Added support for ETW based logging (#280)

https://github.com/PowerShell/Win32-OpenSSH/issues/95
This commit is contained in:
Manoj Ampalam 2018-03-06 15:33:19 -08:00 committed by GitHub
parent 50a4badb79
commit 2c559a2b6c
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
17 changed files with 680 additions and 72 deletions

Binary file not shown.

View File

@ -357,10 +357,11 @@ function Start-OpenSSHPackage
}
$buildDir = Join-Path $repositoryRoot ("bin\" + $folderName + "\" + $Configuration)
$payload = "sshd.exe", "ssh.exe", "ssh-agent.exe", "ssh-add.exe", "sftp.exe"
$payload = "sshd.exe", "ssh.exe", "ssh-agent.exe", "ssh-add.exe", "sftp.exe"
$payload += "sftp-server.exe", "scp.exe", "ssh-shellhost.exe", "ssh-keygen.exe", "ssh-keyscan.exe"
$payload += "sshd_config_default", "install-sshd.ps1", "uninstall-sshd.ps1"
$payload +="FixHostFilePermissions.ps1", "FixUserFilePermissions.ps1", "OpenSSHUtils.psm1", "OpenSSHUtils.psd1"
$payload += "FixHostFilePermissions.ps1", "FixUserFilePermissions.ps1", "OpenSSHUtils.psm1", "OpenSSHUtils.psd1"
$payload += "openssh-events.man"
$packageName = "OpenSSH-Win64"
if ($NativeHostArch -ieq 'x86') {

View File

@ -1227,7 +1227,7 @@
#define HAVE___FUNCTION__ 1
/* Define if libc defines __progname */
/* #undef HAVE___PROGNAME */
#define HAVE___PROGNAME 1
/* Fields in struct sockaddr_storage */
/* #undef HAVE___SS_FAMILY_IN_SS */

