Attachment #2015 for bug #1402

View | Details | Raw Unified | Return to bug 1402 | Differences between

and this patch




{
	/* not implemented */
}

void
audit_destroy_sensitive_data(const char *fp)
{
	/* not implemented */
}

void
audit_destroy_sensitive_data(const char *fp, pid_t pid, uid_t uid)
{
	/* not implemented */
}

void
audit_generate_ephemeral_server_key(const char *fp)
{
	/* not implemented */
}
#endif /* BSM */




	debug("audit session key discard euid %u direction %d from pid %ld uid %u",
		(unsigned)geteuid(), ctos, (long)pid, (unsigned)uid);
}

/*
 * This will be called on destroy private part of the server key
 */
void
audit_destroy_sensitive_data(const char *fp, pid_t pid, uid_t uid)
{
	debug("audit destroy sensitive data euid %d fingerprint %s from pid %ld uid %u",
		geteuid(), fp, (long)pid, (unsigned)uid);
}

/*
 * This will be called on generation of the ephemeral server key
 */
void
audit_generate_ephemeral_server_key(const char *)
{
	debug("audit create ephemeral server key euid %d fingerprint %s", geteuid(), fp);
}
# endif  /* !defined CUSTOM_SSH_AUDIT_EVENTS */
#endif /* SSH_AUDIT_EVENTS */

Lines 48-53 enum ssh_audit_event_type { Link Here

(-)openssh-5.8p1/audit.h.audit5 (+4 lines)
48	};	48	};
49	typedef enum ssh_audit_event_type ssh_audit_event_t;	49	typedef enum ssh_audit_event_type ssh_audit_event_t;
50		50
		51	int listening_for_clients(void);
		52
51	void audit_connection_from(const char *, int);	53	void audit_connection_from(const char *, int);
52	void audit_event(ssh_audit_event_t);	54	void audit_event(ssh_audit_event_t);
53	void audit_count_session_open(void);	55	void audit_count_session_open(void);
Lines 64-68 void audit_unsupported_body(int); Link Here
64	void audit_kex_body(int, char , char , char *, pid_t, uid_t);	66	void audit_kex_body(int, char , char , char *, pid_t, uid_t);
65	void audit_session_key_free(int ctos);	67	void audit_session_key_free(int ctos);
66	void audit_session_key_free_body(int ctos, pid_t, uid_t);	68	void audit_session_key_free_body(int ctos, pid_t, uid_t);
		69	void audit_destroy_sensitive_data(const char *, pid_t, uid_t);
		70	void audit_generate_ephemeral_server_key(const char *);
67		71
68	#endif /* _SSH_AUDIT_H */	72	#endif /* _SSH_AUDIT_H */




		error("cannot write into audit");
}

void
audit_destroy_sensitive_data(const char *fp, pid_t pid, uid_t uid)
{
	char buf[AUDIT_LOG_SIZE];
	int audit_fd, audit_ok;

	snprintf(buf, sizeof(buf), "op=destroy kind=server fp=%s direction=? spid=%jd suid=%jd ",
		fp, (intmax_t)pid, (intmax_t)uid);
	audit_fd = audit_open();
	if (audit_fd < 0) {
		if (errno != EINVAL && errno != EPROTONOSUPPORT &&
					 errno != EAFNOSUPPORT)
			error("cannot open audit");
		return;
	}
	audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_KEY_USER,
			buf, NULL,
			listening_for_clients() ? NULL : get_remote_ipaddr(),
			NULL, 1);
	audit_close(audit_fd);
	/* do not abort if the error is EPERM and sshd is run as non root user */
	if ((audit_ok < 0) && ((audit_ok != -1) || (getuid() == 0)))
		error("cannot write into audit");
}

void
audit_generate_ephemeral_server_key(const char *fp)
{
	char buf[AUDIT_LOG_SIZE];
	int audit_fd, audit_ok;

