104 |
int sent_null; |
int sent_null; |
105 |
|
|
106 |
void doit __P ((int, struct sockaddr_in *)); |
void doit __P ((int, struct sockaddr_in *)); |
107 |
void error __P ((const char *, ...)); |
void rshd_error __P ((const char *, ...)); |
108 |
char *getstr __P ((const char *)); |
char *getstr __P ((const char *)); |
109 |
int local_domain __P ((const char *)); |
int local_domain __P ((const char *)); |
110 |
const char *topdomain __P ((const char *)); |
const char *topdomain __P ((const char *)); |
111 |
void usage __P ((void)); |
void usage __P ((void)); |
112 |
void help __P ((void)); |
void help __P ((void)); |
113 |
|
|
114 |
#ifdef KERBEROS |
#if defined(KERBEROS) || defined(SHISHI) |
115 |
|
#ifdef KERBEROS |
116 |
# include <kerberosIV/des.h> |
# include <kerberosIV/des.h> |
117 |
# include <kerberosIV/krb.h> |
# include <kerberosIV/krb.h> |
118 |
|
Key_schedule schedule; |
119 |
|
char authbuf[sizeof(AUTH_DAT)]; |
120 |
|
char tickbuf[sizeof(KTEXT_ST)]; |
121 |
|
#elif defined(SHISHI) |
122 |
|
# include <shishi.h> |
123 |
|
# include <shishi_def.h> |
124 |
|
Shishi * h; |
125 |
|
Shishi_ap * ap; |
126 |
|
Shishi_key * enckey; |
127 |
|
shishi_ivector iv1, iv2, iv3, iv4; |
128 |
|
shishi_ivector *ivtab[4]; |
129 |
|
int protocol; |
130 |
|
#endif |
131 |
# define VERSION_SIZE 9 |
# define VERSION_SIZE 9 |
132 |
# define SECURE_MESSAGE "This rsh session is using DES encryption for all transmissions.\r\n" |
# define SECURE_MESSAGE "This rsh session is using DES encryption for all transmissions.\r\n" |
133 |
# define OPTIONS "alnkvxLVh" |
# define OPTIONS "alnkvxLVh" |
|
char authbuf[sizeof(AUTH_DAT)]; |
|
|
char tickbuf[sizeof(KTEXT_ST)]; |
|
134 |
int doencrypt, use_kerberos, vacuous; |
int doencrypt, use_kerberos, vacuous; |
|
Key_schedule schedule; |
|
135 |
#else |
#else |
136 |
# define OPTIONS "alnLVh" |
# define OPTIONS "alnLVh" |
137 |
#endif |
#endif |
178 |
keepalive = 0; /* don't enable SO_KEEPALIVE */ |
keepalive = 0; /* don't enable SO_KEEPALIVE */ |
179 |
break; |
break; |
180 |
|
|
181 |
#ifdef KERBEROS |
#if defined(KERBEROS) || defined(SHISHI) |
182 |
case 'k': |
case 'k': |
183 |
use_kerberos = 1; |
use_kerberos = 1; |
184 |
break; |
break; |
222 |
exit (1); |
exit (1); |
223 |
} |
} |
224 |
|
|
225 |
#ifdef KERBEROS |
#if defined(KERBEROS) || defined(SHISHI) |
226 |
if (use_kerberos && vacuous) |
if (use_kerberos && vacuous) |
227 |
{ |
{ |
228 |
syslog (LOG_ERR, "only one of -k and -v allowed"); |
syslog (LOG_ERR, "only one of -k and -v allowed"); |
304 |
fd_set wready, writeto; |
fd_set wready, writeto; |
305 |
|
|
306 |
fromaddr = *fromp; |
fromaddr = *fromp; |
307 |
|
#elif defined SHISHI |
308 |
|
int n; |
309 |
|
int pv1[2], pv2[2]; |
