kentpeacock / rpms / openssh

Forked from rpms/openssh 2 years ago
Clone
1d31ef
diff -up openssh-7.4p1/log.c.log-in-chroot openssh-7.4p1/log.c
1d31ef
--- openssh-7.4p1/log.c.log-in-chroot	2016-12-19 05:59:41.000000000 +0100
1d31ef
+++ openssh-7.4p1/log.c	2017-02-09 09:51:07.571909000 +0100
1d31ef
@@ -250,6 +250,11 @@ debug3(const char *fmt,...)
017ff1
 void
017ff1
 log_init(char *av0, LogLevel level, SyslogFacility facility, int on_stderr)
017ff1
 {
017ff1
+	log_init_handler(av0, level, facility, on_stderr, 1);
017ff1
+}
017ff1
+
017ff1
+void
017ff1
+log_init_handler(char *av0, LogLevel level, SyslogFacility facility, int on_stderr, int reset_handler) {
017ff1
 #if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT)
017ff1
 	struct syslog_data sdata = SYSLOG_DATA_INIT;
017ff1
 #endif
1d31ef
@@ -273,8 +278,10 @@ log_init(char *av0, LogLevel level, Sysl
017ff1
 		exit(1);
017ff1
 	}
017ff1
 
017ff1
-	log_handler = NULL;
017ff1
-	log_handler_ctx = NULL;
017ff1
+	if (reset_handler) {
017ff1
+		log_handler = NULL;
017ff1
+		log_handler_ctx = NULL;
017ff1
+	}
017ff1
 
017ff1
 	log_on_stderr = on_stderr;
017ff1
 	if (on_stderr)
1d31ef
diff -up openssh-7.4p1/log.h.log-in-chroot openssh-7.4p1/log.h
1d31ef
--- openssh-7.4p1/log.h.log-in-chroot	2016-12-19 05:59:41.000000000 +0100
1d31ef
+++ openssh-7.4p1/log.h	2017-02-09 09:51:07.571909000 +0100
017ff1
@@ -49,6 +49,7 @@ typedef enum {
017ff1
 typedef void (log_handler_fn)(LogLevel, const char *, void *);
017ff1
 
017ff1
 void     log_init(char *, LogLevel, SyslogFacility, int);
017ff1
+void     log_init_handler(char *, LogLevel, SyslogFacility, int, int);
017ff1
 void     log_change_level(LogLevel);
017ff1
 int      log_is_on_stderr(void);
017ff1
 void     log_redirect_stderr_to(const char *);
1d31ef
diff -up openssh-7.4p1/monitor.c.log-in-chroot openssh-7.4p1/monitor.c
1d31ef
--- openssh-7.4p1/monitor.c.log-in-chroot	2017-02-09 09:51:07.554909017 +0100
1d31ef
+++ openssh-7.4p1/monitor.c	2017-02-09 10:05:21.067174230 +0100
1d31ef
@@ -307,6 +307,8 @@ monitor_child_preauth(Authctxt *_authctx
017ff1
 	close(pmonitor->m_log_sendfd);
017ff1
 	pmonitor->m_log_sendfd = pmonitor->m_recvfd = -1;
017ff1
 
017ff1
+	pmonitor->m_state = "preauth";
017ff1
+
017ff1
 	authctxt = _authctxt;
017ff1
 	memset(authctxt, 0, sizeof(*authctxt));
017ff1
 
1d31ef
@@ -405,6 +407,8 @@ monitor_child_postauth(struct monitor *p
017ff1
 	close(pmonitor->m_recvfd);
017ff1
 	pmonitor->m_recvfd = -1;
017ff1
 
017ff1
+	pmonitor->m_state = "postauth";
017ff1
+
017ff1
 	monitor_set_child_handler(pmonitor->m_pid);
017ff1
 	signal(SIGHUP, &monitor_child_handler);
017ff1
 	signal(SIGTERM, &monitor_child_handler);
1d31ef
@@ -472,7 +476,7 @@ monitor_read_log(struct monitor *pmonito
017ff1
 	if (log_level_name(level) == NULL)
017ff1
 		fatal("%s: invalid log level %u (corrupted message?)",
017ff1
 		    __func__, level);
017ff1
-	do_log2(level, "%s [preauth]", msg);
017ff1
+	do_log2(level, "%s [%s]", msg, pmonitor->m_state);
017ff1
 
