/openssh-8.5p1.tar.gz

  /openssh-8.5p1.tar.gz.asc

  /gpgkey-736060BA.gpg

   	err = gtk_message_dialog_new(GTK_WINDOW(parent_window), 0,

   	gtk_window_set_position(GTK_WINDOW(err), GTK_WIN_POS_CENTER);

   	gtk_dialog_run(GTK_DIALOG(err));

   		if (prompt_type == PROMPT_ENTRY) {

  @@ -130,6 +145,22 @@ passphrase_dialog(char *message)

   			g_signal_connect(G_OBJECT(entry), "key_press_event",

   		}

  +

  +		hbox = gtk_hbox_new(FALSE, 0);

   log_init(const char *av0, LogLevel level, SyslogFacility facility,

       int on_stderr)

   {

   #if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT)

   	struct syslog_data sdata = SYSLOG_DATA_INIT;

   #endif

   		exit(1);

   	}

   	log_on_stderr = on_stderr;

   	if (on_stderr)

   void     log_init(const char *, LogLevel, SyslogFacility, int);

  +void     log_init_handler(const char *, LogLevel, SyslogFacility, int, int);

   LogLevel log_level_get(void);

   int      log_change_level(LogLevel);

   int      log_is_on_stderr(void);

   		close(pmonitor->m_log_sendfd);

   	pmonitor->m_log_sendfd = pmonitor->m_recvfd = -1;

   	authctxt = (Authctxt *)ssh->authctxt;

   	memset(authctxt, 0, sizeof(*authctxt));

   	ssh->authctxt = authctxt;

   	close(pmonitor->m_recvfd);

   	pmonitor->m_recvfd = -1;

   	monitor_set_child_handler(pmonitor->m_pid);

   	ssh_signal(SIGHUP, &monitor_child_handler);

   	ssh_signal(SIGTERM, &monitor_child_handler);

   	/* Log it */

   	if (log_level_name(level) == NULL)

   		fatal_f("invalid log level %u (corrupted message?)", level);

   	sshbuf_free(logmsg);

   	mon = xcalloc(1, sizeof(*mon));

   	monitor_openfds(mon, 1);

   }

   #ifdef GSSAPI

   	int			 m_log_sendfd;

   	struct kex		**m_pkex;

   	pid_t			 m_pid;

   struct Authctxt;

   void monitor_child_preauth(struct ssh *, struct monitor *);

  @@ -160,6 +160,7 @@ login_cap_t *lc;

   static int is_child = 0;

   /* File containing userauth info, if ExposeAuthInfo set */

   static char *auth_info_file = NULL;

   	int ret;

   	const char *forced = NULL, *tty = NULL;

   	char session_type[1024];

   	if (options.adm_forced_command) {

   		original_command = command;

   			tty += 5;

   	}

   	verbose("Starting session: %s%s%s for %s from %.200s port %d id %d",

   	    session_type,

   	    tty == NULL ? "" : " on ",

   	/* Stop directing logs to a high-numbered fd before we close it */

   	log_redirect_stderr_to(NULL);

   }

   /*

   			exit(1);

   	}

   	do_rc_files(ssh, s, shell);

   	/* restore SIGPIPE for child */

   		argv[i] = NULL;

   		optind = optreset = 1;

   		__progname = argv[0];

   	fflush(NULL);

   	/* Get the last component of the shell name. */

  @@ -97,5 +97,5 @@

   struct passwd;

  -int	sftp_server_main(int, char **, struct passwd *);

  +int	sftp_server_main(int, char **, struct passwd *, int);

   void	sftp_server_cleanup_exit(int) __attribute__((noreturn));

   }

   int

   {

   	fd_set *rset, *wset;

   	int i, r, in, out, max, ch, skipargs = 0, log_stderr = 0;

   	extern char *__progname;

   	__progname = ssh_get_progname(argv[0]);

   	pw = pwcopy(user_pw);

   		}

   	}

   	/*

   	 * On platforms where we can, avoid making /proc/self/{mem,maps}

   		return 1;

