diff options
-rw-r--r-- | auth-options.c | 13 | ||||
-rw-r--r-- | auth-rh-rsa.c | 11 | ||||
-rw-r--r-- | auth-rhosts.c | 12 | ||||
-rw-r--r-- | auth.c | 145 | ||||
-rw-r--r-- | auth.h | 4 | ||||
-rw-r--r-- | auth2-hostbased.c | 7 | ||||
-rw-r--r-- | canohost.c | 262 | ||||
-rw-r--r-- | canohost.h | 13 | ||||
-rw-r--r-- | channels.c | 6 | ||||
-rw-r--r-- | monitor.c | 5 | ||||
-rw-r--r-- | monitor_wrap.c | 12 | ||||
-rw-r--r-- | monitor_wrap.h | 10 | ||||
-rw-r--r-- | opacket.h | 4 | ||||
-rw-r--r-- | packet.c | 37 | ||||
-rw-r--r-- | packet.h | 8 | ||||
-rw-r--r-- | servconf.c | 11 | ||||
-rw-r--r-- | serverloop.c | 12 | ||||
-rw-r--r-- | session.c | 42 | ||||
-rw-r--r-- | session.h | 4 | ||||
-rw-r--r-- | ssh.c | 7 | ||||
-rw-r--r-- | sshd.c | 120 |
21 files changed, 372 insertions, 373 deletions
diff --git a/auth-options.c b/auth-options.c index edbaf80bb..b399b91e3 100644 --- a/auth-options.c +++ b/auth-options.c | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: auth-options.c,v 1.70 2015/12/10 17:08:40 mmcc Exp $ */ | 1 | /* $OpenBSD: auth-options.c,v 1.71 2016/03/07 19:02:43 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
@@ -29,6 +29,7 @@ | |||
29 | #include "ssherr.h" | 29 | #include "ssherr.h" |
30 | #include "log.h" | 30 | #include "log.h" |
31 | #include "canohost.h" | 31 | #include "canohost.h" |
32 | #include "packet.h" | ||
32 | #include "sshbuf.h" | 33 | #include "sshbuf.h" |
33 | #include "misc.h" | 34 | #include "misc.h" |
34 | #include "channels.h" | 35 | #include "channels.h" |
@@ -120,6 +121,7 @@ match_flag(const char *opt, int allow_negate, char **optsp, const char *msg) | |||
120 | int | 121 | int |
121 | auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum) | 122 | auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum) |
122 | { | 123 | { |
124 | struct ssh *ssh = active_state; /* XXX */ | ||
123 | const char *cp; | 125 | const char *cp; |
124 | int i, r; | 126 | int i, r; |
125 | 127 | ||
@@ -273,9 +275,9 @@ auth_parse_options(struct passwd *pw, char *opts, char *file, u_long linenum) | |||
273 | } | 275 | } |
274 | cp = "from=\""; | 276 | cp = "from=\""; |
275 | if (strncasecmp(opts, cp, strlen(cp)) == 0) { | 277 | if (strncasecmp(opts, cp, strlen(cp)) == 0) { |
276 | const char *remote_ip = get_remote_ipaddr(); | 278 | const char *remote_ip = ssh_remote_ipaddr(ssh); |
277 | const char *remote_host = get_canonical_hostname( | 279 | const char *remote_host = auth_get_canonical_hostname( |
278 | options.use_dns); | 280 | ssh, options.use_dns); |
279 | char *patterns = xmalloc(strlen(opts) + 1); | 281 | char *patterns = xmalloc(strlen(opts) + 1); |
280 | 282 | ||
281 | opts += strlen(cp); | 283 | opts += strlen(cp); |
@@ -457,6 +459,7 @@ parse_option_list(struct sshbuf *oblob, struct passwd *pw, | |||
457 | char **cert_forced_command, | 459 | char **cert_forced_command, |
458 | int *cert_source_address_done) | 460 | int *cert_source_address_done) |
459 | { | 461 | { |
462 | struct ssh *ssh = active_state; /* XXX */ | ||
460 | char *command, *allowed; | 463 | char *command, *allowed; |
461 | const char *remote_ip; | 464 | const char *remote_ip; |
462 | char *name = NULL; | 465 | char *name = NULL; |
@@ -530,7 +533,7 @@ parse_option_list(struct sshbuf *oblob, struct passwd *pw, | |||
530 | free(allowed); | 533 | free(allowed); |
531 | goto out; | 534 | goto out; |
532 | } | 535 | } |
533 | remote_ip = get_remote_ipaddr(); | 536 | remote_ip = ssh_remote_ipaddr(ssh); |
534 | result = addr_match_cidr_list(remote_ip, | 537 | result = addr_match_cidr_list(remote_ip, |
535 | allowed); | 538 | allowed); |
536 | free(allowed); | 539 | free(allowed); |
diff --git a/auth-rh-rsa.c b/auth-rh-rsa.c index 2e20396ea..057335ba4 100644 --- a/auth-rh-rsa.c +++ b/auth-rh-rsa.c | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: auth-rh-rsa.c,v 1.44 2014/07/15 15:54:14 millert Exp $ */ | 1 | /* $OpenBSD: auth-rh-rsa.c,v 1.45 2016/03/07 19:02:43 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
@@ -42,8 +42,8 @@ | |||
42 | extern ServerOptions options; | 42 | extern ServerOptions options; |
43 | 43 | ||
44 | int | 44 | int |
45 | auth_rhosts_rsa_key_allowed(struct passwd *pw, char *cuser, char *chost, | 45 | auth_rhosts_rsa_key_allowed(struct passwd *pw, const char *cuser, |
46 | Key *client_host_key) | 46 | const char *chost, Key *client_host_key) |
47 | { | 47 | { |
48 | HostStatus host_status; | 48 | HostStatus host_status; |
49 | 49 | ||
@@ -68,7 +68,8 @@ auth_rhosts_rsa_key_allowed(struct passwd *pw, char *cuser, char *chost, | |||
68 | int | 68 | int |
69 | auth_rhosts_rsa(Authctxt *authctxt, char *cuser, Key *client_host_key) | 69 | auth_rhosts_rsa(Authctxt *authctxt, char *cuser, Key *client_host_key) |
70 | { | 70 | { |
71 | char *chost; | 71 | struct ssh *ssh = active_state; /* XXX */ |
72 | const char *chost; | ||
72 | struct passwd *pw = authctxt->pw; | 73 | struct passwd *pw = authctxt->pw; |
73 | 74 | ||
74 | debug("Trying rhosts with RSA host authentication for client user %.100s", | 75 | debug("Trying rhosts with RSA host authentication for client user %.100s", |
@@ -78,7 +79,7 @@ auth_rhosts_rsa(Authctxt *authctxt, char *cuser, Key *client_host_key) | |||
78 | client_host_key->rsa == NULL) | 79 | client_host_key->rsa == NULL) |
79 | return 0; | 80 | return 0; |
80 | 81 | ||
81 | chost = (char *)get_canonical_hostname(options.use_dns); | 82 | chost = auth_get_canonical_hostname(ssh, options.use_dns); |
82 | debug("Rhosts RSA authentication: canonical host %.900s", chost); | 83 | debug("Rhosts RSA authentication: canonical host %.900s", chost); |
83 | 84 | ||
84 | if (!PRIVSEP(auth_rhosts_rsa_key_allowed(pw, cuser, chost, client_host_key))) { | 85 | if (!PRIVSEP(auth_rhosts_rsa_key_allowed(pw, cuser, chost, client_host_key))) { |
diff --git a/auth-rhosts.c b/auth-rhosts.c index ee9e827af..0ef344712 100644 --- a/auth-rhosts.c +++ b/auth-rhosts.c | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: auth-rhosts.c,v 1.46 2014/12/23 22:42:48 djm Exp $ */ | 1 | /* $OpenBSD: auth-rhosts.c,v 1.47 2016/03/07 19:02:43 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
@@ -30,14 +30,15 @@ | |||
30 | #include <unistd.h> | 30 | #include <unistd.h> |
31 | 31 | ||
32 | #include "packet.h" | 32 | #include "packet.h" |
33 | #include "buffer.h" | ||
34 | #include "uidswap.h" | 33 | #include "uidswap.h" |
35 | #include "pathnames.h" | 34 | #include "pathnames.h" |
36 | #include "log.h" | 35 | #include "log.h" |
37 | #include "misc.h" | 36 | #include "misc.h" |
37 | #include "buffer.h" /* XXX */ | ||
38 | #include "key.h" /* XXX */ | ||
38 | #include "servconf.h" | 39 | #include "servconf.h" |
39 | #include "canohost.h" | 40 | #include "canohost.h" |
40 | #include "key.h" | 41 | #include "sshkey.h" |
41 | #include "hostfile.h" | 42 | #include "hostfile.h" |
42 | #include "auth.h" | 43 | #include "auth.h" |
43 | 44 | ||
@@ -189,10 +190,11 @@ check_rhosts_file(const char *filename, const char *hostname, | |||
189 | int | 190 | int |
190 | auth_rhosts(struct passwd *pw, const char *client_user) | 191 | auth_rhosts(struct passwd *pw, const char *client_user) |
191 | { | 192 | { |
193 | struct ssh *ssh = active_state; /* XXX */ | ||
192 | const char *hostname, *ipaddr; | 194 | const char *hostname, *ipaddr; |
193 | 195 | ||
194 | hostname = get_canonical_hostname(options.use_dns); | 196 | hostname = auth_get_canonical_hostname(ssh, options.use_dns); |
195 | ipaddr = get_remote_ipaddr(); | 197 | ipaddr = ssh_remote_ipaddr(ssh); |
196 | return auth_rhosts2(pw, client_user, hostname, ipaddr); | 198 | return auth_rhosts2(pw, client_user, hostname, ipaddr); |
197 | } | 199 | } |
198 | 200 | ||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: auth.c,v 1.113 2015/08/21 03:42:19 djm Exp $ */ | 1 | /* $OpenBSD: auth.c,v 1.114 2016/03/07 19:02:43 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Copyright (c) 2000 Markus Friedl. All rights reserved. | 3 | * Copyright (c) 2000 Markus Friedl. All rights reserved. |
4 | * | 4 | * |
@@ -27,6 +27,7 @@ | |||
27 | 27 | ||
28 | #include <sys/types.h> | 28 | #include <sys/types.h> |
29 | #include <sys/stat.h> | 29 | #include <sys/stat.h> |
30 | #include <sys/socket.h> | ||
30 | 31 | ||
31 | #include <netinet/in.h> | 32 | #include <netinet/in.h> |
32 | 33 | ||
@@ -50,6 +51,7 @@ | |||
50 | #include <string.h> | 51 | #include <string.h> |
51 | #include <unistd.h> | 52 | #include <unistd.h> |
52 | #include <limits.h> | 53 | #include <limits.h> |
54 | #include <netdb.h> | ||
53 | 55 | ||
54 | #include "xmalloc.h" | 56 | #include "xmalloc.h" |
55 | #include "match.h" | 57 | #include "match.h" |
@@ -97,6 +99,7 @@ int auth_debug_init; | |||
97 | int | 99 | int |
98 | allowed_user(struct passwd * pw) | 100 | allowed_user(struct passwd * pw) |
99 | { | 101 | { |
102 | struct ssh *ssh = active_state; /* XXX */ | ||
100 | struct stat st; | 103 | struct stat st; |
101 | const char *hostname = NULL, *ipaddr = NULL, *passwd = NULL; | 104 | const char *hostname = NULL, *ipaddr = NULL, *passwd = NULL; |
102 | u_int i; | 105 | u_int i; |
@@ -182,8 +185,8 @@ allowed_user(struct passwd * pw) | |||
182 | 185 | ||
183 | if (options.num_deny_users > 0 || options.num_allow_users > 0 || | 186 | if (options.num_deny_users > 0 || options.num_allow_users > 0 || |
184 | options.num_deny_groups > 0 || options.num_allow_groups > 0) { | 187 | options.num_deny_groups > 0 || options.num_allow_groups > 0) { |
185 | hostname = get_canonical_hostname(options.use_dns); | 188 | hostname = auth_get_canonical_hostname(ssh, options.use_dns); |
186 | ipaddr = get_remote_ipaddr(); | 189 | ipaddr = ssh_remote_ipaddr(ssh); |
187 | } | 190 | } |
188 | 191 | ||
189 | /* Return false if user is listed in DenyUsers */ | 192 | /* Return false if user is listed in DenyUsers */ |
@@ -274,6 +277,7 @@ void | |||
