Attachment #2000 for bug #1213




#include "dispatch.h"
#include "monitor.h"
#include "roaming.h"
#include "canohost.h"

#if OPENSSL_VERSION_NUMBER >= 0x00907000L
# if defined(HAVE_EVP_SHA256)

{
	char *hostkeyalg = match_list(client, server, NULL);
	if (hostkeyalg == NULL)
		fatal("no '%.100s' hostkey alg(s) for %.200s", client, get_remote_ipaddr());
	k->hostkey_type = key_type_from_name(hostkeyalg);
	if (k->hostkey_type == KEY_UNSPEC)
		fatal("bad hostkey alg '%s' for %.200s", hostkeyalg, get_remote_ipaddr());
	xfree(hostkeyalg);
}


Lines 1025-1030 Link Here

(-)openssh-5.8p1/packet.c.orig (-1 / +8 lines)
1025	* be used during the interactive session.	1025	* be used during the interactive session.
1026	*/	1026	*/
1027		1027
		1028	int connclosed = 0; /* = 1 if connection closed by remote server */
		1029	/* prior to necessary data being read */
		1030	/* currently used in ssh-keyscan.c */
		1031
1028	int	1032	int
1029	packet_read_seqnr(u_int32_t *seqnr_p)	1033	packet_read_seqnr(u_int32_t *seqnr_p)
1030	{	1034	{
Lines 1035-1040 Link Here
1035		1039
1036	DBG(debug("packet_read()"));	1040	DBG(debug("packet_read()"));
1037		1041
		1042	connclosed = 0;
		1043
1038	setp = (fd_set *)xcalloc(howmany(active_state->connection_in + 1,	1044	setp = (fd_set *)xcalloc(howmany(active_state->connection_in + 1,
1039	NFDBITS), sizeof(fd_mask));	1045	NFDBITS), sizeof(fd_mask));
1040		1046
Lines 1100-1110 Link Here
1100	sizeof(buf), &cont);	1106	sizeof(buf), &cont);
1101	} while (len == 0 && cont);	1107	} while (len == 0 && cont);
1102	if (len == 0) {	1108	if (len == 0) {
		1109	connclosed = 1; /* if anybody wants to know */
1103	logit("Connection closed by %.200s", get_remote_ipaddr());	1110	logit("Connection closed by %.200s", get_remote_ipaddr());
1104	cleanup_exit(255);	1111	cleanup_exit(255);
1105	}	1112	}
1106	if (len < 0)	1113	if (len < 0)
1107	fatal("Read from socket failed: %.100s", strerror(errno));	1114	fatal("Read from %.200s failed: %.100s", get_remote_ipaddr(), strerror(errno));
1108	/* Append it to the buffer. */	1115	/* Append it to the buffer. */
1109	packet_process_incoming(buf, len);	1116	packet_process_incoming(buf, len);
1110	}	1117	}




#include "atomicio.h"
#include "misc.h"
#include "hostfile.h"
#include "canohost.h"

/* Flag indicating whether IPv4 or IPv6.  This can be set on the command line.
   Default value is AF_UNSPEC means both IPv4 and IPv6. */

#define MAXCON (maxfd - 10)

extern char *__progname;
extern int  connclosed;
fd_set *read_wait;
size_t read_wait_nfdset;
int ncon;

	int c_len;		/* Total bytes which must be read. */
	int c_off;		/* Length of data read so far. */
	int c_keytype;		/* Only one of KT_RSA1, KT_DSA, or KT_RSA */
	int c_connclosed;	/* = 1 if previous closed connection */
	char *c_namebase;	/* Address to free for c_name and c_namelist */
	char *c_name;		/* Hostname of connection for errors */
	char *c_namelist;	/* Pointer to other possible addresses */

{
	int j;

/*
 * New fd and socket.  Clear the possibly cached IP-address of the
 * remote host (kex.c:canonical_host_ip) of the previous socket.  Also
 * ensure that the packet_read_seqnr():Connection closed ..." flag is
 * clear (called by dispatch_run()).
 */
	clear_cached_addr();
	connclosed = 0;

	packet_set_connection(c->c_fd, c->c_fd);
	enable_compat20();
	myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = c->c_keytype == KT_DSA?