310 |
|
fd_set wready, writeto; |
311 |
|
int keytype, keylen; |
312 |
|
int cksumtype, cksumlen; |
313 |
|
char *cksum = NULL; |
314 |
#endif |
#endif |
315 |
|
|
316 |
signal(SIGINT, SIG_DFL); |
signal(SIGINT, SIG_DFL); |
371 |
/* Need host byte ordered port# to compare */ |
/* Need host byte ordered port# to compare */ |
372 |
fromp->sin_port = ntohs((u_short)fromp->sin_port); |
fromp->sin_port = ntohs((u_short)fromp->sin_port); |
373 |
/* Verify that the client's address was bound to a reserved port */ |
/* Verify that the client's address was bound to a reserved port */ |
374 |
#ifdef KERBEROS |
#if defined(KERBEROS) || defined(SHISHI) |
375 |
if (!use_kerberos) |
if (!use_kerberos) |
376 |
#endif |
#endif |
377 |
if (fromp->sin_port >= IPPORT_RESERVED |
if (fromp->sin_port >= IPPORT_RESERVED |
424 |
syslog (LOG_ERR, "can't get stderr port: %m"); |
syslog (LOG_ERR, "can't get stderr port: %m"); |
425 |
exit (1); |
exit (1); |
426 |
} |
} |
427 |
#ifdef KERBEROS |
#if defined(KERBEROS) || defined(SHISHI) |
428 |
if (!use_kerberos) |
if (!use_kerberos) |
429 |
#endif |
#endif |
430 |
if (port >= IPPORT_RESERVED || port < IPPORT_RESERVED/2) |
if (port >= IPPORT_RESERVED || port < IPPORT_RESERVED/2) |
437 |
* client's, just change the port# to the one specified |
* client's, just change the port# to the one specified |
438 |
* by the clent as the secondary port. |
* by the clent as the secondary port. |
439 |
*/ |
*/ |
440 |
|
syslog (LOG_ERR, "2nd port not reserved %d\n", port); |
441 |
|
|
442 |
fromp->sin_port = htons (port); |
fromp->sin_port = htons (port); |
443 |
if (connect (s, (struct sockaddr *)fromp, sizeof (*fromp)) < 0) |
if (connect (s, (struct sockaddr *)fromp, sizeof (*fromp)) < 0) |
444 |
{ |
{ |
447 |
} |
} |
448 |
} |
} |
449 |
|
|
450 |
#ifdef KERBEROS |
#if defined(KERBEROS) || defined(SHISHI) |
451 |
if (vacuous) |
if (vacuous) |
452 |
{ |
{ |
453 |
error ("rshd: remote host requires Kerberos authentication\n"); |
rshd_error ("rshd: remote host requires Kerberos authentication\n"); |
454 |
exit (1); |
exit (1); |
455 |
} |
} |
456 |
#endif |
#endif |
478 |
* address corresponds to the name. |
* address corresponds to the name. |
479 |
*/ |
*/ |
480 |
hostname = strdup (hp->h_name); |
hostname = strdup (hp->h_name); |
481 |
#ifdef KERBEROS |
#if defined(KERBEROS) || defined(SHISHI) |
482 |
if (!use_kerberos) |
if (!use_kerberos) |
483 |
#endif |
#endif |
484 |
if (check_all || local_domain (hostname)) |
if (check_all || local_domain (hp->h_name)) |
485 |
{ |
{ |
486 |
char *remotehost = (char *) alloca (strlen (hostname) + 1); |
char *remotehost = (char *) alloca (strlen (hostname) + 1); |
487 |
if (! remotehost) |
if (! remotehost) |