View File

@ -196,8 +196,9 @@
copy /Y "$(SolutionDir)uninstall-ssh*ps1" "$(OutDir)"
copy /Y "$(SolutionDir)OpenSSHUtils.ps*1" "$(OutDir)"
copy /Y "$(SolutionDir)Fix*FilePermissions.ps1" "$(OutDir)"
copy /Y "$(SolutionDir)sshd_config" "$(OutDir)sshd_config_default"</Command>
<Message>Copy install-sshd.ps1, uninstall-sshd.ps1, OpenSSHUtils.psm1, OpenSSHUtils.psd1, FixHostFilePermissions.ps1, FixUserFilePermissions.ps1, ssh-add-hostkey.ps1, and sshd_config (if not already present) to build directory</Message>
copy /Y "$(SolutionDir)sshd_config" "$(OutDir)sshd_config_default"
copy /Y "$(SolutionDir)openssh-events.man" "$(OutDir)"</Command>
<Message>Copy install-sshd.ps1, uninstall-sshd.ps1, OpenSSHUtils.psm1, OpenSSHUtils.psd1, FixHostFilePermissions.ps1, FixUserFilePermissions.ps1, ssh-add-hostkey.ps1, sshd_config (as sshd_config_default), openssh-events.man to build directory</Message>
</PostBuildEvent>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
@ -228,8 +229,9 @@ copy /Y "$(SolutionDir)sshd_config" "$(OutDir)sshd_config_default"</Command>
copy /Y "$(SolutionDir)uninstall-ssh*ps1" "$(OutDir)"
copy /Y "$(SolutionDir)OpenSSHUtils.ps*1" "$(OutDir)"
copy /Y "$(SolutionDir)Fix*FilePermissions.ps1" "$(OutDir)"
copy /Y "$(SolutionDir)sshd_config" "$(OutDir)sshd_config_default"</Command>
<Message>Copy install-sshd.ps1, uninstall-sshd.ps1, OpenSSHUtils.psm1, OpenSSHUtils.psd1, FixHostFilePermissions.ps1, FixUserFilePermissions.ps1, ssh-add-hostkey.ps1, and sshd_config (if not already present) to build directory</Message>
copy /Y "$(SolutionDir)sshd_config" "$(OutDir)sshd_config_default"
copy /Y "$(SolutionDir)openssh-events.man" "$(OutDir)"</Command>
<Message>Copy install-sshd.ps1, uninstall-sshd.ps1, OpenSSHUtils.psm1, OpenSSHUtils.psd1, FixHostFilePermissions.ps1, FixUserFilePermissions.ps1, ssh-add-hostkey.ps1, sshd_config (as sshd_config_default), openssh-events.man to build directory</Message>
</PostBuildEvent>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'">
@ -260,8 +262,9 @@ copy /Y "$(SolutionDir)sshd_config" "$(OutDir)sshd_config_default"</Command>
copy /Y "$(SolutionDir)uninstall-ssh*ps1" "$(OutDir)"
copy /Y "$(SolutionDir)OpenSSHUtils.ps*1" "$(OutDir)"
copy /Y "$(SolutionDir)Fix*FilePermissions.ps1" "$(OutDir)"
copy /Y "$(SolutionDir)sshd_config" "$(OutDir)sshd_config_default"</Command>
<Message>Copy install-sshd.ps1, uninstall-sshd.ps1, OpenSSHUtils.psm1, OpenSSHUtils.psd1, FixHostFilePermissions.ps1, FixUserFilePermissions.ps1, ssh-add-hostkey.ps1, and sshd_config (if not already present) to build directory</Message>
copy /Y "$(SolutionDir)sshd_config" "$(OutDir)sshd_config_default"
copy /Y "$(SolutionDir)openssh-events.man" "$(OutDir)"</Command>
<Message>Copy install-sshd.ps1, uninstall-sshd.ps1, OpenSSHUtils.psm1, OpenSSHUtils.psd1, FixHostFilePermissions.ps1, FixUserFilePermissions.ps1, ssh-add-hostkey.ps1, sshd_config (as sshd_config_default), openssh-events.man to build directory</Message>
</PostBuildEvent>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM'">
@ -292,8 +295,9 @@ copy /Y "$(SolutionDir)sshd_config" "$(OutDir)sshd_config_default"</Command>
copy /Y "$(SolutionDir)uninstall-ssh*ps1" "$(OutDir)"
copy /Y "$(SolutionDir)OpenSSHUtils.ps*1" "$(OutDir)"
copy /Y "$(SolutionDir)Fix*FilePermissions.ps1" "$(OutDir)"
copy /Y "$(SolutionDir)sshd_config" "$(OutDir)sshd_config_default"</Command>
<Message>Copy install-sshd.ps1, uninstall-sshd.ps1, OpenSSHUtils.psm1, OpenSSHUtils.psd1, FixHostFilePermissions.ps1, FixUserFilePermissions.ps1, ssh-add-hostkey.ps1, and sshd_config (if not already present) to build directory</Message>
copy /Y "$(SolutionDir)sshd_config" "$(OutDir)sshd_config_default"
copy /Y "$(SolutionDir)openssh-events.man" "$(OutDir)"</Command>
<Message>Copy install-sshd.ps1, uninstall-sshd.ps1, OpenSSHUtils.psm1, OpenSSHUtils.psd1, FixHostFilePermissions.ps1, FixUserFilePermissions.ps1, ssh-add-hostkey.ps1, sshd_config (as sshd_config_default), openssh-events.man to build directory</Message>
</PostBuildEvent>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