274 | auth_log(Authctxt *authctxt, int authenticated, int partial, | 277 | auth_log(Authctxt *authctxt, int authenticated, int partial, |
275 | const char *method, const char *submethod) | 278 | const char *method, const char *submethod) |
276 | { | 279 | { |
280 | struct ssh *ssh = active_state; /* XXX */ | ||
277 | void (*authlog) (const char *fmt,...) = verbose; | 281 | void (*authlog) (const char *fmt,...) = verbose; |
278 | char *authmsg; | 282 | char *authmsg; |
279 | 283 | ||
@@ -300,8 +304,8 @@ auth_log(Authctxt *authctxt, int authenticated, int partial, | |||
300 | submethod != NULL ? "/" : "", submethod == NULL ? "" : submethod, | 304 | submethod != NULL ? "/" : "", submethod == NULL ? "" : submethod, |
301 | authctxt->valid ? "" : "invalid user ", | 305 | authctxt->valid ? "" : "invalid user ", |
302 | authctxt->user, | 306 | authctxt->user, |
303 | get_remote_ipaddr(), | 307 | ssh_remote_ipaddr(ssh), |
304 | get_remote_port(), | 308 | ssh_remote_port(ssh), |
305 | compat20 ? "ssh2" : "ssh1", | 309 | compat20 ? "ssh2" : "ssh1", |
306 | authctxt->info != NULL ? ": " : "", | 310 | authctxt->info != NULL ? ": " : "", |
307 | authctxt->info != NULL ? authctxt->info : ""); | 311 | authctxt->info != NULL ? authctxt->info : ""); |
@@ -331,12 +335,14 @@ auth_log(Authctxt *authctxt, int authenticated, int partial, | |||
331 | void | 335 | void |
332 | auth_maxtries_exceeded(Authctxt *authctxt) | 336 | auth_maxtries_exceeded(Authctxt *authctxt) |
333 | { | 337 | { |
338 | struct ssh *ssh = active_state; /* XXX */ | ||
339 | |||
334 | error("maximum authentication attempts exceeded for " | 340 | error("maximum authentication attempts exceeded for " |
335 | "%s%.100s from %.200s port %d %s", | 341 | "%s%.100s from %.200s port %d %s", |
336 | authctxt->valid ? "" : "invalid user ", | 342 | authctxt->valid ? "" : "invalid user ", |
337 | authctxt->user, | 343 | authctxt->user, |
338 | get_remote_ipaddr(), | 344 | ssh_remote_ipaddr(ssh), |
339 | get_remote_port(), | 345 | ssh_remote_port(ssh), |
340 | compat20 ? "ssh2" : "ssh1"); | 346 | compat20 ? "ssh2" : "ssh1"); |
341 | packet_disconnect("Too many authentication failures"); | 347 | packet_disconnect("Too many authentication failures"); |
342 | /* NOTREACHED */ | 348 | /* NOTREACHED */ |
@@ -348,6 +354,8 @@ auth_maxtries_exceeded(Authctxt *authctxt) | |||
348 | int | 354 | int |
349 | auth_root_allowed(const char *method) | 355 | auth_root_allowed(const char *method) |
350 | { | 356 | { |
357 | struct ssh *ssh = active_state; /* XXX */ | ||
358 | |||
351 | switch (options.permit_root_login) { | 359 | switch (options.permit_root_login) { |
352 | case PERMIT_YES: | 360 | case PERMIT_YES: |
353 | return 1; | 361 | return 1; |
@@ -364,7 +372,8 @@ auth_root_allowed(const char *method) | |||
364 | } | 372 | } |
365 | break; | 373 | break; |
366 | } | 374 | } |
367 | logit("ROOT LOGIN REFUSED FROM %.200s", get_remote_ipaddr()); | 375 | logit("ROOT LOGIN REFUSED FROM %.200s port %d", |
376 | ssh_remote_ipaddr(ssh), ssh_remote_port(ssh)); | ||
368 | return 0; | 377 | return 0; |
369 | } | 378 | } |
370 | 379 | ||
@@ -604,6 +613,7 @@ auth_openprincipals(const char *file, struct passwd *pw, int strict_modes) | |||
604 | struct passwd * | 613 | struct passwd * |
605 | getpwnamallow(const char *user) | 614 | getpwnamallow(const char *user) |
606 | { | 615 | { |
616 | struct ssh *ssh = active_state; /* XXX */ | ||
607 | #ifdef HAVE_LOGIN_CAP | 617 | #ifdef HAVE_LOGIN_CAP |
608 | extern login_cap_t *lc; | 618 | extern login_cap_t *lc; |
609 | #ifdef BSD_AUTH | 619 | #ifdef BSD_AUTH |
@@ -639,8 +649,8 @@ getpwnamallow(const char *user) | |||
639 | } | 649 | } |
640 | #endif | 650 | #endif |
641 | if (pw == NULL) { | 651 | if (pw == NULL) { |
642 | logit("Invalid user %.100s from %.100s", | 652 | logit("Invalid user %.100s from %.100s port %d", |
643 | user, get_remote_ipaddr()); | 653 | user, ssh_remote_ipaddr(ssh), ssh_remote_port(ssh)); |
644 | #ifdef CUSTOM_FAILED_LOGIN | 654 | #ifdef CUSTOM_FAILED_LOGIN |
645 | record_failed_login(user, | 655 | record_failed_login(user, |
646 | get_canonical_hostname(options.use_dns), "ssh"); | 656 | get_canonical_hostname(options.use_dns), "ssh"); |
@@ -773,3 +783,118 @@ fakepw(void) | |||
773 | 783 | ||
774 | return (&fake); | 784 | return (&fake); |
775 | } | 785 | } |
786 | |||
787 | /* | ||
788 | * Returns the remote DNS hostname as a string. The returned string must not | ||
789 | * be freed. NB. this will usually trigger a DNS query the first time it is | ||
790 | * called. | ||
791 | * This function does additional checks on the hostname to mitigate some | ||
792 | * attacks on legacy rhosts-style authentication. | ||
793 | * XXX is RhostsRSAAuthentication vulnerable to these? | ||
794 | * XXX Can we remove these checks? (or if not, remove RhostsRSAAuthentication?) | ||
795 | */ | ||
796 | |||
797 | static char * | ||
798 | remote_hostname(struct ssh *ssh) | ||
799 | { | ||
800 | struct sockaddr_storage from; | ||
801 | socklen_t fromlen; | ||
802 | struct addrinfo hints, *ai, *aitop; | ||
803 | char name[NI_MAXHOST], ntop2[NI_MAXHOST]; | ||
804 | const char *ntop = ssh_remote_ipaddr(ssh); | ||
805 | |||
806 | /* Get IP address of client. */ | ||
807 | fromlen = sizeof(from); | ||
808 | memset(&from, 0, sizeof(from)); | ||
809 | if (getpeername(ssh_packet_get_connection_in(ssh), | ||
810 | (struct sockaddr *)&from, &fromlen) < 0) { | ||
811 | debug("getpeername failed: %.100s", strerror(errno)); | ||
812 | return strdup(ntop); | ||
813 | } | ||
814 | |||
815 | ipv64_normalise_mapped(&from, &fromlen); | ||
816 | if (from.ss_family == AF_INET6) | ||
817 | fromlen = sizeof(struct sockaddr_in6); | ||
818 | |||
819 | debug3("Trying to reverse map address %.100s.", ntop); | ||
820 | /* Map the IP address to a host name. */ | ||
821 | if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name), | ||
822 | NULL, 0, NI_NAMEREQD) != 0) { | ||
823 | /* Host name not found. Use ip address. */ | ||
824 | return strdup(ntop); | ||
825 | } | ||
826 | |||
827 | /* | ||
828 | * if reverse lookup result looks like a numeric hostname, | ||
829 | * someone is trying to trick us by PTR record like following: | ||
830 | * 1.1.1.10.in-addr.arpa. IN PTR 2.3.4.5 | ||
831 | */ | ||
832 | memset(&hints, 0, sizeof(hints)); | ||
833 | hints.ai_socktype = SOCK_DGRAM; /*dummy*/ | ||
834 | hints.ai_flags = AI_NUMERICHOST; | ||
835 | if (getaddrinfo(name, NULL, &hints, &ai) == 0) { | ||
836 | logit("Nasty PTR record \"%s\" is set up for %s, ignoring", | ||
837 | name, ntop); | ||
838 | freeaddrinfo(ai); | ||
839 | return strdup(ntop); | ||
840 | } | ||
841 | |||
842 | /* Names are stored in lowercase. */ | ||
843 | lowercase(name); | ||
844 | |||
845 | /* | ||
846 | * Map it back to an IP address and check that the given | ||
847 | * address actually is an address of this host. This is | ||
848 | * necessary because anyone with access to a name server can | ||
849 | * define arbitrary names for an IP address. Mapping from | ||
850 | * name to IP address can be trusted better (but can still be | ||
851 | * fooled if the intruder has access to the name server of | ||
852 | * the domain). | ||
853 | */ | ||
854 | memset(&hints, 0, sizeof(hints)); | ||
855 | hints.ai_family = from.ss_family; | ||
856 | hints.ai_socktype = SOCK_STREAM; | ||
857 | if (getaddrinfo(name, NULL, &hints, &aitop) != 0) { | ||
858 | logit("reverse mapping checking getaddrinfo for %.700s " | ||
859 | "[%s] failed - POSSIBLE BREAK-IN ATTEMPT!", name, ntop); | ||
860 | return strdup(ntop); | ||
861 | } | ||
862 | /* Look for the address from the list of addresses. */ | ||
863 | for (ai = aitop; ai; ai = ai->ai_next) { | ||
864 | if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop2, | ||
865 | sizeof(ntop2), NULL, 0, NI_NUMERICHOST) == 0 && | ||
866 | (strcmp(ntop, ntop2) == 0)) | ||
867 | break; | ||
868 | } | ||
869 | freeaddrinfo(aitop); | ||
870 | /* If we reached the end of the list, the address was not there. */ | ||
871 | if (ai == NULL) { | ||
872 | /* Address not found for the host name. */ | ||
873 | logit("Address %.100s maps to %.600s, but this does not " | ||
874 | "map back to the address - POSSIBLE BREAK-IN ATTEMPT!", | ||
875 | ntop, name); | ||
876 | return strdup(ntop); | ||
877 | } | ||
878 | return strdup(name); | ||
879 | } | ||
880 | |||
881 | /* | ||
882 | * Return the canonical name of the host in the other side of the current | ||
883 | * connection. The host name is cached, so it is efficient to call this | ||
884 | * several times. | ||
885 | */ | ||
886 | |||
887 | const char * | ||
888 | auth_get_canonical_hostname(struct ssh *ssh, int use_dns) | ||
889 | { | ||
890 | static char *dnsname; | ||
891 | |||
892 | if (!use_dns) | ||
893 | return ssh_remote_ipaddr(ssh); | ||
894 | else if (dnsname != NULL) | ||
895 | return dnsname; | ||
896 | else { | ||
897 | dnsname = remote_hostname(ssh); | ||
898 | return dnsname; | ||
899 | } | ||
900 | } | ||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: auth.h,v 1.86 2015/12/04 16:41:28 markus Exp $ */ | 1 | /* $OpenBSD: auth.h,v 1.87 2016/03/07 19:02:43 djm Exp $ */ |
2 | 2 | ||
3 | /* | 3 | /* |
4 | * Copyright (c) 2000 Markus Friedl. All rights reserved. | 4 | * Copyright (c) 2000 Markus Friedl. All rights reserved. |
@@ -197,6 +197,8 @@ FILE *auth_openkeyfile(const char *, struct passwd *, int); | |||
197 | FILE *auth_openprincipals(const char *, struct passwd *, int); | 197 | FILE *auth_openprincipals(const char *, struct passwd *, int); |
198 | int auth_key_is_revoked(Key *); | 198 | int auth_key_is_revoked(Key *); |
199 | 199 | ||
200 | const char *auth_get_canonical_hostname(struct ssh *, int); | ||
201 | |||
200 | HostStatus | 202 | HostStatus |
201 | check_key_in_hostfiles(struct passwd *, Key *, const char *, | 203 | check_key_in_hostfiles(struct passwd *, Key *, const char *, |
