1 /* $OpenBSD: session.c,v 1.330 2022/02/08 08:59:12 dtucker Exp $ */
3 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
6 * As far as I am concerned, the code I have written for this software
7 * can be used freely for any purpose. Any derived versions of this
8 * software must be clearly marked as such, and if the derived work is
9 * incompatible with the protocol description in the RFC file, it must be
10 * called by a name other than "ssh" or "Secure Shell".
12 * SSH2 support by Markus Friedl.
13 * Copyright (c) 2000, 2001 Markus Friedl. All rights reserved.
15 * Redistribution and use in source and binary forms, with or without
16 * modification, are permitted provided that the following conditions
18 * 1. Redistributions of source code must retain the above copyright
19 * notice, this list of conditions and the following disclaimer.
20 * 2. Redistributions in binary form must reproduce the above copyright
21 * notice, this list of conditions and the following disclaimer in the
22 * documentation and/or other materials provided with the distribution.
24 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
25 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
26 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
27 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
28 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
29 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
30 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
31 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
32 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
33 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
38 #include <sys/types.h>
39 #ifdef HAVE_SYS_STAT_H
40 # include <sys/stat.h>
42 #include <sys/socket.h>
46 #include <arpa/inet.h>
65 #include "openbsd-compat/sys-queue.h"
84 #include "auth-options.h"
86 #include "pathnames.h"
91 #include "serverloop.h"
95 #include "monitor_wrap.h"
99 #if defined(KRB5) && defined(USE_AFS)
104 #include <selinux/selinux.h>
107 #define IS_INTERNAL_SFTP(c) \
108 (!strncmp(c, INTERNAL_SFTP_NAME, sizeof(INTERNAL_SFTP_NAME) - 1) && \
109 (c[sizeof(INTERNAL_SFTP_NAME) - 1] == '\0' || \
110 c[sizeof(INTERNAL_SFTP_NAME) - 1] == ' ' || \
111 c[sizeof(INTERNAL_SFTP_NAME) - 1] == '\t'))
115 Session
*session_new(void);
116 void session_set_fds(struct ssh
*, Session
*, int, int, int, int, int);
117 void session_pty_cleanup(Session
*);
118 void session_proctitle(Session
*);
119 int session_setup_x11fwd(struct ssh
*, Session
*);
120 int do_exec_pty(struct ssh
*, Session
*, const char *);
121 int do_exec_no_pty(struct ssh
*, Session
*, const char *);
122 int do_exec(struct ssh
*, Session
*, const char *);
123 void do_login(struct ssh
*, Session
*, const char *);
124 void do_child(struct ssh
*, Session
*, const char *);
126 int check_quietlogin(Session
*, const char *);
128 static void do_authenticated2(struct ssh
*, Authctxt
*);
130 static int session_pty_req(struct ssh
*, Session
*);
133 extern ServerOptions options
;
134 extern char *__progname
;
135 extern int debug_flag
;
136 extern u_int utmp_len
;
137 extern int startup_pipe
;
138 extern void destroy_sensitive_data(void);
139 extern struct sshbuf
*loginmsg
;
140 extern struct sshauthopt
*auth_opts
;
141 extern char *tun_fwd_ifnames
; /* serverloop.c */
143 /* original command from peer. */
144 const char *original_command
= NULL
;
147 static int sessions_first_unused
= -1;
148 static int sessions_nalloc
= 0;
149 static Session
*sessions
= NULL
;
151 #define SUBSYSTEM_NONE 0
152 #define SUBSYSTEM_EXT 1
153 #define SUBSYSTEM_INT_SFTP 2
154 #define SUBSYSTEM_INT_SFTP_ERROR 3
156 #ifdef HAVE_LOGIN_CAP
160 static int is_child
= 0;
161 static int in_chroot
= 0;
163 /* File containing userauth info, if ExposeAuthInfo set */
164 static char *auth_info_file
= NULL
;
166 /* Name and directory of socket for authentication agent forwarding. */
167 static char *auth_sock_name
= NULL
;
168 static char *auth_sock_dir
= NULL
;
170 /* removes the agent forwarding socket */
173 auth_sock_cleanup_proc(struct passwd
*pw
)
175 if (auth_sock_name
!= NULL
) {
176 temporarily_use_uid(pw
);
177 unlink(auth_sock_name
);
178 rmdir(auth_sock_dir
);
179 auth_sock_name
= NULL
;
185 auth_input_request_forwarding(struct ssh
*ssh
, struct passwd
* pw
)
190 if (auth_sock_name
!= NULL
) {
191 error("authentication forwarding requested twice.");
195 /* Temporarily drop privileged uid for mkdir/bind. */
196 temporarily_use_uid(pw
);
198 /* Allocate a buffer for the socket name, and format the name. */
199 auth_sock_dir
= xstrdup("/tmp/ssh-XXXXXXXXXX");
201 /* Create private directory for socket */
202 if (mkdtemp(auth_sock_dir
) == NULL
) {
203 ssh_packet_send_debug(ssh
, "Agent forwarding disabled: "
204 "mkdtemp() failed: %.100s", strerror(errno
));
207 auth_sock_dir
= NULL
;
211 xasprintf(&auth_sock_name
, "%s/agent.%ld",
212 auth_sock_dir
, (long) getpid());
214 /* Start a Unix listener on auth_sock_name. */
215 sock
= unix_listener(auth_sock_name
, SSH_LISTEN_BACKLOG
, 0);
217 /* Restore the privileged uid. */
220 /* Check for socket/bind/listen failure. */
224 /* Allocate a channel for the authentication agent socket. */
225 nc
= channel_new(ssh
, "auth socket",
226 SSH_CHANNEL_AUTH_SOCKET
, sock
, sock
, -1,
227 CHAN_X11_WINDOW_DEFAULT
, CHAN_X11_PACKET_DEFAULT
,
228 0, "auth socket", 1);
229 nc
->path
= xstrdup(auth_sock_name
);
233 free(auth_sock_name
);
234 if (auth_sock_dir
!= NULL
) {
235 temporarily_use_uid(pw
);
236 rmdir(auth_sock_dir
);
242 auth_sock_name
= NULL
;
243 auth_sock_dir
= NULL
;
248 display_loginmsg(void)
252 if (sshbuf_len(loginmsg
) == 0)
254 if ((r
= sshbuf_put_u8(loginmsg
, 0)) != 0)
255 fatal_fr(r
, "sshbuf_put_u8");
256 printf("%s", (char *)sshbuf_ptr(loginmsg
));
257 sshbuf_reset(loginmsg
);
261 prepare_auth_info_file(struct passwd
*pw
, struct sshbuf
*info
)
263 int fd
= -1, success
= 0;
265 if (!options
.expose_userauth_info
|| info
== NULL
)
268 temporarily_use_uid(pw
);
269 auth_info_file
= xstrdup("/tmp/sshauth.XXXXXXXXXXXXXXX");
270 if ((fd
= mkstemp(auth_info_file
)) == -1) {
271 error_f("mkstemp: %s", strerror(errno
));
274 if (atomicio(vwrite
, fd
, sshbuf_mutable_ptr(info
),
275 sshbuf_len(info
)) != sshbuf_len(info
)) {
276 error_f("write: %s", strerror(errno
));
279 if (close(fd
) != 0) {
280 error_f("close: %s", strerror(errno
));
288 free(auth_info_file
);
289 auth_info_file
= NULL
;
295 set_fwdpermit_from_authopts(struct ssh
*ssh
, const struct sshauthopt
*opts
)
297 char *tmp
, *cp
, *host
;
301 if ((options
.allow_tcp_forwarding
& FORWARD_LOCAL
) != 0) {
302 channel_clear_permission(ssh
, FORWARD_USER
, FORWARD_LOCAL
);
303 for (i
= 0; i
< auth_opts
->npermitopen
; i
++) {
304 tmp
= cp
= xstrdup(auth_opts
->permitopen
[i
]);
305 /* This shouldn't fail as it has already been checked */
306 if ((host
= hpdelim2(&cp
, NULL
)) == NULL
)
307 fatal_f("internal error: hpdelim");
308 host
= cleanhostname(host
);
309 if (cp
== NULL
|| (port
= permitopen_port(cp
)) < 0)
310 fatal_f("internal error: permitopen port");
311 channel_add_permission(ssh
,
312 FORWARD_USER
, FORWARD_LOCAL
, host
, port
);
316 if ((options
.allow_tcp_forwarding
& FORWARD_REMOTE
) != 0) {
317 channel_clear_permission(ssh
, FORWARD_USER
, FORWARD_REMOTE
);
318 for (i
= 0; i
< auth_opts
->npermitlisten
; i
++) {
319 tmp
= cp
= xstrdup(auth_opts
->permitlisten
[i
]);
320 /* This shouldn't fail as it has already been checked */
321 if ((host
= hpdelim(&cp
)) == NULL
)
322 fatal_f("internal error: hpdelim");
323 host
= cleanhostname(host
);
324 if (cp
== NULL
|| (port
= permitopen_port(cp
)) < 0)
325 fatal_f("internal error: permitlisten port");
326 channel_add_permission(ssh
,
327 FORWARD_USER
, FORWARD_REMOTE
, host
, port
);
334 do_authenticated(struct ssh
*ssh
, Authctxt
*authctxt
)
336 setproctitle("%s", authctxt
->pw
->pw_name
);
338 auth_log_authopts("active", auth_opts
, 0);
340 /* setup the channel layer */
341 /* XXX - streamlocal? */
342 set_fwdpermit_from_authopts(ssh
, auth_opts
);
344 if (!auth_opts
->permit_port_forwarding_flag
||
345 options
.disable_forwarding
) {
346 channel_disable_admin(ssh
, FORWARD_LOCAL
);
347 channel_disable_admin(ssh
, FORWARD_REMOTE
);
349 if ((options
.allow_tcp_forwarding
& FORWARD_LOCAL
) == 0)
350 channel_disable_admin(ssh
, FORWARD_LOCAL
);
352 channel_permit_all(ssh
, FORWARD_LOCAL
);
353 if ((options
.allow_tcp_forwarding
& FORWARD_REMOTE
) == 0)
354 channel_disable_admin(ssh
, FORWARD_REMOTE
);
356 channel_permit_all(ssh
, FORWARD_REMOTE
);
358 auth_debug_send(ssh
);
360 prepare_auth_info_file(authctxt
->pw
, authctxt
->session_info
);
362 do_authenticated2(ssh
, authctxt
);
364 do_cleanup(ssh
, authctxt
);
367 /* Check untrusted xauth strings for metacharacters */
369 xauth_valid_string(const char *s
)
373 for (i
= 0; s
[i
] != '\0'; i
++) {
374 if (!isalnum((u_char
)s
[i
]) &&
375 s
[i
] != '.' && s
[i
] != ':' && s
[i
] != '/' &&
376 s
[i
] != '-' && s
[i
] != '_')
384 * This is called to fork and execute a command when we have no tty. This
385 * will call do_child from the child, and server_loop from the parent after
386 * setting up file descriptors and such.
