Source-Changes-HG archive
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index][Old Index]
[src/trunk]: src/crypto/external/bsd/openssh/dist More fixes from upstream:
details: https://anonhg.NetBSD.org/src/rev/66d60b71b5a5
branches: trunk
changeset: 813168:66d60b71b5a5
user: christos <christos%NetBSD.org@localhost>
date: Tue Jan 19 17:10:55 2016 +0000
description:
More fixes from upstream:
- X connection forwarding fixes
- more explicit_bzero
- more closing file descriptors
XXX: pullup-7
diffstat:
crypto/external/bsd/openssh/dist/clientloop.c | 120 +++++++++------
crypto/external/bsd/openssh/dist/clientloop.h | 4 +-
crypto/external/bsd/openssh/dist/mux.c | 24 +-
crypto/external/bsd/openssh/dist/ssh.c | 25 +--
crypto/external/bsd/openssh/dist/sshbuf-getput-crypto.c | 12 +-
crypto/external/bsd/openssh/dist/sshbuf.c | 12 +-
crypto/external/bsd/openssh/dist/sshconnect.c | 5 +-
crypto/external/bsd/openssh/dist/sshconnect2.c | 5 +-
crypto/external/bsd/openssh/dist/version.h | 4 +-
9 files changed, 114 insertions(+), 97 deletions(-)
diffs (truncated from 493 to 300 lines):
diff -r 9580b55851a1 -r 66d60b71b5a5 crypto/external/bsd/openssh/dist/clientloop.c
--- a/crypto/external/bsd/openssh/dist/clientloop.c Tue Jan 19 16:47:44 2016 +0000
+++ b/crypto/external/bsd/openssh/dist/clientloop.c Tue Jan 19 17:10:55 2016 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: clientloop.c,v 1.16 2016/01/14 22:30:04 christos Exp $ */
+/* $NetBSD: clientloop.c,v 1.17 2016/01/19 17:10:55 christos Exp $ */
/* $OpenBSD: clientloop.c,v 1.275 2015/07/10 06:21:53 markus Exp $ */
/*
* Author: Tatu Ylonen <ylo%cs.hut.fi@localhost>
@@ -61,7 +61,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: clientloop.c,v 1.16 2016/01/14 22:30:04 christos Exp $");
+__RCSID("$NetBSD: clientloop.c,v 1.17 2016/01/19 17:10:55 christos Exp $");
#include <sys/param.h> /* MIN MAX */
#include <sys/types.h>
@@ -283,6 +283,9 @@
{
size_t i, dlen;
+ if (display == NULL)
+ return 0;
+
dlen = strlen(display);
for (i = 0; i < dlen; i++) {
if (!isalnum((u_char)display[i]) &&
@@ -296,35 +299,33 @@
#define SSH_X11_PROTO "MIT-MAGIC-COOKIE-1"
#define X11_TIMEOUT_SLACK 60
-void
+int
client_x11_get_proto(const char *display, const char *xauth_path,
u_int trusted, u_int timeout, char **_proto, char **_data)
{
- char cmd[1024];
- char line[512];
- char xdisplay[512];
+ char cmd[1024], line[512], xdisplay[512];
+ char xauthfile[PATH_MAX], xauthdir[PATH_MAX];
static char proto[512], data[512];
FILE *f;
- int got_data = 0, generated = 0, do_unlink = 0, i;
- char *xauthdir, *xauthfile;
+ int got_data = 0, generated = 0, do_unlink = 0, i, r;
struct stat st;
u_int now, x11_timeout_real;
- xauthdir = xauthfile = NULL;
*_proto = proto;
*_data = data;
- proto[0] = data[0] = '\0';
+ proto[0] = data[0] = xauthfile[0] = xauthdir[0] = '\0';
- if (xauth_path == NULL ||(stat(xauth_path, &st) == -1)) {
+ if (!client_x11_display_valid(display)) {
+ logit("DISPLAY \"%s\" invalid; disabling X11 forwarding",
+ display);
+ return -1;
+ }
+ if (xauth_path != NULL && stat(xauth_path, &st) == -1) {
debug("No xauth program.");
- } else if (!client_x11_display_valid(display)) {
- logit("DISPLAY '%s' invalid, falling back to fake xauth data",
- display);
- } else {
- if (display == NULL) {
- debug("x11_get_proto: DISPLAY not set");
- return;
- }
+ xauth_path = NULL;
+ }
+
+ if (xauth_path != NULL) {
/*
* Handle FamilyLocal case where $DISPLAY does
* not match an authorization entry. For this we
@@ -338,40 +339,52 @@
display = xdisplay;
}
if (trusted == 0) {
- xauthdir = xmalloc(PATH_MAX);
- xauthfile = xmalloc(PATH_MAX);
- mktemp_proto(xauthdir, PATH_MAX);
/*
- * The authentication cookie should briefly outlive
- * ssh's willingness to forward X11 connections to
- * avoid nasty fail-open behaviour in the X server.