541 |
(struct sockaddr *)&local_addr, &rc) < 0) |
(struct sockaddr *)&local_addr, &rc) < 0) |
542 |
{ |
{ |
543 |
syslog (LOG_ERR, "getsockname: %m"); |
syslog (LOG_ERR, "getsockname: %m"); |
544 |
error ("rlogind: getsockname: %m"); |
rshd_error ("rlogind: getsockname: %s", strerror (errno)); |
545 |
exit (1); |
exit (1); |
546 |
} |
} |
547 |
authopts = KOPT_DO_MUTUAL; |
authopts = KOPT_DO_MUTUAL; |
559 |
kdata, "", (bit_64 *) 0, version); |
kdata, "", (bit_64 *) 0, version); |
560 |
if (rc != KSUCCESS) |
if (rc != KSUCCESS) |
561 |
{ |
{ |
562 |
error ("Kerberos authentication failure: %s\n", krb_err_txt[rc]); |
rshd_error ("Kerberos authentication failure: %s\n", krb_err_txt[rc]); |
563 |
exit (1); |
exit (1); |
564 |
} |
} |
565 |
} |
} |
566 |
else |
else |
567 |
|
#elif defined (SHISHI) |
568 |
|
if (use_kerberos) |
569 |
|
{ |
570 |
|
int rc; |
571 |
|
char *err_msg; |
572 |
|
|
573 |
|
rc = get_auth (STDIN_FILENO, &h, &ap, &enckey, &err_msg, &protocol, |
574 |
|
&cksumtype, &cksum, &cksumlen); |
575 |
|
if (rc != SHISHI_OK) |
576 |
|
{ |
577 |
|
rshd_error ("Kerberos authentication failure: %s\n", |
578 |
|
err_msg ? err_msg : shishi_strerror (rc)); |
579 |
|
exit (1); |
580 |
|
} |
581 |
|
} |
582 |
|
else |
583 |
#endif |
#endif |
584 |
remuser = getstr ("remuser"); |
remuser = getstr ("remuser"); |
585 |
|
|
586 |
/* Read three strings from the client. */ |
/* Read three strings from the client. */ |
587 |
locuser = getstr ("locuser"); |
locuser = getstr ("locuser"); |
588 |
cmdbuf = getstr ("command"); |
cmdbuf = getstr ("command"); |
589 |
|
|
590 |
|
#ifdef SHISHI |
591 |
|
{ |
592 |
|
int error; |
593 |
|
int rc; |
594 |
|
char * compcksum; |
595 |
|
size_t compcksumlen; |
596 |
|
char cksumdata[100]; |
597 |
|
struct sockaddr_in sock; |
598 |
|
size_t socklen; |
599 |
|
|
600 |
|
#ifdef ENCRYPTION |
601 |
|
if (strlen (cmdbuf) >= 3) |
602 |
|
if (!strncmp (cmdbuf, "-x ", 3)) |
603 |
|
{ |
604 |
|
doencrypt = 1; |
605 |
|
int i; |
606 |
|
|
607 |
|
ivtab[0] = &iv1; |
608 |
|
ivtab[1] = &iv2; |
609 |
|
ivtab[2] = &iv3; |
610 |
|
ivtab[3] = &iv4; |
611 |
|
|
612 |
|
keytype = shishi_key_type (enckey); |
613 |
|
keylen = shishi_cipher_blocksize (keytype); |
614 |
|
|
615 |
|
for (i=0; i<4; i++) |
616 |
|
{ |
617 |
|
ivtab[i]->ivlen = keylen; |
618 |
|
|
619 |
|
switch (keytype) |
620 |
|
{ |
621 |
|
case SHISHI_DES_CBC_CRC: |
622 |
|
case SHISHI_DES_CBC_MD4: |
623 |
|
case SHISHI_DES_CBC_MD5: |
624 |
|
case SHISHI_DES_CBC_NONE: |
625 |
|
case SHISHI_DES3_CBC_HMAC_SHA1_KD: |
626 |
|
ivtab[i]->keyusage = SHISHI_KEYUSAGE_KCMD_DES; |
627 |
|
ivtab[i]->iv = malloc (ivtab[i]->ivlen); |
628 |
|
memset (ivtab[i]->iv, 2*i -3*(i>=2), ivtab[i]->ivlen); |
629 |
|