	snprintf(buf, sizeof(buf), "op=create kind=server fp=%s direction=? ", fp);
	audit_fd = audit_open();
	if (audit_fd < 0) {
		if (errno != EINVAL && errno != EPROTONOSUPPORT &&
					 errno != EAFNOSUPPORT)
			error("cannot open audit");
		return;
	}
	audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_KEY_USER,
			buf, NULL, 0, NULL, 1);
	audit_close(audit_fd);
	/* do not abort if the error is EPERM and sshd is run as non root user */
	if ((audit_ok < 0) && ((audit_ok != -1) || (getuid() == 0)))
		error("cannot write into audit");
}
#endif /* USE_LINUX_AUDIT */




}

int
key_is_private(const Key *k)
{
	switch (k->type) {
	case KEY_RSA_CERT_V00:
	case KEY_RSA_CERT:
	case KEY_RSA1:
	case KEY_RSA:
		return k->rsa->d != NULL;
	case KEY_DSA_CERT_V00:
	case KEY_DSA_CERT:
	case KEY_DSA:
		return k->dsa->priv_key != NULL;
#ifdef OPENSSL_HAS_ECC
	case KEY_ECDSA_CERT:
	case KEY_ECDSA:
		return EC_KEY_get0_private_key(k->ecdsa) != NULL;
#endif
	default:
		fatal("key_is_private: bad key type %d", k->type);
		return 1;
	}
}

int
key_is_cert(const Key *k)
{
	if (k == NULL)

Lines 109-114 Key *key_generate(int, u_int); Link Here

(-)openssh-5.8p1/key.h.audit5 (+1 lines)
109	Key key_from_private(const Key );	109	Key key_from_private(const Key );
110	int key_type_from_name(char *);	110	int key_type_from_name(char *);
111	int key_is_cert(const Key *);	111	int key_is_cert(const Key *);
		112	int key_is_private(const Key *k);
112	int key_type_plain(int);	113	int key_type_plain(int);
113	int key_to_certified(Key *, int);	114	int key_to_certified(Key *, int);
114	int key_drop_cert(Key *);	115	int key_drop_cert(Key *);

