Add Theo E. Schlossnagle's <[email protected]> SecurID patch to contrib/

shutdown(SHUT_RD) error() bypass for HP-UX.

ChangeLog

@@ -1,3 +1,58 @@
+20010404
+ - (stevesk) nchan.c: remove ostate checks and add EINVAL to
+    shutdown(SHUT_RD) error() bypass for HP-UX.
+
+20010330
+ - (djm) Another openbsd-compat/glob.c sync
+ - (djm) Document default protocol order in config files
+ - (djm) Patch from OpenBSD CVS:
+   - [email protected] 2001/03/29 21:06:21
+     [sshconnect2.c sshd.c]
+     need to set both STOC and CTOS for SSH_BUG_BIGENDIANAES; ok markus@
+
+20010328
+ - (djm) Reorder tests and library inclusion for Krb4/AFS to try to 
+   resolve linking conflicts with libcrypto. Report and suggested fix 
+   from Holger Trapp <[email protected]>
+ - (djm) Work around Solaris' broken struct dirent. Diagnosis and suggested
+   fix from Philippe Levan <[email protected]>
+ - (djm) Rework krbIV tests to get us closer to building on Redhat. Still
+   doesn't work because of conflicts between krbIV's and OpenSSL's des.h
+ - (djm) Sync openbsd-compat/glob.c
+
+20010327
+ - (djm) Reestablish PAM credentials (which can be supplemental group 
+   memberships) after initgroups() blows them away. Report and suggested
+   fix from Nalin Dahyabhai <[email protected]>
+
+20010324
+ - Fixed permissions ssh-keyscan.  Thanks to Christopher Linn <[email protected]>.
+ - OpenBSD CVS Sync
+   - [email protected] 2001/03/23 13:10:57
+     [sftp-int.c]
+     fix put, upload to _absolute_ path, ok djm@
+   - [email protected] 2001/03/22 20:22:55
+     [sshd.c]
+     do not place linefeeds in buffer
+   - [email protected] 2001/03/23 11:04:07
+     [compat.c compat.h sshconnect2.c sshd.c]
+     Compat for OpenSSH with broken Rijndael/AES. ok markus@
+
+20010322
+ - (djm) Better AIX no tty fix, spotted by Gert Doering <[email protected]>
+ - (djm) Released 2.5.2p2
+
+20010321
+ - (djm) Fix ttyname breakage for AIX and Tru64. Patch from Steve 
+   VanDevender <[email protected]>
+ - (djm) Make sure pam_retval is initialised on call to pam_end. Patch
+   from Solar Designer <[email protected]>
+ - (djm) Don't loop forever when changing password via PAM. Patch
+   from Solar Designer <[email protected]>
+ - (djm) Generate config files before build
+ - (djm) Correctly handle SIA and AIX when no tty present. Spotted and
+   suggested fix from Mike Battersby <[email protected]>
+
 20010320
  - (bal) glob.c update to added GLOB_LIMITS (OpenBSD CVS).
  - (bal) glob.c update to set gl_pathv to NULL (OpenBSD CVS).
@@ -13,6 +68,8 @@
  - (djm) Release 2.5.2p1
 - [email protected] 2001/03/19 18:33:47 [defines.h]
   change S_ISLNK macro to work for UnixWare 2.03
+- [email protected] 2001/03/19 20:45:11 [openbsd-compat/glob.c]
+  add get_arg_max(). Use sysconf() if ARG_MAX is not defined
 
 20010319
  - (djm) Seed PRNG at startup, rather than waiting for arc4random calls to 
@@ -4643,4 +4700,4 @@
  - Wrote replacements for strlcpy and mkdtemp
  - Released 1.0pre1
 
-$Id: ChangeLog,v 1.992 2001/03/20 02:31:44 tim Exp $
+$Id: ChangeLog,v 1.991.2.19 2001/04/04 15:00:19 stevesk Exp $

Makefile.in

@@ -1,4 +1,4 @@
-# $Id: Makefile.in,v 1.161 2001/03/14 00:39:46 djm Exp $
+# $Id: Makefile.in,v 1.161.2.2 2001/03/24 00:22:47 mouring Exp $
 
 prefix=@prefix@
 exec_prefix=@exec_prefix@
@@ -73,7 +73,7 @@ PATHSUBS	= \
 
 FIXPATHSCMD	= $(PERL) $(srcdir)/fixpaths $(PATHSUBS)
 
-all: $(TARGETS) $(CONFIGFILES)
+all: $(CONFIGFILES) $(TARGETS) 
 
 manpages: $(MANPAGES)
 
@@ -165,7 +165,7 @@ install-files:
 	$(INSTALL) -m 0755 -s ssh-add $(DESTDIR)$(bindir)/ssh-add
 	$(INSTALL) -m 0755 -s ssh-agent $(DESTDIR)$(bindir)/ssh-agent
 	$(INSTALL) -m 0755 -s ssh-keygen $(DESTDIR)$(bindir)/ssh-keygen
-	$(INSTALL) -m 0775 -s ssh-keyscan $(DESTDIR)$(bindir)/ssh-keyscan
+	$(INSTALL) -m 0755 -s ssh-keyscan $(DESTDIR)$(bindir)/ssh-keyscan
 	$(INSTALL) -m 0755 -s sshd $(DESTDIR)$(sbindir)/sshd
 	@NO_SFTP@$(INSTALL) -m 0755 -s sftp $(DESTDIR)$(bindir)/sftp
 	@NO_SFTP@$(INSTALL) -m 0755 -s sftp-server $(DESTDIR)$(SFTP_SERVER)

TODO

@@ -1,6 +1,9 @@
 Programming:
 - Grep for 'XXX' comments and fix
 
+- Link order is incorrect for some systems using Kerberos 4 and AFS. Result
+is multiple inclusion of DES symbols.
+
 - Integrate contrib/mdoc2man.pl so platforms which only have the troff 
   'an' macros can have readable manpages.
 