	memset(&hints, 0, sizeof(hints));
	hints.ai_family = IPv4or6;
	hints.ai_socktype = SOCK_STREAM;
	if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0) {
		error("getaddrinfo %s: %s", host, ssh_gai_strerror(gaierr));
		s = -1;
		return s;
	}
	for (ai = aitop; ai; ai = ai->ai_next) {
		s = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
		if (s < 0) {

	fdcon[s].c_len = 4;
	fdcon[s].c_off = 0;
	fdcon[s].c_keytype = keytype;
	fdcon[s].c_connclosed = 0;
	gettimeofday(&fdcon[s].c_tv, NULL);
	fdcon[s].c_tv.tv_sec += timeout;
	TAILQ_INSERT_TAIL(&tq, &fdcon[s], c_link);

{
	con *c = &fdcon[s];
	int ret;
	char *name;

/*
 * If "connclosed" isn't set, do the next host from c->c_namelist. Else,
 * restore the original string in c->c_namebase and redo the current
 * host.
 */
	name = c->c_namelist;		/* do next in list ??        */
	if (connclosed != 0) {
	    if (name && *name != '\0')	/* restore separator, if any */
		*(--name) = ',';
	    name = c->c_namebase;	/* redo current              */
	}
	ret = conalloc(name, c->c_output_name, c->c_keytype);
	confree(s);
	if (ret >= 0 && connclosed == s)
		fdcon[ret].c_connclosed = 1;	/* flag once         */
	return (ret);
}


		confree(s);
		return;
	}
	if (c->c_keytype == KT_RSA1) {
		c->c_status = CS_SIZE;
		contouch(s);
		return;
	}
/*
 * Read and print one of the ssh2 keys for this host.
 */
	keyprint(c, keygrab_ssh2(c));

/*
 * We're done with this host if the `packet_read_seqnr()' function was
 * able to complete its data read.
 */
	if (connclosed == 0) {
		confree(s);
	}
/*
 * We're also done with this host if the `packet.c:packet_read_seqnr()'
 * function received an EOF while attempting to read data (probably
 * caused by the LoginGraceTime being exceeded on the host) and if this
 * is the second time this has occurred for this host.
 */
	else if (c->c_connclosed) {
		confree(s);
		connclosed = -1;  /* conrecycle other active sockets */
	}
/*
 * Else, give this host one and only one more chance with this key.  We
 * don't know if this timeout was caused because of slow responses by
 * previous hosts or the host itself (or both (:@{)).  This host and all
 * other hosts that currently have open sockets will be `conrecycled()'.
 */
	else {
		connclosed = s;
	}
}

static void

		if (FD_ISSET(i, e)) {
			error("%s: exception!", fdcon[i].c_name);
			confree(i);
		} else if (FD_ISSET(i, r)) {
			conread(i);
/*
 * Break if the read attempt in the `packet_read_seqnr()' function
 * failed because the remote host closed the connection before the
 * packet data read was complete.  The closure probably occurred because
 * the LoginGraceTime was exceeded on the remote `sshd' server.  All
 * hosts that currently have a viable "fdcon[s]" entry will be recycled
 * below to negate the time used waiting for the current "fdcon[i]"th
 * host to respond.  This is really a kludgy way to do this.
 */
			if (connclosed)
				break;
		}
	}
	xfree(r);
	xfree(e);

	c = TAILQ_FIRST(&tq);
	i = -1;
	while (c && (connclosed ||
		     (c->c_tv.tv_sec < now.tv_sec ||
		      (c->c_tv.tv_sec == now.tv_sec &&
		       c->c_tv.tv_usec < now.tv_usec)))) {
		int s = c->c_fd;

/*
 * If i >= 0, fdcon[i] should be the first of any new allocations that
 * were made as a result of the call(s) to conrecycle().
 */
		if (s == i)
			break;
		c = TAILQ_NEXT(c, c_link);
		s = conrecycle(s);
/*
 * Save fd of first new allocation.  If we encounter it again, we'll
 * know that we've cycled through all of the original queue.
 */
		if (i < 0)
			i = s;
	}
	connclosed = 0;
}

static void

	}
}

/*
 * Convert general remote aborts to continues for ssh-keyscan while
 * executing the `dispatch_run()' function.
 */
void
cleanup_exit(int i)
{
	if (nonfatal_fatal)
		longjmp(kexjmp, -1);
	else
		exit(i);
}