Lines 106-111 extern Buffer auth_debug; Link Here

(-)openssh-5.8p1/monitor.c.audit5 (+29 lines)
106	extern int auth_debug_init;	106	extern int auth_debug_init;
107	extern Buffer loginmsg;	107	extern Buffer loginmsg;
108		108
		109	extern void destroy_sensitive_data(int);
		110
109	/* State exported from the child */	111	/* State exported from the child */
110		112
111	struct {	113	struct {
Lines 182-187 int mm_answer_audit_end_command(int, Buf Link Here
182	int mm_answer_audit_unsupported_body(int, Buffer *);	184	int mm_answer_audit_unsupported_body(int, Buffer *);
183	int mm_answer_audit_kex_body(int, Buffer *);	185	int mm_answer_audit_kex_body(int, Buffer *);
184	int mm_answer_audit_session_key_free_body(int, Buffer *);	186	int mm_answer_audit_session_key_free_body(int, Buffer *);
		187	int mm_answer_audit_server_key_free(int, Buffer *);
185	#endif	188	#endif
186		189
187	static Authctxt *authctxt;	190	static Authctxt *authctxt;
Lines 233-238 struct mon_table mon_dispatch_proto20[] Link Here
233	{MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},	236	{MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},
234	{MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},	237	{MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},
235	{MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MON_PERMIT, mm_answer_audit_session_key_free_body},	238	{MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MON_PERMIT, mm_answer_audit_session_key_free_body},
		239	{MONITOR_REQ_AUDIT_SERVER_KEY_FREE, MON_PERMIT, mm_answer_audit_server_key_free},
236	#endif	240	#endif
237	#ifdef BSD_AUTH	241	#ifdef BSD_AUTH
238	{MONITOR_REQ_BSDAUTHQUERY, MON_ISAUTH, mm_answer_bsdauthquery},	242	{MONITOR_REQ_BSDAUTHQUERY, MON_ISAUTH, mm_answer_bsdauthquery},
Lines 273-278 struct mon_table mon_dispatch_postauth20 Link Here
273	{MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},	277	{MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},
274	{MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},	278	{MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},
275	{MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MON_PERMIT, mm_answer_audit_session_key_free_body},	279	{MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MON_PERMIT, mm_answer_audit_session_key_free_body},
		280	{MONITOR_REQ_AUDIT_SERVER_KEY_FREE, MON_PERMIT, mm_answer_audit_server_key_free},
276	#endif	281	#endif
277	{0, 0, NULL}	282	{0, 0, NULL}
278	};	283	};
Lines 307-312 struct mon_table mon_dispatch_proto15[] Link Here
307	{MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},	312	{MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},
308	{MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},	313	{MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},
309	{MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MON_PERMIT, mm_answer_audit_session_key_free_body},	314	{MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MON_PERMIT, mm_answer_audit_session_key_free_body},
		315	{MONITOR_REQ_AUDIT_SERVER_KEY_FREE, MON_PERMIT, mm_answer_audit_server_key_free},
310	#endif	316	#endif
311	{0, 0, NULL}	317	{0, 0, NULL}
312	};	318	};
Lines 322-327 struct mon_table mon_dispatch_postauth15 Link Here
322	{MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},	328	{MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},
323	{MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},	329	{MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},
324	{MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MON_PERMIT, mm_answer_audit_session_key_free_body},	330	{MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MON_PERMIT, mm_answer_audit_session_key_free_body},
		331	{MONITOR_REQ_AUDIT_SERVER_KEY_FREE, MON_PERMIT, mm_answer_audit_server_key_free},
325	#endif	332	#endif
326	{0, 0, NULL}	333	{0, 0, NULL}
327	};	334	};
Lines 1607-1612 mm_answer_term(int sock, Buffer *req) Link Here
1607	sshpam_cleanup();	1614	sshpam_cleanup();
1608	#endif	1615	#endif
1609		1616
		1617	destroy_sensitive_data(0);
		1618
1610	while (waitpid(pmonitor->m_pid, &status, 0) == -1)	1619	while (waitpid(pmonitor->m_pid, &status, 0) == -1)
1611	if (errno != EINTR)	1620	if (errno != EINTR)
1612	exit(1);	1621	exit(1);
Lines 2338-2341 mm_answer_audit_session_key_free_body(in Link Here
2338	mm_request_send(sock, MONITOR_ANS_AUDIT_SESSION_KEY_FREE, m);	2347	mm_request_send(sock, MONITOR_ANS_AUDIT_SESSION_KEY_FREE, m);
2339	return 0;	2348	return 0;
2340	}	2349	}
		2350
		2351	int
		2352	mm_answer_audit_server_key_free(int sock, Buffer *m)
		2353	{
		2354	int len;
		2355	char *fp;
		2356	pid_t pid;
		2357	uid_t uid;
		2358
		2359	fp = buffer_get_string(m, &len);
		2360	pid = buffer_get_int64(m);
		2361	uid = buffer_get_int64(m);
		2362
		2363	audit_destroy_sensitive_data(fp, pid, uid);
		2364
		2365	buffer_clear(m);
		2366
		2367	mm_request_send(sock, MONITOR_ANS_AUDIT_SERVER_KEY_FREE, m);
		2368	return 0;
		2369	}
2341	#endif /* SSH_AUDIT_EVENTS */	2370	#endif /* SSH_AUDIT_EVENTS */

