lshd.c 28.8 KB
Newer Older
Niels Möller's avatar
Niels Möller committed
1
2
3
/* lshd.c
 *
 * main server program.
4
5
 *
 * $Id$ */
Niels Möller's avatar
Niels Möller committed
6

7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
/* lsh, an implementation of the ssh protocol
 *
 * Copyright (C) 1998 Niels Mller
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU General Public License as
 * published by the Free Software Foundation; either version 2 of the
 * License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 * General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
Niels Möller's avatar
Niels Möller committed
23
 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
24
 */
Niels Möller's avatar
Niels Möller committed
25

26
#include "algorithms.h"
27
28
#include "alist.h"
#include "atoms.h"
29
#include "channel.h"
30
#include "channel_commands.h"
31
#include "charset.h"
32
#include "compress.h"
33
#include "connection_commands.h"
34
#include "crypto.h"
35
#include "daemon.h"
36
#include "dsa.h"
37
#include "format.h"
38
#include "handshake.h"
Niels Möller's avatar
Niels Möller committed
39
#include "io.h"
40
#include "io_commands.h"
41
#include "lookup_verifier.h"
42
#include "randomness.h"
Niels Möller's avatar
Niels Möller committed
43
#include "reaper.h"
Niels Möller's avatar
Niels Möller committed
44
#include "server.h"
45
#include "server_authorization.h"
46
#include "server_keyexchange.h"
47
48
#include "server_pty.h"
#include "server_session.h"
49
#include "sexp.h"
Niels Möller's avatar
Niels Möller committed
50
#include "spki.h"
51
#include "srp.h"
Niels Möller's avatar
Niels Möller committed
52
#include "ssh.h"
53
54
#include "tcpforward.h"
#include "tcpforward_commands.h"
55
#include "tcpforward_commands.h"
56
#include "server_userauth.h"
57
#include "version.h"
58
59
60
#include "werror.h"
#include "xalloc.h"

61
#include "lsh_argp.h"
62

63
/* Forward declarations */
64
65
struct command options2local;
#define OPTIONS2LOCAL (&options2local.super)
66

67
68
struct command options2keys;
#define OPTIONS2KEYS (&options2keys.super)
69

70
71
72
struct command options2tcp_wrapper;
#define OPTIONS2TCP_WRAPPER (&options2tcp_wrapper.super)

73
74
struct command_2 close_on_sighup;
#define CLOSE_ON_SIGHUP (&close_on_sighup.super.super)
75

76
77
78
79
80
81
82
83
84
85
86
87
#include "lshd.c.x"

#include <assert.h>

#include <errno.h>
#include <locale.h>
#include <stdio.h>
#include <string.h>

#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
88
#if HAVE_UNISTD_H
89
#include <unistd.h>
90
#endif
91

92
93
94
95
/* Disabled in the 1.4 series. */
#undef WITH_X11_FORWARD
#define WITH_X11_FORWARD 0

96
97
/* Option parsing */

98
99
100
101
102
const char *argp_program_version
= "lshd-" VERSION ", secsh protocol version " SERVER_PROTOCOL_VERSION;

const char *argp_program_bug_address = BUG_ADDRESS;

Niels Möller's avatar
Niels Möller committed
103
104
105
106
107
108
/* The definition of SBINDIR is currently broken */
#if 0
# define KERBEROS_HELPER SBINDIR "/lsh-krb-checkpw"
#else
# define KERBEROS_HELPER PREFIX "/sbin/lsh-krb-checkpw"
#endif
109

110
#define OPT_NO 0x400
111
112
#define OPT_SSH1_FALLBACK 0x200
#define OPT_INTERFACE 0x201
113

114
#define OPT_TCPIP_FORWARD 0x202
115
#define OPT_NO_TCPIP_FORWARD (OPT_TCPIP_FORWARD | OPT_NO)
116
117
#define OPT_PTY 0x203
#define OPT_NO_PTY (OPT_PTY | OPT_NO)
118
119
#define OPT_SUBSYSTEMS 0x204
#define OPT_NO_SUBSYSTEMS (OPT_SUBSYSTEMS | OPT_NO)
120

121
#define OPT_DAEMONIC 0x205
122
#define OPT_NO_DAEMONIC (OPT_DAEMONIC | OPT_NO)
123
#define OPT_PIDFILE 0x206
124
125
#define OPT_NO_PIDFILE (OPT_PIDFILE | OPT_NO)
#define OPT_CORE 0x207
126
127
#define OPT_SYSLOG 0x208
#define OPT_NO_SYSLOG (OPT_SYSLOG | OPT_NO)
128
129
#define OPT_X11_FORWARD 0x209
#define OPT_NO_X11_FORWARD (OPT_X11_FORWARD |OPT_NO)
130

