Differential D52749 Diff 162866 crypto/openssh/sshd-session.c

Changeset View

Standalone View

crypto/openssh/sshd-session.c

Show First 20 Lines • Show All 211 Lines • ▼ Show 20 Lines
/*		/*
* Signal handler for the alarm after the login grace period has expired.		* Signal handler for the alarm after the login grace period has expired.
* As usual, this may only take signal-safe actions, even though it is		* As usual, this may only take signal-safe actions, even though it is
* terminal.		* terminal.
*/		*/
static void		static void
grace_alarm_handler(int sig)		grace_alarm_handler(int sig)
{		{
		BLACKLIST_NOTIFY(the_active_state, BLACKLIST_AUTH_FAIL,
		"Grace period expired");
		jlduranAuthorUnsubmitted Not Done Inline Actions I just realized the text above the signal handler function. This probe should be removed: D53109 Sorry for the inconvenience. jlduran: I just realized the text above the signal handler function. This probe should be removed…
/*		/*
* Try to kill any processes that we have spawned, E.g. authorized		* Try to kill any processes that we have spawned, E.g. authorized
* keys command helpers or privsep children.		* keys command helpers or privsep children.
*/		*/
if (getpgid(0) == getpid()) {		if (getpgid(0) == getpid()) {
struct sigaction sa;		struct sigaction sa;

/* mask all other signals while in handler */		/* mask all other signals while in handler */
▲ Show 20 Lines • Show All 968 Lines • ▼ Show 20 Lines	#endif
/* We will not restart on SIGHUP since it no longer makes sense. */		/* We will not restart on SIGHUP since it no longer makes sense. */
ssh_signal(SIGALRM, SIG_DFL);		ssh_signal(SIGALRM, SIG_DFL);
ssh_signal(SIGHUP, SIG_DFL);		ssh_signal(SIGHUP, SIG_DFL);
ssh_signal(SIGTERM, SIG_DFL);		ssh_signal(SIGTERM, SIG_DFL);
ssh_signal(SIGQUIT, SIG_DFL);		ssh_signal(SIGQUIT, SIG_DFL);
ssh_signal(SIGCHLD, SIG_DFL);		ssh_signal(SIGCHLD, SIG_DFL);
ssh_signal(SIGINT, SIG_DFL);		ssh_signal(SIGINT, SIG_DFL);

		BLACKLIST_INIT();

/*		/*
* Register our connection. This turns encryption off because we do		* Register our connection. This turns encryption off because we do
* not have a key.		* not have a key.
*/		*/
if ((ssh = ssh_packet_set_connection(NULL, sock_in, sock_out)) == NULL)		if ((ssh = ssh_packet_set_connection(NULL, sock_in, sock_out)) == NULL)
fatal("Unable to create connection");		fatal("Unable to create connection");
the_active_state = ssh;		the_active_state = ssh;
ssh_packet_set_server(ssh);		ssh_packet_set_server(ssh);
▲ Show 20 Lines • Show All 60 Lines • ▼ Show 20 Lines	if (!debug_flag && options.login_grace_time > 0) {
itv.it_value.tv_sec += ujitter / 1000000;		itv.it_value.tv_sec += ujitter / 1000000;
itv.it_value.tv_usec = ujitter % 1000000;		itv.it_value.tv_usec = ujitter % 1000000;

if (setitimer(ITIMER_REAL, &itv, NULL) == -1)		if (setitimer(ITIMER_REAL, &itv, NULL) == -1)
fatal("login grace time setitimer failed");		fatal("login grace time setitimer failed");
}		}

if ((r = kex_exchange_identification(ssh, -1,		if ((r = kex_exchange_identification(ssh, -1,
options.version_addendum)) != 0)		options.version_addendum)) != 0) {
		BLACKLIST_NOTIFY(ssh, BLACKLIST_AUTH_FAIL, "Banner exchange");
sshpkt_fatal(ssh, r, "banner exchange");		sshpkt_fatal(ssh, r, "banner exchange");
		}

ssh_packet_set_nonblocking(ssh);		ssh_packet_set_nonblocking(ssh);

/* allocate authentication context */		/* allocate authentication context */
authctxt = xcalloc(1, sizeof(*authctxt));		authctxt = xcalloc(1, sizeof(*authctxt));
ssh->authctxt = authctxt;		ssh->authctxt = authctxt;

/* XXX global for cleanup, access from other modules */		/* XXX global for cleanup, access from other modules */
the_authctxt = authctxt;		the_authctxt = authctxt;

/* Set default key authentication options */		/* Set default key authentication options */
if ((auth_opts = sshauthopt_new_with_keys_defaults()) == NULL)		if ((auth_opts = sshauthopt_new_with_keys_defaults()) == NULL)
fatal("allocation failed");		fatal("allocation failed");

/* prepare buffer to collect messages to display to user after login */		/* prepare buffer to collect messages to display to user after login */
if ((loginmsg = sshbuf_new()) == NULL)		if ((loginmsg = sshbuf_new()) == NULL)
fatal("sshbuf_new loginmsg failed");		fatal("sshbuf_new loginmsg failed");
auth_debug_reset();		auth_debug_reset();

BLACKLIST_INIT();

if (privsep_preauth(ssh) != 1)		if (privsep_preauth(ssh) != 1)
fatal("privsep_preauth failed");		fatal("privsep_preauth failed");

/* Now user is authenticated */		/* Now user is authenticated */

/*		/*
* Cancel the alarm we set to limit the time taken for		* Cancel the alarm we set to limit the time taken for
* authentication.		* authentication.
▲ Show 20 Lines • Show All 109 Lines • ▼ Show 20 Lines	if (the_active_state != NULL && the_authctxt != NULL) {
}		}
}		}
#ifdef SSH_AUDIT_EVENTS		#ifdef SSH_AUDIT_EVENTS
/* done after do_cleanup so it can cancel the PAM auth 'thread' */		/* done after do_cleanup so it can cancel the PAM auth 'thread' */
if (the_active_state != NULL && mm_is_monitor())		if (the_active_state != NULL && mm_is_monitor())
audit_event(the_active_state, SSH_CONNECTION_ABANDON);		audit_event(the_active_state, SSH_CONNECTION_ABANDON);
#endif		#endif
/* Override default fatal exit value when auth was attempted */		/* Override default fatal exit value when auth was attempted */
if (i == 255 && auth_attempted)		if (i == 255 && auth_attempted) {
		BLACKLIST_NOTIFY(the_active_state, BLACKLIST_AUTH_FAIL,
		"Fatal exit");
_exit(EXIT_AUTH_ATTEMPTED);		_exit(EXIT_AUTH_ATTEMPTED);
		}
_exit(i);		_exit(i);
}		}