Lines 70-75 enum monitor_reqtype { Link Here

(-)openssh-5.8p1/monitor.h.audit5 (+1 lines)
70	MONITOR_REQ_AUDIT_UNSUPPORTED, MONITOR_ANS_AUDIT_UNSUPPORTED,	70	MONITOR_REQ_AUDIT_UNSUPPORTED, MONITOR_ANS_AUDIT_UNSUPPORTED,
71	MONITOR_REQ_AUDIT_KEX, MONITOR_ANS_AUDIT_KEX,	71	MONITOR_REQ_AUDIT_KEX, MONITOR_ANS_AUDIT_KEX,
72	MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MONITOR_ANS_AUDIT_SESSION_KEY_FREE,	72	MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MONITOR_ANS_AUDIT_SESSION_KEY_FREE,
		73	MONITOR_REQ_AUDIT_SERVER_KEY_FREE, MONITOR_ANS_AUDIT_SERVER_KEY_FREE,
73	};	74	};
74		75
75	struct mm_master;	76	struct mm_master;




				  &m);
	buffer_free(&m);
}

void
mm_audit_destroy_sensitive_data(const char *fp, pid_t pid, uid_t uid)
{
	Buffer m;

	buffer_init(&m);
	buffer_put_cstring(&m, fp);
	buffer_put_int64(&m, pid);
	buffer_put_int64(&m, uid);

	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_SERVER_KEY_FREE, &m);
	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUDIT_SERVER_KEY_FREE,
				  &m);
	buffer_free(&m);
}
#endif /* SSH_AUDIT_EVENTS */

Lines 79-84 void mm_audit_end_command(int, const cha Link Here

(-)openssh-5.8p1/monitor_wrap.h.audit5 (+1 lines)
79	void mm_audit_unsupported_body(int);	79	void mm_audit_unsupported_body(int);
80	void mm_audit_kex_body(int, char , char , char *, pid_t, uid_t);	80	void mm_audit_kex_body(int, char , char , char *, pid_t, uid_t);
81	void mm_audit_session_key_free_body(int, pid_t, uid_t);	81	void mm_audit_session_key_free_body(int, pid_t, uid_t);
		82	void mm_audit_destroy_sensitive_data(const char *, pid_t, uid_t);
82	#endif	83	#endif
83		84
84	struct Session;	85	struct Session;

Lines 132-138 extern int log_stderr; Link Here

(-)openssh-5.8p1/session.c.audit5 (-2 / +2 lines)
132	extern int debug_flag;	132	extern int debug_flag;
133	extern u_int utmp_len;	133	extern u_int utmp_len;
134	extern int startup_pipe;	134	extern int startup_pipe;
135	extern void destroy_sensitive_data(void);	135	extern void destroy_sensitive_data(int);
136	extern Buffer loginmsg;	136	extern Buffer loginmsg;
137		137
138	/* original command from peer. */	138	/* original command from peer. */
Lines 1626-1632 do_child(Session s, const char command Link Here
1626	int r = 0;	1626	int r = 0;
1627		1627
1628	/* remove hostkey from the child's memory */	1628	/* remove hostkey from the child's memory */
1629	destroy_sensitive_data();	1629	destroy_sensitive_data(1);
1630	/* Don't audit this - both us and the parent would be talking to the	1630	/* Don't audit this - both us and the parent would be talking to the
1631	monitor over a single socket, with no synchronization. */	1631	monitor over a single socket, with no synchronization. */
1632	packet_destroy_all(0, 1);	1632	packet_destroy_all(0, 1);