131
132
133
134
135
136
#define OPT_SRP 0x210
#define OPT_NO_SRP (OPT_SRP | OPT_NO)
#define OPT_DH 0x211
#define OPT_NO_DH (OPT_DH | OPT_NO)

#define OPT_PUBLICKEY 0x220
137
#define OPT_NO_PUBLICKEY (OPT_PUBLICKEY | OPT_NO)
138
#define OPT_PASSWORD 0x221
139
140
#define OPT_NO_PASSWORD (OPT_PASSWORD | OPT_NO)

141
#define OPT_ROOT_LOGIN 0x222
142
143
#define OPT_NO_ROOT_LOGIN (OPT_ROOT_LOGIN | OPT_NO)

144
145
146
#define OPT_KERBEROS_PASSWD 0x223
#define OPT_NO_KERBEROS_PASSWD (OPT_KERBEROS_PASSWD | OPT_NO)

147
148
#define OPT_PASSWORD_HELPER 0x224

149
150
#define OPT_LOGIN_SHELL 0x225

151
152
153
154
155
#define OPT_TCPWRAPPERS 0x226
#define OPT_NO_TCPWRAPPERS 0x227

#define OPT_TCPWRAP_GOAWAY_MSG 0x228

156
157
158
159
160
/* GABA:
   (class
     (name lshd_options)
     (super algorithms_options)
     (vars
161
162
       (e object exception_handler)
       
163
       (reaper object reaper)
164
       (random object randomness)
165
       
166
       (signature_algorithms object alist)
167
168
169
170
171
       (style . sexp_argp_state)
       (interface . "char *")
       (port . "char *")
       (hostkey . "char *")
       (local object address_info)
172
173
       (tcp_wrapper_name . "char *")
       (tcp_wrapper_message . "char *")
174

175
176
177
178
179
180
       (with_srp_keyexchange . int)
       (with_dh_keyexchange . int)

       ;; (kexinit object make_kexinit)
       (kex_algorithms object int_list)
       
181
182
       (with_publickey . int)
       (with_password . int)
183
       (allow_root . int)
184
       (pw_helper . "const char *")
185
       (login_shell . "const char *")
186
       
187
       (with_tcpip_forward . int)
188
       (with_x11_forward . int)
189
       (with_pty . int)
190
       (subsystems . "const char **")
191
       
192
193
194
       (userauth_methods object int_list)
       (userauth_algorithms object alist)
       
195
196
       (sshd1 object ssh1_fallback)
       (daemonic . int)
197
       (no_syslog . int)
198
199
200
       (corefile . int)
       (pid_file . "const char *")
       ; -1 means use pid file iff we're in daemonic mode
201
202
203
204
       (use_pid_file . int)
       ; Resources that should be killed when SIGHUP is received,
       ; or when the program exits.
       (resources object resource_list)))
205
206
*/

207
208
209
210
211
212
static void
do_exc_lshd_handler(struct exception_handler *s,
		    const struct exception *e)
{
  switch(e->type)
    {
213
    case EXC_RESOLVE:
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
    case EXC_SEXP_SYNTAX:
    case EXC_SPKI_TYPE:
    case EXC_RANDOMNESS_LOW_ENTROPY:
      werror("lshd: %z\n", e->msg);
      exit(EXIT_FAILURE);
    default:
      EXCEPTION_RAISE(s->parent, e);
    }
}

static struct exception_handler *
make_lshd_exception_handler(struct exception_handler *parent,
			    const char *context)
{
  return make_exception_handler(do_exc_lshd_handler, parent, context);
}

Niels Möller's avatar
Niels Möller committed
231
static struct lshd_options *
232
make_lshd_options(void)
233
{
Niels Möller's avatar
Niels Möller committed
234
  NEW(lshd_options, self);
235

236
  init_algorithms_options(&self->super, all_symmetric_algorithms());
237

238
239
  self->e = make_lshd_exception_handler(&default_exception_handler,
					HANDLER_CONTEXT);
240
  self->reaper = make_reaper();
241
  self->random = make_system_random();
242

243
  self->signature_algorithms = all_signature_algorithms(self->random); /* OK to initialize with NULL */
244

245
246
  self->style = SEXP_TRANSPORT;
  self->interface = NULL;
247
248
249
250
251

