kentpeacock / rpms / openssh

Forked from rpms/openssh 2 years ago
Clone
Dmitry Belyavskiy 9dff9c
diff -up openssh-8.6p1/log.c.log-in-chroot openssh-8.6p1/log.c
Dmitry Belyavskiy 9dff9c
--- openssh-8.6p1/log.c.log-in-chroot	2021-04-16 05:55:25.000000000 +0200
Dmitry Belyavskiy 9dff9c
+++ openssh-8.6p1/log.c	2021-05-06 11:32:25.179006811 +0200
Dmitry Belyavskiy 9dff9c
@@ -194,6 +194,11 @@ void
DistroBaker d029bb
 log_init(const char *av0, LogLevel level, SyslogFacility facility,
DistroBaker d029bb
     int on_stderr)
Petr Šabata 81d24c
 {
Petr Šabata 81d24c
+	log_init_handler(av0, level, facility, on_stderr, 1);
Petr Šabata 81d24c
+}
Petr Šabata 81d24c
+
Petr Šabata 81d24c
+void
DistroBaker d029bb
+log_init_handler(const char *av0, LogLevel level, SyslogFacility facility, int on_stderr, int reset_handler) {
Petr Šabata 81d24c
 #if defined(HAVE_OPENLOG_R) && defined(SYSLOG_DATA_INIT)
Petr Šabata 81d24c
 	struct syslog_data sdata = SYSLOG_DATA_INIT;
Petr Šabata 81d24c
 #endif
Dmitry Belyavskiy 9dff9c
@@ -206,8 +211,10 @@ log_init(const char *av0, LogLevel level
Petr Šabata 81d24c
 		exit(1);
Petr Šabata 81d24c
 	}
Petr Šabata 81d24c
 
Petr Šabata 81d24c
-	log_handler = NULL;
Petr Šabata 81d24c
-	log_handler_ctx = NULL;
Petr Šabata 81d24c
+	if (reset_handler) {
Petr Šabata 81d24c
+		log_handler = NULL;
Petr Šabata 81d24c
+		log_handler_ctx = NULL;
Petr Šabata 81d24c
+	}
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 	log_on_stderr = on_stderr;
Petr Šabata 81d24c
 	if (on_stderr)
Dmitry Belyavskiy 9dff9c
diff -up openssh-8.6p1/log.h.log-in-chroot openssh-8.6p1/log.h
Dmitry Belyavskiy 9dff9c
--- openssh-8.6p1/log.h.log-in-chroot	2021-05-06 11:32:25.179006811 +0200
Dmitry Belyavskiy 9dff9c
+++ openssh-8.6p1/log.h	2021-05-06 11:34:22.349925757 +0200
Dmitry Belyavskiy 9dff9c
@@ -52,6 +52,7 @@ typedef enum {
Dmitry Belyavskiy 9dff9c
 typedef void (log_handler_fn)(LogLevel, int, const char *, void *);
Petr Šabata 81d24c
 
DistroBaker d029bb
 void     log_init(const char *, LogLevel, SyslogFacility, int);
DistroBaker d029bb
+void     log_init_handler(const char *, LogLevel, SyslogFacility, int, int);
Petr Šabata 81d24c
 LogLevel log_level_get(void);
Petr Šabata 81d24c
 int      log_change_level(LogLevel);
Petr Šabata 81d24c
 int      log_is_on_stderr(void);
Dmitry Belyavskiy 9dff9c
diff -up openssh-8.6p1/monitor.c.log-in-chroot openssh-8.6p1/monitor.c
Dmitry Belyavskiy 9dff9c
--- openssh-8.6p1/monitor.c.log-in-chroot	2021-05-06 11:32:25.153006607 +0200
Dmitry Belyavskiy 9dff9c
+++ openssh-8.6p1/monitor.c	2021-05-06 11:33:37.671575348 +0200
Dmitry Belyavskiy 9dff9c
@@ -297,6 +297,8 @@ monitor_child_preauth(struct ssh *ssh, s
Petr Šabata 81d24c
 		close(pmonitor->m_log_sendfd);
Petr Šabata 81d24c
 	pmonitor->m_log_sendfd = pmonitor->m_recvfd = -1;
Petr Šabata 81d24c
 
