- Rewrote bsd-login to use proper utmp API if available. Major cleanup

of fallback DIY code.

CREDITS

@@ -25,9 +25,10 @@ Gary E. Miller <[email protected]> - SCO support
 Ged Lodder <[email protected]> - HPUX fixes and enhancements
 Gert Doering <[email protected]> - bug and portability fixes
 HARUYAMA Seigo <[email protected]> - Translations & doc fixes
-Hideaki YOSHIFUJI <[email protected]> - IPv6 fixes
+Hideaki YOSHIFUJI <[email protected]> - IPv6 and bug fixes
 Hiroshi Takekawa <[email protected]> - Configure fixes
 Holger Trapp <[email protected]> - KRB4/AFS config patch
+IWAMURO Motonori <[email protected]> - bugfixes
 Jani Hakala <[email protected]> - Patches
 Jarno Huuskonen <[email protected]> - Bugfixes
 Jim Knoble <[email protected]> - Many patches

ChangeLog

@@ -1,3 +1,33 @@
+20000531
+ - Cleanup of auth.c, login.c and fake-*
+ - Cleanup of auth-pam.c, save and print "account expired" error messages
+ - Fix EGD read bug by IWAMURO Motonori <[email protected]>
+ - Rewrote bsd-login to use proper utmp API if available. Major cleanup
+   of fallback DIY code.
+
+20000530
+ - Define atexit for old Solaris
+ - Fix buffer overrun in login.c for systems which use syslen in utmpx.
+   patch from YOSHIFUJI Hideaki <[email protected]>
+ - OpenBSD CVS updates:
+  - [email protected]
+    [session.c]
+    make x11-fwd work w/ localhost (xauth add host/unix:11)
+    [cipher.c compat.c readconf.c servconf.c]
+    check strtok() != NULL; ok niels@
+    [key.c]
+    fix key_read() for uuencoded keys w/o '='
+    [serverloop.c]
+    group ssh1 vs. ssh2 in serverloop
+    [kex.c kex.h myproposal.h sshconnect2.c sshd.c]
+    split kexinit/kexdh, factor out common code
+    [readconf.c ssh.1 ssh.c]
+    forwardagent defaults to no, add ssh -A
+  - [email protected]
+    [session.c]
+    just some line shortening
+ - Released 2.1.0p3
+
 20000520
  - Xauth fix from Markus Friedl <[email protected]>
  - Don't touch utmp if USE_UTMPX defined

auth-pam.c

@@ -13,12 +13,16 @@
 #include "xmalloc.h"
 #include "servconf.h"
 
-RCSID("$Id: auth-pam.c,v 1.4 2000/04/29 14:47:29 damien Exp $");
+RCSID("$Id: auth-pam.c,v 1.5 2000/05/31 01:20:12 damien Exp $");
+
+#define NEW_AUTHTOK_MSG \
+	"Warning: You password has expired, please change it now"
 
 /* Callbacks */
 static int pamconv(int num_msg, const struct pam_message **msg,
 	  struct pam_response **resp, void *appdata_ptr);
 void pam_cleanup_proc(void *context);
+void pam_msg_cat(const char *msg);
 
 /* module-local variables */
 static struct pam_conv conv = {
@@ -27,7 +31,7 @@ static struct pam_conv conv = {
 };
 static struct pam_handle_t *pamh = NULL;
 static const char *pampasswd = NULL;
-static char *pamconv_msg = NULL;
+static char *pam_msg = NULL;
 
 /* PAM conversation function. This is really a kludge to get the password */
 /* into PAM and to pick up any messages generated by PAM into pamconv_msg */
@@ -36,8 +40,6 @@ static int pamconv(int num_msg, const struct pam_message **msg,
 {
 	struct pam_response *reply;
 	int count;
-	size_t msg_len;
-	char *p;
 
 	/* PAM will free this later */
 	reply = malloc(num_msg * sizeof(*reply));
@@ -54,31 +56,14 @@ static int pamconv(int num_msg, const struct pam_message **msg,
 				reply[count].resp_retcode = PAM_SUCCESS;
 				reply[count].resp = xstrdup(pampasswd);
 				break;
-
 			case PAM_TEXT_INFO:
 				reply[count].resp_retcode = PAM_SUCCESS;
 				reply[count].resp = xstrdup("");
 
-				if (msg[count]->msg == NULL)
-					break;
+				if (msg[count]->msg != NULL)
+					pam_msg_cat(msg[count]->msg);
 
-				debug("Adding PAM message: %s", msg[count]->msg);
-
-				msg_len = strlen(msg[count]->msg);
-				if (pamconv_msg) {
-					size_t n = strlen(pamconv_msg);
-					pamconv_msg = xrealloc(pamconv_msg, n + msg_len + 2);
-					p = pamconv_msg + n;
-				} else {
-					pamconv_msg = p = xmalloc(msg_len + 2);
-				}
-				memcpy(p, msg[count]->msg, msg_len);
-				p[msg_len] = '\n';
-				p[msg_len + 1] = '\0';
 				break;
-
-			case PAM_PROMPT_ECHO_ON:
-			case PAM_ERROR_MSG:
 			default:
 				free(reply);
 				return PAM_CONV_ERR;
@@ -100,19 +85,19 @@ void pam_cleanup_proc(void *context)
 		pam_retval = pam_close_session((pam_handle_t *)pamh, 0);
 		if (pam_retval != PAM_SUCCESS) {
 			log("Cannot close PAM session: %.200s", 
-			PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
+				PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
 		}
 
 		pam_retval = pam_setcred((pam_handle_t *)pamh, PAM_DELETE_CRED);
 		if (pam_retval != PAM_SUCCESS) {
 			log("Cannot delete credentials: %.200s", 
-			PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
+				PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
 		}
 
 		pam_retval = pam_end((pam_handle_t *)pamh, pam_retval);
 		if (pam_retval != PAM_SUCCESS) {
 			log("Cannot release PAM authentication: %.200s", 
-			PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
+				PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
 		}
 	}
 }
@@ -135,7 +120,8 @@ int auth_pam_password(struct passwd *pw, const char *password)
 	
 	pam_retval = pam_authenticate((pam_handle_t *)pamh, 0);
 	if (pam_retval == PAM_SUCCESS) {
-		debug("PAM Password authentication accepted for user \"%.100s\"", pw->pw_name);
+		debug("PAM Password authentication accepted for user \"%.100s\"", 
+			pw->pw_name);
 		return 1;
 	} else {
 		debug("PAM Password authentication for \"%.100s\" failed: %s", 
@@ -148,26 +134,36 @@ int auth_pam_password(struct passwd *pw, const char *password)
 int do_pam_account(char *username, char *remote_user)
 {
 	int pam_retval;
-
+	
 	debug("PAM setting rhost to \"%.200s\"", get_canonical_hostname());
 	pam_retval = pam_set_item((pam_handle_t *)pamh, PAM_RHOST, 
 		get_canonical_hostname());
 	if (pam_retval != PAM_SUCCESS) {
-		fatal("PAM set rhost failed: %.200s", PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
+		fatal("PAM set rhost failed: %.200s", 
+			PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
 	}
 
 	if (remote_user != NULL) {
 		debug("PAM setting ruser to \"%.200s\"", remote_user);
 		pam_retval = pam_set_item((pam_handle_t *)pamh, PAM_RUSER, remote_user);
 		if (pam_retval != PAM_SUCCESS) {
-			fatal("PAM set ruser failed: %.200s", PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
+			fatal("PAM set ruser failed: %.200s", 
+				PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
 		}
 	}
 
 	pam_retval = pam_acct_mgmt((pam_handle_t *)pamh, 0);
-	if (pam_retval != PAM_SUCCESS) {
-		log("PAM rejected by account configuration: %.200s", PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
-		return(0);
+	switch (pam_retval) {
+		case PAM_SUCCESS:
+			/* This is what we want */
+			break;
+		case PAM_NEW_AUTHTOK_REQD:
+			pam_msg_cat(NEW_AUTHTOK_MSG);
+			break;
+		default:
+			log("PAM rejected by account configuration: %.200s", 
+				PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
+			return(0);
 	}
 	
 	return(1);
@@ -181,13 +177,17 @@ void do_pam_session(char *username, const char *ttyname)
 	if (ttyname != NULL) {
 		debug("PAM setting tty to \"%.200s\"", ttyname);
 		pam_retval = pam_set_item((pam_handle_t *)pamh, PAM_TTY, ttyname);
-		if (pam_retval != PAM_SUCCESS)
-			fatal("PAM set tty failed: %.200s", PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
+		if (pam_retval != PAM_SUCCESS) {
+			fatal("PAM set tty failed: %.200s", 
+				PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
+		}
 	}
 
 	pam_retval = pam_open_session((pam_handle_t *)pamh, 0);
-	if (pam_retval != PAM_SUCCESS)
-		fatal("PAM session setup failed: %.200s", PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
+	if (pam_retval != PAM_SUCCESS) {
+		fatal("PAM session setup failed: %.200s", 
+			PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
+	}
 }
 
 /* Set PAM credentials */ 
@@ -197,8 +197,10 @@ void do_pam_setcred()
  
 	debug("PAM establishing creds");
 	pam_retval = pam_setcred((pam_handle_t *)pamh, PAM_ESTABLISH_CRED);
-	if (pam_retval != PAM_SUCCESS)
-		fatal("PAM setcred failed: %.200s", PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
+	if (pam_retval != PAM_SUCCESS) {
+		fatal("PAM setcred failed: %.200s", 
+			PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
+	}
 }
 
 /* Cleanly shutdown PAM */
@@ -217,9 +219,12 @@ void start_pam(struct passwd *pw)
 
 	pam_retval = pam_start(SSHD_PAM_SERVICE, pw->pw_name, &conv, 
 		(pam_handle_t**)&pamh);
-	if (pam_retval != PAM_SUCCESS)
-		fatal("PAM initialisation failed: %.200s", PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
 
+	if (pam_retval != PAM_SUCCESS) {
+		fatal("PAM initialisation failed: %.200s", 
+			PAM_STRERROR((pam_handle_t *)pamh, pam_retval));
+	}
+	
 	fatal_add_cleanup(&pam_cleanup_proc, NULL);
 }
 
@@ -237,8 +242,30 @@ char **fetch_pam_environment(void)
 /* or account checking to stderr */
 void print_pam_messages(void)
 {
-	if (pamconv_msg != NULL)
-		fprintf(stderr, pamconv_msg);
+	if (pam_msg != NULL)
+		fprintf(stderr, pam_msg);
+}
+
+/* Append a message to the PAM message buffer */
+void pam_msg_cat(const char *msg)
+{
+	char *p;
+	size_t new_msg_len;
+	size_t pam_msg_len;
+	
+	new_msg_len = strlen(msg);
+	
+	if (pam_msg) {
+		pam_msg_len = strlen(pam_msg);
+		pam_msg = xrealloc(pam_msg, new_msg_len + pam_msg_len + 2);
+		p = pam_msg + pam_msg_len;
+	} else {
+		pam_msg = p = xmalloc(new_msg_len + 2);
+	}
+
+	memcpy(p, msg, new_msg_len);
+	p[new_msg_len] = '\n';
+	p[new_msg_len + 1] = '\0';
 }
 