@ -328,8 +332,9 @@ copy /Y "$(SolutionDir)sshd_config" "$(OutDir)sshd_config_default"</Command>
copy /Y "$(SolutionDir)uninstall-ssh*ps1" "$(OutDir)"
copy /Y "$(SolutionDir)OpenSSHUtils.ps*1" "$(OutDir)"
copy /Y "$(SolutionDir)Fix*FilePermissions.ps1" "$(OutDir)"
copy /Y "$(SolutionDir)sshd_config" "$(OutDir)sshd_config_default"</Command>
<Message>Copy install-sshd.ps1, uninstall-sshd.ps1, OpenSSHUtils.psm1, OpenSSHUtils.psd1, FixHostFilePermissions.ps1, FixUserFilePermissions.ps1, ssh-add-hostkey.ps1, and sshd_config (if not already present) to build directory</Message>
copy /Y "$(SolutionDir)sshd_config" "$(OutDir)sshd_config_default"
copy /Y "$(SolutionDir)openssh-events.man" "$(OutDir)"</Command>
<Message>Copy install-sshd.ps1, uninstall-sshd.ps1, OpenSSHUtils.psm1, OpenSSHUtils.psd1, FixHostFilePermissions.ps1, FixUserFilePermissions.ps1, ssh-add-hostkey.ps1, sshd_config (as sshd_config_default), openssh-events.man to build directory</Message>
</PostBuildEvent>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
@ -364,8 +369,9 @@ copy /Y "$(SolutionDir)sshd_config" "$(OutDir)sshd_config_default"</Command>
copy /Y "$(SolutionDir)uninstall-ssh*ps1" "$(OutDir)"
copy /Y "$(SolutionDir)OpenSSHUtils.ps*1" "$(OutDir)"
copy /Y "$(SolutionDir)Fix*FilePermissions.ps1" "$(OutDir)"
copy /Y "$(SolutionDir)sshd_config" "$(OutDir)sshd_config_default"</Command>
<Message>Copy install-sshd.ps1, uninstall-sshd.ps1, OpenSSHUtils.psm1, OpenSSHUtils.psd1, FixHostFilePermissions.ps1, FixUserFilePermissions.ps1, ssh-add-hostkey.ps1, and sshd_config (if not already present) to build directory</Message>
copy /Y "$(SolutionDir)sshd_config" "$(OutDir)sshd_config_default"
copy /Y "$(SolutionDir)openssh-events.man" "$(OutDir)"</Command>
<Message>Copy install-sshd.ps1, uninstall-sshd.ps1, OpenSSHUtils.psm1, OpenSSHUtils.psd1, FixHostFilePermissions.ps1, FixUserFilePermissions.ps1, ssh-add-hostkey.ps1, sshd_config (as sshd_config_default), openssh-events.man to build directory</Message>
</PostBuildEvent>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'">
@ -400,8 +406,9 @@ copy /Y "$(SolutionDir)sshd_config" "$(OutDir)sshd_config_default"</Command>
copy /Y "$(SolutionDir)uninstall-ssh*ps1" "$(OutDir)"
copy /Y "$(SolutionDir)OpenSSHUtils.ps*1" "$(OutDir)"
copy /Y "$(SolutionDir)Fix*FilePermissions.ps1" "$(OutDir)"
copy /Y "$(SolutionDir)sshd_config" "$(OutDir)sshd_config_default"</Command>
<Message>Copy install-sshd.ps1, uninstall-sshd.ps1, OpenSSHUtils.psm1, OpenSSHUtils.psd1, FixHostFilePermissions.ps1, FixUserFilePermissions.ps1, ssh-add-hostkey.ps1, and sshd_config (if not already present) to build directory</Message>
copy /Y "$(SolutionDir)sshd_config" "$(OutDir)sshd_config_default"
copy /Y "$(SolutionDir)openssh-events.man" "$(OutDir)"</Command>
<Message>Copy install-sshd.ps1, uninstall-sshd.ps1, OpenSSHUtils.psm1, OpenSSHUtils.psd1, FixHostFilePermissions.ps1, FixUserFilePermissions.ps1, ssh-add-hostkey.ps1, sshd_config (as sshd_config_default), openssh-events.man to build directory</Message>
</PostBuildEvent>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM'">
@ -436,8 +443,9 @@ copy /Y "$(SolutionDir)sshd_config" "$(OutDir)sshd_config_default"</Command>
copy /Y "$(SolutionDir)uninstall-ssh*ps1" "$(OutDir)"
copy /Y "$(SolutionDir)OpenSSHUtils.ps*1" "$(OutDir)"
copy /Y "$(SolutionDir)Fix*FilePermissions.ps1" "$(OutDir)"
copy /Y "$(SolutionDir)sshd_config" "$(OutDir)sshd_config_default"</Command>
<Message>Copy install-sshd.ps1, uninstall-sshd.ps1, OpenSSHUtils.psm1, OpenSSHUtils.psd1, FixHostFilePermissions.ps1, FixUserFilePermissions.ps1, ssh-add-hostkey.ps1, and sshd_config (if not already present) to build directory</Message>
copy /Y "$(SolutionDir)sshd_config" "$(OutDir)sshd_config_default"
copy /Y "$(SolutionDir)openssh-events.man" "$(OutDir)"</Command>
<Message>Copy install-sshd.ps1, uninstall-sshd.ps1, OpenSSHUtils.psm1, OpenSSHUtils.psd1, FixHostFilePermissions.ps1, FixUserFilePermissions.ps1, ssh-add-hostkey.ps1, sshd_config (as sshd_config_default), openssh-events.man to build directory</Message>
</PostBuildEvent>
</ItemDefinitionGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />

View File

@ -0,0 +1,3 @@
mc -um -h ..\win32compat -r . openssh-events.man
wevtutil im openssh-events.man

View File

@ -10,6 +10,7 @@ $sshdpath = Join-Path $scriptdir "sshd.exe"
$sshagentpath = Join-Path $scriptdir "ssh-agent.exe"
$sshdir = Join-Path $env:ProgramData "\ssh"
$logsdir = Join-Path $sshdir "logs"
$etwman = Join-Path $scriptdir "openssh-events.man"
if (-not (Test-Path $sshdpath)) {
throw "sshd.exe is not present in script path"
@ -27,6 +28,18 @@ if (Get-Service ssh-agent -ErrorAction SilentlyContinue)
sc.exe delete ssh-agent 1>$null
}
# unregister etw provider
wevtutil um `"$etwman`"
# adjust provider resource path in instrumentation manifest
[XML]$xml = Get-Content $etwman
$xml.instrumentationManifest.instrumentation.events.provider.resourceFileName = $sshagentpath.ToString()
$xml.instrumentationManifest.instrumentation.events.provider.messageFileName = $sshagentpath.ToString()
$xml.Save($etwman)
#register etw provider
wevtutil im `"$etwman`"
New-Service -Name ssh-agent -BinaryPathName `"$sshagentpath`" -Description "SSH Agent" -StartupType Manual | Out-Null
cmd.exe /c 'sc.exe sdset ssh-agent D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)(A;;RP;;;AU)'

Binary file not shown.

View File

@ -0,0 +1,3 @@
LANGUAGE 0x9,0x1
1 11 "MSG00001.bin"
1 WEVT_TEMPLATE "openssh-eventsTEMP.BIN"

Binary file not shown.

View File

@ -393,6 +393,7 @@
<ClCompile Include="$(OpenSSH-Src-Path)\contrib\win32\win32compat\ssh-agent\keyagent-request.c" />
</ItemGroup>
<ItemGroup>
<ResourceCompile Include="openssh-events.rc" />
<ResourceCompile Include="version.rc" />
</ItemGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />

View File

@ -193,7 +193,7 @@
<AdditionalLibraryDirectories>$(OpenSSH-Lib-Path)$(Platform)\$(Configuration);$(LibreSSL-x86-Path);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
<ForceFileOutput>MultiplyDefinedSymbolOnly</ForceFileOutput>
<EntryPointSymbol>wmainCRTStartup</EntryPointSymbol>
<ShowProgress>LinkVerbose</ShowProgress>
<ShowProgress>NotSet</ShowProgress>
</Link>
<Manifest>
<AdditionalManifestFiles>targetos.manifest</AdditionalManifestFiles>
@ -219,7 +219,7 @@
<AdditionalLibraryDirectories>$(OpenSSH-Lib-Path)$(Platform)\$(Configuration);$(LibreSSL-x64-Path);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
<ForceFileOutput>MultiplyDefinedSymbolOnly</ForceFileOutput>
<EntryPointSymbol>wmainCRTStartup</EntryPointSymbol>
<ShowProgress>LinkVerbose</ShowProgress>
<ShowProgress>NotSet</ShowProgress>
</Link>
<Manifest>
<AdditionalManifestFiles>targetos.manifest</AdditionalManifestFiles>
@ -245,7 +245,7 @@
<AdditionalLibraryDirectories>$(OpenSSH-Lib-Path)$(Platform)\$(Configuration);$(LibreSSL-arm64-Path);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
<ForceFileOutput>MultiplyDefinedSymbolOnly</ForceFileOutput>
<EntryPointSymbol>wmainCRTStartup</EntryPointSymbol>
<ShowProgress>LinkVerbose</ShowProgress>
<ShowProgress>NotSet</ShowProgress>
</Link>
<Manifest>
<AdditionalManifestFiles>targetos.manifest</AdditionalManifestFiles>
@ -271,7 +271,7 @@
<AdditionalLibraryDirectories>$(OpenSSH-Lib-Path)$(Platform)\$(Configuration);$(LibreSSL-arm-Path);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
<ForceFileOutput>MultiplyDefinedSymbolOnly</ForceFileOutput>
<EntryPointSymbol>wmainCRTStartup</EntryPointSymbol>
<ShowProgress>LinkVerbose</ShowProgress>
<ShowProgress>NotSet</ShowProgress>
</Link>
<Manifest>
<AdditionalManifestFiles>targetos.manifest</AdditionalManifestFiles>
@ -301,7 +301,7 @@
<ForceFileOutput>MultiplyDefinedSymbolOnly</ForceFileOutput>
<EntryPointSymbol>wmainCRTStartup</EntryPointSymbol>
<FullProgramDatabaseFile>true</FullProgramDatabaseFile>
<ShowProgress>LinkVerbose</ShowProgress>
<ShowProgress>NotSet</ShowProgress>
</Link>
<Manifest>
<AdditionalManifestFiles>targetos.manifest</AdditionalManifestFiles>
@ -332,7 +332,7 @@
<ForceFileOutput>MultiplyDefinedSymbolOnly</ForceFileOutput>
<EntryPointSymbol>wmainCRTStartup</EntryPointSymbol>
<FullProgramDatabaseFile>true</FullProgramDatabaseFile>
<ShowProgress>LinkVerbose</ShowProgress>
<ShowProgress>NotSet</ShowProgress>
</Link>
<Manifest>
<AdditionalManifestFiles>targetos.manifest</AdditionalManifestFiles>
@ -363,7 +363,7 @@
<ForceFileOutput>MultiplyDefinedSymbolOnly</ForceFileOutput>
<EntryPointSymbol>wmainCRTStartup</EntryPointSymbol>
<FullProgramDatabaseFile>true</FullProgramDatabaseFile>
<ShowProgress>LinkVerbose</ShowProgress>
<ShowProgress>NotSet</ShowProgress>
</Link>
<Manifest>
<AdditionalManifestFiles>targetos.manifest</AdditionalManifestFiles>
@ -394,7 +394,7 @@
<ForceFileOutput>MultiplyDefinedSymbolOnly</ForceFileOutput>
<EntryPointSymbol>wmainCRTStartup</EntryPointSymbol>
<FullProgramDatabaseFile>true</FullProgramDatabaseFile>
<ShowProgress>LinkVerbose</ShowProgress>
<ShowProgress>NotSet</ShowProgress>
</Link>
<Manifest>
<AdditionalManifestFiles>targetos.manifest</AdditionalManifestFiles>

View File

@ -17,6 +17,7 @@
#if !defined(AFX_RESOURCE_DLL) || defined(AFX_TARG_ENU)
LANGUAGE LANG_ENGLISH, SUBLANG_ENGLISH_US
#pragma code_page(1252)
#ifdef APSTUDIO_INVOKED
/////////////////////////////////////////////////////////////////////////////
@ -50,8 +51,8 @@ END
//
VS_VERSION_INFO VERSIONINFO
FILEVERSION 7,6,0,0
PRODUCTVERSION 7,6,0,0
FILEVERSION 7,6,0,1
PRODUCTVERSION 7,6,0,1
FILEFLAGSMASK 0x3fL
#ifdef _DEBUG
FILEFLAGS 0x1L
@ -66,7 +67,7 @@ BEGIN
BEGIN
BLOCK "040904b0"
BEGIN
VALUE "FileVersion", "7.6.0.0"
VALUE "FileVersion", "7.6.0.1"
VALUE "ProductName", "OpenSSH for Windows"
VALUE "ProductVersion", "OpenSSH_7.6p1 for Windows"
END

View File

@ -54,8 +54,6 @@
#include "inc\string.h"
#include "inc\grp.h"
static char* s_programdir = NULL;
/* Maximum reparse buffer info size. The max user defined reparse
* data is 16KB, plus there's a header.
*/
@ -404,33 +402,6 @@ w32_setvbuf(FILE *stream, char *buffer, int mode, size_t size) {
return setvbuf(stream, buffer, mode, size);
}
char *
w32_programdir()
{
wchar_t* wpgmptr;
if (s_programdir != NULL)
return s_programdir;
if (_get_wpgmptr(&wpgmptr) != 0)
return NULL;
if ((s_programdir = utf16_to_utf8(wpgmptr)) == NULL)
return NULL;
/* null terminate after directory path */
char* tail = s_programdir + strlen(s_programdir);
while (tail > s_programdir && *tail != '\\' && *tail != '/')
tail--;
if (tail > s_programdir)
*tail = '\0';
else
*tail = '.'; /* current directory */
return s_programdir;
}
int
daemon(int nochdir, int noclose)
{