Petr Šabata 81d24c
+	pmonitor->m_state = "preauth";
Petr Šabata 81d24c
+
Petr Šabata 81d24c
 	authctxt = (Authctxt *)ssh->authctxt;
Petr Šabata 81d24c
 	memset(authctxt, 0, sizeof(*authctxt));
Petr Šabata 81d24c
 	ssh->authctxt = authctxt;
Dmitry Belyavskiy 9dff9c
@@ -408,6 +410,8 @@ monitor_child_postauth(struct ssh *ssh,
Petr Šabata 81d24c
 	close(pmonitor->m_recvfd);
Petr Šabata 81d24c
 	pmonitor->m_recvfd = -1;
Petr Šabata 81d24c
 
Petr Šabata 81d24c
+	pmonitor->m_state = "postauth";
Petr Šabata 81d24c
+
Petr Šabata 81d24c
 	monitor_set_child_handler(pmonitor->m_pid);
Petr Šabata 81d24c
 	ssh_signal(SIGHUP, &monitor_child_handler);
Petr Šabata 81d24c
 	ssh_signal(SIGTERM, &monitor_child_handler);
Dmitry Belyavskiy 9dff9c
@@ -480,7 +484,7 @@ monitor_read_log(struct monitor *pmonito
DistroBaker d029bb
 	/* Log it */
Petr Šabata 81d24c
 	if (log_level_name(level) == NULL)
DistroBaker d029bb
 		fatal_f("invalid log level %u (corrupted message?)", level);
Dmitry Belyavskiy 9dff9c
-	sshlogdirect(level, forced, "%s [preauth]", msg);
Dmitry Belyavskiy 9dff9c
+	sshlogdirect(level, forced, "%s [%s]", msg, pmonitor->m_state);
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 	sshbuf_free(logmsg);
Dmitry Belyavskiy 9dff9c
 	free(msg);
Dmitry Belyavskiy 9dff9c
@@ -1868,13 +1872,28 @@ monitor_init(void)
Petr Šabata 81d24c
 	mon = xcalloc(1, sizeof(*mon));
Petr Šabata 81d24c
 	monitor_openfds(mon, 1);
Petr Šabata 81d24c
 