ivtab[i]->ctx = shishi_crypto (h, enckey, ivtab[i]->keyusage, shishi_key_type (enckey), |
630 |
|
ivtab[i]->iv, ivtab[i]->ivlen); |
631 |
|
break; |
632 |
|
|
633 |
|
case SHISHI_ARCFOUR_HMAC: |
634 |
|
case SHISHI_ARCFOUR_HMAC_EXP: |
635 |
|
ivtab[i]->keyusage = SHISHI_KEYUSAGE_KCMD_DES + 4*(i<2) + 2 + 2*(i%2); |
636 |
|
ivtab[i]->ctx = shishi_crypto (h, enckey, ivtab[i]->keyusage, shishi_key_type (enckey), |
637 |
|
NULL, 0); |
638 |
|
break; |
639 |
|
|
640 |
|
default : |
641 |
|
ivtab[i]->keyusage = SHISHI_KEYUSAGE_KCMD_DES + 4*(i<2) + 2 + 2*(i%2); |
642 |
|
ivtab[i]->iv = malloc (ivtab[i]->ivlen); |
643 |
|
memset (ivtab[i]->iv, 0, ivtab[i]->ivlen); |
644 |
|
if (protocol == 2) |
645 |
|
ivtab[i]->ctx = shishi_crypto (h, enckey, ivtab[i]->keyusage, shishi_key_type (enckey), |
646 |
|
ivtab[i]->iv, ivtab[i]->ivlen); |
647 |
|
} |
648 |
|
} |
649 |
|
|
650 |
|
} |
651 |
|
#endif |
652 |
|
|
653 |
|
remuser = getstr ("remuser"); |
654 |
|
rc = read (STDIN_FILENO, &error, sizeof (int)); |
655 |
|
if ((rc != sizeof (int)) && rc) |
656 |
|
exit (1); |
657 |
|
|
658 |
|
/* verify checksum */ |
659 |
|
|
660 |
|
/* Doesn't give socket port ? |
661 |
|
if (getsockname (STDIN_FILENO, (struct sockaddr *)&sock, &socklen) < 0) |
662 |
|
{ |
663 |
|
syslog (LOG_ERR, "Can't get sock name"); |
664 |
|
exit (1); |
665 |
|
} |
666 |
|
*/ |
667 |
|
snprintf (cksumdata, 100, "544:%s%s", /*ntohs(sock.sin_port),*/ cmdbuf, locuser); |
668 |
|
rc = shishi_checksum (h, enckey, 0, cksumtype, cksumdata, |
669 |
|
strlen (cksumdata), &compcksum, &compcksumlen); |
670 |
|
free (cksum); |
671 |
|
if (rc != SHISHI_OK |
672 |
|
|| compcksumlen != cksumlen |
673 |
|
|| memcmp (compcksum, cksum, cksumlen) != 0) |
674 |
|
{ |
675 |
|
/* err_msg crash ? */ |
676 |
|
/* *err_msg = "checksum verify failed"; */ |
677 |
|
syslog (LOG_ERR, "checksum verify failed: %s", shishi_error (h)); |
678 |
|
free (compcksum); |
679 |
|
exit (1); |
680 |
|
} |
681 |
|
|
682 |
|
rc = shishi_authorized_p (h, shishi_ap_tkt (ap), locuser); |
683 |
|
if (!rc) |
684 |
|
{ |
685 |
|
syslog (LOG_ERR, "User is not authorized to log in as: %s", locuser); |
686 |
|
shishi_ap_done (ap); |
687 |
|
exit (1); |
688 |
|
} |
689 |
|
|
690 |
|
free (compcksum); |
691 |
|
|
692 |
|
shishi_ap_done (ap); |
693 |
|
|
694 |
|
} |
695 |
|
#endif |
696 |
|
|
697 |
/* Look up locuser in the passerd file. The locuser has\* to be a |
/* Look up locuser in the passerd file. The locuser has\* to be a |
698 |
* valid account on this system. |
* valid account on this system. |
699 |
*/ |
*/ |
717 |
{ |
{ |
718 |
syslog (LOG_INFO|LOG_AUTH, "Kerberos rsh denied to %s.%s@%s", |
syslog (LOG_INFO|LOG_AUTH, "Kerberos rsh denied to %s.%s@%s", |
719 |