389 do_exec_no_pty(struct ssh
*ssh
, Session
*s
, const char *command
)
393 int pin
[2], pout
[2], perr
[2];
396 fatal("do_exec_no_pty: no session");
398 /* Allocate pipes for communicating with the program. */
399 if (pipe(pin
) == -1) {
400 error_f("pipe in: %.100s", strerror(errno
));
403 if (pipe(pout
) == -1) {
404 error_f("pipe out: %.100s", strerror(errno
));
409 if (pipe(perr
) == -1) {
410 error_f("pipe err: %.100s", strerror(errno
));
418 int inout
[2], err
[2];
421 fatal("do_exec_no_pty: no session");
423 /* Uses socket pairs to communicate with the program. */
424 if (socketpair(AF_UNIX
, SOCK_STREAM
, 0, inout
) == -1) {
425 error_f("socketpair #1: %.100s", strerror(errno
));
428 if (socketpair(AF_UNIX
, SOCK_STREAM
, 0, err
) == -1) {
429 error_f("socketpair #2: %.100s", strerror(errno
));
436 session_proctitle(s
);
438 /* Fork the child. */
439 switch ((pid
= fork())) {
441 error_f("fork: %.100s", strerror(errno
));
460 * Create a new session and process group since the 4.4BSD
461 * setlogin() affects the entire process group.
464 error("setsid failed: %.100s", strerror(errno
));
468 * Redirect stdin. We close the parent side of the socket
469 * pair, and make the child side the standard input.
472 if (dup2(pin
[0], 0) == -1)
473 perror("dup2 stdin");
476 /* Redirect stdout. */
478 if (dup2(pout
[1], 1) == -1)
479 perror("dup2 stdout");
482 /* Redirect stderr. */
484 if (dup2(perr
[1], 2) == -1)
485 perror("dup2 stderr");
489 * Redirect stdin, stdout, and stderr. Stdin and stdout will
490 * use the same socket, as some programs (particularly rdist)
491 * seem to depend on it.
495 if (dup2(inout
[0], 0) == -1) /* stdin */
496 perror("dup2 stdin");
497 if (dup2(inout
[0], 1) == -1) /* stdout (same as stdin) */
498 perror("dup2 stdout");
500 if (dup2(err
[0], 2) == -1) /* stderr */
501 perror("dup2 stderr");
505 /* Do processing for the child (exec command etc). */
506 do_child(ssh
, s
, command
);
513 cygwin_set_impersonation_token(INVALID_HANDLE_VALUE
);
517 /* Set interactive/non-interactive mode. */
518 ssh_packet_set_interactive(ssh
, s
->display
!= NULL
,
519 options
.ip_qos_interactive
, options
.ip_qos_bulk
);
522 * Clear loginmsg, since it's the child's responsibility to display
523 * it to the user, otherwise multiple sessions may accumulate
524 * multiple copies of the login messages.
526 sshbuf_reset(loginmsg
);
529 /* We are the parent. Close the child sides of the pipes. */
534 session_set_fds(ssh
, s
, pin
[1], pout
[0], perr
[0],
537 /* We are the parent. Close the child sides of the socket pairs. */
542 * Enter the interactive session. Note: server_loop must be able to
543 * handle the case that fdin and fdout are the same.
545 session_set_fds(ssh
, s
, inout
[1], inout
[1], err
[1],
552 * This is called to fork and execute a command when we have a tty. This
553 * will call do_child from the child, and server_loop from the parent after
554 * setting up file descriptors, controlling tty, updating wtmp, utmp,
555 * lastlog, and other such operations.
558 do_exec_pty(struct ssh
*ssh
, Session
*s
, const char *command
)
560 int fdout
, ptyfd
, ttyfd
, ptymaster
;
564 fatal("do_exec_pty: no session");
569 * Create another descriptor of the pty master side for use as the
570 * standard input. We could use the original descriptor, but this
571 * simplifies code in server_loop. The descriptor is bidirectional.
572 * Do this before forking (and cleanup in the child) so as to
573 * detect and gracefully fail out-of-fd conditions.
575 if ((fdout
= dup(ptyfd
)) == -1) {
576 error_f("dup #1: %s", strerror(errno
));
581 /* we keep a reference to the pty master */
582 if ((ptymaster
= dup(ptyfd
)) == -1) {
583 error_f("dup #2: %s", strerror(errno
));
590 /* Fork the child. */
591 switch ((pid
= fork())) {
593 error_f("fork: %.100s", strerror(errno
));
605 /* Close the master side of the pseudo tty. */
608 /* Make the pseudo tty our controlling tty. */
609 pty_make_controlling_tty(&ttyfd
, s
->tty
);
611 /* Redirect stdin/stdout/stderr from the pseudo tty. */
612 if (dup2(ttyfd
, 0) == -1)
613 error("dup2 stdin: %s", strerror(errno
));
614 if (dup2(ttyfd
, 1) == -1)
615 error("dup2 stdout: %s", strerror(errno
));
616 if (dup2(ttyfd
, 2) == -1)
617 error("dup2 stderr: %s", strerror(errno
));
619 /* Close the extra descriptor for the pseudo tty. */
622 /* record login, etc. similar to login(1) */
624 do_login(ssh
, s
, command
);
627 * Do common processing for the child, such as execing
630 do_child(ssh
, s
, command
);
637 cygwin_set_impersonation_token(INVALID_HANDLE_VALUE
);
642 /* Parent. Close the slave side of the pseudo tty. */
645 /* Enter interactive session. */
646 s
->ptymaster
= ptymaster
;
647 ssh_packet_set_interactive(ssh
, 1,
648 options
.ip_qos_interactive
, options
.ip_qos_bulk
);
649 session_set_fds(ssh
, s
, ptyfd
, fdout
, -1, 1, 1);
654 * This is called to fork and execute a command. If another command is
655 * to be forced, execute that instead.
658 do_exec(struct ssh
*ssh
, Session
*s
, const char *command
)
661 const char *forced
= NULL
, *tty
= NULL
;
662 char session_type
[1024];
664 if (options
.adm_forced_command
) {
665 original_command
= command
;
666 command
= options
.adm_forced_command
;
668 } else if (auth_opts
->force_command
!= NULL
) {
669 original_command
= command
;
670 command
= auth_opts
->force_command
;
671 forced
= "(key-option)";
674 if (forced
!= NULL
) {
676 if (IS_INTERNAL_SFTP(command
)) {
677 s
->is_subsystem
= s
->is_subsystem
?
678 SUBSYSTEM_INT_SFTP
: SUBSYSTEM_INT_SFTP_ERROR
;
679 } else if (s
->is_subsystem
)
680 s
->is_subsystem
= SUBSYSTEM_EXT
;
681 snprintf(session_type
, sizeof(session_type
),
682 "forced-command %s '%.900s'", forced
, command
);
683 } else if (s
->is_subsystem
) {
684 snprintf(session_type
, sizeof(session_type
),
685 "subsystem '%.900s'", s
->subsys
);
686 } else if (command
== NULL
) {
687 snprintf(session_type
, sizeof(session_type
), "shell");
689 /* NB. we don't log unforced commands to preserve privacy */
690 snprintf(session_type
, sizeof(session_type
), "command");
693 if (s
->ttyfd
!= -1) {
695 if (strncmp(tty
, "/dev/", 5) == 0)
699 verbose("Starting session: %s%s%s for %s from %.200s port %d id %d",
701 tty
== NULL
? "" : " on ",
702 tty
== NULL
? "" : tty
,
704 ssh_remote_ipaddr(ssh
),
705 ssh_remote_port(ssh
),
708 #ifdef SSH_AUDIT_EVENTS
710 PRIVSEP(audit_run_command(command
));
711 else if (s
->ttyfd
== -1) {
712 char *shell
= s
->pw
->pw_shell
;
714 if (shell
[0] == '\0') /* empty shell means /bin/sh */
716 PRIVSEP(audit_run_command(shell
));
720 ret
= do_exec_pty(ssh
, s
, command
);
722 ret
= do_exec_no_pty(ssh
, s
, command
);
724 original_command
= NULL
;
727 * Clear loginmsg: it's the child's responsibility to display
728 * it to the user, otherwise multiple sessions may accumulate
729 * multiple copies of the login messages.
731 sshbuf_reset(loginmsg
);
736 /* administrative, login(1)-like work */
738 do_login(struct ssh
*ssh
, Session
*s
, const char *command
)
741 struct sockaddr_storage from
;
742 struct passwd
* pw
= s
->pw
;
743 pid_t pid
= getpid();
746 * Get IP address of client. If the connection is not a socket, let
747 * the address be 0.0.0.0.
