summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--ChangeLog5
-rw-r--r--audit-bsm.c57
-rw-r--r--configure.ac11
3 files changed, 62 insertions, 11 deletions
diff --git a/ChangeLog b/ChangeLog
index b67b29b09..0b2140320 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,6 +2,9 @@
2 - (dtucker) [openbsd-compat/fake-rfc2553.h] rename ssh_gai_strerror hack 2 - (dtucker) [openbsd-compat/fake-rfc2553.h] rename ssh_gai_strerror hack
3 since it now conflicts with the helper function in misc.c. From 3 since it now conflicts with the helper function in misc.c. From
4 vinschen AT redhat.com. 4 vinschen AT redhat.com.
5 - (dtucker) [configure.ac audit-bsm.c] Bug #1420: Add a local implementation
6 of aug_get_machine for systems that don't have their own (eg OS X, FreeBSD).
7 Help and testing from csjp at FreeBSD org, vgiffin at apple com. ok djm@
5 8
620080224 920080224
7 - (tim) [contrib/cygwin/ssh-host-config] 10 - (tim) [contrib/cygwin/ssh-host-config]
@@ -3621,4 +3624,4 @@
3621 OpenServer 6 and add osr5bigcrypt support so when someone migrates 3624 OpenServer 6 and add osr5bigcrypt support so when someone migrates
3622 passwords between UnixWare and OpenServer they will still work. OK dtucker@ 3625 passwords between UnixWare and OpenServer they will still work. OK dtucker@
3623 3626
3624$Id: ChangeLog,v 1.4839 2008/02/25 09:21:20 dtucker Exp $ 3627$Id: ChangeLog,v 1.4840 2008/02/25 10:05:04 dtucker Exp $
diff --git a/audit-bsm.c b/audit-bsm.c
index c26b4caed..2c417bc27 100644
--- a/audit-bsm.c
+++ b/audit-bsm.c
@@ -1,4 +1,4 @@
1/* $Id: audit-bsm.c,v 1.5 2006/09/30 22:09:50 dtucker Exp $ */ 1/* $Id: audit-bsm.c,v 1.6 2008/02/25 10:05:04 dtucker Exp $ */
2 2
3/* 3/*
4 * TODO 4 * TODO
@@ -40,7 +40,9 @@
40#include <sys/types.h> 40#include <sys/types.h>
41 41
42#include <errno.h> 42#include <errno.h>
43#include <netdb.h>
43#include <stdarg.h> 44#include <stdarg.h>
45#include <string.h>
44#include <unistd.h> 46#include <unistd.h>
45 47
46#include "ssh.h" 48#include "ssh.h"
@@ -62,8 +64,6 @@
62#if defined(HAVE_GETAUDIT_ADDR) 64#if defined(HAVE_GETAUDIT_ADDR)
63#define AuditInfoStruct auditinfo_addr 65#define AuditInfoStruct auditinfo_addr
64#define AuditInfoTermID au_tid_addr_t 66#define AuditInfoTermID au_tid_addr_t
65#define GetAuditFunc(a,b) getaudit_addr((a),(b))
66#define GetAuditFuncText "getaudit_addr"
67#define SetAuditFunc(a,b) setaudit_addr((a),(b)) 67#define SetAuditFunc(a,b) setaudit_addr((a),(b))
68#define SetAuditFuncText "setaudit_addr" 68#define SetAuditFuncText "setaudit_addr"
69#define AUToSubjectFunc au_to_subject_ex 69#define AUToSubjectFunc au_to_subject_ex
@@ -71,18 +71,16 @@
71#else 71#else
72#define AuditInfoStruct auditinfo 72#define AuditInfoStruct auditinfo
73#define AuditInfoTermID au_tid_t 73#define AuditInfoTermID au_tid_t
74#define GetAuditFunc(a,b) getaudit(a)
75#define GetAuditFuncText "getaudit"
76#define SetAuditFunc(a,b) setaudit(a) 74#define SetAuditFunc(a,b) setaudit(a)
77#define SetAuditFuncText "setaudit" 75#define SetAuditFuncText "setaudit"
78#define AUToSubjectFunc au_to_subject 76#define AUToSubjectFunc au_to_subject
79#define AUToReturnFunc(a,b) au_to_return((a), (u_int)(b)) 77#define AUToReturnFunc(a,b) au_to_return((a), (u_int)(b))
80#endif 78#endif
81 79
80#ifndef cannot_audit
82extern int cannot_audit(int); 81extern int cannot_audit(int);
82#endif
83extern void aug_init(void); 83extern void aug_init(void);
84extern dev_t aug_get_port(void);
85extern int aug_get_machine(char *, u_int32_t *, u_int32_t *);
86extern void aug_save_auid(au_id_t); 84extern void aug_save_auid(au_id_t);
87extern void aug_save_uid(uid_t); 85extern void aug_save_uid(uid_t);
88extern void aug_save_euid(uid_t); 86extern void aug_save_euid(uid_t);
@@ -119,6 +117,51 @@ static AuditInfoTermID ssh_bsm_tid;
119/* Below is the low-level BSM interface code */ 117/* Below is the low-level BSM interface code */
120 118
121/* 119/*
120 * aug_get_machine is only required on IPv6 capable machines, we use a
121 * different mechanism in audit_connection_from() for IPv4-only machines.
