- (dtucker) [openbsd-compat/fake-rfc2553.h] Bug #812: #undef getaddrinfo

before redefining it, silences warnings on Tru64.

ChangeLog

@@ -1,3 +1,31 @@
+20040310
+ - (dtucker) [openbsd-compat/fake-rfc2553.h] Bug #812: #undef getaddrinfo
+   before redefining it, silences warnings on Tru64.
+
+20040308
+ - (dtucker) [sshd.c] Back out rev 1.270 as it caused problems on some
+   platforms (eg SCO, HP-UX) with logging in the wrong TZ.  ok djm@
+ - (dtucker) [configure.ac sshd.c openbsd-compat/bsd-misc.h
+   openbsd-compat/setenv.c] Unset KRB5CCNAME on AIX to prevent it from being
+   inherited by the child.  ok djm@
+ - (dtucker) [auth-pam.c auth-pam.h auth1.c auth2.c monitor.c monitor_wrap.c
+   monitor_wrap.h] Bug #808: Ensure force_pwchange is correctly initialized
+   even if keyboard-interactive is not used by the client.  Prevents segfaults
+   in some cases where the user's password is expired (note this is not
+   considered a security exposure).  ok djm@
+
+20040304
+ - (dtucker) [auth-pam.c] Don't try to export PAM when compiled with
+   -DUSE_POSIX_THREADS.  From antoine.verheijen at ualbert ca.  ok djm@
+ - (dtucker) [auth-pam.c] Reset signal status when starting pam auth thread,
+   prevent hanging during PAM keyboard-interactive authentications.  ok djm@
+ - (dtucker) [auth-passwd.c auth-sia.c auth-sia.h defines.h
+   openbsd-compat/xcrypt.c] Bug #802: Fix build error on Tru64 when
+   configured --with-osfsia.  ok djm@
+
+20040229
+ - (tim) [configure.ac] Put back bits mistakenly removed from Rev 1.188
+
 20040224
  - (dtucker) OpenBSD CVS Sync
    - [email protected] 2004/02/19 21:15:04
@@ -1929,4 +1957,4 @@
  - Fix sshd BindAddress and -b options for systems using fake-getaddrinfo.
    Report from [email protected], diagnosis from [email protected]
 
-$Id: ChangeLog,v 1.3257 2004/02/24 06:13:28 djm Exp $
+$Id: ChangeLog,v 1.3257.2.8 2004/03/10 10:05:42 dtucker Exp $

auth-pam.c

@@ -31,7 +31,7 @@
 
 /* Based on $FreeBSD: src/crypto/openssh/auth2-pam-freebsd.c,v 1.11 2003/03/31 13:48:18 des Exp $ */
 #include "includes.h"
-RCSID("$Id: auth-pam.c,v 1.95 2004/02/17 12:20:08 dtucker Exp $");
+RCSID("$Id: auth-pam.c,v 1.95.2.3 2004/03/08 12:02:13 dtucker Exp $");
 
 #ifdef USE_PAM
 #if defined(HAVE_SECURITY_PAM_APPL_H)
@@ -117,6 +117,7 @@ pthread_create(sp_pthread_t *thread, const void *attr __unused,
 {
 	pid_t pid;
 
+	sshpam_thread_status = -1;
 	switch ((pid = fork())) {
 	case -1:
 		error("fork(): %s", strerror(errno));
@@ -159,7 +160,7 @@ static int sshpam_session_open = 0;
 static int sshpam_cred_established = 0;
 static int sshpam_account_status = -1;
 static char **sshpam_env = NULL;
-static int *force_pwchange;
+static Authctxt *the_authctxt = NULL;
 
 /* Some PAM implementations don't implement this */
 #ifndef HAVE_PAM_GETENVLIST
@@ -179,7 +180,9 @@ void
 pam_password_change_required(int reqd)
 {
 	debug3("%s %d", __func__, reqd);
-	*force_pwchange = reqd;
+	if (the_authctxt == NULL)
+		fatal("%s: PAM authctxt not initialized", __func__);
+	the_authctxt->force_pwchange = reqd;
 	if (reqd) {
 		no_port_forwarding_flag |= 2;
 		no_agent_forwarding_flag |= 2;
@@ -201,6 +204,7 @@ import_environments(Buffer *b)
 
 	debug3("PAM: %s entering", __func__);
 
+#ifndef USE_POSIX_THREADS
 	/* Import variables set by do_pam_account */
 	sshpam_account_status = buffer_get_int(b);
 	pam_password_change_required(buffer_get_int(b));
@@ -228,6 +232,7 @@ import_environments(Buffer *b)
 		}
 #endif
 	}
+#endif
 }
 
 /*
@@ -336,6 +341,9 @@ sshpam_thread(void *ctxtp)
 	sshpam_conv.conv = sshpam_thread_conv;
 	sshpam_conv.appdata_ptr = ctxt;
 