 #endif /* USE_PAM */

auth.c

@@ -121,17 +121,17 @@ allowed_user(struct passwd * pw)
 	}
 
 #ifdef WITH_AIXAUTHENTICATE
-	if (loginrestrictions(pw->pw_name,S_RLOGIN,NULL,&loginmsg) != 0) {
+	if (loginrestrictions(pw->pw_name, S_RLOGIN, NULL, &loginmsg) != 0) {
 		if (loginmsg && *loginmsg) {
 			/* Remove embedded newlines (if any) */
 			char *p;
-			for (p = loginmsg; *p; p++)
+			for (p = loginmsg; *p; p++) {
 				if (*p == '\n')
 					*p = ' ';
+			}
 			/* Remove trailing newline */
 			*--p = '\0';
-			log("Login restricted for %s: %.100s",
-					pw->pw_name, loginmsg);
+			log("Login restricted for %s: %.100s", pw->pw_name, loginmsg);
 		}
 		return 0;
 	}

bsd-login.c

@@ -1,5 +1,5 @@
 /*
- * This file has been modified from the original OpenBSD version 
+ * This file has been heavily modified from the original OpenBSD version 
  */
 
 /*	$OpenBSD: login.c,v 1.5 1998/07/13 02:11:12 millert Exp $	*/
@@ -74,7 +74,7 @@ struct utmp * utp;
 	int t = 0;
 	struct utmp * u;
 
-#if defined(HAVE_TYPE_IN_UTMP) || defined(HAVE_TYPE_IN_UTMPX)
+# if defined(HAVE_TYPE_IN_UTMP) || defined(HAVE_TYPE_IN_UTMPX)
 	setutent();
 
 	while((u = getutent()) != NULL) {
@@ -93,35 +93,47 @@ struct utmp * utp;
 	}
 
 	endutent();
-#endif
+# endif /* defined(HAVE_TYPE_IN_UTMP) || defined(HAVE_TYPE_IN_UTMPX) */
 	return(-1);
 }
-#else
-int find_tty_slot( utp )
-struct utmp * utp;
+#else /* USER_PROCESS */
+int find_tty_slot(struct utmp *utp)
 {
 	return(ttyslot());
 }
-#endif
+#endif /* USER_PROCESS */
 
 #if defined(HAVE_UTMPX_H) && defined(USE_UTMPX)
-void
-login(utp,utx)
-	struct utmp *utp;
-	struct utmpx *utx;
+void login(struct utmpx *utx)
 #else /* defined(HAVE_UTMPX_H) && defined(USE_UTMPX) */
-void
-login(utp)
-	struct utmp *utp;
+void login(struct utmp *utp)
 #endif /* defined(HAVE_UTMPX_H) && defined(USE_UTMPX) */
 {
-#if defined(HAVE_HOST_IN_UTMP)
-	struct utmp old_ut;
-#endif
-#if defined(HAVE_UTMPX_H) && defined(USE_UTMPX)
-	struct utmpx *old_utx;
-#endif /* defined(HAVE_UTMPX_H) && defined(USE_UTMPX) */
-	register int fd;
+	/* Use proper API if we have it */
+#if defined(USE_UTMPX)
+# if defined(HAVE_PUTUTXLINE)
+	setutxent();
+	pututxline(utx);
+	endutxent();	
+# endif /* defined(HAVE_PUTUTXLINE) */
+# if defined(HAVE_UPDWTMPX)
+	updwtmpx(_PATH_WTMPX, utx);
+# endif /* defined(HAVE_UPDWTMPX) */
+#else /* defined(USE_UTMPX) */
+# if defined(HAVE_PUTUTLINE)
+	setutent();
+	pututline(utp);
+	endutent();	
+# endif /* defined(HAVE_PUTUTLINE) */
+# if defined(HAVE_UPDWTMPX)
+	updwtmp(_PATH_WTMP, utp);
+# endif /* defined(HAVE_UPDWTMP) */
+#endif /* defined(USE_UTMPX) */
+
+	/* Otherwise DIY */
+#if (defined(USE_UTMPX) && !defined(HAVE_PUTUTXLINE)) || \
+	(!defined(USE_UTMPX) && !defined(HAVE_PUTUTLINE)) 
+	int fd;
 	int tty;
 
 	/* can't use ttyslot here, as that will not work for logout
@@ -132,72 +144,52 @@ login(utp)
 	tty = find_tty_slot(utp);
 
 #ifdef USE_UTMPX
+	/* If no tty was found, append it to utmpx */
+	if (tty == -1) {
+		if ((fd = open(_PATH_UTMPX, O_WRONLY|O_APPEND, 0)) >= 0) {
+			(void)write(fd, utp, sizeof(struct utmp));
+			(void)close(fd);
+			return;
+		}
+	}
+	/* Otherwise, tty was found - update at its location */
 	fd = open(_PATH_UTMPX, O_RDWR|O_CREAT, 0644);
 	if (fd == -1) {
 		log("Couldn't open %s: %s", _PATH_UTMPX, strerror(errno));
+		return;
+	}
+	lseek(fd, (off_t)(tty * sizeof(struct utmpx)), SEEK_SET);
+	write(fd, utx, sizeof(struct utmpx));
+	close(fd);
+	if ((fd = open(_PATH_WTMPX, O_WRONLY|O_APPEND, 0)) >= 0) {
+		(void)write(fd, utx, sizeof(struct utmpx));
+		(void)close(fd);
+	}
 #else /* USE_UTMPX */
+	/* If no tty was found, append it to utmp */
+	if (tty == -1) {
+		if ((fd = open(_PATH_UTMP, O_WRONLY|O_APPEND, 0)) >= 0) {
+			(void)write(fd, utp, sizeof(struct utmp));
+			(void)close(fd);
+			return;
+		}
+	}
+	/* Otherwise, tty was found - update at its location */
 	fd = open(_PATH_UTMP, O_RDWR|O_CREAT, 0644);
 	if (fd == -1) {
 		log("Couldn't open %s: %s", _PATH_UTMP, strerror(errno));
-#endif /* USE_UTMPX */
-	} else {
-		/* If no tty was found... */
-		if (tty == -1) {
-			/* ... append it to utmp on login */
-#if defined(HAVE_TYPE_IN_UTMP) || defined(HAVE_TYPE_IN_UTMPX)
-			if (utp->ut_type == USER_PROCESS) {
-#ifdef USE_UTMPX
-				if ((fd = open(_PATH_UTMPX, O_WRONLY|O_APPEND, 0)) >= 0) {
-#else /* USE_UTMPX */
-				if ((fd = open(_PATH_UTMP, O_WRONLY|O_APPEND, 0)) >= 0) {
-#endif /* USE_UTMPX */
-					(void)write(fd, utp, sizeof(struct utmp));
-					(void)close(fd);
-				}
-			} else {
-				/* Shouldn't get to here unless somthing happened to utmp */
-				/* Between login and logout */
-				log("No tty slot found at logout");
-			}
-#endif
-		} else {
-			/* Otherwise, tty was found - update at its location */
-#if defined(HAVE_HOST_IN_UTMP)
-# ifndef UT_LINESIZE
-#  define UT_LINESIZE (sizeof(old_ut.ut_line))
-#  define UT_NAMESIZE (sizeof(old_ut.ut_name))
-#  define UT_HOSTSIZE (sizeof(old_ut.ut_host))
-# endif
-			(void)lseek(fd, (off_t)(tty * sizeof(struct utmp)), SEEK_SET);
-			/*
-			 * Prevent luser from zero'ing out ut_host.
-			 * If the new ut_line is empty but the old one is not
-			 * and ut_line and ut_name match, preserve the old ut_line.
-			 */
-			if (read(fd, &old_ut, sizeof(struct utmp)) ==
-		   	 sizeof(struct utmp) && utp->ut_host[0] == '\0' &&
-		   	 old_ut.ut_host[0] != '\0' &&
-		   	 strncmp(old_ut.ut_line, utp->ut_line, UT_LINESIZE) == 0 &&
-		   	 strncmp(old_ut.ut_name, utp->ut_name, UT_NAMESIZE) == 0)
-				(void)memcpy(utp->ut_host, old_ut.ut_host, UT_HOSTSIZE);
-#endif /* defined(HAVE_HOST_IN_UTMP) */
-			(void)lseek(fd, (off_t)(tty * sizeof(struct utmp)), SEEK_SET);
-			(void)write(fd, utp, sizeof(struct utmp));
-			(void)close(fd);
-		}
+		return;
 	}
-
+	lseek(fd, (off_t)(tty * sizeof(struct utmp)), SEEK_SET);
+	write(fd, utp, sizeof(struct utmp));
+	close(fd);
 	if ((fd = open(_PATH_WTMP, O_WRONLY|O_APPEND, 0)) >= 0) {
 		(void)write(fd, utp, sizeof(struct utmp));
 		(void)close(fd);
 	}
-#if defined(HAVE_UTMPX_H) && defined(USE_UTMPX)
-	old_utx = pututxline(utx);
-# ifdef HAVE_UPDWTMPX
-	updwtmpx(_PATH_WTMPX, utx);
-# endif /* HAVE_UPDWTMPX */
-	endutxent();
-#endif /* defined(HAVE_UTMPX_H) && defined(USE_UTMPX) */
+#endif /* USE_UTMPX */
+#endif /* (defined(USE_UTMPX) && !defined(HAVE_PUTUTXLINE)) || \
+			(!defined(USE_UTMPX) && !defined(HAVE_PUTUTLINE)) */
 }
 
 #endif /* HAVE_LOGIN */

cipher.c

@@ -12,7 +12,7 @@
  */
 
 #include "includes.h"
-RCSID("$Id: cipher.c,v 1.20 2000/04/16 02:31:50 damien Exp $");
+RCSID("$Id: cipher.c,v 1.21 2000/05/30 03:44:52 damien Exp $");
 
 #include "ssh.h"
 #include "cipher.h"
@@ -178,7 +178,7 @@ ciphers_valid(const char *names)
 	char *p;
 	int i;
 
-	if (strcmp(names, "") == 0)
+	if (names == NULL || strcmp(names, "") == 0)
 		return 0;
 	ciphers = xstrdup(names);
 	for ((p = strtok(ciphers, CIPHER_SEP)); p; (p = strtok(NULL, CIPHER_SEP))) {
@@ -201,6 +201,8 @@ int
 cipher_number(const char *name)
 {
 	int i;
+	if (name == NULL)
+		return -1;
 	for (i = 0; i < sizeof(cipher_names) / sizeof(cipher_names[0]); i++)
 		if (strcmp(cipher_names[i], name) == 0 &&
 		    (cipher_mask() & (1 << i)))

compat.c

@@ -28,7 +28,7 @@
  */
 
 #include "includes.h"
-RCSID("$Id: compat.c,v 1.10 2000/05/09 01:03:00 damien Exp $");
+RCSID("$Id: compat.c,v 1.11 2000/05/30 03:44:53 damien Exp $");
 