+ * Generate an untrusted X11 auth cookie.
+ *
+ * The authentication cookie should briefly outlive
+ * ssh's willingness to forward X11 connections to
+ * avoid nasty fail-open behaviour in the X server.
*/
+ mktemp_proto(xauthdir, sizeof(xauthdir));
+ if (mkdtemp(xauthdir) == NULL) {
+ error("%s: mkdtemp: %s",
+ __func__, strerror(errno));
+ return -1;
+ }
+ do_unlink = 1;
+ if ((r = snprintf(xauthfile, sizeof(xauthfile),
+ "%s/xauthfile", xauthdir)) < 0 ||
+ (size_t)r >= sizeof(xauthfile)) {
+ error("%s: xauthfile path too long", __func__);
+ unlink(xauthfile);
+ rmdir(xauthdir);
+ return -1;
+ }
+
if (timeout >= UINT_MAX - X11_TIMEOUT_SLACK)
x11_timeout_real = UINT_MAX;
else
x11_timeout_real = timeout + X11_TIMEOUT_SLACK;
- if (mkdtemp(xauthdir) != NULL) {
- do_unlink = 1;
- snprintf(xauthfile, PATH_MAX, "%s/xauthfile",
- xauthdir);
- snprintf(cmd, sizeof(cmd),
- "%s -f %s generate %s " SSH_X11_PROTO
- " untrusted timeout %u 2>" _PATH_DEVNULL,
- xauth_path, xauthfile, display,
- x11_timeout_real);
- debug2("x11_get_proto: %s", cmd);
- if (x11_refuse_time == 0) {
- now = monotime() + 1;
- if (UINT_MAX - timeout < now)
- x11_refuse_time = UINT_MAX;
- else
- x11_refuse_time = now + timeout;
- channel_set_x11_refuse_time(
- x11_refuse_time);
- }
- if (system(cmd) == 0)
- generated = 1;
+
+ if ((r = snprintf(cmd, sizeof(cmd),
+ "%s -f %s generate %s " SSH_X11_PROTO
+ " untrusted timeout %u 2>" _PATH_DEVNULL,
+ xauth_path, xauthfile, display,
+ x11_timeout_real)) < 0 ||
+ (size_t)r >= sizeof(cmd))
+ fatal("%s: cmd too long", __func__);
+ debug2("%s: %s", __func__, cmd);
+ if (x11_refuse_time == 0) {
+ now = monotime() + 1;
+ if (UINT_MAX - timeout < now)
+ x11_refuse_time = UINT_MAX;
+ else
+ x11_refuse_time = now + timeout;
+ channel_set_x11_refuse_time(x11_refuse_time);
}
+ if (system(cmd) == 0)
+ generated = 1;
}
/*
@@ -393,17 +406,20 @@
got_data = 1;
if (f)
pclose(f);
- } else
- error("Warning: untrusted X11 forwarding setup failed: "
- "xauth key data not generated");
+ }
}
if (do_unlink) {
unlink(xauthfile);
rmdir(xauthdir);
}
- free(xauthdir);
- free(xauthfile);
+
+ /* Don't fall back to fake X11 data for untrusted forwarding */
+ if (!trusted && !got_data) {
+ error("Warning: untrusted X11 forwarding setup failed: "
+ "xauth key data not generated");
+ return -1;
+ }
/*
* If we didn't get authentication data, just make up some
@@ -427,6 +443,8 @@
rnd >>= 8;
}
}
+
+ return 0;
}
/*
diff -r 9580b55851a1 -r 66d60b71b5a5 crypto/external/bsd/openssh/dist/clientloop.h
--- a/crypto/external/bsd/openssh/dist/clientloop.h Tue Jan 19 16:47:44 2016 +0000
+++ b/crypto/external/bsd/openssh/dist/clientloop.h Tue Jan 19 17:10:55 2016 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: clientloop.h,v 1.10 2015/04/03 23:58:19 christos Exp $ */
+/* $NetBSD: clientloop.h,v 1.11 2016/01/19 17:10:55 christos Exp $ */
/* $OpenBSD: clientloop.h,v 1.31 2013/06/02 23:36:29 dtucker Exp $ */
/*
@@ -40,7 +40,7 @@
/* Client side main loop for the interactive session. */
int client_loop(int, int, int);
-void client_x11_get_proto(const char *, const char *, u_int, u_int,
+int client_x11_get_proto(const char *, const char *, u_int, u_int,
char **, char **);
void client_global_request_reply_fwd(int, u_int32_t, void *);
void client_session2_setup(int, int, int, const char *, struct termios *,
diff -r 9580b55851a1 -r 66d60b71b5a5 crypto/external/bsd/openssh/dist/mux.c