  /* Default behaviour is to lookup the "ssh" service, and fall back
   * to port 22 if that fails. */
  self->port = NULL;
  
252
253
254
255
  /* FIXME: this should perhaps use sysconfdir */  
  self->hostkey = "/etc/lsh_host_key";
  self->local = NULL;

256
257
258
259
260
  self->with_dh_keyexchange = 1;
  self->with_srp_keyexchange = 0;

  self->kex_algorithms = NULL;
  
261
262
  self->with_publickey = 1;
  self->with_password = 1;
263
  self->with_tcpip_forward = 1;
264
265
  /* Experimental, so disabled by default. */
  self->with_x11_forward = 0;
266
  self->with_pty = 1;
267
268
  self->subsystems = NULL;
  
269
270
271
  self->tcp_wrapper_name = "lshd";
  self->tcp_wrapper_message = NULL;

272
  self->allow_root = 0;
273
  self->pw_helper = NULL;
274
  self->login_shell = NULL;
275
  
276
277
  self->userauth_methods = NULL;
  self->userauth_algorithms = NULL;
278
279
  
  self->sshd1 = NULL;
280
  self->daemonic = 0;
281
282
  self->no_syslog = 0;
  
283
284
285
286
  /* FIXME: Make the default a configure time option? */
  self->pid_file = "/var/run/lshd.pid";
  self->use_pid_file = -1;
  self->corefile = 0;
287
288
289
290
291
292

  self->resources = make_resource_list();
  /* Not strictly needed for gc, but makes sure the
   * resource list is killed properly by gc_final. */
  gc_global(&self->resources->super);

293
294
295
  return self;
}

Niels Möller's avatar
Niels Möller committed
296
/* Port to listen on */
297
298
299
300
301
DEFINE_COMMAND(options2local)
     (struct command *s UNUSED,
      struct lsh_object *a,
      struct command_continuation *c,
      struct exception_handler *e UNUSED)
Niels Möller's avatar
Niels Möller committed
302
303
{
  CAST(lshd_options, options, a);
304
  COMMAND_RETURN(c, options->local);
Niels Möller's avatar
Niels Möller committed
305
306
307
}

/* alist of signature algorithms */
308
309
310
311
312
DEFINE_COMMAND(options2signature_algorithms)
     (struct command *s UNUSED,
      struct lsh_object *a,
      struct command_continuation *c,
      struct exception_handler *e UNUSED)
Niels Möller's avatar
Niels Möller committed
313
314
{
  CAST(lshd_options, options, a);
315
  COMMAND_RETURN(c, options->signature_algorithms);
Niels Möller's avatar
Niels Möller committed
316
317
}

318

319
320
/* FIXME: Call read_host_key directly from main instead. */
DEFINE_COMMAND(options2keys)
321
322
323
     (struct command *ignored UNUSED,
      struct lsh_object *a,
      struct command_continuation *c,
324
      struct exception_handler *e UNUSED)
Niels Möller's avatar
Niels Möller committed
325
326
327
{
  CAST(lshd_options, options, a);

328
329
330
  struct alist *keys = make_alist(0, -1);
  read_host_key(options->hostkey, options->signature_algorithms, keys);
  COMMAND_RETURN(c, keys);
Niels Möller's avatar
Niels Möller committed
331
332
}

333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
/* GABA:
   (class
     (name pid_file_resource)
     (super resource)
     (vars
       (file . "const char *")))
*/

static void
do_kill_pid_file(struct resource *s)
{
  CAST(pid_file_resource, self, s);
  if (self->super.alive)
    {
      self->super.alive = 0;
      if (unlink(self->file) < 0)
	werror("Unlinking pidfile failed (errno = %i): %z\n",
	       errno, STRERROR(errno));
    }
}

static struct resource *
make_pid_file_resource(const char *file)
{
  NEW(pid_file_resource, self);
  init_resource(&self->super, do_kill_pid_file);
  self->file = file;

  return &self->super;
}

/* GABA:
   (class
     (name sighup_close_callback)
     (super lsh_callback)
     (vars
       (resources object resource_list)))
*/

static void
do_sighup_close_callback(struct lsh_callback *s)
{
  CAST(sighup_close_callback, self, s);
  unsigned nfiles;
  
  werror("SIGHUP received.\n");
  KILL_RESOURCE_LIST(self->resources);
  
  nfiles = io_nfiles();

  if (nfiles)
    werror("Waiting for active connections to terminate, "
	   "%i files still open.\n", nfiles);
}

static struct lsh_callback *
make_sighup_close_callback(struct lshd_options *options)
{
  NEW(sighup_close_callback, self);
  self->super.f = do_sighup_close_callback;
  self->resources = options->resources;

  return &self->super;
}

/* (close_on_sighup options file) */
DEFINE_COMMAND2(close_on_sighup)
     (struct command_2 *ignored UNUSED,
      struct lsh_object *a1,
      struct lsh_object *a2,
      struct command_continuation *c,
      struct exception_handler *e UNUSED)
{
  CAST(lshd_options, options, a1);
  CAST(lsh_fd, fd, a2);

  remember_resource(options->resources, &fd->super);