749 memset(&from
, 0, sizeof(from
));
750 fromlen
= sizeof(from
);
751 if (ssh_packet_connection_is_on_socket(ssh
)) {
752 if (getpeername(ssh_packet_get_connection_in(ssh
),
753 (struct sockaddr
*)&from
, &fromlen
) == -1) {
754 debug("getpeername: %.100s", strerror(errno
));
759 /* Record that there was a login on that tty from the remote host. */
761 record_login(pid
, s
->tty
, pw
->pw_name
, pw
->pw_uid
,
762 session_get_remote_name_or_ip(ssh
, utmp_len
,
764 (struct sockaddr
*)&from
, fromlen
);
768 * If password change is needed, do it now.
769 * This needs to occur before the ~/.hushlogin check.
771 if (options
.use_pam
&& !use_privsep
&& s
->authctxt
->force_pwchange
) {
774 s
->authctxt
->force_pwchange
= 0;
775 /* XXX - signal [net] parent to enable forwardings */
779 if (check_quietlogin(s
, command
))
788 * Display the message of the day.
796 if (options
.print_motd
) {
797 #ifdef HAVE_LOGIN_CAP
798 f
= fopen(login_getcapstr(lc
, "welcome", "/etc/motd",
801 f
= fopen("/etc/motd", "r");
804 while (fgets(buf
, sizeof(buf
), f
))
813 * Check for quiet login, either .hushlogin or command given.
816 check_quietlogin(Session
*s
, const char *command
)
819 struct passwd
*pw
= s
->pw
;
822 /* Return 1 if .hushlogin exists or a command given. */
825 snprintf(buf
, sizeof(buf
), "%.200s/.hushlogin", pw
->pw_dir
);
826 #ifdef HAVE_LOGIN_CAP
827 if (login_getcapbool(lc
, "hushlogin", 0) || stat(buf
, &st
) >= 0)
830 if (stat(buf
, &st
) >= 0)
837 * Reads environment variables from the given file and adds/overrides them
838 * into the environment. If the file does not exist, this does nothing.
839 * Otherwise, it must consist of empty lines, comments (line starts with '#')
840 * and assignments of the form name=value. No other forms are allowed.
841 * If allowlist is not NULL, then it is interpreted as a pattern list and
842 * only variable names that match it will be accepted.
845 read_environment_file(char ***env
, u_int
*envsize
,
846 const char *filename
, const char *allowlist
)
849 char *line
= NULL
, *cp
, *value
;
853 f
= fopen(filename
, "r");
857 while (getline(&line
, &linesize
, f
) != -1) {
859 fatal("Too many lines in environment file %s", filename
);
860 for (cp
= line
; *cp
== ' ' || *cp
== '\t'; cp
++)
862 if (!*cp
|| *cp
== '#' || *cp
== '\n')
865 cp
[strcspn(cp
, "\n")] = '\0';
867 value
= strchr(cp
, '=');
869 fprintf(stderr
, "Bad line %u in %.100s\n", lineno
,
874 * Replace the equals sign by nul, and advance value to
879 if (allowlist
!= NULL
&&
880 match_pattern_list(cp
, allowlist
, 0) != 1)
882 child_set_env(env
, envsize
, cp
, value
);
888 #ifdef HAVE_ETC_DEFAULT_LOGIN
890 * Return named variable from specified environment, or NULL if not present.
893 child_get_env(char **env
, const char *name
)
899 for (i
=0; env
[i
] != NULL
; i
++)
900 if (strncmp(name
, env
[i
], len
) == 0 && env
[i
][len
] == '=')
901 return(env
[i
] + len
+ 1);
906 * Read /etc/default/login.
907 * We pick up the PATH (or SUPATH for root) and UMASK.
910 read_etc_default_login(char ***env
, u_int
*envsize
, uid_t uid
)
912 char **tmpenv
= NULL
, *var
;
913 u_int i
, tmpenvsize
= 0;
917 * We don't want to copy the whole file to the child's environment,
918 * so we use a temporary environment and copy the variables we're
921 read_environment_file(&tmpenv
, &tmpenvsize
, "/etc/default/login",
922 options
.permit_user_env_allowlist
);
928 var
= child_get_env(tmpenv
, "SUPATH");
930 var
= child_get_env(tmpenv
, "PATH");
932 child_set_env(env
, envsize
, "PATH", var
);
934 if ((var
= child_get_env(tmpenv
, "UMASK")) != NULL
)
935 if (sscanf(var
, "%5lo", &mask
) == 1)
938 for (i
= 0; tmpenv
[i
] != NULL
; i
++)
942 #endif /* HAVE_ETC_DEFAULT_LOGIN */
944 #if defined(USE_PAM) || defined(HAVE_CYGWIN)
946 copy_environment_denylist(char **source
, char ***env
, u_int
*envsize
,
947 const char *denylist
)
949 char *var_name
, *var_val
;
955 for(i
= 0; source
[i
] != NULL
; i
++) {
956 var_name
= xstrdup(source
[i
]);
957 if ((var_val
= strstr(var_name
, "=")) == NULL
) {
963 if (denylist
== NULL
||
964 match_pattern_list(var_name
, denylist
, 0) != 1) {
965 debug3("Copy environment: %s=%s", var_name
, var_val
);
966 child_set_env(env
, envsize
, var_name
, var_val
);
972 #endif /* defined(USE_PAM) || defined(HAVE_CYGWIN) */
976 copy_environment(char **source
, char ***env
, u_int
*envsize
)
978 copy_environment_denylist(source
, env
, envsize
, NULL
);
983 do_setup_env(struct ssh
*ssh
, Session
*s
, const char *shell
)
988 char *ocp
, *cp
, *value
, **env
, *laddr
;
989 struct passwd
*pw
= s
->pw
;
990 #if !defined (HAVE_LOGIN_CAP) && !defined (HAVE_CYGWIN)
994 /* Initialize the environment. */
996 env
= xcalloc(envsize
, sizeof(char *));
1001 * The Windows environment contains some setting which are
1002 * important for a running system. They must not be dropped.
1007 p
= fetch_windows_environment();
1008 copy_environment(p
, &env
, &envsize
);
1009 free_windows_environment(p
);
1014 /* Allow any GSSAPI methods that we've used to alter
1015 * the child's environment as they see fit
1017 ssh_gssapi_do_child(&env
, &envsize
);
1020 /* Set basic environment. */
1021 for (i
= 0; i
< s
->num_env
; i
++)
1022 child_set_env(&env
, &envsize
, s
->env
[i
].name
, s
->env
[i
].val
);
1024 child_set_env(&env
, &envsize
, "USER", pw
->pw_name
);
1025 child_set_env(&env
, &envsize
, "LOGNAME", pw
->pw_name
);
1027 child_set_env(&env
, &envsize
, "LOGIN", pw
->pw_name
);
1029 child_set_env(&env
, &envsize
, "HOME", pw
->pw_dir
);
1030 #ifdef HAVE_LOGIN_CAP
1031 if (setusercontext(lc
, pw
, pw
->pw_uid
, LOGIN_SETPATH
) < 0)
1032 child_set_env(&env
, &envsize
, "PATH", _PATH_STDPATH
);
1034 child_set_env(&env
, &envsize
, "PATH", getenv("PATH"));
1035 #else /* HAVE_LOGIN_CAP */
1036 # ifndef HAVE_CYGWIN
1038 * There's no standard path on Windows. The path contains
1039 * important components pointing to the system directories,
1040 * needed for loading shared libraries. So the path better
1041 * remains intact here.
1043 # ifdef HAVE_ETC_DEFAULT_LOGIN
1044 read_etc_default_login(&env
, &envsize
, pw
->pw_uid
);
1045 path
= child_get_env(env
, "PATH");
1046 # endif /* HAVE_ETC_DEFAULT_LOGIN */
1047 if (path
== NULL
|| *path
== '\0') {
1048 child_set_env(&env
, &envsize
, "PATH",
1049 s
->pw
->pw_uid
== 0 ? SUPERUSER_PATH
: _PATH_STDPATH
);
1051 # endif /* HAVE_CYGWIN */
1052 #endif /* HAVE_LOGIN_CAP */
1054 if (!options
.use_pam
) {
1055 snprintf(buf
, sizeof buf
, "%.200s/%.50s",
1056 _PATH_MAILDIR
, pw
->pw_name
);
1057 child_set_env(&env
, &envsize
, "MAIL", buf
);
1060 /* Normal systems set SHELL by default. */
1061 child_set_env(&env
, &envsize
, "SHELL", shell
);
1064 child_set_env(&env
, &envsize
, "TZ", getenv("TZ"));
1066 child_set_env(&env
, &envsize
, "TERM", s
->term
);
1068 child_set_env(&env
, &envsize
, "DISPLAY", s
->display
);
1071 * Since we clear KRB5CCNAME at startup, if it's set now then it
1072 * must have been set by a native authentication method (eg AIX or
1073 * SIA), so copy it to the child.