 #include "ssh.h"
 #include "packet.h"
@@ -80,10 +80,12 @@ compat_datafellows(const char *version)
 int
 proto_spec(const char *spec)
 {
-	char *s = xstrdup(spec);
-	char *p;
+	char *s, *p;
 	int ret = SSH_PROTO_UNKNOWN;
 
+	if (spec == NULL)
+		return ret;
+	s = xstrdup(spec);
 	for ((p = strtok(s, SEP)); p; (p = strtok(NULL, SEP))) {
 		switch(atoi(p)) {
 		case 1:

configure.in

@@ -135,7 +135,7 @@ fi
 AC_CHECK_HEADERS(bstring.h endian.h lastlog.h login.h maillock.h netdb.h netgroup.h netinet/in_systm.h paths.h poll.h pty.h shadow.h security/pam_appl.h sys/bitypes.h sys/bsdtty.h sys/cdefs.h sys/poll.h sys/select.h sys/stropts.h sys/sysmacros.h sys/time.h sys/ttcompat.h stddef.h util.h utmp.h utmpx.h)
 
 # Checks for library functions.
-AC_CHECK_FUNCS(arc4random b64_ntop bcopy bindresvport_af clock freeaddrinfo gai_strerror getaddrinfo getnameinfo getrusage innetgr md5_crypt memmove mkdtemp openpty rresvport_af setenv seteuid setlogin setproctitle setreuid snprintf strlcat strlcpy updwtmpx vsnprintf vhangup _getpty __b64_ntop)
+AC_CHECK_FUNCS(arc4random atexit b64_ntop bcopy bindresvport_af clock freeaddrinfo gai_strerror getaddrinfo getnameinfo getrusage innetgr md5_crypt memmove mkdtemp on_exit openpty pututline pututxline rresvport_af setenv seteuid setlogin setproctitle setreuid snprintf strlcat strlcpy updwtmp updwtmpx vsnprintf vhangup _getpty __b64_ntop)
 
 AC_CHECK_FUNC(login, 
 	[AC_DEFINE(HAVE_LOGIN)],

contrib/redhat/openssh.spec

@@ -1,5 +1,5 @@
 # Version of OpenSSH
-%define oversion 2.1.0p2
+%define oversion 2.1.0p3
 
 # Version of ssh-askpass
 %define aversion 1.0

contrib/suse/openssh.spec

@@ -1,6 +1,6 @@
 Summary: OpenSSH, a free Secure Shell (SSH) implementation
 Name: openssh
-Version: 2.1.0p2
+Version: 2.1.0p3
 URL: http://www.openssh.com/
 Release: 1
 Source0: openssh-%{version}.tar.gz

defines.h

@@ -293,4 +293,8 @@ typedef int ssize_t;
 # define memmove(s1, s2, n) bcopy((s2), (s1), (n))
 #endif /* !defined(HAVE_MEMMOVE) && defined(HAVE_BCOPY) */
 
+#if !defined(HAVE_ATEXIT) && defined(HAVE_ON_EXIT)
+# define atexit(a) on_exit(a)
+#endif /* !defined(HAVE_ATEXIT) && defined(HAVE_ON_EXIT) */
+
 #endif /* _DEFINES_H */

entropy.c

@@ -35,7 +35,7 @@
 #include <openssl/rand.h>
 #include <openssl/sha.h>
 
-RCSID("$Id: entropy.c,v 1.11 2000/05/17 12:08:30 damien Exp $");
+RCSID("$Id: entropy.c,v 1.12 2000/05/31 01:24:34 damien Exp $");
 
 #ifdef EGD_SOCKET
 #ifndef offsetof
@@ -82,8 +82,6 @@ void get_random_bytes(unsigned char *buf, int len)
 	c = atomicio(read, egd_socket, buf, len);
 	if (c <= 0)
 		fatal("Couldn't read from EGD socket \"%s\": %s", EGD_SOCKET, strerror(errno));
-	
-	close(EGD_SOCKET);
 }
 #else /* !EGD_SOCKET */
 #ifdef RANDOM_POOL

fake-getaddrinfo.c

@@ -7,113 +7,112 @@
  * But these functions are not implemented correctly. The minimum subset
  * is implemented for ssh use only. For exapmle, this routine assumes
  * that ai_family is AF_INET. Don't use it for another purpose.
- * 
- * In the case not using 'configure --enable-ipv6', this getaddrinfo.c
- * will be used if you have broken getaddrinfo or no getaddrinfo.
  */
 
 #include "includes.h"
 #include "ssh.h"
 
 #ifndef HAVE_GAI_STRERROR
-char *
-gai_strerror(ecode)
-int ecode;
+char *gai_strerror(int ecode)
 {
-  switch (ecode) {
-  case EAI_NODATA:
-    return "no address associated with hostname.";
-  case EAI_MEMORY:
-    return "memory allocation failure.";
-  default:
-    return "unknown error.";
-  }
+	switch (ecode) {
+		case EAI_NODATA:
+			return "no address associated with hostname.";
+		case EAI_MEMORY:
+			return "memory allocation failure.";
+		default:
+			return "unknown error.";
+	}
 }    
 #endif /* !HAVE_GAI_STRERROR */
 
 #ifndef HAVE_FREEADDRINFO
-void
-freeaddrinfo(ai)
-struct addrinfo *ai;
+void freeaddrinfo(struct addrinfo *ai)
 {
-  struct addrinfo *next;
-  
-  do {
-    next = ai->ai_next;
-    free(ai);
-  } while (NULL != (ai = next));
+	struct addrinfo *next;
+
+	do {
+		next = ai->ai_next;
+		free(ai);
+	} while (NULL != (ai = next));
 }
 #endif /* !HAVE_FREEADDRINFO */
 
 #ifndef HAVE_GETADDRINFO
-static struct addrinfo *
-malloc_ai(port, addr)
-int port;
-u_long addr;
+static struct addrinfo *malloc_ai(int port, u_long addr)
 {
-  struct addrinfo *ai;
+	struct addrinfo *ai;
 
-  if (NULL != (ai = (struct addrinfo *)malloc(sizeof(struct addrinfo) +
-				     sizeof(struct sockaddr_in)))) {
-    memset(ai, 0, sizeof(struct addrinfo) + sizeof(struct sockaddr_in));
-    ai->ai_addr = (struct sockaddr *)(ai + 1);
-    /* XXX -- ssh doesn't use sa_len */
-    ai->ai_addrlen = sizeof(struct sockaddr_in);
-    ai->ai_addr->sa_family = ai->ai_family = AF_INET;
-    ((struct sockaddr_in *)(ai)->ai_addr)->sin_port = port;
-    ((struct sockaddr_in *)(ai)->ai_addr)->sin_addr.s_addr = addr;
-    return ai;
-  } else {
-    return NULL;
-  }
+	ai = malloc(sizeof(struct addrinfo) + sizeof(struct sockaddr_in));
+	if (ai == NULL)
+		return(NULL);
+	
+	memset(ai, 0, sizeof(struct addrinfo) + sizeof(struct sockaddr_in));
+	
+	ai->ai_addr = (struct sockaddr *)(ai + 1);
+	/* XXX -- ssh doesn't use sa_len */
+	ai->ai_addrlen = sizeof(struct sockaddr_in);
+	ai->ai_addr->sa_family = ai->ai_family = AF_INET;
+
+	((struct sockaddr_in *)(ai)->ai_addr)->sin_port = port;
+	((struct sockaddr_in *)(ai)->ai_addr)->sin_addr.s_addr = addr;
+	
+	return(ai);
 }
 
-int
-getaddrinfo(hostname, servname, hints, res)
-const char *hostname, *servname;
-const struct addrinfo *hints;
-struct addrinfo **res;
+int getaddrinfo(const char *hostname, const char *servname, 
+                const struct addrinfo *hints, struct addrinfo **res)
 {
-  struct addrinfo *cur, *prev = NULL;
-  struct hostent *hp;
-  int i, port;
-  
-  if (servname)
-    port = htons(atoi(servname));
-  else
-    port = 0;
-  if (hints && hints->ai_flags & AI_PASSIVE)
-    if (NULL != (*res = malloc_ai(port, htonl(0x00000000))))
-      return 0;
-    else
-      return EAI_MEMORY;
-  if (!hostname)
-    if (NULL != (*res = malloc_ai(port, htonl(0x7f000001))))
-      return 0;
-    else
-      return EAI_MEMORY;
-  if (inet_addr(hostname) != -1)
-    if (NULL != (*res = malloc_ai(port, inet_addr(hostname))))
-      return 0;
-    else
-      return EAI_MEMORY;
-  if ((hp = gethostbyname(hostname)) &&
-      hp->h_name && hp->h_name[0] && hp->h_addr_list[0]) {
-    for (i = 0; hp->h_addr_list[i]; i++)
-      if (NULL != (cur = malloc_ai(port, 
-			((struct in_addr *)hp->h_addr_list[i])->s_addr))) {
-	if (prev)
-	  prev->ai_next = cur;
+	struct addrinfo *cur, *prev = NULL;
+	struct hostent *hp;
+	int i, port;
+
+	if (servname)
+		port = htons(atoi(servname));
 	else
-	  *res = cur;
-	prev = cur;
-      } else {
-	if (*res)
-	  freeaddrinfo(*res);
-	return EAI_MEMORY;
-      }
-    return 0;
-  }
-  return EAI_NODATA;
+		port = 0;
+
+	if (hints && hints->ai_flags & AI_PASSIVE) {
+		if (NULL != (*res = malloc_ai(port, htonl(0x00000000))))
+			return 0;
+		else
+			return EAI_MEMORY;
+	}
+		
+	if (!hostname) {
+		if (NULL != (*res = malloc_ai(port, htonl(0x7f000001))))
+			return 0;
+		else
+			return EAI_MEMORY;
+	}
+	
+	if (inet_addr(hostname) != -1) {
+		if (NULL != (*res = malloc_ai(port, inet_addr(hostname))))
+			return 0;
+		else
+			return EAI_MEMORY;
+	}
+	
+	hp = gethostbyname(hostname);
+	if (hp && hp->h_name && hp->h_name[0] && hp->h_addr_list[0]) {
+		for (i = 0; hp->h_addr_list[i]; i++) {
+			cur = malloc_ai(port, ((struct in_addr *)hp->h_addr_list[i])->s_addr);
+			if (cur == NULL) {
+				if (*res)
+					freeaddrinfo(*res);
+				return EAI_MEMORY;
+			}
+			
+			if (prev)
+				prev->ai_next = cur;
+			else
+				*res = cur;
+
+			prev = cur;
+		}
+		return 0;
+	}
+	
+	return EAI_NODATA;
 }
 #endif /* !HAVE_GETADDRINFO */

fake-getnameinfo.c

@@ -7,55 +7,47 @@
  * But these functions are not implemented correctly. The minimum subset
  * is implemented for ssh use only. For exapmle, this routine assumes
  * that ai_family is AF_INET. Don't use it for another purpose.
- * 
- * In the case not using 'configure --enable-ipv6', this getnameinfo.c
- * will be used if you have broken getnameinfo or no getnameinfo.
  */
 