017ff1
 	buffer_free(&logmsg);
017ff1
 	free(msg);
1d31ef
@@ -1719,13 +1723,28 @@ monitor_init(void)
1d31ef
 	mon = xcalloc(1, sizeof(*mon));
1d31ef
 	monitor_openfds(mon, 1);
017ff1
 
017ff1
+	mon->m_state = "";
017ff1
+
017ff1
 	return mon;
017ff1
 }
017ff1
 
017ff1
 void
017ff1
-monitor_reinit(struct monitor *mon)
017ff1
+monitor_reinit(struct monitor *mon, const char *chroot_dir)
017ff1
 {
017ff1
-	monitor_openfds(mon, 0);
017ff1
+	struct stat dev_log_stat;
017ff1
+	char *dev_log_path;
017ff1
+	int do_logfds = 0;
017ff1
+
017ff1
+	if (chroot_dir != NULL) {
017ff1
+		xasprintf(&dev_log_path, "%s/dev/log", chroot_dir);
017ff1
+
017ff1
+		if (stat(dev_log_path, &dev_log_stat) != 0) {
017ff1
+			debug("%s: /dev/log doesn't exist in %s chroot - will try to log via monitor using [postauth] suffix", __func__, chroot_dir);
017ff1
+			do_logfds = 1;
017ff1
+		}
017ff1
+		free(dev_log_path);
017ff1
+	}
017ff1
+	monitor_openfds(mon, do_logfds);
017ff1
 }
017ff1
 
017ff1
 #ifdef GSSAPI
1d31ef
diff -up openssh-7.4p1/monitor.h.log-in-chroot openssh-7.4p1/monitor.h
1d31ef
--- openssh-7.4p1/monitor.h.log-in-chroot	2017-02-09 09:51:07.571909000 +0100
1d31ef
+++ openssh-7.4p1/monitor.h	2017-02-09 10:05:49.792146561 +0100
017ff1
@@ -83,10 +83,11 @@ struct monitor {
1d31ef
 	int			 m_log_sendfd;
1d31ef
 	struct kex		**m_pkex;
017ff1
 	pid_t			 m_pid;
017ff1
+	char		*m_state;
017ff1
 };
017ff1
 
017ff1
 struct monitor *monitor_init(void);
017ff1
-void monitor_reinit(struct monitor *);
017ff1
+void monitor_reinit(struct monitor *, const char *);
017ff1
 
017ff1
 struct Authctxt;
1d31ef
 void monitor_child_preauth(struct Authctxt *, struct monitor *);
1d31ef
diff -up openssh-7.4p1/session.c.log-in-chroot openssh-7.4p1/session.c
1d31ef
--- openssh-7.4p1/session.c.log-in-chroot	2017-02-09 09:51:07.570909002 +0100
1d31ef
+++ openssh-7.4p1/session.c	2017-02-09 10:08:16.241005497 +0100
1d31ef
@@ -160,6 +160,7 @@ login_cap_t *lc;
017ff1
 
017ff1
 static int is_child = 0;
1d31ef
 static int in_chroot = 0;
017ff1
+static int have_dev_log = 1;
1d31ef
 
017ff1
 /* Name and directory of socket for authentication agent forwarding. */
017ff1
 static char *auth_sock_name = NULL;
1d31ef
@@ -365,8 +366,8 @@ do_exec_no_pty(Session *s, const char *c
017ff1
 		is_child = 1;
017ff1
 
017ff1
 		/* Child.  Reinitialize the log since the pid has changed. */
017ff1
-		log_init(__progname, options.log_level,
017ff1
-		    options.log_facility, log_stderr);
017ff1
+		log_init_handler(__progname, options.log_level,
017ff1
+		    options.log_facility, log_stderr, have_dev_log);
017ff1
 
017ff1
 		/*
017ff1
 		 * Create a new session and process group since the 4.4BSD
1d31ef
@@ -523,8 +524,8 @@ do_exec_pty(Session *s, const char *comm
017ff1
 		close(ptymaster);
017ff1
 
