104 | snprintf(buf, sizeof(buf), "Last login: %s\r\n", | 103 | snprintf(buf, sizeof(buf), "Last login: %s\r\n", |
| 105 | time_string); | 104 | time_string); |
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: sshpty.c,v 1.26 2006/08/03 03:34:42 deraadt Exp $ */ | 1 | /* $OpenBSD: sshpty.c,v 1.28 2007/09/11 23:49:09 stevesk Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: sshpty.h,v 1.10 2006/08/03 03:34:42 deraadt Exp $ */ | 1 | /* $OpenBSD: sshpty.h,v 1.11 2008/05/19 15:45:07 djm Exp $ */ |
| 2 | 2 | ||
| 3 | /* | 3 | /* |
| 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| @@ -16,7 +16,7 @@ | |||
| 16 | 16 | ||
| 17 | #include <termios.h> | 17 | #include <termios.h> |
| 18 | 18 | ||
| 19 | struct termios get_saved_tio(void); | 19 | struct termios *get_saved_tio(void); |
| 20 | void leave_raw_mode(void); | 20 | void leave_raw_mode(void); |
| 21 | void enter_raw_mode(void); | 21 | void enter_raw_mode(void); |
| 22 | 22 | ||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: sshtty.c,v 1.12 2006/08/03 03:34:42 deraadt Exp $ */ | 1 | /* $OpenBSD: sshtty.c,v 1.13 2008/05/19 15:45:07 djm Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
| @@ -47,10 +47,10 @@ | |||
| 47 | static struct termios _saved_tio; | 47 | static struct termios _saved_tio; |
| 48 | static int _in_raw_mode = 0; | 48 | static int _in_raw_mode = 0; |
| 49 | 49 | ||
| 50 | struct termios | 50 | struct termios * |
| 51 | get_saved_tio(void) | 51 | get_saved_tio(void) |
| 52 | { | 52 | { |
| 53 | return _saved_tio; | 53 | return _in_raw_mode ? &_saved_tio : NULL; |
| 54 | } | 54 | } |
| 55 | 55 | ||
| 56 | void | 56 | void |
diff --git a/ttymodes.c b/ttymodes.c index d8e2c553a..e116b1999 100644 --- a/ttymodes.c +++ b/ttymodes.c | |||
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: ttymodes.c,v 1.26 2006/08/03 03:34:42 deraadt Exp $ */ | 1 | /* $OpenBSD: ttymodes.c,v 1.28 2008/07/07 00:31:41 stevesk Exp $ */ |
| 2 | /* | 2 | /* |
| 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
| 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
| @@ -298,6 +298,10 @@ tty_make_modes(int fd, struct termios *tiop) | |||
| 298 | } | 298 | } |
| 299 | 299 | ||
| 300 | if (tiop == NULL) { | 300 | if (tiop == NULL) { |
| 301 | if (fd == -1) { | ||
| 302 | debug("tty_make_modes: no fd or tio"); | ||
| 303 | goto end; | ||
| 304 | } | ||
| 301 | if (tcgetattr(fd, &tio) == -1) { | 305 | if (tcgetattr(fd, &tio) == -1) { |
| 302 | logit("tcgetattr: %.100s", strerror(errno)); | 306 | logit("tcgetattr: %.100s", strerror(errno)); |
| 303 | goto end; | 307 | goto end; |
| @@ -317,12 +321,10 @@ tty_make_modes(int fd, struct termios *tiop) | |||
| 317 | 321 | ||
| 318 | /* Store values of mode flags. */ | 322 | /* Store values of mode flags. */ |
| 319 | #define TTYCHAR(NAME, OP) \ | 323 | #define TTYCHAR(NAME, OP) \ |
| 320 | debug3("tty_make_modes: %d %d", OP, tio.c_cc[NAME]); \ | ||
| 321 | buffer_put_char(&buf, OP); \ | 324 | buffer_put_char(&buf, OP); \ |