 #include "includes.h"
 #include "ssh.h"
 
 #ifndef HAVE_GETNAMEINFO
-int
-getnameinfo(sa, salen, host, hostlen, serv, servlen, flags)
-const struct sockaddr *sa;
-size_t salen;
-char *host;
-size_t hostlen;
-char *serv;
-size_t servlen;
-int flags;
+int getnameinfo(const struct sockaddr *sa, size_t salen, char *host, 
+                size_t hostlen, char *serv, size_t servlen, int flags)
 {
-  struct sockaddr_in *sin = (struct sockaddr_in *)sa;
-  struct hostent *hp;
-  char tmpserv[16];
-  
-  if (serv) {
-    sprintf(tmpserv, "%d", ntohs(sin->sin_port));
-    if (strlen(tmpserv) > servlen)
-      return EAI_MEMORY;
-    else
-      strcpy(serv, tmpserv);
-  }
-  if (host)
-    if (flags & NI_NUMERICHOST)
-      if (strlen(inet_ntoa(sin->sin_addr)) > hostlen)
-	return EAI_MEMORY;
-      else {
-	strcpy(host, inet_ntoa(sin->sin_addr));
-	return 0;
-      }
-    else
-      if (NULL != (hp = gethostbyaddr((char *)&sin->sin_addr, 
-			sizeof(struct in_addr), AF_INET)))
-	if (strlen(hp->h_name) > hostlen)
-	  return EAI_MEMORY;
-	else {
-	  strcpy(host, hp->h_name);
-	  return 0;
+	struct sockaddr_in *sin = (struct sockaddr_in *)sa;
+	struct hostent *hp;
+	char tmpserv[16];
+
+	if (serv) {
+		snprintf(tmpserv, sizeof(tmpserv), "%d", ntohs(sin->sin_port));
+		if (strlen(tmpserv) > servlen)
+			return EAI_MEMORY;
+		else
+			strcpy(serv, tmpserv);
 	}
-      else
-	return EAI_NODATA;
-  return 0;
+
+	if (host) {
+		if (flags & NI_NUMERICHOST) {
+			if (strlen(inet_ntoa(sin->sin_addr)) > hostlen)
+				return EAI_MEMORY;
+
+			strcpy(host, inet_ntoa(sin->sin_addr));
+			return 0;
+		} else {
+			hp = gethostbyaddr((char *)&sin->sin_addr, 
+				sizeof(struct in_addr), AF_INET);
+			if (hp == NULL)
+				return EAI_NODATA;
+			
+			if (strlen(hp->h_name) > hostlen)
+				return EAI_MEMORY;
+
+			strcpy(host, hp->h_name);
+			return 0;
+		}
+	}
+	return 0;
 }
 #endif /* !HAVE_GETNAMEINFO */

fake-getnameinfo.h

@@ -2,6 +2,7 @@
 #define _FAKE_GETNAMEINFO_H
 
 #include "config.h"
+
 #ifndef HAVE_GETNAMEINFO
 int getnameinfo(const struct sockaddr *sa, size_t salen, char *host, 
                 size_t hostlen, char *serv, size_t servlen, int flags);

fake-socket.h

@@ -5,10 +5,10 @@
 #include "sys/types.h"
 
 #ifndef HAVE_STRUCT_SOCKADDR_STORAGE
-#define	_SS_MAXSIZE	128	/* Implementation specific max size */
-#define	_SS_ALIGNSIZE	(sizeof(int))
-#define	_SS_PAD1SIZE	(_SS_ALIGNSIZE - sizeof(u_short))
-#define	_SS_PAD2SIZE	(_SS_MAXSIZE - (sizeof(u_short) + \
+# define	_SS_MAXSIZE	128	/* Implementation specific max size */
+# define	_SS_ALIGNSIZE	(sizeof(int))
+# define	_SS_PAD1SIZE	(_SS_ALIGNSIZE - sizeof(u_short))
+# define	_SS_PAD2SIZE	(_SS_MAXSIZE - (sizeof(u_short) + \
 					_SS_PAD1SIZE + _SS_ALIGNSIZE))
 
 struct sockaddr_storage {
@@ -20,7 +20,7 @@ struct sockaddr_storage {
 #endif /* !HAVE_STRUCT_SOCKADDR_STORAGE */
 
 #ifndef IN6_IS_ADDR_LOOPBACK
-#define IN6_IS_ADDR_LOOPBACK(a) \
+# define IN6_IS_ADDR_LOOPBACK(a) \
 	(((u_int32_t *) (a))[0] == 0 && ((u_int32_t *) (a))[1] == 0 && \
 	 ((u_int32_t *) (a))[2] == 0 && ((u_int32_t *) (a))[3] == htonl (1))
 #endif /* !IN6_IS_ADDR_LOOPBACK */

kex.c

@@ -28,13 +28,14 @@
  */
 
 #include "includes.h"
-RCSID("$Id: kex.c,v 1.8 2000/05/09 01:03:01 damien Exp $");
+RCSID("$Id: kex.c,v 1.9 2000/05/30 03:44:53 damien Exp $");
 
 #include "ssh.h"
 #include "ssh2.h"
 #include "xmalloc.h"
 #include "buffer.h"
 #include "bufaux.h"
+#include "packet.h"
 #include "cipher.h"
 #include "compat.h"
 
@@ -49,15 +50,17 @@ RCSID("$Id: kex.c,v 1.8 2000/05/09 01:03:01 damien Exp $");
 
 #include "kex.h"
 
+#define KEX_COOKIE_LEN	16
+
 Buffer *
 kex_init(char *myproposal[PROPOSAL_MAX])
 {
-	char c = 0;
-	unsigned char cookie[16];
+	int first_kex_packet_follows = 0;
+	unsigned char cookie[KEX_COOKIE_LEN];
 	u_int32_t rand = 0;
 	int i;
 	Buffer *ki = xmalloc(sizeof(*ki));
-	for (i = 0; i < 16; i++) {
+	for (i = 0; i < KEX_COOKIE_LEN; i++) {
 		if (i % 4 == 0)
 			rand = arc4random();
 		cookie[i] = rand & 0xff;
@@ -67,11 +70,55 @@ kex_init(char *myproposal[PROPOSAL_MAX])
 	buffer_append(ki, (char *)cookie, sizeof cookie);
 	for (i = 0; i < PROPOSAL_MAX; i++)
 		buffer_put_cstring(ki, myproposal[i]);
-	buffer_append(ki, &c, 1); /* boolean   first_kex_packet_follows */
-	buffer_put_int(ki, 0);    /* uint32    0 (reserved for future extension) */
+	buffer_put_char(ki, first_kex_packet_follows);
+	buffer_put_int(ki, 0);				/* uint32 reserved */
 	return ki;
 }
 
+/* send kexinit, parse and save reply */
+void
+kex_exchange_kexinit(
+    Buffer *my_kexinit, Buffer *peer_kexint,
+    char *peer_proposal[PROPOSAL_MAX])
+{
+	int i;
+	char *ptr;
+	int plen;
+
+	debug("send KEXINIT");
+	packet_start(SSH2_MSG_KEXINIT);
+	packet_put_raw(buffer_ptr(my_kexinit), buffer_len(my_kexinit));	
+	packet_send();
+	packet_write_wait();
+	debug("done");
+
+	/*
+	 * read and save raw KEXINIT payload in buffer. this is used during
+	 * computation of the session_id and the session keys.
+	 */
+	debug("wait KEXINIT");
+	packet_read_expect(&plen, SSH2_MSG_KEXINIT);
+	ptr = packet_get_raw(&plen);
+	buffer_append(peer_kexint, ptr, plen);
+
+	/* parse packet and save algorithm proposal */
+	/* skip cookie */
+	for (i = 0; i < KEX_COOKIE_LEN; i++)
+		packet_get_char();
+	/* extract kex init proposal strings */
+	for (i = 0; i < PROPOSAL_MAX; i++) {
+		peer_proposal[i] = packet_get_string(NULL);
+		debug("got kexinit: %s", peer_proposal[i]);
+	}
+	/* first kex follow / reserved */
+	i = packet_get_char();
+	debug("first kex follow: %d ", i);
+	i = packet_get_int();
+	debug("reserved: %d ", i);
+	packet_done();
+	debug("done");
+}
+
 /* diffie-hellman-group1-sha1 */
 
 int
@@ -133,12 +180,6 @@ dh_new_group1()
 	return dh;
 }
 
-void
-bignum_print(BIGNUM *b)
-{
-	BN_print_fp(stderr,b);
-}
-
 void
 dump_digest(unsigned char *digest, int len)
 {
@@ -246,10 +287,13 @@ char *
 get_match(char *client, char *server)
 {
 	char *sproposals[MAX_PROP];
-	char *p;
+	char *c, *s, *p, *ret;
 	int i, j, nproposals;
 
-	for ((p = strtok(server, SEP)), i=0; p; (p = strtok(NULL, SEP)), i++) {
+	c = xstrdup(client);
+	s = xstrdup(server);
+
+	for ((p = strtok(s, SEP)), i=0; p; (p = strtok(NULL, SEP)), i++) {
 		if (i < MAX_PROP)
 			sproposals[i] = p;
 		else
@@ -257,11 +301,18 @@ get_match(char *client, char *server)
 	}
 	nproposals = i;
 
-	for ((p = strtok(client, SEP)), i=0; p; (p = strtok(NULL, SEP)), i++) {
-		for (j = 0; j < nproposals; j++)
-			if (strcmp(p, sproposals[j]) == 0)
-				return xstrdup(p);
+	for ((p = strtok(c, SEP)), i=0; p; (p = strtok(NULL, SEP)), i++) {
+		for (j = 0; j < nproposals; j++) {
+			if (strcmp(p, sproposals[j]) == 0) {
+				ret = xstrdup(p);
+				xfree(c);
+				xfree(s);
+				return ret;
+			}
+		}
 	}
+	xfree(c);
+	xfree(s);
 	return NULL;
 }
 void
@@ -355,7 +406,6 @@ choose_hostkeyalg(Kex *k, char *client, char *server)
 Kex *
 kex_choose_conf(char *cprop[PROPOSAL_MAX], char *sprop[PROPOSAL_MAX], int server)
 {
-	int i;
 	int mode;
 	int ctos;				/* direction: if true client-to-server */
 	int need;
@@ -383,10 +433,6 @@ kex_choose_conf(char *cprop[PROPOSAL_MAX], char *sprop[PROPOSAL_MAX], int server
 	choose_kex(k, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]);
 	choose_hostkeyalg(k, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS],
 	    sprop[PROPOSAL_SERVER_HOST_KEY_ALGS]);
-	for (i = 0; i < PROPOSAL_MAX; i++) {
-		xfree(cprop[i]);
-		xfree(sprop[i]);
-	}
 	need = 0;
 	for (mode = 0; mode < MODE_MAX; mode++) {
 	    if (need < k->enc[mode].key_len)
@@ -396,9 +442,7 @@ kex_choose_conf(char *cprop[PROPOSAL_MAX], char *sprop[PROPOSAL_MAX], int server
 	    if (need < k->mac[mode].key_len)
 		    need = k->mac[mode].key_len;
 	}
-	/* need runden? */
-#define WE_NEED 32
-	k->we_need = WE_NEED;
+	/* XXX need runden? */
 	k->we_need = need;
 	return k;
 }

kex.h

@@ -91,12 +91,17 @@ struct Kex {
 };
 