017ff1
 		/* Child.  Reinitialize the log because the pid has changed. */
017ff1
-		log_init(__progname, options.log_level,
017ff1
-		    options.log_facility, log_stderr);
017ff1
+		log_init_handler(__progname, options.log_level,
017ff1
+		    options.log_facility, log_stderr, have_dev_log);
017ff1
 		/* Close the master side of the pseudo tty. */
017ff1
 		close(ptyfd);
017ff1
 
1d31ef
@@ -619,6 +620,7 @@ do_exec(Session *s, const char *command)
017ff1
 	int ret;
1d31ef
 	const char *forced = NULL, *tty = NULL;
1d31ef
 	char session_type[1024];
017ff1
+	struct stat dev_log_stat;
017ff1
 
017ff1
 	if (options.adm_forced_command) {
017ff1
 		original_command = command;
1d31ef
@@ -676,6 +678,10 @@ do_exec(Session *s, const char *command)
017ff1
 			tty += 5;
017ff1
 	}
017ff1
 
017ff1
+	if (lstat("/dev/log", &dev_log_stat) != 0) {
017ff1
+		have_dev_log = 0;
017ff1
+	}
017ff1
+
1d31ef
 	verbose("Starting session: %s%s%s for %s from %.200s port %d id %d",
017ff1
 	    session_type,
017ff1
 	    tty == NULL ? "" : " on ",
1d31ef
@@ -1490,14 +1496,6 @@ child_close_fds(void)
017ff1
 	 * descriptors left by system functions.  They will be closed later.
017ff1
 	 */
017ff1
 	endpwent();
017ff1
-
017ff1
-	/*
017ff1
-	 * Close any extra open file descriptors so that we don't have them
017ff1
-	 * hanging around in clients.  Note that we want to do this after
017ff1
-	 * initgroups, because at least on Solaris 2.3 it leaves file
017ff1
-	 * descriptors open.
017ff1
-	 */
017ff1
-	closefrom(STDERR_FILENO + 1);
017ff1
 }
017ff1
 
017ff1
 /*
1d31ef
@@ -1633,8 +1631,6 @@ do_child(Session *s, const char *command
017ff1
 			exit(1);
017ff1
 	}
017ff1
 
017ff1
-	closefrom(STDERR_FILENO + 1);
017ff1
-
1d31ef
 	do_rc_files(s, shell);
017ff1
 
1d31ef
 	/* restore SIGPIPE for child */
1d31ef
@@ -1658,9 +1654,17 @@ do_child(Session *s, const char *command
017ff1
 		argv[i] = NULL;
017ff1
 		optind = optreset = 1;
017ff1
 		__progname = argv[0];
017ff1
-		exit(sftp_server_main(i, argv, s->pw));
017ff1
+		exit(sftp_server_main(i, argv, s->pw, have_dev_log));
017ff1
 	}
017ff1
 
017ff1
+	/*
017ff1
+	 * Close any extra open file descriptors so that we don't have them
017ff1
+	 * hanging around in clients.  Note that we want to do this after
017ff1
+	 * initgroups, because at least on Solaris 2.3 it leaves file
017ff1
+	 * descriptors open.
017ff1
+	 */
017ff1
+	closefrom(STDERR_FILENO + 1);
017ff1
+
017ff1
 	fflush(NULL);
017ff1
 
1d31ef
 	/* Get the last component of the shell name. */
1d31ef
diff -up openssh-7.4p1/sftp.h.log-in-chroot openssh-7.4p1/sftp.h
1d31ef
--- openssh-7.4p1/sftp.h.log-in-chroot	2016-12-19 05:59:41.000000000 +0100
1d31ef
+++ openssh-7.4p1/sftp.h	2017-02-09 09:51:07.572908999 +0100
1d31ef
@@ -97,5 +97,5 @@
017ff1
 