@@ -79,4 +82,4 @@ Packaging:
 - HP-UX: Provide DEPOT package scripts.
   ([email protected])
 
-$Id: TODO,v 1.38 2001/03/19 14:58:47 stevesk Exp $
+$Id: TODO,v 1.38.2.1 2001/03/21 02:12:12 djm Exp $

acconfig.h

@@ -1,4 +1,4 @@
-/* $Id: acconfig.h,v 1.108 2001/03/17 01:15:38 mouring Exp $ */
+/* $Id: acconfig.h,v 1.108.2.1 2001/03/28 04:37:37 djm Exp $ */
 
 #ifndef _CONFIG_H
 #define _CONFIG_H
@@ -308,6 +308,9 @@
 /* Define if your system glob() function has gl_matchc options in glob_t */
 #undef GLOB_HAS_GL_MATCHC
 
+/* Define in your struct dirent expects you to allocate extra space for d_name */
+#undef BROKEN_ONE_BYTE_DIRENT_D_NAME
+
 @BOTTOM@
 
 /* ******************* Shouldn't need to edit below this line ************** */

auth-pam.c

@@ -33,7 +33,7 @@
 #include "canohost.h"
 #include "readpass.h"
 
-RCSID("$Id: auth-pam.c,v 1.31 2001/02/28 22:18:58 djm Exp $");
+RCSID("$Id: auth-pam.c,v 1.31.2.2 2001/03/27 06:13:47 djm Exp $");
 
 #define NEW_AUTHTOK_MSG \
 	"Warning: Your password has expired, please change it now"
@@ -172,7 +172,7 @@ static int do_pam_conversation(int num_msg, const struct pam_message **msg,
 /* Called at exit to cleanly shutdown PAM */
 void do_pam_cleanup_proc(void *context)
 {
-	int pam_retval;
+	int pam_retval = PAM_SUCCESS;
 
 	if (__pamh && session_opened) {
 		pam_retval = pam_close_session(__pamh, 0);
@@ -287,14 +287,15 @@ void do_pam_session(char *username, const char *ttyname)
 }
 
 /* Set PAM credentials */
-void do_pam_setcred(void)
+void do_pam_setcred(int init)
 {
 	int pam_retval;
 
 	do_pam_set_conv(&conv);
 
 	debug("PAM establishing creds");
-	pam_retval = pam_setcred(__pamh, PAM_ESTABLISH_CRED);
+	pam_retval = pam_setcred(__pamh, 
+	    init ? PAM_ESTABLISH_CRED : PAM_REINITIALIZE_CRED);
 	if (pam_retval != PAM_SUCCESS) {
 		if (was_authenticated)
 			fatal("PAM setcred failed[%d]: %.200s",
@@ -326,14 +327,10 @@ void do_pam_chauthtok(void)
 
 	if (password_change_required) {
 		pamstate = OTHER;
-		/* XXX: should we really loop forever? */
-		do {
-			pam_retval = pam_chauthtok(__pamh, 
-			    PAM_CHANGE_EXPIRED_AUTHTOK);
-			if (pam_retval != PAM_SUCCESS)
-				log("PAM pam_chauthtok failed[%d]: %.200s",
-				    pam_retval, PAM_STRERROR(__pamh, pam_retval));
-		} while (pam_retval != PAM_SUCCESS);
+		pam_retval = pam_chauthtok(__pamh, PAM_CHANGE_EXPIRED_AUTHTOK);
+		if (pam_retval != PAM_SUCCESS)
+			fatal("PAM pam_chauthtok failed[%d]: %.200s",
+			    pam_retval, PAM_STRERROR(__pamh, pam_retval));
 	}
 }
 

auth-pam.h

@@ -1,4 +1,4 @@
-/* $Id: auth-pam.h,v 1.10 2001/02/15 00:51:32 djm Exp $ */
+/* $Id: auth-pam.h,v 1.10.6.1 2001/03/27 06:13:48 djm Exp $ */
 
 #include "includes.h"
 #ifdef USE_PAM
@@ -12,7 +12,7 @@ char **fetch_pam_environment(void);
 int do_pam_authenticate(int flags);
 int do_pam_account(char *username, char *remote_user);
 void do_pam_session(char *username, const char *ttyname);
-void do_pam_setcred(void);
+void do_pam_setcred(int init);
 void print_pam_messages(void);
 int is_pam_password_change_required(void);
 void do_pam_chauthtok(void);

compat.c

@@ -23,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: compat.c,v 1.39 2001/03/18 23:30:55 deraadt Exp $");
+RCSID("$OpenBSD: compat.c,v 1.40 2001/03/23 11:04:06 djm Exp $");
 
 #ifdef HAVE_LIBPCRE
 #  include <pcreposix.h>
@@ -69,7 +69,9 @@ compat_datafellows(const char *version)
 	} check[] = {
 		{ "^OpenSSH[-_]2\\.[012]",
 					SSH_OLD_SESSIONID|SSH_BUG_BANNER },
-		{ "^OpenSSH_2\\.3\\.0", SSH_BUG_BANNER },
+		{ "^OpenSSH_2\\.3\\.0", SSH_BUG_BANNER|SSH_BUG_BIGENDIANAES },
+		{ "^OpenSSH_2\\.5\\.[01]p1",
+					SSH_BUG_BIGENDIANAES },
 		{ "^OpenSSH",		0 },
 		{ "MindTerm",		0 },
 		{ "^2\\.1\\.0",		SSH_BUG_SIGBLOB|SSH_BUG_HMAC|
@@ -149,3 +151,33 @@ proto_spec(const char *spec)
 	xfree(s);
 	return ret;
 }
+
+char *
+compat_cipher_proposal(char *cipher_prop)
+{
+	char *orig_prop, *fix_ciphers;
+	char *cp, *tmp;
+	size_t len;
+
+	if (!(datafellows & SSH_BUG_BIGENDIANAES))
+		return(cipher_prop);
+
+	len = strlen(cipher_prop) + 1;
+	fix_ciphers = xmalloc(len);
+	*fix_ciphers = '\0';
+	tmp = orig_prop = xstrdup(cipher_prop);
+	while((cp = strsep(&tmp, ",")) != NULL) {
+		if (strncmp(cp, "aes", 3) && strncmp(cp, "rijndael", 8)) {
+			if (*fix_ciphers)
+				strlcat(fix_ciphers, ",", len);
+			strlcat(fix_ciphers, cp, len);
+		}
+	}
+	xfree(orig_prop);
+	debug2("Original cipher proposal: %s", cipher_prop);
+	debug2("Compat cipher proposal: %s", fix_ciphers);
+	if (!*fix_ciphers)
+		fatal("No available ciphers found.");
+
+	return(fix_ciphers);
+}

compat.h

@@ -21,7 +21,7 @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
-/* RCSID("$OpenBSD: compat.h,v 1.18 2001/03/18 23:30:55 deraadt Exp $"); */
+/* RCSID("$OpenBSD: compat.h,v 1.19 2001/03/23 11:04:06 djm Exp $"); */
 