  COMMAND_RETURN(c, a2);
}
Niels Möller's avatar
Niels Möller committed
413

414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439

DEFINE_COMMAND(options2tcp_wrapper)
     (struct command *s UNUSED,
      struct lsh_object *a,
      struct command_continuation *c,
      struct exception_handler *e UNUSED)
{
#if WITH_TCPWRAPPERS
  CAST(lshd_options, options, a);


  if (options->tcp_wrapper_name) 
    COMMAND_RETURN(c, 
		   make_tcp_wrapper(
				    make_string(options->tcp_wrapper_name),
				    options->tcp_wrapper_message ? 
				    ssh_format("%lz\n", options->tcp_wrapper_message ) :
				    ssh_format("")
				    )
		   ); 
  else
#endif /* WITH_TCPWRAPPERS */
    COMMAND_RETURN(c, &io_log_peer_command);
}


440
441
442
443
444
static const struct argp_option
main_options[] =
{
  /* Name, key, arg-name, flags, doc, group */
  { "interface", OPT_INTERFACE, "interface", 0,
445
    "Listen on this network interface.", 0 }, 
446
447
  { "port", 'p', "Port", 0, "Listen on this port.", 0 },
  { "host-key", 'h', "Key file", 0, "Location of the server's private key.", 0},
448
449
450
451
#if WITH_SSH1_FALLBACK
  { "ssh1-fallback", OPT_SSH1_FALLBACK, "File name", OPTION_ARG_OPTIONAL,
    "Location of the sshd1 program, for falling back to version 1 of the Secure Shell protocol.", 0 },
#endif /* WITH_SSH1_FALLBACK */
452

453
454
455
456
457
458
459
460
#if WITH_TCPWRAPPERS
  { NULL, 0, NULL, 0, "Connection filtering:", 0 },
  { "tcpwrappers", OPT_TCPWRAPPERS, "name", 0, "Set service name for tcp wrappers (default lshd)", 0 },
  { "no-tcpwrappers", OPT_NO_TCPWRAPPERS, NULL, 0, "Disable wrappers", 0 },
  { "tcpwrappers-msg", OPT_TCPWRAP_GOAWAY_MSG, "'Message'", 0, "Message sent to clients " 
    "who aren't allowed to connect. A newline will be added.", 0 },
#endif /* WITH_TCPWRAPPERS */

461
  { NULL, 0, NULL, 0, "Keyexchange options:", 0 },
462
463
464
465
466
467
468
469
#if WITH_SRP
  { "srp-keyexchange", OPT_SRP, NULL, 0, "Enable experimental SRP support.", 0 },
  { "no-srp-keyexchange", OPT_NO_SRP, NULL, 0, "Disable experimental SRP support (default).", 0 },
#endif /* WITH_SRP */

  { "dh-keyexchange", OPT_DH, NULL, 0, "Enable DH support (default).", 0 },
  { "no-dh-keyexchange", OPT_NO_DH, NULL, 0, "Disable DH support.", 0 },
  
470
  { NULL, 0, NULL, 0, "User authentication options:", 0 },
471

472
473
474
475
476
477
478
479
480
  { "password", OPT_PASSWORD, NULL, 0,
    "Enable password user authentication (default).", 0},
  { "no-password", OPT_NO_PASSWORD, NULL, 0,
    "Disable password user authentication.", 0},

  { "publickey", OPT_PUBLICKEY, NULL, 0,
    "Enable publickey user authentication (default).", 0},
  { "no-publickey", OPT_NO_PUBLICKEY, NULL, 0,
    "Disable publickey user authentication.", 0},
481
482
483
484
485

  { "root-login", OPT_ROOT_LOGIN, NULL, 0,
    "Allow root to login.", 0 },
  { "no-root-login", OPT_NO_ROOT_LOGIN, NULL, 0,
    "Don't allow root to login (default).", 0 },
486