   	}

  -	return (sftp_server_main(argc, argv, user_pw));

  +	return (sftp_server_main(argc, argv, user_pw, 0));

   }

   	}

   	/* New socket pair */

   	pmonitor->m_pid = fork();

   	if (pmonitor->m_pid == -1)

   	close(pmonitor->m_sendfd);

   	pmonitor->m_sendfd = -1;

   #endif

   }

   audit_session_open(struct logininfo *li)

   {

   	/* not implemented */

   	/* not implemented */

   }

   void

   audit_event(struct ssh *ssh, ssh_audit_event_t event)

   {

   		debug("%s: unhandled event %d", __func__, event);

   	}

   }

  +	/* not implemented */

  +}

   #endif /* BSM */

  @@ -34,6 +34,12 @@

   #include "log.h"

   #include "hostfile.h"

   }

   # endif  /* !defined CUSTOM_SSH_AUDIT_EVENTS */

   #endif /* SSH_AUDIT_EVENTS */

  @@ -26,6 +26,7 @@

   # define _SSH_AUDIT_H

  +void	audit_destroy_sensitive_data(struct ssh *, const char *, pid_t, uid_t);

   #endif /* _SSH_AUDIT_H */

  @@ -33,27 +33,40 @@

   #include "log.h"

  +		error("cannot write into audit");

  +}

   #endif /* USE_LINUX_AUDIT */

  @@ -0,0 +1,52 @@

  +/* $Id: auditstub.c,v 1.1 jfch Exp $ */

  +

  +audit_session_key_free_body(struct ssh *ssh, int ctos, pid_t pid, uid_t uid)

  +{

  +}

   		} else {

   			/* Invalid user, fake password information */

   			authctxt->pw = fakepw();

   		}

   #ifdef USE_PAM

   		if (options.use_pam)

  @@ -158,7 +158,7 @@ userauth_hostbased(struct ssh *ssh)

   	authenticated = 0;

   	if (PRIVSEP(hostbased_key_allowed(ssh, authctxt->pw, cuser,

   /* return 1 if given hostkey is allowed */

   int

   hostbased_key_allowed(struct ssh *ssh, struct passwd *pw,

   		/* test for correct signature */

   		authenticated = 0;

   		if (PRIVSEP(user_key_allowed(ssh, pw, key, 1, &authopts)) &&

   		    sshbuf_ptr(b), sshbuf_len(b),

   		    (ssh->compat & SSH_BUG_SIGTYPE) == 0 ? pkalg : NULL,

   		    ssh->compat, &sig_details)) == 0) {

   	return authenticated;

   }

   static int

   match_principals_option(const char *principal_list, struct sshkey_cert *cert)

   {

   # endif

   #endif

   #ifdef SSH_AUDIT_EVENTS

   		audit_event(ssh, audit_classify_auth(method));

   #endif

   }

   		record_failed_login(ssh, user,

   		    auth_get_canonical_hostname(ssh, options.use_dns), "ssh");

   #endif

   		return (NULL);

   	}

   	if (!allowed_user(ssh, pw))

   char	*expand_authorized_keys(const char *, struct passwd *pw);

   char	*authorized_principals_file(struct passwd *);

   FILE	*auth_openkeyfile(const char *, struct passwd *, int);

   FILE	*auth_openprincipals(const char *, struct passwd *, int);

   int	 get_hostkey_index(struct sshkey *, int, struct ssh *);

   int	 sshd_hostkey_sign(struct ssh *, struct sshkey *, struct sshkey *,

       u_char **, size_t *, const u_char *, size_t, const char *);

   /* Key / cert options linkage to auth layer */

   const struct sshauthopt *auth_options(struct ssh *);

   	const struct sshcipher *cipher;

   };

   static const struct sshcipher ciphers[] = {

   #ifdef WITH_OPENSSL

   #ifndef OPENSSL_NO_DES

   void

   cipher_free(struct sshcipher_ctx *cc)