View File

@ -0,0 +1,497 @@
//**********************************************************************`
//* This is an include file generated by Message Compiler. *`
//* *`
//* Copyright (c) Microsoft Corporation. All Rights Reserved. *`
//**********************************************************************`
#pragma once
#include <wmistr.h>
#include <evntrace.h>
#include "evntprov.h"
//
// Initial Defs
//
#if !defined(ETW_INLINE)
#define ETW_INLINE DECLSPEC_NOINLINE __inline
#endif
#if defined(__cplusplus)
extern "C" {
#endif
//
// Allow Diasabling of code generation
//
#ifndef MCGEN_DISABLE_PROVIDER_CODE_GENERATION
#if !defined(McGenDebug)
#define McGenDebug(a,b)
#endif
#if !defined(MCGEN_TRACE_CONTEXT_DEF)
#define MCGEN_TRACE_CONTEXT_DEF
typedef struct _MCGEN_TRACE_CONTEXT
{
TRACEHANDLE RegistrationHandle;
TRACEHANDLE Logger;
ULONGLONG MatchAnyKeyword;
ULONGLONG MatchAllKeyword;
ULONG Flags;
ULONG IsEnabled;
UCHAR Level;
UCHAR Reserve;
USHORT EnableBitsCount;
PULONG EnableBitMask;
const ULONGLONG* EnableKeyWords;
const UCHAR* EnableLevel;
} MCGEN_TRACE_CONTEXT, *PMCGEN_TRACE_CONTEXT;
#endif
#if !defined(MCGEN_LEVEL_KEYWORD_ENABLED_DEF)
#define MCGEN_LEVEL_KEYWORD_ENABLED_DEF
FORCEINLINE
BOOLEAN
McGenLevelKeywordEnabled(
_In_ PMCGEN_TRACE_CONTEXT EnableInfo,
_In_ UCHAR Level,
_In_ ULONGLONG Keyword
)
{
//
// Check if the event Level is lower than the level at which
// the channel is enabled.
// If the event Level is 0 or the channel is enabled at level 0,
// all levels are enabled.
//
if ((Level <= EnableInfo->Level) || // This also covers the case of Level == 0.
(EnableInfo->Level == 0)) {
//
// Check if Keyword is enabled
//
if ((Keyword == (ULONGLONG)0) ||
((Keyword & EnableInfo->MatchAnyKeyword) &&
((Keyword & EnableInfo->MatchAllKeyword) == EnableInfo->MatchAllKeyword))) {
return TRUE;
}
}
return FALSE;
}
#endif
#if !defined(MCGEN_EVENT_ENABLED_DEF)
#define MCGEN_EVENT_ENABLED_DEF
FORCEINLINE
BOOLEAN
McGenEventEnabled(
_In_ PMCGEN_TRACE_CONTEXT EnableInfo,
_In_ PCEVENT_DESCRIPTOR EventDescriptor
)
{
return McGenLevelKeywordEnabled(EnableInfo, EventDescriptor->Level, EventDescriptor->Keyword);
}
#endif
//
// EnableCheckMacro
//
#ifndef MCGEN_ENABLE_CHECK
#define MCGEN_ENABLE_CHECK(Context, Descriptor) (Context.IsEnabled && McGenEventEnabled(&Context, &Descriptor))
#endif
#if !defined(MCGEN_CONTROL_CALLBACK)
#define MCGEN_CONTROL_CALLBACK
DECLSPEC_NOINLINE __inline
VOID
__stdcall
McGenControlCallbackV2(
_In_ LPCGUID SourceId,
_In_ ULONG ControlCode,
_In_ UCHAR Level,
_In_ ULONGLONG MatchAnyKeyword,
_In_ ULONGLONG MatchAllKeyword,
_In_opt_ PEVENT_FILTER_DESCRIPTOR FilterData,
_Inout_opt_ PVOID CallbackContext
)
/*++
Routine Description:
This is the notification callback for Vista.
Arguments:
SourceId - The GUID that identifies the session that enabled the provider.
ControlCode - The parameter indicates whether the provider
is being enabled or disabled.
Level - The level at which the event is enabled.
MatchAnyKeyword - The bitmask of keywords that the provider uses to
determine the category of events that it writes.
MatchAllKeyword - This bitmask additionally restricts the category
of events that the provider writes.
FilterData - The provider-defined data.
CallbackContext - The context of the callback that is defined when the provider
called EtwRegister to register itself.
Remarks:
ETW calls this function to notify provider of enable/disable
--*/
{
PMCGEN_TRACE_CONTEXT Ctx = (PMCGEN_TRACE_CONTEXT)CallbackContext;
ULONG Ix;
#ifndef MCGEN_PRIVATE_ENABLE_CALLBACK_V2
UNREFERENCED_PARAMETER(SourceId);
UNREFERENCED_PARAMETER(FilterData);
#endif
if (Ctx == NULL) {
return;
}
switch (ControlCode) {
case EVENT_CONTROL_CODE_ENABLE_PROVIDER:
Ctx->Level = Level;
Ctx->MatchAnyKeyword = MatchAnyKeyword;
Ctx->MatchAllKeyword = MatchAllKeyword;
Ctx->IsEnabled = EVENT_CONTROL_CODE_ENABLE_PROVIDER;
for (Ix = 0; Ix < Ctx->EnableBitsCount; Ix += 1) {
if (McGenLevelKeywordEnabled(Ctx, Ctx->EnableLevel[Ix], Ctx->EnableKeyWords[Ix]) != FALSE) {
Ctx->EnableBitMask[Ix >> 5] |= (1 << (Ix % 32));
} else {
Ctx->EnableBitMask[Ix >> 5] &= ~(1 << (Ix % 32));
}
}
break;
case EVENT_CONTROL_CODE_DISABLE_PROVIDER:
Ctx->IsEnabled = EVENT_CONTROL_CODE_DISABLE_PROVIDER;
Ctx->Level = 0;
Ctx->MatchAnyKeyword = 0;
Ctx->MatchAllKeyword = 0;
if (Ctx->EnableBitsCount > 0) {
RtlZeroMemory(Ctx->EnableBitMask, (((Ctx->EnableBitsCount - 1) / 32) + 1) * sizeof(ULONG));
}
break;
default:
break;
}
#ifdef MCGEN_PRIVATE_ENABLE_CALLBACK_V2
//
// Call user defined callback
//
MCGEN_PRIVATE_ENABLE_CALLBACK_V2(
SourceId,
ControlCode,
Level,
MatchAnyKeyword,
MatchAllKeyword,
FilterData,
CallbackContext
);
#endif
return;
}
#endif
#endif // MCGEN_DISABLE_PROVIDER_CODE_GENERATION
//+
// Provider OpenSSH Event Count 5
//+
EXTERN_C __declspec(selectany) const GUID OpenSSH = {0xc4b57d35, 0x0636, 0x4bc3, {0xa2, 0x62, 0x37, 0x0f, 0x24, 0x9f, 0x98, 0x02}};
//
// Channel
//
#define OpenSSH_Admin 0x10
#define OpenSSH_Operational 0x11
#define OpenSSH_Debug 0x12
//
// Levels
//
#define Debug 0x10
//
// Event Descriptors
//
EXTERN_C __declspec(selectany) const EVENT_DESCRIPTOR CRITICAL_Event = {0x1, 0x0, 0x10, 0x1, 0x0, 0x0, 0x8000000000000000};
#define CRITICAL_Event_value 0x1
EXTERN_C __declspec(selectany) const EVENT_DESCRIPTOR ERROR_Event = {0x2, 0x0, 0x10, 0x2, 0x0, 0x0, 0x8000000000000000};
#define ERROR_Event_value 0x2
EXTERN_C __declspec(selectany) const EVENT_DESCRIPTOR WARNING_Event = {0x3, 0x0, 0x11, 0x3, 0x0, 0x0, 0x4000000000000000};
#define WARNING_Event_value 0x3
EXTERN_C __declspec(selectany) const EVENT_DESCRIPTOR INFO_Event = {0x4, 0x0, 0x11, 0x4, 0x0, 0x0, 0x4000000000000000};
#define INFO_Event_value 0x4
EXTERN_C __declspec(selectany) const EVENT_DESCRIPTOR DEBUG_Event = {0x6, 0x0, 0x12, 0x10, 0x0, 0x0, 0x2000000000000000};