487
488
489
490
  { "login-shell", OPT_LOGIN_SHELL, "Program", 0,
    "Use this program as the login shell for all users. "
    "(Experimental)", 0 },
  
491
492
493
  { "kerberos-passwords", OPT_KERBEROS_PASSWD, NULL, 0,
    "Recognize kerberos passwords, using the helper program "
    "\"" KERBEROS_HELPER "\". This option is experimental.", 0 },
494
  { "no-kerberos-passwords", OPT_NO_KERBEROS_PASSWD, NULL, 0,
Niels Möller's avatar
Niels Möller committed
495
    "Don't recognize kerberos passwords (default behaviour).", 0 },
496

497
498
  { "password-helper", OPT_PASSWORD_HELPER, "Program", 0,
    "Use the named helper program for password verification. "
499
    "(Experimental).", 0 },
500

501
  { NULL, 0, NULL, 0, "Offered services:", 0 },
502

503
504
505
506
#if WITH_PTY_SUPPORT
  { "pty-support", OPT_PTY, NULL, 0, "Enable pty allocation (default).", 0 },
  { "no-pty-support", OPT_NO_PTY, NULL, 0, "Disable pty allocation.", 0 },
#endif /* WITH_PTY_SUPPORT */
507
508
509
510
511
512
513
514
515
516
517
518
519
#if WITH_TCP_FORWARD
  { "tcpip-forward", OPT_TCPIP_FORWARD, NULL, 0,
    "Enable tcpip forwarding (default).", 0 },
  { "no-tcpip-forward", OPT_NO_TCPIP_FORWARD, NULL, 0,
    "Disable tcpip forwarding.", 0 },
#endif /* WITH_TCP_FORWARD */
#if WITH_X11_FORWARD
  { "x11-forward", OPT_X11_FORWARD, NULL, 0,
    "Enable x11 forwarding.", 0 },
  { "no-x11-forward", OPT_NO_X11_FORWARD, NULL, 0,
    "Disable x11 forwarding (default).", 0 },
#endif /* WITH_X11_FORWARD */
  
520
521
522
  { "subsystems", OPT_SUBSYSTEMS, "List of subsystem names and programs", 0,
    "For example `sftp=/usr/sbin/sftp-server,foosystem=/usr/bin/foo' "
    "(experimental).", 0},
523
  
524
525
  { NULL, 0, NULL, 0, "Daemonic behaviour", 0 },
  { "daemonic", OPT_DAEMONIC, NULL, 0, "Run in the background, redirect stdio to /dev/null, and chdir to /.", 0 },
526
  { "no-daemonic", OPT_NO_DAEMONIC, NULL, 0, "Run in the foreground, with messages to stderr (default).", 0 },
527
528
  { "pid-file", OPT_PIDFILE, "file name", 0, "Create a pid file. When running in daemonic mode, "
    "the default is /var/run/lshd.pid.", 0 },
529
  { "no-pid-file", OPT_NO_PIDFILE, NULL, 0, "Don't use any pid file. Default in non-daemonic mode.", 0 },
530
  { "enable-core", OPT_CORE, NULL, 0, "Dump core on fatal errors (disabled by default).", 0 },
531
532
  { "no-syslog", OPT_NO_SYSLOG, NULL, 0, "Don't use syslog (by default, syslog is used "
    "when running in daemonic mode).", 0 },
533
534
535
536
537
538
539
540
541
542
543
544
  { NULL, 0, NULL, 0, NULL, 0 }
};

static const struct argp_child
main_argp_children[] =
{
  { &sexp_input_argp, 0, "", 0 },
  { &algorithms_argp, 0, "", 0 },
  { &werror_argp, 0, "", 0 },
  { NULL, 0, NULL, 0}
};

545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
/* NOTE: Modifies the argument string. */
static const char **
parse_subsystem_list(char *arg)
{
  const char **subsystems;
  char *separator;
  unsigned length;
  unsigned i;
  
  /* First count the number of elements. */
  for (length = 1, i = 0; arg[i]; i++)
    if (arg[i] == ',')
      length++;

  subsystems = lsh_space_alloc((length * 2 + 1) * sizeof(*subsystems));

  for (i = 0; ; i++)
    {
      subsystems[2*i] = arg;

      separator = strchr(arg, '=');

      if (!separator)
	goto fail;

      *separator = '\0';

      subsystems[2*i+1] = arg = separator + 1;
      
      separator = strchr(arg, ',');

      if (i == (length - 1))
	break;
      
      if (!separator)
	goto fail;

