xref: /openssh-portable/session.c (revision bef92346)
1 /* $OpenBSD: session.c,v 1.327 2020/12/14 03:13:12 djm Exp $ */
2 /*
3  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
4  *                    All rights reserved
5  *
6  * As far as I am concerned, the code I have written for this software
7  * can be used freely for any purpose.  Any derived versions of this
8  * software must be clearly marked as such, and if the derived work is
9  * incompatible with the protocol description in the RFC file, it must be
10  * called by a name other than "ssh" or "Secure Shell".
11  *
12  * SSH2 support by Markus Friedl.
13  * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
14  *
15  * Redistribution and use in source and binary forms, with or without
16  * modification, are permitted provided that the following conditions
17  * are met:
18  * 1. Redistributions of source code must retain the above copyright
19  *    notice, this list of conditions and the following disclaimer.
20  * 2. Redistributions in binary form must reproduce the above copyright
21  *    notice, this list of conditions and the following disclaimer in the
22  *    documentation and/or other materials provided with the distribution.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
25  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
26  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
27  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
28  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
29  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
30  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
31  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
32  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
33  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
34  */
35 
36 #include "includes.h"
37 
38 #include <sys/types.h>
39 #include <sys/param.h>
40 #ifdef HAVE_SYS_STAT_H
41 # include <sys/stat.h>
42 #endif
43 #include <sys/socket.h>
44 #include <sys/un.h>
45 #include <sys/wait.h>
46 
47 #include <arpa/inet.h>
48 
49 #include <ctype.h>
50 #include <errno.h>
51 #include <fcntl.h>
52 #include <grp.h>
53 #include <netdb.h>
54 #ifdef HAVE_PATHS_H
55 #include <paths.h>
56 #endif
57 #include <pwd.h>
58 #include <signal.h>
59 #include <stdio.h>
60 #include <stdlib.h>
61 #include <string.h>
62 #include <stdarg.h>
63 #include <unistd.h>
64 #include <limits.h>
65 
66 #include "openbsd-compat/sys-queue.h"
67 #include "xmalloc.h"
68 #include "ssh.h"
69 #include "ssh2.h"
70 #include "sshpty.h"
71 #include "packet.h"
72 #include "sshbuf.h"
73 #include "ssherr.h"
74 #include "match.h"
75 #include "uidswap.h"
76 #include "compat.h"
77 #include "channels.h"
78 #include "sshkey.h"
79 #include "cipher.h"
80 #ifdef GSSAPI
81 #include "ssh-gss.h"
82 #endif
83 #include "hostfile.h"
84 #include "auth.h"
85 #include "auth-options.h"
86 #include "authfd.h"
87 #include "pathnames.h"
88 #include "log.h"
89 #include "misc.h"
90 #include "servconf.h"
91 #include "sshlogin.h"
92 #include "serverloop.h"
93 #include "canohost.h"
94 #include "session.h"
95 #include "kex.h"
96 #include "monitor_wrap.h"
97 #include "sftp.h"
98 #include "atomicio.h"
99 
100 #if defined(KRB5) && defined(USE_AFS)
101 #include <kafs.h>
102 #endif
103 
104 #ifdef WITH_SELINUX
105 #include <selinux/selinux.h>
106 #endif
107 
108 #define IS_INTERNAL_SFTP(c) \
109 	(!strncmp(c, INTERNAL_SFTP_NAME, sizeof(INTERNAL_SFTP_NAME) - 1) && \
110 	 (c[sizeof(INTERNAL_SFTP_NAME) - 1] == '\0' || \
111 	  c[sizeof(INTERNAL_SFTP_NAME) - 1] == ' ' || \
112 	  c[sizeof(INTERNAL_SFTP_NAME) - 1] == '\t'))
113 
114 /* func */
115 
116 Session *session_new(void);
117 void	session_set_fds(struct ssh *, Session *, int, int, int, int, int);
118 void	session_pty_cleanup(Session *);
119 void	session_proctitle(Session *);
120 int	session_setup_x11fwd(struct ssh *, Session *);
121 int	do_exec_pty(struct ssh *, Session *, const char *);
122 int	do_exec_no_pty(struct ssh *, Session *, const char *);
123 int	do_exec(struct ssh *, Session *, const char *);
124 void	do_login(struct ssh *, Session *, const char *);
125 void	do_child(struct ssh *, Session *, const char *);
126 void	do_motd(void);
127 int	check_quietlogin(Session *, const char *);
128 
129 static void do_authenticated2(struct ssh *, Authctxt *);
130 
131 static int session_pty_req(struct ssh *, Session *);
132 
133 /* import */
134 extern ServerOptions options;
135 extern char *__progname;
136 extern int debug_flag;
137 extern u_int utmp_len;
138 extern int startup_pipe;
139 extern void destroy_sensitive_data(void);
140 extern struct sshbuf *loginmsg;
141 extern struct sshauthopt *auth_opts;
142 extern char *tun_fwd_ifnames; /* serverloop.c */
143 
144 /* original command from peer. */
145 const char *original_command = NULL;
146 
147 /* data */
148 static int sessions_first_unused = -1;
149 static int sessions_nalloc = 0;
150 static Session *sessions = NULL;
151 
152 #define SUBSYSTEM_NONE			0
153 #define SUBSYSTEM_EXT			1
154 #define SUBSYSTEM_INT_SFTP		2
155 #define SUBSYSTEM_INT_SFTP_ERROR	3
156 
157 #ifdef HAVE_LOGIN_CAP
158 login_cap_t *lc;
159 #endif
160 
161 static int is_child = 0;
162 static int in_chroot = 0;
163 
164 /* File containing userauth info, if ExposeAuthInfo set */
165 static char *auth_info_file = NULL;
166 
167 /* Name and directory of socket for authentication agent forwarding. */
168 static char *auth_sock_name = NULL;
169 static char *auth_sock_dir = NULL;
170 
171 /* removes the agent forwarding socket */
172 
173 static void
auth_sock_cleanup_proc(struct passwd * pw)174 auth_sock_cleanup_proc(struct passwd *pw)
175 {
176 	if (auth_sock_name != NULL) {
177 		temporarily_use_uid(pw);
178 		unlink(auth_sock_name);
179 		rmdir(auth_sock_dir);
180 		auth_sock_name = NULL;
181 		restore_uid();
182 	}
183 }
184 
185 static int
auth_input_request_forwarding(struct ssh * ssh,struct passwd * pw)186 auth_input_request_forwarding(struct ssh *ssh, struct passwd * pw)
187 {
188 	Channel *nc;
189 	int sock = -1;
190 
191 	if (auth_sock_name != NULL) {
192 		error("authentication forwarding requested twice.");
193 		return 0;
194 	}
195 
196 	/* Temporarily drop privileged uid for mkdir/bind. */
197 	temporarily_use_uid(pw);
198 
199 	/* Allocate a buffer for the socket name, and format the name. */
200 	auth_sock_dir = xstrdup("/tmp/ssh-XXXXXXXXXX");
201 
202 	/* Create private directory for socket */
203 	if (mkdtemp(auth_sock_dir) == NULL) {
204 		ssh_packet_send_debug(ssh, "Agent forwarding disabled: "
205 		    "mkdtemp() failed: %.100s", strerror(errno));
206 		restore_uid();
207 		free(auth_sock_dir);
208 		auth_sock_dir = NULL;
209 		goto authsock_err;
210 	}
211 
212 	xasprintf(&auth_sock_name, "%s/agent.%ld",
213 	    auth_sock_dir, (long) getpid());
214 
215 	/* Start a Unix listener on auth_sock_name. */
216 	sock = unix_listener(auth_sock_name, SSH_LISTEN_BACKLOG, 0);
217 
218 	/* Restore the privileged uid. */
219 	restore_uid();
220 
221 	/* Check for socket/bind/listen failure. */
222 	if (sock < 0)
223 		goto authsock_err;
224 
225 	/* Allocate a channel for the authentication agent socket. */
226 	nc = channel_new(ssh, "auth socket",
227 	    SSH_CHANNEL_AUTH_SOCKET, sock, sock, -1,
228 	    CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
229 	    0, "auth socket", 1);
230 	nc->path = xstrdup(auth_sock_name);
231 	return 1;
232 
233  authsock_err:
234 	free(auth_sock_name);
235 	if (auth_sock_dir != NULL) {
236 		temporarily_use_uid(pw);
237 		rmdir(auth_sock_dir);
238 		restore_uid();
239 		free(auth_sock_dir);
240 	}
241 	if (sock != -1)
242 		close(sock);
243 	auth_sock_name = NULL;
244 	auth_sock_dir = NULL;
245 	return 0;
246 }
247 
248 static void
display_loginmsg(void)249 display_loginmsg(void)
250 {
251 	int r;
252 
253 	if (sshbuf_len(loginmsg) == 0)
254 		return;
255 	if ((r = sshbuf_put_u8(loginmsg, 0)) != 0)
256 		fatal_fr(r, "sshbuf_put_u8");
257 	printf("%s", (char *)sshbuf_ptr(loginmsg));
258 	sshbuf_reset(loginmsg);
259 }
260 
261 static void
prepare_auth_info_file(struct passwd * pw,struct sshbuf * info)262 prepare_auth_info_file(struct passwd *pw, struct sshbuf *info)
263 {
264 	int fd = -1, success = 0;
265 
266 	if (!options.expose_userauth_info || info == NULL)
267 		return;
268 
269 	temporarily_use_uid(pw);
270 	auth_info_file = xstrdup("/tmp/sshauth.XXXXXXXXXXXXXXX");
271 	if ((fd = mkstemp(auth_info_file)) == -1) {
272 		error_f("mkstemp: %s", strerror(errno));
273 		goto out;
274 	}
275 	if (atomicio(vwrite, fd, sshbuf_mutable_ptr(info),
276 	    sshbuf_len(info)) != sshbuf_len(info)) {
277 		error_f("write: %s", strerror(errno));
278 		goto out;
279 	}
280 	if (close(fd) != 0) {
281 		error_f("close: %s", strerror(errno));
282 		goto out;
283 	}
284 	success = 1;
285  out:
286 	if (!success) {
287 		if (fd != -1)
288 			close(fd);
289 		free(auth_info_file);
290 		auth_info_file = NULL;
291 	}
292 	restore_uid();
293 }
294 
295 static void
set_fwdpermit_from_authopts(struct ssh * ssh,const struct sshauthopt * opts)296 set_fwdpermit_from_authopts(struct ssh *ssh, const struct sshauthopt *opts)
297 {
298 	char *tmp, *cp, *host;
299 	int port;
300 	size_t i;
301 
302 	if ((options.allow_tcp_forwarding & FORWARD_LOCAL) != 0) {
303 		channel_clear_permission(ssh, FORWARD_USER, FORWARD_LOCAL);
304 		for (i = 0; i < auth_opts->npermitopen; i++) {
305 			tmp = cp = xstrdup(auth_opts->permitopen[i]);
306 			/* This shouldn't fail as it has already been checked */
307 			if ((host = hpdelim(&cp)) == NULL)
308 				fatal_f("internal error: hpdelim");
309 			host = cleanhostname(host);
310 			if (cp == NULL || (port = permitopen_port(cp)) < 0)
311 				fatal_f("internal error: permitopen port");
312 			channel_add_permission(ssh,
313 			    FORWARD_USER, FORWARD_LOCAL, host, port);
314 			free(tmp);
315 		}
316 	}
317 	if ((options.allow_tcp_forwarding & FORWARD_REMOTE) != 0) {
318 		channel_clear_permission(ssh, FORWARD_USER, FORWARD_REMOTE);
319 		for (i = 0; i < auth_opts->npermitlisten; i++) {
320 			tmp = cp = xstrdup(auth_opts->permitlisten[i]);
321 			/* This shouldn't fail as it has already been checked */
322 			if ((host = hpdelim(&cp)) == NULL)
323 				fatal_f("internal error: hpdelim");
324 			host = cleanhostname(host);
325 			if (cp == NULL || (port = permitopen_port(cp)) < 0)
326 				fatal_f("internal error: permitlisten port");
327 			channel_add_permission(ssh,
328 			    FORWARD_USER, FORWARD_REMOTE, host, port);
329 			free(tmp);
330 		}
331 	}
332 }
333 
334 void
do_authenticated(struct ssh * ssh,Authctxt * authctxt)335 do_authenticated(struct ssh *ssh, Authctxt *authctxt)
336 {
337 	setproctitle("%s", authctxt->pw->pw_name);
338 
339 	auth_log_authopts("active", auth_opts, 0);
340 
341 	/* setup the channel layer */
342 	/* XXX - streamlocal? */
343 	set_fwdpermit_from_authopts(ssh, auth_opts);
344 
345 	if (!auth_opts->permit_port_forwarding_flag ||
346 	    options.disable_forwarding) {
347 		channel_disable_admin(ssh, FORWARD_LOCAL);
348 		channel_disable_admin(ssh, FORWARD_REMOTE);
349 	} else {
350 		if ((options.allow_tcp_forwarding & FORWARD_LOCAL) == 0)
351 			channel_disable_admin(ssh, FORWARD_LOCAL);
352 		else
353 			channel_permit_all(ssh, FORWARD_LOCAL);
354 		if ((options.allow_tcp_forwarding & FORWARD_REMOTE) == 0)
355 			channel_disable_admin(ssh, FORWARD_REMOTE);
356 		else
357 			channel_permit_all(ssh, FORWARD_REMOTE);
358 	}
359 	auth_debug_send(ssh);
360 
361 	prepare_auth_info_file(authctxt->pw, authctxt->session_info);
362 
363 	do_authenticated2(ssh, authctxt);
364 
365 	do_cleanup(ssh, authctxt);
366 }
367 
368 /* Check untrusted xauth strings for metacharacters */
369 static int
xauth_valid_string(const char * s)370 xauth_valid_string(const char *s)
371 {
372 	size_t i;
373 
374 	for (i = 0; s[i] != '\0'; i++) {
375 		if (!isalnum((u_char)s[i]) &&
376 		    s[i] != '.' && s[i] != ':' && s[i] != '/' &&
377 		    s[i] != '-' && s[i] != '_')
378 			return 0;
379 	}
380 	return 1;
381 }
382 
383 #define USE_PIPES 1
384 /*
385  * This is called to fork and execute a command when we have no tty.  This
386  * will call do_child from the child, and server_loop from the parent after
387  * setting up file descriptors and such.