 Buffer	*kex_init(char *myproposal[PROPOSAL_MAX]);
+void
+kex_exchange_kexinit(
+    Buffer *my_kexinit, Buffer *peer_kexint,
+    char *peer_proposal[PROPOSAL_MAX]);
+Kex *
+kex_choose_conf(char *cprop[PROPOSAL_MAX],
+    char *sprop[PROPOSAL_MAX], int server);
+int	kex_derive_keys(Kex *k, unsigned char *hash, BIGNUM *shared_secret);
+void	packet_set_kex(Kex *k);
 int	dh_pub_is_valid(DH *dh, BIGNUM *dh_pub);
 DH	*dh_new_group1();
-Kex 	*kex_choose_conf(char *cprop[PROPOSAL_MAX], char *sprop[PROPOSAL_MAX], int server);
-int	kex_derive_keys(Kex *k, unsigned char *hash, BIGNUM *shared_secret);
-void	bignum_print(BIGNUM *b);
-void	packet_set_kex(Kex *k);
 
 unsigned char *
 kex_hash(

key.c

@@ -256,12 +256,14 @@ key_read(Key *ret, char **cpp)
 		blob = xmalloc(len);
 		n = uudecode(cp, blob, len);
 		if (n < 0) {
-			error("uudecode %s failed", cp);
+			error("key_read: uudecode %s failed", cp);
 			return 0;
 		}
 		k = dsa_key_from_blob(blob, n);
-		if (k == NULL)
-			 return 0;
+		if (k == NULL) {
+			error("key_read: dsa_key_from_blob %s failed", cp);
+			return 0;
+		}
 		xfree(blob);
 		if (ret->dsa != NULL)
 			DSA_free(ret->dsa);
@@ -269,10 +271,12 @@ key_read(Key *ret, char **cpp)
 		k->dsa = NULL;
 		key_free(k);
 		bits = BN_num_bits(ret->dsa->p);
-		cp = strchr(cp, '=');
-		if (cp == NULL)
-			return 0;
-		*cpp = cp + 1;
+		/* advance cp: skip whitespace and data */
+		while (*cp == ' ' || *cp == '\t')
+			cp++;
+		while (*cp != '\0' && *cp != ' ' && *cp != '\t')
+			cp++;
+		*cpp = cp;
 		break;
 	default:
 		fatal("key_read: bad key type: %d", ret->type);

login.c

@@ -18,7 +18,7 @@
  */
 
 #include "includes.h"
-RCSID("$Id: login.c,v 1.27 2000/05/17 12:00:03 damien Exp $");
+RCSID("$Id: login.c,v 1.30 2000/05/31 03:57:19 damien Exp $");
 
 #if defined(HAVE_UTMPX_H) && defined(USE_UTMPX)
 # include <utmpx.h>
@@ -38,6 +38,11 @@ RCSID("$Id: login.c,v 1.27 2000/05/17 12:00:03 damien Exp $");
 # include <login.h>
 #endif
 
+#ifdef WITH_AIXAUTHENTICATE
+/* This is done in do_authentication */
+# define DISABLE_LASTLOG
+#endif /* WITH_AIXAUTHENTICATE */
+
 /*
  * Returns the time when the user last logged in.  Returns 0 if the
  * information is not available.  This must be called before record_login.
@@ -53,58 +58,50 @@ unsigned long
 get_last_login_time(uid_t uid, const char *logname,
 		    char *buf, unsigned int bufsize)
 {
-#if defined(WITH_AIXAUTHENTICATE)
-	/* This is done in do_authentication */
-	return (unsigned long) 0;
-#else
 #if defined(_PATH_LASTLOG) && !defined(DISABLE_LASTLOG)
 	struct lastlog ll;
-	char *lastlog;
 	int fd;
-#ifdef LASTLOG_IS_DIR
+# ifdef LASTLOG_IS_DIR
 	char lbuf[1024];
-#endif /* LASTLOG_IS_DIR */
 
-	lastlog = _PATH_LASTLOG;
+	snprintf(lbuf, sizeof(buf), "%s/%s", _PATH_LASTLOG, logname);
+	if ((fd = open(lbuf, O_RDONLY)) < 0)
+		return 0;
+# else /* LASTLOG_IS_DIR */
 	buf[0] = '\0';
 
-#ifndef LASTLOG_IS_DIR
-	fd = open(lastlog, O_RDONLY);
-	if (fd < 0)
+	if ((fd = open(_PATH_LASTLOG, O_RDONLY)) < 0)
 		return 0;
+
 	lseek(fd, (off_t) ((long) uid * sizeof(ll)), SEEK_SET);
-#else /* LASTLOG_IS_DIR */
-	snprintf(lbuf, sizeof(buf), "%s/%s", lastlog, logname);
-	fd = open(lbuf, O_RDONLY);
-	if (fd < 0)
-		return 0;
-#endif /* LASTLOG_IS_DIR */
+# endif /* LASTLOG_IS_DIR */
 	if (read(fd, &ll, sizeof(ll)) != sizeof(ll)) {
 		close(fd);
 		return 0;
 	}
+
 	close(fd);
+
 	if (bufsize > sizeof(ll.ll_host) + 1)
 		bufsize = sizeof(ll.ll_host) + 1;
 	strncpy(buf, ll.ll_host, bufsize - 1);
 	buf[bufsize - 1] = 0;
-	return ll.ll_time;
 
+	return ll.ll_time;
 #else /* defined(_PATH_LASTLOG) && !defined(DISABLE_LASTLOG) */
 # ifdef HAVE_TYPE_IN_UTMP
 	/* Look in wtmp for the last login */
 	struct utmp  wt;
-	char        *wt_file = _PATH_WTMP;
-	int         fd1;
+	int fd1;
 	unsigned long t = 0;
 
-	if ( (fd1 = open(wt_file, O_RDONLY)) < 0 ) {
-		error("Couldn't open %.100s to find last login time.", wt_file);
+	if ((fd1 = open(_PATH_WTMP, O_RDONLY)) < 0) {
+		error("Couldn't open %.100s to find last login time.", _PATH_WTMP);
 		return 0;
 	}
 
 	/* seek to last record of file */
-	lseek(fd1, (off_t)(0-sizeof(struct utmp)), SEEK_END);
+	lseek(fd1, (off_t)(0 - sizeof(struct utmp)), SEEK_END);
 
 	/* loop through wtmp for our last user login record */
 	do {
@@ -113,47 +110,44 @@ get_last_login_time(uid_t uid, const char *logname,
 			return 0;
 		}
 
-		if ( wt.ut_type == USER_PROCESS) {
-			if ( !strncmp(logname, wt.ut_user, 8) ) {
-				t = (unsigned long) wt.ut_time;
-# ifdef HAVE_HOST_IN_UTMP
+		if (wt.ut_type == USER_PROCESS) {
+			if (!strncmp(logname, wt.ut_user, 8)) {
+				t = (unsigned long)wt.ut_time;
+#  ifdef HAVE_HOST_IN_UTMP
 				if (bufsize > sizeof(wt.ut_host) + 1)
-				bufsize = sizeof(wt.ut_host) + 1;
+					bufsize = sizeof(wt.ut_host) + 1;
 				strncpy(buf, wt.ut_host, bufsize - 1);
 				buf[bufsize - 1] = 0;
-# else /* HAVE_HOST_IN_UTMP */
+#  else /* HAVE_HOST_IN_UTMP */
 				buf[0] = 0;
-# endif /* HAVE_HOST_IN_UTMP */
+#  endif /* HAVE_HOST_IN_UTMP */
 			}
 		}
 
-		if (lseek(fd1, (off_t)(0-2*sizeof(struct utmp)), SEEK_CUR) == -1)
+		if (lseek(fd1, (off_t)(0 - (2 * sizeof(struct utmp))), SEEK_CUR) < 0)
 			break;
 	} while (t == 0);
 
 	return t;
-# else
+# else /* HAVE_TYPE_IN_UTMP */
 	return 0;
 # endif /* HAVE_TYPE_IN_UTMP */
 #endif /* defined(_PATH_LASTLOG) && !defined(DISABLE_LASTLOG) */
-#endif /* defined(WITH_AIXAUTHENTICATE) */
 }
 
