From nobody Fri Oct 07 14:04:35 2022 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4MkVRl3Vtrz4dpxC; Fri, 7 Oct 2022 14:04:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4MkVRl2l0sz3rmb; Fri, 7 Oct 2022 14:04:35 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1665151475; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=A2JGYxjpvXsz66Bggq77qWh1oMe3wEQwJDvjkCuZbaI=; b=oBjNO72M3ZELSDYWioHHWMhAs6hbXEYDSzCczxpAYrlLI50FBme88prCaSV4MJd92Hjmm4 ZRSWA+WYUoCi/xGsQGyYhlF8tmJWZAl8QAE5blnOIetpQ5PqSAXEU+mWp8M8gu49Bx963o YGo/TclsVr5nEWq2t8S/vPjvYSdXiAQG0WL6oj1IkkWG84Ong/I9lJGFN7lydhiD5aW4Vz iJWRBRc6ipCpIjseAA+zYiEuoT9ntMp3x5p4Hivicp4m+Pas6YOEY7CFxF9W2D0f+MPv88 SqjLZCdwPZkuxFKiCGFkPLF/Sz+q3WnDIm2m+Q0kcghUacxgtVbVE+O/UksOAQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4MkVRl1RvGzcdZ; Fri, 7 Oct 2022 14:04:35 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 297E4Zxt047791; Fri, 7 Oct 2022 14:04:35 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 297E4Zhn047790; Fri, 7 Oct 2022 14:04:35 GMT (envelope-from git) Date: Fri, 7 Oct 2022 14:04:35 GMT Message-Id: <202210071404.297E4Zhn047790@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Ed Maste Subject: git: 1efd9eefd106 - stable/12 - sshd: update the libwrap patch to drop connections early List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: emaste X-Git-Repository: src X-Git-Refname: refs/heads/stable/12 X-Git-Reftype: branch X-Git-Commit: 1efd9eefd106142cbaf30c7efcf3db52659dc56e Auto-Submitted: auto-generated ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1665151475; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=A2JGYxjpvXsz66Bggq77qWh1oMe3wEQwJDvjkCuZbaI=; b=I+KekK7Uk+TTs5gjpzpVTQzbyjzVUib2/mZ/0d6kZl6dRMZ7cSLNPQSUoeOstQ1A24UOsK FkKwOkKKvMkU+lFqAFDK0JcDpr5Zofxgvwm53ByCpGe9jBHeqaD0tmJzCBK0dxMPdEcN2V D/GmjynqO6c9BuhEw0RJvAJTAoU8AiVXdnfRSOxFYzdxDyoFeU2wC0j1xnI3aGmN7VAWAN PmLpF4PTyiMBI7LJYbvdcRNrqOqjKu5fv/61Cp62NxfFxeSJXjXtgln/sJyR8jwUaQZig6 KBfJFZw4MtV1y1QYzL8qdoUacbTehvfG1C+9dOuUqUPKjlWX3R5GMKOz4we3mw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1665151475; a=rsa-sha256; cv=none; b=jDjfiduYxuyg5zOi5IGVFPp6d50u+ypqnmXzzN9pYGuozbYMKsOTa3yM09xX+Rrr7zdbKt RCtI0SEFIfytKpZy60D9rVeYA/GewE4XXhIUt5DxDfNoB43xnJ0klxYV1fXgY1kvPUD17Y LZUKEKfmKV+DpkWhUCsW0O5zp2N9qJPvfmAxVAkYwYk/1qNYiRemxVIlKfe3GZB9erWtDx eGA9XM4sC6FinHI+Fy14zNKP/G8g+2BpG7tkUmJvWSJdHQxCdIY1237hUHpULfnhl1BmQW 06MCEiKJtswHjZ54y44t8m2Y9/t1zfV7lcLeb0I6w3ubjPPiTD5mlPsUo7hUPg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none X-ThisMailContainsUnwantedMimeParts: N The branch stable/12 has been updated by emaste: URL: https://cgit.FreeBSD.org/src/commit/?id=1efd9eefd106142cbaf30c7efcf3db52659dc56e commit 1efd9eefd106142cbaf30c7efcf3db52659dc56e Author: Gleb Smirnoff AuthorDate: 2022-01-03 02:32:30 +0000 Commit: Ed Maste CommitDate: 2022-10-07 13:22:09 +0000 sshd: update the libwrap patch to drop connections early OpenSSH has dropped libwrap support in OpenSSH 6.7p in 2014 (f2719b7c in github.com/openssh/openssh-portable) and we maintain the patch ourselves since 2016 (a0ee8cc636cd). Over the years, the libwrap support has deteriotated and probably that was reason for removal upstream. Original idea of libwrap was to drop illegitimate connection as soon as possible, but over the years the code was pushed further down and down and ended in the forked client connection handler. The negative effects of late dropping is increasing attack surface for hosts that are to be dropped anyway. Apart from hypothetical future vulnerabilities in connection handling, today a malicious host listed in /etc/hosts.allow still can trigger sshd to enter connection throttling mode, which is enabled by default (see MaxStartups in sshd_config(5)), effectively casting DoS attack. Note that on OpenBSD this attack isn't