      *separator = '\0';
      arg = separator + 1;
    }
  if (separator)
    {
    fail:
      lsh_space_free(subsystems);
      return NULL;
    }
  return subsystems;
}

594
595
596
597
598
599
600
601
602
603
604
605
static error_t
main_argp_parser(int key, char *arg, struct argp_state *state)
{
  CAST(lshd_options, self, state->input);
  
  switch(key)
    {
    default:
      return ARGP_ERR_UNKNOWN;
    case ARGP_KEY_INIT:
      state->child_inputs[0] = &self->style;
      state->child_inputs[1] = &self->super;
606
      state->child_inputs[2] = NULL;
607
608
      break;
    case ARGP_KEY_END:
609
      {
610
	struct user_db *user_db = NULL;
611
	
612
613
	if (!self->random)
	  argp_failure( state, EXIT_FAILURE, 0,  "No randomness generator available.");
614
615
	
       	if (self->with_password || self->with_publickey || self->with_srp_keyexchange)
616
	  user_db = make_unix_user_db(self->reaper,
617
618
				      self->pw_helper, self->login_shell,
				      self->allow_root);
619
	  
620
621
622
623
624
625
626
627
628
629
630
	if (self->with_dh_keyexchange || self->with_srp_keyexchange)
	  {
	    int i = 0;
	    self->kex_algorithms 
	      = alloc_int_list(self->with_dh_keyexchange + self->with_srp_keyexchange);
	    
	    if (self->with_dh_keyexchange)
	      {
		LIST(self->kex_algorithms)[i++] = ATOM_DIFFIE_HELLMAN_GROUP1_SHA1;
		ALIST_SET(self->super.algorithms,
			  ATOM_DIFFIE_HELLMAN_GROUP1_SHA1,
631
			  &make_dh_server(make_dh1(self->random))
632
			  ->super);
633
634
635
636
	      }
#if WITH_SRP	    
	    if (self->with_srp_keyexchange)
	      {
637
		assert(user_db);
638
		LIST(self->kex_algorithms)[i++] = ATOM_SRP_RING1_SHA1_LOCAL;
639
		ALIST_SET(self->super.algorithms,
640
			  ATOM_SRP_RING1_SHA1_LOCAL,
641
			  &make_srp_server(make_srp1(self->random),
642
					   user_db)
643
			  ->super);
644
645
646
647
648
649
650
	      }
#endif /* WITH_SRP */
	  }
	else
	  argp_error(state, "All keyexchange algorithms disabled.");

	if (self->port)
651
	  self->local = make_address_info_c(self->interface, self->port, 0);
652
	else
653
	  self->local = make_address_info_c(self->interface, "ssh", 22);
654
      
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
	if (!self->local)
	  argp_error(state, "Invalid interface, port or service, %s:%s'.",
		     self->interface ? self->interface : "ANY",
		     self->port);

	if (self->use_pid_file < 0)
	  self->use_pid_file = self->daemonic;

	if (self->with_password || self->with_publickey)
	  {
	    int i = 0;
	    
	    self->userauth_methods
	      = alloc_int_list(self->with_password + self->with_publickey);
	    self->userauth_algorithms = make_alist(0, -1);
	    
	    if (self->with_password)
	      {
		LIST(self->userauth_methods)[i++] = ATOM_PASSWORD;
		ALIST_SET(self->userauth_algorithms,
675
			  ATOM_PASSWORD,
676
			  &make_userauth_password(user_db)->super);
677
678
679
	      }
	    if (self->with_publickey)
	      {
680
681
682
		/* FIXME: Doesn't use spki */
		struct lookup_verifier *key_db
		  = make_authorization_db(ssh_format("authorized_keys_sha1"),
683
					  &crypto_sha1_algorithm);
684
		
685
686
687
		LIST(self->userauth_methods)[i++] = ATOM_PUBLICKEY;
		ALIST_SET(self->userauth_algorithms,
			  ATOM_PUBLICKEY,
688
			  &make_userauth_publickey
689
690
691
692
			  (user_db,
			   make_alist(2,
				      ATOM_SSH_DSS, key_db,
				      ATOM_SSH_RSA, key_db,
693
694
				      -1))
			  ->super);
695
696
	      }
	  }
697
698
699
700
701
702
        if (self->with_srp_keyexchange)
          ALIST_SET(self->userauth_algorithms,
                    ATOM_NONE,
                    &server_userauth_none.super);

        if (!self->userauth_algorithms->size)
703
	  argp_error(state, "All user authentication methods disabled.");
704