388  */
389 int
do_exec_no_pty(struct ssh * ssh,Session * s,const char * command)390 do_exec_no_pty(struct ssh *ssh, Session *s, const char *command)
391 {
392 	pid_t pid;
393 #ifdef USE_PIPES
394 	int pin[2], pout[2], perr[2];
395 
396 	if (s == NULL)
397 		fatal("do_exec_no_pty: no session");
398 
399 	/* Allocate pipes for communicating with the program. */
400 	if (pipe(pin) == -1) {
401 		error_f("pipe in: %.100s", strerror(errno));
402 		return -1;
403 	}
404 	if (pipe(pout) == -1) {
405 		error_f("pipe out: %.100s", strerror(errno));
406 		close(pin[0]);
407 		close(pin[1]);
408 		return -1;
409 	}
410 	if (pipe(perr) == -1) {
411 		error_f("pipe err: %.100s", strerror(errno));
412 		close(pin[0]);
413 		close(pin[1]);
414 		close(pout[0]);
415 		close(pout[1]);
416 		return -1;
417 	}
418 #else
419 	int inout[2], err[2];
420 
421 	if (s == NULL)
422 		fatal("do_exec_no_pty: no session");
423 
424 	/* Uses socket pairs to communicate with the program. */
425 	if (socketpair(AF_UNIX, SOCK_STREAM, 0, inout) == -1) {
426 		error_f("socketpair #1: %.100s", strerror(errno));
427 		return -1;
428 	}
429 	if (socketpair(AF_UNIX, SOCK_STREAM, 0, err) == -1) {
430 		error_f("socketpair #2: %.100s", strerror(errno));
431 		close(inout[0]);
432 		close(inout[1]);
433 		return -1;
434 	}
435 #endif
436 
437 	session_proctitle(s);
438 
439 	/* Fork the child. */
440 	switch ((pid = fork())) {
441 	case -1:
442 		error_f("fork: %.100s", strerror(errno));
443 #ifdef USE_PIPES
444 		close(pin[0]);
445 		close(pin[1]);
446 		close(pout[0]);
447 		close(pout[1]);
448 		close(perr[0]);
449 		close(perr[1]);
450 #else
451 		close(inout[0]);
452 		close(inout[1]);
453 		close(err[0]);
454 		close(err[1]);
455 #endif
456 		return -1;
457 	case 0:
458 		is_child = 1;
459 
460 		/*
461 		 * Create a new session and process group since the 4.4BSD
462 		 * setlogin() affects the entire process group.
463 		 */
464 		if (setsid() == -1)
465 			error("setsid failed: %.100s", strerror(errno));
466 
467 #ifdef USE_PIPES
468 		/*
469 		 * Redirect stdin.  We close the parent side of the socket
470 		 * pair, and make the child side the standard input.
471 		 */
472 		close(pin[1]);
473 		if (dup2(pin[0], 0) == -1)
474 			perror("dup2 stdin");
475 		close(pin[0]);
476 
477 		/* Redirect stdout. */
478 		close(pout[0]);
479 		if (dup2(pout[1], 1) == -1)
480 			perror("dup2 stdout");
481 		close(pout[1]);
482 
483 		/* Redirect stderr. */
484 		close(perr[0]);
485 		if (dup2(perr[1], 2) == -1)
486 			perror("dup2 stderr");
487 		close(perr[1]);
488 #else
489 		/*
490 		 * Redirect stdin, stdout, and stderr.  Stdin and stdout will
491 		 * use the same socket, as some programs (particularly rdist)
492 		 * seem to depend on it.
493 		 */
494 		close(inout[1]);
495 		close(err[1]);
496 		if (dup2(inout[0], 0) == -1)	/* stdin */
497 			perror("dup2 stdin");
498 		if (dup2(inout[0], 1) == -1)	/* stdout (same as stdin) */
499 			perror("dup2 stdout");
500 		close(inout[0]);
501 		if (dup2(err[0], 2) == -1)	/* stderr */
502 			perror("dup2 stderr");
503 		close(err[0]);
504 #endif
505 
506 		/* Do processing for the child (exec command etc). */
507 		do_child(ssh, s, command);
508 		/* NOTREACHED */
509 	default:
510 		break;
511 	}
512 
513 #ifdef HAVE_CYGWIN
514 	cygwin_set_impersonation_token(INVALID_HANDLE_VALUE);
515 #endif
516 
517 	s->pid = pid;
518 	/* Set interactive/non-interactive mode. */
519 	ssh_packet_set_interactive(ssh, s->display != NULL,
520 	    options.ip_qos_interactive, options.ip_qos_bulk);
521 
522 	/*
523 	 * Clear loginmsg, since it's the child's responsibility to display
524 	 * it to the user, otherwise multiple sessions may accumulate
525 	 * multiple copies of the login messages.
526 	 */
527 	sshbuf_reset(loginmsg);
528 
529 #ifdef USE_PIPES
530 	/* We are the parent.  Close the child sides of the pipes. */
531 	close(pin[0]);
532 	close(pout[1]);
533 	close(perr[1]);
534 
535 	session_set_fds(ssh, s, pin[1], pout[0], perr[0],
536 	    s->is_subsystem, 0);
537 #else
538 	/* We are the parent.  Close the child sides of the socket pairs. */
539 	close(inout[0]);
540 	close(err[0]);
541 
542 	/*
543 	 * Enter the interactive session.  Note: server_loop must be able to
544 	 * handle the case that fdin and fdout are the same.
545 	 */
546 	session_set_fds(ssh, s, inout[1], inout[1], err[1],
547 	    s->is_subsystem, 0);
548 #endif
549 	return 0;
550 }
551 
552 /*
553  * This is called to fork and execute a command when we have a tty.  This
554  * will call do_child from the child, and server_loop from the parent after
555  * setting up file descriptors, controlling tty, updating wtmp, utmp,
556  * lastlog, and other such operations.
557  */
558 int
do_exec_pty(struct ssh * ssh,Session * s,const char * command)559 do_exec_pty(struct ssh *ssh, Session *s, const char *command)
560 {
561 	int fdout, ptyfd, ttyfd, ptymaster;
562 	pid_t pid;
563 
564 	if (s == NULL)
565 		fatal("do_exec_pty: no session");
566 	ptyfd = s->ptyfd;
567 	ttyfd = s->ttyfd;
568 
569 	/*
570 	 * Create another descriptor of the pty master side for use as the
571 	 * standard input.  We could use the original descriptor, but this
572 	 * simplifies code in server_loop.  The descriptor is bidirectional.
573 	 * Do this before forking (and cleanup in the child) so as to
574 	 * detect and gracefully fail out-of-fd conditions.
575 	 */
576 	if ((fdout = dup(ptyfd)) == -1) {
577 		error_f("dup #1: %s", strerror(errno));
578 		close(ttyfd);
579 		close(ptyfd);
580 		return -1;
581 	}
582 	/* we keep a reference to the pty master */
583 	if ((ptymaster = dup(ptyfd)) == -1) {
584 		error_f("dup #2: %s", strerror(errno));
585 		close(ttyfd);
586 		close(ptyfd);
587 		close(fdout);
588 		return -1;
589 	}
590 
591 	/* Fork the child. */
592 	switch ((pid = fork())) {
593 	case -1:
594 		error_f("fork: %.100s", strerror(errno));
595 		close(fdout);
596 		close(ptymaster);
597 		close(ttyfd);
598 		close(ptyfd);
599 		return -1;
600 	case 0:
601 		is_child = 1;
602 
603 		close(fdout);
604 		close(ptymaster);
605 
606 		/* Close the master side of the pseudo tty. */
607 		close(ptyfd);
608 
609 		/* Make the pseudo tty our controlling tty. */
610 		pty_make_controlling_tty(&ttyfd, s->tty);
611 
612 		/* Redirect stdin/stdout/stderr from the pseudo tty. */
613 		if (dup2(ttyfd, 0) == -1)
614 			error("dup2 stdin: %s", strerror(errno));
615 		if (dup2(ttyfd, 1) == -1)
616 			error("dup2 stdout: %s", strerror(errno));
617 		if (dup2(ttyfd, 2) == -1)
618 			error("dup2 stderr: %s", strerror(errno));
619 
620 		/* Close the extra descriptor for the pseudo tty. */
621 		close(ttyfd);
622 
623 		/* record login, etc. similar to login(1) */
624 #ifndef HAVE_OSF_SIA
625 		do_login(ssh, s, command);
626 #endif
627 		/*
628 		 * Do common processing for the child, such as execing
629 		 * the command.
630 		 */
631 		do_child(ssh, s, command);
632 		/* NOTREACHED */
633 	default:
634 		break;
635 	}
636 
637 #ifdef HAVE_CYGWIN
638 	cygwin_set_impersonation_token(INVALID_HANDLE_VALUE);
639 #endif
640 
641 	s->pid = pid;
642 
643 	/* Parent.  Close the slave side of the pseudo tty. */
644 	close(ttyfd);
645 
646 	/* Enter interactive session. */
647 	s->ptymaster = ptymaster;
648 	ssh_packet_set_interactive(ssh, 1,
649 	    options.ip_qos_interactive, options.ip_qos_bulk);
650 	session_set_fds(ssh, s, ptyfd, fdout, -1, 1, 1);
651 	return 0;
652 }
653 
654 /*
655  * This is called to fork and execute a command.  If another command is
656  * to be forced, execute that instead.
657  */
658 int
do_exec(struct ssh * ssh,Session * s,const char * command)659 do_exec(struct ssh *ssh, Session *s, const char *command)
660 {
661 	int ret;
662 	const char *forced = NULL, *tty = NULL;
663 	char session_type[1024];
664 
665 	if (options.adm_forced_command) {
666 		original_command = command;
667 		command = options.adm_forced_command;
668 		forced = "(config)";
669 	} else if (auth_opts->force_command != NULL) {
670 		original_command = command;
671 		command = auth_opts->force_command;
672 		forced = "(key-option)";
673 	}
674 	s->forced = 0;
675 	if (forced != NULL) {
676 		s->forced = 1;
677 		if (IS_INTERNAL_SFTP(command)) {
678 			s->is_subsystem = s->is_subsystem ?
679 			    SUBSYSTEM_INT_SFTP : SUBSYSTEM_INT_SFTP_ERROR;
680 		} else if (s->is_subsystem)
681 			s->is_subsystem = SUBSYSTEM_EXT;
682 		snprintf(session_type, sizeof(session_type),
683 		    "forced-command %s '%.900s'", forced, command);
684 	} else if (s->is_subsystem) {
685 		snprintf(session_type, sizeof(session_type),
686 		    "subsystem '%.900s'", s->subsys);
687 	} else if (command == NULL) {
688 		snprintf(session_type, sizeof(session_type), "shell");
689 	} else {
690 		/* NB. we don't log unforced commands to preserve privacy */
691 		snprintf(session_type, sizeof(session_type), "command");
692 	}
693 
694 	if (s->ttyfd != -1) {
695 		tty = s->tty;
696 		if (strncmp(tty, "/dev/", 5) == 0)
697 			tty += 5;
698 	}
699 
700 	verbose("Starting session: %s%s%s for %s from %.200s port %d id %d",
701 	    session_type,
702 	    tty == NULL ? "" : " on ",
703 	    tty == NULL ? "" : tty,
704 	    s->pw->pw_name,
705 	    ssh_remote_ipaddr(ssh),
706 	    ssh_remote_port(ssh),
707 	    s->self);
708 
709 #ifdef SSH_AUDIT_EVENTS
710 	if (command != NULL)
711 		PRIVSEP(audit_run_command(command));
712 	else if (s->ttyfd == -1) {
713 		char *shell = s->pw->pw_shell;
714 
715 		if (shell[0] == '\0')	/* empty shell means /bin/sh */
716 			shell =_PATH_BSHELL;
717 		PRIVSEP(audit_run_command(shell));
718 	}
719 #endif
720 	if (s->ttyfd != -1)
721 		ret = do_exec_pty(ssh, s, command);
722 	else
723 		ret = do_exec_no_pty(ssh, s, command);
724 
725 	original_command = NULL;
726 
727 	/*
728 	 * Clear loginmsg: it's the child's responsibility to display
729 	 * it to the user, otherwise multiple sessions may accumulate
730 	 * multiple copies of the login messages.