1078 if ((cp
= getenv("KRB5CCNAME")) != NULL
)
1079 child_set_env(&env
, &envsize
, "KRB5CCNAME", cp
);
1086 if ((cp
= getenv("AUTHSTATE")) != NULL
)
1087 child_set_env(&env
, &envsize
, "AUTHSTATE", cp
);
1088 read_environment_file(&env
, &envsize
, "/etc/environment",
1089 options
.permit_user_env_allowlist
);
1093 if (s
->authctxt
->krb5_ccname
)
1094 child_set_env(&env
, &envsize
, "KRB5CCNAME",
1095 s
->authctxt
->krb5_ccname
);
1097 if (auth_sock_name
!= NULL
)
1098 child_set_env(&env
, &envsize
, SSH_AUTHSOCKET_ENV_NAME
,
1102 /* Set custom environment options from pubkey authentication. */
1103 if (options
.permit_user_env
) {
1104 for (n
= 0 ; n
< auth_opts
->nenv
; n
++) {
1105 ocp
= xstrdup(auth_opts
->env
[n
]);
1106 cp
= strchr(ocp
, '=');
1109 /* Apply PermitUserEnvironment allowlist */
1110 if (options
.permit_user_env_allowlist
== NULL
||
1111 match_pattern_list(ocp
,
1112 options
.permit_user_env_allowlist
, 0) == 1)
1113 child_set_env(&env
, &envsize
,
1120 /* read $HOME/.ssh/environment. */
1121 if (options
.permit_user_env
) {
1122 snprintf(buf
, sizeof buf
, "%.200s/%s/environment",
1123 pw
->pw_dir
, _PATH_SSH_USER_DIR
);
1124 read_environment_file(&env
, &envsize
, buf
,
1125 options
.permit_user_env_allowlist
);
1130 * Pull in any environment variables that may have
1133 if (options
.use_pam
) {
1137 * Don't allow PAM-internal env vars to leak
1138 * back into the session environment.
1140 #define PAM_ENV_DENYLIST "SSH_AUTH_INFO*,SSH_CONNECTION*"
1141 p
= fetch_pam_child_environment();
1142 copy_environment_denylist(p
, &env
, &envsize
,
1144 free_pam_environment(p
);
1146 p
= fetch_pam_environment();
1147 copy_environment_denylist(p
, &env
, &envsize
,
1149 free_pam_environment(p
);
1151 #endif /* USE_PAM */
1153 /* Environment specified by admin */
1154 for (i
= 0; i
< options
.num_setenv
; i
++) {
1155 cp
= xstrdup(options
.setenv
[i
]);
1156 if ((value
= strchr(cp
, '=')) == NULL
) {
1157 /* shouldn't happen; vars are checked in servconf.c */
1158 fatal("Invalid config SetEnv: %s", options
.setenv
[i
]);
1161 child_set_env(&env
, &envsize
, cp
, value
);
1164 /* SSH_CLIENT deprecated */
1165 snprintf(buf
, sizeof buf
, "%.50s %d %d",
1166 ssh_remote_ipaddr(ssh
), ssh_remote_port(ssh
),
1167 ssh_local_port(ssh
));
1168 child_set_env(&env
, &envsize
, "SSH_CLIENT", buf
);
1170 laddr
= get_local_ipaddr(ssh_packet_get_connection_in(ssh
));
1171 snprintf(buf
, sizeof buf
, "%.50s %d %.50s %d",
1172 ssh_remote_ipaddr(ssh
), ssh_remote_port(ssh
),
1173 laddr
, ssh_local_port(ssh
));
1175 child_set_env(&env
, &envsize
, "SSH_CONNECTION", buf
);
1177 if (tun_fwd_ifnames
!= NULL
)
1178 child_set_env(&env
, &envsize
, "SSH_TUNNEL", tun_fwd_ifnames
);
1179 if (auth_info_file
!= NULL
)
1180 child_set_env(&env
, &envsize
, "SSH_USER_AUTH", auth_info_file
);
1182 child_set_env(&env
, &envsize
, "SSH_TTY", s
->tty
);
1183 if (original_command
)
1184 child_set_env(&env
, &envsize
, "SSH_ORIGINAL_COMMAND",
1188 /* dump the environment */
1189 fprintf(stderr
, "Environment:\n");
1190 for (i
= 0; env
[i
]; i
++)
1191 fprintf(stderr
, " %.200s\n", env
[i
]);
1197 * Run $HOME/.ssh/rc, /etc/ssh/sshrc, or xauth (whichever is found
1198 * first in this order).
1201 do_rc_files(struct ssh
*ssh
, Session
*s
, const char *shell
)
1204 char *cmd
= NULL
, *user_rc
= NULL
;
1209 s
->display
!= NULL
&& s
->auth_proto
!= NULL
&& s
->auth_data
!= NULL
;
1210 xasprintf(&user_rc
, "%s/%s", s
->pw
->pw_dir
, _PATH_SSH_USER_RC
);
1212 /* ignore _PATH_SSH_USER_RC for subsystems and admin forced commands */
1213 if (!s
->is_subsystem
&& options
.adm_forced_command
== NULL
&&
1214 auth_opts
->permit_user_rc
&& options
.permit_user_rc
&&
1215 stat(user_rc
, &st
) >= 0) {
1216 if (xasprintf(&cmd
, "%s -c '%s %s'", shell
, _PATH_BSHELL
,
1218 fatal_f("xasprintf: %s", strerror(errno
));
1220 fprintf(stderr
, "Running %s\n", cmd
);
1221 f
= popen(cmd
, "w");
1224 fprintf(f
, "%s %s\n", s
->auth_proto
,
1228 fprintf(stderr
, "Could not run %s\n",
1230 } else if (stat(_PATH_SSH_SYSTEM_RC
, &st
) >= 0) {
1232 fprintf(stderr
, "Running %s %s\n", _PATH_BSHELL
,
1233 _PATH_SSH_SYSTEM_RC
);
1234 f
= popen(_PATH_BSHELL
" " _PATH_SSH_SYSTEM_RC
, "w");
1237 fprintf(f
, "%s %s\n", s
->auth_proto
,
1241 fprintf(stderr
, "Could not run %s\n",
1242 _PATH_SSH_SYSTEM_RC
);
1243 } else if (do_xauth
&& options
.xauth_location
!= NULL
) {
1244 /* Add authority data to .Xauthority if appropriate. */
1247 "Running %.500s remove %.100s\n",
1248 options
.xauth_location
, s
->auth_display
);
1250 "%.500s add %.100s %.100s %.100s\n",
1251 options
.xauth_location
, s
->auth_display
,
1252 s
->auth_proto
, s
->auth_data
);
1254 if (xasprintf(&cmd
, "%s -q -", options
.xauth_location
) == -1)
1255 fatal_f("xasprintf: %s", strerror(errno
));
1256 f
= popen(cmd
, "w");
1258 fprintf(f
, "remove %s\n",
1260 fprintf(f
, "add %s %s %s\n",
1261 s
->auth_display
, s
->auth_proto
,
1265 fprintf(stderr
, "Could not run %s\n",
1274 do_nologin(struct passwd
*pw
)
1277 char buf
[1024], *nl
, *def_nl
= _PATH_NOLOGIN
;
1280 #ifdef HAVE_LOGIN_CAP
1281 if (login_getcapbool(lc
, "ignorenologin", 0) || pw
->pw_uid
== 0)
1283 nl
= strdup(login_getcapstr(lc
, "nologin", def_nl
, def_nl
));
1285 if (pw
->pw_uid
== 0)
1289 if (stat(nl
, &sb
) == -1)
1292 /* /etc/nologin exists. Print its contents if we can and exit. */
1293 logit("User %.100s not allowed because %s exists", pw
->pw_name
, nl
);
1294 if ((f
= fopen(nl
, "r")) != NULL
) {
1295 while (fgets(buf
, sizeof(buf
), f
))
1303 * Chroot into a directory after checking it for safety: all path components
1304 * must be root-owned directories with strict permissions.
1307 safely_chroot(const char *path
, uid_t uid
)
1310 char component
[PATH_MAX
];
1313 if (!path_absolute(path
))
1314 fatal("chroot path does not begin at root");
1315 if (strlen(path
) >= sizeof(component
))
1316 fatal("chroot path too long");
1319 * Descend the path, checking that each component is a
1320 * root-owned directory with strict permissions.
1322 for (cp
= path
; cp
!= NULL
;) {
1323 if ((cp
= strchr(cp
, '/')) == NULL
)
1324 strlcpy(component
, path
, sizeof(component
));
1327 memcpy(component
, path
, cp
- path
);
1328 component
[cp
- path
] = '\0';
1331 debug3_f("checking '%s'", component
);
1333 if (stat(component
, &st
) != 0)
1334 fatal_f("stat(\"%s\"): %s",
1335 component
, strerror(errno
));
1336 if (st
.st_uid
!= 0 || (st
.st_mode
& 022) != 0)
1337 fatal("bad ownership or modes for chroot "
1338 "directory %s\"%s\"",
1339 cp
== NULL
? "" : "component ", component
);
1340 if (!S_ISDIR(st
.st_mode
))
1341 fatal("chroot path %s\"%s\" is not a directory",
1342 cp
== NULL
? "" : "component ", component
);
1346 if (chdir(path
) == -1)
1347 fatal("Unable to chdir to chroot path \"%s\": "
1348 "%s", path
, strerror(errno
));
1349 if (chroot(path
) == -1)
1350 fatal("chroot(\"%s\"): %s", path
, strerror(errno
));
1351 if (chdir("/") == -1)
1352 fatal_f("chdir(/) after chroot: %s", strerror(errno
));
1353 verbose("Changed root directory to \"%s\"", path
);
1356 /* Set login name, uid, gid, and groups. */
1358 do_setusercontext(struct passwd
*pw
)
1360 char uidstr
[32], *chroot_path
, *tmp
;
1362 platform_setusercontext(pw
);
1364 if (platform_privileged_uidswap()) {
1365 #ifdef HAVE_LOGIN_CAP
1366 if (setusercontext(lc
, pw
, pw
->pw_uid
,
1367 (LOGIN_SETALL
& ~(LOGIN_SETPATH
|LOGIN_SETUSER
))) < 0) {
1368 perror("unable to set user context");
1372 if (setlogin(pw
->pw_name
) < 0)
1373 error("setlogin failed: %s", strerror(errno
));
1374 if (setgid(pw
->pw_gid
) < 0) {
1378 /* Initialize the group list. */
1379 if (initgroups(pw
->pw_name
, pw
->pw_gid
) < 0) {
1380 perror("initgroups");
1386 platform_setusercontext_post_groups(pw
);
1388 if (!in_chroot
&& options
.chroot_directory
!= NULL
&&
1389 strcasecmp(options
.chroot_directory
, "none") != 0) {
1390 tmp
= tilde_expand_filename(options
.chroot_directory
,
1392 snprintf(uidstr
, sizeof(uidstr
), "%llu",
1393 (unsigned long long)pw
->pw_uid
);
1394 chroot_path
= percent_expand(tmp
, "h", pw
->pw_dir
,
1395 "u", pw
->pw_name
, "U", uidstr
, (char *)NULL
);
1396 safely_chroot(chroot_path
, pw
->pw_uid
);
1399 /* Make sure we don't attempt to chroot again */
1400 free(options
.chroot_directory
);
1401 options
.chroot_directory
= NULL
;
1405 #ifdef HAVE_LOGIN_CAP
1406 if (setusercontext(lc
, pw
, pw
->pw_uid
, LOGIN_SETUSER
) < 0) {
1407 perror("unable to set user context (setuser)");
1411 * FreeBSD's setusercontext() will not apply the user's
1412 * own umask setting unless running with the user's UID.