202 | const char *, const char *); | 204 | const char *, const char *); |
diff --git a/auth2-hostbased.c b/auth2-hostbased.c index e2327cf77..1b3c3b202 100644 --- a/auth2-hostbased.c +++ b/auth2-hostbased.c | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: auth2-hostbased.c,v 1.25 2015/05/04 06:10:48 djm Exp $ */ | 1 | /* $OpenBSD: auth2-hostbased.c,v 1.26 2016/03/07 19:02:43 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Copyright (c) 2000 Markus Friedl. All rights reserved. | 3 | * Copyright (c) 2000 Markus Friedl. All rights reserved. |
4 | * | 4 | * |
@@ -160,6 +160,7 @@ int | |||
160 | hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost, | 160 | hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost, |
161 | Key *key) | 161 | Key *key) |
162 | { | 162 | { |
163 | struct ssh *ssh = active_state; /* XXX */ | ||
163 | const char *resolvedname, *ipaddr, *lookup, *reason; | 164 | const char *resolvedname, *ipaddr, *lookup, *reason; |
164 | HostStatus host_status; | 165 | HostStatus host_status; |
165 | int len; | 166 | int len; |
@@ -168,8 +169,8 @@ hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost, | |||
168 | if (auth_key_is_revoked(key)) | 169 | if (auth_key_is_revoked(key)) |
169 | return 0; | 170 | return 0; |
170 | 171 | ||
171 | resolvedname = get_canonical_hostname(options.use_dns); | 172 | resolvedname = auth_get_canonical_hostname(ssh, options.use_dns); |
172 | ipaddr = get_remote_ipaddr(); | 173 | ipaddr = ssh_remote_ipaddr(ssh); |
173 | 174 | ||
174 | debug2("%s: chost %s resolvedname %s ipaddr %s", __func__, | 175 | debug2("%s: chost %s resolvedname %s ipaddr %s", __func__, |
175 | chost, resolvedname, ipaddr); | 176 | chost, resolvedname, ipaddr); |
diff --git a/canohost.c b/canohost.c index 223964ea3..f71a08568 100644 --- a/canohost.c +++ b/canohost.c | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: canohost.c,v 1.72 2015/03/01 15:44:40 millert Exp $ */ | 1 | /* $OpenBSD: canohost.c,v 1.73 2016/03/07 19:02:43 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
@@ -35,147 +35,6 @@ | |||
35 | #include "canohost.h" | 35 | #include "canohost.h" |
36 | #include "misc.h" | 36 | #include "misc.h" |
37 | 37 | ||
38 | static void check_ip_options(int, char *); | ||
39 | static char *canonical_host_ip = NULL; | ||
40 | static int cached_port = -1; | ||
41 | |||
42 | /* | ||
43 | * Return the canonical name of the host at the other end of the socket. The | ||
44 | * caller should free the returned string. | ||
45 | */ | ||
46 | |||
47 | static char * | ||
48 | get_remote_hostname(int sock, int use_dns) | ||
49 | { | ||
50 | struct sockaddr_storage from; | ||
51 | socklen_t fromlen; | ||
52 | struct addrinfo hints, *ai, *aitop; | ||
53 | char name[NI_MAXHOST], ntop[NI_MAXHOST], ntop2[NI_MAXHOST]; | ||
54 | |||
55 | /* Get IP address of client. */ | ||
56 | fromlen = sizeof(from); | ||
57 | memset(&from, 0, sizeof(from)); | ||
58 | if (getpeername(sock, (struct sockaddr *)&from, &fromlen) < 0) { | ||
59 | debug("getpeername failed: %.100s", strerror(errno)); | ||
60 | cleanup_exit(255); | ||
61 | } | ||
62 | |||
63 | if (from.ss_family == AF_INET) | ||
64 | check_ip_options(sock, ntop); | ||
65 | |||
66 | ipv64_normalise_mapped(&from, &fromlen); | ||
67 | |||
68 | if (from.ss_family == AF_INET6) | ||
69 | fromlen = sizeof(struct sockaddr_in6); | ||
70 | |||
71 | if (getnameinfo((struct sockaddr *)&from, fromlen, ntop, sizeof(ntop), | ||
72 | NULL, 0, NI_NUMERICHOST) != 0) | ||
73 | fatal("get_remote_hostname: getnameinfo NI_NUMERICHOST failed"); | ||
74 | |||
75 | if (!use_dns) | ||
76 | return xstrdup(ntop); | ||
77 | |||
78 | debug3("Trying to reverse map address %.100s.", ntop); | ||
79 | /* Map the IP address to a host name. */ | ||
80 | if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name), | ||
81 | NULL, 0, NI_NAMEREQD) != 0) { | ||
82 | /* Host name not found. Use ip address. */ | ||
83 | return xstrdup(ntop); | ||
84 | } | ||
85 | |||
86 | /* | ||
87 | * if reverse lookup result looks like a numeric hostname, | ||
88 | * someone is trying to trick us by PTR record like following: | ||
89 | * 1.1.1.10.in-addr.arpa. IN PTR 2.3.4.5 | ||
90 | */ | ||
91 | memset(&hints, 0, sizeof(hints)); | ||
92 | hints.ai_socktype = SOCK_DGRAM; /*dummy*/ | ||
93 | hints.ai_flags = AI_NUMERICHOST; | ||
94 | if (getaddrinfo(name, NULL, &hints, &ai) == 0) { | ||
95 | logit("Nasty PTR record \"%s\" is set up for %s, ignoring", | ||
96 | name, ntop); | ||
97 | freeaddrinfo(ai); | ||
98 | return xstrdup(ntop); | ||
99 | } | ||
100 | |||
101 | /* Names are stores in lowercase. */ | ||
102 | lowercase(name); | ||
103 | |||
104 | /* | ||
105 | * Map it back to an IP address and check that the given | ||
106 | * address actually is an address of this host. This is | ||
107 | * necessary because anyone with access to a name server can | ||
108 | * define arbitrary names for an IP address. Mapping from | ||
109 | * name to IP address can be trusted better (but can still be | ||
110 | * fooled if the intruder has access to the name server of | ||
111 | * the domain). | ||
112 | */ | ||
113 | memset(&hints, 0, sizeof(hints)); | ||
114 | hints.ai_family = from.ss_family; | ||
115 | hints.ai_socktype = SOCK_STREAM; | ||
116 | if (getaddrinfo(name, NULL, &hints, &aitop) != 0) { | ||
117 | logit("reverse mapping checking getaddrinfo for %.700s " | ||
118 | "[%s] failed - POSSIBLE BREAK-IN ATTEMPT!", name, ntop); | ||
119 | return xstrdup(ntop); | ||
120 | } | ||
121 | /* Look for the address from the list of addresses. */ | ||
122 | for (ai = aitop; ai; ai = ai->ai_next) { | ||
123 | if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop2, | ||
124 | sizeof(ntop2), NULL, 0, NI_NUMERICHOST) == 0 && | ||
125 | (strcmp(ntop, ntop2) == 0)) | ||
126 | break; | ||
127 | } | ||
128 | freeaddrinfo(aitop); | ||
129 | /* If we reached the end of the list, the address was not there. */ | ||
130 | if (!ai) { | ||
131 | /* Address not found for the host name. */ | ||
132 | logit("Address %.100s maps to %.600s, but this does not " | ||
133 | "map back to the address - POSSIBLE BREAK-IN ATTEMPT!", | ||
134 | ntop, name); | ||
135 | return xstrdup(ntop); | ||
136 | } | ||
137 | return xstrdup(name); | ||
138 | } | ||
139 | |||
140 | /* | ||
141 | * If IP options are supported, make sure there are none (log and | ||
142 | * disconnect them if any are found). Basically we are worried about | ||
143 | * source routing; it can be used to pretend you are somebody | ||
144 | * (ip-address) you are not. That itself may be "almost acceptable" | ||
145 | * under certain circumstances, but rhosts autentication is useless | ||
146 | * if source routing is accepted. Notice also that if we just dropped | ||
147 | * source routing here, the other side could use IP spoofing to do | ||
148 | * rest of the interaction and could still bypass security. So we | ||
149 | * exit here if we detect any IP options. | ||
150 | */ | ||
151 | /* IPv4 only */ | ||
152 | static void | ||
153 | check_ip_options(int sock, char *ipaddr) | ||
154 | { | ||
155 | #ifdef IP_OPTIONS | ||
156 | u_char options[200]; | ||
157 | char text[sizeof(options) * 3 + 1]; | ||
158 | socklen_t option_size, i; | ||
159 | int ipproto; | ||
160 | struct protoent *ip; | ||
161 | |||
162 | if ((ip = getprotobyname("ip")) != NULL) | ||
163 | ipproto = ip->p_proto; | ||
164 | else | ||
165 | ipproto = IPPROTO_IP; | ||
166 | option_size = sizeof(options); | ||
167 | if (getsockopt(sock, ipproto, IP_OPTIONS, options, | ||
168 | &option_size) >= 0 && option_size != 0) { | ||
169 | text[0] = '\0'; | ||
170 | for (i = 0; i < option_size; i++) | ||
171 | snprintf(text + i*3, sizeof(text) - i*3, | ||
172 | " %2.2x", options[i]); | ||
173 | fatal("Connection from %.100s with IP options:%.800s", | ||
174 | ipaddr, text); | ||
175 | } | ||
176 | #endif /* IP_OPTIONS */ | ||
177 | } | ||
178 | |||
179 | void | 38 | void |
180 | ipv64_normalise_mapped(struct sockaddr_storage *addr, socklen_t *len) | 39 | ipv64_normalise_mapped(struct sockaddr_storage *addr, socklen_t *len) |
181 | { | 40 | { |
@@ -202,38 +61,6 @@ ipv64_normalise_mapped(struct sockaddr_storage *addr, socklen_t *len) | |||
202 | } | 61 | } |
203 | 62 | ||
204 | /* | 63 | /* |
205 | * Return the canonical name of the host in the other side of the current | ||
206 | * connection. The host name is cached, so it is efficient to call this | ||
207 | * several times. | ||
208 | */ | ||
209 | |||
210 | const char * | ||
211 | get_canonical_hostname(int use_dns) | ||
212 | { | ||
213 | char *host; | ||
214 | static char *canonical_host_name = NULL; | ||
215 | static char *remote_ip = NULL; | ||
216 | |||
217 | /* Check if we have previously retrieved name with same option. */ | ||
218 | if (use_dns && canonical_host_name != NULL) | ||
219 | return canonical_host_name; | ||
220 | if (!use_dns && remote_ip != NULL) | ||
221 | return remote_ip; | ||
222 | |||
223 | /* Get the real hostname if socket; otherwise return UNKNOWN. */ | ||
224 | if (packet_connection_is_on_socket()) | ||
225 | host = get_remote_hostname(packet_get_connection_in(), use_dns); | ||
226 | else | ||
227 | host = "UNKNOWN"; | ||
228 | |||
229 | if (use_dns) | ||
230 | canonical_host_name = host; | ||
231 | else | ||
232 | remote_ip = host; | ||
233 | return host; | ||
234 | } | ||
235 | |||
236 | /* | ||
237 | * Returns the local/remote IP-address/hostname of socket as a string. | 64 | * Returns the local/remote IP-address/hostname of socket as a string. |
238 | * The returned string must be freed. | 65 | * The returned string must be freed. |
239 | */ | 66 | */ |
@@ -250,12 +77,10 @@ get_socket_address(int sock, int remote, int flags) | |||
250 | memset(&addr, 0, sizeof(addr)); | 77 | memset(&addr, 0, sizeof(addr)); |