731 	 */
732 	sshbuf_reset(loginmsg);
733 
734 	return ret;
735 }
736 
737 /* administrative, login(1)-like work */
738 void
do_login(struct ssh * ssh,Session * s,const char * command)739 do_login(struct ssh *ssh, Session *s, const char *command)
740 {
741 	socklen_t fromlen;
742 	struct sockaddr_storage from;
743 	struct passwd * pw = s->pw;
744 	pid_t pid = getpid();
745 
746 	/*
747 	 * Get IP address of client. If the connection is not a socket, let
748 	 * the address be 0.0.0.0.
749 	 */
750 	memset(&from, 0, sizeof(from));
751 	fromlen = sizeof(from);
752 	if (ssh_packet_connection_is_on_socket(ssh)) {
753 		if (getpeername(ssh_packet_get_connection_in(ssh),
754 		    (struct sockaddr *)&from, &fromlen) == -1) {
755 			debug("getpeername: %.100s", strerror(errno));
756 			cleanup_exit(255);
757 		}
758 	}
759 
760 	/* Record that there was a login on that tty from the remote host. */
761 	if (!use_privsep)
762 		record_login(pid, s->tty, pw->pw_name, pw->pw_uid,
763 		    session_get_remote_name_or_ip(ssh, utmp_len,
764 		    options.use_dns),
765 		    (struct sockaddr *)&from, fromlen);
766 
767 #ifdef USE_PAM
768 	/*
769 	 * If password change is needed, do it now.
770 	 * This needs to occur before the ~/.hushlogin check.
771 	 */
772 	if (options.use_pam && !use_privsep && s->authctxt->force_pwchange) {
773 		display_loginmsg();
774 		do_pam_chauthtok();
775 		s->authctxt->force_pwchange = 0;
776 		/* XXX - signal [net] parent to enable forwardings */
777 	}
778 #endif
779 
780 	if (check_quietlogin(s, command))
781 		return;
782 
783 	display_loginmsg();
784 
785 	do_motd();
786 }
787 
788 /*
789  * Display the message of the day.
790  */
791 void
do_motd(void)792 do_motd(void)
793 {
794 	FILE *f;
795 	char buf[256];
796 
797 	if (options.print_motd) {
798 #ifdef HAVE_LOGIN_CAP
799 		f = fopen(login_getcapstr(lc, "welcome", "/etc/motd",
800 		    "/etc/motd"), "r");
801 #else
802 		f = fopen("/etc/motd", "r");
803 #endif
804 		if (f) {
805 			while (fgets(buf, sizeof(buf), f))
806 				fputs(buf, stdout);
807 			fclose(f);
808 		}
809 	}
810 }
811 
812 
813 /*
814  * Check for quiet login, either .hushlogin or command given.
815  */
816 int
check_quietlogin(Session * s,const char * command)817 check_quietlogin(Session *s, const char *command)
818 {
819 	char buf[256];
820 	struct passwd *pw = s->pw;
821 	struct stat st;
822 
823 	/* Return 1 if .hushlogin exists or a command given. */
824 	if (command != NULL)
825 		return 1;
826 	snprintf(buf, sizeof(buf), "%.200s/.hushlogin", pw->pw_dir);
827 #ifdef HAVE_LOGIN_CAP
828 	if (login_getcapbool(lc, "hushlogin", 0) || stat(buf, &st) >= 0)
829 		return 1;
830 #else
831 	if (stat(buf, &st) >= 0)
832 		return 1;
833 #endif
834 	return 0;
835 }
836 
837 /*
838  * Reads environment variables from the given file and adds/overrides them
839  * into the environment.  If the file does not exist, this does nothing.
840  * Otherwise, it must consist of empty lines, comments (line starts with '#')
841  * and assignments of the form name=value.  No other forms are allowed.
842  * If allowlist is not NULL, then it is interpreted as a pattern list and
843  * only variable names that match it will be accepted.
844  */
845 static void
read_environment_file(char *** env,u_int * envsize,const char * filename,const char * allowlist)846 read_environment_file(char ***env, u_int *envsize,
847 	const char *filename, const char *allowlist)
848 {
849 	FILE *f;
850 	char *line = NULL, *cp, *value;
851 	size_t linesize = 0;
852 	u_int lineno = 0;
853 
854 	f = fopen(filename, "r");
855 	if (!f)
856 		return;
857 
858 	while (getline(&line, &linesize, f) != -1) {
859 		if (++lineno > 1000)
860 			fatal("Too many lines in environment file %s", filename);
861 		for (cp = line; *cp == ' ' || *cp == '\t'; cp++)
862 			;
863 		if (!*cp || *cp == '#' || *cp == '\n')
864 			continue;
865 
866 		cp[strcspn(cp, "\n")] = '\0';
867 
868 		value = strchr(cp, '=');
869 		if (value == NULL) {
870 			fprintf(stderr, "Bad line %u in %.100s\n", lineno,
871 			    filename);
872 			continue;
873 		}
874 		/*
875 		 * Replace the equals sign by nul, and advance value to
876 		 * the value string.
877 		 */
878 		*value = '\0';
879 		value++;
880 		if (allowlist != NULL &&
881 		    match_pattern_list(cp, allowlist, 0) != 1)
882 			continue;
883 		child_set_env(env, envsize, cp, value);
884 	}
885 	free(line);
886 	fclose(f);
887 }
888 
889 #ifdef HAVE_ETC_DEFAULT_LOGIN
890 /*
891  * Return named variable from specified environment, or NULL if not present.
892  */
893 static char *
child_get_env(char ** env,const char * name)894 child_get_env(char **env, const char *name)
895 {
896 	int i;
897 	size_t len;
898 
899 	len = strlen(name);
900 	for (i=0; env[i] != NULL; i++)
901 		if (strncmp(name, env[i], len) == 0 && env[i][len] == '=')
902 			return(env[i] + len + 1);
903 	return NULL;
904 }
905 
906 /*
907  * Read /etc/default/login.
908  * We pick up the PATH (or SUPATH for root) and UMASK.
909  */
910 static void
read_etc_default_login(char *** env,u_int * envsize,uid_t uid)911 read_etc_default_login(char ***env, u_int *envsize, uid_t uid)
912 {
913 	char **tmpenv = NULL, *var;
914 	u_int i, tmpenvsize = 0;
915 	u_long mask;
916 
917 	/*
918 	 * We don't want to copy the whole file to the child's environment,
919 	 * so we use a temporary environment and copy the variables we're
920 	 * interested in.
921 	 */
922 	read_environment_file(&tmpenv, &tmpenvsize, "/etc/default/login",
923 	    options.permit_user_env_allowlist);
924 
925 	if (tmpenv == NULL)
926 		return;
927 
928 	if (uid == 0)
929 		var = child_get_env(tmpenv, "SUPATH");
930 	else
931 		var = child_get_env(tmpenv, "PATH");
932 	if (var != NULL)
933 		child_set_env(env, envsize, "PATH", var);
934 
935 	if ((var = child_get_env(tmpenv, "UMASK")) != NULL)
936 		if (sscanf(var, "%5lo", &mask) == 1)
937 			umask((mode_t)mask);
938 
939 	for (i = 0; tmpenv[i] != NULL; i++)
940 		free(tmpenv[i]);
941 	free(tmpenv);
942 }
943 #endif /* HAVE_ETC_DEFAULT_LOGIN */
944 
945 #if defined(USE_PAM) || defined(HAVE_CYGWIN)
946 static void
copy_environment_denylist(char ** source,char *** env,u_int * envsize,const char * denylist)947 copy_environment_denylist(char **source, char ***env, u_int *envsize,
948     const char *denylist)
949 {
950 	char *var_name, *var_val;
951 	int i;
952 
953 	if (source == NULL)
954 		return;
955 
956 	for(i = 0; source[i] != NULL; i++) {
957 		var_name = xstrdup(source[i]);
958 		if ((var_val = strstr(var_name, "=")) == NULL) {
959 			free(var_name);
960 			continue;
961 		}
962 		*var_val++ = '\0';
963 
964 		if (denylist == NULL ||
965 		    match_pattern_list(var_name, denylist, 0) != 1) {
966 			debug3("Copy environment: %s=%s", var_name, var_val);
967 			child_set_env(env, envsize, var_name, var_val);
968 		}
969 
970 		free(var_name);
971 	}
972 }
973 #endif /* defined(USE_PAM) || defined(HAVE_CYGWIN) */
974 
975 #ifdef HAVE_CYGWIN
976 static void
copy_environment(char ** source,char *** env,u_int * envsize)977 copy_environment(char **source, char ***env, u_int *envsize)
978 {
979 	copy_environment_denylist(source, env, envsize, NULL);
980 }
981 #endif
982 
983 static char **
do_setup_env(struct ssh * ssh,Session * s,const char * shell)984 do_setup_env(struct ssh *ssh, Session *s, const char *shell)
985 {
986 	char buf[256];
987 	size_t n;
988 	u_int i, envsize;
989 	char *ocp, *cp, *value, **env, *laddr;
990 	struct passwd *pw = s->pw;
991 #if !defined (HAVE_LOGIN_CAP) && !defined (HAVE_CYGWIN)
992 	char *path = NULL;
993 #endif
994 
995 	/* Initialize the environment. */
996 	envsize = 100;
997 	env = xcalloc(envsize, sizeof(char *));
998 	env[0] = NULL;
999 
1000 #ifdef HAVE_CYGWIN
1001 	/*
1002 	 * The Windows environment contains some setting which are
1003 	 * important for a running system. They must not be dropped.
1004 	 */
1005 	{
1006 		char **p;
1007 
1008 		p = fetch_windows_environment();
1009 		copy_environment(p, &env, &envsize);
1010 		free_windows_environment(p);
1011 	}
1012 #endif
1013 
1014 #ifdef GSSAPI
1015 	/* Allow any GSSAPI methods that we've used to alter
1016 	 * the child's environment as they see fit
1017 	 */
1018 	ssh_gssapi_do_child(&env, &envsize);
1019 #endif
1020 
1021 	/* Set basic environment. */
1022 	for (i = 0; i < s->num_env; i++)
1023 		child_set_env(&env, &envsize, s->env[i].name, s->env[i].val);
1024 
1025 	child_set_env(&env, &envsize, "USER", pw->pw_name);
1026 	child_set_env(&env, &envsize, "LOGNAME", pw->pw_name);
1027 #ifdef _AIX
1028 	child_set_env(&env, &envsize, "LOGIN", pw->pw_name);
1029 #endif
1030 	child_set_env(&env, &envsize, "HOME", pw->pw_dir);
1031 #ifdef HAVE_LOGIN_CAP
1032 	if (setusercontext(lc, pw, pw->pw_uid, LOGIN_SETPATH) < 0)
1033 		child_set_env(&env, &envsize, "PATH", _PATH_STDPATH);
1034 	else
1035 		child_set_env(&env, &envsize, "PATH", getenv("PATH"));
1036 #else /* HAVE_LOGIN_CAP */
1037 # ifndef HAVE_CYGWIN
1038 	/*
1039 	 * There's no standard path on Windows. The path contains
1040 	 * important components pointing to the system directories,
1041 	 * needed for loading shared libraries. So the path better
1042 	 * remains intact here.
1043 	 */
1044 #  ifdef HAVE_ETC_DEFAULT_LOGIN
1045 	read_etc_default_login(&env, &envsize, pw->pw_uid);
1046 	path = child_get_env(env, "PATH");
1047 #  endif /* HAVE_ETC_DEFAULT_LOGIN */
1048 	if (path == NULL || *path == '\0') {
1049 		child_set_env(&env, &envsize, "PATH",
1050 		    s->pw->pw_uid == 0 ?  SUPERUSER_PATH : _PATH_STDPATH);
1051 	}
1052 # endif /* HAVE_CYGWIN */
1053 #endif /* HAVE_LOGIN_CAP */
1054 
1055 	if (!options.use_pam) {
1056 		snprintf(buf, sizeof buf, "%.200s/%.50s",
1057 		    _PATH_MAILDIR, pw->pw_name);
1058 		child_set_env(&env, &envsize, "MAIL", buf);
1059 	}
1060 
1061 	/* Normal systems set SHELL by default. */
1062 	child_set_env(&env, &envsize, "SHELL", shell);
1063 
1064 	if (getenv("TZ"))
1065 		child_set_env(&env, &envsize, "TZ", getenv("TZ"));
1066 	if (s->term)
1067 		child_set_env(&env, &envsize, "TERM", s->term);
1068 	if (s->display)
1069 		child_set_env(&env, &envsize, "DISPLAY", s->display);
1070 
1071 	/*
1072 	 * Since we clear KRB5CCNAME at startup, if it's set now then it
1073 	 * must have been set by a native authentication method (eg AIX or
1074 	 * SIA), so copy it to the child.