kdata->pname, kdata->pinst, kdata->prealm); |
kdata->pname, kdata->pinst, kdata->prealm); |
720 |
error ("Permission denied.\n"); |
rshd_error ("Permission denied.\n"); |
721 |
exit (1); |
exit (1); |
722 |
} |
} |
723 |
} |
} |
724 |
} |
} |
725 |
else |
else |
726 |
|
#elif defined(SHISHI) |
727 |
|
if (use_kerberos) |
728 |
|
{/* |
729 |
|
if (pwd->pw_passwd != 0 && *pwd->pw_passwd != '\0') |
730 |
|
{ |
731 |
|
if (kuserok (kdata, locuser) != 0) |
732 |
|
{ |
733 |
|
syslog (LOG_INFO|LOG_AUTH, "Kerberos rsh denied to %s.%s@%s", |
734 |
|
kdata->pname, kdata->pinst, kdata->prealm); |
735 |
|
rshd_error ("Permission denied.\n"); |
736 |
|
exit (1); |
737 |
|
} |
738 |
|
}*/ |
739 |
|
} |
740 |
|
else |
741 |
#endif |
#endif |
742 |
if (errorstr || pwd->pw_passwd != 0 && *pwd->pw_passwd != '\0' |
if (errorstr || pwd->pw_passwd != 0 && *pwd->pw_passwd != '\0' |
743 |
&& (iruserok (fromp->sin_addr.s_addr, pwd->pw_uid == 0, |
&& (iruserok (fromp->sin_addr.s_addr, pwd->pw_uid == 0, |
754 |
fail: |
fail: |
755 |
if (errorstr == NULL) |
if (errorstr == NULL) |
756 |
errorstr = "Permission denied.\n"; |
errorstr = "Permission denied.\n"; |
757 |
error (errorstr, errorhost); |
rshd_error (errorstr, errorhost); |
758 |
exit (1); |
exit (1); |
759 |
} |
} |
760 |
|
|
761 |
/* If the locuser isn't root, then check if logins are disabled. */ |
/* If the locuser isn't root, then check if logins are disabled. */ |
762 |
if (pwd->pw_uid && !access (PATH_NOLOGIN, F_OK)) |
if (pwd->pw_uid && !access (PATH_NOLOGIN, F_OK)) |
763 |
{ |
{ |
764 |
error ("Logins currently disabled.\n"); |
rshd_error ("Logins currently disabled.\n"); |
765 |
exit (1); |
exit (1); |
766 |
} |
} |
767 |
|
|
774 |
*/ |
*/ |
775 |
if (write (STDERR_FILENO, "\0", 1) < 0) |
if (write (STDERR_FILENO, "\0", 1) < 0) |
776 |
{ |
{ |
777 |
error ("Lost connection.\n"); |
rshd_error ("Lost connection.\n"); |
778 |
exit (1); |
exit (1); |
779 |
} |
} |
780 |
sent_null = 1; |
sent_null = 1; |
789 |
*/ |
*/ |
790 |
if (pipe (pv) < 0) |
if (pipe (pv) < 0) |
791 |
{ |
{ |
792 |
error ("Can't make pipe.\n"); |
rshd_error ("Can't make pipe.\n"); |
793 |
exit (1); |
exit (1); |
794 |
} |
} |
795 |
#ifdef ENCRYPTION |
#ifdef ENCRYPTION |
796 |
#ifdef KERBEROS |
#if defined(KERBEROS) || defined(SHISHI) |
797 |
if (doencrypt) |
if (doencrypt) |
798 |
{ |
{ |
799 |
if (pipe (pv1) < 0) |
if (pipe (pv1) < 0) |
800 |
{ |
{ |
801 |
error ("Can't make 2nd pipe.\n"); |
rshd_error ("Can't make 2nd pipe.\n"); |
802 |
exit (1); |
exit (1); |
803 |
} |
} |
804 |
if (pipe (pv2) < 0) |
if (pipe (pv2) < 0) |
805 |
{ |
{ |
806 |
error ("Can't make 3rd pipe.\n"); |
rshd_error ("Can't make 3rd pipe.\n"); |
807 |
exit (1); |
exit (1); |