 #ifndef COMPAT_H
 #define COMPAT_H
@@ -43,11 +43,13 @@
 #define SSH_BUG_PKOK		0x0200
 #define SSH_BUG_PASSWORDPAD	0x0400
 #define SSH_BUG_SCANNER		0x0800
+#define SSH_BUG_BIGENDIANAES	0x1000
 
 void    enable_compat13(void);
 void    enable_compat20(void);
 void    compat_datafellows(const char *s);
 int	proto_spec(const char *spec);
+char	*compat_cipher_proposal(char *cipher_prop);
 extern int compat13;
 extern int compat20;
 extern int datafellows;

configure.in

@@ -1,4 +1,4 @@
-# $Id: configure.in,v 1.267 2001/03/18 23:09:28 djm Exp $
+# $Id: configure.in,v 1.267.2.3 2001/03/28 04:37:53 djm Exp $
 
 AC_INIT(ssh.c)
 
@@ -404,75 +404,20 @@ AC_EGREP_CPP(FOUNDIT,
         ]
 )
 
-
-
-# Check whether user wants Kerberos support
-KRB4_MSG="no" 
-AC_ARG_WITH(kerberos4,
-	[  --with-kerberos4=PATH   Enable Kerberos 4 support],
+AC_MSG_CHECKING([whether struct dirent allocates space for d_name])
+AC_TRY_RUN(
 	[
-		if test "x$withval" != "xno" ; then
-	
-			if test "x$withval" != "xyes" ; then
-				CPPFLAGS="$CPPFLAGS -I${withval}/include"
-				LDFLAGS="$LDFLAGS -L${withval}/lib"
-				if test ! -z "$need_dash_r" ; then
-					LDFLAGS="$LDFLAGS -R${withval}/lib"
-				fi
-				if test ! -z "$blibpath" ; then
-					blibpath="$blibpath:${withval}/lib"
-				fi
-			else
-				if test -d /usr/include/kerberosIV ; then
-					CPPFLAGS="$CPPFLAGS -I/usr/include/kerberosIV"
-				fi
-			fi
-
-			AC_CHECK_HEADERS(krb.h)
-			AC_CHECK_LIB(krb, main)
-			if test "$ac_cv_header_krb_h" != yes; then
-				AC_MSG_WARN([Cannot find krb.h, build may fail])
-			fi
-			if test "$ac_cv_lib_krb_main" != yes; then
-				AC_MSG_WARN([Cannot find libkrb, build may fail])
-			fi
-
-			KLIBS="-lkrb -ldes"
-			AC_CHECK_LIB(resolv, dn_expand, , )
-			KRB4=yes
-			KRB4_MSG="yes" 
-			AC_DEFINE(KRB4)
-		fi
+#include <sys/types.h>
+#include <dirent.h>
+int main(void){struct dirent d;return(sizeof(d.d_name)<=sizeof(char));}
+	],
+	[AC_MSG_RESULT(yes)], 
+	[
+		AC_MSG_RESULT(no)
+		AC_DEFINE(BROKEN_ONE_BYTE_DIRENT_D_NAME)
 	]
 )
 
-# Check whether user wants AFS support
-AFS_MSG="no" 
-AC_ARG_WITH(afs,
-	[  --with-afs=PATH         Enable AFS support],
-	[
-		if test "x$withval" != "xno" ; then
-
-			if test "x$withval" != "xyes" ; then
-				CPPFLAGS="$CPPFLAGS -I${withval}/include"
-				LDFLAGS="$LDFLAGS -L${withval}/lib"
-			fi
-
-			if test -z "$KRB4" ; then
-				AC_MSG_WARN([AFS requires Kerberos IV support, build may fail])
-			fi
-
-			LIBS="$LIBS -lkafs"
-			if test ! -z "$AFS_LIBS" ; then
-				LIBS="$LIBS $AFS_LIBS"
-			fi
-			AC_DEFINE(AFS)
-			AFS_MSG="yes" 
-		fi
-	]
-)
-LIBS="$LIBS $KLIBS"
-
 # Check whether user wants S/Key support
 SKEY_MSG="no" 
 AC_ARG_WITH(skey,
@@ -1247,6 +1192,89 @@ if test "x$ac_cv_libc_defines_sys_nerr" = "xyes" ; then
 fi
 
 
+# Check whether user wants Kerberos support
+KRB4_MSG="no" 
+AC_ARG_WITH(kerberos4,
+	[  --with-kerberos4=PATH   Enable Kerberos 4 support],
+	[
+		if test "x$withval" != "xno" ; then
+	
+			if test "x$withval" != "xyes" ; then
+				CPPFLAGS="$CPPFLAGS -I${withval}/include"
+				LDFLAGS="$LDFLAGS -L${withval}/lib"
+				if test ! -z "$need_dash_r" ; then
+					LDFLAGS="$LDFLAGS -R${withval}/lib"
+				fi
+				if test ! -z "$blibpath" ; then
+					blibpath="$blibpath:${withval}/lib"
+				fi
+			else
+				if test -d /usr/include/kerberosIV ; then
+					CPPFLAGS="$CPPFLAGS -I/usr/include/kerberosIV"
+				fi
+			fi
+
+			AC_CHECK_HEADERS(krb.h)
+			if test "$ac_cv_header_krb_h" != yes; then
+				AC_MSG_WARN([Cannot find krb.h, build may fail])
+			fi
+			AC_CHECK_LIB(krb, main)
+			if test "$ac_cv_lib_krb_main" != yes; then
+				AC_CHECK_LIB(krb4, main)
+				if test "$ac_cv_lib_krb4_main" != yes; then
+					AC_MSG_WARN([Cannot find libkrb nor libkrb4, build may fail])
+				else
+					KLIBS="-lkrb4"
+				fi
+			else
+				KLIBS="-lkrb"
+			fi
+			AC_CHECK_LIB(des, des_cbc_encrypt)
+			if test "$ac_cv_lib_des_des_cbc_encrypt" != yes; then
+				AC_CHECK_LIB(des425, des_cbc_encrypt)
+				if test "$ac_cv_lib_des425_des_cbc_encrypt" != yes; then
+					AC_MSG_WARN([Cannot find libdes nor libdes425, build may fail])
+				else
+					KLIBS="-ldes425"
+				fi
+			else
+				KLIBS="-ldes"
+			fi
+			AC_CHECK_LIB(resolv, dn_expand, , )
+			KRB4=yes
+			KRB4_MSG="yes" 
+			AC_DEFINE(KRB4)
+		fi
+	]
+)
+
+# Check whether user wants AFS support
+AFS_MSG="no" 
+AC_ARG_WITH(afs,
+	[  --with-afs=PATH         Enable AFS support],
+	[
+		if test "x$withval" != "xno" ; then
+
+			if test "x$withval" != "xyes" ; then
+				CPPFLAGS="$CPPFLAGS -I${withval}/include"
+				LDFLAGS="$LDFLAGS -L${withval}/lib"
+			fi
+
+			if test -z "$KRB4" ; then
+				AC_MSG_WARN([AFS requires Kerberos IV support, build may fail])
+			fi
+
+			LIBS="-lkafs $LIBS"
+			if test ! -z "$AFS_LIBS" ; then
+				LIBS="$LIBS $AFS_LIBS"
+			fi
+			AC_DEFINE(AFS)
+			AFS_MSG="yes" 
+		fi
+	]
+)
+LIBS="$LIBS $KLIBS"
+
 # Looking for programs, paths and files
 AC_ARG_WITH(rsh,
 	[  --with-rsh=PATH         Specify path to remote shell program ],

