diff options
Diffstat (limited to 'sshd.c')
-rw-r--r-- | sshd.c | 119 |
1 files changed, 116 insertions, 3 deletions
@@ -117,6 +117,10 @@ | |||
117 | #include "monitor_fdpass.h" | 117 | #include "monitor_fdpass.h" |
118 | #include "version.h" | 118 | #include "version.h" |
119 | 119 | ||
120 | #ifdef USE_SECURITY_SESSION_API | ||
121 | #include <Security/AuthSession.h> | ||
122 | #endif | ||
123 | |||
120 | #ifdef LIBWRAP | 124 | #ifdef LIBWRAP |
121 | #include <tcpd.h> | 125 | #include <tcpd.h> |
122 | #include <syslog.h> | 126 | #include <syslog.h> |
@@ -419,7 +423,7 @@ sshd_exchange_identification(int sock_in, int sock_out) | |||
419 | major = PROTOCOL_MAJOR_1; | 423 | major = PROTOCOL_MAJOR_1; |
420 | minor = PROTOCOL_MINOR_1; | 424 | minor = PROTOCOL_MINOR_1; |
421 | } | 425 | } |
422 | snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s\n", major, minor, SSH_VERSION); | 426 | snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s\n", major, minor, SSH_RELEASE); |
423 | server_version_string = xstrdup(buf); | 427 | server_version_string = xstrdup(buf); |
424 | 428 | ||
425 | /* Send our protocol version identification. */ | 429 | /* Send our protocol version identification. */ |
@@ -1305,7 +1309,12 @@ main(int ac, char **av) | |||
1305 | /* ignored */ | 1309 | /* ignored */ |
1306 | break; | 1310 | break; |
1307 | case 'q': | 1311 | case 'q': |
1308 | options.log_level = SYSLOG_LEVEL_QUIET; | 1312 | if (options.log_level == SYSLOG_LEVEL_QUIET) { |
1313 | options.log_level = SYSLOG_LEVEL_SILENT; | ||
1314 | } | ||
1315 | else if (options.log_level != SYSLOG_LEVEL_SILENT) { | ||
1316 | options.log_level = SYSLOG_LEVEL_QUIET; | ||
1317 | } | ||
1309 | break; | 1318 | break; |
1310 | case 'b': | 1319 | case 'b': |
1311 | options.server_key_bits = (int)strtonum(optarg, 256, | 1320 | options.server_key_bits = (int)strtonum(optarg, 256, |
@@ -1477,10 +1486,13 @@ main(int ac, char **av) | |||
1477 | logit("Disabling protocol version 1. Could not load host key"); | 1486 | logit("Disabling protocol version 1. Could not load host key"); |
1478 | options.protocol &= ~SSH_PROTO_1; | 1487 | options.protocol &= ~SSH_PROTO_1; |
1479 | } | 1488 | } |
1489 | #ifndef GSSAPI | ||
1490 | /* The GSSAPI key exchange can run without a host key */ | ||
1480 | if ((options.protocol & SSH_PROTO_2) && !sensitive_data.have_ssh2_key) { | 1491 | if ((options.protocol & SSH_PROTO_2) && !sensitive_data.have_ssh2_key) { |
1481 | logit("Disabling protocol version 2. Could not load host key"); | 1492 | logit("Disabling protocol version 2. Could not load host key"); |
1482 | options.protocol &= ~SSH_PROTO_2; | 1493 | options.protocol &= ~SSH_PROTO_2; |
1483 | } | 1494 | } |
1495 | #endif | ||
1484 | if (!(options.protocol & (SSH_PROTO_1|SSH_PROTO_2))) { | 1496 | if (!(options.protocol & (SSH_PROTO_1|SSH_PROTO_2))) { |
1485 | logit("sshd: no hostkeys available -- exiting."); | 1497 | logit("sshd: no hostkeys available -- exiting."); |
1486 | exit(1); | 1498 | exit(1); |
@@ -1707,7 +1719,7 @@ main(int ac, char **av) | |||
1707 | * Register our connection. This turns encryption off because we do | 1719 | * Register our connection. This turns encryption off because we do |
1708 | * not have a key. | 1720 | * not have a key. |
1709 | */ | 1721 | */ |
1710 | packet_set_connection(sock_in, sock_out); | 1722 | packet_set_connection(sock_in, sock_out, -1); |
1711 | packet_set_server(); | 1723 | packet_set_server(); |
1712 | 1724 | ||
1713 | /* Set SO_KEEPALIVE if requested. */ | 1725 | /* Set SO_KEEPALIVE if requested. */ |
@@ -1755,6 +1767,60 @@ main(int ac, char **av) | |||
1755 | /* Log the connection. */ | 1767 | /* Log the connection. */ |
1756 | verbose("Connection from %.500s port %d", remote_ip, remote_port); | 1768 | verbose("Connection from %.500s port %d", remote_ip, remote_port); |
1757 | 1769 | ||
1770 | #ifdef USE_SECURITY_SESSION_API | ||
1771 | /* | ||
1772 | * Create a new security session for use by the new user login if | ||
1773 | * the current session is the root session or we are not launched | ||
1774 | * by inetd (eg: debugging mode or server mode). We do not | ||
1775 | * necessarily need to create a session if we are launched from | ||
1776 | * inetd because Panther xinetd will create a session for us. | ||
1777 | * | ||
1778 | * The only case where this logic will fail is if there is an | ||
1779 | * inetd running in a non-root session which is not creating | ||
1780 | * new sessions for us. Then all the users will end up in the | ||
1781 | * same session (bad). | ||
1782 | * | ||
1783 | * When the client exits, the session will be destroyed for us | ||
