From 7906ad4cda93c7b15a14bdf00d7f5260035849e0 Mon Sep 17 00:00:00 2001 From: Tess Gauthier Date: Wed, 24 Jul 2024 14:18:29 -0400 Subject: [PATCH] continue merge - not compiling --- contrib/win32/openssh/Win32-OpenSSH.sln | 23 +- contrib/win32/openssh/sshd-session.vcxproj | 483 +++++++++++++++++++++ contrib/win32/openssh/sshd.vcxproj | 23 - sshd-session.c | 194 ++++++++- sshd.c | 67 +-- 5 files changed, 701 insertions(+), 89 deletions(-) create mode 100644 contrib/win32/openssh/sshd-session.vcxproj diff --git a/contrib/win32/openssh/Win32-OpenSSH.sln b/contrib/win32/openssh/Win32-OpenSSH.sln index 40732fe3b..14946f9d9 100644 --- a/contrib/win32/openssh/Win32-OpenSSH.sln +++ b/contrib/win32/openssh/Win32-OpenSSH.sln @@ -1,6 +1,6 @@ Microsoft Visual Studio Solution File, Format Version 12.00 -# Visual Studio 15 -VisualStudioVersion = 15.0.27027.1 +# Visual Studio Version 17 +VisualStudioVersion = 17.10.35027.167 MinimumVisualStudioVersion = 10.0.40219.1 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ssh", "ssh.vcxproj", "{74E69D5E-A1EF-46EA-9173-19A412774104}" ProjectSection(ProjectDependencies) = postProject @@ -180,6 +180,8 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "ssh-pkcs11-helper", "ssh-pk {0D02F0F0-013B-4EE3-906D-86517F3822C0} = {0D02F0F0-013B-4EE3-906D-86517F3822C0} EndProjectSection EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "sshd-session", "sshd-session.vcxproj", "{86D5F580-EFB0-4BEA-96B7-7181F9BC6171}" +EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution Debug|ARM = Debug|ARM @@ -576,6 +578,22 @@ Global {21D772C3-0EB0-47B7-A93C-FF624675A58D}.Release|x64.Build.0 = Release|x64 {21D772C3-0EB0-47B7-A93C-FF624675A58D}.Release|x86.ActiveCfg = Release|Win32 {21D772C3-0EB0-47B7-A93C-FF624675A58D}.Release|x86.Build.0 = Release|Win32 + {86D5F580-EFB0-4BEA-96B7-7181F9BC6171}.Debug|ARM.ActiveCfg = Debug|ARM + {86D5F580-EFB0-4BEA-96B7-7181F9BC6171}.Debug|ARM.Build.0 = Debug|ARM + {86D5F580-EFB0-4BEA-96B7-7181F9BC6171}.Debug|ARM64.ActiveCfg = Debug|ARM64 + {86D5F580-EFB0-4BEA-96B7-7181F9BC6171}.Debug|ARM64.Build.0 = Debug|ARM64 + {86D5F580-EFB0-4BEA-96B7-7181F9BC6171}.Debug|x64.ActiveCfg = Debug|x64 + {86D5F580-EFB0-4BEA-96B7-7181F9BC6171}.Debug|x64.Build.0 = Debug|x64 + {86D5F580-EFB0-4BEA-96B7-7181F9BC6171}.Debug|x86.ActiveCfg = Debug|Win32 + {86D5F580-EFB0-4BEA-96B7-7181F9BC6171}.Debug|x86.Build.0 = Debug|Win32 + {86D5F580-EFB0-4BEA-96B7-7181F9BC6171}.Release|ARM.ActiveCfg = Release|ARM + {86D5F580-EFB0-4BEA-96B7-7181F9BC6171}.Release|ARM.Build.0 = Release|ARM + {86D5F580-EFB0-4BEA-96B7-7181F9BC6171}.Release|ARM64.ActiveCfg = Release|ARM64 + {86D5F580-EFB0-4BEA-96B7-7181F9BC6171}.Release|ARM64.Build.0 = Release|ARM64 + {86D5F580-EFB0-4BEA-96B7-7181F9BC6171}.Release|x64.ActiveCfg = Release|x64 + {86D5F580-EFB0-4BEA-96B7-7181F9BC6171}.Release|x64.Build.0 = Release|x64 + {86D5F580-EFB0-4BEA-96B7-7181F9BC6171}.Release|x86.ActiveCfg = Release|Win32 + {86D5F580-EFB0-4BEA-96B7-7181F9BC6171}.Release|x86.Build.0 = Release|Win32 EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE @@ -605,6 +623,7 @@ Global {7D0A75FC-F366-4B60-B72F-B37C3EA07CCA} = {17322AAF-808F-4646-AD37-5B0EDDCB8F3E} {7D0A75FC-F366-4B60-B72F-B37C3EA07CCB} = {17322AAF-808F-4646-AD37-5B0EDDCB8F3E} {21D772C3-0EB0-47B7-A93C-FF624675A58D} = {17322AAF-808F-4646-AD37-5B0EDDCB8F3E} + {86D5F580-EFB0-4BEA-96B7-7181F9BC6171} = {17322AAF-808F-4646-AD37-5B0EDDCB8F3E} EndGlobalSection GlobalSection(ExtensibilityGlobals) = postSolution SolutionGuid = {0AC224E8-C215-4270-954A-A2ACEE06DE58} diff --git a/contrib/win32/openssh/sshd-session.vcxproj b/contrib/win32/openssh/sshd-session.vcxproj new file mode 100644 index 000000000..978040212 --- /dev/null +++ b/contrib/win32/openssh/sshd-session.vcxproj @@ -0,0 +1,483 @@ + + + + + + Debug + ARM + + + Debug + ARM64 + + + Debug + Win32 + + + Release + ARM + + + Release + ARM64 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + {86D5F580-EFB0-4BEA-96B7-7181F9BC6171} + Win32Proj + keygen + $(WindowsSDKVersion) + sshd-session + + + + Application + true + v143 + MultiByte + Spectre + + + Application + false + v143 + true + MultiByte + Spectre + + + Application + true + v143 + MultiByte + Spectre + + + Application + true + v143 + MultiByte + Spectre + + + Application + true + v143 + MultiByte + Spectre + + + Application + false + v143 + true + MultiByte + Spectre + + + Application + false + v143 + true + MultiByte + Spectre + + + Application + false + v143 + true + MultiByte + Spectre + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + true + $(OpenSSH-Bin-Path)$(Platform)\$(Configuration)\ + $(Platform)\$(Configuration)\$(TargetName)\ + $(OpenSSH-Src-Path)contrib\win32\win32compat\inc;$(VC_IncludePath);$(WindowsSDK_IncludePath); + + + true + $(OpenSSH-Bin-Path)$(Platform)\$(Configuration)\ + $(Platform)\$(Configuration)\$(TargetName)\ + $(OpenSSH-Src-Path)contrib\win32\win32compat\inc;$(VC_IncludePath);$(WindowsSDK_IncludePath); + + + true + $(OpenSSH-Bin-Path)$(Platform)\$(Configuration)\ + $(Platform)\$(Configuration)\$(TargetName)\ + $(OpenSSH-Src-Path)contrib\win32\win32compat\inc;$(VC_IncludePath);$(WindowsSDK_IncludePath); + + + true + $(OpenSSH-Bin-Path)$(Platform)\$(Configuration)\ + $(Platform)\$(Configuration)\$(TargetName)\ + $(OpenSSH-Src-Path)contrib\win32\win32compat\inc;$(VC_IncludePath);$(WindowsSDK_IncludePath); + + + false + $(OpenSSH-Bin-Path)$(Platform)\$(Configuration)\ + $(Platform)\$(Configuration)\$(TargetName)\ + $(OpenSSH-Src-Path)contrib\win32\win32compat\inc;$(VC_IncludePath);$(WindowsSDK_IncludePath); + + + false + $(OpenSSH-Bin-Path)$(Platform)\$(Configuration)\ + $(Platform)\$(Configuration)\$(TargetName)\ + $(OpenSSH-Src-Path)contrib\win32\win32compat\inc;$(VC_IncludePath);$(WindowsSDK_IncludePath); + + + false + $(OpenSSH-Bin-Path)$(Platform)\$(Configuration)\ + $(Platform)\$(Configuration)\$(TargetName)\ + $(OpenSSH-Src-Path)contrib\win32\win32compat\inc;$(VC_IncludePath);$(WindowsSDK_IncludePath); + + + false + $(OpenSSH-Bin-Path)$(Platform)\$(Configuration)\ + $(Platform)\$(Configuration)\$(TargetName)\ + $(OpenSSH-Src-Path)contrib\win32\win32compat\inc;$(VC_IncludePath);$(WindowsSDK_IncludePath); + + + + + + Level1 + Disabled + _CRT_DECLARE_NONSTDC_NAMES=0;_WIN32_WINNT=0x601;;WIN32;_DEBUG;_LIB;_CRT_SECURE_NO_WARNINGS;_CRT_NONSTDC_NO_WARNINGS;_WINSOCK_DEPRECATED_NO_WARNINGS;%(PreprocessorDefinitions) + false + $(SolutionDir);$(LibreSSL-Path)include;$(ZLib-Path);$(OpenSSH-Src-Path)includes;$(OpenSSH-Src-Path);$(OpenSSH-Src-Path)contrib\win32\win32compat;$(OpenSSH-Src-Path)libkrb;$(OpenSSH-Src-Path)libkrb\libKrb5;%(AdditionalIncludeDirectories) + MultiThreadedDebug + ProgramDatabase + Guard + /Gy /ZH:SHA_256 %(AdditionalOptions) + + + Console + true + posix_compat.lib;libssh.lib;openbsd_compat.lib;zlib.lib;$(SSLLib)$(AdditionalDependentLibs);%(AdditionalDependencies) + $(OpenSSH-Lib-Path)$(Platform)\$(Configuration);$(LibreSSL-x86-Path);$(ZLib-x86-Path);%(AdditionalLibraryDirectories) + MultiplyDefinedSymbolOnly + wmainCRTStartup + NotSet + /debug /debugtype:cv,fixup /opt:ref /opt:icf /incremental:no /ignore:4099 /ignore:4098 /CETCOMPAT %(AdditionalOptions) + + + targetos.manifest + + + + + + + Level1 + Disabled + _CRT_DECLARE_NONSTDC_NAMES=0;_WIN32_WINNT=0x601;;WIN32;_DEBUG;_LIB;_CRT_SECURE_NO_WARNINGS;_CRT_NONSTDC_NO_WARNINGS;_WINSOCK_DEPRECATED_NO_WARNINGS;%(PreprocessorDefinitions) + false + $(SolutionDir);$(LibreSSL-Path)include;$(ZLib-Path);$(OpenSSH-Src-Path)includes;$(OpenSSH-Src-Path);$(OpenSSH-Src-Path)contrib\win32\win32compat;$(OpenSSH-Src-Path)libkrb;$(OpenSSH-Src-Path)libkrb\libKrb5;%(AdditionalIncludeDirectories) + MultiThreadedDebug + ProgramDatabase + Guard + /Gy /ZH:SHA_256 %(AdditionalOptions) + + + Console + true + posix_compat.lib;libssh.lib;openbsd_compat.lib;zlib.lib;$(SSLLib)$(AdditionalDependentLibs);%(AdditionalDependencies) + $(OpenSSH-Lib-Path)$(Platform)\$(Configuration);$(LibreSSL-x64-Path);$(ZLib-x64-Path);%(AdditionalLibraryDirectories) + MultiplyDefinedSymbolOnly + wmainCRTStartup + NotSet + /debug /debugtype:cv,fixup /opt:ref /opt:icf /incremental:no /ignore:4099 /ignore:4098 /CETCOMPAT %(AdditionalOptions) + + + targetos.manifest + + + + + + + Level1 + Disabled + _CRT_DECLARE_NONSTDC_NAMES=0;_WIN32_WINNT=0x601;;WIN32;_DEBUG;_LIB;_CRT_SECURE_NO_WARNINGS;_CRT_NONSTDC_NO_WARNINGS;_WINSOCK_DEPRECATED_NO_WARNINGS;%(PreprocessorDefinitions) + false + $(SolutionDir);$(LibreSSL-Path)include;$(ZLib-Path);$(OpenSSH-Src-Path)includes;$(OpenSSH-Src-Path);$(OpenSSH-Src-Path)contrib\win32\win32compat;$(OpenSSH-Src-Path)libkrb;$(OpenSSH-Src-Path)libkrb\libKrb5;%(AdditionalIncludeDirectories) + MultiThreadedDebug + ProgramDatabase + Guard + /Gy /ZH:SHA_256 %(AdditionalOptions) + + + Console + true + posix_compat.lib;libssh.lib;openbsd_compat.lib;zlib.lib;$(SSLLib)$(AdditionalDependentLibs);%(AdditionalDependencies) + $(OpenSSH-Lib-Path)$(Platform)\$(Configuration);$(LibreSSL-arm64-Path);$(ZLib-arm64-Path);%(AdditionalLibraryDirectories) + MultiplyDefinedSymbolOnly + wmainCRTStartup + NotSet + /debug /debugtype:cv,fixup /opt:ref /opt:icf /incremental:no /ignore:4099 /ignore:4098 %(AdditionalOptions) + + + targetos.manifest + + + + + + + Level1 + Disabled + _CRT_DECLARE_NONSTDC_NAMES=0;_WIN32_WINNT=0x601;;WIN32;_DEBUG;_LIB;_CRT_SECURE_NO_WARNINGS;_CRT_NONSTDC_NO_WARNINGS;_WINSOCK_DEPRECATED_NO_WARNINGS;%(PreprocessorDefinitions) + false + $(SolutionDir);$(LibreSSL-Path)include;$(ZLib-Path);$(OpenSSH-Src-Path)includes;$(OpenSSH-Src-Path);$(OpenSSH-Src-Path)contrib\win32\win32compat;$(OpenSSH-Src-Path)libkrb;$(OpenSSH-Src-Path)libkrb\libKrb5;%(AdditionalIncludeDirectories) + MultiThreadedDebug + ProgramDatabase + Guard + /Gy /ZH:SHA_256 %(AdditionalOptions) + + + Console + true + posix_compat.lib;libssh.lib;openbsd_compat.lib;zlib.lib;$(SSLLib)$(AdditionalDependentLibs);%(AdditionalDependencies) + $(OpenSSH-Lib-Path)$(Platform)\$(Configuration);$(LibreSSL-arm-Path);$(ZLib-arm-Path);%(AdditionalLibraryDirectories) + MultiplyDefinedSymbolOnly + wmainCRTStartup + NotSet + /debug /debugtype:cv,fixup /opt:ref /opt:icf /incremental:no /ignore:4099 /ignore:4098 %(AdditionalOptions) + + + targetos.manifest + + + + + Level1 + + + MaxSpeed + true + true + _CRT_DECLARE_NONSTDC_NAMES=0;_WIN32_WINNT=0x601;;_LIB;_CRT_SECURE_NO_WARNINGS;_CRT_NONSTDC_NO_WARNINGS;_WINSOCK_DEPRECATED_NO_WARNINGS;WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + $(SolutionDir);$(LibreSSL-Path)include;$(ZLib-Path);$(OpenSSH-Src-Path)includes;$(OpenSSH-Src-Path);$(OpenSSH-Src-Path)contrib\win32\win32compat;$(OpenSSH-Src-Path)libkrb;$(OpenSSH-Src-Path)libkrb\libKrb5;%(AdditionalIncludeDirectories) + MultiThreaded + Guard + /Gy /ZH:SHA_256 %(AdditionalOptions) + + + Console + true + true + true + posix_compat.lib;libssh.lib;openbsd_compat.lib;zlib.lib;$(SSLLib)$(AdditionalDependentLibs);%(AdditionalDependencies) + $(OpenSSH-Lib-Path)$(Platform)\$(Configuration);$(LibreSSL-x86-Path);$(ZLib-x86-Path);%(AdditionalLibraryDirectories) + MultiplyDefinedSymbolOnly + wmainCRTStartup + true + NotSet + /debug /debugtype:cv,fixup /opt:ref /opt:icf /incremental:no /ignore:4099 /CETCOMPAT %(AdditionalOptions) + + + targetos.manifest + + + + + Level1 + + + MaxSpeed + true + true + _CRT_DECLARE_NONSTDC_NAMES=0;_WIN32_WINNT=0x601;;_LIB;_CRT_SECURE_NO_WARNINGS;_CRT_NONSTDC_NO_WARNINGS;_WINSOCK_DEPRECATED_NO_WARNINGS;WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + $(SolutionDir);$(LibreSSL-Path)include;$(ZLib-Path);$(OpenSSH-Src-Path)includes;$(OpenSSH-Src-Path);$(OpenSSH-Src-Path)contrib\win32\win32compat;$(OpenSSH-Src-Path)libkrb;$(OpenSSH-Src-Path)libkrb\libKrb5;%(AdditionalIncludeDirectories) + MultiThreaded + true + Guard + /Gy /ZH:SHA_256 %(AdditionalOptions) + + + Console + true + true + true + posix_compat.lib;libssh.lib;openbsd_compat.lib;zlib.lib;$(SSLLib)$(AdditionalDependentLibs);%(AdditionalDependencies) + $(OpenSSH-Lib-Path)$(Platform)\$(Configuration);$(LibreSSL-x64-Path);$(ZLib-x64-Path);%(AdditionalLibraryDirectories) + MultiplyDefinedSymbolOnly + wmainCRTStartup + true + NotSet + /debug /debugtype:cv,fixup /opt:ref /opt:icf /incremental:no /ignore:4099 /CETCOMPAT %(AdditionalOptions) + + + targetos.manifest + + + + + Level1 + + + MaxSpeed + true + true + _CRT_DECLARE_NONSTDC_NAMES=0;_WIN32_WINNT=0x601;;_LIB;_CRT_SECURE_NO_WARNINGS;_CRT_NONSTDC_NO_WARNINGS;_WINSOCK_DEPRECATED_NO_WARNINGS;WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + $(SolutionDir);$(LibreSSL-Path)include;$(ZLib-Path);$(OpenSSH-Src-Path)includes;$(OpenSSH-Src-Path);$(OpenSSH-Src-Path)contrib\win32\win32compat;$(OpenSSH-Src-Path)libkrb;$(OpenSSH-Src-Path)libkrb\libKrb5;%(AdditionalIncludeDirectories) + MultiThreaded + true + Guard + /Gy /ZH:SHA_256 %(AdditionalOptions) + + + Console + true + true + true + posix_compat.lib;libssh.lib;openbsd_compat.lib;zlib.lib;$(SSLLib)$(AdditionalDependentLibs);%(AdditionalDependencies) + $(OpenSSH-Lib-Path)$(Platform)\$(Configuration);$(LibreSSL-arm64-Path);$(ZLib-arm64-Path);%(AdditionalLibraryDirectories) + MultiplyDefinedSymbolOnly + wmainCRTStartup + true + NotSet + /debug /debugtype:cv,fixup /opt:ref /opt:icf /incremental:no /ignore:4099 %(AdditionalOptions) + + + targetos.manifest + + + + + Level1 + + + MaxSpeed + true + true + _CRT_DECLARE_NONSTDC_NAMES=0;_WIN32_WINNT=0x601;;_LIB;_CRT_SECURE_NO_WARNINGS;_CRT_NONSTDC_NO_WARNINGS;_WINSOCK_DEPRECATED_NO_WARNINGS;WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + $(SolutionDir);$(LibreSSL-Path)include;$(ZLib-Path);$(OpenSSH-Src-Path)includes;$(OpenSSH-Src-Path);$(OpenSSH-Src-Path)contrib\win32\win32compat;$(OpenSSH-Src-Path)libkrb;$(OpenSSH-Src-Path)libkrb\libKrb5;%(AdditionalIncludeDirectories) + MultiThreaded + true + Guard + /Gy /ZH:SHA_256 %(AdditionalOptions) + + + Console + true + true + true + posix_compat.lib;libssh.lib;openbsd_compat.lib;zlib.lib;$(SSLLib)$(AdditionalDependentLibs);%(AdditionalDependencies) + $(OpenSSH-Lib-Path)$(Platform)\$(Configuration);$(LibreSSL-arm-Path);$(ZLib-arm-Path);%(AdditionalLibraryDirectories) + MultiplyDefinedSymbolOnly + wmainCRTStartup + true + NotSet + /debug /debugtype:cv,fixup /opt:ref /opt:icf /incremental:no /ignore:4099 %(AdditionalOptions) + + + targetos.manifest + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/contrib/win32/openssh/sshd.vcxproj b/contrib/win32/openssh/sshd.vcxproj index 36e751252..653eec523 100644 --- a/contrib/win32/openssh/sshd.vcxproj +++ b/contrib/win32/openssh/sshd.vcxproj @@ -428,28 +428,9 @@ - - - - - - - - - - - - - - - - - - - @@ -458,16 +439,12 @@ - - - - diff --git a/sshd-session.c b/sshd-session.c index 6f1bc43ec..608600b17 100644 --- a/sshd-session.c +++ b/sshd-session.c @@ -70,6 +70,10 @@ #include #endif +#ifdef WINDOWS +#include "sshTelemetry.h" +#endif + #include "xmalloc.h" #include "ssh.h" #include "ssh2.h" @@ -116,6 +120,14 @@ #define REEXEC_CONFIG_PASS_FD (STDERR_FILENO + 3) #define REEXEC_MIN_FREE_FD (STDERR_FILENO + 4) +/* Privilege separation related spawn fds */ +#ifdef WINDOWS +#define PRIVSEP_MONITOR_FD (STDERR_FILENO + 1) +#define PRIVSEP_LOG_FD (STDERR_FILENO + 2) +#define PRIVSEP_UNAUTH_MIN_FREE_FD (PRIVSEP_LOG_FD + 1) +#define PRIVSEP_AUTH_MIN_FREE_FD (PRIVSEP_LOG_FD + 1) +#endif /* WINDOWS */ + extern char *__progname; /* Server configuration options. */ @@ -138,9 +150,9 @@ static int inetd_flag = 0; /* debug goes to stderr unless inetd_flag is set */ #ifdef WINDOWS int log_stderr = 0; -#else +#else /* WINDOWS */ static int log_stderr = 0; -#endif +#endif /* WINDOWS */ /* Saved arguments to main(). */ static char **saved_argv; static int saved_argc; @@ -149,6 +161,13 @@ static int saved_argc; int auth_sock = -1; static int have_agent = 0; +#ifdef WINDOWS +int privsep_unauth_child = 0; +int privsep_auth_child = 0; +int io_sock_in = 0; +int io_sock_out = 0; +#endif /* WINDOWS */ + /* * Any really sensitive data in the application is contained in this * structure. The idea is that this structure could be locked into memory so @@ -199,6 +218,116 @@ void demote_sensitive_data(void); static void do_ssh2_kex(struct ssh *); #ifdef WINDOWS +/* copied from sshd.c */ +static struct sshbuf* +pack_hostkeys(void) +{ + struct sshbuf* keybuf = NULL, * hostkeys = NULL; + int r; + u_int i; + + if ((keybuf = sshbuf_new()) == NULL || + (hostkeys = sshbuf_new()) == NULL) + fatal_f("sshbuf_new failed"); + + /* pack hostkeys into a string. Empty key slots get empty strings */ + for (i = 0; i < options.num_host_key_files; i++) { + /* private key */ + sshbuf_reset(keybuf); + if (sensitive_data.host_keys[i] != NULL && + (r = sshkey_private_serialize(sensitive_data.host_keys[i], + keybuf)) != 0) + fatal_fr(r, "serialize hostkey private"); + if ((r = sshbuf_put_stringb(hostkeys, keybuf)) != 0) + fatal_fr(r, "compose hostkey private"); + /* public key */ + if (sensitive_data.host_pubkeys[i] != NULL) { + if ((r = sshkey_puts(sensitive_data.host_pubkeys[i], + hostkeys)) != 0) + fatal_fr(r, "compose hostkey public"); + } + else { + if ((r = sshbuf_put_string(hostkeys, NULL, 0)) != 0) + fatal_fr(r, "compose hostkey empty public"); + } + /* cert */ + if (sensitive_data.host_certificates[i] != NULL) { + if ((r = sshkey_puts( + sensitive_data.host_certificates[i], + hostkeys)) != 0) + fatal_fr(r, "compose host cert"); + } + else { + if ((r = sshbuf_put_string(hostkeys, NULL, 0)) != 0) + fatal_fr(r, "compose host cert empty"); + } + } + + sshbuf_free(keybuf); + return hostkeys; +} + +static void +send_config_state(int fd, struct sshbuf* conf) +{ + /* copied from send_rexec_state in sshd.c */ + struct sshbuf* m = NULL, * inc = NULL, * hostkeys = NULL; + struct include_item* item = NULL; + int r, sz; + + debug3_f("entering fd = %d config len %zu", fd, + sshbuf_len(conf)); + + if ((m = sshbuf_new()) == NULL || + (inc = sshbuf_new()) == NULL) + fatal_f("sshbuf_new failed"); + + /* pack includes into a string */ + TAILQ_FOREACH(item, &includes, entry) { + if ((r = sshbuf_put_cstring(inc, item->selector)) != 0 || + (r = sshbuf_put_cstring(inc, item->filename)) != 0 || + (r = sshbuf_put_stringb(inc, item->contents)) != 0) + fatal_fr(r, "compose includes"); + } + + hostkeys = pack_hostkeys(); + + /* + * Protocol from reexec master to child: + * string configuration + * uint64 timing_secret + * string host_keys[] { + * string private_key + * string public_key + * string certificate + * } + * string included_files[] { + * string selector + * string filename + * string contents + * } + */ + if ((r = sshbuf_put_stringb(m, conf)) != 0 || + (r = sshbuf_put_u64(m, options.timing_secret)) != 0 || + (r = sshbuf_put_stringb(m, hostkeys)) != 0 || + (r = sshbuf_put_stringb(m, inc)) != 0) + fatal_fr(r, "compose config"); + + /* We need to fit the entire message inside the socket send buffer */ + sz = ROUNDUP(sshbuf_len(m) + 5, 16 * 1024); + if (setsockopt(fd, SOL_SOCKET, SO_SNDBUF, &sz, sizeof sz) == -1) + fatal_f("setsockopt SO_SNDBUF: %s", strerror(errno)); + + if (ssh_msg_send(fd, 0, m) == -1) + error_f("ssh_msg_send failed"); + + sshbuf_free(m); + sshbuf_free(inc); + sshbuf_free(hostkeys); + + debug3_f("done"); +} + static void send_idexch_state(struct ssh *ssh, int fd) { @@ -342,28 +471,29 @@ send_hostkeys_state(int