808 |
} |
} |
809 |
} |
} |
812 |
pid = fork (); |
pid = fork (); |
813 |
if (pid == -1) |
if (pid == -1) |
814 |
{ |
{ |
815 |
error ("Can't fork; try again.\n"); |
rshd_error ("Can't fork; try again.\n"); |
816 |
exit (1); |
exit (1); |
817 |
} |
} |
818 |
if (pid) |
if (pid) |
823 |
* signal. |
* signal. |
824 |
*/ |
*/ |
825 |
#ifdef ENCRYPTION |
#ifdef ENCRYPTION |
826 |
#ifdef KERBEROS |
#if defined(KERBEROS) |
827 |
if (doencrypt) |
if (doencrypt) |
828 |
{ |
{ |
829 |
static char msg[] = SECURE_MESSAGE; |
static char msg[] = SECURE_MESSAGE; |
832 |
des_write (s, msg, sizeof(msg) - 1); |
des_write (s, msg, sizeof(msg) - 1); |
833 |
} |
} |
834 |
else |
else |
835 |
|
#elif defined(SHISHI) |
836 |
|
if (doencrypt) |
837 |
|
{ |
838 |
|
close (pv1[1]); |
839 |
|
close (pv2[1]); |
840 |
|
} |
841 |
|
else |
842 |
#endif |
#endif |
843 |
#endif |
#endif |
844 |
{ |
{ |
859 |
else |
else |
860 |
nfd = s; |
nfd = s; |
861 |
#ifdef ENCRYPTION |
#ifdef ENCRYPTION |
862 |
#ifdef KERBEROS |
#if defined(KERBEROS) || defined(SHISHI) |
863 |
if (doencrypt) |
if (doencrypt) |
864 |
{ |
{ |
865 |
FD_ZERO (&writeto); |
FD_ZERO (&writeto); |
879 |
{ |
{ |
880 |
ready = readfrom; |
ready = readfrom; |
881 |
#ifdef ENCRYPTION |
#ifdef ENCRYPTION |
882 |
#ifdef KERBEROS |
#if defined(KERBEROS) || defined(SHISHI) |
883 |
if (doencrypt) |
if (doencrypt) |
884 |
{ |
{ |
885 |
wready = writeto; |
#ifdef SHISHI |
886 |
|
wready = readfrom; |
887 |
|
#else |
888 |
|
wready = writeto; |
889 |
|
#endif |
890 |
if (select (nfd, &ready, &wready, (fd_set *) 0, |
if (select (nfd, &ready, &wready, (fd_set *) 0, |
891 |
(struct timeval *) 0) < 0) |
(struct timeval *) 0) < 0) |
892 |
break; |
break; |
906 |
if (doencrypt) |
if (doencrypt) |
907 |
ret = des_read (s, &sig, 1); |
ret = des_read (s, &sig, 1); |
908 |
else |
else |
909 |
|
#elif defined(SHISHI) |
910 |
|
if (doencrypt) |
911 |
|
readenc (h, s, &sig, &ret, &iv2, enckey, protocol); |
912 |
|
else |
913 |
#endif |
#endif |
914 |
#endif |
#endif |
915 |
ret = read (s, &sig, 1); |
ret = read (s, &sig, 1); |
934 |
if (doencrypt) |
if (doencrypt) |
935 |
des_write (s, buf, cc); |
des_write (s, buf, cc); |
936 |
else |
else |
937 |
|
#elif defined(SHISHI) |
938 |
|
if (doencrypt) |
939 |
|
writeenc (h, s, buf, cc, &n, &iv4, enckey, protocol); |
940 |
|
else |
941 |
#endif |
#endif |
942 |
#endif |
#endif |
943 |
write (s, buf, cc); |
write (s, buf, cc); |
944 |
} |
} |
945 |
} |
} |
946 |
#ifdef ENCRYPTION |
#ifdef ENCRYPTION |
947 |
#ifdef KERBEROS |
#if defined(KERBEROS) || defined(SHISHI) |
948 |
if (doencrypt && FD_ISSET(pv1[0], &ready)) |
if (doencrypt && FD_ISSET(pv1[0], &ready)) |
949 |
{ |
{ |
950 |
errno = 0; |
errno = 0; |
955 |