1d31ef
 struct passwd;
1d31ef
 
1d31ef
-int	sftp_server_main(int, char **, struct passwd *);
1d31ef
+int	sftp_server_main(int, char **, struct passwd *, int);
1d31ef
 void	sftp_server_cleanup_exit(int) __attribute__((noreturn));
1d31ef
diff -up openssh-7.4p1/sftp-server.c.log-in-chroot openssh-7.4p1/sftp-server.c
1d31ef
--- openssh-7.4p1/sftp-server.c.log-in-chroot	2017-02-09 09:51:07.572908999 +0100
1d31ef
+++ openssh-7.4p1/sftp-server.c	2017-02-09 10:09:39.662925141 +0100
1d31ef
@@ -1497,7 +1497,7 @@ sftp_server_usage(void)
017ff1
 }
017ff1
 
017ff1
 int
017ff1
-sftp_server_main(int argc, char **argv, struct passwd *user_pw)
017ff1
+sftp_server_main(int argc, char **argv, struct passwd *user_pw, int reset_handler)
017ff1
 {
017ff1
 	fd_set *rset, *wset;
1d31ef
 	int i, r, in, out, max, ch, skipargs = 0, log_stderr = 0;
1d31ef
@@ -1511,7 +1511,7 @@ sftp_server_main(int argc, char **argv,
017ff1
 
1d31ef
 	ssh_malloc_init();	/* must be called before any mallocs */
017ff1
 	__progname = ssh_get_progname(argv[0]);
017ff1
-	log_init(__progname, log_level, log_facility, log_stderr);
017ff1
+	log_init_handler(__progname, log_level, log_facility, log_stderr, reset_handler);
017ff1
 
017ff1
 	pw = pwcopy(user_pw);
017ff1
 
1d31ef
@@ -1582,7 +1582,7 @@ sftp_server_main(int argc, char **argv,
017ff1
 		}
017ff1
 	}
017ff1
 
017ff1
-	log_init(__progname, log_level, log_facility, log_stderr);
017ff1
+	log_init_handler(__progname, log_level, log_facility, log_stderr, reset_handler);
017ff1
 
1d31ef
 	/*
1d31ef
 	 * On platforms where we can, avoid making /proc/self/{mem,maps}
1d31ef
diff -up openssh-7.4p1/sftp-server-main.c.log-in-chroot openssh-7.4p1/sftp-server-main.c
1d31ef
--- openssh-7.4p1/sftp-server-main.c.log-in-chroot	2016-12-19 05:59:41.000000000 +0100
1d31ef
+++ openssh-7.4p1/sftp-server-main.c	2017-02-09 09:51:07.572908999 +0100
1d31ef
@@ -49,5 +49,5 @@ main(int argc, char **argv)
1d31ef
 		return 1;
1d31ef
 	}
017ff1
 
1d31ef
-	return (sftp_server_main(argc, argv, user_pw));
1d31ef
+	return (sftp_server_main(argc, argv, user_pw, 0));
1d31ef
 }
1d31ef
diff -up openssh-7.4p1/sshd.c.log-in-chroot openssh-7.4p1/sshd.c
1d31ef
--- openssh-7.4p1/sshd.c.log-in-chroot	2017-02-09 09:51:07.557909015 +0100
1d31ef
+++ openssh-7.4p1/sshd.c	2017-02-09 09:51:07.573908998 +0100
1d31ef
@@ -642,7 +642,7 @@ privsep_postauth(Authctxt *authctxt)
017ff1
 	}
017ff1
 
017ff1
 	/* New socket pair */
017ff1
-	monitor_reinit(pmonitor);
017ff1
+	monitor_reinit(pmonitor, options.chroot_directory);
017ff1
 
017ff1
 	pmonitor->m_pid = fork();
017ff1
 	if (pmonitor->m_pid == -1)
1d31ef
@@ -660,6 +660,11 @@ privsep_postauth(Authctxt *authctxt)
017ff1
 
017ff1
 	close(pmonitor->m_sendfd);
017ff1
 	pmonitor->m_sendfd = -1;
017ff1
+	close(pmonitor->m_log_recvfd);
017ff1
+	pmonitor->m_log_recvfd = -1;
017ff1
+
017ff1
+	if (pmonitor->m_log_sendfd != -1)
017ff1
+		set_log_handler(mm_log_handler, pmonitor);
017ff1
 
017ff1
 	/* Demote the private keys to public keys. */
017ff1
 	demote_sensitive_data();