contrib/caldera/openssh.spec

@@ -1,5 +1,5 @@
 # Version of OpenSSH
-%define oversion 2.5.2p1
+%define oversion 2.5.2p2
 
 # Version of ssh-askpass
 %define aversion 1.2.0

contrib/openssh-2.5.2p1+SecurID_v1.README

@@ -0,0 +1,82 @@
+/*
+ * Author: Theo Schlossnagle <[email protected]>
+ * Copyright (c) 2000,2001 Theo Schlossnagle <[email protected]>
+ *                    All rights reserved
+ * Created: September 21, 2000
+ * License: OpenSSH License.  See the license for OpenSSH for more details.
+ *
+ * March 19, 2001:
+ * Updated to 2.5.2p1 -- [email protected]
+ *
+ * December 20, 2000:
+ * Updated to 2.3.0p1 -- [email protected]
+ *
+ * Jan 9th, 2001:
+ * Added SecurIDUsersFile, SecurIDIgnoreShell, AllowNonSecurID directives
+ * to the sshd_config file.  These parameters are documented in the man page.
+ * This provides a more logical seperationg between fail-through due to system
+ * failure and fall-through by configuration. (fall-through vs. fail-through)
+ *   -- [email protected]
+ */
+
+Seems like a few people are interested.  So here is the patch.
+
+This has only been tested on UNICIES that support PAM.  There is untested
+(only 5 lines) code in auth-passwd.c that should provide the same
+functionality for normal (non-PAM) password verifications.
+
+The patch is logical quite small, the physical patch bulky because it contains
+all the line number changes in "configure" after running autoconf on the
+modified configure.in file (in which I changed maybe 10 lines -- Yuk.)
+
+The sshd man page has been patched too :-)  Read it for the two new options
+relating to SecurID.
+
+How it works:
+
+0) apply patch ;-)
+1) copy sdi headers (in SecurID example directory) into either a standard
+include place (like /usr/local/include) or into the openssh source tree
+or add the --with-cflags=-I/path/to/ace/examples (where the include files are)
+2) copy the sdiclient.a file (same dir) into the openssh source tree.
+
+Make sure that /var/ace contains your sdconf.rec, etc.  If you installed
+SecurID client or server on a machine it should be this way already.  If you
+used a non-standard install location do a "ln -s /path/to/ace/data /var/ace"
+
+3) add --with-securid --with-pam to the configure flags.  This module rides on
+the PAM authentication mechanism.
+
+It will trigger if a user has a shell in /etc/passwd that ends with "sdshell"
+and it snags your shell the same way sdshell does.  Users with other shells
+will log in as if SecurID didn't exist.
+
+Done:
+  o Normal passcode verification
+  o Enter next token for verification
+    (use ssh -v to see the *useful* debgging messages)
+
+ssh -v will let you know if:
+ o your code was accepted.
+ o your code was rejected.
+ o you are required to wait for the next token and enter that.
+
+TODO:
+  o Handle PIN creation and changing (as their are by default three log in
+attempts, it should be straight forward to integrate in these additions --
+both of these operations require exactly three user inputs.)
+  o Add sshd_config parameter to specify the VAR_ACE location (forced to
+/var/ace OR VAR_ACE environment variable now.)
+  o Make autoconf find the headers in logical places and add a long-option to
+give it a hint.  I am an "autoconf idiot"... The small changes I made were
+challenging enough :) 
+
+
+DISCLAIMER:
+  I works for me (yes, in production).  If you get locked out of a production
+system becuase you replaced your sshd with this one, feeling really dumb is
+YOUR responsibility NOT mine.  It is not my fault :-D
+
+Hope this is useful! scp (and all other tools that can use ssh like rsync and
+cvs) will work now!!!! Hooray!
+

contrib/redhat/openssh.spec

@@ -1,5 +1,5 @@
 # Version of OpenSSH
-%define oversion 2.5.2p1
+%define oversion 2.5.2p2
 
 # Version of ssh-askpass
 %define aversion 1.2.0

contrib/suse/openssh.spec

@@ -1,6 +1,6 @@
 Summary: OpenSSH, a free Secure Shell (SSH) implementation
 Name: openssh
-Version: 2.5.2p1
+Version: 2.5.2p2
 URL: http://www.openssh.com/
 Release: 1
 Source0: openssh-%{version}.tar.gz

defines.h

@@ -1,7 +1,7 @@
 #ifndef _DEFINES_H
 #define _DEFINES_H
 
-/* $Id: defines.h,v 1.61 2001/03/20 02:31:45 tim Exp $ */
+/* $Id: defines.h,v 1.60.2.1 2001/03/20 02:49:22 tim Exp $ */
 