Petr Šabata 81d24c
+	mon->m_state = "";
Petr Šabata 81d24c
+
Petr Šabata 81d24c
 	return mon;
Petr Šabata 81d24c
 }
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 void
Petr Šabata 81d24c
-monitor_reinit(struct monitor *mon)
Petr Šabata 81d24c
+monitor_reinit(struct monitor *mon, const char *chroot_dir)
Petr Šabata 81d24c
 {
Petr Šabata 81d24c
-	monitor_openfds(mon, 0);
Petr Šabata 81d24c
+	struct stat dev_log_stat;
Petr Šabata 81d24c
+	char *dev_log_path;
Petr Šabata 81d24c
+	int do_logfds = 0;
Petr Šabata 81d24c
+
Petr Šabata 81d24c
+	if (chroot_dir != NULL) {
Petr Šabata 81d24c
+		xasprintf(&dev_log_path, "%s/dev/log", chroot_dir);
Petr Šabata 81d24c
+
Petr Šabata 81d24c
+		if (stat(dev_log_path, &dev_log_stat) != 0) {
DistroBaker d029bb
+			debug_f("/dev/log doesn't exist in %s chroot - will try to log via monitor using [postauth] suffix", chroot_dir);
Petr Šabata 81d24c
+			do_logfds = 1;
Petr Šabata 81d24c
+		}
Petr Šabata 81d24c
+		free(dev_log_path);
Petr Šabata 81d24c
+	}
Petr Šabata 81d24c
+	monitor_openfds(mon, do_logfds);
Petr Šabata 81d24c
 }
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 #ifdef GSSAPI
Dmitry Belyavskiy 9dff9c
diff -up openssh-8.6p1/monitor.h.log-in-chroot openssh-8.6p1/monitor.h
Dmitry Belyavskiy 9dff9c
--- openssh-8.6p1/monitor.h.log-in-chroot	2021-05-06 11:32:25.153006607 +0200
Dmitry Belyavskiy 9dff9c
+++ openssh-8.6p1/monitor.h	2021-05-06 11:32:25.180006819 +0200
Dmitry Belyavskiy 9dff9c
@@ -80,10 +80,11 @@ struct monitor {
Petr Šabata 81d24c
 	int			 m_log_sendfd;
Petr Šabata 81d24c
 	struct kex		**m_pkex;
Petr Šabata 81d24c
 	pid_t			 m_pid;
Petr Šabata 81d24c
+	char		*m_state;
Petr Šabata 81d24c
 };
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 struct monitor *monitor_init(void);
Petr Šabata 81d24c
-void monitor_reinit(struct monitor *);
Petr Šabata 81d24c
+void monitor_reinit(struct monitor *, const char *);
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 struct Authctxt;
Petr Šabata 81d24c
 void monitor_child_preauth(struct ssh *, struct monitor *);
Dmitry Belyavskiy 9dff9c
diff -up openssh-8.6p1/session.c.log-in-chroot openssh-8.6p1/session.c
Dmitry Belyavskiy 9dff9c
--- openssh-8.6p1/session.c.log-in-chroot	2021-05-06 11:32:25.166006709 +0200
Dmitry Belyavskiy 9dff9c
+++ openssh-8.6p1/session.c	2021-05-06 11:32:25.181006827 +0200
Petr Šabata 81d24c
@@ -160,6 +160,7 @@ login_cap_t *lc;
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 static int is_child = 0;
Petr Šabata 81d24c
 static int in_chroot = 0;
Petr Šabata 81d24c
+static int have_dev_log = 1;
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 /* File containing userauth info, if ExposeAuthInfo set */
Petr Šabata 81d24c
 static char *auth_info_file = NULL;
Dmitry Belyavskiy 9dff9c
@@ -661,6 +662,7 @@ do_exec(struct ssh *ssh, Session *s, con
Petr Šabata 81d24c
 	int ret;
Petr Šabata 81d24c
 	const char *forced = NULL, *tty = NULL;
Petr Šabata 81d24c
 	char session_type[1024];
Petr Šabata 81d24c
+	struct stat dev_log_stat;
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 	if (options.adm_forced_command) {
Petr Šabata 81d24c
 		original_command = command;
Dmitry Belyavskiy 9dff9c
@@ -720,6 +722,10 @@ do_exec(struct ssh *ssh, Session *s, con
Petr Šabata 81d24c
 			tty += 5;
Petr Šabata 81d24c
 	}
Petr Šabata 81d24c
 
Petr Šabata 81d24c
+	if (lstat("/dev/log", &dev_log_stat) != 0) {
Petr Šabata 81d24c
+		have_dev_log = 0;
Petr Šabata 81d24c
+	}
Petr Šabata 81d24c
+
Petr Šabata 81d24c
 	verbose("Starting session: %s%s%s for %s from %.200s port %d id %d",
Petr Šabata 81d24c
 	    session_type,
Petr Šabata 81d24c
 	    tty == NULL ? "" : " on ",
Dmitry Belyavskiy 9dff9c
@@ -1524,14 +1530,6 @@ child_close_fds(struct ssh *ssh)
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 	/* Stop directing logs to a high-numbered fd before we close it */
Petr Šabata 81d24c
 	log_redirect_stderr_to(NULL);
Petr Šabata 81d24c
-
Petr Šabata 81d24c
-	/*
Petr Šabata 81d24c
-	 * Close any extra open file descriptors so that we don't have them
Petr Šabata 81d24c
-	 * hanging around in clients.  Note that we want to do this after
Petr Šabata 81d24c
-	 * initgroups, because at least on Solaris 2.3 it leaves file
Petr Šabata 81d24c
-	 * descriptors open.
Petr Šabata 81d24c
-	 */
Petr Šabata 81d24c
-	closefrom(STDERR_FILENO + 1);
Petr Šabata 81d24c
 }
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 /*
Dmitry Belyavskiy 9dff9c
@@ -1665,8 +1663,6 @@ do_child(struct ssh *ssh, Session *s, co
Petr Šabata 81d24c
 			exit(1);
Petr Šabata 81d24c
 	}
Petr Šabata 81d24c
 