FD_CLR (pv1[0], &readfrom); |
FD_CLR (pv1[0], &readfrom); |
956 |
} |
} |
957 |
else |
else |
958 |
|
#ifdef SHISHI |
959 |
|
writeenc (h, STDOUT_FILENO, buf, cc, &n, &iv3, enckey, protocol); |
960 |
|
#else |
961 |
des_write (STDOUT_FILENO, buf, cc); |
des_write (STDOUT_FILENO, buf, cc); |
962 |
|
#endif |
963 |
} |
} |
964 |
|
|
965 |
if (doencrypt && FD_ISSET(pv2[0], &wready)) |
if (doencrypt && FD_ISSET(pv2[0], &wready)) |
966 |
{ |
{ |
967 |
errno = 0; |
errno = 0; |
968 |
|
#ifdef SHISHI |
969 |
|
readenc (h, STDIN_FILENO, buf, &cc, &iv1, enckey, protocol); |
970 |
|
#else |
971 |
cc = des_read (STDIN_FILENO, buf, sizeof buf); |
cc = des_read (STDIN_FILENO, buf, sizeof buf); |
972 |
|
#endif |
973 |
if (cc <= 0) |
if (cc <= 0) |
974 |
{ |
{ |
975 |
shutdown (pv2[0], 1+1); |
shutdown (pv2[0], 1+1); |
982 |
#endif |
#endif |
983 |
} while (FD_ISSET (s, &readfrom) || |
} while (FD_ISSET (s, &readfrom) || |
984 |
#ifdef ENCRYPTION |
#ifdef ENCRYPTION |
985 |
#ifdef KERBEROS |
#if defined(KERBEROS) || defined(SHISHI) |
986 |
(doencrypt && FD_ISSET (pv1[0], &readfrom)) || |
(doencrypt && FD_ISSET (pv1[0], &readfrom)) || |
987 |
#endif |
#endif |
988 |
#endif |
#endif |
1004 |
close(s); /* control process handles this fd */ |
close(s); /* control process handles this fd */ |
1005 |
close (pv[0]); /* close read end of pipe */ |
close (pv[0]); /* close read end of pipe */ |
1006 |
#ifdef ENCRYPTION |
#ifdef ENCRYPTION |
1007 |
#ifdef KERBEROS |
#if defined(KERBEROS) || defined(SHISHI) |
1008 |
if (doencrypt) |
if (doencrypt) |
1009 |
{ |
{ |
1010 |
close (pv1[0]); close (pv2[0]); |
close (pv1[0]); close (pv2[0]); |
1015 |
} |
} |
1016 |
#endif |
#endif |
1017 |
#endif |
#endif |
1018 |
|
|
1019 |
|
#if defined(SHISHI) |
1020 |
|
if (use_kerberos) |
1021 |
|
{ |
1022 |
|
int i; |
1023 |
|
|
1024 |
|
shishi_done (h); |
1025 |
|
#ifdef ENCRYPTION |
1026 |
|
if (doencrypt) |
1027 |
|
{ |
1028 |
|
shishi_key_done (enckey); |
1029 |
|
for (i = 0; i < 4; i++) |
1030 |
|
{ |
1031 |
|
shishi_crypto_close (ivtab[i]->ctx); |
1032 |
|
free (ivtab[i]->iv); |
1033 |
|
} |
1034 |
|
} |
1035 |
|
#endif |
1036 |
|
} |
1037 |
|
|
1038 |
|
#endif |
1039 |
|
|
1040 |
dup2 (pv[1], STDERR_FILENO); /* stderr of shell has to go |
dup2 (pv[1], STDERR_FILENO); /* stderr of shell has to go |
1041 |
pipe to control process */ |
pipe to control process */ |
1042 |
close (pv[1]); |
close (pv[1]); |
1067 |
chdir ("/"); |
chdir ("/"); |
1068 |
syslog (LOG_INFO|LOG_AUTH, "%s@%s as %s: no home directory. cmd='%.80s'", |
syslog (LOG_INFO|LOG_AUTH, "%s@%s as %s: no home directory. cmd='%.80s'", |
1069 |
remuser, hostname, locuser, cmdbuf); |
remuser, hostname, locuser, cmdbuf); |
1070 |