 /*
- * Records that the user has logged in.  I these parts of operating systems
- * were more standardized.
+ * Records that the user has logged in.  I wish these parts of operating 
+ * systems were more standardized.
  */
-
 void
 record_login(pid_t pid, const char *ttyname, const char *user, uid_t uid,
 	     const char *host, struct sockaddr * addr)
 {
 #if defined(_PATH_LASTLOG) && !defined(DISABLE_LASTLOG)
 	struct lastlog ll;
-	char *lastlog;
-#ifdef LASTLOG_IS_DIR
+# ifdef LASTLOG_IS_DIR
 	char buf[1024];
-#endif /* LASTLOG_IS_DIR */
+# endif /* LASTLOG_IS_DIR */
 #endif /* defined(_PATH_LASTLOG) && !defined(DISABLE_LASTLOG) */
 	struct utmp u;
 #if defined(HAVE_UTMPX_H) && defined(USE_UTMPX)
@@ -163,28 +157,35 @@ record_login(pid_t pid, const char *ttyname, const char *user, uid_t uid,
 	/* Construct an utmp/wtmp entry. */
 	memset(&u, 0, sizeof(u));
 	strncpy(u.ut_line, ttyname + 5, sizeof(u.ut_line));
+	
 #if defined(HAVE_ID_IN_UTMP)
-#ifdef _AIX
+# ifdef _AIX
 	strncpy(u.ut_id, ttyname + 5, sizeof(u.ut_id));
-#else /* !AIX */
+# else /* !AIX */
 	strncpy(u.ut_id, ttyname + 8, sizeof(u.ut_id));
-#endif
+# endif
 #endif /* defined(HAVE_ID_IN_UTMP) */ 
+
 	strncpy(u.ut_name, user, sizeof(u.ut_name));
+	
 #if defined(HAVE_TV_IN_UTMP)
 	(void)gettimeofday(&u.ut_tv, NULL);
 #else /* defined(HAVE_TV_IN_UTMP) */
 	u.ut_time = time(NULL);
 #endif /* defined(HAVE_TV_IN_UTMP) */
+
 #if defined(HAVE_PID_IN_UTMP)
 	u.ut_pid = (pid_t)pid;
 #endif /* HAVE_PID_IN_UTMP */
+
 #if defined(HAVE_TYPE_IN_UTMP)
  	u.ut_type = (uid == -1)?DEAD_PROCESS:USER_PROCESS;
 #endif /* HAVE_TYPE_IN_UTMP */
+
 #if defined(HAVE_HOST_IN_UTMP)
 	strncpy(u.ut_host, host, sizeof(u.ut_host));
 #endif
+
 #if defined(HAVE_ADDR_IN_UTMP)
 	if (addr) {
 		switch (addr->sa_family) {
@@ -193,36 +194,43 @@ record_login(pid_t pid, const char *ttyname, const char *user, uid_t uid,
 				memcpy(&(u.ut_addr), &(in->sin_addr), sizeof(&(in->sin_addr)));
 				break;
 			}
-#if defined(HAVE_ADDR_V6_IN_UTMP)
+# if defined(HAVE_ADDR_V6_IN_UTMP)
 			case AF_INET6: {
 				struct sockaddr_in6 *in6 = (struct sockaddr_in6*)addr;
 				memcpy(u.ut_addr_v6, &(in6->sin6_addr), sizeof(&(in6->sin6_addr)));
 				break;
 			}
-#endif
+# endif /* defined(HAVE_ADDR_V6_IN_UTMP) */
 			default:
 				break;
 		}
 	}
-#endif
+#endif /* defined(HAVE_ADDR_IN_UTMP) */
 
 #if defined(HAVE_UTMPX_H) && defined(USE_UTMPX)
 	memset(&utx, 0, sizeof(utx));
+
 	strncpy(utx.ut_user, user, sizeof(utx.ut_name));
 	strncpy(utx.ut_line, ttyname + 5, sizeof(utx.ut_line));
 	strncpy(utx.ut_id, ttyname + 8, sizeof(utx.ut_id));
+
 	utx.ut_pid = (pid_t)pid;
 	(void)gettimeofday(&utx.ut_tv, NULL);
+	
  	utx.ut_type = (uid == -1)?DEAD_PROCESS:USER_PROCESS;
 # ifdef HAVE_HOST_IN_UTMPX
 #  ifdef HAVE_SYSLEN_IN_UTMPX
 	utx.ut_syslen = strlen(host);
+	if (utx.ut_syslen + 1 > sizeof(utx.ut_host))
+		utx.ut_syslen = sizeof(utx.ut_host);
 	strncpy(utx.ut_host, host, utx.ut_syslen);
 #  else
 	strncpy(utx.ut_host, host, sizeof(utx.ut_host));
 #  endif /* HAVE_SYSLEN_IN_UTMPX */
+	utx.ut_host[sizeof(utx.ut_host)-1] = '\0';
 # endif
-#if defined(HAVE_ADDR_IN_UTMPX)
+
+# if defined(HAVE_ADDR_IN_UTMPX)
 	if (addr) {
 		switch (addr->sa_family) {
 			case AF_INET: {
@@ -230,31 +238,27 @@ record_login(pid_t pid, const char *ttyname, const char *user, uid_t uid,
 				memcpy(&(utx.ut_addr), &(in->sin_addr), sizeof(&(in->sin_addr)));
 				break;
 			}
-#if defined(HAVE_ADDR_V6_IN_UTMPX)
+#  if defined(HAVE_ADDR_V6_IN_UTMPX)
 			case AF_INET6: {
 				struct sockaddr_in6 *in6 = (struct sockaddr_in6*)addr;
 				memcpy(utx.ut_addr_v6, &(in6->sin6_addr), sizeof(&(in6->sin6_addr)));
 				break;
 			}
-#endif
+#  endif /* defined(HAVE_ADDR_V6_IN_UTMPX) */
 			default:
 				break;
 		}
 	}
-#endif
+# endif /* defined(HAVE_ADDR_IN_UTMPX) */
 #endif /* defined(HAVE_UTMPX_H) && defined(USE_UTMPX) */
 
-/*#if defined(HAVE_UTMPX_H) && defined(USE_UTMPX) && !defined(HAVE_LOGIN)*/
 #if defined(HAVE_UTMPX_H) && defined(USE_UTMPX)
-	login(&u, &utx);
+	login(&utx);
 #else /* defined(HAVE_UTMPX_H) && defined(USE_UTMPX) */
 	login(&u);
 #endif /* defined(HAVE_UTMPX_H) && defined(USE_UTMPX) */
 
-#if defined(_PATH_LASTLOG) && !defined(DISABLE_LASTLOG) && !defined(WITH_AIXAUTHENTICATE)
-	/* AIX does this in do_authentication */
-	lastlog = _PATH_LASTLOG;
-
+#if defined(_PATH_LASTLOG) && !defined(DISABLE_LASTLOG)
 	/* Update lastlog unless actually recording a logout. */
 	if (strcmp(user, "") != 0) {
 		int fd;
@@ -268,21 +272,25 @@ record_login(pid_t pid, const char *ttyname, const char *user, uid_t uid,
 		ll.ll_time = time(NULL);
 		strncpy(ll.ll_line, ttyname + 5, sizeof(ll.ll_line));
 		strncpy(ll.ll_host, host, sizeof(ll.ll_host));
-#ifdef LASTLOG_IS_DIR
-		snprintf(buf, sizeof(buf), "%s/%s", lastlog, user);
-		fd = open(buf, O_RDWR);
-		if (fd >= 0) {
-#else /* LASTLOG_IS_DIR */
-		fd = open(lastlog, O_RDWR);
-		if (fd >= 0) {
-			lseek(fd, (off_t) ((long) uid * sizeof(ll)), SEEK_SET);
-#endif /* LASTLOG_IS_DIR */
+# ifdef LASTLOG_IS_DIR
+		snprintf(buf, sizeof(buf), "%s/%s", _PATH_LASTLOG, user);
+		if ((fd = open(buf, O_RDWR)) >= 0) {
 			if (write(fd, &ll, sizeof(ll)) != sizeof(ll))
-				log("Could not write %.100s: %.100s", lastlog, strerror(errno));
+				log("Could not write %.100s: %.100s", buf, strerror(errno));
 			close(fd);
 		}
+# else /* LASTLOG_IS_DIR */
+		if ((fd = open(_PATH_LASTLOG, O_RDWR)) >= 0) {
+			lseek(fd, (off_t) ((long) uid * sizeof(ll)), SEEK_SET);
+			if (write(fd, &ll, sizeof(ll)) != sizeof(ll)) {
+				log("Could not write %.100s: %.100s", _PATH_LASTLOG, 
+					strerror(errno));
+			}
+			close(fd);
+		}
+# endif /* LASTLOG_IS_DIR */
 	}
-#endif /* defined(_PATH_LASTLOG) && !defined(DISABLE_LASTLOG) && !defined(WITH_AIXAUTHENTICATE) */
+#endif /* defined(_PATH_LASTLOG) && !defined(DISABLE_LASTLOG) */
 }
 
 /* Records that the user has logged out. */

myproposal.h

@@ -6,7 +6,7 @@
 #define	KEX_DEFAULT_LANG	""
 
 
-static const char *myproposal[PROPOSAL_MAX] = {
+static char *myproposal[PROPOSAL_MAX] = {
 	KEX_DEFAULT_KEX,
 	KEX_DEFAULT_PK_ALG,
 	KEX_DEFAULT_ENCRYPT,

readconf.c

@@ -14,7 +14,7 @@
  */
 
 #include "includes.h"
-RCSID("$Id: readconf.c,v 1.14 2000/05/09 01:03:01 damien Exp $");
+RCSID("$Id: readconf.c,v 1.15 2000/05/30 03:44:53 damien Exp $");
 
 #include "ssh.h"
 #include "cipher.h"
@@ -464,6 +464,8 @@ parse_int:
 	case oCipher:
 		intptr = &options->cipher;
 		cp = strtok(NULL, WHITESPACE);
+		if (!cp)
+			fatal("%.200s line %d: Missing argument.", filename, linenum);
 		value = cipher_number(cp);
 		if (value == -1)
 			fatal("%.200s line %d: Bad cipher '%s'.",
@@ -474,6 +476,8 @@ parse_int:
 
 	case oCiphers:
 		cp = strtok(NULL, WHITESPACE);
+		if (!cp)
+			fatal("%.200s line %d: Missing argument.", filename, linenum);
 		if (!ciphers_valid(cp))
 			fatal("%.200s line %d: Bad SSH2 cipher spec '%s'.",
 			      filename, linenum, cp ? cp : "<NONE>");
@@ -484,6 +488,8 @@ parse_int:
 	case oProtocol:
 		intptr = &options->protocol;
 		cp = strtok(NULL, WHITESPACE);
+		if (!cp)
+			fatal("%.200s line %d: Missing argument.", filename, linenum);
 		value = proto_spec(cp);
 		if (value == SSH_PROTO_UNKNOWN)
 			fatal("%.200s line %d: Bad protocol spec '%s'.",
@@ -691,7 +697,7 @@ void
 fill_default_options(Options * options)
 {
 	if (options->forward_agent == -1)
-		options->forward_agent = 1;
+		options->forward_agent = 0;
 	if (options->forward_x11 == -1)
 		options->forward_x11 = 0;
 	if (options->gateway_ports == -1)

servconf.c

@@ -12,7 +12,7 @@
  */
 
 #include "includes.h"
-RCSID("$Id: servconf.c,v 1.16 2000/05/09 01:03:01 damien Exp $");
+RCSID("$Id: servconf.c,v 1.17 2000/05/30 03:44:53 damien Exp $");
 
 #include "ssh.h"
 #include "servconf.h"
@@ -588,6 +588,8 @@ parse_flag:
 
 		case sCiphers:
 			cp = strtok(NULL, WHITESPACE);
+			if (!cp)
+				fatal("%s line %d: Missing argument.", filename, linenum);
 			if (!ciphers_valid(cp))
 				fatal("%s line %d: Bad SSH2 cipher spec '%s'.",
 				    filename, linenum, cp ? cp : "<NONE>");
@@ -598,6 +600,8 @@ parse_flag:
 		case sProtocol:
 			intptr = &options->protocol;
 			cp = strtok(NULL, WHITESPACE);
+			if (!cp)
+				fatal("%s line %d: Missing argument.", filename, linenum);
 			value = proto_spec(cp);
 			if (value == SSH_PROTO_UNKNOWN)
 				fatal("%s line %d: Bad protocol spec '%s'.",

serverloop.c

@@ -164,33 +164,37 @@ retry_select:
 