possible, since they enable MaxStartups together with UseBlacklist. A only negative effect from early drop, that I can imagine, is that now main listener parses file in /etc, and if our root filesystems goes bad, it would get stuck. But unlikely you'd be able to login in that case anyway. Implementation details: - For brevity we reuse the same struct request_info. This isn't a documented feature of libwrap, but code review, viewing data in a debugger and real life testing shows that if we clear RQ_CLIENT_NAME and RQ_CLIENT_ADDR every time, it works as intended. - We set SO_LINGER on the socket to force immediate connection reset. - We log message exactly as libwrap's refuse() would do. Differential revision: https://reviews.freebsd.org/D33044 (cherry picked from commit ca573c9a1779bdeeea6d0a6e948676555977737e) (cherry picked from commit 46aaea6c19ef1f377936eede16b4bdb626421dd6) --- crypto/openssh/sshd.c | 60 ++++++++++++++++++++++++++++++++++----------------- 1 file changed, 40 insertions(+), 20 deletions(-) diff --git a/crypto/openssh/sshd.c b/crypto/openssh/sshd.c index c4544137d5d7..16d2d87a6655 100644 --- a/crypto/openssh/sshd.c +++ b/crypto/openssh/sshd.c @@ -141,8 +141,8 @@ __RCSID("$FreeBSD$"); #ifdef LIBWRAP #include #include -int allow_severity; -int deny_severity; +extern int allow_severity; +extern int deny_severity; #endif /* LIBWRAP */ /* Re-exec fds */ @@ -1170,6 +1170,11 @@ server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s) pid_t pid; u_char rnd[256]; sigset_t nsigset, osigset; +#ifdef LIBWRAP + struct request_info req; + + request_init(&req, RQ_DAEMON, __progname, 0); +#endif /* setup fd set for accept */ fdset = NULL; @@ -1291,6 +1296,31 @@ server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s) usleep(100 * 1000); continue; } +#ifdef LIBWRAP + /* Check whether logins are denied from this host. */ + request_set(&req, RQ_FILE, *newsock, + RQ_CLIENT_NAME, "", RQ_CLIENT_ADDR, "", 0); + sock_host(&req); + if (!hosts_access(&req)) { + const struct linger l = { .l_onoff = 1, + .l_linger = 0 }; + + (void )setsockopt(*newsock, SOL_SOCKET, + SO_LINGER, &l, sizeof(l)); + (void )close(*newsock); + /* + * Mimic message from libwrap's refuse() + * exactly. sshguard, and supposedly lots + * of custom made scripts rely on it. + */ + syslog(deny_severity, + "refused connect from %s (%s)", + eval_client(&req), + eval_hostaddr(req.client)); + debug("Connection refused by tcp wrapper"); + continue; + } +#endif /* LIBWRAP */ if (unset_nonblock(*newsock) == -1 || pipe(startup_p) == -1) continue; @@ -2060,6 +2090,14 @@ main(int ac, char **av) /* Reinitialize the log (because of the fork above). */ log_init(__progname, options.log_level, options.log_facility, log_stderr); +#ifdef LIBWRAP + /* + * We log refusals ourselves. However, libwrap will report + * syntax errors in hosts.allow via syslog(3). + */ + allow_severity = options.log_facility|LOG_INFO; + deny_severity = options.log_facility|LOG_WARNING; +#endif /* Avoid killing the process in high-pressure swapping environments. */ if (!inetd_flag && madvise(NULL, 0, MADV_PROTECT) != 0) debug("madvise(): %.200s", strerror(errno)); @@ -2238,24 +2276,6 @@ main(int ac, char **av) #ifdef SSH_AUDIT_EVENTS audit_connection_from(remote_ip, remote_port); #endif -#ifdef LIBWRAP - allow_severity = options.log_facility|LOG_INFO; - deny_severity = options.log_facility|LOG_WARNING; - /* Check whether logins are denied from this host. */ - if (ssh_packet_connection_is_on_socket(ssh)) { - struct request_info req; - - request_init(&req, RQ_DAEMON, __progname, RQ_FILE, sock_in, 0); - fromhost(&req); - - if (!hosts_access(&req)) { - debug("Connection refused by tcp wrapper"); - refuse(&req); - /* NOTREACHED */ - fatal("libwrap refuse returns"); - } - } -#endif /* LIBWRAP */ rdomain = ssh_packet_rdomain_in(ssh);