Lines 253-259 Buffer loginmsg; Link Here

(-)openssh-5.8p1/sshd.c.audit5 (-6 / +72 lines)
253	struct passwd *privsep_pw = NULL;	253	struct passwd *privsep_pw = NULL;
254		254
255	/* Prototypes for various functions defined later in this file. */	255	/* Prototypes for various functions defined later in this file. */
256	void destroy_sensitive_data(void);	256	void destroy_sensitive_data(int);
257	void demote_sensitive_data(void);	257	void demote_sensitive_data(void);
258		258
259	static void do_ssh1_kex(void);	259	static void do_ssh1_kex(void);
Lines 272-277 close_listen_socks(void) Link Here
272	num_listen_socks = -1;	272	num_listen_socks = -1;
273	}	273	}
274		274
		275	/*
		276	* Is this process listening for clients (i.e. not specific to any specific
		277	* client connection?)
		278	*/
		279	int listening_for_clients(void)
		280	{
		281	return num_listen_socks > 0;
		282	}
		283
275	static void	284	static void
276	close_startup_pipes(void)	285	close_startup_pipes(void)
277	{	286	{
Lines 532-553 sshd_exchange_identification(int sock_in Link Here
532	}	541	}
533	}	542	}
534		543
535	/* Destroy the host and server keys. They will no longer be needed. */	544	/*
		545	* Destroy the host and server keys. They will no longer be needed. Careful,
		546	* this can be called from cleanup_exit() - i.e. from just about anywhere.
		547	*/
536	void	548	void
537	destroy_sensitive_data(void)	549	destroy_sensitive_data(int privsep)
538	{	550	{
539	int i;	551	int i;
		552	pid_t pid;
		553	uid_t uid;
540		554
541	if (sensitive_data.server_key) {	555	if (sensitive_data.server_key) {
542	key_free(sensitive_data.server_key);	556	key_free(sensitive_data.server_key);
543	sensitive_data.server_key = NULL;	557	sensitive_data.server_key = NULL;
544	}	558	}
		559	pid = getpid();
		560	uid = getuid();
545	for (i = 0; i < options.num_host_key_files; i++) {	561	for (i = 0; i < options.num_host_key_files; i++) {
546	if (sensitive_data.host_keys[i]) {	562	if (sensitive_data.host_keys[i]) {
		563	char *fp;
		564
		565	if (key_is_private(sensitive_data.host_keys[i]))
		566	fp = key_fingerprint(sensitive_data.host_keys[i],
		567	FIPS_mode() ? SSH_FP_SHA1 : SSH_FP_MD5,
		568	SSH_FP_HEX);
		569	else
		570	fp = NULL;
547	key_free(sensitive_data.host_keys[i]);	571	key_free(sensitive_data.host_keys[i]);
548	sensitive_data.host_keys[i] = NULL;	572	sensitive_data.host_keys[i] = NULL;
		573	if (fp != NULL) {
		574	if (privsep)
		575	PRIVSEP(audit_destroy_sensitive_data(fp,
		576	pid, uid));
		577	else
		578	audit_destroy_sensitive_data(fp,
		579	pid, uid);
		580	xfree(fp);
		581	}
549	}	582	}
550	if (sensitive_data.host_certificates[i]) {	583	if (sensitive_data.host_certificates
		584	&& sensitive_data.host_certificates[i]) {
551	key_free(sensitive_data.host_certificates[i]);	585	key_free(sensitive_data.host_certificates[i]);
552	sensitive_data.host_certificates[i] = NULL;	586	sensitive_data.host_certificates[i] = NULL;
553	}	587	}
Lines 561-566 void Link Here
561	demote_sensitive_data(void)	595	demote_sensitive_data(void)
562	{	596	{
563	Key *tmp;	597	Key *tmp;
		598	pid_t pid;
		599	uid_t uid;
564	int i;	600	int i;
565		601
566	if (sensitive_data.server_key) {	602	if (sensitive_data.server_key) {
Lines 569-581 demote_sensitive_data(void) Link Here
569	sensitive_data.server_key = tmp;	605	sensitive_data.server_key = tmp;
570	}	606	}
571		607
		608	pid = getpid();
		609	uid = getuid();
572	for (i = 0; i < options.num_host_key_files; i++) {	610	for (i = 0; i < options.num_host_key_files; i++) {
573	if (sensitive_data.host_keys[i]) {	611	if (sensitive_data.host_keys[i]) {
		612	char *fp;
		613
		614	if (key_is_private(sensitive_data.host_keys[i]))