error ("No remote directory.\n"); |
rshd_error ("No remote directory.\n"); |
1071 |
#ifdef notdef |
#ifdef notdef |
1072 |
exit (1); |
exit (1); |
1073 |
#endif |
#endif |
1098 |
syslog (LOG_INFO|LOG_AUTH, "%s@%s as %s: cmd='%.80s'", |
syslog (LOG_INFO|LOG_AUTH, "%s@%s as %s: cmd='%.80s'", |
1099 |
remuser, hostname, locuser, cmdbuf); |
remuser, hostname, locuser, cmdbuf); |
1100 |
} |
} |
1101 |
execl (pwd->pw_shell, cp, "-c", cmdbuf, 0); |
#ifdef SHISHI |
1102 |
perror (pwd->pw_shell); |
if (doencrypt) |
1103 |
exit (1); |
execl (pwd->pw_shell, cp, "-c", cmdbuf+3, 0); |
1104 |
|
else |
1105 |
|
#endif |
1106 |
|
execl (pwd->pw_shell, cp, "-c", cmdbuf, 0); |
1107 |
|
error (1, errno, "cannot execute %s", pwd->pw_shell); |
1108 |
} |
} |
1109 |
|
|
1110 |
/* |
/* |
1114 |
*/ |
*/ |
1115 |
|
|
1116 |
void |
void |
1117 |
#if defined(HAVE_STDARG_H) && defined(__STDC__) && __STDC__ |
rshd_error (const char *fmt, ...) |
|
error (const char *fmt, ...) |
|
|
#else |
|
|
error (fmt, va_alist) |
|
|
char *fmt; |
|
|
va_dcl |
|
|
#endif |
|
1118 |
{ |
{ |
1119 |
va_list ap; |
va_list ap; |
1120 |
int len; |
int len; |
1121 |
char *bp, buf[BUFSIZ]; |
char *bp, buf[BUFSIZ]; |
|
#if defined(HAVE_STDARG_H) && defined(__STDC__) && __STDC__ |
|
1122 |
va_start (ap, fmt); |
va_start (ap, fmt); |
1123 |
#else |
|
|
va_start (ap); |
|
|
#endif |
|
1124 |
bp = buf; |
bp = buf; |
1125 |
if (sent_null == 0) |
if (sent_null == 0) |
1126 |
{ |
{ |
1140 |
|
|
1141 |
if (! buf) |
if (! buf) |
1142 |
{ |
{ |
1143 |
error ("Out of space reading %s\n", err); |
rshd_error ("Out of space reading %s\n", err); |
1144 |
exit (1); |
exit (1); |
1145 |
} |
} |
1146 |
|
|
1151 |
if (rd <= 0) |
if (rd <= 0) |
1152 |
{ |
{ |
1153 |
if (rd == 0) |
if (rd == 0) |
1154 |
error ("EOF reading %s\n", err); |
rshd_error ("EOF reading %s\n", err); |
1155 |
else |
else |
1156 |
perror (err); |
perror (err); |
1157 |
exit (1); |
exit (1); |
1166 |
buf = realloc (buf, buf_len); |
buf = realloc (buf, buf_len); |
1167 |
if (! buf) |
if (! buf) |
1168 |
{ |
{ |
1169 |
error ("Out of space reading %s\n", err); |
rshd_error ("Out of space reading %s\n", err); |
1170 |
exit (1); |
exit (1); |
1171 |
} |
} |
1172 |
end = buf + end_offs; |
end = buf + end_offs; |
1244 |
-L, --log-session Set local domain name"); |
-L, --log-session Set local domain name"); |
1245 |
puts ("\ |
puts ("\ |
1246 |
-n, --no-keepalive Do not set SO_KEEPALIVE"); |
-n, --no-keepalive Do not set SO_KEEPALIVE"); |
1247 |
#ifdef KERBEROS |
#if defined(KERBEROS) || defined(SHISHI) |
1248 |
puts ("\ |
puts ("\ |
1249 |
-k, --kerberos Use kerberos IV authentication"); |
-k, --kerberos Use kerberos IV authentication"); |
1250 |
#ifdef ENCRYPTION |
#ifdef ENCRYPTION |