diff options
Diffstat (limited to 'sshconnect.c')
| -rw-r--r-- | sshconnect.c | 69 |
1 files changed, 20 insertions, 49 deletions
diff --git a/sshconnect.c b/sshconnect.c index 3805d35d98455..78813c164bcb8 100644 --- a/sshconnect.c +++ b/sshconnect.c @@ -1,4 +1,4 @@ -/* $OpenBSD: sshconnect.c,v 1.297 2018/02/23 15:58:38 markus Exp $ */ +/* $OpenBSD: sshconnect.c,v 1.304 2018/07/27 05:34:42 dtucker Exp $ */ /* * Author: Tatu Ylonen <ylo@cs.hut.fi> * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland @@ -49,14 +49,12 @@ #endif #include "xmalloc.h" -#include "key.h" #include "hostfile.h" #include "ssh.h" -#include "buffer.h" +#include "sshbuf.h" #include "packet.h" -#include "uidswap.h" #include "compat.h" -#include "key.h" +#include "sshkey.h" #include "sshconnect.h" #include "hostfile.h" #include "log.h" @@ -82,8 +80,6 @@ static pid_t proxy_command_pid = 0; /* import */ extern Options options; extern char *__progname; -extern uid_t original_real_uid; -extern uid_t original_effective_uid; static int show_other_keys(struct hostkeys *, struct sshkey *); static void warn_changed_key(struct sshkey *); @@ -131,9 +127,6 @@ ssh_proxy_fdpass_connect(struct ssh *ssh, const char *host, u_short port, if ((pid = fork()) == 0) { char *argv[10]; - /* Child. Permanently give up superuser privileges. */ - permanently_drop_suid(original_real_uid); - close(sp[1]); /* Redirect stdin and stdout. */ if (sp[0] != 0) { @@ -213,9 +206,6 @@ ssh_proxy_connect(struct ssh *ssh, const char *host, u_short port, if ((pid = fork()) == 0) { char *argv[10]; - /* Child. Permanently give up superuser privileges. */ - permanently_drop_suid(original_real_uid); - /* Redirect stdin and stdout. */ close(pin[1]); if (pin[0] != 0) { @@ -277,7 +267,7 @@ ssh_kill_proxy_command(void) #ifdef HAVE_IFADDRS_H /* * Search a interface address list (returned from getifaddrs(3)) for an - * address that matches the desired address family on the specifed interface. + * address that matches the desired address family on the specified interface. * Returns 0 and fills in *resultp and *rlenp on success. Returns -1 on failure. */ static int @@ -338,12 +328,12 @@ check_ifaddrs(const char *ifname, int af, const struct ifaddrs *ifaddrs, #endif /* - * Creates a (possibly privileged) socket for use as the ssh connection. + * Creates a socket for use as the ssh connection. */ static int -ssh_create_socket(int privileged, struct addrinfo *ai) +ssh_create_socket(struct addrinfo *ai) { - int sock, r, oerrno; + int sock, r; struct sockaddr_storage bindaddr; socklen_t bindaddrlen = 0; struct addrinfo hints, *res = NULL; @@ -360,8 +350,7 @@ ssh_create_socket(int privileged, struct addrinfo *ai) fcntl(sock, F_SETFD, FD_CLOEXEC); /* Bind the socket to an alternative local IP address */ - if (options.bind_address == NULL && options.bind_interface == NULL && - !privileged) + if (options.bind_address == NULL && options.bind_interface == NULL) return sock; if (options.bind_address != NULL) { @@ -410,22 +399,7 @@ ssh_create_socket(int privileged, struct addrinfo *ai) ssh_gai_strerror(r)); goto fail; } - /* - * If we are running as root and want to connect to a privileged - * port, bind our own socket to a privileged port. - */ - if (privileged) { - PRIV_START; - r = bindresvport_sa(sock, - bindaddrlen == 0 ? NULL : (struct sockaddr *)&bindaddr); - oerrno = errno; - PRIV_END; - if (r < 0) { - error("bindresvport_sa %s: %s", ntop, - strerror(oerrno)); - goto fail; - } - } else if (bind(sock, (struct sockaddr *)&bindaddr, bindaddrlen) != 0) { + if (bind(sock, (struct sockaddr *)&bindaddr, bindaddrlen) != 0) { error("bind %s: %s", ntop, strerror(errno)); goto fail; } @@ -515,9 +489,7 @@ timeout_connect(int sockfd, const struct sockaddr *serv_addr, /* * Opens a TCP/IP connection to the remote server on the given host. * The address of the remote host will be returned in hostaddr. - * If port is 0, the default port will be used. If needpriv is true, - * a privileged port will be allocated to make the connection. - * This requires super-user privileges if needpriv is true. + * If port is 0, the default port will be used. * Connection_attempts specifies the maximum number of tries (one per * second). If proxy_command is non-NULL, it specifies the command (with %h * and %p substituted for host and port, respectively) to use to contact @@ -526,14 +498,14 @@ timeout_connect(int sockfd, const struct sockaddr *serv_addr, static int ssh_connect_direct(struct ssh *ssh, const char *host, struct addrinfo *aitop, struct sockaddr_storage *hostaddr, u_short port, int family, - int connection_attempts, int *timeout_ms, int want_keepalive, int needpriv) + int connection_attempts, int *timeout_ms, int want_keepalive) { int on = 1; int oerrno, sock = -1, attempt; char ntop[NI_MAXHOST], strport[NI_MAXSERV]; struct addrinfo *ai; - debug2("%s: needpriv %d", __func__, needpriv); + debug2("%s", __func__); memset(ntop, 0, sizeof(ntop)); memset(strport, 0, sizeof(strport)); @@ -565,7 +537,7 @@ ssh_connect_direct(struct ssh *ssh, const char *host, struct addrinfo *aitop, host, ntop, strport); /* Create a socket for connecting. */ - sock = ssh_create_socket(needpriv, ai); + sock = ssh_create_socket(ai); if (sock < 0) { /* Any error is already output */ errno = 0; @@ -615,12 +587,11 @@ ssh_connect_direct(struct ssh *ssh, const char *host, struct addrinfo *aitop, int ssh_connect(struct ssh *ssh, const char *host, struct addrinfo *addrs, struct sockaddr_storage *hostaddr, u_short port, int family, - int connection_attempts, int *timeout_ms, int want_keepalive, int needpriv) + int connection_attempts, int *timeout_ms, int want_keepalive) { if (options.proxy_command == NULL) { return ssh_connect_direct(ssh, host, addrs, hostaddr, port, - family, connection_attempts, timeout_ms, want_keepalive, - needpriv); + family, connection_attempts, timeout_ms, want_keepalive); } else if (strcmp(options.proxy_command, "-") == 0) { if ((ssh_packet_set_connection(ssh, STDIN_FILENO, STDOUT_FILENO)) == NULL) @@ -767,11 +738,11 @@ check_host_cert(const char *host, const struct sshkey *host_key) { const char *reason; - if (key_cert_check_authority(host_key, 1, 0, host, &reason) != 0) { + if (sshkey_cert_check_authority(host_key, 1, 0, host, &reason) != 0) { error("%s", reason); return 0; } - if (buffer_len(host_key->cert->critical) != 0) { + if (sshbuf_len(host_key->cert->critical) != 0) { error("Certificate for %s contains unsupported " "critical options(s)", host); return 0; @@ -1496,9 +1467,9 @@ show_other_keys(struct hostkeys *hostkeys, struct sshkey *key) logit("WARNING: %s key found for host %s\n" "in %s:%lu\n" "%s key fingerprint %s.", - key_type(found->key), + sshkey_type(found->key), found->host, found->file, found->line, - key_type(found->key), fp); + sshkey_type(found->key), fp); if (options.visual_host_key) logit("%s", ra); free(ra); @@ -1525,7 +1496,7 @@ warn_changed_key(struct sshkey *host_key) error("Someone could be eavesdropping on you right now (man-in-the-middle attack)!"); error("It is also possible that a host key has just been changed."); error("The fingerprint for the %s key sent by the remote host is\n%s.", - key_type(host_key), fp); + sshkey_type(host_key), fp); error("Please contact your system administrator."); free(fp); |