| 322 | put_arg(&buf, special_char_encode(tio.c_cc[NAME])); | 325 | put_arg(&buf, special_char_encode(tio.c_cc[NAME])); |
| 323 | 326 | ||
| 324 | #define TTYMODE(NAME, FIELD, OP) \ | 327 | #define TTYMODE(NAME, FIELD, OP) \ |
| 325 | debug3("tty_make_modes: %d %d", OP, ((tio.FIELD & NAME) != 0)); \ | ||
| 326 | buffer_put_char(&buf, OP); \ | 328 | buffer_put_char(&buf, OP); \ |
| 327 | put_arg(&buf, ((tio.FIELD & NAME) != 0)); | 329 | put_arg(&buf, ((tio.FIELD & NAME) != 0)); |
| 328 | 330 | ||
| @@ -353,7 +355,7 @@ tty_parse_modes(int fd, int *n_bytes_ptr) | |||
| 353 | int n_bytes = 0; | 355 | int n_bytes = 0; |
| 354 | int failure = 0; | 356 | int failure = 0; |
| 355 | u_int (*get_arg)(void); | 357 | u_int (*get_arg)(void); |
| 356 | int arg, arg_size; | 358 | int arg_size; |
| 357 | 359 | ||
| 358 | if (compat20) { | 360 | if (compat20) { |
| 359 | *n_bytes_ptr = packet_get_int(); | 361 | *n_bytes_ptr = packet_get_int(); |
| @@ -410,16 +412,14 @@ tty_parse_modes(int fd, int *n_bytes_ptr) | |||
| 410 | case OP: \ | 412 | case OP: \ |
| 411 | n_bytes += arg_size; \ | 413 | n_bytes += arg_size; \ |
| 412 | tio.c_cc[NAME] = special_char_decode(get_arg()); \ | 414 | tio.c_cc[NAME] = special_char_decode(get_arg()); \ |
| 413 | debug3("tty_parse_modes: %d %d", OP, tio.c_cc[NAME]); \ | ||
| 414 | break; | 415 | break; |
| 415 | #define TTYMODE(NAME, FIELD, OP) \ | 416 | #define TTYMODE(NAME, FIELD, OP) \ |
| 416 | case OP: \ | 417 | case OP: \ |
| 417 | n_bytes += arg_size; \ | 418 | n_bytes += arg_size; \ |
| 418 | if ((arg = get_arg())) \ | 419 | if (get_arg()) \ |
| 419 | tio.FIELD |= NAME; \ | 420 | tio.FIELD |= NAME; \ |
| 420 | else \ | 421 | else \ |
| 421 | tio.FIELD &= ~NAME; \ | 422 | tio.FIELD &= ~NAME; \ |
| 422 | debug3("tty_parse_modes: %d %d", OP, arg); \ | ||
| 423 | break; | 423 | break; |
| 424 | 424 | ||
| 425 | #include "ttymodes.h" | 425 | #include "ttymodes.h" |
| @@ -1,4 +1,4 @@ | |||
| 1 | /* $OpenBSD: umac.c,v 1.1 2007/06/07 19:37:34 pvalchev Exp $ */ | 1 | /* $OpenBSD: umac.c,v 1.3 2008/05/12 20:52:20 pvalchev Exp $ */ |
| 2 | /* ----------------------------------------------------------------------- | 2 | /* ----------------------------------------------------------------------- |
| 3 | * | 3 | * |
| 4 | * umac.c -- C Implementation UMAC Message Authentication | 4 | * umac.c -- C Implementation UMAC Message Authentication |
| @@ -66,6 +66,7 @@ | |||
| 66 | #include "includes.h" | 66 | #include "includes.h" |
| 67 | #include <sys/types.h> | 67 | #include <sys/types.h> |
| 68 | 68 | ||
| 69 | #include "xmalloc.h" | ||
| 69 | #include "umac.h" | 70 | #include "umac.h" |
| 70 | #include <string.h> | 71 | #include <string.h> |
| 71 | #include <stdlib.h> | 72 | #include <stdlib.h> |
| @@ -135,12 +136,14 @@ static UINT32 LOAD_UINT32_REVERSED(void *ptr) | |||
| 135 | return (UINT32)temp; | 136 | return (UINT32)temp; |
| 136 | } | 137 | } |
| 137 | 138 | ||
| 139 | # if (__LITTLE_ENDIAN__) | ||
| 138 | static void STORE_UINT32_REVERSED(void *ptr, UINT32 x) | 140 | static void STORE_UINT32_REVERSED(void *ptr, UINT32 x) |
