Attachment 3047 Details for Bug 2440 – factor out agent socket directory creation for reuse

[patch] factor out agent socket directory creation for reuse

bz2501_refactor.diff (text/plain), 4.53 KB, created by Damien Miller on 2017-09-01 14:54:27 AEST

(hide)

Description:

Filename:

MIME Type:

Creator: Damien Miller

Created: 2017-09-01 14:54:27 AEST

Size: 4.53 KB

patch

obsolete

>commit 84b344f7c63edf4e96fe31b0977617fd50726394
>Author: Damien Miller <djm@mindrot.org>
>Date:   Fri Sep 1 14:22:30 2017 +1000
>
>    factor out agent socket directory for reuse
>
>diff --git a/session.c b/session.c
>index 7ddb575..56695d2 100644
>--- a/session.c
>+++ b/session.c
>@@ -146,19 +146,60 @@ static int in_chroot = 0;
> /* File containing userauth info, if ExposeAuthInfo set */
> static char *auth_info_file = NULL;
> 
>-/* Name and directory of socket for authentication agent forwarding. */
>+/* Directory for auth socket and other private files */
>+static char *private_temp_dir = NULL;
>+
>+/* Path for authentication agent forwarding socket. */
> static char *auth_sock_name = NULL;
>-static char *auth_sock_dir = NULL;
>+
>+/* removes the per-session temporary directory */
>+static void
>+cleanup_private_temp_dir(struct passwd *pw)
>+{
>+	if (private_temp_dir != NULL) {
>+		temporarily_use_uid(pw);
>+		rmdir(private_temp_dir);
>+		restore_uid();
>+		free(private_temp_dir);
>+		private_temp_dir = NULL;
>+	}
>+}
>+
>+/*
>+ * establish a per-session private directory to store various
>+ * things, including the authentication agent socket.
>+ */
>+static int
>+make_private_temp_dir(struct passwd * pw)
>+{
>+	char *cp, *path = xstrdup("/tmp/ssh-XXXXXXXXXX");
>+	int oerrno;
>+
>+	if (private_temp_dir != NULL)
>+		return 0;
>+
>+	temporarily_use_uid(pw);
>+	cp = mkdtemp(path);
>+	oerrno = errno;
>+	restore_uid();
>+
>+	if (cp == NULL) {
>+		debug("%s: mkdtemp: %s", __func__, strerror(oerrno));
>+		free(cp);
>+		return -1;
>+	}
>+	debug3("%s: created %s", __func__, cp);
>+	private_temp_dir = cp;
>+	return 0;
>+}
> 
> /* removes the agent forwarding socket */
>-
> static void
> auth_sock_cleanup_proc(struct passwd *pw)
> {
> 	if (auth_sock_name != NULL) {
> 		temporarily_use_uid(pw);
> 		unlink(auth_sock_name);
>-		rmdir(auth_sock_dir);
> 		auth_sock_name = NULL;
> 		restore_uid();
> 	}
>@@ -175,24 +216,17 @@ auth_input_request_forwarding(struct passwd * pw)
> 		return 0;
> 	}
> 
>+	if (make_private_temp_dir(pw) != 0) {
>+		error("Agent forwarding disabled: failed to create "
>+		    "socket directory");
>+		return 0;
>+	}
>+
> 	/* Temporarily drop privileged uid for mkdir/bind. */
> 	temporarily_use_uid(pw);
> 
>-	/* Allocate a buffer for the socket name, and format the name. */
>-	auth_sock_dir = xstrdup("/tmp/ssh-XXXXXXXXXX");
>-
>-	/* Create private directory for socket */
>-	if (mkdtemp(auth_sock_dir) == NULL) {
>-		packet_send_debug("Agent forwarding disabled: "
>-		    "mkdtemp() failed: %.100s", strerror(errno));
>-		restore_uid();
>-		free(auth_sock_dir);
>-		auth_sock_dir = NULL;
>-		goto authsock_err;
>-	}
>-
> 	xasprintf(&auth_sock_name, "%s/agent.%ld",
>-	    auth_sock_dir, (long) getpid());
>+	    private_temp_dir, (long) getpid());
> 
> 	/* Start a Unix listener on auth_sock_name. */
> 	sock = unix_listener(auth_sock_name, SSH_LISTEN_BACKLOG, 0);
>@@ -214,14 +248,9 @@ auth_input_request_forwarding(struct passwd * pw)
> 
>  authsock_err:
> 	free(auth_sock_name);
>-	if (auth_sock_dir != NULL) {
>-		rmdir(auth_sock_dir);
>-		free(auth_sock_dir);
>-	}
> 	if (sock != -1)
> 		close(sock);
> 	auth_sock_name = NULL;
>-	auth_sock_dir = NULL;
> 	return 0;
> }
> 
>@@ -240,11 +269,17 @@ prepare_auth_info_file(struct passwd *pw, struct sshbuf *info)
> {
> 	int fd = -1, success = 0;
> 
>-	if (!options.expose_userauth_info || info == NULL)
>+	if (!options.expose_userauth_info || info == NULL ||
>+	    auth_info_file != NULL)
> 		return;
> 
>-	temporarily_use_uid(pw);
>-	auth_info_file = xstrdup("/tmp/sshauth.XXXXXXXXXXXXXXX");
>+	if (make_private_temp_dir(pw) != 0) {
>+		error("%s: could not create directory for ExposeAuthInfo",
>+		    __func__);
>+		return;
>+	}
>+
>+	xasprintf(&auth_info_file, "%s/sshauth.XXXXXXXXXX", private_temp_dir);
> 	if ((fd = mkstemp(auth_info_file)) == -1) {
> 		error("%s: mkstemp: %s", __func__, strerror(errno));
> 		goto out;
>@@ -1000,7 +1035,7 @@ safely_chroot(const char *path, uid_t uid)
> 			memcpy(component, path, cp - path);
> 			component[cp - path] = '\0';
> 		}
>-	
>+
> 		debug3("%s: checking '%s'", __func__, component);
> 
> 		if (stat(component, &st) != 0)
>@@ -2114,7 +2149,7 @@ do_cleanup(Authctxt *authctxt)
> {
> 	static int called = 0;
> 
>-	debug("do_cleanup");
>+	debug("do_cleanup: %s", mm_is_monitor() ? "monitor" : "child");
> 
> 	/* no cleanup if we're in the child for login shell */
> 	if (is_child)
>@@ -2156,6 +2191,12 @@ do_cleanup(Authctxt *authctxt)
> 	 */
> 	if (!use_privsep || mm_is_monitor())
> 		session_destroy_all(session_pty_cleanup2);
>+
>+	/*
>+	 * Must be called after cleanup of auth info file, xauthority file
>+	 * and agent socket
>+	 */
>+	cleanup_private_temp_dir(authctxt->pw);
> }
> 
> /* Return a name for the remote host that fits inside utmp_size */

Flags:

djm: ok? (dtucker)

Actions: View | Diff

Attachments on bug 2440: 2680 | 2809 | 3047 | 3048