1414 (void) setusercontext(lc
, pw
, pw
->pw_uid
, LOGIN_SETUMASK
);
1418 * In a chroot environment, the set_id() will always fail;
1419 * typically because of the lack of necessary authentication
1420 * services and runtime such as ./usr/lib/libiaf.so,
1421 * ./usr/lib/libpam.so.1, and ./etc/passwd We skip it in the
1422 * internal sftp chroot case. We'll lose auditing and ACLs but
1423 * permanently_set_uid will take care of the rest.
1425 if (!in_chroot
&& set_id(pw
->pw_name
) != 0)
1426 fatal("set_id(%s) Failed", pw
->pw_name
);
1427 # endif /* USE_LIBIAF */
1428 /* Permanently switch to the desired uid. */
1429 permanently_set_uid(pw
);
1431 } else if (options
.chroot_directory
!= NULL
&&
1432 strcasecmp(options
.chroot_directory
, "none") != 0) {
1433 fatal("server lacks privileges to chroot to ChrootDirectory");
1436 if (getuid() != pw
->pw_uid
|| geteuid() != pw
->pw_uid
)
1437 fatal("Failed to set uids to %u.", (u_int
) pw
->pw_uid
);
1441 do_pwchange(Session
*s
)
1444 fprintf(stderr
, "WARNING: Your password has expired.\n");
1445 if (s
->ttyfd
!= -1) {
1447 "You must change your password now and login again!\n");
1451 #ifdef PASSWD_NEEDS_USERNAME
1452 execl(_PATH_PASSWD_PROG
, "passwd", s
->pw
->pw_name
,
1455 execl(_PATH_PASSWD_PROG
, "passwd", (char *)NULL
);
1460 "Password change required but no TTY available.\n");
1466 child_close_fds(struct ssh
*ssh
)
1468 extern int auth_sock
;
1470 if (auth_sock
!= -1) {
1475 if (ssh_packet_get_connection_in(ssh
) ==
1476 ssh_packet_get_connection_out(ssh
))
1477 close(ssh_packet_get_connection_in(ssh
));
1479 close(ssh_packet_get_connection_in(ssh
));
1480 close(ssh_packet_get_connection_out(ssh
));
1483 * Close all descriptors related to channels. They will still remain
1484 * open in the parent.
1486 /* XXX better use close-on-exec? -markus */
1487 channel_close_all(ssh
);
1490 * Close any extra file descriptors. Note that there may still be
1491 * descriptors left by system functions. They will be closed later.
1495 /* Stop directing logs to a high-numbered fd before we close it */
1496 log_redirect_stderr_to(NULL
);
1499 * Close any extra open file descriptors so that we don't have them
1500 * hanging around in clients. Note that we want to do this after
1501 * initgroups, because at least on Solaris 2.3 it leaves file
1504 closefrom(STDERR_FILENO
+ 1);
1508 * Performs common processing for the child, such as setting up the
1509 * environment, closing extra file descriptors, setting the user and group
1510 * ids, and executing the command or shell.
1514 do_child(struct ssh
*ssh
, Session
*s
, const char *command
)
1516 extern char **environ
;
1517 char **env
, *argv
[ARGV_MAX
], remote_id
[512];
1518 const char *shell
, *shell0
;
1519 struct passwd
*pw
= s
->pw
;
1522 sshpkt_fmt_connection_id(ssh
, remote_id
, sizeof(remote_id
));
1524 /* remove hostkey from the child's memory */
1525 destroy_sensitive_data();
1526 ssh_packet_clear_keys(ssh
);
1528 /* Force a password change */
1529 if (s
->authctxt
->force_pwchange
) {
1530 do_setusercontext(pw
);
1531 child_close_fds(ssh
);
1537 * Login(1) does this as well, and it needs uid 0 for the "-h"
1538 * switch, so we let login(1) to this for us.
1541 session_setup_sia(pw
, s
->ttyfd
== -1 ? NULL
: s
->tty
);
1542 if (!check_quietlogin(s
, command
))
1544 #else /* HAVE_OSF_SIA */
1545 /* When PAM is enabled we rely on it to do the nologin check */
1546 if (!options
.use_pam
)
1548 do_setusercontext(pw
);
1550 * PAM session modules in do_setusercontext may have
1551 * generated messages, so if this in an interactive
1552 * login then display them too.
1554 if (!check_quietlogin(s
, command
))
1556 #endif /* HAVE_OSF_SIA */
1559 if (options
.use_pam
&& !is_pam_session_open()) {
1560 debug3("PAM session not opened, exiting");
1567 * Get the shell from the password data. An empty shell field is
1568 * legal, and means /bin/sh.
1570 shell
= (pw
->pw_shell
[0] == '\0') ? _PATH_BSHELL
: pw
->pw_shell
;
1573 * Make sure $SHELL points to the shell from the password file,
1574 * even if shell is overridden from login.conf
1576 env
= do_setup_env(ssh
, s
, shell
);
1578 #ifdef HAVE_LOGIN_CAP
1579 shell
= login_getcapstr(lc
, "shell", (char *)shell
, (char *)shell
);
1583 * Close the connection descriptors; note that this is the child, and
1584 * the server will still have the socket open, and it is important
1585 * that we do not shutdown it. Note that the descriptors cannot be
1586 * closed before building the environment, as we call
1587 * ssh_remote_ipaddr there.
1589 child_close_fds(ssh
);
1592 * Must take new environment into use so that .ssh/rc,
1593 * /etc/ssh/sshrc and xauth are run in the proper environment.
1597 #if defined(KRB5) && defined(USE_AFS)
1599 * At this point, we check to see if AFS is active and if we have
1600 * a valid Kerberos 5 TGT. If so, it seems like a good idea to see
1601 * if we can (and need to) extend the ticket into an AFS token. If
1602 * we don't do this, we run into potential problems if the user's
1603 * home directory is in AFS and it's not world-readable.
1606 if (options
.kerberos_get_afs_token
&& k_hasafs() &&
1607 (s
->authctxt
->krb5_ctx
!= NULL
)) {
1610 debug("Getting AFS token");
1614 if (k_afs_cell_of_file(pw
->pw_dir
, cell
, sizeof(cell
)) == 0)
1615 krb5_afslog(s
->authctxt
->krb5_ctx
,
1616 s
->authctxt
->krb5_fwd_ccache
, cell
, NULL
);
1618 krb5_afslog_home(s
->authctxt
->krb5_ctx
,
1619 s
->authctxt
->krb5_fwd_ccache
, NULL
, NULL
, pw
->pw_dir
);
1623 /* Change current directory to the user's home directory. */
1624 if (chdir(pw
->pw_dir
) == -1) {
1625 /* Suppress missing homedir warning for chroot case */
1626 #ifdef HAVE_LOGIN_CAP
1627 r
= login_getcapbool(lc
, "requirehome", 0);
1629 if (r
|| !in_chroot
) {
1630 fprintf(stderr
, "Could not chdir to home "
1631 "directory %s: %s\n", pw
->pw_dir
,
1638 closefrom(STDERR_FILENO
+ 1);
1640 do_rc_files(ssh
, s
, shell
);
1642 /* restore SIGPIPE for child */
1643 ssh_signal(SIGPIPE
, SIG_DFL
);
1645 if (s
->is_subsystem
== SUBSYSTEM_INT_SFTP_ERROR
) {
1646 error("Connection from %s: refusing non-sftp session",
1648 printf("This service allows sftp connections only.\n");
1651 } else if (s
->is_subsystem
== SUBSYSTEM_INT_SFTP
) {
1652 extern int optind
, optreset
;
1656 setproctitle("%s@%s", s
->pw
->pw_name
, INTERNAL_SFTP_NAME
);
1657 args
= xstrdup(command
? command
: "sftp-server");
1658 for (i
= 0, (p
= strtok(args
, " ")); p
; (p
= strtok(NULL
, " ")))
1659 if (i
< ARGV_MAX
- 1)
1662 optind
= optreset
= 1;
1663 __progname
= argv
[0];
1665 ssh_selinux_change_context("sftpd_t");
1667 exit(sftp_server_main(i
, argv
, s
->pw
));
1672 /* Get the last component of the shell name. */
1673 if ((shell0
= strrchr(shell
, '/')) != NULL
)
1679 * If we have no command, execute the shell. In this case, the shell
1680 * name to be passed in argv[0] is preceded by '-' to indicate that
1681 * this is a login shell.
1686 /* Start the shell. Set initial character to '-'. */
1689 if (strlcpy(argv0
+ 1, shell0
, sizeof(argv0
) - 1)
1690 >= sizeof(argv0
) - 1) {
1696 /* Execute the shell. */
1699 execve(shell
, argv
, env
);
1701 /* Executing the shell failed. */
1706 * Execute the command using the user's shell. This uses the -c
1707 * option to execute the command.