| 139 | { | 141 | { |
| 140 | UINT32 i = (UINT32)x; | 142 | UINT32 i = (UINT32)x; |
| 141 | *(UINT32 *)ptr = (i >> 24) | ((i & 0x00FF0000) >> 8 ) | 143 | *(UINT32 *)ptr = (i >> 24) | ((i & 0x00FF0000) >> 8 ) |
| 142 | | ((i & 0x0000FF00) << 8 ) | (i << 24); | 144 | | ((i & 0x0000FF00) << 8 ) | (i << 24); |
| 143 | } | 145 | } |
| 146 | # endif /* __LITTLE_ENDIAN */ | ||
| 144 | #endif /* HAVE_SWAP32 */ | 147 | #endif /* HAVE_SWAP32 */ |
| 145 | 148 | ||
| 146 | /* The following definitions use the above reversal-primitives to do the right | 149 | /* The following definitions use the above reversal-primitives to do the right |
| @@ -178,14 +181,14 @@ typedef AES_KEY aes_int_key[1]; | |||
| 178 | /* The user-supplied UMAC key is stretched using AES in a counter | 181 | /* The user-supplied UMAC key is stretched using AES in a counter |
| 179 | * mode to supply all random bits needed by UMAC. The kdf function takes | 182 | * mode to supply all random bits needed by UMAC. The kdf function takes |
| 180 | * an AES internal key representation 'key' and writes a stream of | 183 | * an AES internal key representation 'key' and writes a stream of |
| 181 | * 'nbytes' bytes to the memory pointed at by 'buffer_ptr'. Each distinct | 184 | * 'nbytes' bytes to the memory pointed at by 'bufp'. Each distinct |
| 182 | * 'ndx' causes a distinct byte stream. | 185 | * 'ndx' causes a distinct byte stream. |
| 183 | */ | 186 | */ |
| 184 | static void kdf(void *buffer_ptr, aes_int_key key, UINT8 ndx, int nbytes) | 187 | static void kdf(void *bufp, aes_int_key key, UINT8 ndx, int nbytes) |
| 185 | { | 188 | { |
| 186 | UINT8 in_buf[AES_BLOCK_LEN] = {0}; | 189 | UINT8 in_buf[AES_BLOCK_LEN] = {0}; |
| 187 | UINT8 out_buf[AES_BLOCK_LEN]; | 190 | UINT8 out_buf[AES_BLOCK_LEN]; |
| 188 | UINT8 *dst_buf = (UINT8 *)buffer_ptr; | 191 | UINT8 *dst_buf = (UINT8 *)bufp; |
| 189 | int i; | 192 | int i; |
| 190 | 193 | ||
| 191 | /* Setup the initial value */ | 194 | /* Setup the initial value */ |
| @@ -543,6 +546,7 @@ static void nh_transform(nh_ctx *hc, UINT8 *buf, UINT32 nbytes) | |||
| 543 | 546 | ||
| 544 | /* ---------------------------------------------------------------------- */ | 547 | /* ---------------------------------------------------------------------- */ |
| 545 | 548 | ||
| 549 | #if (__LITTLE_ENDIAN__) | ||
| 546 | static void endian_convert(void *buf, UWORD bpw, UINT32 num_bytes) | 550 | static void endian_convert(void *buf, UWORD bpw, UINT32 num_bytes) |
| 547 | /* We endian convert the keys on little-endian computers to */ | 551 | /* We endian convert the keys on little-endian computers to */ |
| 548 | /* compensate for the lack of big-endian memory reads during hashing. */ | 552 | /* compensate for the lack of big-endian memory reads during hashing. */ |
| @@ -565,7 +569,6 @@ static void endian_convert(void *buf, UWORD bpw, UINT32 num_bytes) | |||
| 565 | } while (--iters); | 569 | } while (--iters); |
| 566 | } | 570 | } |
| 567 | } | 571 | } |