705
706
	break;
      }
707
708
709
710
711
712
713
714
715
716
717
    case 'p':
      self->port = arg;
      break;

    case 'h':
      self->hostkey = arg;
      break;

    case OPT_INTERFACE:
      self->interface = arg;
      break;
718

719
720
721
722
723
#if WITH_SSH1_FALLBACK
    case OPT_SSH1_FALLBACK:
      self->sshd1 = make_ssh1_fallback(arg ? arg : SSHD1);
      break;
#endif
Niels Möller's avatar
Niels Möller committed
724

725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
    case OPT_SRP:
      self->with_srp_keyexchange = 1;
      break;

    case OPT_NO_SRP:
      self->with_srp_keyexchange = 0;
      break;
      
    case OPT_DH:
      self->with_dh_keyexchange = 1;
      break;

    case OPT_NO_DH:
      self->with_dh_keyexchange = 0;
      break;
      
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
    case OPT_PASSWORD:
      self->with_password = 1;
      break;
      
    case OPT_NO_PASSWORD:
      self->with_password = 0;
      break;

    case OPT_PUBLICKEY:
      self->with_publickey = 1;
      break;
      
    case OPT_NO_PUBLICKEY:
      self->with_publickey = 0;
      break;
756
757
758
759

    case OPT_ROOT_LOGIN:
      self->allow_root = 1;
      break;
760
761

    case OPT_KERBEROS_PASSWD:
762
      self->pw_helper = KERBEROS_HELPER;
763
764
765
766
767
      break;

    case OPT_NO_KERBEROS_PASSWD:
      self->pw_helper = NULL;
      break;
768
769
770
771

    case OPT_PASSWORD_HELPER:
      self->pw_helper = arg;
      break;
772
773
774
775

    case OPT_LOGIN_SHELL:
      self->login_shell = arg;
      break;
776
      
777
#if WITH_TCP_FORWARD
778
779
780
781
782
783
784
    case OPT_TCPIP_FORWARD:
      self->with_tcpip_forward = 1;
      break;

    case OPT_NO_TCPIP_FORWARD:
      self->with_tcpip_forward = 0;
      break;
785
#endif /* WITH_TCP_FORWARD */
786
787
788
789
790
791
792
793
#if WITH_X11_FORWARD
    case OPT_X11_FORWARD:
      self->with_x11_forward = 1;
      break;
    case OPT_NO_X11_FORWARD:
      self->with_x11_forward = 0;
      break;
#endif /* WITH_X11_FORWARD */
794
795
796
797
798
799
800
801
802
      
#if WITH_PTY_SUPPORT
    case OPT_PTY:
      self->with_pty = 1;
      break;
    case OPT_NO_PTY:
      self->with_pty = 0;
      break;
#endif /* WITH_PTY_SUPPORT */
803

804
805
806
807
808
809
810
811
812
813
814
815
816
817
#if WITH_TCPWRAPPERS
    case OPT_TCPWRAPPERS:
      self->tcp_wrapper_name = arg; /* Name given */
      break;
    case OPT_NO_TCPWRAPPERS:
      self->tcp_wrapper_name = NULL; /* Disable by giving name NULL */
      break;
      
    case OPT_TCPWRAP_GOAWAY_MSG:
      self->tcp_wrapper_message = arg;
      break;

#endif /* WITH_TCPWRAPPERS */

818
819
820
821
822
823
824
825
826
827
    case OPT_SUBSYSTEMS:
      self->subsystems = parse_subsystem_list(arg);
      if (!self->subsystems)
	argp_error(state, "Invalid subsystem list.");
      break;

    case OPT_NO_SUBSYSTEMS:
      self->subsystems = NULL;
      break;
      
828
829
830
    case OPT_DAEMONIC:
      self->daemonic = 1;
      break;
831
      
832
833
834
835
    case OPT_NO_DAEMONIC:
      self->daemonic = 0;
      break;

836
837
838
839
    case OPT_NO_SYSLOG:
      self->no_syslog = 1;
      break;
      
840
841
842
843
844
845
846
847
848
849
850
851
    case OPT_PIDFILE:
      self->pid_file = arg;
      self->use_pid_file = 1;
      break;

    case OPT_NO_PIDFILE:
      self->use_pid_file = 0;
      break;

    case OPT_CORE:
      self->corefile = 1;
      break;
852
853
854
    }
  return 0;
}
Niels Möller's avatar
Niels Möller committed
855