1709 argv
[0] = (char *) shell0
;
1711 argv
[2] = (char *) command
;
1713 execve(shell
, argv
, env
);
1719 session_unused(int id
)
1721 debug3_f("session id %d unused", id
);
1722 if (id
>= options
.max_sessions
||
1723 id
>= sessions_nalloc
) {
1724 fatal_f("insane session id %d (max %d nalloc %d)",
1725 id
, options
.max_sessions
, sessions_nalloc
);
1727 memset(&sessions
[id
], 0, sizeof(*sessions
));
1728 sessions
[id
].self
= id
;
1729 sessions
[id
].used
= 0;
1730 sessions
[id
].chanid
= -1;
1731 sessions
[id
].ptyfd
= -1;
1732 sessions
[id
].ttyfd
= -1;
1733 sessions
[id
].ptymaster
= -1;
1734 sessions
[id
].x11_chanids
= NULL
;
1735 sessions
[id
].next_unused
= sessions_first_unused
;
1736 sessions_first_unused
= id
;
1744 if (sessions_first_unused
== -1) {
1745 if (sessions_nalloc
>= options
.max_sessions
)
1747 debug2_f("allocate (allocated %d max %d)",
1748 sessions_nalloc
, options
.max_sessions
);
1749 tmp
= xrecallocarray(sessions
, sessions_nalloc
,
1750 sessions_nalloc
+ 1, sizeof(*sessions
));
1752 error_f("cannot allocate %d sessions",
1753 sessions_nalloc
+ 1);
1757 session_unused(sessions_nalloc
++);
1760 if (sessions_first_unused
>= sessions_nalloc
||
1761 sessions_first_unused
< 0) {
1762 fatal_f("insane first_unused %d max %d nalloc %d",
1763 sessions_first_unused
, options
.max_sessions
,
1767 s
= &sessions
[sessions_first_unused
];
1769 fatal_f("session %d already used", sessions_first_unused
);
1770 sessions_first_unused
= s
->next_unused
;
1772 s
->next_unused
= -1;
1773 debug("session_new: session %d", s
->self
);
1782 for (i
= 0; i
< sessions_nalloc
; i
++) {
1783 Session
*s
= &sessions
[i
];
1785 debug("dump: used %d next_unused %d session %d "
1786 "channel %d pid %ld",
1796 session_open(Authctxt
*authctxt
, int chanid
)
1798 Session
*s
= session_new();
1799 debug("session_open: channel %d", chanid
);
1801 error("no more sessions");
1804 s
->authctxt
= authctxt
;
1805 s
->pw
= authctxt
->pw
;
1806 if (s
->pw
== NULL
|| !authctxt
->valid
)
1807 fatal("no user for session %d", s
->self
);
1808 debug("session_open: session %d: link with channel %d", s
->self
, chanid
);
1814 session_by_tty(char *tty
)
1817 for (i
= 0; i
< sessions_nalloc
; i
++) {
1818 Session
*s
= &sessions
[i
];
1819 if (s
->used
&& s
->ttyfd
!= -1 && strcmp(s
->tty
, tty
) == 0) {
1820 debug("session_by_tty: session %d tty %s", i
, tty
);
1824 debug("session_by_tty: unknown tty %.100s", tty
);
1830 session_by_channel(int id
)
1833 for (i
= 0; i
< sessions_nalloc
; i
++) {
1834 Session
*s
= &sessions
[i
];
1835 if (s
->used
&& s
->chanid
== id
) {
1836 debug("session_by_channel: session %d channel %d",
1841 debug("session_by_channel: unknown channel %d", id
);
1847 session_by_x11_channel(int id
)
1851 for (i
= 0; i
< sessions_nalloc
; i
++) {
1852 Session
*s
= &sessions
[i
];
1854 if (s
->x11_chanids
== NULL
|| !s
->used
)
1856 for (j
= 0; s
->x11_chanids
[j
] != -1; j
++) {
1857 if (s
->x11_chanids
[j
] == id
) {
1858 debug("session_by_x11_channel: session %d "
1859 "channel %d", s
->self
, id
);
1864 debug("session_by_x11_channel: unknown channel %d", id
);
1870 session_by_pid(pid_t pid
)
1873 debug("session_by_pid: pid %ld", (long)pid
);
1874 for (i
= 0; i
< sessions_nalloc
; i
++) {
1875 Session
*s
= &sessions
[i
];
1876 if (s
->used
&& s
->pid
== pid
)
1879 error("session_by_pid: unknown pid %ld", (long)pid
);
1885 session_window_change_req(struct ssh
*ssh
, Session
*s
)
1889 if ((r
= sshpkt_get_u32(ssh
, &s
->col
)) != 0 ||
1890 (r
= sshpkt_get_u32(ssh
, &s
->row
)) != 0 ||
1891 (r
= sshpkt_get_u32(ssh
, &s
->xpixel
)) != 0 ||
1892 (r
= sshpkt_get_u32(ssh
, &s
->ypixel
)) != 0 ||
1893 (r
= sshpkt_get_end(ssh
)) != 0)
1894 sshpkt_fatal(ssh
, r
, "%s: parse packet", __func__
);
1895 pty_change_window_size(s
->ptyfd
, s
->row
, s
->col
, s
->xpixel
, s
->ypixel
);
1900 session_pty_req(struct ssh
*ssh
, Session
*s
)
1904 if (!auth_opts
->permit_pty_flag
|| !options
.permit_tty
) {
1905 debug("Allocating a pty not permitted for this connection.");
1908 if (s
->ttyfd
!= -1) {
1909 ssh_packet_disconnect(ssh
, "Protocol error: you already have a pty.");
1913 if ((r
= sshpkt_get_cstring(ssh
, &s
->term
, NULL
)) != 0 ||
1914 (r
= sshpkt_get_u32(ssh
, &s
->col
)) != 0 ||
1915 (r
= sshpkt_get_u32(ssh
, &s
->row
)) != 0 ||
1916 (r
= sshpkt_get_u32(ssh
, &s
->xpixel
)) != 0 ||
1917 (r
= sshpkt_get_u32(ssh
, &s
->ypixel
)) != 0)
1918 sshpkt_fatal(ssh
, r
, "%s: parse packet", __func__
);
1920 if (strcmp(s
->term
, "") == 0) {
1925 /* Allocate a pty and open it. */
1926 debug("Allocating pty.");
1927 if (!PRIVSEP(pty_allocate(&s
->ptyfd
, &s
->ttyfd
, s
->tty
,
1933 error("session_pty_req: session %d alloc failed", s
->self
);
1936 debug("session_pty_req: session %d alloc %s", s
->self
, s
->tty
);
1938 ssh_tty_parse_modes(ssh
, s
->ttyfd
);
1940 if ((r
= sshpkt_get_end(ssh
)) != 0)
1941 sshpkt_fatal(ssh
, r
, "%s: parse packet", __func__
);
1944 pty_setowner(s
->pw
, s
->tty
);
1946 /* Set window size from the packet. */
1947 pty_change_window_size(s
->ptyfd
, s
->row
, s
->col
, s
->xpixel
, s
->ypixel
);
1949 session_proctitle(s
);
1954 session_subsystem_req(struct ssh
*ssh
, Session
*s
)
1961 if ((r
= sshpkt_get_cstring(ssh
, &s
->subsys
, NULL
)) != 0 ||
1962 (r
= sshpkt_get_end(ssh
)) != 0)
1963 sshpkt_fatal(ssh
, r
, "%s: parse packet", __func__
);
1964 debug2("subsystem request for %.100s by user %s", s
->subsys
,
1967 for (i
= 0; i
< options
.num_subsystems
; i
++) {
1968 if (strcmp(s
->subsys
, options
.subsystem_name
[i
]) == 0) {
1969 prog
= options
.subsystem_command
[i
];
1970 cmd
= options
.subsystem_args
[i
];
1971 if (strcmp(INTERNAL_SFTP_NAME
, prog
) == 0) {
1972 s
->is_subsystem
= SUBSYSTEM_INT_SFTP
;
1973 debug("subsystem: %s", prog
);
1975 if (stat(prog
, &st
) == -1)
1976 debug("subsystem: cannot stat %s: %s",
1977 prog
, strerror(errno
));
1978 s
->is_subsystem
= SUBSYSTEM_EXT
;
1979 debug("subsystem: exec() %s", cmd
);
1981 success
= do_exec(ssh
, s
, cmd
) == 0;
1987 logit("subsystem request for %.100s by user %s failed, "
1988 "subsystem not found", s
->subsys
, s
->pw
->pw_name
);
1994 session_x11_req(struct ssh
*ssh
, Session
*s
)
1997 u_char single_connection
= 0;
1999 if (s
->auth_proto
!= NULL
|| s
->auth_data
!= NULL
) {
2000 error("session_x11_req: session %d: "
2001 "x11 forwarding already active", s
->self
);
2004 if ((r
= sshpkt_get_u8(ssh
, &single_connection
)) != 0 ||
2005 (r
= sshpkt_get_cstring(ssh
, &s
->auth_proto
, NULL
)) != 0 ||
2006 (r
= sshpkt_get_cstring(ssh
, &s
->auth_data
, NULL
)) != 0 ||
2007 (r
= sshpkt_get_u32(ssh
, &s
->screen
)) != 0 ||
2008 (r
= sshpkt_get_end(ssh
)) != 0)
2009 sshpkt_fatal(ssh
, r
, "%s: parse packet", __func__
);
2011 s
->single_connection
= single_connection
;
2013 if (xauth_valid_string(s
->auth_proto
) &&
2014 xauth_valid_string(s
->auth_data
))
2015 success
= session_setup_x11fwd(ssh
, s
);
2018 error("Invalid X11 forwarding data");
2021 free(s
->auth_proto
);
2023 s
->auth_proto
= NULL
;
2024 s
->auth_data
= NULL
;
2030 session_shell_req(struct ssh
*ssh
, Session
*s
)
2034 if ((r
= sshpkt_get_end(ssh
)) != 0)
2035 sshpkt_fatal(ssh
, r
, "%s: parse packet", __func__
);
2036 return do_exec(ssh
, s
, NULL
) == 0;
2040 session_exec_req(struct ssh
*ssh
, Session
*s
)
2044 char *command
= NULL
;
2046 if ((r
= sshpkt_get_cstring(ssh
, &command
, NULL
)) != 0 ||
2047 (r
= sshpkt_get_end(ssh
)) != 0)
2048 sshpkt_fatal(ssh
, r
, "%s: parse packet", __func__
);
2050 success
= do_exec(ssh
, s
, command
) == 0;
2056 session_break_req(struct ssh
*ssh
, Session
*s
)
2060 if ((r
= sshpkt_get_u32(ssh
, NULL
)) != 0 || /* ignore */
2061 (r
= sshpkt_get_end(ssh
)) != 0)
2062 sshpkt_fatal(ssh
, r
, "%s: parse packet", __func__
);
2064 if (s
->ptymaster
== -1 || tcsendbreak(s
->ptymaster
, 0) == -1)
2070 session_env_req(struct ssh
*ssh
, Session
*s
)
2076 if ((r
= sshpkt_get_cstring(ssh
, &name
, NULL
)) != 0 ||
2077 (r
= sshpkt_get_cstring(ssh
, &val
, NULL
)) != 0 ||
2078 (r
= sshpkt_get_end(ssh
)) != 0)
2079 sshpkt_fatal(ssh
, r
, "%s: parse packet", __func__
);
2081 /* Don't set too many environment variables */
2082 if (s
->num_env
> 128) {
2083 debug2("Ignoring env request %s: too many env vars", name
);
2087 for (i
= 0; i
< options
.num_accept_env
; i
++) {
2088 if (match_pattern(name
, options
.accept_env
[i
])) {
2089 debug2("Setting env %d: %s=%s", s
->num_env
, name
, val
);
2090 s
->env
= xrecallocarray(s
->env
, s
->num_env
,
2091 s
->num_env
+ 1, sizeof(*s
->env
));
2092 s
->env
[s
->num_env
].name
= name
;
2093 s
->env
[s
->num_env
].val
= val
;
2098 debug2("Ignoring env request %s: disallowed name", name
);
2107 * Conversion of signals from ssh channel request names.