fd) static char** privsep_child_cmdline(int authenticated) { - char** argv = rexec_argv ? rexec_argv : saved_argv; + //char** argv = rexec_argv ? rexec_argv : saved_argv; + char** argv = saved_argv; int argc = 0; - if (rexec_argv) - argc = rexec_argc; - else { - if (rexeced_flag) - argc = saved_argc - 1; // override '-R' - else { - char **tmp = xcalloc(saved_argc + 1 + 1, sizeof(*saved_argv)); // 1 - extra argument "-y/-z", 1 - NULL - int i = 0; - for (i = 0; (int)i < saved_argc; i++) { - tmp[i] = xstrdup(saved_argv[i]); - free(saved_argv[i]); - } - - free(saved_argv); - argv = saved_argv = tmp; - argc = saved_argc; - } + // if (rexec_argv) + // argc = rexec_argc; + //else { + //if (rexeced_flag) + // argc = saved_argc - 1; // override '-R' + //else { + char **tmp = xcalloc(saved_argc + 1 + 1, sizeof(*saved_argv)); // 1 - extra argument "-y/-z", 1 - NULL + int i = 0; + for (i = 0; (int)i < saved_argc; i++) { + tmp[i] = xstrdup(saved_argv[i]); + free(saved_argv[i]); } + free(saved_argv); + argv = saved_argv = tmp; + argc = saved_argc; + //} + //} + if (authenticated) argv[argc] = "-z"; else @@ -1212,8 +1342,13 @@ main(int ac, char **av) initialize_server_options(&options); /* Parse command-line arguments. */ +#ifdef WINDOWS + while ((opt = getopt(ac, av, + "C:E:b:c:f:g:h:k:o:p:u:46DGQRTdeiqrtVyz")) != -1) { +#else /* WINDOWS */ while ((opt = getopt(ac, av, "C:E:b:c:f:g:h:k:o:p:u:46DGQRTdeiqrtV")) != -1) { +#endif /* WINDOWS */ switch (opt) { case '4': options.address_family = AF_INET; @@ -1316,6 +1451,18 @@ main(int ac, char **av) fprintf(stderr, "%s, %s\n", SSH_RELEASE, SSH_OPENSSL_VERSION); exit(0); +#ifdef WINDOWS + case 'y': + privsep_unauth_child = 1; + //rexec_flag = 0; + logfile = NULL; + break; + case 'z': + privsep_auth_child = 1; + //rexec_flag = 0; + logfile = NULL; + break; +#endif /* WINDOWS */ default: usage(); break; @@ -1332,7 +1479,12 @@ main(int ac, char **av) if (!rexeced_flag) fatal("sshd-session should not be executed directly"); - +#ifdef WINDOWS + if (privsep_unauth_child) + closefrom(PRIVSEP_UNAUTH_MIN_FREE_FD); + else if (privsep_auth_child) + closefrom(PRIVSEP_AUTH_MIN_FREE_FD); +#endif /* WINDOWS */ closefrom(REEXEC_MIN_FREE_FD); seed_rng(); diff --git a/sshd.c b/sshd.c index cbe5e002c..4963f9af4 100644 --- a/sshd.c +++ b/sshd.c @@ -857,13 +857,12 @@ server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s, posix_spawnattr_setflags(&attributes, POSIX_SPAWN_SETPGROUP) != 0 || posix_spawnattr_setpgroup(&attributes, 0) != 0) error("posix_spawn initialization failed"); - else { - if (posix_spawn(&pid, rexec_argv[0], &actions, &attributes, rexec_argv, NULL) != 0) - error("%s, posix_spawn failed", __func__); - posix_spawn_file_actions_destroy(&actions); - posix_spawnattr_destroy(&attributes); - } - + // else { + // if (posix_spawn(&pid, rexec_argv[0], &actions, &attributes, rexec_argv, NULL) != 0) + // error("%s, posix_spawn failed", __func__); + // posix_spawn_file_actions_destroy(&actions); + // posix_spawnattr_destroy(&attributes); + // } } #else /* @@ -1041,13 +1040,8 @@ main(int ac, char **av) initialize_server_options(&options); /* Parse command-line arguments. */ -#ifdef WINDOWS - while ((opt = getopt(ac, av, - "C:E:b:c:f:g:h:k:o:p:u:46DGQRTdeiqrtVyz")) != -1) { -#else while ((opt = getopt(ac, av, "C:E:b:c:f:g:h:k:o:p:u:46DGQRTdeiqrtV")) != -1) { -#endif /* WINDOWS */ switch (opt) { case '4': options.address_family = AF_INET; @@ -1154,31 +1148,17 @@ main(int ac, char **av) fprintf(stderr, "%s, %s\n", SSH_RELEASE, SSH_OPENSSL_VERSION); exit(0); -#ifdef WINDOWS - case 'y': - privsep_unauth_child = 1; - rexec_flag = 0; - logfile = NULL; - //Sleep(10 * 1000); - break; - case 'z': - privsep_auth_child = 1; - rexec_flag = 0; - logfile = NULL; - //Sleep(10 * 1000); - break; -#endif /* WINDOWS */ default: usage(); break; } } - if (!test_flag && !do_dump_cfg && rexec_flag && !path_absolute(av[0])) + if (!test_flag && !do_dump_cfg && !path_absolute(av[0])) fatal("sshd re-exec requires execution with an absolute path"); - if (privsep_unauth_child) - closefrom(PRIVSEP_UNAUTH_MIN_FREE_FD); - else if (privsep_auth_child) - closefrom(PRIVSEP_AUTH_MIN_FREE_FD); + // if (privsep_unauth_child) + // closefrom(PRIVSEP_UNAUTH_MIN_FREE_FD); + // else if (privsep_auth_child) + // closefrom(PRIVSEP_AUTH_MIN_FREE_FD); closefrom(REEXEC_DEVCRYPTO_RESERVED_FD); @@ -1275,12 +1255,13 @@ main(int ac, char **av) debug("sshd version %s, %s", SSH_VERSION, SSH_OPENSSL_VERSION); if (do_dump_cfg) - print_config(ssh, connection_info); + print_config(&connection_info); - if (privsep_auth_child || privsep_unauth_child) { - recv_hostkeys_state(PRIVSEP_MONITOR_FD); - goto done_loading_hostkeys; - } + // TODO: does this need to be in ssh-session? + // if (privsep_auth_child || privsep_unauth_child) { + // recv_hostkeys_state(PRIVSEP_MONITOR_FD); + // goto done_loading_hostkeys; + // } /* load host keys */ sensitive_data.host_keys = xcalloc(options.num_host_key_files, @@ -1305,7 +1286,7 @@ main(int ac, char **av) if (options.host_key_files[i] == NULL) continue; - if (privsep_unauth_child || privsep_auth_child) key = NULL; else /*TODO - remove this*/ + //if (privsep_unauth_child || privsep_auth_child) key = NULL; else /*TODO - remove this*/ if ((r = sshkey_load_private(options.host_key_files[i], "", &key, NULL)) != 0 && r != SSH_ERR_SYSTEM_ERROR) do_log2_r(r, ll, "Unable to load host key \"%s\"", @@ -1538,11 +1519,11 @@ main(int ac, char **av) fatal("socketpair: %s", strerror(errno)); send_rexec_state(config_s[0], cfg); close(config_s[0]); - } else if (privsep_unauth_child || privsep_auth_child) { - sock_in = sock_out = dup(STDIN_FILENO); - close(STDIN_FILENO); - close(STDOUT_FILENO); - startup_pipe = -1; + // } else if (privsep_unauth_child || privsep_auth_child) { + // sock_in = sock_out = dup(STDIN_FILENO); + // close(STDIN_FILENO); + // close(STDOUT_FILENO); + // startup_pipe = -1; } else { platform_pre_listen(); server_listen(); @@ -1600,7 +1581,6 @@ main(int ac, char **av) debug3("dup2 config_s: %s", strerror(errno)); close(config_s[1]); } -#endif if (startup_pipe == -1) close(REEXEC_STARTUP_PIPE_FD); else if (startup_pipe != REEXEC_STARTUP_PIPE_FD) { @@ -1613,6 +1593,7 @@ main(int ac, char **av) execv(rexec_argv[0], rexec_argv); fatal("rexec of %s failed: %s", rexec_argv[0], strerror(errno)); +#endif /* FORK_NOT_SUPPORTED */ } /* server specific fatal cleanup */