		615	fp = key_fingerprint(sensitive_data.host_keys[i],
		616	FIPS_mode() ? SSH_FP_SHA1 : SSH_FP_MD5,
		617	SSH_FP_HEX);
		618	else
		619	fp = NULL;
574	tmp = key_demote(sensitive_data.host_keys[i]);	620	tmp = key_demote(sensitive_data.host_keys[i]);
575	key_free(sensitive_data.host_keys[i]);	621	key_free(sensitive_data.host_keys[i]);
576	sensitive_data.host_keys[i] = tmp;	622	sensitive_data.host_keys[i] = tmp;
577	if (tmp->type == KEY_RSA1)	623	if (tmp->type == KEY_RSA1)
578	sensitive_data.ssh1_host_key = tmp;	624	sensitive_data.ssh1_host_key = tmp;
		625	if (fp != NULL) {
		626	audit_destroy_sensitive_data(fp, pid, uid);
		627	xfree(fp);
		628	}
579	}	629	}
580	/* Certs do not need demotion */	630	/* Certs do not need demotion */
581	}	631	}
Lines 1120-1125 server_accept_loop(int sock_in, int so Link Here
1120	if (received_sigterm) {	1170	if (received_sigterm) {
1121	logit("Received signal %d; terminating.",	1171	logit("Received signal %d; terminating.",
1122	(int) received_sigterm);	1172	(int) received_sigterm);
		1173	destroy_sensitive_data(0);
1123	close_listen_socks();	1174	close_listen_socks();
1124	unlink(options.pid_file);	1175	unlink(options.pid_file);
1125	exit(0);	1176	exit(0);
Lines 2023-2029 main(int ac, char **av) Link Here
2023	privsep_postauth(authctxt);	2074	privsep_postauth(authctxt);
2024	/* the monitor process [priv] will not return */	2075	/* the monitor process [priv] will not return */
2025	if (!compat20)	2076	if (!compat20)
2026	destroy_sensitive_data();	2077	destroy_sensitive_data(0);
2027	}	2078	}
2028		2079
2029	packet_set_timeout(options.client_alive_interval,	2080	packet_set_timeout(options.client_alive_interval,
Lines 2034-2039 main(int ac, char **av) Link Here
2034		2085
2035	/* The connection has been terminated. */	2086	/* The connection has been terminated. */
2036	packet_destroy_all(1, 1);	2087	packet_destroy_all(1, 1);
		2088	destroy_sensitive_data(1);
2037		2089
2038	packet_get_state(MODE_IN, NULL, NULL, NULL, &ibytes);	2090	packet_get_state(MODE_IN, NULL, NULL, NULL, &ibytes);
2039	packet_get_state(MODE_OUT, NULL, NULL, NULL, &obytes);	2091	packet_get_state(MODE_OUT, NULL, NULL, NULL, &obytes);
Lines 2262-2268 do_ssh1_kex(void) Link Here
2262	session_id[i] = session_key[i] ^ session_key[i + 16];	2314	session_id[i] = session_key[i] ^ session_key[i + 16];
2263	}	2315	}
2264	/* Destroy the private and public keys. No longer. */	2316	/* Destroy the private and public keys. No longer. */
2265	destroy_sensitive_data();	2317	destroy_sensitive_data(0);
2266		2318
2267	if (use_privsep)	2319	if (use_privsep)
2268	mm_ssh1_session_id(session_id);	2320	mm_ssh1_session_id(session_id);
Lines 2352-2359 do_ssh2_kex(void) Link Here
2352	void	2404	void
2353	cleanup_exit(int i)	2405	cleanup_exit(int i)
2354	{	2406	{
		2407	static int in_cleanup;
		2408
		2409	int is_privsep_child;
		2410
		2411	/* cleanup_exit can be called at the very least from the privsep
		2412	wrappers used for auditing. Make sure we don't recurse
		2413	indefinitely. */
		2414	if (in_cleanup)
		2415	_exit(i);
		2416	in_cleanup = 1;
		2417
2355	if (the_authctxt)	2418	if (the_authctxt)
2356	do_cleanup(the_authctxt);	2419	do_cleanup(the_authctxt);
		2420	is_privsep_child = use_privsep && pmonitor != NULL && !mm_is_monitor();
		2421	if (sensitive_data.host_keys != NULL)
		2422	destroy_sensitive_data(is_privsep_child);
2357	packet_destroy_all(1, is_privsep_child);	2423	packet_destroy_all(1, is_privsep_child);
2358	#ifdef SSH_AUDIT_EVENTS	2424	#ifdef SSH_AUDIT_EVENTS
2359	/* done after do_cleanup so it can cancel the PAM auth 'thread' */	2425	/* done after do_cleanup so it can cancel the PAM auth 'thread' */