2108 * Subset of signals from RFC 4254 section 6.10C, with SIGINFO as
2112 name2sig(char *name
)
2114 #define SSH_SIG(x) if (strcmp(name, #x) == 0) return SIG ## x
2124 if (strcmp(name
, "INFO@openssh.com") == 0)
2131 session_signal_req(struct ssh
*ssh
, Session
*s
)
2133 char *signame
= NULL
;
2134 int r
, sig
, success
= 0;
2136 if ((r
= sshpkt_get_cstring(ssh
, &signame
, NULL
)) != 0 ||
2137 (r
= sshpkt_get_end(ssh
)) != 0) {
2138 error_fr(r
, "parse");
2141 if ((sig
= name2sig(signame
)) == -1) {
2142 error_f("unsupported signal \"%s\"", signame
);
2146 error_f("no pid for session %d", s
->self
);
2149 if (s
->forced
|| s
->is_subsystem
) {
2150 error_f("refusing to send signal %s to %s session",
2151 signame
, s
->forced
? "forced-command" : "subsystem");
2154 if (!use_privsep
|| mm_is_monitor()) {
2155 error_f("session signalling requires privilege separation");
2159 debug_f("signal %s, killpg(%ld, %d)", signame
, (long)s
->pid
, sig
);
2160 temporarily_use_uid(s
->pw
);
2161 r
= killpg(s
->pid
, sig
);
2164 error_f("killpg(%ld, %d): %s", (long)s
->pid
,
2165 sig
, strerror(errno
));
2177 session_auth_agent_req(struct ssh
*ssh
, Session
*s
)
2179 static int called
= 0;
2182 if ((r
= sshpkt_get_end(ssh
)) != 0)
2183 sshpkt_fatal(ssh
, r
, "%s: parse packet", __func__
);
2184 if (!auth_opts
->permit_agent_forwarding_flag
||
2185 !options
.allow_agent_forwarding
) {
2186 debug_f("agent forwarding disabled");
2193 return auth_input_request_forwarding(ssh
, s
->pw
);
2198 session_input_channel_req(struct ssh
*ssh
, Channel
*c
, const char *rtype
)
2203 if ((s
= session_by_channel(c
->self
)) == NULL
) {
2204 logit_f("no session %d req %.100s", c
->self
, rtype
);
2207 debug_f("session %d req %s", s
->self
, rtype
);
2210 * a session is in LARVAL state until a shell, a command
2211 * or a subsystem is executed
2213 if (c
->type
== SSH_CHANNEL_LARVAL
) {
2214 if (strcmp(rtype
, "shell") == 0) {
2215 success
= session_shell_req(ssh
, s
);
2216 } else if (strcmp(rtype
, "exec") == 0) {
2217 success
= session_exec_req(ssh
, s
);
2218 } else if (strcmp(rtype
, "pty-req") == 0) {
2219 success
= session_pty_req(ssh
, s
);
2220 } else if (strcmp(rtype
, "x11-req") == 0) {
2221 success
= session_x11_req(ssh
, s
);
2222 } else if (strcmp(rtype
, "auth-agent-req@openssh.com") == 0) {
2223 success
= session_auth_agent_req(ssh
, s
);
2224 } else if (strcmp(rtype
, "subsystem") == 0) {
2225 success
= session_subsystem_req(ssh
, s
);
2226 } else if (strcmp(rtype
, "env") == 0) {
2227 success
= session_env_req(ssh
, s
);
2230 if (strcmp(rtype
, "window-change") == 0) {
2231 success
= session_window_change_req(ssh
, s
);
2232 } else if (strcmp(rtype
, "break") == 0) {
2233 success
= session_break_req(ssh
, s
);
2234 } else if (strcmp(rtype
, "signal") == 0) {
2235 success
= session_signal_req(ssh
, s
);
2242 session_set_fds(struct ssh
*ssh
, Session
*s
,
2243 int fdin
, int fdout
, int fderr
, int ignore_fderr
, int is_tty
)
2246 * now that have a child and a pipe to the child,
2247 * we can activate our channel and register the fd's
2249 if (s
->chanid
== -1)
2250 fatal("no channel for session %d", s
->self
);
2251 channel_set_fds(ssh
, s
->chanid
,
2253 ignore_fderr
? CHAN_EXTENDED_IGNORE
: CHAN_EXTENDED_READ
,
2254 1, is_tty
, CHAN_SES_WINDOW_DEFAULT
);
2258 * Function to perform pty cleanup. Also called if we get aborted abnormally
2259 * (e.g., due to a dropped connection).
2262 session_pty_cleanup2(Session
*s
)
2265 error_f("no session");
2271 debug_f("session %d release %s", s
->self
, s
->tty
);
2273 /* Record that the user has logged out. */
2275 record_logout(s
->pid
, s
->tty
, s
->pw
->pw_name
);
2277 /* Release the pseudo-tty. */
2279 pty_release(s
->tty
);
2282 * Close the server side of the socket pairs. We must do this after
2283 * the pty cleanup, so that another process doesn't get this pty
2284 * while we're still cleaning up.
2286 if (s
->ptymaster
!= -1 && close(s
->ptymaster
) == -1)
2287 error("close(s->ptymaster/%d): %s",
2288 s
->ptymaster
, strerror(errno
));
2290 /* unlink pty from session */
2295 session_pty_cleanup(Session
*s
)
2297 PRIVSEP(session_pty_cleanup2(s
));
2303 #define SSH_SIG(x) if (sig == SIG ## x) return #x
2318 return "SIG@openssh.com";
2322 session_close_x11(struct ssh
*ssh
, int id
)
2326 if ((c
= channel_by_id(ssh
, id
)) == NULL
) {
2327 debug_f("x11 channel %d missing", id
);
2329 /* Detach X11 listener */
2330 debug_f("detach x11 channel %d", id
);
2331 channel_cancel_cleanup(ssh
, id
);
2332 if (c
->ostate
!= CHAN_OUTPUT_CLOSED
)
2333 chan_mark_dead(ssh
, c
);
2338 session_close_single_x11(struct ssh
*ssh
, int id
, void *arg
)
2343 debug3_f("channel %d", id
);
2344 channel_cancel_cleanup(ssh
, id
);
2345 if ((s
= session_by_x11_channel(id
)) == NULL
)
2346 fatal_f("no x11 channel %d", id
);
2347 for (i
= 0; s
->x11_chanids
[i
] != -1; i
++) {
2348 debug_f("session %d: closing channel %d",
2349 s
->self
, s
->x11_chanids
[i
]);
2351 * The channel "id" is already closing, but make sure we
2352 * close all of its siblings.