122 * getaudit_addr() is only present on IPv6 capable machines.
123 */
124#if defined(HAVE_AUG_GET_MACHINE) || !defined(HAVE_GETAUDIT_ADDR)
125extern int aug_get_machine(char *, u_int32_t *, u_int32_t *);
126#else
127static int
128aug_get_machine(char *host, u_int32_t *addr, u_int32_t *type)
129{
130 struct addrinfo *ai;
131 struct sockaddr_in *in4;
132 struct sockaddr_in6 *in6;
133 int ret = 0, r;
134
135 if ((r = getaddrinfo(host, NULL, NULL, &ai)) != 0) {
136 error("BSM audit: getaddrinfo failed for %.100s: %.100s", host,
137 r == EAI_SYSTEM ? strerror(errno) : gai_strerror(r));
138 return -1;
139 }
140
141 switch (ai->ai_family) {
142 case AF_INET:
143 in4 = (struct sockaddr_in *)ai->ai_addr;
144 *type = AU_IPv4;
145 memcpy(addr, &in4->sin_addr, sizeof(struct in_addr));
146 break;
147#ifdef AU_IPv6
148 case AF_INET6:
149 in6 = (struct sockaddr_in6 *)ai->ai_addr;
150 *type = AU_IPv6;
151 memcpy(addr, &in6->sin6_addr, sizeof(struct in6_addr));
152 break;
153#endif
154 default:
155 error("BSM audit: unknown address family for %.100s: %d",
156 host, ai->ai_family);
157 ret = -1;
158 }
159 freeaddrinfo(ai);
160 return ret;
161}
162#endif
163
164/*
122 * Check if the specified event is selected (enabled) for auditing. 165 * Check if the specified event is selected (enabled) for auditing.
123 * Returns 1 if the event is selected, 0 if not and -1 on failure. 166 * Returns 1 if the event is selected, 0 if not and -1 on failure.
124 */ 167 */
diff --git a/configure.ac b/configure.ac
index 484d45d53..f9e2d8b34 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,4 +1,4 @@
1# $Id: configure.ac,v 1.389 2008/01/02 07:08:45 dtucker Exp $ 1# $Id: configure.ac,v 1.390 2008/02/25 10:05:04 dtucker Exp $
2# 2#
3# Copyright (c) 1999-2004 Damien Miller 3# Copyright (c) 1999-2004 Damien Miller
4# 4#
@@ -15,7 +15,7 @@
15# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 15# OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 16
17AC_INIT(OpenSSH, Portable, openssh-unix-dev@mindrot.org) 17AC_INIT(OpenSSH, Portable, openssh-unix-dev@mindrot.org)
18AC_REVISION($Revision: 1.389 $) 18AC_REVISION($Revision: 1.390 $)
19AC_CONFIG_SRCDIR([ssh.c]) 19AC_CONFIG_SRCDIR([ssh.c])
20 20
21AC_CONFIG_HEADER(config.h) 21AC_CONFIG_HEADER(config.h)
@@ -423,6 +423,11 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
423 [Use tunnel device compatibility to OpenBSD]) 423 [Use tunnel device compatibility to OpenBSD])
424 AC_DEFINE(SSH_TUN_PREPEND_AF, 1, 424 AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
425 [Prepend the address family to IP tunnel traffic]) 425 [Prepend the address family to IP tunnel traffic])
426 m4_pattern_allow(AU_IPv)
427 AC_CHECK_DECL(AU_IPv4, [],
428 AC_DEFINE(AU_IPv4, 0, [System only supports IPv4 audit records])
429 [#include <bsm/audit.h>]
430 )
426 ;; 431 ;;
427*-*-dragonfly*) 432*-*-dragonfly*)
428 SSHDLIBS="$SSHDLIBS -lcrypt" 433 SSHDLIBS="$SSHDLIBS -lcrypt"
@@ -1226,7 +1231,7 @@ AC_ARG_WITH(audit,
1226 AC_CHECK_FUNCS(getaudit, [], 1231 AC_CHECK_FUNCS(getaudit, [],
1227 [AC_MSG_ERROR(BSM enabled and required function not found)]) 1232 [AC_MSG_ERROR(BSM enabled and required function not found)])
1228 # These are optional 1233 # These are optional
1229 AC_CHECK_FUNCS(getaudit_addr) 1234 AC_CHECK_FUNCS(getaudit_addr aug_get_machine)
1230 AC_DEFINE(USE_BSM_AUDIT, 1, [Use BSM audit module]) 1235 AC_DEFINE(USE_BSM_AUDIT, 1, [Use BSM audit module])
1231 ;; 1236 ;;
1232 debug) 1237 debug)