   {

   		return;

   	if ((cc->cipher->flags & CFLAG_CHACHAPOLY) != 0) {

   		chachapoly_free(cc->cp_ctx);

   #define CIPHER_ENCRYPT		1

   #define CIPHER_DECRYPT		0

   struct sshcipher_ctx;

   const struct sshcipher *cipher_by_name(const char *);

   #include "ssherr.h"

   #include "sshbuf.h"

   #include "digest.h"

   #ifdef GSSAPI

   #include "ssh-gss.h"

   }

   static int

   	if ((enc->cipher = cipher_by_name(name)) == NULL) {

   		error_f("unsupported cipher %s", name);

   		free(name);

   {

   	char *name = match_list(client, server, NULL);

   	if (mac_setup(mac, name) < 0) {

   		error_f("unsupported MAC %s", name);

   		free(name);

   }

   static int

   #ifdef WITH_ZLIB

   	if (strcmp(name, "zlib@openssh.com") == 0) {

   		comp->type = COMP_DELAYED;

   		nenc  = ctos ? PROPOSAL_ENC_ALGS_CTOS  : PROPOSAL_ENC_ALGS_STOC;

   		nmac  = ctos ? PROPOSAL_MAC_ALGS_CTOS  : PROPOSAL_MAC_ALGS_STOC;

   		ncomp = ctos ? PROPOSAL_COMP_ALGS_CTOS : PROPOSAL_COMP_ALGS_STOC;

   		    sprop[nenc])) != 0) {

   			kex->failed_choice = peer[nenc];

   			peer[nenc] = NULL;

   			peer[nmac] = NULL;

   			goto out;

   		}

   		    sprop[ncomp])) != 0) {

   			kex->failed_choice = peer[ncomp];

   			peer[ncomp] = NULL;

   		dh_need = MAXIMUM(dh_need, newkeys->enc.block_size);

   		dh_need = MAXIMUM(dh_need, newkeys->enc.iv_len);

   		dh_need = MAXIMUM(dh_need, newkeys->mac.key_len);

   	}

   	/* XXX need runden? */

   	kex->we_need = need;

   }

   #endif

   /*

    * Send a plaintext error message to the peer, suffixed by \r\n.

    * Only used during banner exchange, and there only for the server.

  @@ -226,6 +226,8 @@ int	 kexgss_client(struct ssh *);

   int	 kexgss_server(struct ssh *);

   #endif

   int	 kex_dh_keypair(struct kex *);

   int	 kex_dh_enc(struct kex *, const struct sshbuf *, struct sshbuf **,

       struct sshbuf **);

   	mac->umac_ctx = NULL;

   }

   /* XXX copied from ciphers_valid */

   #define	MAC_SEP	","

   int

  @@ -49,5 +49,6 @@ int	 mac_compute(struct sshmac *, u_int3

   int	 mac_check(struct sshmac *, u_int32_t, const u_char *, size_t,

       const u_char *, size_t);

  +void	 mac_destroy(struct sshmac *);

   #endif /* SSHMAC_H */

   	kexsntrup761x25519.o sntrup761.o kexgen.o \

   	kexgssc.o \

  -	sshbuf-io.o

  +	sshbuf-io.o auditstub.o

   SKOBJS=	ssh-sk-client.o

  @@ -93,6 +93,7 @@

   #include "compat.h"

   #include "ssh2.h"

   #include "match.h"

   #include "ssherr.h"

   #include "sk-api.h"

   extern struct sshbuf *loginmsg;

   extern struct sshauthopt *auth_opts; /* XXX move to permanent ssh->authctxt? */

   #endif

       {0, 0, NULL}

   };

   	int r, ret, req_presence = 0, req_verify = 0, valid_data = 0;

   	int encoded_ret;

   	struct sshkey_sig_details *sig_details = NULL;

   	    (r = sshbuf_get_string_direct(m, &signature, &signaturelen)) != 0 ||

   	    (r = sshbuf_get_string_direct(m, &data, &datalen)) != 0 ||

   	    (r = sshbuf_get_cstring(m, &sigalg, NULL)) != 0)

   	if (hostbased_cuser == NULL || hostbased_chost == NULL ||

   	  !monitor_allowed_key(blob, bloblen))

   		fatal_f("bad key, not previously allowed");