 /* Some platforms need this for the _r() functions */
 #if !defined(_REENTRANT) && !defined(SNI)

nchan.c

@@ -489,11 +489,10 @@ chan_shutdown_read(Channel *c)
 		/*
 		 * shutdown(sock, SHUT_READ) may return ENOTCONN if the
 		 * write side has been closed already. (bug on Linux)
+		 * HP-UX will return EINVAL.
 		 */
 		if (shutdown(c->sock, SHUT_RD) < 0
-		    && (errno != ENOTCONN
-			|| c->ostate == CHAN_OUTPUT_OPEN
-			|| c->ostate == CHAN_OUTPUT_WAIT_DRAIN))
+		    && (errno != ENOTCONN && errno != EINVAL))
 			error("channel %d: chan_shutdown_read: shutdown() failed for fd%d [i%d o%d]: %.100s",
 			    c->self, c->sock, c->istate, c->ostate, strerror(errno));
 	} else {

openbsd-compat/glob.c

@@ -37,6 +37,18 @@
 #include "includes.h"
 #include <ctype.h>
 
+long
+get_arg_max()
+{
+#ifdef ARG_MAX
+	return(ARG_MAX);
+#elif defined(HAVE_SYSCONF) && defined(_SC_ARG_MAX)
+	return(sysconf(_SC_ARG_MAX));
+#else
+	return(256); /* XXX: arbitrary */
+#endif
+}
+
 #if !defined(HAVE_GLOB) || !defined(GLOB_HAS_ALTDIRFUNC) || \
     !defined(GLOB_HAS_GL_MATCHC)
 
@@ -44,7 +56,7 @@
 #if 0
 static char sccsid[] = "@(#)glob.c	8.3 (Berkeley) 10/13/93";
 #else
-static char rcsid[] = "$OpenBSD: glob.c,v 1.10 2001/03/19 13:45:30 millert Exp $";
+static char rcsid[] = "$OpenBSD: glob.c,v 1.14 2001/03/28 20:54:19 millert Exp $";
 #endif
 #endif /* LIBC_SCCS and not lint */
 
@@ -125,19 +137,17 @@ typedef char Char;
 
 
 static int	 compare __P((const void *, const void *));
-static void	 g_Ctoc __P((const Char *, char *));
+static int	 g_Ctoc __P((const Char *, char *, char *));
 static int	 g_lstat __P((Char *, struct stat *, glob_t *));
 static DIR	*g_opendir __P((Char *, glob_t *));
 static Char	*g_strchr __P((Char *, int));
-#ifdef notdef
-static Char	*g_strcat __P((Char *, const Char *));
-#endif
 static int	 g_stat __P((Char *, struct stat *, glob_t *));
 static int	 glob0 __P((const Char *, glob_t *));
-static int	 glob1 __P((Char *, glob_t *, size_t *));
-static int	 glob2 __P((Char *, Char *, Char *, glob_t *, size_t *));
-static int	 glob3 __P((Char *, Char *, Char *, Char *, glob_t *,
-		    size_t *));
+static int	 glob1 __P((Char *, Char *, glob_t *, size_t *));
+static int	 glob2 __P((Char *, Char *, Char *, Char *, Char *, Char *,
+		    glob_t *, size_t *));
+static int	 glob3 __P((Char *, Char *, Char *, Char *, Char *, Char *,
+		    Char *, Char *, glob_t *, size_t *));
 static int	 globextend __P((const Char *, glob_t *, size_t *));
 static const Char *
 		 globtilde __P((const Char *, Char *, size_t, glob_t *));
@@ -156,7 +166,7 @@ glob(pattern, flags, errfunc, pglob)
 {
 	const u_char *patnext;
 	int c;
-	Char *bufnext, *bufend, patbuf[MAXPATHLEN+1];
+	Char *bufnext, *bufend, patbuf[MAXPATHLEN];
 
 	patnext = (u_char *) pattern;
 	if (!(flags & GLOB_APPEND)) {
@@ -170,10 +180,10 @@ glob(pattern, flags, errfunc, pglob)
 	pglob->gl_matchc = 0;
 
 	bufnext = patbuf;
-	bufend = bufnext + MAXPATHLEN;
+	bufend = bufnext + MAXPATHLEN - 1;
 	if (flags & GLOB_NOESCAPE)
-	    while (bufnext < bufend && (c = *patnext++) != EOS)
-		    *bufnext++ = c;
+		while (bufnext < bufend && (c = *patnext++) != EOS)
+			*bufnext++ = c;
 	else {
 		/* Protect the quoted characters. */
 		while (bufnext < bufend && (c = *patnext++) != EOS)
@@ -200,7 +210,8 @@ glob(pattern, flags, errfunc, pglob)
  * invoke the standard globbing routine to glob the rest of the magic
  * characters
  */
-static int globexp1(pattern, pglob)
+static int
+globexp1(pattern, pglob)
 	const Char *pattern;
 	glob_t *pglob;
 {
@@ -224,7 +235,8 @@ static int globexp1(pattern, pglob)
  * If it succeeds then it invokes globexp1 with the new pattern.
  * If it fails then it tries to glob the rest of the pattern and returns.
  */
-static int globexp2(ptr, pattern, pglob, rv)
+static int
+globexp2(ptr, pattern, pglob, rv)
 	const Char *ptr, *pattern;
 	glob_t *pglob;
 	int *rv;
@@ -232,11 +244,12 @@ static int globexp2(ptr, pattern, pglob, rv)
 	int     i;
 	Char   *lm, *ls;
 	const Char *pe, *pm, *pl;
-	Char    patbuf[MAXPATHLEN + 1];
+	Char    patbuf[MAXPATHLEN];
 
 	/* copy part up to the brace */
 	for (lm = patbuf, pm = pattern; pm != ptr; *lm++ = *pm++)
 		continue;
+	*lm = EOS;
 	ls = lm;
 
 	/* Find the balanced brace */
@@ -267,7 +280,7 @@ static int globexp2(ptr, pattern, pglob, rv)
 		return 0;
 	}
 
-	for (i = 0, pl = pm = ptr; pm <= pe; pm++)
+	for (i = 0, pl = pm = ptr; pm <= pe; pm++) {
 		switch (*pm) {
 		case LBRACKET:
 			/* Ignore everything between [] */
@@ -288,8 +301,8 @@ static int globexp2(ptr, pattern, pglob, rv)
 
 		case RBRACE:
 			if (i) {
-			    i--;
-			    break;
+				i--;
+				break;
 			}
 			/* FALLTHROUGH */
 		case COMMA:
@@ -320,6 +333,7 @@ static int globexp2(ptr, pattern, pglob, rv)
 		default:
 			break;
 		}
+	}
 	*rv = 0;
 	return 0;
 }
@@ -404,11 +418,10 @@ glob0(pattern, pglob)
 {
 	const Char *qpatnext;
 	int c, err, oldpathc;
-	Char *bufnext, patbuf[MAXPATHLEN+1];
+	Char *bufnext, patbuf[MAXPATHLEN];
 	size_t limit = 0;
 
-	qpatnext = globtilde(pattern, patbuf, sizeof(patbuf) / sizeof(Char),
-	    pglob);
+	qpatnext = globtilde(pattern, patbuf, MAXPATHLEN, pglob);
 	oldpathc = pglob->gl_pathc;
 	bufnext = patbuf;
 