251 | 78 | ||
252 | if (remote) { | 79 | if (remote) { |
253 | if (getpeername(sock, (struct sockaddr *)&addr, &addrlen) | 80 | if (getpeername(sock, (struct sockaddr *)&addr, &addrlen) != 0) |
254 | < 0) | ||
255 | return NULL; | 81 | return NULL; |
256 | } else { | 82 | } else { |
257 | if (getsockname(sock, (struct sockaddr *)&addr, &addrlen) | 83 | if (getsockname(sock, (struct sockaddr *)&addr, &addrlen) != 0) |
258 | < 0) | ||
259 | return NULL; | 84 | return NULL; |
260 | } | 85 | } |
261 | 86 | ||
@@ -271,7 +96,7 @@ get_socket_address(int sock, int remote, int flags) | |||
271 | /* Get the address in ascii. */ | 96 | /* Get the address in ascii. */ |
272 | if ((r = getnameinfo((struct sockaddr *)&addr, addrlen, ntop, | 97 | if ((r = getnameinfo((struct sockaddr *)&addr, addrlen, ntop, |
273 | sizeof(ntop), NULL, 0, flags)) != 0) { | 98 | sizeof(ntop), NULL, 0, flags)) != 0) { |
274 | error("get_socket_address: getnameinfo %d failed: %s", | 99 | error("%s: getnameinfo %d failed: %s", __func__, |
275 | flags, ssh_gai_strerror(r)); | 100 | flags, ssh_gai_strerror(r)); |
276 | return NULL; | 101 | return NULL; |
277 | } | 102 | } |
@@ -316,7 +141,8 @@ get_local_name(int fd) | |||
316 | 141 | ||
317 | /* Handle the case where we were passed a pipe */ | 142 | /* Handle the case where we were passed a pipe */ |
318 | if (gethostname(myname, sizeof(myname)) == -1) { | 143 | if (gethostname(myname, sizeof(myname)) == -1) { |
319 | verbose("get_local_name: gethostname: %s", strerror(errno)); | 144 | verbose("%s: gethostname: %s", __func__, strerror(errno)); |
145 | host = xstrdup("UNKNOWN"); | ||
320 | } else { | 146 | } else { |
321 | host = xstrdup(myname); | 147 | host = xstrdup(myname); |
322 | } | 148 | } |
@@ -324,51 +150,9 @@ get_local_name(int fd) | |||
324 | return host; | 150 | return host; |
325 | } | 151 | } |
326 | 152 | ||
327 | void | ||
328 | clear_cached_addr(void) | ||
329 | { | ||
330 | free(canonical_host_ip); | ||
331 | canonical_host_ip = NULL; | ||
332 | cached_port = -1; | ||
333 | } | ||
334 | |||
335 | /* | ||
336 | * Returns the IP-address of the remote host as a string. The returned | ||
337 | * string must not be freed. | ||
338 | */ | ||
339 | |||
340 | const char * | ||
341 | get_remote_ipaddr(void) | ||
342 | { | ||
343 | /* Check whether we have cached the ipaddr. */ | ||
344 | if (canonical_host_ip == NULL) { | ||
345 | if (packet_connection_is_on_socket()) { | ||
346 | canonical_host_ip = | ||
347 | get_peer_ipaddr(packet_get_connection_in()); | ||
348 | if (canonical_host_ip == NULL) | ||
349 | cleanup_exit(255); | ||
350 | } else { | ||
351 | /* If not on socket, return UNKNOWN. */ | ||
352 | canonical_host_ip = xstrdup("UNKNOWN"); | ||
353 | } | ||
354 | } | ||
355 | return canonical_host_ip; | ||
356 | } | ||
357 | |||
358 | const char * | ||
359 | get_remote_name_or_ip(u_int utmp_len, int use_dns) | ||
360 | { | ||
361 | static const char *remote = ""; | ||
362 | if (utmp_len > 0) | ||
363 | remote = get_canonical_hostname(use_dns); | ||
364 | if (utmp_len == 0 || strlen(remote) > utmp_len) | ||
365 | remote = get_remote_ipaddr(); | ||
366 | return remote; | ||
367 | } | ||
368 | |||
369 | /* Returns the local/remote port for the socket. */ | 153 | /* Returns the local/remote port for the socket. */ |
370 | 154 | ||
371 | int | 155 | static int |
372 | get_sock_port(int sock, int local) | 156 | get_sock_port(int sock, int local) |
373 | { | 157 | { |
374 | struct sockaddr_storage from; | 158 | struct sockaddr_storage from; |
@@ -402,27 +186,11 @@ get_sock_port(int sock, int local) | |||
402 | /* Return port number. */ | 186 | /* Return port number. */ |
403 | if ((r = getnameinfo((struct sockaddr *)&from, fromlen, NULL, 0, | 187 | if ((r = getnameinfo((struct sockaddr *)&from, fromlen, NULL, 0, |
404 | strport, sizeof(strport), NI_NUMERICSERV)) != 0) | 188 | strport, sizeof(strport), NI_NUMERICSERV)) != 0) |
405 | fatal("get_sock_port: getnameinfo NI_NUMERICSERV failed: %s", | 189 | fatal("%s: getnameinfo NI_NUMERICSERV failed: %s", __func__, |
406 | ssh_gai_strerror(r)); | 190 | ssh_gai_strerror(r)); |
407 | return atoi(strport); | 191 | return atoi(strport); |
408 | } | 192 | } |
409 | 193 | ||
410 | /* Returns remote/local port number for the current connection. */ | ||
411 | |||
412 | static int | ||
413 | get_port(int local) | ||
414 | { | ||
415 | /* | ||
416 | * If the connection is not a socket, return 65535. This is | ||
417 | * intentionally chosen to be an unprivileged port number. | ||
418 | */ | ||
419 | if (!packet_connection_is_on_socket()) | ||
420 | return 65535; | ||
421 | |||
422 | /* Get socket and return the port number. */ | ||
423 | return get_sock_port(packet_get_connection_in(), local); | ||
424 | } | ||
425 | |||
426 | int | 194 | int |
427 | get_peer_port(int sock) | 195 | get_peer_port(int sock) |
428 | { | 196 | { |
@@ -430,17 +198,7 @@ get_peer_port(int sock) | |||
430 | } | 198 | } |
431 | 199 | ||
432 | int | 200 | int |
433 | get_remote_port(void) | 201 | get_local_port(int sock) |
434 | { | ||
435 | /* Cache to avoid getpeername() on a dead connection */ | ||
436 | if (cached_port == -1) | ||
437 | cached_port = get_port(0); | ||
438 | |||
439 | return cached_port; | ||
440 | } | ||
441 | |||
442 | int | ||
443 | get_local_port(void) | ||
444 | { | 202 | { |
445 | return get_port(1); | 203 | return get_sock_port(sock, 1); |
446 | } | 204 | } |
diff --git a/canohost.h b/canohost.h index 4c8636f42..26d62855a 100644 --- a/canohost.h +++ b/canohost.h | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: canohost.h,v 1.11 2009/05/27 06:31:25 andreas Exp $ */ | 1 | /* $OpenBSD: canohost.h,v 1.12 2016/03/07 19:02:43 djm Exp $ */ |
2 | 2 | ||
3 | /* | 3 | /* |
4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
@@ -12,18 +12,15 @@ | |||
12 | * called by a name other than "ssh" or "Secure Shell". | 12 | * called by a name other than "ssh" or "Secure Shell". |
13 | */ | 13 | */ |
14 | 14 | ||
15 | const char *get_canonical_hostname(int); | 15 | #ifndef _CANOHOST_H |
16 | const char *get_remote_ipaddr(void); | 16 | #define _CANOHOST_H |
17 | const char *get_remote_name_or_ip(u_int, int); | ||
18 | 17 | ||
19 | char *get_peer_ipaddr(int); | 18 | char *get_peer_ipaddr(int); |
20 | int get_peer_port(int); | 19 | int get_peer_port(int); |
21 | char *get_local_ipaddr(int); | 20 | char *get_local_ipaddr(int); |
22 | char *get_local_name(int); | 21 | char *get_local_name(int); |
22 | int get_local_port(int); | ||
23 | 23 | ||
24 | int get_remote_port(void); | 24 | #endif /* _CANOHOST_H */ |
25 | int get_local_port(void); | ||
26 | int get_sock_port(int, int); | ||
27 | void clear_cached_addr(void); | ||
28 | 25 | ||
29 | void ipv64_normalise_mapped(struct sockaddr_storage *, socklen_t *); | 26 | void ipv64_normalise_mapped(struct sockaddr_storage *, socklen_t *); |
diff --git a/channels.c b/channels.c index c9d2015ee..7ee1f98d0 100644 --- a/channels.c +++ b/channels.c | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: channels.c,v 1.349 2016/02/05 13:28:19 naddy Exp $ */ | 1 | /* $OpenBSD: channels.c,v 1.350 2016/03/07 19:02:43 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
@@ -1416,7 +1416,7 @@ port_open_helper(Channel *c, char *rtype) | |||
1416 | { | 1416 | { |
1417 | char buf[1024]; | 1417 | char buf[1024]; |
1418 | char *local_ipaddr = get_local_ipaddr(c->sock); | 1418 | char *local_ipaddr = get_local_ipaddr(c->sock); |
1419 | int local_port = c->sock == -1 ? 65536 : get_sock_port(c->sock, 1); | 1419 | int local_port = c->sock == -1 ? 65536 : get_local_port(c->sock); |
1420 | char *remote_ipaddr = get_peer_ipaddr(c->sock); | 1420 | char *remote_ipaddr = get_peer_ipaddr(c->sock); |
1421 | int remote_port = get_peer_port(c->sock); | 1421 | int remote_port = get_peer_port(c->sock); |
1422 | 1422 | ||
@@ -2935,7 +2935,7 @@ channel_setup_fwd_listener_tcpip(int type, struct Forward *fwd, | |||
2935 | if (type == SSH_CHANNEL_RPORT_LISTENER && fwd->listen_port == 0 && | 2935 | if (type == SSH_CHANNEL_RPORT_LISTENER && fwd->listen_port == 0 && |
2936 | allocated_listen_port != NULL && | 2936 | allocated_listen_port != NULL && |
2937 | *allocated_listen_port == 0) { | 2937 | *allocated_listen_port == 0) { |
2938 | *allocated_listen_port = get_sock_port(sock, 1); | 2938 | *allocated_listen_port = get_local_port(sock); |
2939 | debug("Allocated listen port %d", | 2939 | debug("Allocated listen port %d", |
2940 | *allocated_listen_port); | 2940 | *allocated_listen_port); |
2941 | } | 2941 | } |
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: monitor.c,v 1.157 2016/02/15 23:32:37 djm Exp $ */ | 1 | /* $OpenBSD: monitor.c,v 1.158 2016/03/07 19:02:43 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Copyright 2002 Niels Provos <provos@citi.umich.edu> | 3 | * Copyright 2002 Niels Provos <provos@citi.umich.edu> |
4 | * Copyright 2002 Markus Friedl <markus@openbsd.org> | 4 | * Copyright 2002 Markus Friedl <markus@openbsd.org> |
@@ -1469,6 +1469,7 @@ mm_answer_keyverify(int sock, Buffer *m) | |||
1469 | static void | 1469 | static void |
1470 | mm_record_login(Session *s, struct passwd *pw) | 1470 | mm_record_login(Session *s, struct passwd *pw) |
1471 | { | 1471 | { |
1472 | struct ssh *ssh = active_state; /* XXX */ | ||
1472 | socklen_t fromlen; | 1473 | socklen_t fromlen; |
1473 | struct sockaddr_storage from; | 1474 | struct sockaddr_storage from; |
1474 | 1475 | ||
@@ -1490,7 +1491,7 @@ mm_record_login(Session *s, struct passwd *pw) | |||
1490 | } | 1491 | } |
1491 | /* Record that there was a login on that tty from the remote host. */ | 1492 | /* Record that there was a login on that tty from the remote host. */ |
1492 | record_login(s->pid, s->tty, pw->pw_name, pw->pw_uid, | 1493 | record_login(s->pid, s->tty, pw->pw_name, pw->pw_uid, |