#define DEBUG_Event_value 0x6
//
// Note on Generate Code from Manifest Windows Vista and above
//
//Structures : are handled as a size and pointer pairs. The macro for the event will have an extra
//parameter for the size in bytes of the structure. Make sure that your structures have no extra padding.
//
//Strings: There are several cases that can be described in the manifest. For array of variable length
//strings, the generated code will take the count of characters for the whole array as an input parameter.
//
//SID No support for array of SIDs, the macro will take a pointer to the SID and use appropriate
//GetLengthSid function to get the length.
//
//
// Allow Diasabling of code generation
//
#ifndef MCGEN_DISABLE_PROVIDER_CODE_GENERATION
//
// Globals
//
//
// Event Enablement Bits
//
EXTERN_C __declspec(selectany) DECLSPEC_CACHEALIGN ULONG OpenSSHEnableBits[1];
EXTERN_C __declspec(selectany) const ULONGLONG OpenSSHKeywords[5] = {0x8000000000000000, 0x8000000000000000, 0x4000000000000000, 0x4000000000000000, 0x2000000000000000};
EXTERN_C __declspec(selectany) const UCHAR OpenSSHLevels[5] = {1, 2, 3, 4, 16};
EXTERN_C __declspec(selectany) MCGEN_TRACE_CONTEXT OpenSSH_Context = {0, 0, 0, 0, 0, 0, 0, 0, 5, OpenSSHEnableBits, OpenSSHKeywords, OpenSSHLevels};
EXTERN_C __declspec(selectany) REGHANDLE OpenSSHHandle = (REGHANDLE)0;
#if !defined(McGenEventRegisterUnregister)
#define McGenEventRegisterUnregister
DECLSPEC_NOINLINE __inline
ULONG __stdcall
McGenEventRegister(
_In_ LPCGUID ProviderId,
_In_opt_ PENABLECALLBACK EnableCallback,
_In_opt_ PVOID CallbackContext,
_Inout_ PREGHANDLE RegHandle
)
/*++
Routine Description:
This function register the provider with ETW USER mode.
Arguments:
ProviderId - Provider Id to be register with ETW.
EnableCallback - Callback to be used.
CallbackContext - Context for this provider.
RegHandle - Pointer to Registration handle.
Remarks:
If the handle != NULL will return ERROR_SUCCESS
--*/
{
ULONG Error;
if (*RegHandle) {
//
// already registered
//
return ERROR_SUCCESS;
}
Error = EventRegister( ProviderId, EnableCallback, CallbackContext, RegHandle);
return Error;
}
DECLSPEC_NOINLINE __inline
ULONG __stdcall
McGenEventUnregister(_Inout_ PREGHANDLE RegHandle)
/*++
Routine Description:
Unregister from ETW USER mode
Arguments:
RegHandle this is the pointer to the provider context
Remarks:
If Provider has not register RegHandle = NULL,
return ERROR_SUCCESS
--*/
{
ULONG Error;
if(!(*RegHandle)) {
//
// Provider has not registerd
//
return ERROR_SUCCESS;
}
Error = EventUnregister(*RegHandle);
*RegHandle = (REGHANDLE)0;
return Error;
}
#endif
//
// Register with ETW Vista +
//
#ifndef EventRegisterOpenSSH
#define EventRegisterOpenSSH() McGenEventRegister(&OpenSSH, McGenControlCallbackV2, &OpenSSH_Context, &OpenSSHHandle)
#endif
//
// UnRegister with ETW
//
#ifndef EventUnregisterOpenSSH
#define EventUnregisterOpenSSH() McGenEventUnregister(&OpenSSHHandle)
#endif
//
// Enablement check macro for CRITICAL_Event
//
#define EventEnabledCRITICAL_Event() ((OpenSSHEnableBits[0] & 0x00000001) != 0)
//
// Event Macro for CRITICAL_Event
//
#define EventWriteCRITICAL_Event(process, payload)\
EventEnabledCRITICAL_Event() ?\
Template_zz(OpenSSHHandle, &CRITICAL_Event, process, payload)\
: ERROR_SUCCESS\
//
// Enablement check macro for ERROR_Event
//
#define EventEnabledERROR_Event() ((OpenSSHEnableBits[0] & 0x00000002) != 0)
//
// Event Macro for ERROR_Event
//
#define EventWriteERROR_Event(process, payload)\
EventEnabledERROR_Event() ?\
Template_zz(OpenSSHHandle, &ERROR_Event, process, payload)\
: ERROR_SUCCESS\
//
// Enablement check macro for WARNING_Event
//
#define EventEnabledWARNING_Event() ((OpenSSHEnableBits[0] & 0x00000004) != 0)
//
// Event Macro for WARNING_Event
//
#define EventWriteWARNING_Event(process, payload)\
EventEnabledWARNING_Event() ?\
Template_zz(OpenSSHHandle, &WARNING_Event, process, payload)\
: ERROR_SUCCESS\
//
// Enablement check macro for INFO_Event
//
#define EventEnabledINFO_Event() ((OpenSSHEnableBits[0] & 0x00000008) != 0)
//
// Event Macro for INFO_Event
//
#define EventWriteINFO_Event(process, payload)\
EventEnabledINFO_Event() ?\
Template_zz(OpenSSHHandle, &INFO_Event, process, payload)\
: ERROR_SUCCESS\
//
// Enablement check macro for DEBUG_Event
//
#define EventEnabledDEBUG_Event() ((OpenSSHEnableBits[0] & 0x00000010) != 0)
//
// Event Macro for DEBUG_Event
//
#define EventWriteDEBUG_Event(process, payload)\
EventEnabledDEBUG_Event() ?\
Template_zz(OpenSSHHandle, &DEBUG_Event, process, payload)\
: ERROR_SUCCESS\
#endif // MCGEN_DISABLE_PROVIDER_CODE_GENERATION
//
// Allow Diasabling of code generation
//
#ifndef MCGEN_DISABLE_PROVIDER_CODE_GENERATION
//
// Template Functions
//
//
//Template from manifest : 2StrTemplate
//
#ifndef Template_zz_def
#define Template_zz_def
ETW_INLINE
ULONG
Template_zz(
_In_ REGHANDLE RegHandle,
_In_ PCEVENT_DESCRIPTOR Descriptor,
_In_opt_ PCWSTR _Arg0,
_In_opt_ PCWSTR _Arg1
)
{
#define ARGUMENT_COUNT_zz 2
EVENT_DATA_DESCRIPTOR EventData[ARGUMENT_COUNT_zz];
EventDataDescCreate(&EventData[0],
(_Arg0 != NULL) ? _Arg0 : L"NULL",
(_Arg0 != NULL) ? (ULONG)((wcslen(_Arg0) + 1) * sizeof(WCHAR)) : (ULONG)sizeof(L"NULL"));
EventDataDescCreate(&EventData[1],
(_Arg1 != NULL) ? _Arg1 : L"NULL",
(_Arg1 != NULL) ? (ULONG)((wcslen(_Arg1) + 1) * sizeof(WCHAR)) : (ULONG)sizeof(L"NULL"));
return EventWrite(RegHandle, Descriptor, ARGUMENT_COUNT_zz, EventData);
}
#endif
#endif // MCGEN_DISABLE_PROVIDER_CODE_GENERATION
#if defined(__cplusplus)
};
#endif
#define MSG_level_Critical 0x50000001L
#define MSG_level_Error 0x50000002L
#define MSG_level_Warning 0x50000003L
#define MSG_level_Informational 0x50000004L
#define MSG_OpenSSH_level_Debug_message 0x50000010L
#define MSG_OpenSSH_event_message 0xB0000001L