@@ -452,7 +465,7 @@ glob0(pattern, pglob)
 			 * to avoid exponential behavior
 			 */
 			if (bufnext == patbuf || bufnext[-1] != M_ALL)
-			    *bufnext++ = M_ALL;
+				*bufnext++ = M_ALL;
 			break;
 		default:
 			*bufnext++ = CHAR(c);
@@ -464,7 +477,7 @@ glob0(pattern, pglob)
 	qprintf("glob0:", patbuf);
 #endif
 
-	if ((err = glob1(patbuf, pglob, &limit)) != 0)
+	if ((err = glob1(patbuf, patbuf+MAXPATHLEN-1, pglob, &limit)) != 0)
 		return(err);
 
 	/*
@@ -495,17 +508,19 @@ compare(p, q)
 }
 
 static int
-glob1(pattern, pglob, limitp)
-	Char *pattern;
+glob1(pattern, pattern_last, pglob, limitp)
+	Char *pattern, *pattern_last;
 	glob_t *pglob;
 	size_t *limitp;
 {
-	Char pathbuf[MAXPATHLEN+1];
+	Char pathbuf[MAXPATHLEN];
 
 	/* A null pathname is invalid -- POSIX 1003.1 sect. 2.4. */
 	if (*pattern == EOS)
 		return(0);
-	return(glob2(pathbuf, pathbuf, pattern, pglob, limitp));
+	return(glob2(pathbuf, pathbuf+MAXPATHLEN-1,
+	    pathbuf, pathbuf+MAXPATHLEN-1,
+	    pattern, pattern_last, pglob, limitp));
 }
 
 /*
@@ -514,8 +529,10 @@ glob1(pattern, pglob, limitp)
  * meta characters.
  */
 static int
-glob2(pathbuf, pathend, pattern, pglob, limitp)
-	Char *pathbuf, *pathend, *pattern;
+glob2(pathbuf, pathbuf_last, pathend, pathend_last, pattern,
+    pattern_last, pglob, limitp)
+	Char *pathbuf, *pathbuf_last, *pathend, *pathend_last;
+	Char *pattern, *pattern_last;
 	glob_t *pglob;
 	size_t *limitp;
 {
@@ -534,10 +551,12 @@ glob2(pathbuf, pathend, pattern, pglob, limitp)
 				return(0);
 
 			if (((pglob->gl_flags & GLOB_MARK) &&
-			    pathend[-1] != SEP) && (S_ISDIR(sb.st_mode)
-			    || (S_ISLNK(sb.st_mode) &&
+			    pathend[-1] != SEP) && (S_ISDIR(sb.st_mode) ||
+			    (S_ISLNK(sb.st_mode) &&
 			    (g_stat(pathbuf, &sb, pglob) == 0) &&
 			    S_ISDIR(sb.st_mode)))) {
+				if (pathend+1 > pathend_last)
+					return (1);
 				*pathend++ = SEP;
 				*pathend = EOS;
 			}
@@ -551,24 +570,33 @@ glob2(pathbuf, pathend, pattern, pglob, limitp)
 		while (*p != EOS && *p != SEP) {
 			if (ismeta(*p))
 				anymeta = 1;
+			if (q+1 > pathend_last)
+				return (1);
 			*q++ = *p++;
 		}
 
 		if (!anymeta) {		/* No expansion, do next segment. */
 			pathend = q;
 			pattern = p;
-			while (*pattern == SEP)
+			while (*pattern == SEP) {
+				if (pathend+1 > pathend_last)
+					return (1);
 				*pathend++ = *pattern++;
-		} else			/* Need expansion, recurse. */
-			return(glob3(pathbuf, pathend, pattern, p, pglob,
-			    limitp));
+			}
+		} else
+			/* Need expansion, recurse. */
+			return(glob3(pathbuf, pathbuf_last, pathend,
+			    pathend_last, pattern, pattern_last,
+			    p, pattern_last, pglob, limitp));
 	}
 	/* NOTREACHED */
 }
 
 static int
-glob3(pathbuf, pathend, pattern, restpattern, pglob, limitp)
-	Char *pathbuf, *pathend, *pattern, *restpattern;
+glob3(pathbuf, pathbuf_last, pathend, pathend_last, pattern, pattern_last,
+    restpattern, restpattern_last, pglob, limitp)
+	Char *pathbuf, *pathbuf_last, *pathend, *pathend_last;
+	Char *pattern, *pattern_last, *restpattern, *restpattern_last;
 	glob_t *pglob;
 	size_t *limitp;
 {
@@ -585,16 +613,19 @@ glob3(pathbuf, pathend, pattern, restpattern, pglob, limitp)
 	 */
 	struct dirent *(*readdirfunc)();
 
+	if (pathend > pathend_last)
+		return (1);
 	*pathend = EOS;
 	errno = 0;
 
 	if ((dirp = g_opendir(pathbuf, pglob)) == NULL) {
 		/* TODO: don't call for ENOENT or ENOTDIR? */
 		if (pglob->gl_errfunc) {
-			g_Ctoc(pathbuf, buf);
+			if (g_Ctoc(pathbuf, buf, buf+sizeof(buf)))
+				return(GLOB_ABORTED);
 			if (pglob->gl_errfunc(buf, errno) ||
 			    pglob->gl_flags & GLOB_ERR)
-				return (GLOB_ABORTED);
+				return(GLOB_ABORTED);
 		}
 		return(0);
 	}
@@ -613,14 +644,22 @@ glob3(pathbuf, pathend, pattern, restpattern, pglob, limitp)
 		/* Initial DOT must be matched literally. */
 		if (dp->d_name[0] == DOT && *pattern != DOT)
 			continue;
-		for (sc = (u_char *) dp->d_name, dc = pathend;
-		     (*dc++ = *sc++) != EOS;)
-			continue;
+		dc = pathend;
+		sc = (u_char *) dp->d_name;
+		while (dc < pathend_last && (*dc++ = *sc++) != EOS)
+			;
+		if (dc >= pathend_last) {
+			*dc = EOS;
+			err = 1;
+			break;
+		}
+
 		if (!match(pathend, pattern, restpattern)) {
 			*pathend = EOS;
 			continue;
 		}
-		err = glob2(pathbuf, --dc, restpattern, pglob, limitp);
+		err = glob2(pathbuf, pathbuf_last, --dc, pathend_last,
+		    restpattern, restpattern_last, pglob, limitp);
 		if (err)
 			break;
 	}
@@ -683,13 +722,16 @@ globextend(path, pglob, limitp)
 	len = (size_t)(p - path);
 	*limitp += len;
 	if ((copy = malloc(len)) != NULL) {
-		g_Ctoc(path, copy);
+		if (g_Ctoc(path, copy, copy+len+1)) {
+			free(copy);
+			return(GLOB_NOSPACE);
+		}
 		pathv[pglob->gl_offs + pglob->gl_pathc++] = copy;
 	}
 	pathv[pglob->gl_offs + pglob->gl_pathc] = NULL;
 