| 568 | #if (__LITTLE_ENDIAN__) | ||
| 569 | #define endian_convert_if_le(x,y,z) endian_convert((x),(y),(z)) | 572 | #define endian_convert_if_le(x,y,z) endian_convert((x),(y),(z)) |
| 570 | #else | 573 | #else |
| 571 | #define endian_convert_if_le(x,y,z) do{}while(0) /* Do nothing */ | 574 | #define endian_convert_if_le(x,y,z) do{}while(0) /* Do nothing */ |
| @@ -1042,7 +1045,8 @@ static int uhash_update(uhash_ctx_t ctx, u_char *input, long len) | |||
| 1042 | */ | 1045 | */ |
| 1043 | { | 1046 | { |
| 1044 | UWORD bytes_hashed, bytes_remaining; | 1047 | UWORD bytes_hashed, bytes_remaining; |
| 1045 | UINT8 nh_result[STREAMS*sizeof(UINT64)]; | 1048 | UINT64 result_buf[STREAMS]; |
| 1049 | UINT8 *nh_result = (UINT8 *)&result_buf; | ||
| 1046 | 1050 | ||
| 1047 | if (ctx->msg_len + len <= L1_KEY_LEN) { | 1051 | if (ctx->msg_len + len <= L1_KEY_LEN) { |
| 1048 | nh_update(&ctx->hash, (UINT8 *)input, len); | 1052 | nh_update(&ctx->hash, (UINT8 *)input, len); |
| @@ -1094,7 +1098,8 @@ static int uhash_update(uhash_ctx_t ctx, u_char *input, long len) | |||
| 1094 | static int uhash_final(uhash_ctx_t ctx, u_char *res) | 1098 | static int uhash_final(uhash_ctx_t ctx, u_char *res) |
| 1095 | /* Incorporate any pending data, pad, and generate tag */ | 1099 | /* Incorporate any pending data, pad, and generate tag */ |
| 1096 | { | 1100 | { |
| 1097 | UINT8 nh_result[STREAMS*sizeof(UINT64)]; | 1101 | UINT64 result_buf[STREAMS]; |
| 1102 | UINT8 *nh_result = (UINT8 *)&result_buf; | ||
| 1098 | 1103 | ||
| 1099 | if (ctx->msg_len > L1_KEY_LEN) { | 1104 | if (ctx->msg_len > L1_KEY_LEN) { |
| 1100 | if (ctx->msg_len % L1_KEY_LEN) { | 1105 | if (ctx->msg_len % L1_KEY_LEN) { |
| @@ -1196,7 +1201,7 @@ int umac_delete(struct umac_ctx *ctx) | |||
| 1196 | if (ctx) { | 1201 | if (ctx) { |
| 1197 | if (ALLOC_BOUNDARY) | 1202 | if (ALLOC_BOUNDARY) |
| 1198 | ctx = (struct umac_ctx *)ctx->free_ptr; | 1203 | ctx = (struct umac_ctx *)ctx->free_ptr; |
| 1199 | free(ctx); | 1204 | xfree(ctx); |
| 1200 | } | 1205 | } |
| 1201 | return (1); | 1206 | return (1); |
| 1202 | } | 1207 | } |
| @@ -1212,7 +1217,7 @@ struct umac_ctx *umac_new(u_char key[]) | |||
| 1212 | size_t bytes_to_add; | 1217 | size_t bytes_to_add; |
| 1213 | aes_int_key prf_key; | 1218 | aes_int_key prf_key; |
| 1214 | 1219 | ||
| 1215 | octx = ctx = malloc(sizeof(*ctx) + ALLOC_BOUNDARY); | 1220 | octx = ctx = xmalloc(sizeof(*ctx) + ALLOC_BOUNDARY); |
| 1216 | if (ctx) { | 1221 | if (ctx) { |
| 1217 | if (ALLOC_BOUNDARY) { | 1222 | if (ALLOC_BOUNDARY) { |
| 1218 | bytes_to_add = ALLOC_BOUNDARY - | 1223 | bytes_to_add = ALLOC_BOUNDARY - |
| @@ -1,6 +1,6 @@ | |||
| 1 | /* $OpenBSD: version.h,v 1.50 2007/08/15 08:16:49 markus Exp $ */ | 1 | /* $OpenBSD: version.h,v 1.54 2008/07/21 08:19:07 djm Exp $ */ |
| 2 | 2 | ||
| 3 | #define SSH_VERSION "OpenSSH_4.7" | 3 | #define SSH_VERSION "OpenSSH_5.1" |
| 4 | 4 | ||
| 5 | #define SSH_PORTABLE "p1" | 5 | #define SSH_PORTABLE "p1" |
| 6 | #ifdef SSH_EXTRAVERSION | 6 | #ifdef SSH_EXTRAVERSION |