void
fatal(const char *fmt,...)
{

		fdlim_set(maxfd);
	fdcon = xcalloc(maxfd, sizeof(con));

	read_wait_nfdset = howmany(maxfd + 1, NFDBITS);
	read_wait = xcalloc(read_wait_nfdset, sizeof(fd_mask));

	for (j = 0; j < fopt_count; j++) {

Return to bug 1213

Lines 49-54 Link Here

(-)openssh-5.8p1/kex.c.orig (-2 / +3 lines)
49	#include "dispatch.h"	49	#include "dispatch.h"
50	#include "monitor.h"	50	#include "monitor.h"
51	#include "roaming.h"	51	#include "roaming.h"
		52	#include "canohost.h"
52		53
53	#if OPENSSL_VERSION_NUMBER >= 0x00907000L	54	#if OPENSSL_VERSION_NUMBER >= 0x00907000L
54	# if defined(HAVE_EVP_SHA256)	55	# if defined(HAVE_EVP_SHA256)
Lines 367-376 Link Here
367	{	368	{
368	char *hostkeyalg = match_list(client, server, NULL);	369	char *hostkeyalg = match_list(client, server, NULL);
369	if (hostkeyalg == NULL)	370	if (hostkeyalg == NULL)
370	fatal("no hostkey alg");	371	fatal("no '%.100s' hostkey alg(s) for %.200s", client, get_remote_ipaddr());
371	k->hostkey_type = key_type_from_name(hostkeyalg);	372	k->hostkey_type = key_type_from_name(hostkeyalg);
372	if (k->hostkey_type == KEY_UNSPEC)	373	if (k->hostkey_type == KEY_UNSPEC)
373	fatal("bad hostkey alg '%s'", hostkeyalg);	374	fatal("bad hostkey alg '%s' for %.200s", hostkeyalg, get_remote_ipaddr());
374	xfree(hostkeyalg);	375	xfree(hostkeyalg);
375	}	376	}
376		377