Niels Möller's avatar
Niels Möller committed
856
857
858
859
860
861
static const struct argp
main_argp =
{ main_options, main_argp_parser, 
  NULL,
  "Server for the ssh-2 protocol.",
  main_argp_children,
862
  NULL, NULL
Niels Möller's avatar
Niels Möller committed
863
864
};

865

866
867
/* GABA:
   (expr
868
     (name make_lshd_listen)
869
     (params
870
       (handshake object handshake_info)
871
       (init object make_kexinit)
872
       (services object command) )
873
     (expr (lambda (options)
874
             (let ((keys (options2keys options)))
875
876
877
878
879
880
881
	       (close_on_sighup options
	         (listen_callback
	           (lambda (lv)
    	             (services (connection_handshake
    	           		  handshake
    	           		  (kexinit_filter init keys)
    	           		  keys 
882
				  (options2tcp_wrapper options lv))))
883
	           (options2local options) ))))))
884
885
*/

886

887
/* Invoked when starting the ssh-connection service */
888
889
/* GABA:
   (expr
890
     (name make_lshd_connection_service)
891
     (params
892
893
       (hooks object object_list))
     (expr
894
895
896
897
       (lambda (connection)
         ((progn hooks)
	    ; We have to initialize the connection
	    ; before adding handlers.
898
899
900
	    (init_connection_service
	      ; Disconnect if connection->user is NULL
	      (connection_require_userauth connection)))))))
901
902
*/

903
904
905
static void
do_terminate_callback(struct lsh_callback *s UNUSED)
{
906
  io_final();
907
908
909
910
911
912

  /* If we're using GCOV, just call exit(). That way, profiling info
   * is written properly when the process is terminated. */
#if !WITH_GCOV
  kill(getpid(), SIGKILL);
#endif
913
914
915
  exit(0);
}

916
static struct lsh_callback
917
sigterm_handler = { STATIC_HEADER, do_terminate_callback };
918
919

static void
920
install_signal_handlers(struct lshd_options *options)
921
{
922
923
924
  io_signal_handler(SIGTERM, &sigterm_handler);
  io_signal_handler(SIGHUP,
		    make_sighup_close_callback(options));
925
}
926

927
928
int
main(int argc, char **argv)
Niels Möller's avatar
Niels Möller committed
929
{
930
  struct lshd_options *options;
931

932
  io_init();
933
  
Niels Möller's avatar
Niels Möller committed
934
935
936
  /* For filtering messages. Could perhaps also be used when converting
   * strings to and from UTF8. */
  setlocale(LC_CTYPE, "");
937

938
939
  /* FIXME: Choose character set depending on the locale */
  set_local_charset(CHARSET_LATIN1);
940

941
  options = make_lshd_options();
942
943
944

  if (!options)
    return EXIT_FAILURE;
945
946

  install_signal_handlers(options);
947
  
Niels Möller's avatar
Niels Möller committed
948
  trace("Parsing options...\n");
Niels Möller's avatar
Niels Möller committed
949
  argp_parse(&main_argp, argc, argv, 0, NULL, options);
Niels Möller's avatar
Niels Möller committed
950
  trace("Parsing options... done\n");  
951

952
953
954
955
956
  if (!options->corefile && !daemon_disable_core())
    {
      werror("Disabling of core dumps failed.\n");
      return EXIT_FAILURE;
    }
957

958
959
960
961
962
963
  if (!options->random) 
    {
      werror("Failed to initialize randomness generator.\n");
      return EXIT_FAILURE;
    }
  
964
  if (options->daemonic)
965
    {
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
      if (options->no_syslog)
        {
          /* Just put process into the background. --no-syslog is an
           * inappropriate name */
          switch (fork())
            {
            case 0:
              /* Child */
              /* FIXME: Should we create a new process group, close our tty
               * and stdio, etc? */
              trace("forked into background. New pid: %i.\n", getpid());
              break;
              
            case -1:
              /* Error */
              werror("background_process: fork failed (errno = %i): %z\n",
                     errno, STRERROR(errno));
              break;
              
            default:
              /* Parent */
              _exit(EXIT_SUCCESS);
            }
        }
      else
        {
992
#if HAVE_SYSLOG
993
          set_error_syslog("lshd");
994
#else /* !HAVE_SYSLOG */
995
          werror("lshd: No syslog. Further messages will be directed to /dev/null.\n");
996
997
#endif /* !HAVE_SYSLOG */

998
999
1000
          switch (daemon_init())
            {
            case 0:
For faster browsing, not all history is shown. View entire blame