 	/* Initialize select() masks. */
 	FD_ZERO(readset);
+	FD_ZERO(writeset);
 
-	/*
-	 * Read packets from the client unless we have too much buffered
-	 * stdin or channel data.
-	 */
 	if (compat20) {
 		/* wrong: bad condition XXX */
 		if (channel_not_very_much_buffered_data())
 			FD_SET(connection_in, readset);
 	} else {
-		if (buffer_len(&stdin_buffer) < 4096 &&
+		/*
+		 * Read packets from the client unless we have too much
+		 * buffered stdin or channel data.
+		 */
+		if (buffer_len(&stdin_buffer) < buffer_high &&
 		    channel_not_very_much_buffered_data())
 			FD_SET(connection_in, readset);
+		/*
+		 * If there is not too much data already buffered going to
+		 * the client, try to get some more data from the program.
+		 */
+		if (packet_not_very_much_data_to_write()) {
+			if (!fdout_eof)
+				FD_SET(fdout, readset);
+			if (!fderr_eof)
+				FD_SET(fderr, readset);
+		}
+		/*
+		 * If we have buffered data, try to write some of that data
+		 * to the program.
+		 */
+		if (fdin != -1 && buffer_len(&stdin_buffer) > 0)
+			FD_SET(fdin, writeset);
 	}
-
-	/*
-	 * If there is not too much data already buffered going to the
-	 * client, try to get some more data from the program.
-	 */
-	if (!compat20 && packet_not_very_much_data_to_write()) {
-		if (!fdout_eof)
-			FD_SET(fdout, readset);
-		if (!fderr_eof)
-			FD_SET(fderr, readset);
-	}
-	FD_ZERO(writeset);
-
 	/* Set masks for channel descriptors. */
 	channel_prepare_select(readset, writeset);
 
@@ -201,11 +205,6 @@ retry_select:
 	if (packet_have_data_to_write())
 		FD_SET(connection_out, writeset);
 
-	/* If we have buffered data, try to write some of that data to the
-	   program. */
-	if (!compat20 && fdin != -1 && buffer_len(&stdin_buffer) > 0)
-		FD_SET(fdin, writeset);
-
 	/* Update the maximum descriptor number if appropriate. */
 	if (channel_max_fd() > max_fd)
 		max_fd = channel_max_fd();
@@ -377,6 +376,7 @@ process_buffered_input_packets()
 void
 server_loop(pid_t pid, int fdin_arg, int fdout_arg, int fderr_arg)
 {
+	fd_set readset, writeset;
 	int wait_status;	/* Status returned by wait(). */
 	pid_t wait_pid;		/* pid returned by wait(). */
 	int waiting_termination = 0;	/* Have displayed waiting close message. */
@@ -445,7 +445,6 @@ server_loop(pid_t pid, int fdin_arg, int fdout_arg, int fderr_arg)
 
 	/* Main loop of the server for the interactive session mode. */
 	for (;;) {
-		fd_set readset, writeset;
 
 		/* Process buffered packets from the client. */
 		process_buffered_input_packets();
@@ -717,6 +716,9 @@ input_direct_tcpip(void)
 	originator = packet_get_string(NULL);
 	originator_port = packet_get_int();
 	packet_done();
+
+	debug("open direct-tcpip: from %s port %d to %s port %d",
+	   originator, originator_port, target, target_port);
 	/* XXX check permission */
 	sock = channel_connect_to(target, target_port);
 	xfree(target);
@@ -768,7 +770,6 @@ server_input_channel_open(int type, int plen)
 			channel_free(id);
 		}
 	} else if (strcmp(ctype, "direct-tcpip") == 0) {
-		debug("open direct-tcpip");
 		id = input_direct_tcpip();
 		if (id >= 0)
 			c = channel_lookup(id);

session.c

@@ -8,7 +8,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: session.c,v 1.12 2000/05/03 18:03:07 markus Exp $");
+RCSID("$OpenBSD: session.c,v 1.14 2000/05/25 03:10:18 deraadt Exp $");
 
 #include "xmalloc.h"
 #include "ssh.h"
@@ -645,7 +645,8 @@ do_exec_pty(Session *s, const char *command, struct passwd * pw)
 		}
 #endif
 		/* Do common processing for the child, such as execing the command. */
-		do_child(command, pw, s->term, s->display, s->auth_proto, s->auth_data, s->tty);
+		do_child(command, pw, s->term, s->display, s->auth_proto,
+		    s->auth_data, s->tty);
 		/* NOTREACHED */
 	}
 	if (pid < 0)
@@ -749,7 +750,10 @@ read_environment_file(char ***env, unsigned int *envsize,
 			fprintf(stderr, "Bad line in %.100s: %.200s\n", filename, buf);
 			continue;
 		}
-		/* Replace the equals sign by nul, and advance value to the value string. */
+		/*
+		 * Replace the equals sign by nul, and advance value to
+		 * the value string.
+		 */
 		*value = '\0';
 		value++;
 		child_set_env(env, envsize, cp, value);
@@ -948,7 +952,8 @@ do_child(const char *command, struct passwd * pw, const char *term,
 
 	/* read $HOME/.ssh/environment. */
 	if (!options.use_login) {
-		snprintf(buf, sizeof buf, "%.200s/.ssh/environment", pw->pw_dir);
+		snprintf(buf, sizeof buf, "%.200s/.ssh/environment",
+		    pw->pw_dir);
 		read_environment_file(&env, &envsize, buf);
 	}
 	if (debug_flag) {
@@ -1037,21 +1042,27 @@ do_child(const char *command, struct passwd * pw, const char *term,
 			if (auth_proto != NULL && auth_data != NULL) {
 				char *screen = strchr(display, ':');
 				if (debug_flag) {
-					fprintf(stderr, "Running %.100s add %.100s %.100s %.100s\n",
+					fprintf(stderr,
+					    "Running %.100s add %.100s %.100s %.100s\n",
 					    XAUTH_PATH, display, auth_proto, auth_data);
 					if (screen != NULL)
-						fprintf(stderr, "Adding %.*s/unix%s %s %s\n",
-						    screen-display, display, screen, auth_proto, auth_data);
+						fprintf(stderr,
+						    "Adding %.*s/unix%s %s %s\n",
+						    screen-display, display,
+						    screen, auth_proto, auth_data);
 				}
 				f = popen(XAUTH_PATH " -q -", "w");
 				if (f) {
-					fprintf(f, "add %s %s %s\n", display, auth_proto, auth_data);
+					fprintf(f, "add %s %s %s\n", display,
+					    auth_proto, auth_data);
 					if (screen != NULL) 
 						fprintf(f, "add %.*s/unix%s %s %s\n",
-						     screen-display, display, screen, auth_proto, auth_data);
+						    screen-display, display,
+						    screen, auth_proto, auth_data);
 					pclose(f);
 				} else
-					fprintf(stderr, "Could not run %s -q -\n", XAUTH_PATH);
+					fprintf(stderr, "Could not run %s -q -\n",
+					    XAUTH_PATH);
 			}
 		}
 #endif /* XAUTH_PATH */
@@ -1081,7 +1092,8 @@ do_child(const char *command, struct passwd * pw, const char *term,
 				struct stat mailstat;
 				mailbox = getenv("MAIL");
 				if (mailbox != NULL) {
-					if (stat(mailbox, &mailstat) != 0 || mailstat.st_size == 0)
+					if (stat(mailbox, &mailstat) != 0 ||
+					    mailstat.st_size == 0)
 						printf("No mail.\n");
 					else if (mailstat.st_mtime < mailstat.st_atime)
 						printf("You have mail.\n");

ssh.1

@@ -9,7 +9,7 @@
 .\"
 .\" Created: Sat Apr 22 21:55:14 1995 ylo
 .\"
-.\" $Id: ssh.1,v 1.26 2000/05/17 12:34:24 damien Exp $
+.\" $Id: ssh.1,v 1.27 2000/05/30 03:44:54 damien Exp $
 .\"
 .Dd September 25, 1999
 .Dt SSH 1
@@ -24,7 +24,7 @@
 .Op Ar command
 .Pp
 .Nm ssh
-.Op Fl afgknqtvxCNPTX246
+.Op Fl afgknqtvxACNPTX246
 .Op Fl c Ar cipher_spec
 .Op Fl e Ar escape_char
 .Op Fl i Ar identity_file
@@ -332,7 +332,9 @@ host key is not known or has changed.
 .Bl -tag -width Ds
 .It Fl a
 Disables forwarding of the authentication agent connection.
-This may also be specified on a per-host basis in the configuration file.
+.It Fl A
+Enables forwarding of the authentication agent connection.
+This can also be specified on a per-host basis in a configuration file.
 .It Fl c Ar blowfish|3des
 Selects the cipher to use for encrypting the session.
 .Ar 3des
@@ -460,9 +462,9 @@ The verbose mode is also used to display
 challenges, if the user entered "s/key" as password.
 .It Fl x
 Disables X11 forwarding.
-This can also be specified on a per-host basis in a configuration file.
 .It Fl X
 Enables X11 forwarding.
+This can also be specified on a per-host basis in a configuration file.
 .It Fl C
 Requests compression of all data (including stdin, stdout, stderr, and
 data for forwarded X11 and TCP/IP connections).
@@ -671,6 +673,8 @@ The argument must be
 .Dq yes
 or
 .Dq no .
+The default is
+.Dq no .
 .It Cm ForwardX11
 Specifies whether X11 connections will be automatically redirected
 over the secure channel and

ssh.c

@@ -11,7 +11,7 @@
  */
 
 #include "includes.h"
-RCSID("$Id: ssh.c,v 1.32 2000/05/20 05:22:37 damien Exp $");
+RCSID("$Id: ssh.c,v 1.33 2000/05/30 03:44:54 damien Exp $");
 
 #include <openssl/evp.h>
 #include <openssl/dsa.h>
@@ -116,6 +116,7 @@ usage()
 	fprintf(stderr, "Options:\n");
 	fprintf(stderr, "  -l user     Log in using this user name.\n");
 	fprintf(stderr, "  -n          Redirect input from /dev/null.\n");
+	fprintf(stderr, "  -A          Enable authentication agent forwarding.\n");
 	fprintf(stderr, "  -a          Disable authentication agent forwarding.\n");
 #ifdef AFS
 	fprintf(stderr, "  -k          Disable Kerberos ticket and AFS token forwarding.\n");
@@ -315,6 +316,9 @@ main(int ac, char **av)
 		case 'a':
 			options.forward_agent = 0;
 			break;
+		case 'A':
+			options.forward_agent = 1;
+			break;
 #ifdef AFS
 		case 'k':
 			options.kerberos_tgt_passing = 0;

sshconnect2.c

@@ -28,7 +28,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: sshconnect2.c,v 1.10 2000/05/08 17:42:25 markus Exp $");
+RCSID("$OpenBSD: sshconnect2.c,v 1.11 2000/05/25 20:45:20 markus Exp $");
 