   	/* Empty signature algorithm means NULL. */

   	if (*sigalg == '\0') {

   	case MM_USERKEY:

   		valid_data = monitor_valid_userblob(ssh, data, datalen);

   		auth_method = "publickey";

   		break;

   	}

   	if (!valid_data)

   	    SSH_FP_DEFAULT)) == NULL)

   		fatal_f("sshkey_fingerprint failed");

   	debug3_f("%s %p signature %s%s%s", auth_method, key,

   	    (ret == 0) ? "verified" : "unverified",

   	    (ret != 0) ? ": " : "", (ret != 0) ? ssh_err(ret) : "");

   }

   static void

   	session_unused(s->self);

   }

    error:

   	if (s != NULL)

   	if ((r = sshbuf_put_u32(m, 0)) != 0)

   		fatal_fr(r, "assemble 0");

   	mm_request_send(sock, MONITOR_ANS_PTY, m);

   	if ((r = sshbuf_get_cstring(m, &tty, NULL)) != 0)

   		fatal_fr(r, "parse tty");

   	if ((s = session_by_tty(tty)) != NULL)

   	sshbuf_reset(m);

   	free(tty);

   	return (0);

   		sshpam_cleanup();

   #endif

   	while (waitpid(pmonitor->m_pid, &status, 0) == -1)

   		if (errno != EINTR)

   			exit(1);

   {

   	char *cmd;

   	int r;

   	free(cmd);

   	return (0);

   }

   void

   mm_get_keystate(struct ssh *ssh, struct monitor *pmonitor)

   {

   	debug3_f("Waiting for new keys");

   	if ((child_state = sshbuf_new()) == NULL)

   	mm_request_receive_expect(pmonitor->m_sendfd, MONITOR_REQ_KEYEXPORT,

   	    child_state);

   	debug3_f("GOT new keys");

   }

   #endif /* GSSAPI */

  +	return 0;

  +}

  +#endif /* SSH_AUDIT_EVENTS */

  @@ -65,7 +65,13 @@ enum monitor_reqtype {

   	MONITOR_REQ_PAM_QUERY = 106, MONITOR_ANS_PAM_QUERY = 107,

   	MONITOR_REQ_PAM_RESPOND = 108, MONITOR_ANS_PAM_RESPOND = 109,

   	MONITOR_REQ_GSSSIGN = 150, MONITOR_ANS_GSSSIGN = 151,

   	MONITOR_REQ_GSSUPCREDS = 152, MONITOR_ANS_GSSUPCREDS = 153,

    */

   int

       const u_char *data, size_t datalen, const char *sigalg, u_int compat,

       struct sshkey_sig_details **sig_detailsp)

   {

   		*sig_detailsp = NULL;

   	if ((m = sshbuf_new()) == NULL)

   		fatal_f("sshbuf_new failed");

   	    (r = sshbuf_put_string(m, sig, siglen)) != 0 ||

   	    (r = sshbuf_put_string(m, data, datalen)) != 0 ||

   	    (r = sshbuf_put_cstring(m, sigalg == NULL ? "" : sigalg)) != 0)

   	return 0;

   }

   void

   mm_send_keystate(struct ssh *ssh, struct monitor *monitor)

   {

   	sshbuf_free(m);

   }

   	debug3("%s entering command %s", __func__, command);

   		fatal("%s: buffer error: %s", __func__, ssh_err(r));

   	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_COMMAND, m);

   	sshbuf_free(m);

   }

   #endif /* SSH_AUDIT_EVENTS */

   }

   #endif /* GSSAPI */

  +	sshbuf_free(m);

  +}

  +#endif /* SSH_AUDIT_EVENTS */

       struct sshauthopt **);

   int mm_hostbased_key_allowed(struct ssh *, struct passwd *, const char *,

       const char *, struct sshkey *);