1493 | get_remote_name_or_ip(utmp_len, options.use_dns), | 1494 | session_get_remote_name_or_ip(ssh, utmp_len, options.use_dns), |
1494 | (struct sockaddr *)&from, fromlen); | 1495 | (struct sockaddr *)&from, fromlen); |
1495 | } | 1496 | } |
1496 | 1497 | ||
diff --git a/monitor_wrap.c b/monitor_wrap.c index c5db6df48..552004902 100644 --- a/monitor_wrap.c +++ b/monitor_wrap.c | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: monitor_wrap.c,v 1.87 2016/01/14 16:17:40 markus Exp $ */ | 1 | /* $OpenBSD: monitor_wrap.c,v 1.88 2016/03/07 19:02:43 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Copyright 2002 Niels Provos <provos@citi.umich.edu> | 3 | * Copyright 2002 Niels Provos <provos@citi.umich.edu> |
4 | * Copyright 2002 Markus Friedl <markus@openbsd.org> | 4 | * Copyright 2002 Markus Friedl <markus@openbsd.org> |
@@ -378,15 +378,15 @@ mm_user_key_allowed(struct passwd *pw, Key *key, int pubkey_auth_attempt) | |||
378 | } | 378 | } |
379 | 379 | ||
380 | int | 380 | int |
381 | mm_hostbased_key_allowed(struct passwd *pw, char *user, char *host, | 381 | mm_hostbased_key_allowed(struct passwd *pw, const char *user, const char *host, |
382 | Key *key) | 382 | Key *key) |
383 | { | 383 | { |
384 | return (mm_key_allowed(MM_HOSTKEY, user, host, key, 0)); | 384 | return (mm_key_allowed(MM_HOSTKEY, user, host, key, 0)); |
385 | } | 385 | } |
386 | 386 | ||
387 | int | 387 | int |
388 | mm_auth_rhosts_rsa_key_allowed(struct passwd *pw, char *user, | 388 | mm_auth_rhosts_rsa_key_allowed(struct passwd *pw, const char *user, |
389 | char *host, Key *key) | 389 | const char *host, Key *key) |
390 | { | 390 | { |
391 | int ret; | 391 | int ret; |
392 | 392 | ||
@@ -397,8 +397,8 @@ mm_auth_rhosts_rsa_key_allowed(struct passwd *pw, char *user, | |||
397 | } | 397 | } |
398 | 398 | ||
399 | int | 399 | int |
400 | mm_key_allowed(enum mm_keytype type, char *user, char *host, Key *key, | 400 | mm_key_allowed(enum mm_keytype type, const char *user, const char *host, |
401 | int pubkey_auth_attempt) | 401 | Key *key, int pubkey_auth_attempt) |
402 | { | 402 | { |
403 | Buffer m; | 403 | Buffer m; |
404 | u_char *blob; | 404 | u_char *blob; |
diff --git a/monitor_wrap.h b/monitor_wrap.h index eb820aeea..9fd02b30c 100644 --- a/monitor_wrap.h +++ b/monitor_wrap.h | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: monitor_wrap.h,v 1.29 2015/12/04 16:41:28 markus Exp $ */ | 1 | /* $OpenBSD: monitor_wrap.h,v 1.30 2016/03/07 19:02:43 djm Exp $ */ |
2 | 2 | ||
3 | /* | 3 | /* |
4 | * Copyright 2002 Niels Provos <provos@citi.umich.edu> | 4 | * Copyright 2002 Niels Provos <provos@citi.umich.edu> |
@@ -45,10 +45,12 @@ void mm_inform_authserv(char *, char *); | |||
45 | struct passwd *mm_getpwnamallow(const char *); | 45 | struct passwd *mm_getpwnamallow(const char *); |
46 | char *mm_auth2_read_banner(void); | 46 | char *mm_auth2_read_banner(void); |
47 | int mm_auth_password(struct Authctxt *, char *); | 47 | int mm_auth_password(struct Authctxt *, char *); |
48 | int mm_key_allowed(enum mm_keytype, char *, char *, Key *, int); | 48 | int mm_key_allowed(enum mm_keytype, const char *, const char *, Key *, int); |
49 | int mm_user_key_allowed(struct passwd *, Key *, int); | 49 | int mm_user_key_allowed(struct passwd *, Key *, int); |
50 | int mm_hostbased_key_allowed(struct passwd *, char *, char *, Key *); | 50 | int mm_hostbased_key_allowed(struct passwd *, const char *, |
51 | int mm_auth_rhosts_rsa_key_allowed(struct passwd *, char *, char *, Key *); | 51 | const char *, Key *); |
52 | int mm_auth_rhosts_rsa_key_allowed(struct passwd *, const char *, | ||
53 | const char *, Key *); | ||
52 | int mm_key_verify(Key *, u_char *, u_int, u_char *, u_int); | 54 | int mm_key_verify(Key *, u_char *, u_int, u_char *, u_int); |
53 | int mm_auth_rsa_key_allowed(struct passwd *, BIGNUM *, Key **); | 55 | int mm_auth_rsa_key_allowed(struct passwd *, BIGNUM *, Key **); |
54 | int mm_auth_rsa_verify_response(Key *, BIGNUM *, u_char *); | 56 | int mm_auth_rsa_verify_response(Key *, BIGNUM *, u_char *); |
@@ -144,10 +144,6 @@ void packet_disconnect(const char *, ...) | |||
144 | ssh_packet_get_state(active_state, m) | 144 | ssh_packet_get_state(active_state, m) |
145 | #define packet_set_state(m) \ | 145 | #define packet_set_state(m) \ |
146 | ssh_packet_set_state(active_state, m) | 146 | ssh_packet_set_state(active_state, m) |
147 | #if 0 | ||
148 | #define get_remote_ipaddr() \ | ||
149 | ssh_remote_ipaddr(active_state) | ||
150 | #endif | ||
151 | #define packet_get_raw(lenp) \ | 147 | #define packet_get_raw(lenp) \ |
152 | sshpkt_ptr(active_state, lenp) | 148 | sshpkt_ptr(active_state, lenp) |
153 | #define packet_get_ecpoint(c,p) \ | 149 | #define packet_get_ecpoint(c,p) \ |
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: packet.c,v 1.229 2016/02/17 22:20:14 djm Exp $ */ | 1 | /* $OpenBSD: packet.c,v 1.230 2016/03/07 19:02:43 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
@@ -52,6 +52,7 @@ | |||
52 | #include <arpa/inet.h> | 52 | #include <arpa/inet.h> |
53 | 53 | ||
54 | #include <errno.h> | 54 | #include <errno.h> |
55 | #include <netdb.h> | ||
55 | #include <stdarg.h> | 56 | #include <stdarg.h> |
56 | #include <stdio.h> | 57 | #include <stdio.h> |
57 | #include <stdlib.h> | 58 | #include <stdlib.h> |
@@ -296,7 +297,7 @@ ssh_packet_set_connection(struct ssh *ssh, int fd_in, int fd_out) | |||
296 | (r = cipher_init(&state->receive_context, none, | 297 | (r = cipher_init(&state->receive_context, none, |
297 | (const u_char *)"", 0, NULL, 0, CIPHER_DECRYPT)) != 0) { | 298 | (const u_char *)"", 0, NULL, 0, CIPHER_DECRYPT)) != 0) { |
298 | error("%s: cipher_init failed: %s", __func__, ssh_err(r)); | 299 | error("%s: cipher_init failed: %s", __func__, ssh_err(r)); |
299 | free(ssh); | 300 | free(ssh); /* XXX need ssh_free_session_state? */ |
300 | return NULL; | 301 | return NULL; |
301 | } | 302 | } |
302 | state->newkeys[MODE_IN] = state->newkeys[MODE_OUT] = NULL; | 303 | state->newkeys[MODE_IN] = state->newkeys[MODE_OUT] = NULL; |
@@ -379,6 +380,9 @@ ssh_packet_connection_is_on_socket(struct ssh *ssh) | |||
379 | struct sockaddr_storage from, to; | 380 | struct sockaddr_storage from, to; |
380 | socklen_t fromlen, tolen; | 381 | socklen_t fromlen, tolen; |
381 | 382 | ||
383 | if (state->connection_in == -1 || state->connection_out == -1) | ||
384 | return 0; | ||
385 | |||
382 | /* filedescriptors in and out are the same, so it's a socket */ | 386 | /* filedescriptors in and out are the same, so it's a socket */ |
383 | if (state->connection_in == state->connection_out) | 387 | if (state->connection_in == state->connection_out) |
384 | return 1; | 388 | return 1; |
@@ -468,10 +472,14 @@ ssh_remote_ipaddr(struct ssh *ssh) | |||
468 | if (ssh->remote_ipaddr == NULL) { | 472 | if (ssh->remote_ipaddr == NULL) { |
469 | if (ssh_packet_connection_is_on_socket(ssh)) { | 473 | if (ssh_packet_connection_is_on_socket(ssh)) { |
470 | ssh->remote_ipaddr = get_peer_ipaddr(sock); | 474 | ssh->remote_ipaddr = get_peer_ipaddr(sock); |
471 | ssh->remote_port = get_sock_port(sock, 0); | 475 | ssh->remote_port = get_peer_port(sock); |
476 | ssh->local_ipaddr = get_local_ipaddr(sock); | ||
477 | ssh->local_port = get_local_port(sock); | ||
472 | } else { | 478 | } else { |
473 | ssh->remote_ipaddr = strdup("UNKNOWN"); | 479 | ssh->remote_ipaddr = strdup("UNKNOWN"); |
474 | ssh->remote_port = 0; | 480 | ssh->remote_port = 65535; |
481 | ssh->local_ipaddr = strdup("UNKNOWN"); | ||
482 | ssh->local_port = 65535; | ||
475 | } | 483 | } |
476 | } | 484 | } |
477 | return ssh->remote_ipaddr; | 485 | return ssh->remote_ipaddr; |
@@ -486,6 +494,27 @@ ssh_remote_port(struct ssh *ssh) | |||
486 | return ssh->remote_port; | 494 | return ssh->remote_port; |
487 | } | 495 | } |
488 | 496 | ||
497 | /* | ||
498 | * Returns the IP-address of the local host as a string. The returned | ||
499 | * string must not be freed. | ||
500 | */ | ||
501 | |||
502 | const char * | ||
503 | ssh_local_ipaddr(struct ssh *ssh) | ||
504 | { | ||
505 | (void)ssh_remote_ipaddr(ssh); /* Will lookup and cache. */ | ||
506 | return ssh->local_ipaddr; | ||
507 | } | ||
508 | |||
509 | /* Returns the port number of the local host. */ | ||
510 | |||
511 | int | ||
512 | ssh_local_port(struct ssh *ssh) | ||
513 | { | ||
514 | (void)ssh_remote_ipaddr(ssh); /* Will lookup and cache. */ | ||
515 | return ssh->local_port; | ||
516 | } | ||
517 | |||
489 | /* Closes the connection and clears and frees internal data structures. */ | 518 | /* Closes the connection and clears and frees internal data structures. */ |
490 | 519 | ||
491 | void | 520 | void |
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: packet.h,v 1.70 2016/02/08 10:57:07 djm Exp $ */ | 1 | /* $OpenBSD: packet.h,v 1.71 2016/03/07 19:02:43 djm Exp $ */ |
2 | 2 | ||
3 | /* | 3 | /* |
4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 4 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
@@ -56,9 +56,11 @@ struct ssh { | |||
56 | /* Key exchange */ | 56 | /* Key exchange */ |
57 | struct kex *kex; | 57 | struct kex *kex; |
58 | 58 | ||
59 | /* cached remote ip address and port*/ | 59 | /* cached local and remote ip addresses and ports */ |
60 | char *remote_ipaddr; | 60 | char *remote_ipaddr; |
61 | int remote_port; | 61 | int remote_port; |
62 | char *local_ipaddr; | ||
63 | int local_port; | ||
62 | 64 | ||
63 | /* Dispatcher table */ | 65 | /* Dispatcher table */ |
64 | dispatch_fn *dispatch[DISPATCH_MAX]; | 66 | dispatch_fn *dispatch[DISPATCH_MAX]; |
@@ -145,6 +147,8 @@ int ssh_packet_set_state(struct ssh *, struct sshbuf *); | |||
145 | 147 | ||
146 | const char *ssh_remote_ipaddr(struct ssh *); | 148 | const char *ssh_remote_ipaddr(struct ssh *); |
147 | int ssh_remote_port(struct ssh *); | 149 | int ssh_remote_port(struct ssh *); |