1075 	 */
1076 	{
1077 		char *cp;
1078 
1079 		if ((cp = getenv("KRB5CCNAME")) != NULL)
1080 			child_set_env(&env, &envsize, "KRB5CCNAME", cp);
1081 	}
1082 
1083 #ifdef _AIX
1084 	{
1085 		char *cp;
1086 
1087 		if ((cp = getenv("AUTHSTATE")) != NULL)
1088 			child_set_env(&env, &envsize, "AUTHSTATE", cp);
1089 		read_environment_file(&env, &envsize, "/etc/environment",
1090 		    options.permit_user_env_allowlist);
1091 	}
1092 #endif
1093 #ifdef KRB5
1094 	if (s->authctxt->krb5_ccname)
1095 		child_set_env(&env, &envsize, "KRB5CCNAME",
1096 		    s->authctxt->krb5_ccname);
1097 #endif
1098 	if (auth_sock_name != NULL)
1099 		child_set_env(&env, &envsize, SSH_AUTHSOCKET_ENV_NAME,
1100 		    auth_sock_name);
1101 
1102 
1103 	/* Set custom environment options from pubkey authentication. */
1104 	if (options.permit_user_env) {
1105 		for (n = 0 ; n < auth_opts->nenv; n++) {
1106 			ocp = xstrdup(auth_opts->env[n]);
1107 			cp = strchr(ocp, '=');
1108 			if (cp != NULL) {
1109 				*cp = '\0';
1110 				/* Apply PermitUserEnvironment allowlist */
1111 				if (options.permit_user_env_allowlist == NULL ||
1112 				    match_pattern_list(ocp,
1113 				    options.permit_user_env_allowlist, 0) == 1)
1114 					child_set_env(&env, &envsize,
1115 					    ocp, cp + 1);
1116 			}
1117 			free(ocp);
1118 		}
1119 	}
1120 
1121 	/* read $HOME/.ssh/environment. */
1122 	if (options.permit_user_env) {
1123 		snprintf(buf, sizeof buf, "%.200s/%s/environment",
1124 		    pw->pw_dir, _PATH_SSH_USER_DIR);
1125 		read_environment_file(&env, &envsize, buf,
1126 		    options.permit_user_env_allowlist);
1127 	}
1128 
1129 #ifdef USE_PAM
1130 	/*
1131 	 * Pull in any environment variables that may have
1132 	 * been set by PAM.
1133 	 */
1134 	if (options.use_pam) {
1135 		char **p;
1136 
1137 		/*
1138 		 * Don't allow PAM-internal env vars to leak
1139 		 * back into the session environment.
1140 		 */
1141 #define PAM_ENV_DENYLIST  "SSH_AUTH_INFO*,SSH_CONNECTION*"
1142 		p = fetch_pam_child_environment();
1143 		copy_environment_denylist(p, &env, &envsize,
1144 		    PAM_ENV_DENYLIST);
1145 		free_pam_environment(p);
1146 
1147 		p = fetch_pam_environment();
1148 		copy_environment_denylist(p, &env, &envsize,
1149 		    PAM_ENV_DENYLIST);
1150 		free_pam_environment(p);
1151 	}
1152 #endif /* USE_PAM */
1153 
1154 	/* Environment specified by admin */
1155 	for (i = 0; i < options.num_setenv; i++) {
1156 		cp = xstrdup(options.setenv[i]);
1157 		if ((value = strchr(cp, '=')) == NULL) {
1158 			/* shouldn't happen; vars are checked in servconf.c */
1159 			fatal("Invalid config SetEnv: %s", options.setenv[i]);
1160 		}
1161 		*value++ = '\0';
1162 		child_set_env(&env, &envsize, cp, value);
1163 	}
1164 
1165 	/* SSH_CLIENT deprecated */
1166 	snprintf(buf, sizeof buf, "%.50s %d %d",
1167 	    ssh_remote_ipaddr(ssh), ssh_remote_port(ssh),
1168 	    ssh_local_port(ssh));
1169 	child_set_env(&env, &envsize, "SSH_CLIENT", buf);
1170 
1171 	laddr = get_local_ipaddr(ssh_packet_get_connection_in(ssh));
1172 	snprintf(buf, sizeof buf, "%.50s %d %.50s %d",
1173 	    ssh_remote_ipaddr(ssh), ssh_remote_port(ssh),
1174 	    laddr, ssh_local_port(ssh));
1175 	free(laddr);
1176 	child_set_env(&env, &envsize, "SSH_CONNECTION", buf);
1177 
1178 	if (tun_fwd_ifnames != NULL)
1179 		child_set_env(&env, &envsize, "SSH_TUNNEL", tun_fwd_ifnames);
1180 	if (auth_info_file != NULL)
1181 		child_set_env(&env, &envsize, "SSH_USER_AUTH", auth_info_file);
1182 	if (s->ttyfd != -1)
1183 		child_set_env(&env, &envsize, "SSH_TTY", s->tty);
1184 	if (original_command)
1185 		child_set_env(&env, &envsize, "SSH_ORIGINAL_COMMAND",
1186 		    original_command);
1187 
1188 	if (debug_flag) {
1189 		/* dump the environment */
1190 		fprintf(stderr, "Environment:\n");
1191 		for (i = 0; env[i]; i++)
1192 			fprintf(stderr, "  %.200s\n", env[i]);
1193 	}
1194 	return env;
1195 }
1196 
1197 /*
1198  * Run $HOME/.ssh/rc, /etc/ssh/sshrc, or xauth (whichever is found
1199  * first in this order).
1200  */
1201 static void
do_rc_files(struct ssh * ssh,Session * s,const char * shell)1202 do_rc_files(struct ssh *ssh, Session *s, const char *shell)
1203 {
1204 	FILE *f = NULL;
1205 	char *cmd = NULL, *user_rc = NULL;
1206 	int do_xauth;
1207 	struct stat st;
1208 
1209 	do_xauth =
1210 	    s->display != NULL && s->auth_proto != NULL && s->auth_data != NULL;
1211 	xasprintf(&user_rc, "%s/%s", s->pw->pw_dir, _PATH_SSH_USER_RC);
1212 
1213 	/* ignore _PATH_SSH_USER_RC for subsystems and admin forced commands */
1214 	if (!s->is_subsystem && options.adm_forced_command == NULL &&
1215 	    auth_opts->permit_user_rc && options.permit_user_rc &&
1216 	    stat(user_rc, &st) >= 0) {
1217 		if (xasprintf(&cmd, "%s -c '%s %s'", shell, _PATH_BSHELL,
1218 		    user_rc) == -1)
1219 			fatal_f("xasprintf: %s", strerror(errno));
1220 		if (debug_flag)
1221 			fprintf(stderr, "Running %s\n", cmd);
1222 		f = popen(cmd, "w");
1223 		if (f) {
1224 			if (do_xauth)
1225 				fprintf(f, "%s %s\n", s->auth_proto,
1226 				    s->auth_data);
1227 			pclose(f);
1228 		} else
1229 			fprintf(stderr, "Could not run %s\n",
1230 			    user_rc);
1231 	} else if (stat(_PATH_SSH_SYSTEM_RC, &st) >= 0) {
1232 		if (debug_flag)
1233 			fprintf(stderr, "Running %s %s\n", _PATH_BSHELL,
1234 			    _PATH_SSH_SYSTEM_RC);
1235 		f = popen(_PATH_BSHELL " " _PATH_SSH_SYSTEM_RC, "w");
1236 		if (f) {
1237 			if (do_xauth)
1238 				fprintf(f, "%s %s\n", s->auth_proto,
1239 				    s->auth_data);
1240 			pclose(f);
1241 		} else
1242 			fprintf(stderr, "Could not run %s\n",
1243 			    _PATH_SSH_SYSTEM_RC);
1244 	} else if (do_xauth && options.xauth_location != NULL) {
1245 		/* Add authority data to .Xauthority if appropriate. */
1246 		if (debug_flag) {
1247 			fprintf(stderr,
1248 			    "Running %.500s remove %.100s\n",
1249 			    options.xauth_location, s->auth_display);
1250 			fprintf(stderr,
1251 			    "%.500s add %.100s %.100s %.100s\n",
1252 			    options.xauth_location, s->auth_display,
1253 			    s->auth_proto, s->auth_data);
1254 		}
1255 		if (xasprintf(&cmd, "%s -q -", options.xauth_location) == -1)
1256 			fatal_f("xasprintf: %s", strerror(errno));
1257 		f = popen(cmd, "w");
1258 		if (f) {
1259 			fprintf(f, "remove %s\n",
1260 			    s->auth_display);
1261 			fprintf(f, "add %s %s %s\n",
1262 			    s->auth_display, s->auth_proto,
1263 			    s->auth_data);
1264 			pclose(f);
1265 		} else {
1266 			fprintf(stderr, "Could not run %s\n",
1267 			    cmd);
1268 		}
1269 	}
1270 	free(cmd);
1271 	free(user_rc);
1272 }
1273 
1274 static void
do_nologin(struct passwd * pw)1275 do_nologin(struct passwd *pw)
1276 {
1277 	FILE *f = NULL;
1278 	char buf[1024], *nl, *def_nl = _PATH_NOLOGIN;
1279 	struct stat sb;
1280 
1281 #ifdef HAVE_LOGIN_CAP
1282 	if (login_getcapbool(lc, "ignorenologin", 0) || pw->pw_uid == 0)
1283 		return;
1284 	nl = login_getcapstr(lc, "nologin", def_nl, def_nl);
1285 #else
1286 	if (pw->pw_uid == 0)
1287 		return;
1288 	nl = def_nl;
1289 #endif
1290 	if (stat(nl, &sb) == -1) {
1291 		if (nl != def_nl)
1292 			free(nl);
1293 		return;
1294 	}
1295 
1296 	/* /etc/nologin exists.  Print its contents if we can and exit. */
1297 	logit("User %.100s not allowed because %s exists", pw->pw_name, nl);
1298 	if ((f = fopen(nl, "r")) != NULL) {
1299 		while (fgets(buf, sizeof(buf), f))
1300 			fputs(buf, stderr);
1301 		fclose(f);
1302 	}
1303 	exit(254);
1304 }
1305 
1306 /*
1307  * Chroot into a directory after checking it for safety: all path components
1308  * must be root-owned directories with strict permissions.
1309  */
1310 static void
safely_chroot(const char * path,uid_t uid)1311 safely_chroot(const char *path, uid_t uid)
1312 {
1313 	const char *cp;
1314 	char component[PATH_MAX];
1315 	struct stat st;
1316 
1317 	if (!path_absolute(path))
1318 		fatal("chroot path does not begin at root");
1319 	if (strlen(path) >= sizeof(component))
1320 		fatal("chroot path too long");
1321 
1322 	/*
1323 	 * Descend the path, checking that each component is a
1324 	 * root-owned directory with strict permissions.
1325 	 */
1326 	for (cp = path; cp != NULL;) {
1327 		if ((cp = strchr(cp, '/')) == NULL)
1328 			strlcpy(component, path, sizeof(component));
1329 		else {
1330 			cp++;
1331 			memcpy(component, path, cp - path);
1332 			component[cp - path] = '\0';
1333 		}
1334 
1335 		debug3_f("checking '%s'", component);
1336 
1337 		if (stat(component, &st) != 0)
1338 			fatal_f("stat(\"%s\"): %s",
1339 			    component, strerror(errno));
1340 		if (st.st_uid != 0 || (st.st_mode & 022) != 0)
1341 			fatal("bad ownership or modes for chroot "
1342 			    "directory %s\"%s\"",
1343 			    cp == NULL ? "" : "component ", component);
1344 		if (!S_ISDIR(st.st_mode))
1345 			fatal("chroot path %s\"%s\" is not a directory",
1346 			    cp == NULL ? "" : "component ", component);
1347 
1348 	}
1349 
1350 	if (chdir(path) == -1)
1351 		fatal("Unable to chdir to chroot path \"%s\": "
1352 		    "%s", path, strerror(errno));
1353 	if (chroot(path) == -1)
1354 		fatal("chroot(\"%s\"): %s", path, strerror(errno));
1355 	if (chdir("/") == -1)
1356 		fatal_f("chdir(/) after chroot: %s", strerror(errno));
1357 	verbose("Changed root directory to \"%s\"", path);
1358 }
1359 
1360 /* Set login name, uid, gid, and groups. */
1361 void
do_setusercontext(struct passwd * pw)1362 do_setusercontext(struct passwd *pw)
1363 {
1364 	char uidstr[32], *chroot_path, *tmp;
1365 
1366 	platform_setusercontext(pw);
1367 
1368 	if (platform_privileged_uidswap()) {
1369 #ifdef HAVE_LOGIN_CAP
1370 		if (setusercontext(lc, pw, pw->pw_uid,
1371 		    (LOGIN_SETALL & ~(LOGIN_SETPATH|LOGIN_SETUSER))) < 0) {
1372 			perror("unable to set user context");
1373 			exit(1);
1374 		}
1375 #else
1376 		if (setlogin(pw->pw_name) < 0)
1377 			error("setlogin failed: %s", strerror(errno));
1378 		if (setgid(pw->pw_gid) < 0) {
1379 			perror("setgid");
1380 			exit(1);
1381 		}
1382 		/* Initialize the group list. */
1383 		if (initgroups(pw->pw_name, pw->pw_gid) < 0) {
1384 			perror("initgroups");
1385 			exit(1);
1386 		}
1387 		endgrent();
1388 #endif
1389 
1390 		platform_setusercontext_post_groups(pw);
1391 
1392 		if (!in_chroot && options.chroot_directory != NULL &&
1393 		    strcasecmp(options.chroot_directory, "none") != 0) {
1394                         tmp = tilde_expand_filename(options.chroot_directory,
1395 			    pw->pw_uid);
1396 			snprintf(uidstr, sizeof(uidstr), "%llu",
1397 			    (unsigned long long)pw->pw_uid);
1398 			chroot_path = percent_expand(tmp, "h", pw->pw_dir,
1399 			    "u", pw->pw_name, "U", uidstr, (char *)NULL);
1400 			safely_chroot(chroot_path, pw->pw_uid);
1401 			free(tmp);
1402 			free(chroot_path);
1403 			/* Make sure we don't attempt to chroot again */
1404 			free(options.chroot_directory);
1405 			options.chroot_directory = NULL;
1406 			in_chroot = 1;
1407 		}
1408 
1409 #ifdef HAVE_LOGIN_CAP
1410 		if (setusercontext(lc, pw, pw->pw_uid, LOGIN_SETUSER) < 0) {
1411 			perror("unable to set user context (setuser)");
1412 			exit(1);
1413 		}
1414 		/*
1415 		 * FreeBSD's setusercontext() will not apply the user's
1416 		 * own umask setting unless running with the user's UID.