Return to bug 1402

Lines 1797-1802 key_demote(const Key *k) Link Here

(-)openssh-5.8p1/key.c.audit5 (+24 lines)
1797	}	1797	}
1798		1798
1799	int	1799	int
		1800	key_is_private(const Key *k)
		1801	{
		1802	switch (k->type) {
		1803	case KEY_RSA_CERT_V00:
		1804	case KEY_RSA_CERT:
		1805	case KEY_RSA1:
		1806	case KEY_RSA:
		1807	return k->rsa->d != NULL;
		1808	case KEY_DSA_CERT_V00:
		1809	case KEY_DSA_CERT:
		1810	case KEY_DSA:
		1811	return k->dsa->priv_key != NULL;
		1812	#ifdef OPENSSL_HAS_ECC
		1813	case KEY_ECDSA_CERT:
		1814	case KEY_ECDSA:
		1815	return EC_KEY_get0_private_key(k->ecdsa) != NULL;
		1816	#endif
		1817	default:
		1818	fatal("key_is_private: bad key type %d", k->type);
		1819	return 1;
		1820	}
		1821	}
		1822
		1823	int
1800	key_is_cert(const Key *k)	1824	key_is_cert(const Key *k)
1801	{	1825	{
1802	if (k == NULL)	1826	if (k == NULL)

Lines 1501-1504 mm_audit_session_key_free_body(int ctos, Link Here

(-)openssh-5.8p1/monitor_wrap.c.audit5 (+16 lines)
1501	&m);	1501	&m);
1502	buffer_free(&m);	1502	buffer_free(&m);
1503	}	1503	}
		1504
		1505	void
		1506	mm_audit_destroy_sensitive_data(const char *fp, pid_t pid, uid_t uid)
		1507	{
		1508	Buffer m;
		1509
		1510	buffer_init(&m);
		1511	buffer_put_cstring(&m, fp);
		1512	buffer_put_int64(&m, pid);
		1513	buffer_put_int64(&m, uid);
		1514
		1515	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_SERVER_KEY_FREE, &m);
		1516	mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_AUDIT_SERVER_KEY_FREE,
		1517	&m);
		1518	buffer_free(&m);
		1519	}
1504	#endif /* SSH_AUDIT_EVENTS */	1520	#endif /* SSH_AUDIT_EVENTS */

Lines 414-417 audit_session_key_free_body(int ctos, pi Link Here

(-)openssh-5.8p1/audit-bsm.c.audit5 (+18 lines)
414	{	414	{
415	/* not implemented */	415	/* not implemented */
416	}	416	}
		417
		418	void
		419	audit_destroy_sensitive_data(const char *fp)
		420	{
		421	/* not implemented */
		422	}
		423
		424	void
		425	audit_destroy_sensitive_data(const char *fp, pid_t pid, uid_t uid)
		426	{
		427	/* not implemented */
		428	}
		429
		430	void
		431	audit_generate_ephemeral_server_key(const char *fp)
		432	{
		433	/* not implemented */
		434	}
417	#endif /* BSM */	435	#endif /* BSM */