 	if ((pglob->gl_flags & GLOB_LIMIT) &&
-	    newsize + *limitp >= ARG_MAX) {
+	    newsize + *limitp >= (u_int) get_arg_max()) {
 		errno = 0;
 		return(GLOB_NOSPACE);
 	}
@@ -718,7 +760,8 @@ match(name, pat, patend)
 			do
 			    if (match(name, pat, patend))
 				    return(1);
-			while (*name++ != EOS);
+			while (*name++ != EOS)
+				;
 			return(0);
 		case M_ONE:
 			if (*name++ == EOS)
@@ -776,8 +819,10 @@ g_opendir(str, pglob)
 
 	if (!*str)
 		strcpy(buf, ".");
-	else
-		g_Ctoc(str, buf);
+	else {
+		if (g_Ctoc(str, buf, buf+sizeof(buf)))
+			return(NULL);
+	}
 
 	if (pglob->gl_flags & GLOB_ALTDIRFUNC)
 		return((*pglob->gl_opendir)(buf));
@@ -793,7 +838,8 @@ g_lstat(fn, sb, pglob)
 {
 	char buf[MAXPATHLEN];
 
-	g_Ctoc(fn, buf);
+	if (g_Ctoc(fn, buf, buf+sizeof(buf)))
+		return(-1);
 	if (pglob->gl_flags & GLOB_ALTDIRFUNC)
 		return((*pglob->gl_lstat)(buf, sb));
 	return(lstat(buf, sb));
@@ -807,7 +853,8 @@ g_stat(fn, sb, pglob)
 {
 	char buf[MAXPATHLEN];
 
-	g_Ctoc(fn, buf);
+	if (g_Ctoc(fn, buf, buf+sizeof(buf)))
+		return(-1);
 	if (pglob->gl_flags & GLOB_ALTDIRFUNC)
 		return((*pglob->gl_stat)(buf, sb));
 	return(stat(buf, sb));
@@ -825,33 +872,18 @@ g_strchr(str, ch)
 	return (NULL);
 }
 
-#ifdef notdef
-static Char *
-g_strcat(dst, src)
-	Char *dst;
-	const Char* src;
-{
-	Char *sdst = dst;
-
-	while (*dst++)
-		continue;
-	--dst;
-	while((*dst++ = *src++) != EOS)
-		continue;
-
-	return (sdst);
-}
-#endif
-
-static void
-g_Ctoc(str, buf)
+static int
+g_Ctoc(str, buf, ebuf)
 	register const Char *str;
-	char *buf;
+	char *buf, *ebuf;
 {
 	register char *dc;
 
-	for (dc = buf; (*dc++ = *str++) != EOS;)
+	for (dc = buf; dc < ebuf && (*dc++ = *str++) != EOS;)
 		continue;
+	if (dc >= ebuf)
+		return (1);
+	return (0);
 }
 
 #ifdef DEBUG

session.c

@@ -481,7 +481,7 @@ do_exec_no_pty(Session *s, const char *command, struct passwd * pw)
 	session_proctitle(s);
 
 #if defined(USE_PAM)
-	do_pam_setcred();
+	do_pam_setcred(1);
 #endif /* USE_PAM */
 
 	/* Fork the child. */
@@ -598,7 +598,7 @@ do_exec_pty(Session *s, const char *command, struct passwd * pw)
 
 #if defined(USE_PAM)
 	do_pam_session(pw->pw_name, s->tty);
-	do_pam_setcred();
+	do_pam_setcred(1);
 #endif
 
 	/* Fork the child. */
@@ -1053,7 +1053,7 @@ do_child(Session *s, const char *command)
 	   switch, so we let login(1) to this for us. */
 	if (!options.use_login) {
 #ifdef HAVE_OSF_SIA
-		session_setup_sia(pw->pw_name, ttyname);
+		session_setup_sia(pw->pw_name, s->ttyfd == -1 ? NULL : s->tty);
 #else /* HAVE_OSF_SIA */
 #ifdef HAVE_CYGWIN
 		if (is_winnt) {
@@ -1095,6 +1095,15 @@ do_child(Session *s, const char *command)
 				exit(1);
 			}
 			endgrent();
+#  ifdef USE_PAM
+			/*
+			 * PAM credentials may take the form of 
+			 * supplementary groups. These will have been 
+			 * wiped by the above initgroups() call.
+			 * Reestablish them here.
+			 */
+			do_pam_setcred(0);
+#  endif /* USE_PAM */
 #  ifdef WITH_IRIX_JOBS
 			jid = jlimit_startjob(pw->pw_name, pw->pw_uid, "interactive");
 			if (jid == -1) {
@@ -1134,10 +1143,12 @@ do_child(Session *s, const char *command)
 			 * other stuff is stored - a few applications
 			 * actually use this and die if it's not set
 			 */
-			cp = xmalloc(22 + strlen(ttyname) + 
+			if (s->ttyfd == -1)
+				s->tty[0] = '\0';
+			cp = xmalloc(22 + strlen(s->tty) + 
 			    2 * strlen(pw->pw_name));
 			i = sprintf(cp, "LOGNAME=%s%cNAME=%s%cTTY=%s%c%c",
-			    pw->pw_name, 0, pw->pw_name, 0, ttyname, 0,0);
+			    pw->pw_name, 0, pw->pw_name, 0, s->tty, 0, 0);
 			if (usrinfo(SETUINFO, cp, i) == -1)
 				fatal("Couldn't set usrinfo: %s", 
 				    strerror(errno));

sftp-glob.c

@@ -65,7 +65,9 @@ void *fudge_opendir(const char *path)
 
 struct dirent *fudge_readdir(struct SFTP_OPENDIR *od)
 {
-	static struct dirent ret;
+	/* Solaris needs sizeof(dirent) + path length (see below) */
+	static char buf[sizeof(struct dirent) + MAXPATHLEN];
+	struct dirent *ret = (struct dirent *)buf;
 #ifdef __GNU_LIBRARY__
 	static int inum = 1;
 #endif /* __GNU_LIBRARY__ */
@@ -73,22 +75,30 @@ struct dirent *fudge_readdir(struct SFTP_OPENDIR *od)
 	if (od->dir[od->offset] == NULL)
 		return(NULL);
 