150 | const char *ssh_local_ipaddr(struct ssh *); | ||
151 | int ssh_local_port(struct ssh *); | ||
148 | 152 | ||
149 | void ssh_packet_set_rekey_limits(struct ssh *, u_int64_t, time_t); | 153 | void ssh_packet_set_rekey_limits(struct ssh *, u_int64_t, time_t); |
150 | time_t ssh_packet_get_rekey_timeout(struct ssh *); | 154 | time_t ssh_packet_get_rekey_timeout(struct ssh *); |
diff --git a/servconf.c b/servconf.c index b19d30e18..ba39dce1d 100644 --- a/servconf.c +++ b/servconf.c | |||
@@ -1,5 +1,5 @@ | |||
1 | 1 | ||
2 | /* $OpenBSD: servconf.c,v 1.285 2016/02/17 05:29:04 djm Exp $ */ | 2 | /* $OpenBSD: servconf.c,v 1.286 2016/03/07 19:02:43 djm Exp $ */ |
3 | /* | 3 | /* |
4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
5 | * All rights reserved | 5 | * All rights reserved |
@@ -706,14 +706,15 @@ process_queued_listen_addrs(ServerOptions *options) | |||
706 | struct connection_info * | 706 | struct connection_info * |
707 | get_connection_info(int populate, int use_dns) | 707 | get_connection_info(int populate, int use_dns) |
708 | { | 708 | { |
709 | struct ssh *ssh = active_state; /* XXX */ | ||
709 | static struct connection_info ci; | 710 | static struct connection_info ci; |
710 | 711 | ||
711 | if (!populate) | 712 | if (!populate) |
712 | return &ci; | 713 | return &ci; |
713 | ci.host = get_canonical_hostname(use_dns); | 714 | ci.host = auth_get_canonical_hostname(ssh, use_dns); |
714 | ci.address = get_remote_ipaddr(); | 715 | ci.address = ssh_remote_ipaddr(ssh); |
715 | ci.laddress = get_local_ipaddr(packet_get_connection_in()); | 716 | ci.laddress = ssh_local_ipaddr(ssh); |
716 | ci.lport = get_local_port(); | 717 | ci.lport = ssh_local_port(ssh); |
717 | return &ci; | 718 | return &ci; |
718 | } | 719 | } |
719 | 720 | ||
diff --git a/serverloop.c b/serverloop.c index e6a92476f..f9e3e5d14 100644 --- a/serverloop.c +++ b/serverloop.c | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: serverloop.c,v 1.183 2016/03/04 03:35:44 djm Exp $ */ | 1 | /* $OpenBSD: serverloop.c,v 1.184 2016/03/07 19:02:43 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
@@ -395,6 +395,7 @@ wait_until_can_do_something(fd_set **readsetp, fd_set **writesetp, int *maxfdp, | |||
395 | static void | 395 | static void |
396 | process_input(fd_set *readset) | 396 | process_input(fd_set *readset) |
397 | { | 397 | { |
398 | struct ssh *ssh = active_state; /* XXX */ | ||
398 | int len; | 399 | int len; |
399 | char buf[16384]; | 400 | char buf[16384]; |
400 | 401 | ||
@@ -402,8 +403,8 @@ process_input(fd_set *readset) | |||
402 | if (FD_ISSET(connection_in, readset)) { | 403 | if (FD_ISSET(connection_in, readset)) { |
403 | len = read(connection_in, buf, sizeof(buf)); | 404 | len = read(connection_in, buf, sizeof(buf)); |
404 | if (len == 0) { | 405 | if (len == 0) { |
405 | verbose("Connection closed by %.100s", | 406 | verbose("Connection closed by %.100s port %d", |
406 | get_remote_ipaddr()); | 407 | ssh_remote_ipaddr(ssh), ssh_remote_port(ssh)); |
407 | connection_closed = 1; | 408 | connection_closed = 1; |
408 | if (compat20) | 409 | if (compat20) |
409 | return; | 410 | return; |
@@ -412,8 +413,9 @@ process_input(fd_set *readset) | |||
412 | if (errno != EINTR && errno != EAGAIN && | 413 | if (errno != EINTR && errno != EAGAIN && |
413 | errno != EWOULDBLOCK) { | 414 | errno != EWOULDBLOCK) { |
414 | verbose("Read error from remote host " | 415 | verbose("Read error from remote host " |
415 | "%.100s: %.100s", | 416 | "%.100s port %d: %.100s", |
416 | get_remote_ipaddr(), strerror(errno)); | 417 | ssh_remote_ipaddr(ssh), |
418 | ssh_remote_port(ssh), strerror(errno)); | ||
417 | cleanup_exit(255); | 419 | cleanup_exit(255); |
418 | } | 420 | } |
419 | } else { | 421 | } else { |
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: session.c,v 1.280 2016/02/16 03:37:48 djm Exp $ */ | 1 | /* $OpenBSD: session.c,v 1.281 2016/03/07 19:02:43 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 3 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
4 | * All rights reserved | 4 | * All rights reserved |
@@ -778,6 +778,7 @@ do_pre_login(Session *s) | |||
778 | int | 778 | int |
779 | do_exec(Session *s, const char *command) | 779 | do_exec(Session *s, const char *command) |
780 | { | 780 | { |
781 | struct ssh *ssh = active_state; /* XXX */ | ||
781 | int ret; | 782 | int ret; |
782 | const char *forced = NULL, *tty = NULL; | 783 | const char *forced = NULL, *tty = NULL; |
783 | char session_type[1024]; | 784 | char session_type[1024]; |
@@ -820,8 +821,8 @@ do_exec(Session *s, const char *command) | |||
820 | tty == NULL ? "" : " on ", | 821 | tty == NULL ? "" : " on ", |
821 | tty == NULL ? "" : tty, | 822 | tty == NULL ? "" : tty, |
822 | s->pw->pw_name, | 823 | s->pw->pw_name, |
823 | get_remote_ipaddr(), | 824 | ssh_remote_ipaddr(ssh), |
824 | get_remote_port(), | 825 | ssh_remote_port(ssh), |
825 | s->self); | 826 | s->self); |
826 | 827 | ||
827 | #ifdef SSH_AUDIT_EVENTS | 828 | #ifdef SSH_AUDIT_EVENTS |
@@ -856,6 +857,7 @@ do_exec(Session *s, const char *command) | |||
856 | void | 857 | void |
857 | do_login(Session *s, const char *command) | 858 | do_login(Session *s, const char *command) |
858 | { | 859 | { |
860 | struct ssh *ssh = active_state; /* XXX */ | ||
859 | socklen_t fromlen; | 861 | socklen_t fromlen; |
860 | struct sockaddr_storage from; | 862 | struct sockaddr_storage from; |
861 | struct passwd * pw = s->pw; | 863 | struct passwd * pw = s->pw; |
@@ -878,7 +880,7 @@ do_login(Session *s, const char *command) | |||
878 | /* Record that there was a login on that tty from the remote host. */ | 880 | /* Record that there was a login on that tty from the remote host. */ |
879 | if (!use_privsep) | 881 | if (!use_privsep) |
880 | record_login(pid, s->tty, pw->pw_name, pw->pw_uid, | 882 | record_login(pid, s->tty, pw->pw_name, pw->pw_uid, |
881 | get_remote_name_or_ip(utmp_len, | 883 | session_get_remote_name_or_ip(ssh, utmp_len, |
882 | options.use_dns), | 884 | options.use_dns), |
883 | (struct sockaddr *)&from, fromlen); | 885 | (struct sockaddr *)&from, fromlen); |
884 | 886 | ||
@@ -1139,6 +1141,7 @@ copy_environment(char **source, char ***env, u_int *envsize) | |||
1139 | static char ** | 1141 | static char ** |
1140 | do_setup_env(Session *s, const char *shell) | 1142 | do_setup_env(Session *s, const char *shell) |
1141 | { | 1143 | { |
1144 | struct ssh *ssh = active_state; /* XXX */ | ||
1142 | char buf[256]; | 1145 | char buf[256]; |
1143 | u_int i, envsize; | 1146 | u_int i, envsize; |
1144 | char **env, *laddr; | 1147 | char **env, *laddr; |
@@ -1240,12 +1243,14 @@ do_setup_env(Session *s, const char *shell) | |||
1240 | 1243 | ||
1241 | /* SSH_CLIENT deprecated */ | 1244 | /* SSH_CLIENT deprecated */ |
1242 | snprintf(buf, sizeof buf, "%.50s %d %d", | 1245 | snprintf(buf, sizeof buf, "%.50s %d %d", |
1243 | get_remote_ipaddr(), get_remote_port(), get_local_port()); | 1246 | ssh_remote_ipaddr(ssh), ssh_remote_port(ssh), |
1247 | ssh_local_port(ssh)); | ||
1244 | child_set_env(&env, &envsize, "SSH_CLIENT", buf); | 1248 | child_set_env(&env, &envsize, "SSH_CLIENT", buf); |
1245 | 1249 | ||
1246 | laddr = get_local_ipaddr(packet_get_connection_in()); | 1250 | laddr = get_local_ipaddr(packet_get_connection_in()); |
1247 | snprintf(buf, sizeof buf, "%.50s %d %.50s %d", | 1251 | snprintf(buf, sizeof buf, "%.50s %d %.50s %d", |
1248 | get_remote_ipaddr(), get_remote_port(), laddr, get_local_port()); | 1252 | ssh_remote_ipaddr(ssh), ssh_remote_port(ssh), |
1253 | laddr, ssh_local_port(ssh)); | ||
1249 | free(laddr); | 1254 | free(laddr); |
1250 | child_set_env(&env, &envsize, "SSH_CONNECTION", buf); | 1255 | child_set_env(&env, &envsize, "SSH_CONNECTION", buf); |
1251 | 1256 | ||
@@ -1662,6 +1667,7 @@ child_close_fds(void) | |||
1662 | void | 1667 | void |
1663 | do_child(Session *s, const char *command) | 1668 | do_child(Session *s, const char *command) |
1664 | { | 1669 | { |
1670 | struct ssh *ssh = active_state; /* XXX */ | ||
1665 | extern char **environ; | 1671 | extern char **environ; |
1666 | char **env; | 1672 | char **env; |
1667 | char *argv[ARGV_MAX]; | 1673 | char *argv[ARGV_MAX]; |
@@ -1738,14 +1744,14 @@ do_child(Session *s, const char *command) | |||
1738 | 1744 | ||
1739 | /* we have to stash the hostname before we close our socket. */ | 1745 | /* we have to stash the hostname before we close our socket. */ |
1740 | if (options.use_login) | 1746 | if (options.use_login) |
1741 | hostname = get_remote_name_or_ip(utmp_len, | 1747 | hostname = session_get_remote_name_or_ip(ssh, utmp_len, |
1742 | options.use_dns); | 1748 | options.use_dns); |
1743 | /* | 1749 | /* |
1744 | * Close the connection descriptors; note that this is the child, and | 1750 | * Close the connection descriptors; note that this is the child, and |
1745 | * the server will still have the socket open, and it is important | 1751 | * the server will still have the socket open, and it is important |
1746 | * that we do not shutdown it. Note that the descriptors cannot be | 1752 | * that we do not shutdown it. Note that the descriptors cannot be |
1747 | * closed before building the environment, as we call | 1753 | * closed before building the environment, as we call |
1748 | * get_remote_ipaddr there. | 1754 | * ssh_remote_ipaddr there. |
1749 | */ | 1755 | */ |
1750 | child_close_fds(); | 1756 | child_close_fds(); |
1751 | 1757 | ||
@@ -2498,12 +2504,13 @@ session_exit_message(Session *s, int status) | |||
2498 | void | 2504 | void |
2499 | session_close(Session *s) | 2505 | session_close(Session *s) |
2500 | { | 2506 | { |
2507 | struct ssh *ssh = active_state; /* XXX */ | ||
2501 | u_int i; | 2508 | u_int i; |
2502 | 2509 | ||