1417 		 */
1418 		(void) setusercontext(lc, pw, pw->pw_uid, LOGIN_SETUMASK);
1419 #else
1420 # ifdef USE_LIBIAF
1421 		/*
1422 		 * In a chroot environment, the set_id() will always fail;
1423 		 * typically because of the lack of necessary authentication
1424 		 * services and runtime such as ./usr/lib/libiaf.so,
1425 		 * ./usr/lib/libpam.so.1, and ./etc/passwd We skip it in the
1426 		 * internal sftp chroot case.  We'll lose auditing and ACLs but
1427 		 * permanently_set_uid will take care of the rest.
1428 		 */
1429 		if (!in_chroot && set_id(pw->pw_name) != 0)
1430 			fatal("set_id(%s) Failed", pw->pw_name);
1431 # endif /* USE_LIBIAF */
1432 		/* Permanently switch to the desired uid. */
1433 		permanently_set_uid(pw);
1434 #endif
1435 	} else if (options.chroot_directory != NULL &&
1436 	    strcasecmp(options.chroot_directory, "none") != 0) {
1437 		fatal("server lacks privileges to chroot to ChrootDirectory");
1438 	}
1439 
1440 	if (getuid() != pw->pw_uid || geteuid() != pw->pw_uid)
1441 		fatal("Failed to set uids to %u.", (u_int) pw->pw_uid);
1442 }
1443 
1444 static void
do_pwchange(Session * s)1445 do_pwchange(Session *s)
1446 {
1447 	fflush(NULL);
1448 	fprintf(stderr, "WARNING: Your password has expired.\n");
1449 	if (s->ttyfd != -1) {
1450 		fprintf(stderr,
1451 		    "You must change your password now and login again!\n");
1452 #ifdef WITH_SELINUX
1453 		setexeccon(NULL);
1454 #endif
1455 #ifdef PASSWD_NEEDS_USERNAME
1456 		execl(_PATH_PASSWD_PROG, "passwd", s->pw->pw_name,
1457 		    (char *)NULL);
1458 #else
1459 		execl(_PATH_PASSWD_PROG, "passwd", (char *)NULL);
1460 #endif
1461 		perror("passwd");
1462 	} else {
1463 		fprintf(stderr,
1464 		    "Password change required but no TTY available.\n");
1465 	}
1466 	exit(1);
1467 }
1468 
1469 static void
child_close_fds(struct ssh * ssh)1470 child_close_fds(struct ssh *ssh)
1471 {
1472 	extern int auth_sock;
1473 
1474 	if (auth_sock != -1) {
1475 		close(auth_sock);
1476 		auth_sock = -1;
1477 	}
1478 
1479 	if (ssh_packet_get_connection_in(ssh) ==
1480 	    ssh_packet_get_connection_out(ssh))
1481 		close(ssh_packet_get_connection_in(ssh));
1482 	else {
1483 		close(ssh_packet_get_connection_in(ssh));
1484 		close(ssh_packet_get_connection_out(ssh));
1485 	}
1486 	/*
1487 	 * Close all descriptors related to channels.  They will still remain
1488 	 * open in the parent.
1489 	 */
1490 	/* XXX better use close-on-exec? -markus */
1491 	channel_close_all(ssh);
1492 
1493 	/*
1494 	 * Close any extra file descriptors.  Note that there may still be
1495 	 * descriptors left by system functions.  They will be closed later.
1496 	 */
1497 	endpwent();
1498 
1499 	/* Stop directing logs to a high-numbered fd before we close it */
1500 	log_redirect_stderr_to(NULL);
1501 
1502 	/*
1503 	 * Close any extra open file descriptors so that we don't have them
1504 	 * hanging around in clients.  Note that we want to do this after
1505 	 * initgroups, because at least on Solaris 2.3 it leaves file
1506 	 * descriptors open.
1507 	 */
1508 	closefrom(STDERR_FILENO + 1);
1509 }
1510 
1511 /*
1512  * Performs common processing for the child, such as setting up the
1513  * environment, closing extra file descriptors, setting the user and group
1514  * ids, and executing the command or shell.
1515  */
1516 #define ARGV_MAX 10
1517 void
do_child(struct ssh * ssh,Session * s,const char * command)1518 do_child(struct ssh *ssh, Session *s, const char *command)
1519 {
1520 	extern char **environ;
1521 	char **env, *argv[ARGV_MAX], remote_id[512];
1522 	const char *shell, *shell0;
1523 	struct passwd *pw = s->pw;
1524 	int r = 0;
1525 
1526 	sshpkt_fmt_connection_id(ssh, remote_id, sizeof(remote_id));
1527 
1528 	/* remove hostkey from the child's memory */
1529 	destroy_sensitive_data();
1530 	ssh_packet_clear_keys(ssh);
1531 
1532 	/* Force a password change */
1533 	if (s->authctxt->force_pwchange) {
1534 		do_setusercontext(pw);
1535 		child_close_fds(ssh);
1536 		do_pwchange(s);
1537 		exit(1);
1538 	}
1539 
1540 	/*
1541 	 * Login(1) does this as well, and it needs uid 0 for the "-h"
1542 	 * switch, so we let login(1) to this for us.
1543 	 */
1544 #ifdef HAVE_OSF_SIA
1545 	session_setup_sia(pw, s->ttyfd == -1 ? NULL : s->tty);
1546 	if (!check_quietlogin(s, command))
1547 		do_motd();
1548 #else /* HAVE_OSF_SIA */
1549 	/* When PAM is enabled we rely on it to do the nologin check */
1550 	if (!options.use_pam)
1551 		do_nologin(pw);
1552 	do_setusercontext(pw);
1553 	/*
1554 	 * PAM session modules in do_setusercontext may have
1555 	 * generated messages, so if this in an interactive
1556 	 * login then display them too.
1557 	 */
1558 	if (!check_quietlogin(s, command))
1559 		display_loginmsg();
1560 #endif /* HAVE_OSF_SIA */
1561 
1562 #ifdef USE_PAM
1563 	if (options.use_pam && !is_pam_session_open()) {
1564 		debug3("PAM session not opened, exiting");
1565 		display_loginmsg();
1566 		exit(254);
1567 	}
1568 #endif
1569 
1570 	/*
1571 	 * Get the shell from the password data.  An empty shell field is
1572 	 * legal, and means /bin/sh.
1573 	 */
1574 	shell = (pw->pw_shell[0] == '\0') ? _PATH_BSHELL : pw->pw_shell;
1575 
1576 	/*
1577 	 * Make sure $SHELL points to the shell from the password file,
1578 	 * even if shell is overridden from login.conf
1579 	 */
1580 	env = do_setup_env(ssh, s, shell);
1581 
1582 #ifdef HAVE_LOGIN_CAP
1583 	shell = login_getcapstr(lc, "shell", (char *)shell, (char *)shell);
1584 #endif
1585 
1586 	/*
1587 	 * Close the connection descriptors; note that this is the child, and
1588 	 * the server will still have the socket open, and it is important
1589 	 * that we do not shutdown it.  Note that the descriptors cannot be
1590 	 * closed before building the environment, as we call
1591 	 * ssh_remote_ipaddr there.
1592 	 */
1593 	child_close_fds(ssh);
1594 
1595 	/*
1596 	 * Must take new environment into use so that .ssh/rc,
1597 	 * /etc/ssh/sshrc and xauth are run in the proper environment.
1598 	 */
1599 	environ = env;
1600 
1601 #if defined(KRB5) && defined(USE_AFS)
1602 	/*
1603 	 * At this point, we check to see if AFS is active and if we have
1604 	 * a valid Kerberos 5 TGT. If so, it seems like a good idea to see
1605 	 * if we can (and need to) extend the ticket into an AFS token. If
1606 	 * we don't do this, we run into potential problems if the user's
1607 	 * home directory is in AFS and it's not world-readable.
1608 	 */
1609 
1610 	if (options.kerberos_get_afs_token && k_hasafs() &&
1611 	    (s->authctxt->krb5_ctx != NULL)) {
1612 		char cell[64];
1613 
1614 		debug("Getting AFS token");
1615 
1616 		k_setpag();
1617 
1618 		if (k_afs_cell_of_file(pw->pw_dir, cell, sizeof(cell)) == 0)
1619 			krb5_afslog(s->authctxt->krb5_ctx,
1620 			    s->authctxt->krb5_fwd_ccache, cell, NULL);
1621 
1622 		krb5_afslog_home(s->authctxt->krb5_ctx,
1623 		    s->authctxt->krb5_fwd_ccache, NULL, NULL, pw->pw_dir);
1624 	}
1625 #endif
1626 
1627 	/* Change current directory to the user's home directory. */
1628 	if (chdir(pw->pw_dir) == -1) {
1629 		/* Suppress missing homedir warning for chroot case */
1630 #ifdef HAVE_LOGIN_CAP
1631 		r = login_getcapbool(lc, "requirehome", 0);
1632 #endif
1633 		if (r || !in_chroot) {
1634 			fprintf(stderr, "Could not chdir to home "
1635 			    "directory %s: %s\n", pw->pw_dir,
1636 			    strerror(errno));
1637 		}
1638 		if (r)
1639 			exit(1);
1640 	}
1641 
1642 	closefrom(STDERR_FILENO + 1);
1643 
1644 	do_rc_files(ssh, s, shell);
1645 
1646 	/* restore SIGPIPE for child */
1647 	ssh_signal(SIGPIPE, SIG_DFL);
1648 
1649 	if (s->is_subsystem == SUBSYSTEM_INT_SFTP_ERROR) {
1650 		error("Connection from %s: refusing non-sftp session",
1651 		    remote_id);
1652 		printf("This service allows sftp connections only.\n");
1653 		fflush(NULL);
1654 		exit(1);
1655 	} else if (s->is_subsystem == SUBSYSTEM_INT_SFTP) {
1656 		extern int optind, optreset;
1657 		int i;
1658 		char *p, *args;
1659 
1660 		setproctitle("%s@%s", s->pw->pw_name, INTERNAL_SFTP_NAME);
1661 		args = xstrdup(command ? command : "sftp-server");
1662 		for (i = 0, (p = strtok(args, " ")); p; (p = strtok(NULL, " ")))
1663 			if (i < ARGV_MAX - 1)
1664 				argv[i++] = p;
1665 		argv[i] = NULL;
1666 		optind = optreset = 1;
1667 		__progname = argv[0];
1668 #ifdef WITH_SELINUX
1669 		ssh_selinux_change_context("sftpd_t");
1670 #endif
1671 		exit(sftp_server_main(i, argv, s->pw));
1672 	}
1673 
1674 	fflush(NULL);
1675 
1676 	/* Get the last component of the shell name. */
1677 	if ((shell0 = strrchr(shell, '/')) != NULL)
1678 		shell0++;
1679 	else
1680 		shell0 = shell;
1681 
1682 	/*
1683 	 * If we have no command, execute the shell.  In this case, the shell
1684 	 * name to be passed in argv[0] is preceded by '-' to indicate that
1685 	 * this is a login shell.
1686 	 */
1687 	if (!command) {
1688 		char argv0[256];
1689 
1690 		/* Start the shell.  Set initial character to '-'. */
1691 		argv0[0] = '-';
1692 
1693 		if (strlcpy(argv0 + 1, shell0, sizeof(argv0) - 1)
1694 		    >= sizeof(argv0) - 1) {
1695 			errno = EINVAL;
1696 			perror(shell);
1697 			exit(1);
1698 		}
1699 
1700 		/* Execute the shell. */
1701 		argv[0] = argv0;
1702 		argv[1] = NULL;
1703 		execve(shell, argv, env);
1704 
1705 		/* Executing the shell failed. */
1706 		perror(shell);
1707 		exit(1);
1708 	}
1709 	/*
1710 	 * Execute the command using the user's shell.  This uses the -c
1711 	 * option to execute the command.
