author | Tomas Kuthan <tomas.kuthan@oracle.com> |
Mon, 06 Feb 2017 22:51:03 -0800 | |
changeset 7649 | 69d7508f0d66 |
parent 7562 | 2adf9e2cdc69 |
permissions | -rw-r--r-- |
7059
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
1 |
# |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
2 |
# Implements watchdog process, which backs up login_grace_time alarm. |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
3 |
# |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
4 |
# If the main process is hung in a syscall, SIGALRM is queued but not |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
5 |
# delivered and the connection stays unauthenticated for too long. |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
6 |
# |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
7 |
# Function start_grace_watchdog forks of a watchdog process, that sends the |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
8 |
# main process a SIGTERM, if it does neither authenticate nor exit before |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
9 |
# (login_grace_time + GRACE_WATCHDOG_THRESHOLD). |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
10 |
# If the main process does not react to SIGTERM, SIGKILL is sent after |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
11 |
# additional GRACE_WATCHDOG_THRESHOLD seconds. |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
12 |
# |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
13 |
# Patch source: in-house |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
14 |
# Reported to [email protected] as security issue. |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
15 |
# |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
16 |
# Per agreement with upstream developers, filed: |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
17 |
# https://bugzilla.mindrot.org/show_bug.cgi?id=2615 |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
18 |
# |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
19 |
diff -pur old/sshd.c new/sshd.c |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
20 |
--- old/sshd.c |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
21 |
+++ new/sshd.c |
7649
69d7508f0d66
PSARC/2017/022 OpenSSH 7.4
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
7562
diff
changeset
|
22 |
@@ -236,7 +236,14 @@ Buffer loginmsg; |
7059
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
23 |
/* Unprivileged user */ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
24 |
struct passwd *privsep_pw = NULL; |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
25 |
|
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
26 |
+/* Pid of process backing up login_grace_time alarm. */ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
27 |
+pid_t grace_watchdog_pid = -1; |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
28 |
+ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
29 |
+/* Time in seconds */ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
30 |
+#define GRACE_WATCHDOG_THRESHOLD 10 |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
31 |
+ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
32 |
/* Prototypes for various functions defined later in this file. */ |
7649
69d7508f0d66
PSARC/2017/022 OpenSSH 7.4
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
7562
diff
changeset
|
33 |
+static void stop_grace_watchdog(void); |
7059
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
34 |
void destroy_sensitive_data(void); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
35 |
void demote_sensitive_data(void); |
7649
69d7508f0d66
PSARC/2017/022 OpenSSH 7.4
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
7562
diff
changeset
|
36 |
static void do_ssh2_kex(void); |
69d7508f0d66
PSARC/2017/022 OpenSSH 7.4
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
7562
diff
changeset
|
37 |
@@ -351,12 +358,101 @@ grace_alarm_handler(int sig) |
7059
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
38 |
signal(SIGTERM, SIG_IGN); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
39 |
kill(0, SIGTERM); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
40 |
} |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
41 |
+ stop_grace_watchdog(); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
42 |
|
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
43 |
/* Log error and exit. */ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
44 |
sigdie("Timeout before authentication for %s port %d", |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
45 |
ssh_remote_ipaddr(active_state), ssh_remote_port(active_state)); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
46 |
} |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
47 |
|
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
48 |
+static inline void |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
49 |
+sleep_reliably(unsigned int seconds) |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
50 |
+{ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
51 |
+ while (seconds > 0) |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
52 |
+ seconds = sleep(seconds); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
53 |
+} |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
54 |
+ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
55 |
+/* |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
56 |
+ * Implements watchdog process, which backs up login_grace_time alarm. |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
57 |
+ * |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
58 |
+ * If the main process is hung in a syscall, SIGALRM is queued but not |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
59 |
+ * delivered and the connection stays unauthenticated for too long. |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
60 |
+ * |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
61 |
+ * This function forks off a watchdog process, which sends the main process |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
62 |
+ * a SIGTERM, if it does neither authenticate nor exit before |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
63 |
+ * (login_grace_time + GRACE_WATCHDOG_THRESHOLD). |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
64 |
+ * If the main process does not react to SIGTERM, SIGKILL is sent after |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
65 |
+ * additional GRACE_WATCHDOG_THRESHOLD seconds. |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
66 |
+ */ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
67 |
+static void |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
68 |
+start_grace_watchdog(int login_grace_time) |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
69 |
+{ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
70 |
+ pid_t ppid = getpid(); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
71 |
+ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
72 |
+ if (login_grace_time == 0) |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
73 |
+ return; |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
74 |
+ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
75 |
+ if (grace_watchdog_pid != -1) { |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
76 |
+ error("login_grace_time watchdog process already running"); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
77 |
+ return; |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
78 |
+ } |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
79 |
+ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
80 |
+ grace_watchdog_pid = fork(); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
81 |
+ if (grace_watchdog_pid == -1) |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
82 |
+ fatal("fork of login_grace_time watchdog process failed"); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
83 |
+ else if (grace_watchdog_pid > 0) |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
84 |
+ return; |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