Lines 45-50 Link Here

(-)openssh-5.8p1/ssh-keyscan.c.orig (-13 / +113 lines)
45	#include "atomicio.h"	45	#include "atomicio.h"
46	#include "misc.h"	46	#include "misc.h"
47	#include "hostfile.h"	47	#include "hostfile.h"
		48	#include "canohost.h"
48		49
49	/* Flag indicating whether IPv4 or IPv6. This can be set on the command line.	50	/* Flag indicating whether IPv4 or IPv6. This can be set on the command line.
50	Default value is AF_UNSPEC means both IPv4 and IPv6. */	51	Default value is AF_UNSPEC means both IPv4 and IPv6. */
Lines 70-75 Link Here
70	#define MAXCON (maxfd - 10)	71	#define MAXCON (maxfd - 10)
71		72
72	extern char *__progname;	73	extern char *__progname;
		74	extern int connclosed;
73	fd_set *read_wait;	75	fd_set *read_wait;
74	size_t read_wait_nfdset;	76	size_t read_wait_nfdset;
75	int ncon;	77	int ncon;
Lines 92-97 Link Here
92	int c_len; /* Total bytes which must be read. */	94	int c_len; /* Total bytes which must be read. */
93	int c_off; /* Length of data read so far. */	95	int c_off; /* Length of data read so far. */
94	int c_keytype; /* Only one of KT_RSA1, KT_DSA, or KT_RSA */	96	int c_keytype; /* Only one of KT_RSA1, KT_DSA, or KT_RSA */
		97	int c_connclosed; /* = 1 if previous closed connection */
95	char c_namebase; / Address to free for c_name and c_namelist */	98	char c_namebase; / Address to free for c_name and c_namelist */
96	char c_name; / Hostname of connection for errors */	99	char c_name; / Hostname of connection for errors */
97	char c_namelist; / Pointer to other possible addresses */	100	char c_namelist; / Pointer to other possible addresses */
Lines 243-248 Link Here
243	{	246	{
244	int j;	247	int j;
245		248
		249	/*
		250	* New fd and socket. Clear the possibly cached IP-address of the
		251	* remote host (kex.c:canonical_host_ip) of the previous socket. Also
		252	* ensure that the packet_read_seqnr():Connection closed ..." flag is
		253	* clear (called by dispatch_run()).
		254	*/
		255	clear_cached_addr();
		256	connclosed = 0;
		257
246	packet_set_connection(c->c_fd, c->c_fd);	258	packet_set_connection(c->c_fd, c->c_fd);
247	enable_compat20();	259	enable_compat20();
248	myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = c->c_keytype == KT_DSA?	260	myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = c->c_keytype == KT_DSA?
Lines 296-303 Link Here
296	memset(&hints, 0, sizeof(hints));	308	memset(&hints, 0, sizeof(hints));
297	hints.ai_family = IPv4or6;	309	hints.ai_family = IPv4or6;
298	hints.ai_socktype = SOCK_STREAM;	310	hints.ai_socktype = SOCK_STREAM;
299	if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0)	311	if ((gaierr = getaddrinfo(host, strport, &hints, &aitop)) != 0) {
300	fatal("getaddrinfo %s: %s", host, ssh_gai_strerror(gaierr));	312	error("getaddrinfo %s: %s", host, ssh_gai_strerror(gaierr));
		313	s = -1;
		314	return s;
		315	}
301	for (ai = aitop; ai; ai = ai->ai_next) {	316	for (ai = aitop; ai; ai = ai->ai_next) {
302	s = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);	317	s = socket(ai->ai_family, ai->ai_socktype, ai->ai_protocol);
303	if (s < 0) {	318	if (s < 0) {
Lines 349-354 Link Here
349	fdcon[s].c_len = 4;	364	fdcon[s].c_len = 4;
350	fdcon[s].c_off = 0;	365	fdcon[s].c_off = 0;
351	fdcon[s].c_keytype = keytype;	366	fdcon[s].c_keytype = keytype;
		367	fdcon[s].c_connclosed = 0;
352	gettimeofday(&fdcon[s].c_tv, NULL);	368	gettimeofday(&fdcon[s].c_tv, NULL);
353	fdcon[s].c_tv.tv_sec += timeout;	369	fdcon[s].c_tv.tv_sec += timeout;
354	TAILQ_INSERT_TAIL(&tq, &fdcon[s], c_link);	370	TAILQ_INSERT_TAIL(&tq, &fdcon[s], c_link);
Lines 388-396 Link Here
388	{	404	{
389	con *c = &fdcon[s];	405	con *c = &fdcon[s];
390	int ret;	406	int ret;
		407	char *name;
391		408
392	ret = conalloc(c->c_namelist, c->c_output_name, c->c_keytype);	409	/*
		410	* If "connclosed" isn't set, do the next host from c->c_namelist. Else,
		411	* restore the original string in c->c_namebase and redo the current
		412	* host.
		413	*/
		414	name = c->c_namelist; /* do next in list ?? */
		415	if (connclosed != 0) {
		416	if (name && name != '\0') / restore separator, if any */
		417	*(--name) = ',';
		418	name = c->c_namebase; /* redo current */
		419	}
		420	ret = conalloc(name, c->c_output_name, c->c_keytype);
393	confree(s);	421	confree(s);
		422	if (ret >= 0 && connclosed == s)
		423	fdcon[ret].c_connclosed = 1; /* flag once */