1712 	 */
1713 	argv[0] = (char *) shell0;
1714 	argv[1] = "-c";
1715 	argv[2] = (char *) command;
1716 	argv[3] = NULL;
1717 	execve(shell, argv, env);
1718 	perror(shell);
1719 	exit(1);
1720 }
1721 
1722 void
session_unused(int id)1723 session_unused(int id)
1724 {
1725 	debug3_f("session id %d unused", id);
1726 	if (id >= options.max_sessions ||
1727 	    id >= sessions_nalloc) {
1728 		fatal_f("insane session id %d (max %d nalloc %d)",
1729 		    id, options.max_sessions, sessions_nalloc);
1730 	}
1731 	memset(&sessions[id], 0, sizeof(*sessions));
1732 	sessions[id].self = id;
1733 	sessions[id].used = 0;
1734 	sessions[id].chanid = -1;
1735 	sessions[id].ptyfd = -1;
1736 	sessions[id].ttyfd = -1;
1737 	sessions[id].ptymaster = -1;
1738 	sessions[id].x11_chanids = NULL;
1739 	sessions[id].next_unused = sessions_first_unused;
1740 	sessions_first_unused = id;
1741 }
1742 
1743 Session *
session_new(void)1744 session_new(void)
1745 {
1746 	Session *s, *tmp;
1747 
1748 	if (sessions_first_unused == -1) {
1749 		if (sessions_nalloc >= options.max_sessions)
1750 			return NULL;
1751 		debug2_f("allocate (allocated %d max %d)",
1752 		    sessions_nalloc, options.max_sessions);
1753 		tmp = xrecallocarray(sessions, sessions_nalloc,
1754 		    sessions_nalloc + 1, sizeof(*sessions));
1755 		if (tmp == NULL) {
1756 			error_f("cannot allocate %d sessions",
1757 			    sessions_nalloc + 1);
1758 			return NULL;
1759 		}
1760 		sessions = tmp;
1761 		session_unused(sessions_nalloc++);
1762 	}
1763 
1764 	if (sessions_first_unused >= sessions_nalloc ||
1765 	    sessions_first_unused < 0) {
1766 		fatal_f("insane first_unused %d max %d nalloc %d",
1767 		    sessions_first_unused, options.max_sessions,
1768 		    sessions_nalloc);
1769 	}
1770 
1771 	s = &sessions[sessions_first_unused];
1772 	if (s->used)
1773 		fatal_f("session %d already used", sessions_first_unused);
1774 	sessions_first_unused = s->next_unused;
1775 	s->used = 1;
1776 	s->next_unused = -1;
1777 	debug("session_new: session %d", s->self);
1778 
1779 	return s;
1780 }
1781 
1782 static void
session_dump(void)1783 session_dump(void)
1784 {
1785 	int i;
1786 	for (i = 0; i < sessions_nalloc; i++) {
1787 		Session *s = &sessions[i];
1788 
1789 		debug("dump: used %d next_unused %d session %d %p "
1790 		    "channel %d pid %ld",
1791 		    s->used,
1792 		    s->next_unused,
1793 		    s->self,
1794 		    s,
1795 		    s->chanid,
1796 		    (long)s->pid);
1797 	}
1798 }
1799 
1800 int
session_open(Authctxt * authctxt,int chanid)1801 session_open(Authctxt *authctxt, int chanid)
1802 {
1803 	Session *s = session_new();
1804 	debug("session_open: channel %d", chanid);
1805 	if (s == NULL) {
1806 		error("no more sessions");
1807 		return 0;
1808 	}
1809 	s->authctxt = authctxt;
1810 	s->pw = authctxt->pw;
1811 	if (s->pw == NULL || !authctxt->valid)
1812 		fatal("no user for session %d", s->self);
1813 	debug("session_open: session %d: link with channel %d", s->self, chanid);
1814 	s->chanid = chanid;
1815 	return 1;
1816 }
1817 
1818 Session *
session_by_tty(char * tty)1819 session_by_tty(char *tty)
1820 {
1821 	int i;
1822 	for (i = 0; i < sessions_nalloc; i++) {
1823 		Session *s = &sessions[i];
1824 		if (s->used && s->ttyfd != -1 && strcmp(s->tty, tty) == 0) {
1825 			debug("session_by_tty: session %d tty %s", i, tty);
1826 			return s;
1827 		}
1828 	}
1829 	debug("session_by_tty: unknown tty %.100s", tty);
1830 	session_dump();
1831 	return NULL;
1832 }
1833 
1834 static Session *
session_by_channel(int id)1835 session_by_channel(int id)
1836 {
1837 	int i;
1838 	for (i = 0; i < sessions_nalloc; i++) {
1839 		Session *s = &sessions[i];
1840 		if (s->used && s->chanid == id) {
1841 			debug("session_by_channel: session %d channel %d",
1842 			    i, id);
1843 			return s;
1844 		}
1845 	}
1846 	debug("session_by_channel: unknown channel %d", id);
1847 	session_dump();
1848 	return NULL;
1849 }
1850 
1851 static Session *
session_by_x11_channel(int id)1852 session_by_x11_channel(int id)
1853 {
1854 	int i, j;
1855 
1856 	for (i = 0; i < sessions_nalloc; i++) {
1857 		Session *s = &sessions[i];
1858 
1859 		if (s->x11_chanids == NULL || !s->used)
1860 			continue;
1861 		for (j = 0; s->x11_chanids[j] != -1; j++) {
1862 			if (s->x11_chanids[j] == id) {
1863 				debug("session_by_x11_channel: session %d "
1864 				    "channel %d", s->self, id);
1865 				return s;
1866 			}
1867 		}
1868 	}
1869 	debug("session_by_x11_channel: unknown channel %d", id);
1870 	session_dump();
1871 	return NULL;
1872 }
1873 
1874 static Session *
session_by_pid(pid_t pid)1875 session_by_pid(pid_t pid)
1876 {
1877 	int i;
1878 	debug("session_by_pid: pid %ld", (long)pid);
1879 	for (i = 0; i < sessions_nalloc; i++) {
1880 		Session *s = &sessions[i];
1881 		if (s->used && s->pid == pid)
1882 			return s;
1883 	}
1884 	error("session_by_pid: unknown pid %ld", (long)pid);
1885 	session_dump();
1886 	return NULL;
1887 }
1888 
1889 static int
session_window_change_req(struct ssh * ssh,Session * s)1890 session_window_change_req(struct ssh *ssh, Session *s)
1891 {
1892 	int r;
1893 
1894 	if ((r = sshpkt_get_u32(ssh, &s->col)) != 0 ||
1895 	    (r = sshpkt_get_u32(ssh, &s->row)) != 0 ||
1896 	    (r = sshpkt_get_u32(ssh, &s->xpixel)) != 0 ||
1897 	    (r = sshpkt_get_u32(ssh, &s->ypixel)) != 0 ||
1898 	    (r = sshpkt_get_end(ssh)) != 0)
1899 		sshpkt_fatal(ssh, r, "%s: parse packet", __func__);
1900 	pty_change_window_size(s->ptyfd, s->row, s->col, s->xpixel, s->ypixel);
1901 	return 1;
1902 }
1903 
1904 static int
session_pty_req(struct ssh * ssh,Session * s)1905 session_pty_req(struct ssh *ssh, Session *s)
1906 {
1907 	int r;
1908 
1909 	if (!auth_opts->permit_pty_flag || !options.permit_tty) {
1910 		debug("Allocating a pty not permitted for this connection.");
1911 		return 0;
1912 	}
1913 	if (s->ttyfd != -1) {
1914 		ssh_packet_disconnect(ssh, "Protocol error: you already have a pty.");
1915 		return 0;
1916 	}
1917 
1918 	if ((r = sshpkt_get_cstring(ssh, &s->term, NULL)) != 0 ||
1919 	    (r = sshpkt_get_u32(ssh, &s->col)) != 0 ||
1920 	    (r = sshpkt_get_u32(ssh, &s->row)) != 0 ||
1921 	    (r = sshpkt_get_u32(ssh, &s->xpixel)) != 0 ||
1922 	    (r = sshpkt_get_u32(ssh, &s->ypixel)) != 0)
1923 		sshpkt_fatal(ssh, r, "%s: parse packet", __func__);
1924 
1925 	if (strcmp(s->term, "") == 0) {
1926 		free(s->term);
1927 		s->term = NULL;
1928 	}
1929 
1930 	/* Allocate a pty and open it. */
1931 	debug("Allocating pty.");
1932 	if (!PRIVSEP(pty_allocate(&s->ptyfd, &s->ttyfd, s->tty,
1933 	    sizeof(s->tty)))) {
1934 		free(s->term);
1935 		s->term = NULL;
1936 		s->ptyfd = -1;
1937 		s->ttyfd = -1;
1938 		error("session_pty_req: session %d alloc failed", s->self);
1939 		return 0;
1940 	}
1941 	debug("session_pty_req: session %d alloc %s", s->self, s->tty);
1942 
1943 	ssh_tty_parse_modes(ssh, s->ttyfd);
1944 
1945 	if ((r = sshpkt_get_end(ssh)) != 0)
1946 		sshpkt_fatal(ssh, r, "%s: parse packet", __func__);
1947 
1948 	if (!use_privsep)
1949 		pty_setowner(s->pw, s->tty);
1950 
1951 	/* Set window size from the packet. */
1952 	pty_change_window_size(s->ptyfd, s->row, s->col, s->xpixel, s->ypixel);
1953 
1954 	session_proctitle(s);
1955 	return 1;
1956 }
1957 
1958 static int
session_subsystem_req(struct ssh * ssh,Session * s)1959 session_subsystem_req(struct ssh *ssh, Session *s)
1960 {
1961 	struct stat st;
1962 	int r, success = 0;
1963 	char *prog, *cmd;
1964 	u_int i;
1965 
1966 	if ((r = sshpkt_get_cstring(ssh, &s->subsys, NULL)) != 0 ||
1967 	    (r = sshpkt_get_end(ssh)) != 0)
1968 		sshpkt_fatal(ssh, r, "%s: parse packet", __func__);
1969 	debug2("subsystem request for %.100s by user %s", s->subsys,
1970 	    s->pw->pw_name);
1971 
1972 	for (i = 0; i < options.num_subsystems; i++) {
1973 		if (strcmp(s->subsys, options.subsystem_name[i]) == 0) {
1974 			prog = options.subsystem_command[i];
1975 			cmd = options.subsystem_args[i];
1976 			if (strcmp(INTERNAL_SFTP_NAME, prog) == 0) {
1977 				s->is_subsystem = SUBSYSTEM_INT_SFTP;
1978 				debug("subsystem: %s", prog);
1979 			} else {
1980 				if (stat(prog, &st) == -1)
1981 					debug("subsystem: cannot stat %s: %s",
1982 					    prog, strerror(errno));
1983 				s->is_subsystem = SUBSYSTEM_EXT;
1984 				debug("subsystem: exec() %s", cmd);
1985 			}
1986 			success = do_exec(ssh, s, cmd) == 0;
1987 			break;
1988 		}
1989 	}
1990 
1991 	if (!success)
1992 		logit("subsystem request for %.100s by user %s failed, "
1993 		    "subsystem not found", s->subsys, s->pw->pw_name);
1994 
1995 	return success;
1996 }
1997 
1998 static int
session_x11_req(struct ssh * ssh,Session * s)1999 session_x11_req(struct ssh *ssh, Session *s)
2000 {
2001 	int r, success;
2002 	u_char single_connection = 0;
2003 
2004 	if (s->auth_proto != NULL || s->auth_data != NULL) {
2005 		error("session_x11_req: session %d: "
2006 		    "x11 forwarding already active", s->self);
2007 		return 0;
2008 	}
2009 	if ((r = sshpkt_get_u8(ssh, &single_connection)) != 0 ||
2010 	    (r = sshpkt_get_cstring(ssh, &s->auth_proto, NULL)) != 0 ||
2011 	    (r = sshpkt_get_cstring(ssh, &s->auth_data, NULL)) != 0 ||
2012 	    (r = sshpkt_get_u32(ssh, &s->screen)) != 0 ||
2013 	    (r = sshpkt_get_end(ssh)) != 0)
2014 		sshpkt_fatal(ssh, r, "%s: parse packet", __func__);
2015 
2016 	s->single_connection = single_connection;
2017 
2018 	if (xauth_valid_string(s->auth_proto) &&
2019 	    xauth_valid_string(s->auth_data))
2020 		success = session_setup_x11fwd(ssh, s);
2021 	else {
2022 		success = 0;
2023 		error("Invalid X11 forwarding data");
2024 	}
2025 	if (!success) {
2026 		free(s->auth_proto);
2027 		free(s->auth_data);
2028 		s->auth_proto = NULL;
2029 		s->auth_data = NULL;
2030 	}
2031 	return success;
2032 }
2033 
2034 static int
session_shell_req(struct ssh * ssh,Session * s)2035 session_shell_req(struct ssh *ssh, Session *s)
2036 {
2037 	int r;
2038 
2039 	if ((r = sshpkt_get_end(ssh)) != 0)
2040 		sshpkt_fatal(ssh, r, "%s: parse packet", __func__);
2041 	return do_exec(ssh, s, NULL) == 0;
2042 }
2043 
2044 static int
session_exec_req(struct ssh * ssh,Session * s)2045 session_exec_req(struct ssh *ssh, Session *s)
2046 {
2047 	u_int success;
2048 	int r;
2049 	char *command = NULL;
2050 
2051 	if ((r = sshpkt_get_cstring(ssh, &command, NULL)) != 0 ||
2052 	    (r = sshpkt_get_end(ssh)) != 0)
2053 		sshpkt_fatal(ssh, r, "%s: parse packet", __func__);
2054 
2055 	success = do_exec(ssh, s, command) == 0;
2056 	free(command);
2057 	return success;
2058 }
2059 
2060 static int
session_break_req(struct ssh * ssh,Session * s)2061 session_break_req(struct ssh *ssh, Session *s)
2062 {
2063 	int r;
2064 
2065 	if ((r = sshpkt_get_u32(ssh, NULL)) != 0 || /* ignore */
2066 	    (r = sshpkt_get_end(ssh)) != 0)
2067 		sshpkt_fatal(ssh, r, "%s: parse packet", __func__);
2068 
2069 	if (s->ptymaster == -1 || tcsendbreak(s->ptymaster, 0) == -1)
2070 		return 0;
2071 	return 1;
2072 }
2073 
2074 static int
session_env_req(struct ssh * ssh,Session * s)2075 session_env_req(struct ssh *ssh, Session *s)
2076 {
2077 	char *name, *val;
2078 	u_int i;
2079 	int r;
2080 
2081 	if ((r = sshpkt_get_cstring(ssh, &name, NULL)) != 0 ||
2082 	    (r = sshpkt_get_cstring(ssh, &val, NULL)) != 0 ||
2083 	    (r = sshpkt_get_end(ssh)) != 0)
2084 		sshpkt_fatal(ssh, r, "%s: parse packet", __func__);
2085 
2086 	/* Don't set too many environment variables */
2087 	if (s->num_env > 128) {
2088 		debug2("Ignoring env request %s: too many env vars", name);
2089 		goto fail;
2090 	}
2091 
2092 	for (i = 0; i < options.num_accept_env; i++) {
2093 		if (match_pattern(name, options.accept_env[i])) {
2094 			debug2("Setting env %d: %s=%s", s->num_env, name, val);
2095 			s->env = xrecallocarray(s->env, s->num_env,
2096 			    s->num_env + 1, sizeof(*s->env));
2097 			s->env[s->num_env].name = name;
2098 			s->env[s->num_env].val = val;
2099 			s->num_env++;
2100 			return (1);
2101 		}
2102 	}
2103 	debug2("Ignoring env request %s: disallowed name", name);
2104 
2105  fail:
2106 	free(name);
2107 	free(val);
2108 	return (0);
2109 }
2110 
2111 /*
2112  * Conversion of signals from ssh channel request names.