 #include <openssl/bn.h>
 #include <openssl/rsa.h>
@@ -68,16 +68,12 @@ unsigned char *session_id2 = NULL;
 int session_id2_len = 0;
 
 void
-ssh_kex2(char *host, struct sockaddr *hostaddr)
+ssh_kex_dh(Kex *kex, char *host, struct sockaddr *hostaddr,
+    Buffer *client_kexinit, Buffer *server_kexinit)
 {
-	Kex *kex;
-	char *cprop[PROPOSAL_MAX];
-	char *sprop[PROPOSAL_MAX];
-	Buffer *client_kexinit;
-	Buffer *server_kexinit;
-	int payload_len, dlen;
+	int i;
+	int plen, dlen;
 	unsigned int klen, kout;
-	char *ptr;
 	char *signature = NULL;
 	unsigned int slen;
 	char *server_host_key_blob = NULL;
@@ -86,72 +82,10 @@ ssh_kex2(char *host, struct sockaddr *hostaddr)
 	DH *dh;
 	BIGNUM *dh_server_pub = 0;
 	BIGNUM *shared_secret = 0;
-	int i;
 	unsigned char *kbuf;
 	unsigned char *hash;
 
-/* KEXINIT */
-
-	debug("Sending KEX init.");
-	if (options.ciphers != NULL) {
-		myproposal[PROPOSAL_ENC_ALGS_CTOS] =
-		myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
-	} else if (options.cipher == SSH_CIPHER_3DES) {
-		myproposal[PROPOSAL_ENC_ALGS_CTOS] =
-		myproposal[PROPOSAL_ENC_ALGS_STOC] =
-		    cipher_name(SSH_CIPHER_3DES_CBC);
-	} else if (options.cipher == SSH_CIPHER_BLOWFISH) {
-		myproposal[PROPOSAL_ENC_ALGS_CTOS] =
-		myproposal[PROPOSAL_ENC_ALGS_STOC] =
-		    cipher_name(SSH_CIPHER_BLOWFISH_CBC);
-	}
-	if (options.compression) {
-		myproposal[PROPOSAL_COMP_ALGS_CTOS] = "zlib";
-		myproposal[PROPOSAL_COMP_ALGS_STOC] = "zlib";
-	} else {
-		myproposal[PROPOSAL_COMP_ALGS_CTOS] = "none";
-		myproposal[PROPOSAL_COMP_ALGS_STOC] = "none";
-	}
-	for (i = 0; i < PROPOSAL_MAX; i++)
-		cprop[i] = xstrdup(myproposal[i]);
-
-	client_kexinit = kex_init(cprop);
-	packet_start(SSH2_MSG_KEXINIT);
-	packet_put_raw(buffer_ptr(client_kexinit), buffer_len(client_kexinit));	
-	packet_send();
-	packet_write_wait();
-
-	debug("done");
-
-	packet_read_expect(&payload_len, SSH2_MSG_KEXINIT);
-
-	/* save payload for session_id */
-	server_kexinit = xmalloc(sizeof(*server_kexinit));
-	buffer_init(server_kexinit);
-	ptr = packet_get_raw(&payload_len);
-	buffer_append(server_kexinit, ptr, payload_len);
-
-	/* skip cookie */
-	for (i = 0; i < 16; i++)
-		(void) packet_get_char();
-	/* kex init proposal strings */
-	for (i = 0; i < PROPOSAL_MAX; i++) {
-		sprop[i] = packet_get_string(NULL);
-		debug("got kexinit string: %s", sprop[i]);
-	}
-	i = (int) packet_get_char();
-	debug("first kex follow == %d", i);
-	i = packet_get_int();
-	debug("reserved == %d", i);
-	packet_done();
-
-	debug("done read kexinit");
-	kex = kex_choose_conf(cprop, sprop, 0);
-
-/* KEXDH */
-
 	debug("Sending SSH2_MSG_KEXDH_INIT.");
-
 	/* generate and send 'e', client DH public key */
 	dh = dh_new_group1();
 	packet_start(SSH2_MSG_KEXDH_INIT);
@@ -172,7 +106,7 @@ ssh_kex2(char *host, struct sockaddr *hostaddr)
 
 	debug("Wait SSH2_MSG_KEXDH_REPLY.");
 
-	packet_read_expect(&payload_len, SSH2_MSG_KEXDH_REPLY);
+	packet_read_expect(&plen, SSH2_MSG_KEXDH_REPLY);
 
 	debug("Got SSH2_MSG_KEXDH_REPLY.");
 
@@ -233,10 +167,7 @@ ssh_kex2(char *host, struct sockaddr *hostaddr)
 	    shared_secret
 	);
 	xfree(server_host_key_blob);
-	buffer_free(client_kexinit);
-	buffer_free(server_kexinit);
-	xfree(client_kexinit);
-	xfree(server_kexinit);
+	DH_free(dh);
 #ifdef DEBUG_KEXDH
 	fprintf(stderr, "hash == ");
 	for (i = 0; i< 20; i++)
@@ -250,16 +181,61 @@ ssh_kex2(char *host, struct sockaddr *hostaddr)
 	kex_derive_keys(kex, hash, shared_secret);
 	packet_set_kex(kex);
 
-	/* have keys, free DH */
-	DH_free(dh);
-
 	/* save session id */
 	session_id2_len = 20;
 	session_id2 = xmalloc(session_id2_len);
 	memcpy(session_id2, hash, session_id2_len);
+}
+
+void
+ssh_kex2(char *host, struct sockaddr *hostaddr)
+{
+	int i, plen;
+	Kex *kex;
+	Buffer *client_kexinit, *server_kexinit;
+	char *sprop[PROPOSAL_MAX];
+
+	if (options.ciphers != NULL) {
+		myproposal[PROPOSAL_ENC_ALGS_CTOS] =
+		myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
+	} else if (options.cipher == SSH_CIPHER_3DES) {
+		myproposal[PROPOSAL_ENC_ALGS_CTOS] =
+		myproposal[PROPOSAL_ENC_ALGS_STOC] =
+		    (char *) cipher_name(SSH_CIPHER_3DES_CBC);
+	} else if (options.cipher == SSH_CIPHER_BLOWFISH) {
+		myproposal[PROPOSAL_ENC_ALGS_CTOS] =
+		myproposal[PROPOSAL_ENC_ALGS_STOC] =
+		    (char *) cipher_name(SSH_CIPHER_BLOWFISH_CBC);
+	}
+	if (options.compression) {
+		myproposal[PROPOSAL_COMP_ALGS_CTOS] = "zlib";
+		myproposal[PROPOSAL_COMP_ALGS_STOC] = "zlib";
+	} else {
+		myproposal[PROPOSAL_COMP_ALGS_CTOS] = "none";
+		myproposal[PROPOSAL_COMP_ALGS_STOC] = "none";
+	}
+
+	/* buffers with raw kexinit messages */
+	server_kexinit = xmalloc(sizeof(*server_kexinit));
+	buffer_init(server_kexinit);
+	client_kexinit = kex_init(myproposal);
+
+	/* algorithm negotiation */
+	kex_exchange_kexinit(client_kexinit, server_kexinit, sprop);
+	kex = kex_choose_conf(myproposal, sprop, 0);
+	for (i = 0; i < PROPOSAL_MAX; i++)
+		xfree(sprop[i]);
+
+	/* server authentication and session key agreement */
+	ssh_kex_dh(kex, host, hostaddr, client_kexinit, server_kexinit);
+
+	buffer_free(client_kexinit);
+	buffer_free(server_kexinit);
+	xfree(client_kexinit);
+	xfree(server_kexinit);
 
 	debug("Wait SSH2_MSG_NEWKEYS.");
-	packet_read_expect(&payload_len, SSH2_MSG_NEWKEYS);
+	packet_read_expect(&plen, SSH2_MSG_NEWKEYS);
 	packet_done();
 	debug("GOT SSH2_MSG_NEWKEYS.");
 
@@ -278,6 +254,7 @@ ssh_kex2(char *host, struct sockaddr *hostaddr)
 #endif
 	debug("done: KEX2.");
 }
+
 /*
  * Authenticate user
  */

sshd.c

@@ -14,7 +14,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: sshd.c,v 1.117 2000/05/18 13:27:36 djm Exp $");
+RCSID("$OpenBSD: sshd.c,v 1.118 2000/05/25 20:45:20 markus Exp $");
 
 #include "xmalloc.h"
 #include "rsa.h"
@@ -1159,7 +1159,6 @@ do_ssh2_kex()
 	int payload_len, dlen;
 	int slen;
 	unsigned int klen, kout;
-	char *ptr;
 	unsigned char *signature = NULL;
 	unsigned char *server_host_key_blob = NULL;
 	unsigned int sbloblen;
@@ -1171,7 +1170,6 @@ do_ssh2_kex()
 	unsigned char *hash;
 	Kex *kex;
 	char *cprop[PROPOSAL_MAX];
-	char *sprop[PROPOSAL_MAX];
 
 /* KEXINIT */
 
@@ -1179,46 +1177,15 @@ do_ssh2_kex()
 		myproposal[PROPOSAL_ENC_ALGS_CTOS] =
 		myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
 	}
-
-	debug("Sending KEX init.");
-
-	for (i = 0; i < PROPOSAL_MAX; i++)
-		sprop[i] = xstrdup(myproposal[i]);
-	server_kexinit = kex_init(sprop);
-	packet_start(SSH2_MSG_KEXINIT);
-	packet_put_raw(buffer_ptr(server_kexinit), buffer_len(server_kexinit));	
-	packet_send();
-	packet_write_wait();
-
-	debug("done");
-
-	packet_read_expect(&payload_len, SSH2_MSG_KEXINIT);
-
-	/*
-	 * save raw KEXINIT payload in buffer. this is used during
-	 * computation of the session_id and the session keys.
-	 */
+	server_kexinit = kex_init(myproposal);
 	client_kexinit = xmalloc(sizeof(*client_kexinit));
 	buffer_init(client_kexinit);
-	ptr = packet_get_raw(&payload_len);
-	buffer_append(client_kexinit, ptr, payload_len);
 
-	/* skip cookie */
-	for (i = 0; i < 16; i++)
-		(void) packet_get_char();
-	/* save kex init proposal strings */
-	for (i = 0; i < PROPOSAL_MAX; i++) {
-		cprop[i] = packet_get_string(NULL);
-		debug("got kexinit string: %s", cprop[i]);
-	}
-
-	i = (int) packet_get_char();
-	debug("first kex follow == %d", i);
-	i = packet_get_int();
-	debug("reserved == %d", i);
-
-	debug("done read kexinit");
-	kex = kex_choose_conf(cprop, sprop, 1);
+	/* algorithm negotiation */
+	kex_exchange_kexinit(server_kexinit, client_kexinit, cprop);
+	kex = kex_choose_conf(cprop, myproposal, 1);
+	for (i = 0; i < PROPOSAL_MAX; i++)
+		xfree(cprop[i]);
 
 /* KEXDH */