Petr Šabata 81d24c
-	closefrom(STDERR_FILENO + 1);
Petr Šabata 81d24c
-
Petr Šabata 81d24c
 	do_rc_files(ssh, s, shell);
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 	/* restore SIGPIPE for child */
Dmitry Belyavskiy 9dff9c
@@ -1691,9 +1687,17 @@ do_child(struct ssh *ssh, Session *s, co
Petr Šabata 81d24c
 		argv[i] = NULL;
Petr Šabata 81d24c
 		optind = optreset = 1;
Petr Šabata 81d24c
 		__progname = argv[0];
Petr Šabata 81d24c
-		exit(sftp_server_main(i, argv, s->pw));
Petr Šabata 81d24c
+		exit(sftp_server_main(i, argv, s->pw, have_dev_log));
Petr Šabata 81d24c
 	}
Petr Šabata 81d24c
 
Petr Šabata 81d24c
+	/*
Petr Šabata 81d24c
+	 * Close any extra open file descriptors so that we don't have them
Petr Šabata 81d24c
+	 * hanging around in clients.  Note that we want to do this after
Petr Šabata 81d24c
+	 * initgroups, because at least on Solaris 2.3 it leaves file
Petr Šabata 81d24c
+	 * descriptors open.
Petr Šabata 81d24c
+	 */
Petr Šabata 81d24c
+	closefrom(STDERR_FILENO + 1);
Petr Šabata 81d24c
+
Petr Šabata 81d24c
 	fflush(NULL);
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 	/* Get the last component of the shell name. */
Dmitry Belyavskiy 9dff9c
diff -up openssh-8.6p1/sftp.h.log-in-chroot openssh-8.6p1/sftp.h
Dmitry Belyavskiy 9dff9c
--- openssh-8.6p1/sftp.h.log-in-chroot	2021-04-16 05:55:25.000000000 +0200
Dmitry Belyavskiy 9dff9c
+++ openssh-8.6p1/sftp.h	2021-05-06 11:32:25.181006827 +0200
Petr Šabata 81d24c
@@ -97,5 +97,5 @@
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 struct passwd;
Petr Šabata 81d24c
 
Petr Šabata 81d24c
-int	sftp_server_main(int, char **, struct passwd *);
Petr Šabata 81d24c
+int	sftp_server_main(int, char **, struct passwd *, int);
Petr Šabata 81d24c
 void	sftp_server_cleanup_exit(int) __attribute__((noreturn));
Dmitry Belyavskiy 9dff9c
diff -up openssh-8.6p1/sftp-server.c.log-in-chroot openssh-8.6p1/sftp-server.c
Dmitry Belyavskiy 9dff9c
--- openssh-8.6p1/sftp-server.c.log-in-chroot	2021-04-16 05:55:25.000000000 +0200
Dmitry Belyavskiy 9dff9c
+++ openssh-8.6p1/sftp-server.c	2021-05-06 11:32:25.181006827 +0200
Dmitry Belyavskiy 9dff9c
@@ -1644,7 +1644,7 @@ sftp_server_usage(void)
Petr Šabata 81d24c
 }
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 int
Petr Šabata 81d24c
-sftp_server_main(int argc, char **argv, struct passwd *user_pw)
Petr Šabata 81d24c
+sftp_server_main(int argc, char **argv, struct passwd *user_pw, int reset_handler)
Petr Šabata 81d24c
 {
Petr Šabata 81d24c
 	fd_set *rset, *wset;
Petr Šabata 81d24c
 	int i, r, in, out, max, ch, skipargs = 0, log_stderr = 0;
Dmitry Belyavskiy 9dff9c
@@ -1657,7 +1657,7 @@ sftp_server_main(int argc, char **argv,
Petr Šabata 81d24c
 	extern char *__progname;
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 	__progname = ssh_get_progname(argv[0]);
Petr Šabata 81d24c
-	log_init(__progname, log_level, log_facility, log_stderr);
Petr Šabata 81d24c
+	log_init_handler(__progname, log_level, log_facility, log_stderr, reset_handler);
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 	pw = pwcopy(user_pw);
Petr Šabata 81d24c
 