394	return (ret);	424	return (ret);
395	}	425	}
396		426
Lines 466-478 Link Here
466	confree(s);	496	confree(s);
467	return;	497	return;
468	}	498	}
469	if (c->c_keytype != KT_RSA1) {	499	if (c->c_keytype == KT_RSA1) {
470	keyprint(c, keygrab_ssh2(c));	500	c->c_status = CS_SIZE;
471	confree(s);	501	contouch(s);
472	return;	502	return;
473	}	503	}
474	c->c_status = CS_SIZE;	504	/*
475	contouch(s);	505	* Read and print one of the ssh2 keys for this host.
		506	*/
		507	keyprint(c, keygrab_ssh2(c));
		508
		509	/*
		510	* We're done with this host if the `packet_read_seqnr()' function was
		511	* able to complete its data read.
		512	*/
		513	if (connclosed == 0) {
		514	confree(s);
		515	}
		516	/*
		517	* We're also done with this host if the `packet.c:packet_read_seqnr()'
		518	* function received an EOF while attempting to read data (probably
		519	* caused by the LoginGraceTime being exceeded on the host) and if this
		520	* is the second time this has occurred for this host.
		521	*/
		522	else if (c->c_connclosed) {
		523	confree(s);
		524	connclosed = -1; /* conrecycle other active sockets */
		525	}
		526	/*
		527	* Else, give this host one and only one more chance with this key. We
		528	* don't know if this timeout was caused because of slow responses by
		529	* previous hosts or the host itself (or both (:@{)). This host and all
		530	* other hosts that currently have open sockets will be `conrecycled()'.
		531	*/
		532	else {
		533	connclosed = s;
		534	}
476	}	535	}
477		536
478	static void	537	static void
Lines 550-569 Link Here
550	if (FD_ISSET(i, e)) {	609	if (FD_ISSET(i, e)) {
551	error("%s: exception!", fdcon[i].c_name);	610	error("%s: exception!", fdcon[i].c_name);
552	confree(i);	611	confree(i);
553	} else if (FD_ISSET(i, r))	612	} else if (FD_ISSET(i, r)) {
554	conread(i);	613	conread(i);
		614	/*
		615	* Break if the read attempt in the `packet_read_seqnr()' function
		616	* failed because the remote host closed the connection before the
		617	* packet data read was complete. The closure probably occurred because
		618	* the LoginGraceTime was exceeded on the remote `sshd' server. All
		619	* hosts that currently have a viable "fdcon[s]" entry will be recycled
		620	* below to negate the time used waiting for the current "fdcon[i]"th
		621	* host to respond. This is really a kludgy way to do this.
		622	*/
		623	if (connclosed)
		624	break;
		625	}
555	}	626	}
556	xfree(r);	627	xfree(r);
557	xfree(e);	628	xfree(e);
558		629
559	c = TAILQ_FIRST(&tq);	630	c = TAILQ_FIRST(&tq);
560	while (c && (c->c_tv.tv_sec < now.tv_sec \|\|	631	i = -1;
561	(c->c_tv.tv_sec == now.tv_sec && c->c_tv.tv_usec < now.tv_usec))) {	632	while (c && (connclosed \|\|
		633	(c->c_tv.tv_sec < now.tv_sec \|\|
		634	(c->c_tv.tv_sec == now.tv_sec &&
		635	c->c_tv.tv_usec < now.tv_usec)))) {
562	int s = c->c_fd;	636	int s = c->c_fd;
563		637
		638	/*
		639	* If i >= 0, fdcon[i] should be the first of any new allocations that
		640	* were made as a result of the call(s) to conrecycle().
		641	*/
		642	if (s == i)
		643	break;
564	c = TAILQ_NEXT(c, c_link);	644	c = TAILQ_NEXT(c, c_link);
565	conrecycle(s);	645	s = conrecycle(s);
		646	/*
		647	* Save fd of first new allocation. If we encounter it again, we'll
		648	* know that we've cycled through all of the original queue.
		649	*/
		650	if (i < 0)
		651	i = s;
566	}	652	}
		653	connclosed = 0;
567	}	654	}
568		655
569	static void	656	static void
Lines 583-588 Link Here
583	}	670	}
584	}	671	}
585		672
		673	/*
		674	* Convert general remote aborts to continues for ssh-keyscan while
		675	* executing the `dispatch_run()' function.
		676	*/
		677	void
		678	cleanup_exit(int i)
		679	{
		680	if (nonfatal_fatal)
		681	longjmp(kexjmp, -1);
		682	else
		683	exit(i);
		684	}
		685
586	void	686	void
587	fatal(const char *fmt,...)	687	fatal(const char *fmt,...)
588	{	688	{
Lines 715-721 Link Here
715	fdlim_set(maxfd);	815	fdlim_set(maxfd);
716	fdcon = xcalloc(maxfd, sizeof(con));	816	fdcon = xcalloc(maxfd, sizeof(con));
717		817
718	read_wait_nfdset = howmany(maxfd, NFDBITS);	818	read_wait_nfdset = howmany(maxfd + 1, NFDBITS);
719	read_wait = xcalloc(read_wait_nfdset, sizeof(fd_mask));	819	read_wait = xcalloc(read_wait_nfdset, sizeof(fd_mask));
720		820
721	for (j = 0; j < fopt_count; j++) {	821	for (j = 0; j < fopt_count; j++) {