2113  * Subset of signals from RFC 4254 section 6.10C, with SIGINFO as
2114  * local extension.
2115  */
2116 static int
name2sig(char * name)2117 name2sig(char *name)
2118 {
2119 #define SSH_SIG(x) if (strcmp(name, #x) == 0) return SIG ## x
2120 	SSH_SIG(HUP);
2121 	SSH_SIG(INT);
2122 	SSH_SIG(KILL);
2123 	SSH_SIG(QUIT);
2124 	SSH_SIG(TERM);
2125 	SSH_SIG(USR1);
2126 	SSH_SIG(USR2);
2127 #undef	SSH_SIG
2128 #ifdef SIGINFO
2129 	if (strcmp(name, "INFO@openssh.com") == 0)
2130 		return SIGINFO;
2131 #endif
2132 	return -1;
2133 }
2134 
2135 static int
session_signal_req(struct ssh * ssh,Session * s)2136 session_signal_req(struct ssh *ssh, Session *s)
2137 {
2138 	char *signame = NULL;
2139 	int r, sig, success = 0;
2140 
2141 	if ((r = sshpkt_get_cstring(ssh, &signame, NULL)) != 0 ||
2142 	    (r = sshpkt_get_end(ssh)) != 0) {
2143 		error_fr(r, "parse");
2144 		goto out;
2145 	}
2146 	if ((sig = name2sig(signame)) == -1) {
2147 		error_f("unsupported signal \"%s\"", signame);
2148 		goto out;
2149 	}
2150 	if (s->pid <= 0) {
2151 		error_f("no pid for session %d", s->self);
2152 		goto out;
2153 	}
2154 	if (s->forced || s->is_subsystem) {
2155 		error_f("refusing to send signal %s to %s session",
2156 		    signame, s->forced ? "forced-command" : "subsystem");
2157 		goto out;
2158 	}
2159 	if (!use_privsep || mm_is_monitor()) {
2160 		error_f("session signalling requires privilege separation");
2161 		goto out;
2162 	}
2163 
2164 	debug_f("signal %s, killpg(%ld, %d)", signame, (long)s->pid, sig);
2165 	temporarily_use_uid(s->pw);
2166 	r = killpg(s->pid, sig);
2167 	restore_uid();
2168 	if (r != 0) {
2169 		error_f("killpg(%ld, %d): %s", (long)s->pid,
2170 		    sig, strerror(errno));
2171 		goto out;
2172 	}
2173 
2174 	/* success */
2175 	success = 1;
2176  out:
2177 	free(signame);
2178 	return success;
2179 }
2180 
2181 static int
session_auth_agent_req(struct ssh * ssh,Session * s)2182 session_auth_agent_req(struct ssh *ssh, Session *s)
2183 {
2184 	static int called = 0;
2185 	int r;
2186 
2187 	if ((r = sshpkt_get_end(ssh)) != 0)
2188 		sshpkt_fatal(ssh, r, "%s: parse packet", __func__);
2189 	if (!auth_opts->permit_agent_forwarding_flag ||
2190 	    !options.allow_agent_forwarding) {
2191 		debug_f("agent forwarding disabled");
2192 		return 0;
2193 	}
2194 	if (called) {
2195 		return 0;
2196 	} else {
2197 		called = 1;
2198 		return auth_input_request_forwarding(ssh, s->pw);
2199 	}
2200 }
2201 
2202 int
session_input_channel_req(struct ssh * ssh,Channel * c,const char * rtype)2203 session_input_channel_req(struct ssh *ssh, Channel *c, const char *rtype)
2204 {
2205 	int success = 0;
2206 	Session *s;
2207 
2208 	if ((s = session_by_channel(c->self)) == NULL) {
2209 		logit_f("no session %d req %.100s", c->self, rtype);
2210 		return 0;
2211 	}
2212 	debug_f("session %d req %s", s->self, rtype);
2213 
2214 	/*
2215 	 * a session is in LARVAL state until a shell, a command
2216 	 * or a subsystem is executed
2217 	 */
2218 	if (c->type == SSH_CHANNEL_LARVAL) {
2219 		if (strcmp(rtype, "shell") == 0) {
2220 			success = session_shell_req(ssh, s);
2221 		} else if (strcmp(rtype, "exec") == 0) {
2222 			success = session_exec_req(ssh, s);
2223 		} else if (strcmp(rtype, "pty-req") == 0) {
2224 			success = session_pty_req(ssh, s);
2225 		} else if (strcmp(rtype, "x11-req") == 0) {
2226 			success = session_x11_req(ssh, s);
2227 		} else if (strcmp(rtype, "auth-agent-req@openssh.com") == 0) {
2228 			success = session_auth_agent_req(ssh, s);
2229 		} else if (strcmp(rtype, "subsystem") == 0) {
2230 			success = session_subsystem_req(ssh, s);
2231 		} else if (strcmp(rtype, "env") == 0) {
2232 			success = session_env_req(ssh, s);
2233 		}
2234 	}
2235 	if (strcmp(rtype, "window-change") == 0) {
2236 		success = session_window_change_req(ssh, s);
2237 	} else if (strcmp(rtype, "break") == 0) {
2238 		success = session_break_req(ssh, s);
2239 	} else if (strcmp(rtype, "signal") == 0) {
2240 		success = session_signal_req(ssh, s);
2241 	}
2242 
2243 	return success;
2244 }
2245 
2246 void
session_set_fds(struct ssh * ssh,Session * s,int fdin,int fdout,int fderr,int ignore_fderr,int is_tty)2247 session_set_fds(struct ssh *ssh, Session *s,
2248     int fdin, int fdout, int fderr, int ignore_fderr, int is_tty)
2249 {
2250 	/*
2251 	 * now that have a child and a pipe to the child,
2252 	 * we can activate our channel and register the fd's
2253 	 */
2254 	if (s->chanid == -1)
2255 		fatal("no channel for session %d", s->self);
2256 	channel_set_fds(ssh, s->chanid,
2257 	    fdout, fdin, fderr,
2258 	    ignore_fderr ? CHAN_EXTENDED_IGNORE : CHAN_EXTENDED_READ,
2259 	    1, is_tty, CHAN_SES_WINDOW_DEFAULT);
2260 }
2261 
2262 /*
2263  * Function to perform pty cleanup. Also called if we get aborted abnormally
2264  * (e.g., due to a dropped connection).
2265  */
2266 void
session_pty_cleanup2(Session * s)2267 session_pty_cleanup2(Session *s)
2268 {
2269 	if (s == NULL) {
2270 		error_f("no session");
2271 		return;
2272 	}
2273 	if (s->ttyfd == -1)
2274 		return;
2275 
2276 	debug_f("session %d release %s", s->self, s->tty);
2277 
2278 	/* Record that the user has logged out. */
2279 	if (s->pid != 0)
2280 		record_logout(s->pid, s->tty, s->pw->pw_name);
2281 
2282 	/* Release the pseudo-tty. */
2283 	if (getuid() == 0)
2284 		pty_release(s->tty);
2285 
2286 	/*
2287 	 * Close the server side of the socket pairs.  We must do this after
2288 	 * the pty cleanup, so that another process doesn't get this pty
2289 	 * while we're still cleaning up.
2290 	 */
2291 	if (s->ptymaster != -1 && close(s->ptymaster) == -1)
2292 		error("close(s->ptymaster/%d): %s",
2293 		    s->ptymaster, strerror(errno));
2294 
2295 	/* unlink pty from session */
2296 	s->ttyfd = -1;
2297 }
2298 
2299 void
session_pty_cleanup(Session * s)2300 session_pty_cleanup(Session *s)
2301 {
2302 	PRIVSEP(session_pty_cleanup2(s));
2303 }
2304 
2305 static char *
sig2name(int sig)2306 sig2name(int sig)
2307 {
2308 #define SSH_SIG(x) if (sig == SIG ## x) return #x
2309 	SSH_SIG(ABRT);
2310 	SSH_SIG(ALRM);
2311 	SSH_SIG(FPE);
2312 	SSH_SIG(HUP);
2313 	SSH_SIG(ILL);
2314 	SSH_SIG(INT);
2315 	SSH_SIG(KILL);
2316 	SSH_SIG(PIPE);
2317 	SSH_SIG(QUIT);
2318 	SSH_SIG(SEGV);
2319 	SSH_SIG(TERM);
2320 	SSH_SIG(USR1);
2321 	SSH_SIG(USR2);
2322 #undef	SSH_SIG
2323 	return "SIG@openssh.com";
2324 }
2325 
2326 static void
session_close_x11(struct ssh * ssh,int id)2327 session_close_x11(struct ssh *ssh, int id)
2328 {
2329 	Channel *c;
2330 
2331 	if ((c = channel_by_id(ssh, id)) == NULL) {
2332 		debug_f("x11 channel %d missing", id);
2333 	} else {
2334 		/* Detach X11 listener */
2335 		debug_f("detach x11 channel %d", id);
2336 		channel_cancel_cleanup(ssh, id);
2337 		if (c->ostate != CHAN_OUTPUT_CLOSED)
2338 			chan_mark_dead(ssh, c);
2339 	}
2340 }
2341 
2342 static void
session_close_single_x11(struct ssh * ssh,int id,void * arg)2343 session_close_single_x11(struct ssh *ssh, int id, void *arg)
2344 {
2345 	Session *s;
2346 	u_int i;
2347 
2348 	debug3_f("channel %d", id);
2349 	channel_cancel_cleanup(ssh, id);
2350 	if ((s = session_by_x11_channel(id)) == NULL)
2351 		fatal_f("no x11 channel %d", id);
2352 	for (i = 0; s->x11_chanids[i] != -1; i++) {
2353 		debug_f("session %d: closing channel %d",
2354 		    s->self, s->x11_chanids[i]);
2355 		/*
2356 		 * The channel "id" is already closing, but make sure we
2357 		 * close all of its siblings.