Lines 290-294 audit_session_key_free_body(int ctos, pi Link Here

(-)openssh-5.8p1/audit.c.audit5 (+19 lines)
290	debug("audit session key discard euid %u direction %d from pid %ld uid %u",	290	debug("audit session key discard euid %u direction %d from pid %ld uid %u",
291	(unsigned)geteuid(), ctos, (long)pid, (unsigned)uid);	291	(unsigned)geteuid(), ctos, (long)pid, (unsigned)uid);
292	}	292	}
		293
		294	/*
		295	* This will be called on destroy private part of the server key
		296	*/
		297	void
		298	audit_destroy_sensitive_data(const char *fp, pid_t pid, uid_t uid)
		299	{
		300	debug("audit destroy sensitive data euid %d fingerprint %s from pid %ld uid %u",
		301	geteuid(), fp, (long)pid, (unsigned)uid);
		302	}
		303
		304	/*
		305	* This will be called on generation of the ephemeral server key
		306	*/
		307	void
		308	audit_generate_ephemeral_server_key(const char *)
		309	{
		310	debug("audit create ephemeral server key euid %d fingerprint %s", geteuid(), fp);
		311	}
293	# endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */	312	# endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */
294	#endif /* SSH_AUDIT_EVENTS */	313	#endif /* SSH_AUDIT_EVENTS */

Lines 350-353 audit_session_key_free_body(int ctos, pi Link Here

(-)openssh-5.8p1/audit-linux.c.audit5 (+46 lines)
350	error("cannot write into audit");	350	error("cannot write into audit");
351	}	351	}
352		352
		353	void
		354	audit_destroy_sensitive_data(const char *fp, pid_t pid, uid_t uid)
		355	{
		356	char buf[AUDIT_LOG_SIZE];
		357	int audit_fd, audit_ok;
		358
		359	snprintf(buf, sizeof(buf), "op=destroy kind=server fp=%s direction=? spid=%jd suid=%jd ",
		360	fp, (intmax_t)pid, (intmax_t)uid);
		361	audit_fd = audit_open();
		362	if (audit_fd < 0) {
		363	if (errno != EINVAL && errno != EPROTONOSUPPORT &&
		364	errno != EAFNOSUPPORT)
		365	error("cannot open audit");
		366	return;
		367	}
		368	audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_KEY_USER,
		369	buf, NULL,
		370	listening_for_clients() ? NULL : get_remote_ipaddr(),
		371	NULL, 1);
		372	audit_close(audit_fd);
		373	/* do not abort if the error is EPERM and sshd is run as non root user */
		374	if ((audit_ok < 0) && ((audit_ok != -1) \|\| (getuid() == 0)))
		375	error("cannot write into audit");
		376	}
		377
		378	void
		379	audit_generate_ephemeral_server_key(const char *fp)
		380	{
		381	char buf[AUDIT_LOG_SIZE];
		382	int audit_fd, audit_ok;
		383
		384	snprintf(buf, sizeof(buf), "op=create kind=server fp=%s direction=? ", fp);
		385	audit_fd = audit_open();
		386	if (audit_fd < 0) {
		387	if (errno != EINVAL && errno != EPROTONOSUPPORT &&
		388	errno != EAFNOSUPPORT)
		389	error("cannot open audit");
		390	return;
		391	}
		392	audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_KEY_USER,
		393	buf, NULL, 0, NULL, 1);
		394	audit_close(audit_fd);
		395	/* do not abort if the error is EPERM and sshd is run as non root user */
		396	if ((audit_ok < 0) && ((audit_ok != -1) \|\| (getuid() == 0)))
		397	error("cannot write into audit");
		398	}
353	#endif /* USE_LINUX_AUDIT */	399	#endif /* USE_LINUX_AUDIT */