2354 if (s
->x11_chanids
[i
] != id
)
2355 session_close_x11(ssh
, s
->x11_chanids
[i
]);
2357 free(s
->x11_chanids
);
2358 s
->x11_chanids
= NULL
;
2361 free(s
->auth_proto
);
2362 s
->auth_proto
= NULL
;
2364 s
->auth_data
= NULL
;
2365 free(s
->auth_display
);
2366 s
->auth_display
= NULL
;
2370 session_exit_message(struct ssh
*ssh
, Session
*s
, int status
)
2375 if ((c
= channel_lookup(ssh
, s
->chanid
)) == NULL
)
2376 fatal_f("session %d: no channel %d", s
->self
, s
->chanid
);
2377 debug_f("session %d channel %d pid %ld",
2378 s
->self
, s
->chanid
, (long)s
->pid
);
2380 if (WIFEXITED(status
)) {
2381 channel_request_start(ssh
, s
->chanid
, "exit-status", 0);
2382 if ((r
= sshpkt_put_u32(ssh
, WEXITSTATUS(status
))) != 0 ||
2383 (r
= sshpkt_send(ssh
)) != 0)
2384 sshpkt_fatal(ssh
, r
, "%s: exit reply", __func__
);
2385 } else if (WIFSIGNALED(status
)) {
2386 channel_request_start(ssh
, s
->chanid
, "exit-signal", 0);
2388 # define WCOREDUMP(x) (0)
2390 if ((r
= sshpkt_put_cstring(ssh
, sig2name(WTERMSIG(status
)))) != 0 ||
2391 (r
= sshpkt_put_u8(ssh
, WCOREDUMP(status
)? 1 : 0)) != 0 ||
2392 (r
= sshpkt_put_cstring(ssh
, "")) != 0 ||
2393 (r
= sshpkt_put_cstring(ssh
, "")) != 0 ||
2394 (r
= sshpkt_send(ssh
)) != 0)
2395 sshpkt_fatal(ssh
, r
, "%s: exit reply", __func__
);
2397 /* Some weird exit cause. Just exit. */
2398 ssh_packet_disconnect(ssh
, "wait returned status %04x.", status
);
2401 /* disconnect channel */
2402 debug_f("release channel %d", s
->chanid
);
2405 * Adjust cleanup callback attachment to send close messages when
2406 * the channel gets EOF. The session will be then be closed
2407 * by session_close_by_channel when the child sessions close their fds.
2409 channel_register_cleanup(ssh
, c
->self
, session_close_by_channel
, 1);
2412 * emulate a write failure with 'chan_write_failed', nobody will be
2413 * interested in data we write.
2414 * Note that we must not call 'chan_read_failed', since there could
2415 * be some more data waiting in the pipe.
2417 if (c
->ostate
!= CHAN_OUTPUT_CLOSED
)
2418 chan_write_failed(ssh
, c
);
2422 session_close(struct ssh
*ssh
, Session
*s
)
2426 verbose("Close session: user %s from %.200s port %d id %d",
2428 ssh_remote_ipaddr(ssh
),
2429 ssh_remote_port(ssh
),
2433 session_pty_cleanup(s
);
2436 free(s
->x11_chanids
);
2437 free(s
->auth_display
);
2439 free(s
->auth_proto
);
2441 if (s
->env
!= NULL
) {
2442 for (i
= 0; i
< s
->num_env
; i
++) {
2443 free(s
->env
[i
].name
);
2444 free(s
->env
[i
].val
);
2448 session_proctitle(s
);
2449 session_unused(s
->self
);
2453 session_close_by_pid(struct ssh
*ssh
, pid_t pid
, int status
)
2455 Session
*s
= session_by_pid(pid
);
2457 debug_f("no session for pid %ld", (long)pid
);
2460 if (s
->chanid
!= -1)
2461 session_exit_message(ssh
, s
, status
);
2463 session_pty_cleanup(s
);
2468 * this is called when a channel dies before
2469 * the session 'child' itself dies
2472 session_close_by_channel(struct ssh
*ssh
, int id
, void *arg
)
2474 Session
*s
= session_by_channel(id
);
2478 debug_f("no session for id %d", id
);
2481 debug_f("channel %d child %ld", id
, (long)s
->pid
);
2483 debug_f("channel %d: has child, ttyfd %d", id
, s
->ttyfd
);
2485 * delay detach of session, but release pty, since
2486 * the fd's to the child are already closed
2489 session_pty_cleanup(s
);
2492 /* detach by removing callback */
2493 channel_cancel_cleanup(ssh
, s
->chanid
);
2495 /* Close any X11 listeners associated with this session */
2496 if (s
->x11_chanids
!= NULL
) {
2497 for (i
= 0; s
->x11_chanids
[i
] != -1; i
++) {
2498 session_close_x11(ssh
, s
->x11_chanids
[i
]);
2499 s
->x11_chanids
[i
] = -1;
2504 session_close(ssh
, s
);
2508 session_destroy_all(struct ssh
*ssh
, void (*closefunc
)(Session
*))
2511 for (i
= 0; i
< sessions_nalloc
; i
++) {
2512 Session
*s
= &sessions
[i
];
2514 if (closefunc
!= NULL
)
2517 session_close(ssh
, s
);
2523 session_tty_list(void)
2525 static char buf
[1024];
2530 for (i
= 0; i
< sessions_nalloc
; i
++) {
2531 Session
*s
= &sessions
[i
];
2532 if (s
->used
&& s
->ttyfd
!= -1) {
2534 if (strncmp(s
->tty
, "/dev/", 5) != 0) {
2535 cp
= strrchr(s
->tty
, '/');
2536 cp
= (cp
== NULL
) ? s
->tty
: cp
+ 1;
2541 strlcat(buf
, ",", sizeof buf
);
2542 strlcat(buf
, cp
, sizeof buf
);
2546 strlcpy(buf
, "notty", sizeof buf
);
2551 session_proctitle(Session
*s
)
2554 error("no user for session %d", s
->self
);
2556 setproctitle("%s@%s", s
->pw
->pw_name
, session_tty_list());
2560 session_setup_x11fwd(struct ssh
*ssh
, Session
*s
)
2563 char display
[512], auth_display
[512];
2564 char hostname
[NI_MAXHOST
];
2567 if (!auth_opts
->permit_x11_forwarding_flag
) {
2568 ssh_packet_send_debug(ssh
, "X11 forwarding disabled by key options.");
2571 if (!options
.x11_forwarding
) {
2572 debug("X11 forwarding disabled in server configuration file.");
2575 if (options
.xauth_location
== NULL
||
2576 (stat(options
.xauth_location
, &st
) == -1)) {
2577 ssh_packet_send_debug(ssh
, "No xauth program; cannot forward X11.");
2580 if (s
->display
!= NULL
) {
2581 debug("X11 display already set.");
2584 if (x11_create_display_inet(ssh
, options
.x11_display_offset
,
2585 options
.x11_use_localhost
, s
->single_connection
,
2586 &s
->display_number
, &s
->x11_chanids
) == -1) {
2587 debug("x11_create_display_inet failed.");
2590 for (i
= 0; s
->x11_chanids
[i
] != -1; i
++) {
2591 channel_register_cleanup(ssh
, s
->x11_chanids
[i
],
2592 session_close_single_x11
, 0);
2595 /* Set up a suitable value for the DISPLAY variable. */
2596 if (gethostname(hostname
, sizeof(hostname
)) == -1)
2597 fatal("gethostname: %.100s", strerror(errno
));
2599 * auth_display must be used as the displayname when the
2600 * authorization entry is added with xauth(1). This will be
2601 * different than the DISPLAY string for localhost displays.
2603 if (options
.x11_use_localhost
) {
2604 snprintf(display
, sizeof display
, "localhost:%u.%u",
2605 s
->display_number
, s
->screen
);
2606 snprintf(auth_display
, sizeof auth_display
, "unix:%u.%u",
2607 s
->display_number
, s
->screen
);
2608 s
->display
= xstrdup(display
);
2609 s
->auth_display
= xstrdup(auth_display
);
2611 #ifdef IPADDR_IN_DISPLAY
2613 struct in_addr my_addr
;
2615 he
= gethostbyname(hostname
);
2617 error("Can't get IP address for X11 DISPLAY.");
2618 ssh_packet_send_debug(ssh
, "Can't get IP address for X11 DISPLAY.");
2621 memcpy(&my_addr
, he
->h_addr_list
[0], sizeof(struct in_addr
));
2622 snprintf(display
, sizeof display
, "%.50s:%u.%u", inet_ntoa(my_addr
),
2623 s
->display_number
, s
->screen
);
2625 snprintf(display
, sizeof display
, "%.400s:%u.%u", hostname
,
2626 s
->display_number
, s
->screen
);
2628 s
->display
= xstrdup(display
);
2629 s
->auth_display
= xstrdup(display
);
2636 do_authenticated2(struct ssh
*ssh
, Authctxt
*authctxt
)
2638 server_loop2(ssh
, authctxt
);
2642 do_cleanup(struct ssh
*ssh
, Authctxt
*authctxt
)
2644 static int called
= 0;
2646 debug("do_cleanup");
2648 /* no cleanup if we're in the child for login shell */
2652 /* avoid double cleanup */
2657 if (authctxt
== NULL
)
2661 if (options
.use_pam
) {
2663 sshpam_thread_cleanup();
2667 if (!authctxt
->authenticated
)
2671 if (options
.kerberos_ticket_cleanup
&&
2673 krb5_cleanup_proc(authctxt
);
2677 if (options
.gss_cleanup_creds
)
2678 ssh_gssapi_cleanup_creds();
2681 /* remove agent socket */
2682 auth_sock_cleanup_proc(authctxt
->pw
);
2684 /* remove userauth info */
2685 if (auth_info_file
!= NULL
) {
2686 temporarily_use_uid(authctxt
->pw
);
2687 unlink(auth_info_file
);
2689 free(auth_info_file
);
2690 auth_info_file
= NULL
;
2694 * Cleanup ptys/utmp only if privsep is disabled,
2695 * or if running in monitor.
2697 if (!use_privsep
|| mm_is_monitor())
2698 session_destroy_all(ssh
, session_pty_cleanup2
);
2701 /* Return a name for the remote host that fits inside utmp_size */
2704 session_get_remote_name_or_ip(struct ssh
*ssh
, u_int utmp_size
, int use_dns
)
2706 const char *remote
= "";
2709 remote
= auth_get_canonical_hostname(ssh
, use_dns
);
2710 if (utmp_size
== 0 || strlen(remote
) > utmp_size
)
2711 remote
= ssh_remote_ipaddr(ssh
);