2358 		 */
2359 		if (s->x11_chanids[i] != id)
2360 			session_close_x11(ssh, s->x11_chanids[i]);
2361 	}
2362 	free(s->x11_chanids);
2363 	s->x11_chanids = NULL;
2364 	free(s->display);
2365 	s->display = NULL;
2366 	free(s->auth_proto);
2367 	s->auth_proto = NULL;
2368 	free(s->auth_data);
2369 	s->auth_data = NULL;
2370 	free(s->auth_display);
2371 	s->auth_display = NULL;
2372 }
2373 
2374 static void
session_exit_message(struct ssh * ssh,Session * s,int status)2375 session_exit_message(struct ssh *ssh, Session *s, int status)
2376 {
2377 	Channel *c;
2378 	int r;
2379 
2380 	if ((c = channel_lookup(ssh, s->chanid)) == NULL)
2381 		fatal_f("session %d: no channel %d", s->self, s->chanid);
2382 	debug_f("session %d channel %d pid %ld",
2383 	    s->self, s->chanid, (long)s->pid);
2384 
2385 	if (WIFEXITED(status)) {
2386 		channel_request_start(ssh, s->chanid, "exit-status", 0);
2387 		if ((r = sshpkt_put_u32(ssh, WEXITSTATUS(status))) != 0 ||
2388 		    (r = sshpkt_send(ssh)) != 0)
2389 			sshpkt_fatal(ssh, r, "%s: exit reply", __func__);
2390 	} else if (WIFSIGNALED(status)) {
2391 		channel_request_start(ssh, s->chanid, "exit-signal", 0);
2392 #ifndef WCOREDUMP
2393 # define WCOREDUMP(x) (0)
2394 #endif
2395 		if ((r = sshpkt_put_cstring(ssh, sig2name(WTERMSIG(status)))) != 0 ||
2396 		    (r = sshpkt_put_u8(ssh, WCOREDUMP(status)? 1 : 0)) != 0 ||
2397 		    (r = sshpkt_put_cstring(ssh, "")) != 0 ||
2398 		    (r = sshpkt_put_cstring(ssh, "")) != 0 ||
2399 		    (r = sshpkt_send(ssh)) != 0)
2400 			sshpkt_fatal(ssh, r, "%s: exit reply", __func__);
2401 	} else {
2402 		/* Some weird exit cause.  Just exit. */
2403 		ssh_packet_disconnect(ssh, "wait returned status %04x.", status);
2404 	}
2405 
2406 	/* disconnect channel */
2407 	debug_f("release channel %d", s->chanid);
2408 
2409 	/*
2410 	 * Adjust cleanup callback attachment to send close messages when
2411 	 * the channel gets EOF. The session will be then be closed
2412 	 * by session_close_by_channel when the child sessions close their fds.
2413 	 */
2414 	channel_register_cleanup(ssh, c->self, session_close_by_channel, 1);
2415 
2416 	/*
2417 	 * emulate a write failure with 'chan_write_failed', nobody will be
2418 	 * interested in data we write.
2419 	 * Note that we must not call 'chan_read_failed', since there could
2420 	 * be some more data waiting in the pipe.
2421 	 */
2422 	if (c->ostate != CHAN_OUTPUT_CLOSED)
2423 		chan_write_failed(ssh, c);
2424 }
2425 
2426 void
session_close(struct ssh * ssh,Session * s)2427 session_close(struct ssh *ssh, Session *s)
2428 {
2429 	u_int i;
2430 
2431 	verbose("Close session: user %s from %.200s port %d id %d",
2432 	    s->pw->pw_name,
2433 	    ssh_remote_ipaddr(ssh),
2434 	    ssh_remote_port(ssh),
2435 	    s->self);
2436 
2437 	if (s->ttyfd != -1)
2438 		session_pty_cleanup(s);
2439 	free(s->term);
2440 	free(s->display);
2441 	free(s->x11_chanids);
2442 	free(s->auth_display);
2443 	free(s->auth_data);
2444 	free(s->auth_proto);
2445 	free(s->subsys);
2446 	if (s->env != NULL) {
2447 		for (i = 0; i < s->num_env; i++) {
2448 			free(s->env[i].name);
2449 			free(s->env[i].val);
2450 		}
2451 		free(s->env);
2452 	}
2453 	session_proctitle(s);
2454 	session_unused(s->self);
2455 }
2456 
2457 void
session_close_by_pid(struct ssh * ssh,pid_t pid,int status)2458 session_close_by_pid(struct ssh *ssh, pid_t pid, int status)
2459 {
2460 	Session *s = session_by_pid(pid);
2461 	if (s == NULL) {
2462 		debug_f("no session for pid %ld", (long)pid);
2463 		return;
2464 	}
2465 	if (s->chanid != -1)
2466 		session_exit_message(ssh, s, status);
2467 	if (s->ttyfd != -1)
2468 		session_pty_cleanup(s);
2469 	s->pid = 0;
2470 }
2471 
2472 /*
2473  * this is called when a channel dies before
2474  * the session 'child' itself dies
2475  */
2476 void
session_close_by_channel(struct ssh * ssh,int id,void * arg)2477 session_close_by_channel(struct ssh *ssh, int id, void *arg)
2478 {
2479 	Session *s = session_by_channel(id);
2480 	u_int i;
2481 
2482 	if (s == NULL) {
2483 		debug_f("no session for id %d", id);
2484 		return;
2485 	}
2486 	debug_f("channel %d child %ld", id, (long)s->pid);
2487 	if (s->pid != 0) {
2488 		debug_f("channel %d: has child, ttyfd %d", id, s->ttyfd);
2489 		/*
2490 		 * delay detach of session, but release pty, since
2491 		 * the fd's to the child are already closed
2492 		 */
2493 		if (s->ttyfd != -1)
2494 			session_pty_cleanup(s);
2495 		return;
2496 	}
2497 	/* detach by removing callback */
2498 	channel_cancel_cleanup(ssh, s->chanid);
2499 
2500 	/* Close any X11 listeners associated with this session */
2501 	if (s->x11_chanids != NULL) {
2502 		for (i = 0; s->x11_chanids[i] != -1; i++) {
2503 			session_close_x11(ssh, s->x11_chanids[i]);
2504 			s->x11_chanids[i] = -1;
2505 		}
2506 	}
2507 
2508 	s->chanid = -1;
2509 	session_close(ssh, s);
2510 }
2511 
2512 void
session_destroy_all(struct ssh * ssh,void (* closefunc)(Session *))2513 session_destroy_all(struct ssh *ssh, void (*closefunc)(Session *))
2514 {
2515 	int i;
2516 	for (i = 0; i < sessions_nalloc; i++) {
2517 		Session *s = &sessions[i];
2518 		if (s->used) {
2519 			if (closefunc != NULL)
2520 				closefunc(s);
2521 			else
2522 				session_close(ssh, s);
2523 		}
2524 	}
2525 }
2526 
2527 static char *
session_tty_list(void)2528 session_tty_list(void)
2529 {
2530 	static char buf[1024];
2531 	int i;
2532 	char *cp;
2533 
2534 	buf[0] = '\0';
2535 	for (i = 0; i < sessions_nalloc; i++) {
2536 		Session *s = &sessions[i];
2537 		if (s->used && s->ttyfd != -1) {
2538 
2539 			if (strncmp(s->tty, "/dev/", 5) != 0) {
2540 				cp = strrchr(s->tty, '/');
2541 				cp = (cp == NULL) ? s->tty : cp + 1;
2542 			} else
2543 				cp = s->tty + 5;
2544 
2545 			if (buf[0] != '\0')
2546 				strlcat(buf, ",", sizeof buf);
2547 			strlcat(buf, cp, sizeof buf);
2548 		}
2549 	}
2550 	if (buf[0] == '\0')
2551 		strlcpy(buf, "notty", sizeof buf);
2552 	return buf;
2553 }
2554 
2555 void
session_proctitle(Session * s)2556 session_proctitle(Session *s)
2557 {
2558 	if (s->pw == NULL)
2559 		error("no user for session %d", s->self);
2560 	else
2561 		setproctitle("%s@%s", s->pw->pw_name, session_tty_list());
2562 }
2563 
2564 int
session_setup_x11fwd(struct ssh * ssh,Session * s)2565 session_setup_x11fwd(struct ssh *ssh, Session *s)
2566 {
2567 	struct stat st;
2568 	char display[512], auth_display[512];
2569 	char hostname[NI_MAXHOST];
2570 	u_int i;
2571 
2572 	if (!auth_opts->permit_x11_forwarding_flag) {
2573 		ssh_packet_send_debug(ssh, "X11 forwarding disabled by key options.");
2574 		return 0;
2575 	}
2576 	if (!options.x11_forwarding) {
2577 		debug("X11 forwarding disabled in server configuration file.");
2578 		return 0;
2579 	}
2580 	if (options.xauth_location == NULL ||
2581 	    (stat(options.xauth_location, &st) == -1)) {
2582 		ssh_packet_send_debug(ssh, "No xauth program; cannot forward X11.");
2583 		return 0;
2584 	}
2585 	if (s->display != NULL) {
2586 		debug("X11 display already set.");
2587 		return 0;
2588 	}
2589 	if (x11_create_display_inet(ssh, options.x11_display_offset,
2590 	    options.x11_use_localhost, s->single_connection,
2591 	    &s->display_number, &s->x11_chanids) == -1) {
2592 		debug("x11_create_display_inet failed.");
2593 		return 0;
2594 	}
2595 	for (i = 0; s->x11_chanids[i] != -1; i++) {
2596 		channel_register_cleanup(ssh, s->x11_chanids[i],
2597 		    session_close_single_x11, 0);
2598 	}
2599 
2600 	/* Set up a suitable value for the DISPLAY variable. */
2601 	if (gethostname(hostname, sizeof(hostname)) == -1)
2602 		fatal("gethostname: %.100s", strerror(errno));
2603 	/*
2604 	 * auth_display must be used as the displayname when the
2605 	 * authorization entry is added with xauth(1).  This will be
2606 	 * different than the DISPLAY string for localhost displays.
2607 	 */
2608 	if (options.x11_use_localhost) {
2609 		snprintf(display, sizeof display, "localhost:%u.%u",
2610 		    s->display_number, s->screen);
2611 		snprintf(auth_display, sizeof auth_display, "unix:%u.%u",
2612 		    s->display_number, s->screen);
2613 		s->display = xstrdup(display);
2614 		s->auth_display = xstrdup(auth_display);
2615 	} else {
2616 #ifdef IPADDR_IN_DISPLAY
2617 		struct hostent *he;
2618 		struct in_addr my_addr;
2619 
2620 		he = gethostbyname(hostname);
2621 		if (he == NULL) {
2622 			error("Can't get IP address for X11 DISPLAY.");
2623 			ssh_packet_send_debug(ssh, "Can't get IP address for X11 DISPLAY.");
2624 			return 0;
2625 		}
2626 		memcpy(&my_addr, he->h_addr_list[0], sizeof(struct in_addr));
2627 		snprintf(display, sizeof display, "%.50s:%u.%u", inet_ntoa(my_addr),
2628 		    s->display_number, s->screen);
2629 #else
2630 		snprintf(display, sizeof display, "%.400s:%u.%u", hostname,
2631 		    s->display_number, s->screen);
2632 #endif
2633 		s->display = xstrdup(display);
2634 		s->auth_display = xstrdup(display);
2635 	}
2636 
2637 	return 1;
2638 }
2639 
2640 static void
do_authenticated2(struct ssh * ssh,Authctxt * authctxt)2641 do_authenticated2(struct ssh *ssh, Authctxt *authctxt)
2642 {
2643 	server_loop2(ssh, authctxt);
2644 }
2645 
2646 void
do_cleanup(struct ssh * ssh,Authctxt * authctxt)2647 do_cleanup(struct ssh *ssh, Authctxt *authctxt)
2648 {
2649 	static int called = 0;
2650 
2651 	debug("do_cleanup");
2652 
2653 	/* no cleanup if we're in the child for login shell */
2654 	if (is_child)
2655 		return;
2656 
2657 	/* avoid double cleanup */
2658 	if (called)
2659 		return;
2660 	called = 1;
2661 
2662 	if (authctxt == NULL)
2663 		return;
2664 
2665 #ifdef USE_PAM
2666 	if (options.use_pam) {
2667 		sshpam_cleanup();
2668 		sshpam_thread_cleanup();
2669 	}
2670 #endif
2671 
2672 	if (!authctxt->authenticated)
2673 		return;
2674 
2675 #ifdef KRB5
2676 	if (options.kerberos_ticket_cleanup &&
2677 	    authctxt->krb5_ctx)
2678 		krb5_cleanup_proc(authctxt);
2679 #endif
2680 
2681 #ifdef GSSAPI
2682 	if (options.gss_cleanup_creds)
2683 		ssh_gssapi_cleanup_creds();
2684 #endif
2685 
2686 	/* remove agent socket */
2687 	auth_sock_cleanup_proc(authctxt->pw);
2688 
2689 	/* remove userauth info */
2690 	if (auth_info_file != NULL) {
2691 		temporarily_use_uid(authctxt->pw);
2692 		unlink(auth_info_file);
2693 		restore_uid();
2694 		free(auth_info_file);
2695 		auth_info_file = NULL;
2696 	}
2697 
2698 	/*
2699 	 * Cleanup ptys/utmp only if privsep is disabled,
2700 	 * or if running in monitor.
2701 	 */
2702 	if (!use_privsep || mm_is_monitor())
2703 		session_destroy_all(ssh, session_pty_cleanup2);
2704 }
2705 
2706 /* Return a name for the remote host that fits inside utmp_size */
2707 
2708 const char *
session_get_remote_name_or_ip(struct ssh * ssh,u_int utmp_size,int use_dns)2709 session_get_remote_name_or_ip(struct ssh *ssh, u_int utmp_size, int use_dns)
2710 {
2711 	const char *remote = "";
2712 
2713 	if (utmp_size > 0)
2714 		remote = auth_get_canonical_hostname(ssh, use_dns);
2715 	if (utmp_size == 0 || strlen(remote) > utmp_size)
2716 		remote = ssh_remote_ipaddr(ssh);
2717 	return remote;
2718 }
2719 
2720