85 |
+ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
86 |
+ /* child */ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
87 |
+ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
88 |
+ /* close open fds, including client socket and startup_pipe */ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
89 |
+ closefrom(3); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
90 |
+ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
91 |
+ /* kill the monitor with SIGTERM after timeout + threshold */ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
92 |
+ sleep_reliably(login_grace_time + GRACE_WATCHDOG_THRESHOLD); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
93 |
+ if (getppid() != ppid) { |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
94 |
+ debug("login_grace_time watchdog still active, " |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
95 |
+ "but watched process %d already exited.", (int)ppid); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
96 |
+ exit(0); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
97 |
+ } |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
98 |
+ error("Timeout before authentication for %s. Killing process %d " |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
99 |
+ "with SIGTERM.", ssh_remote_ipaddr(active_state), (int)ppid); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
100 |
+ kill(ppid, SIGTERM); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
101 |
+ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
102 |
+ /* if neccessary, kill it with SIGKILL */ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
103 |
+ sleep_reliably(GRACE_WATCHDOG_THRESHOLD); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
104 |
+ if (getppid() != ppid) |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
105 |
+ exit(0); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
106 |
+ error("Watched process %d did not respond to SIGTERM. " |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
107 |
+ "Killing it with SIGKILL.", (int)ppid); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
108 |
+ kill(ppid, SIGKILL); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
109 |
+ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
110 |
+ /* give up */ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
111 |
+ sleep_reliably(GRACE_WATCHDOG_THRESHOLD); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
112 |
+ if (getppid() == ppid) { |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
113 |
+ error("login_grace_time watchdog failed to kill %d", (int)ppid); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
114 |
+ exit(255); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
115 |
+ } |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
116 |
+ exit(0); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
117 |
+} |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
118 |
+ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
119 |
+/* kill grace watchdog process */ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
120 |
+static void |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
121 |
+stop_grace_watchdog() |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
122 |
+{ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
123 |
+ if (grace_watchdog_pid == -1) { |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
124 |
+ debug3("login_grace_time watchdog process not running"); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
125 |
+ return; |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
126 |
+ } |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
127 |
+ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
128 |
+ kill(grace_watchdog_pid, SIGTERM); |
7562
2adf9e2cdc69
25044066 sshd error: session_by_pid: unknown pid when root ssh session exits
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
7059
diff
changeset
|
129 |
+ while (waitpid(grace_watchdog_pid, NULL, 0) < 0) { |
2adf9e2cdc69
25044066 sshd error: session_by_pid: unknown pid when root ssh session exits
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
7059
diff
changeset
|
130 |
+ if (errno == EINTR) |
2adf9e2cdc69
25044066 sshd error: session_by_pid: unknown pid when root ssh session exits
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
7059
diff
changeset
|
131 |
+ continue; |
2adf9e2cdc69
25044066 sshd error: session_by_pid: unknown pid when root ssh session exits
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
7059
diff
changeset
|
132 |
+ } |
7059
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
133 |
+ grace_watchdog_pid = -1; |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
134 |
+} |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
135 |
+ |
7649
69d7508f0d66
PSARC/2017/022 OpenSSH 7.4
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
7562
diff
changeset
|
136 |
static void |
69d7508f0d66
PSARC/2017/022 OpenSSH 7.4
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
7562
diff
changeset
|
137 |
sshd_exchange_identification(struct ssh *ssh, int sock_in, int sock_out) |
69d7508f0d66
PSARC/2017/022 OpenSSH 7.4
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
7562
diff
changeset
|
138 |
{ |
69d7508f0d66
PSARC/2017/022 OpenSSH 7.4
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
7562
diff
changeset
|
139 |
@@ -623,6 +719,7 @@ privsep_preauth(Authctxt *authctxt) |
7059
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
140 |
/* child */ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
141 |
close(pmonitor->m_sendfd); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
142 |
close(pmonitor->m_log_recvfd); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
143 |
+ grace_watchdog_pid = -1; |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
144 |
|
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
145 |
/* Arrange for logging to be sent to the monitor */ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
146 |
set_log_handler(mm_log_handler, pmonitor); |
7649
69d7508f0d66
PSARC/2017/022 OpenSSH 7.4
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
7562
diff
changeset
|
147 |
@@ -2006,8 +2103,10 @@ main(int ac, char **av) |
7059
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
148 |
* are about to discover the bug. |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
149 |
*/ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
150 |
signal(SIGALRM, grace_alarm_handler); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
151 |
- if (!debug_flag) |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
152 |
+ if (!debug_flag) { |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
153 |
alarm(options.login_grace_time); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
154 |
+ start_grace_watchdog(options.login_grace_time); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
155 |
+ } |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
156 |
|
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
157 |
sshd_exchange_identification(ssh, sock_in, sock_out); |
7649
69d7508f0d66
PSARC/2017/022 OpenSSH 7.4
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
7562
diff
changeset
|
158 |
packet_set_nonblocking(); |
69d7508f0d66
PSARC/2017/022 OpenSSH 7.4
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
7562
diff
changeset
|
159 |
@@ -2055,6 +2154,7 @@ main(int ac, char **av) |
7059
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
160 |
*/ |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
161 |
alarm(0); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
162 |
signal(SIGALRM, SIG_DFL); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
163 |
+ stop_grace_watchdog(); |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
164 |
authctxt->authenticated = 1; |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
165 |
if (startup_pipe != -1) { |
f2f4b9922ef9
23223069 problem in UTILITY/OPENSSH
Tomas Kuthan <tomas.kuthan@oracle.com>
parents:
diff
changeset
|
166 |
close(startup_pipe); |