View File

@ -69,6 +69,10 @@ void fd_table_set(struct w32_io* pio, int index);
void fd_decode_state(char*);
#define POSIX_STATE_ENV "c28fc6f98a2c44abbbd89d6a3037d0d9_POSIX_STATE"
/* __progname */
char* __progname = "";
static char* s_programdir = "";
/* initializes mapping table*/
static int
fd_table_initialize()
@ -157,13 +161,45 @@ fd_table_clear(int index)
FD_CLR(index, &(fd_table.occupied));
}
char *
w32_programdir()
{
return s_programdir;
}
static int
init_prog_paths()
{
wchar_t* wpgmptr;
if (_get_wpgmptr(&wpgmptr) != 0) {
errno = EOTHER;
return -1;
}
if ((s_programdir = utf16_to_utf8(wpgmptr)) == NULL) {
errno = ENOMEM;
return -1;
}
__progname = strrchr(s_programdir, '\\') + 1;
*(__progname - 1) = '\0';
/* strip .exe off __progname */
*(__progname + strlen(__progname) - 4) = '\0';
return 0;
}
void
w32posix_initialize()
{
if ((fd_table_initialize() != 0) || (socketio_initialize() != 0))
DebugBreak();
main_thread = OpenThread(THREAD_SET_CONTEXT | SYNCHRONIZE, FALSE, GetCurrentThreadId());
if ((main_thread == NULL) || (sw_initialize() != 0) || w32_programdir() == NULL) {
if (main_thread == NULL ||
sw_initialize() != 0 ||
init_prog_paths() != 0 ) {
DebugBreak();
fatal("failed to initialize w32posix wrapper");
}

View File

@ -36,17 +36,63 @@
#include "inc\syslog.h"
#include "misc_internal.h"
#include "inc\utf.h"
#include "openssh-events.h"
#define MSGBUFSIZ 1024
static int logfd = -1;
char* identity = NULL;
int log_facility = 0;
void openlog_etw()
{
EventRegisterOpenSSH();
}
void
syslog_etw(int priority, const char *format, const char *formatBuffer)
{
wchar_t *w_identity = NULL, *w_payload = NULL;
w_identity = utf8_to_utf16(identity);
w_payload = utf8_to_utf16(formatBuffer);
if (!w_identity || !w_payload)
goto done;
switch (priority) {
case LOG_CRIT:
EventWriteCRITICAL_Event(w_identity, w_payload);
break;
case LOG_ERR:
EventWriteERROR_Event(w_identity, w_payload);
break;
case LOG_WARNING:
EventWriteWARNING_Event(w_identity, w_payload);
break;
case LOG_INFO:
EventWriteINFO_Event(w_identity, w_payload);
break;
case LOG_DEBUG:
EventWriteDEBUG_Event(w_identity, w_payload);
break;
default:
break;
}
done:
if (w_identity)
free(w_identity);
if (w_payload)
free(w_payload);
}
/*
* log file location will be - "%programData%\\openssh\\logs\\<module_name>.log"
*/
void
openlog(char *ident, unsigned int option, int facility)
openlog_file()
{
if (logfd != -1 || ident == NULL)
if (logfd != -1)
return;
wchar_t *logs_dir = L"\\logs\\";
@ -84,13 +130,7 @@ openlog(char *ident, unsigned int option, int facility)
}
void
closelog(void)
{
/*NOOP*/
}
void
syslog(int priority, const char *format, const char *formatBuffer)
syslog_file(int priority, const char *format, const char *formatBuffer)
{
char msgbufTimestamp[MSGBUFSIZ];
SYSTEMTIME st;
@ -110,3 +150,29 @@ syslog(int priority, const char *format, const char *formatBuffer)
msgbufTimestamp[strnlen(msgbufTimestamp, MSGBUFSIZ)] = '\0';
_write(logfd, msgbufTimestamp, (unsigned int)strnlen(msgbufTimestamp, MSGBUFSIZ));
}
void
openlog(char *ident, unsigned int option, int facility)
{
identity = ident;
log_facility = facility;
if (log_facility == LOG_LOCAL0)
openlog_file();
else
openlog_etw();
}
void
syslog(int priority, const char *format, const char *formatBuffer)
{
if (log_facility == LOG_LOCAL0)
syslog_file(priority, format, formatBuffer);
else
syslog_etw(priority, format, formatBuffer);
}
void
closelog(void)
{
/*NOOP*/
}

14
sshd.c
View File

@ -742,9 +742,13 @@ privsep_preauth(Authctxt *authctxt)
#ifdef FORK_NOT_SUPPORTED
if (privsep_auth_child) {
struct passwd* me = getpwuid(geteuid());
/* this re-does the user specific config */
authctxt->pw = getpwnamallow(xstrdup(me->pw_name));
struct connection_info *ci = get_connection_info(1, options.use_dns);
authctxt->pw = getpwuid(geteuid());
ci->user = authctxt->pw->pw_name;
parse_server_match_config(&options, ci);
log_change_level(options.log_level);
process_permitopen(active_state, &options);
authctxt->valid = 1;
return 1;
}
@ -777,6 +781,8 @@ privsep_preauth(Authctxt *authctxt)
char** argv = privsep_child_cmdline(0);
if (__posix_spawn_asuser(&pid, argv[0], &actions, NULL, argv, NULL, SSH_PRIVSEP_USER) != 0)
error("%s, posix_spawn failed", __func__);
else
debug2("Network child is on pid %ld", (long)pid);
posix_spawn_file_actions_destroy(&actions);
}
close(pmonitor->m_recvfd);
@ -883,6 +889,8 @@ privsep_postauth(Authctxt *authctxt)
char** argv = privsep_child_cmdline(1);
if (__posix_spawn_asuser(&pmonitor->m_pid, argv[0], &actions, NULL, argv, NULL, authctxt->pw->pw_name) != 0)
error("%s, posix_spawn failed", __func__);
else
verbose("User child is on pid %ld", (long)pmonitor->m_pid);
posix_spawn_file_actions_destroy(&actions);
}