2503 | verbose("Close session: user %s from %.200s port %d id %d", | 2510 | verbose("Close session: user %s from %.200s port %d id %d", |
2504 | s->pw->pw_name, | 2511 | s->pw->pw_name, |
2505 | get_remote_ipaddr(), | 2512 | ssh_remote_ipaddr(ssh), |
2506 | get_remote_port(), | 2513 | ssh_remote_port(ssh), |
2507 | s->self); | 2514 | s->self); |
2508 | 2515 | ||
2509 | if (s->ttyfd != -1) | 2516 | if (s->ttyfd != -1) |
@@ -2772,3 +2779,18 @@ do_cleanup(Authctxt *authctxt) | |||
2772 | if (!use_privsep || mm_is_monitor()) | 2779 | if (!use_privsep || mm_is_monitor()) |
2773 | session_destroy_all(session_pty_cleanup2); | 2780 | session_destroy_all(session_pty_cleanup2); |
2774 | } | 2781 | } |
2782 | |||
2783 | /* Return a name for the remote host that fits inside utmp_size */ | ||
2784 | |||
2785 | const char * | ||
2786 | session_get_remote_name_or_ip(struct ssh *ssh, u_int utmp_size, int use_dns) | ||
2787 | { | ||
2788 | const char *remote = ""; | ||
2789 | |||
2790 | if (utmp_size > 0) | ||
2791 | remote = auth_get_canonical_hostname(ssh, use_dns); | ||
2792 | if (utmp_size == 0 || strlen(remote) > utmp_size) | ||
2793 | remote = ssh_remote_ipaddr(ssh); | ||
2794 | return remote; | ||
2795 | } | ||
2796 | |||
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: session.h,v 1.31 2013/10/14 21:20:52 djm Exp $ */ | 1 | /* $OpenBSD: session.h,v 1.32 2016/03/07 19:02:43 djm Exp $ */ |
2 | 2 | ||
3 | /* | 3 | /* |
4 | * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. | 4 | * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved. |
@@ -81,4 +81,6 @@ void do_setusercontext(struct passwd *); | |||
81 | void child_set_env(char ***envp, u_int *envsizep, const char *name, | 81 | void child_set_env(char ***envp, u_int *envsizep, const char *name, |
82 | const char *value); | 82 | const char *value); |
83 | 83 | ||
84 | const char *session_get_remote_name_or_ip(struct ssh *, u_int, int); | ||
85 | |||
84 | #endif | 86 | #endif |
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: ssh.c,v 1.436 2016/02/15 09:47:49 dtucker Exp $ */ | 1 | /* $OpenBSD: ssh.c,v 1.437 2016/03/07 19:02:43 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
@@ -513,6 +513,7 @@ set_addrinfo_port(struct addrinfo *addrs, int port) | |||
513 | int | 513 | int |
514 | main(int ac, char **av) | 514 | main(int ac, char **av) |
515 | { | 515 | { |
516 | struct ssh *ssh = NULL; | ||
516 | int i, r, opt, exit_status, use_syslog, config_test = 0; | 517 | int i, r, opt, exit_status, use_syslog, config_test = 0; |
517 | char *p, *cp, *line, *argv0, buf[PATH_MAX], *host_arg, *logfile; | 518 | char *p, *cp, *line, *argv0, buf[PATH_MAX], *host_arg, *logfile; |
518 | char thishost[NI_MAXHOST], shorthost[NI_MAXHOST], portstr[NI_MAXSERV]; | 519 | char thishost[NI_MAXHOST], shorthost[NI_MAXHOST], portstr[NI_MAXSERV]; |
@@ -1220,6 +1221,8 @@ main(int ac, char **av) | |||
1220 | packet_set_timeout(options.server_alive_interval, | 1221 | packet_set_timeout(options.server_alive_interval, |
1221 | options.server_alive_count_max); | 1222 | options.server_alive_count_max); |
1222 | 1223 | ||
1224 | ssh = active_state; /* XXX */ | ||
1225 | |||
1223 | if (timeout_ms > 0) | 1226 | if (timeout_ms > 0) |
1224 | debug3("timeout: %d ms remain after connect", timeout_ms); | 1227 | debug3("timeout: %d ms remain after connect", timeout_ms); |
1225 | 1228 | ||
@@ -1346,7 +1349,7 @@ main(int ac, char **av) | |||
1346 | 1349 | ||
1347 | if (packet_connection_is_on_socket()) { | 1350 | if (packet_connection_is_on_socket()) { |
1348 | verbose("Authenticated to %s ([%s]:%d).", host, | 1351 | verbose("Authenticated to %s ([%s]:%d).", host, |
1349 | get_remote_ipaddr(), get_remote_port()); | 1352 | ssh_remote_ipaddr(ssh), ssh_remote_port(ssh)); |
1350 | } else { | 1353 | } else { |
1351 | verbose("Authenticated to %s (via proxy).", host); | 1354 | verbose("Authenticated to %s (via proxy).", host); |
1352 | } | 1355 | } |
@@ -1,4 +1,4 @@ | |||
1 | /* $OpenBSD: sshd.c,v 1.465 2016/02/15 09:47:49 dtucker Exp $ */ | 1 | /* $OpenBSD: sshd.c,v 1.466 2016/03/07 19:02:43 djm Exp $ */ |
2 | /* | 2 | /* |
3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> | 3 | * Author: Tatu Ylonen <ylo@cs.hut.fi> |
4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland | 4 | * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland |
@@ -371,7 +371,8 @@ grace_alarm_handler(int sig) | |||
371 | } | 371 | } |
372 | 372 | ||
373 | /* Log error and exit. */ | 373 | /* Log error and exit. */ |
374 | sigdie("Timeout before authentication for %s", get_remote_ipaddr()); | 374 | sigdie("Timeout before authentication for %s port %d", |
375 | ssh_remote_ipaddr(active_state), ssh_remote_port(active_state)); | ||
375 | } | 376 | } |
376 | 377 | ||
377 | /* | 378 | /* |
@@ -407,7 +408,7 @@ key_regeneration_alarm(int sig) | |||
407 | } | 408 | } |
408 | 409 | ||
409 | static void | 410 | static void |
410 | sshd_exchange_identification(int sock_in, int sock_out) | 411 | sshd_exchange_identification(struct ssh *ssh, int sock_in, int sock_out) |
411 | { | 412 | { |
412 | u_int i; | 413 | u_int i; |
413 | int mismatch; | 414 | int mismatch; |
@@ -439,7 +440,8 @@ sshd_exchange_identification(int sock_in, int sock_out) | |||
439 | if (atomicio(vwrite, sock_out, server_version_string, | 440 | if (atomicio(vwrite, sock_out, server_version_string, |
440 | strlen(server_version_string)) | 441 | strlen(server_version_string)) |
441 | != strlen(server_version_string)) { | 442 | != strlen(server_version_string)) { |
442 | logit("Could not write ident string to %s", get_remote_ipaddr()); | 443 | logit("Could not write ident string to %s port %d", |
444 | ssh_remote_ipaddr(ssh), ssh_remote_port(ssh)); | ||
443 | cleanup_exit(255); | 445 | cleanup_exit(255); |
444 | } | 446 | } |
445 | 447 | ||
@@ -447,8 +449,9 @@ sshd_exchange_identification(int sock_in, int sock_out) | |||
447 | memset(buf, 0, sizeof(buf)); | 449 | memset(buf, 0, sizeof(buf)); |
448 | for (i = 0; i < sizeof(buf) - 1; i++) { | 450 | for (i = 0; i < sizeof(buf) - 1; i++) { |
449 | if (atomicio(read, sock_in, &buf[i], 1) != 1) { | 451 | if (atomicio(read, sock_in, &buf[i], 1) != 1) { |
450 | logit("Did not receive identification string from %s", | 452 | logit("Did not receive identification string " |
451 | get_remote_ipaddr()); | 453 | "from %s port %d", |
454 | ssh_remote_ipaddr(ssh), ssh_remote_port(ssh)); | ||
452 | cleanup_exit(255); | 455 | cleanup_exit(255); |
453 | } | 456 | } |
454 | if (buf[i] == '\r') { | 457 | if (buf[i] == '\r') { |
@@ -477,7 +480,7 @@ sshd_exchange_identification(int sock_in, int sock_out) | |||
477 | (void) atomicio(vwrite, sock_out, s, strlen(s)); | 480 | (void) atomicio(vwrite, sock_out, s, strlen(s)); |
478 | logit("Bad protocol version identification '%.100s' " | 481 | logit("Bad protocol version identification '%.100s' " |
479 | "from %s port %d", client_version_string, | 482 | "from %s port %d", client_version_string, |
480 | get_remote_ipaddr(), get_remote_port()); | 483 | ssh_remote_ipaddr(ssh), ssh_remote_port(ssh)); |
481 | close(sock_in); | 484 | close(sock_in); |
482 | close(sock_out); | 485 | close(sock_out); |
483 | cleanup_exit(255); | 486 | cleanup_exit(255); |
@@ -485,23 +488,25 @@ sshd_exchange_identification(int sock_in, int sock_out) | |||
485 | debug("Client protocol version %d.%d; client software version %.100s", | 488 | debug("Client protocol version %d.%d; client software version %.100s", |
486 | remote_major, remote_minor, remote_version); | 489 | remote_major, remote_minor, remote_version); |
487 | 490 | ||
488 | active_state->compat = compat_datafellows(remote_version); | 491 | ssh->compat = compat_datafellows(remote_version); |
489 | 492 | ||
490 | if ((datafellows & SSH_BUG_PROBE) != 0) { | 493 | if ((ssh->compat & SSH_BUG_PROBE) != 0) { |
491 | logit("probed from %s with %s. Don't panic.", | 494 | logit("probed from %s port %d with %s. Don't panic.", |
492 | get_remote_ipaddr(), client_version_string); | 495 | ssh_remote_ipaddr(ssh), ssh_remote_port(ssh), |
496 | client_version_string); | ||
493 | cleanup_exit(255); | 497 | cleanup_exit(255); |
494 | } | 498 | } |
495 | if ((datafellows & SSH_BUG_SCANNER) != 0) { | 499 | if ((ssh->compat & SSH_BUG_SCANNER) != 0) { |
496 | logit("scanned from %s with %s. Don't panic.", | 500 | logit("scanned from %s port %d with %s. Don't panic.", |
497 | get_remote_ipaddr(), client_version_string); | 501 | ssh_remote_ipaddr(ssh), ssh_remote_port(ssh), |
502 | client_version_string); | ||
498 | cleanup_exit(255); | 503 | cleanup_exit(255); |
499 | } | 504 | } |
500 | if ((datafellows & SSH_BUG_RSASIGMD5) != 0) { | 505 | if ((ssh->compat & SSH_BUG_RSASIGMD5) != 0) { |
501 | logit("Client version \"%.100s\" uses unsafe RSA signature " | 506 | logit("Client version \"%.100s\" uses unsafe RSA signature " |
502 | "scheme; disabling use of RSA keys", remote_version); | 507 | "scheme; disabling use of RSA keys", remote_version); |
503 | } | 508 | } |
504 | if ((datafellows & SSH_BUG_DERIVEKEY) != 0) { | 509 | if ((ssh->compat & SSH_BUG_DERIVEKEY) != 0) { |
505 | fatal("Client version \"%.100s\" uses unsafe key agreement; " | 510 | fatal("Client version \"%.100s\" uses unsafe key agreement; " |
506 | "refusing connection", remote_version); | 511 | "refusing connection", remote_version); |
507 | } | 512 | } |
@@ -546,8 +551,9 @@ sshd_exchange_identification(int sock_in, int sock_out) | |||
546 | (void) atomicio(vwrite, sock_out, s, strlen(s)); | 551 | (void) atomicio(vwrite, sock_out, s, strlen(s)); |
547 | close(sock_in); | 552 | close(sock_in); |
548 | close(sock_out); | 553 | close(sock_out); |
549 | logit("Protocol major versions differ for %s: %.200s vs. %.200s", | 554 | logit("Protocol major versions differ for %s port %d: " |
550 | get_remote_ipaddr(), | 555 | "%.200s vs. %.200s", |
556 | ssh_remote_ipaddr(ssh), ssh_remote_port(ssh), | ||