Dmitry Belyavskiy 9dff9c
@@ -1730,7 +1730,7 @@ sftp_server_main(int argc, char **argv,
Petr Šabata 81d24c
 		}
Petr Šabata 81d24c
 	}
Petr Šabata 81d24c
 
Petr Šabata 81d24c
-	log_init(__progname, log_level, log_facility, log_stderr);
Petr Šabata 81d24c
+	log_init_handler(__progname, log_level, log_facility, log_stderr, reset_handler);
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 	/*
Petr Šabata 81d24c
 	 * On platforms where we can, avoid making /proc/self/{mem,maps}
Dmitry Belyavskiy 9dff9c
diff -up openssh-8.6p1/sftp-server-main.c.log-in-chroot openssh-8.6p1/sftp-server-main.c
Dmitry Belyavskiy 9dff9c
--- openssh-8.6p1/sftp-server-main.c.log-in-chroot	2021-04-16 05:55:25.000000000 +0200
Dmitry Belyavskiy 9dff9c
+++ openssh-8.6p1/sftp-server-main.c	2021-05-06 11:32:25.181006827 +0200
Dmitry Belyavskiy 9dff9c
@@ -50,5 +50,5 @@ main(int argc, char **argv)
Petr Šabata 81d24c
 		return 1;
Petr Šabata 81d24c
 	}
Petr Šabata 81d24c
 
Petr Šabata 81d24c
-	return (sftp_server_main(argc, argv, user_pw));
Petr Šabata 81d24c
+	return (sftp_server_main(argc, argv, user_pw, 0));
Petr Šabata 81d24c
 }
Dmitry Belyavskiy 9dff9c
diff -up openssh-8.6p1/sshd.c.log-in-chroot openssh-8.6p1/sshd.c
Dmitry Belyavskiy 9dff9c
--- openssh-8.6p1/sshd.c.log-in-chroot	2021-05-06 11:32:25.177006795 +0200
Dmitry Belyavskiy 9dff9c
+++ openssh-8.6p1/sshd.c	2021-05-06 11:32:25.182006834 +0200
Dmitry Belyavskiy 9dff9c
@@ -559,7 +559,7 @@ privsep_postauth(struct ssh *ssh, Authct
Petr Šabata 81d24c
 	}
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 	/* New socket pair */
Petr Šabata 81d24c
-	monitor_reinit(pmonitor);
Petr Šabata 81d24c
+	monitor_reinit(pmonitor, options.chroot_directory);
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 	pmonitor->m_pid = fork();
Petr Šabata 81d24c
 	if (pmonitor->m_pid == -1)
Dmitry Belyavskiy 9dff9c
@@ -578,6 +578,11 @@ privsep_postauth(struct ssh *ssh, Authct
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 	close(pmonitor->m_sendfd);
Petr Šabata 81d24c
 	pmonitor->m_sendfd = -1;
Petr Šabata 81d24c
+	close(pmonitor->m_log_recvfd);
Petr Šabata 81d24c
+	pmonitor->m_log_recvfd = -1;
Petr Šabata 81d24c
+
Petr Šabata 81d24c
+	if (pmonitor->m_log_sendfd != -1)
Petr Šabata 81d24c
+		set_log_handler(mm_log_handler, pmonitor);
Petr Šabata 81d24c
 
Petr Šabata 81d24c
 	/* Demote the private keys to public keys. */
Petr Šabata 81d24c
 	demote_sensitive_data();