1784 | * automatically. | ||
1785 | * | ||
1786 | * We must create the session before any credentials are stored | ||
1787 | * (including AFS pags, which happens a few lines below). | ||
1788 | */ | ||
1789 | { | ||
1790 | OSStatus err = 0; | ||
1791 | SecuritySessionId sid = 0; | ||
1792 | SessionAttributeBits sattrs = 0; | ||
1793 | |||
1794 | err = SessionGetInfo(callerSecuritySession, &sid, &sattrs); | ||
1795 | if (err) | ||
1796 | error("SessionGetInfo() failed with error %.8X", | ||
1797 | (unsigned) err); | ||
1798 | else | ||
1799 | debug("Current Session ID is %.8X / Session Attributes are %.8X", | ||
1800 | (unsigned) sid, (unsigned) sattrs); | ||
1801 | |||
1802 | if (inetd_flag && !(sattrs & sessionIsRoot)) | ||
1803 | debug("Running in inetd mode in a non-root session... " | ||
1804 | "assuming inetd created the session for us."); | ||
1805 | else { | ||
1806 | debug("Creating new security session..."); | ||
1807 | err = SessionCreate(0, sessionHasTTY | sessionIsRemote); | ||
1808 | if (err) | ||
1809 | error("SessionCreate() failed with error %.8X", | ||
1810 | (unsigned) err); | ||
1811 | |||
1812 | err = SessionGetInfo(callerSecuritySession, &sid, | ||
1813 | &sattrs); | ||
1814 | if (err) | ||
1815 | error("SessionGetInfo() failed with error %.8X", | ||
1816 | (unsigned) err); | ||
1817 | else | ||
1818 | debug("New Session ID is %.8X / Session Attributes are %.8X", | ||
1819 | (unsigned) sid, (unsigned) sattrs); | ||
1820 | } | ||
1821 | } | ||
1822 | #endif | ||
1823 | |||
1758 | /* | 1824 | /* |
1759 | * We don't want to listen forever unless the other side | 1825 | * We don't want to listen forever unless the other side |
1760 | * successfully authenticates itself. So we set up an alarm which is | 1826 | * successfully authenticates itself. So we set up an alarm which is |
@@ -2113,12 +2179,59 @@ do_ssh2_kex(void) | |||
2113 | 2179 | ||
2114 | myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = list_hostkey_types(); | 2180 | myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = list_hostkey_types(); |
2115 | 2181 | ||
2182 | #ifdef GSSAPI | ||
2183 | { | ||
2184 | char *orig; | ||
2185 | char *gss = NULL; | ||
2186 | char *newstr = NULL; | ||
2187 | orig = myproposal[PROPOSAL_KEX_ALGS]; | ||
2188 | |||
2189 | /* | ||
2190 | * If we don't have a host key, then there's no point advertising | ||
2191 | * the other key exchange algorithms | ||
2192 | */ | ||
2193 | |||
2194 | if (strlen(myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS]) == 0) | ||
2195 | orig = NULL; | ||
2196 | |||
2197 | if (options.gss_keyex) | ||
2198 | gss = ssh_gssapi_server_mechanisms(); | ||
2199 | else | ||
2200 | gss = NULL; | ||
2201 | |||
2202 | if (gss && orig) | ||
2203 | xasprintf(&newstr, "%s,%s", gss, orig); | ||
2204 | else if (gss) | ||
2205 | newstr = gss; | ||
2206 | else if (orig) | ||
2207 | newstr = orig; | ||
2208 | |||
2209 | /* | ||
2210 | * If we've got GSSAPI mechanisms, then we've got the 'null' host | ||
2211 | * key alg, but we can't tell people about it unless its the only | ||
2212 | * host key algorithm we support | ||
2213 | */ | ||
2214 | if (gss && (strlen(myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS])) == 0) | ||
2215 | myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = "null"; | ||
2216 | |||
2217 | if (newstr) | ||
2218 | myproposal[PROPOSAL_KEX_ALGS] = newstr; | ||
2219 | else | ||
2220 | fatal("No supported key exchange algorithms"); | ||
2221 | } | ||
2222 | #endif | ||
2223 | |||
2116 | /* start key exchange */ | 2224 | /* start key exchange */ |
2117 | kex = kex_setup(myproposal); | 2225 | kex = kex_setup(myproposal); |
2118 | kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server; | 2226 | kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server; |
2119 | kex->kex[KEX_DH_GRP14_SHA1] = kexdh_server; | 2227 | kex->kex[KEX_DH_GRP14_SHA1] = kexdh_server; |
2120 | kex->kex[KEX_DH_GEX_SHA1] = kexgex_server; | 2228 | kex->kex[KEX_DH_GEX_SHA1] = kexgex_server; |
2121 | kex->kex[KEX_DH_GEX_SHA256] = kexgex_server; | 2229 | kex->kex[KEX_DH_GEX_SHA256] = kexgex_server; |
2230 | #ifdef GSSAPI | ||
2231 | kex->kex[KEX_GSS_GRP1_SHA1] = kexgss_server; | ||
2232 | kex->kex[KEX_GSS_GRP14_SHA1] = kexgss_server; | ||
2233 | kex->kex[KEX_GSS_GEX_SHA1] = kexgss_server; | ||
2234 | #endif | ||
2122 | kex->server = 1; | 2235 | kex->server = 1; |
2123 | kex->client_version_string=client_version_string; | 2236 | kex->client_version_string=client_version_string; |
2124 | kex->server_version_string=server_version_string; | 2237 | kex->server_version_string=server_version_string; |