551 | server_version_string, client_version_string); | 557 | server_version_string, client_version_string); |
552 | cleanup_exit(255); | 558 | cleanup_exit(255); |
553 | } | 559 | } |
@@ -1452,6 +1458,47 @@ server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s) | |||
1452 | } | 1458 | } |
1453 | } | 1459 | } |
1454 | 1460 | ||
1461 | /* | ||
1462 | * If IP options are supported, make sure there are none (log and | ||
1463 | * return an error if any are found). Basically we are worried about | ||
1464 | * source routing; it can be used to pretend you are somebody | ||
1465 | * (ip-address) you are not. That itself may be "almost acceptable" | ||
1466 | * under certain circumstances, but rhosts autentication is useless | ||
1467 | * if source routing is accepted. Notice also that if we just dropped | ||
1468 | * source routing here, the other side could use IP spoofing to do | ||
1469 | * rest of the interaction and could still bypass security. So we | ||
1470 | * exit here if we detect any IP options. | ||
1471 | */ | ||
1472 | static void | ||
1473 | check_ip_options(struct ssh *ssh) | ||
1474 | { | ||
1475 | #ifdef IP_OPTIONS | ||
1476 | int sock_in = ssh_packet_get_connection_in(ssh); | ||
1477 | struct sockaddr_storage from; | ||
1478 | socklen_t option_size, i, fromlen = sizeof(from); | ||
1479 | u_char opts[200]; | ||
1480 | char text[sizeof(opts) * 3 + 1]; | ||
1481 | |||
1482 | memset(&from, 0, sizeof(from)); | ||
1483 | if (getpeername(sock_in, (struct sockaddr *)&from, | ||
1484 | &fromlen) < 0) | ||
1485 | return; | ||
1486 | if (from.ss_family != AF_INET) | ||
1487 | return; | ||
1488 | /* XXX IPv6 options? */ | ||
1489 | |||
1490 | if (getsockopt(sock_in, IPPROTO_IP, IP_OPTIONS, opts, | ||
1491 | &option_size) >= 0 && option_size != 0) { | ||
1492 | text[0] = '\0'; | ||
1493 | for (i = 0; i < option_size; i++) | ||
1494 | snprintf(text + i*3, sizeof(text) - i*3, | ||
1495 | " %2.2x", opts[i]); | ||
1496 | fatal("Connection from %.100s port %d with IP opts: %.800s", | ||
1497 | ssh_remote_ipaddr(ssh), ssh_remote_port(ssh), text); | ||
1498 | } | ||
1499 | return; | ||
1500 | #endif /* IP_OPTIONS */ | ||
1501 | } | ||
1455 | 1502 | ||
1456 | /* | 1503 | /* |
1457 | * Main program for the daemon. | 1504 | * Main program for the daemon. |
@@ -1459,6 +1506,7 @@ server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s) | |||
1459 | int | 1506 | int |
1460 | main(int ac, char **av) | 1507 | main(int ac, char **av) |
1461 | { | 1508 | { |
1509 | struct ssh *ssh = NULL; | ||
1462 | extern char *optarg; | 1510 | extern char *optarg; |
1463 | extern int optind; | 1511 | extern int optind; |
1464 | int r, opt, i, j, on = 1; | 1512 | int r, opt, i, j, on = 1; |
@@ -2118,28 +2166,25 @@ main(int ac, char **av) | |||
2118 | */ | 2166 | */ |
2119 | packet_set_connection(sock_in, sock_out); | 2167 | packet_set_connection(sock_in, sock_out); |
2120 | packet_set_server(); | 2168 | packet_set_server(); |
2169 | ssh = active_state; /* XXX */ | ||
2170 | check_ip_options(ssh); | ||
2121 | 2171 | ||
2122 | /* Set SO_KEEPALIVE if requested. */ | 2172 | /* Set SO_KEEPALIVE if requested. */ |
2123 | if (options.tcp_keep_alive && packet_connection_is_on_socket() && | 2173 | if (options.tcp_keep_alive && packet_connection_is_on_socket() && |
2124 | setsockopt(sock_in, SOL_SOCKET, SO_KEEPALIVE, &on, sizeof(on)) < 0) | 2174 | setsockopt(sock_in, SOL_SOCKET, SO_KEEPALIVE, &on, sizeof(on)) < 0) |
2125 | error("setsockopt SO_KEEPALIVE: %.100s", strerror(errno)); | 2175 | error("setsockopt SO_KEEPALIVE: %.100s", strerror(errno)); |
2126 | 2176 | ||
2127 | if ((remote_port = get_remote_port()) < 0) { | 2177 | if ((remote_port = ssh_remote_port(ssh)) < 0) { |
2128 | debug("get_remote_port failed"); | 2178 | debug("ssh_remote_port failed"); |
2129 | cleanup_exit(255); | 2179 | cleanup_exit(255); |
2130 | } | 2180 | } |
2131 | 2181 | ||
2132 | /* | 2182 | /* |
2133 | * We use get_canonical_hostname with usedns = 0 instead of | ||
2134 | * get_remote_ipaddr here so IP options will be checked. | ||
2135 | */ | ||
2136 | (void) get_canonical_hostname(0); | ||
2137 | /* | ||
2138 | * The rest of the code depends on the fact that | 2183 | * The rest of the code depends on the fact that |
2139 | * get_remote_ipaddr() caches the remote ip, even if | 2184 | * ssh_remote_ipaddr() caches the remote ip, even if |
2140 | * the socket goes away. | 2185 | * the socket goes away. |
2141 | */ | 2186 | */ |
2142 | remote_ip = get_remote_ipaddr(); | 2187 | remote_ip = ssh_remote_ipaddr(ssh); |
2143 | 2188 | ||
2144 | #ifdef SSH_AUDIT_EVENTS | 2189 | #ifdef SSH_AUDIT_EVENTS |
2145 | audit_connection_from(remote_ip, remote_port); | 2190 | audit_connection_from(remote_ip, remote_port); |
@@ -2148,7 +2193,7 @@ main(int ac, char **av) | |||
2148 | /* Log the connection. */ | 2193 | /* Log the connection. */ |
2149 | laddr = get_local_ipaddr(sock_in); | 2194 | laddr = get_local_ipaddr(sock_in); |
2150 | verbose("Connection from %s port %d on %s port %d", | 2195 | verbose("Connection from %s port %d on %s port %d", |
2151 | remote_ip, remote_port, laddr, get_local_port()); | 2196 | remote_ip, remote_port, laddr, ssh_local_port(ssh)); |
2152 | free(laddr); | 2197 | free(laddr); |
2153 | 2198 | ||
2154 | /* | 2199 | /* |
@@ -2163,7 +2208,7 @@ main(int ac, char **av) | |||
2163 | if (!debug_flag) | 2208 | if (!debug_flag) |
2164 | alarm(options.login_grace_time); | 2209 | alarm(options.login_grace_time); |
2165 | 2210 | ||
2166 | sshd_exchange_identification(sock_in, sock_out); | 2211 | sshd_exchange_identification(ssh, sock_in, sock_out); |
2167 | 2212 | ||
2168 | /* In inetd mode, generate ephemeral key only for proto 1 connections */ | 2213 | /* In inetd mode, generate ephemeral key only for proto 1 connections */ |
2169 | if (!compat20 && inetd_flag && sensitive_data.server_key == NULL) | 2214 | if (!compat20 && inetd_flag && sensitive_data.server_key == NULL) |
@@ -2299,6 +2344,7 @@ main(int ac, char **av) | |||
2299 | int | 2344 | int |
2300 | ssh1_session_key(BIGNUM *session_key_int) | 2345 | ssh1_session_key(BIGNUM *session_key_int) |
2301 | { | 2346 | { |
2347 | struct ssh *ssh = active_state; /* XXX */ | ||
2302 | int rsafail = 0; | 2348 | int rsafail = 0; |
2303 | 2349 | ||
2304 | if (BN_cmp(sensitive_data.server_key->rsa->n, | 2350 | if (BN_cmp(sensitive_data.server_key->rsa->n, |
@@ -2307,9 +2353,9 @@ ssh1_session_key(BIGNUM *session_key_int) | |||
2307 | if (BN_num_bits(sensitive_data.server_key->rsa->n) < | 2353 | if (BN_num_bits(sensitive_data.server_key->rsa->n) < |
2308 | BN_num_bits(sensitive_data.ssh1_host_key->rsa->n) + | 2354 | BN_num_bits(sensitive_data.ssh1_host_key->rsa->n) + |
2309 | SSH_KEY_BITS_RESERVED) { | 2355 | SSH_KEY_BITS_RESERVED) { |
2310 | fatal("do_connection: %s: " | 2356 | fatal("do_connection: %s port %d: " |
2311 | "server_key %d < host_key %d + SSH_KEY_BITS_RESERVED %d", | 2357 | "server_key %d < host_key %d + SSH_KEY_BITS_RESERVED %d", |
2312 | get_remote_ipaddr(), | 2358 | ssh_remote_ipaddr(ssh), ssh_remote_port(ssh), |
2313 | BN_num_bits(sensitive_data.server_key->rsa->n), | 2359 | BN_num_bits(sensitive_data.server_key->rsa->n), |
2314 | BN_num_bits(sensitive_data.ssh1_host_key->rsa->n), | 2360 | BN_num_bits(sensitive_data.ssh1_host_key->rsa->n), |
2315 | SSH_KEY_BITS_RESERVED); | 2361 | SSH_KEY_BITS_RESERVED); |
@@ -2325,9 +2371,9 @@ ssh1_session_key(BIGNUM *session_key_int) | |||
2325 | if (BN_num_bits(sensitive_data.ssh1_host_key->rsa->n) < | 2371 | if (BN_num_bits(sensitive_data.ssh1_host_key->rsa->n) < |
2326 | BN_num_bits(sensitive_data.server_key->rsa->n) + | 2372 | BN_num_bits(sensitive_data.server_key->rsa->n) + |
2327 | SSH_KEY_BITS_RESERVED) { | 2373 | SSH_KEY_BITS_RESERVED) { |
2328 | fatal("do_connection: %s: " | 2374 | fatal("do_connection: %s port %d: " |
2329 | "host_key %d < server_key %d + SSH_KEY_BITS_RESERVED %d", | 2375 | "host_key %d < server_key %d + SSH_KEY_BITS_RESERVED %d", |
2330 | get_remote_ipaddr(), | 2376 | ssh_remote_ipaddr(ssh), ssh_remote_port(ssh), |
2331 | BN_num_bits(sensitive_data.ssh1_host_key->rsa->n), | 2377 | BN_num_bits(sensitive_data.ssh1_host_key->rsa->n), |
2332 | BN_num_bits(sensitive_data.server_key->rsa->n), | 2378 | BN_num_bits(sensitive_data.server_key->rsa->n), |
2333 | SSH_KEY_BITS_RESERVED); | 2379 | SSH_KEY_BITS_RESERVED); |
@@ -2348,6 +2394,7 @@ ssh1_session_key(BIGNUM *session_key_int) | |||
2348 | static void | 2394 | static void |
2349 | do_ssh1_kex(void) | 2395 | do_ssh1_kex(void) |
2350 | { | 2396 | { |
2397 | struct ssh *ssh = active_state; /* XXX */ | ||
2351 | int i, len; | 2398 | int i, len; |
2352 | int rsafail = 0; | 2399 | int rsafail = 0; |
2353 | BIGNUM *session_key_int, *fake_key_int, *real_key_int; | 2400 | BIGNUM *session_key_int, *fake_key_int, *real_key_int; |
@@ -2465,9 +2512,10 @@ do_ssh1_kex(void) | |||
2465 | (void) BN_mask_bits(session_key_int, sizeof(session_key) * 8); | 2512 | (void) BN_mask_bits(session_key_int, sizeof(session_key) * 8); |
2466 | len = BN_num_bytes(session_key_int); | 2513 | len = BN_num_bytes(session_key_int); |
2467 | if (len < 0 || (u_int)len > sizeof(session_key)) { | 2514 | if (len < 0 || (u_int)len > sizeof(session_key)) { |
2468 | error("do_ssh1_kex: bad session key len from %s: " | 2515 | error("%s: bad session key len from %s port %d: " |
2469 | "session_key_int %d > sizeof(session_key) %lu", | 2516 | "session_key_int %d > sizeof(session_key) %lu", __func__, |
2470 | get_remote_ipaddr(), len, (u_long)sizeof(session_key)); | 2517 | ssh_remote_ipaddr(ssh), ssh_remote_port(ssh), |
2518 | len, (u_long)sizeof(session_key)); | ||
2471 | rsafail++; | 2519 | rsafail++; |
2472 | } else { | 2520 | } else { |
2473 | explicit_bzero(session_key, sizeof(session_key)); | 2521 | explicit_bzero(session_key, sizeof(session_key)); |