-	memset(&ret, 0, sizeof(ret));
-	strlcpy(ret.d_name, od->dir[od->offset++]->filename, 
-	    sizeof(ret.d_name));
+	memset(buf, 0, sizeof(buf));
 
+	/*
+	 * Solaris defines dirent->d_name as a one byte array and expects
+	 * you to hack around it.
+	 */
+#ifdef BROKEN_ONE_BYTE_DIRENT_D_NAME
+	strlcpy(ret->d_name, od->dir[od->offset++]->filename, MAXPATHLEN);
+#else
+	strlcpy(ret->d_name, od->dir[od->offset++]->filename, 
+	    sizeof(ret->d_name));
+#endif
 #ifdef __GNU_LIBRARY__
 	/*
 	 * Idiot glibc uses extensions to struct dirent for readdir with
 	 * ALTDIRFUNCs. Not that this is documented anywhere but the 
 	 * source... Fake an inode number to appease it.
 	 */
-	ret.d_ino = inum++;
+	ret->d_ino = inum++;
 	if (!inum)
 		inum = 1;
 #endif /* __GNU_LIBRARY__ */
 
-	return(&ret);
+	return(ret);
 }
 
 void fudge_closedir(struct SFTP_OPENDIR *od)

sftp-int.c

@@ -26,7 +26,7 @@
 /* XXX: recursive operations */
 
 #include "includes.h"
-RCSID("$OpenBSD: sftp-int.c,v 1.31 2001/03/16 13:44:24 markus Exp $");
+RCSID("$OpenBSD: sftp-int.c,v 1.32 2001/03/23 13:10:57 markus Exp $");
 
 #include "buffer.h"
 #include "xmalloc.h"
@@ -451,9 +451,12 @@ process_put(int in, int out, char *src, char *dst, char *pwd, int pflag)
 				xfree(tmp);
 			} else
 				abs_dst = xstrdup(tmp_dst);
-		} else if (infer_path(g.gl_pathv[0], &abs_dst)) {
-			err = -1;
-			goto out;
+		} else {
+			if (infer_path(g.gl_pathv[0], &abs_dst)) {
+				err = -1;
+				goto out;
+			}
+			abs_dst = make_absolute(abs_dst, pwd);
 		}
 		printf("Uploading %s to %s\n", g.gl_pathv[0], abs_dst);
 		err = do_upload(in, out, g.gl_pathv[0], abs_dst, pflag);

ssh_config

@@ -31,6 +31,6 @@
 #   IdentityFile ~/.ssh/id_rsa1
 #   IdentityFile ~/.ssh/id_rsa2
 #   Port 22
-#   Protocol 2,1
+#   Protocol 1,2
 #   Cipher blowfish
 #   EscapeChar ~

sshconnect2.c

@@ -23,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: sshconnect2.c,v 1.54 2001/03/12 22:02:02 markus Exp $");
+RCSID("$OpenBSD: sshconnect2.c,v 1.55 2001/03/23 11:04:07 djm Exp $");
 
 #include <openssl/bn.h>
 #include <openssl/md5.h>
@@ -84,6 +84,10 @@ ssh_kex2(char *host, struct sockaddr *hostaddr)
 		myproposal[PROPOSAL_ENC_ALGS_CTOS] =
 		myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
 	}
+	myproposal[PROPOSAL_ENC_ALGS_CTOS] =
+	    compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]);
+	myproposal[PROPOSAL_ENC_ALGS_STOC] =
+	    compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_STOC]);
 	if (options.compression) {
 		myproposal[PROPOSAL_COMP_ALGS_CTOS] =
 		myproposal[PROPOSAL_COMP_ALGS_STOC] = "zlib";

sshd.c

@@ -40,7 +40,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: sshd.c,v 1.175 2001/03/18 23:30:55 deraadt Exp $");
+RCSID("$OpenBSD: sshd.c,v 1.177 2001/03/23 11:04:07 djm Exp $");
 
 #include <openssl/dh.h>
 #include <openssl/bn.h>
@@ -344,8 +344,7 @@ sshd_exchange_identification(int sock_in, int sock_out)
 				fatal_cleanup();
 			}
 			if (buf[i] == '\r') {
-				buf[i] = '\n';
-				buf[i + 1] = 0;
+				buf[i] = 0;
 				/* Kludge for F-Secure Macintosh < 1.0.2 */
 				if (i == 12 &&
 				    strncmp(buf, "SSH-1.5-W1.0", 12) == 0)
@@ -353,8 +352,7 @@ sshd_exchange_identification(int sock_in, int sock_out)
 				continue;
 			}
 			if (buf[i] == '\n') {
-				/* buf[i] == '\n' */
-				buf[i + 1] = 0;
+				buf[i] = 0;
 				break;
 			}
 		}
@@ -420,7 +418,6 @@ sshd_exchange_identification(int sock_in, int sock_out)
 		break;
 	}
 	chop(server_version_string);
-	chop(client_version_string);
 	debug("Local version string %.200s", server_version_string);
 
 	if (mismatch) {
@@ -1447,6 +1444,11 @@ do_ssh2_kex(void)
 		myproposal[PROPOSAL_ENC_ALGS_CTOS] =
 		myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
 	}
+	myproposal[PROPOSAL_ENC_ALGS_CTOS] =
+	    compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]);
+	myproposal[PROPOSAL_ENC_ALGS_STOC] =
+	    compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_STOC]);
+
 	if (options.macs != NULL) {
 		myproposal[PROPOSAL_MAC_ALGS_CTOS] =
 		myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;

sshd_config

@@ -6,7 +6,7 @@
 # for more information.
 
 Port 22
-#Protocol 2,1
+#Protocol 1,2
 #ListenAddress 0.0.0.0
 #ListenAddress ::
 HostKey /etc/ssh_host_key

version.h

@@ -1,3 +1,3 @@
 /* $OpenBSD: version.h,v 1.19 2001/02/19 10:35:23 markus Exp $ */
   
-#define SSH_VERSION	"OpenSSH_2.5.2p1"
+#define SSH_VERSION	"OpenSSH_2.5.2p2"