--- a/crypto/external/bsd/openssh/dist/mux.c Tue Jan 19 16:47:44 2016 +0000
+++ b/crypto/external/bsd/openssh/dist/mux.c Tue Jan 19 17:10:55 2016 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: mux.c,v 1.13 2015/08/21 08:20:59 christos Exp $ */
+/* $NetBSD: mux.c,v 1.14 2016/01/19 17:10:55 christos Exp $ */
/* $OpenBSD: mux.c,v 1.54 2015/08/19 23:18:26 djm Exp $ */
/*
* Copyright (c) 2002-2008 Damien Miller <djm%openbsd.org@localhost>
@@ -32,7 +32,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: mux.c,v 1.13 2015/08/21 08:20:59 christos Exp $");
+__RCSID("$NetBSD: mux.c,v 1.14 2016/01/19 17:10:55 christos Exp $");
#include <sys/types.h>
#include <sys/queue.h>
#include <sys/stat.h>
@@ -1344,16 +1344,18 @@
char *proto, *data;
/* Get reasonable local authentication information. */
- client_x11_get_proto(display, options.xauth_location,
+ if (client_x11_get_proto(display, options.xauth_location,
options.forward_x11_trusted, options.forward_x11_timeout,
- &proto, &data);
- /* Request forwarding with authentication spoofing. */
- debug("Requesting X11 forwarding with authentication "
- "spoofing.");
- x11_request_forwarding_with_spoofing(id, display, proto,
- data, 1);
- client_expect_confirm(id, "X11 forwarding", CONFIRM_WARN);
- /* XXX exit_on_forward_failure */
+ &proto, &data) == 0) {
+ /* Request forwarding with authentication spoofing. */
+ debug("Requesting X11 forwarding with authentication "
+ "spoofing.");
+ x11_request_forwarding_with_spoofing(id, display, proto,
+ data, 1);
+ /* XXX exit_on_forward_failure */
+ client_expect_confirm(id, "X11 forwarding",
+ CONFIRM_WARN);
+ }
}
if (cctx->want_agent_fwd && options.forward_agent) {
diff -r 9580b55851a1 -r 66d60b71b5a5 crypto/external/bsd/openssh/dist/ssh.c
--- a/crypto/external/bsd/openssh/dist/ssh.c Tue Jan 19 16:47:44 2016 +0000
+++ b/crypto/external/bsd/openssh/dist/ssh.c Tue Jan 19 17:10:55 2016 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: ssh.c,v 1.20 2016/01/14 22:30:04 christos Exp $ */
+/* $NetBSD: ssh.c,v 1.21 2016/01/19 17:10:55 christos Exp $ */
/* $OpenBSD: ssh.c,v 1.420 2015/07/30 00:01:34 djm Exp $ */
/*
* Author: Tatu Ylonen <ylo%cs.hut.fi@localhost>
@@ -42,7 +42,7 @@
*/
#include "includes.h"
-__RCSID("$NetBSD: ssh.c,v 1.20 2016/01/14 22:30:04 christos Exp $");
+__RCSID("$NetBSD: ssh.c,v 1.21 2016/01/19 17:10:55 christos Exp $");
#include <sys/types.h>
#include <sys/param.h>
#include <sys/ioctl.h>
@@ -1563,6 +1563,7 @@
int have_tty = 0;
struct winsize ws;
const char *display;
+ char *proto = NULL, *data = NULL;
/* Enable compression if requested. */
if (options.compression) {
@@ -1634,13 +1635,9 @@
display = getenv("DISPLAY");
if (display == NULL && options.forward_x11)
debug("X11 forwarding requested but DISPLAY not set");
- if (options.forward_x11 && display != NULL) {
- char *proto, *data;
- /* Get reasonable local authentication information. */
- client_x11_get_proto(display, options.xauth_location,
- options.forward_x11_trusted,
- options.forward_x11_timeout,
- &proto, &data);
+ if (options.forward_x11 && client_x11_get_proto(display,
+ options.xauth_location, options.forward_x11_trusted,
+ options.forward_x11_timeout, &proto, &data) == 0) {
/* Request forwarding with authentication spoofing. */
debug("Requesting X11 forwarding with authentication "
Home |
Main Index |
Thread Index |
Old Index