+	if (the_authctxt == NULL)
+		fatal("%s: PAM authctxt not initialized", __func__);
+
 	buffer_init(&buffer);
 	sshpam_err = pam_set_item(sshpam_handle, PAM_CONV,
 	    (const void *)&sshpam_conv);
@@ -348,7 +356,7 @@ sshpam_thread(void *ctxtp)
 	if (compat20) {
 		if (!do_pam_account())
 			goto auth_fail;
-		if (*force_pwchange) {
+		if (the_authctxt->force_pwchange) {
 			sshpam_err = pam_chauthtok(sshpam_handle,
 			    PAM_CHANGE_EXPIRED_AUTHTOK);
 			if (sshpam_err != PAM_SUCCESS)
@@ -362,7 +370,7 @@ sshpam_thread(void *ctxtp)
 #ifndef USE_POSIX_THREADS
 	/* Export variables set by do_pam_account */
 	buffer_put_int(&buffer, sshpam_account_status);
-	buffer_put_int(&buffer, *force_pwchange);
+	buffer_put_int(&buffer, the_authctxt->force_pwchange);
 
 	/* Export any environment strings set in child */
 	for(i = 0; environ[i] != NULL; i++)
@@ -443,11 +451,11 @@ sshpam_cleanup(void)
 }
 
 static int
-sshpam_init(const char *user)
+sshpam_init(Authctxt *authctxt)
 {
 	extern u_int utmp_len;
 	extern char *__progname;
-	const char *pam_rhost, *pam_user;
+	const char *pam_rhost, *pam_user, *user = authctxt->user;
 
 	if (sshpam_handle != NULL) {
 		/* We already have a PAM context; check if the user matches */
@@ -461,6 +469,8 @@ sshpam_init(const char *user)
 	debug("PAM: initializing for \"%s\"", user);
 	sshpam_err =
 	    pam_start(SSHD_PAM_SERVICE, user, &null_conv, &sshpam_handle);
+	the_authctxt = authctxt;
+
 	if (sshpam_err != PAM_SUCCESS) {
 		pam_end(sshpam_handle, sshpam_err);
 		sshpam_handle = NULL;
@@ -503,7 +513,7 @@ sshpam_init_ctx(Authctxt *authctxt)
 		return NULL;
 
 	/* Initialize PAM */
-	if (sshpam_init(authctxt->user) == -1) {
+	if (sshpam_init(authctxt) == -1) {
 		error("PAM: initialization failed");
 		return (NULL);
 	}
@@ -511,8 +521,6 @@ sshpam_init_ctx(Authctxt *authctxt)
 	ctxt = xmalloc(sizeof *ctxt);
 	memset(ctxt, 0, sizeof(*ctxt));
 
-	force_pwchange = &(authctxt->force_pwchange);
-
 	/* Start the authentication thread */
 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, socks) == -1) {
 		error("PAM: failed create sockets: %s", strerror(errno));
@@ -671,12 +679,12 @@ KbdintDevice mm_sshpam_device = {
  * This replaces auth-pam.c
  */
 void
-start_pam(const char *user)
+start_pam(Authctxt *authctxt)
 {
 	if (!options.use_pam)
 		fatal("PAM: initialisation requested when UsePAM=no");
 
-	if (sshpam_init(user) == -1)
+	if (sshpam_init(authctxt) == -1)
 		fatal("PAM: initialisation failed");
 }
 

auth-pam.h

@@ -1,4 +1,4 @@
-/* $Id: auth-pam.h,v 1.24 2004/02/10 02:23:29 dtucker Exp $ */
+/* $Id: auth-pam.h,v 1.24.2.1 2004/03/08 12:02:13 dtucker Exp $ */
 
 /*
  * Copyright (c) 2000 Damien Miller.  All rights reserved.
@@ -31,7 +31,7 @@
 # define SSHD_PAM_SERVICE		__progname
 #endif
 
-void start_pam(const char *);
+void start_pam(Authctxt *);
 void finish_pam(void);
 u_int do_pam_account(void);
 void do_pam_session(void);

auth-passwd.c

@@ -73,13 +73,6 @@ auth_password(Authctxt *authctxt, const char *password)
 	if (*password == '\0' && options.permit_empty_passwd == 0)
 		return 0;
 
-#if defined(HAVE_OSF_SIA)
-	/*
-	 * XXX: any reason this is before krb?  could be moved to
-	 * sys_auth_passwd()?  -dt
-	 */
-	return auth_sia_password(authctxt, password) && ok;
-#endif
 #ifdef KRB5
 	if (options.kerberos_authentication == 1) {
 		int ret = auth_krb5_password(authctxt, password);

auth-sia.c

@@ -47,7 +47,7 @@ extern int saved_argc;
 extern char **saved_argv;
 
 int
-auth_sia_password(Authctxt *authctxt, char *pass)
+sys_auth_passwd(Authctxt *authctxt, char *pass)
 {
 	int ret;
 	SIAENTITY *ent = NULL;

auth-sia.h

@@ -26,7 +26,7 @@
 
 #ifdef HAVE_OSF_SIA
 
-int	auth_sia_password(Authctxt *, char *);
+int	sys_auth_passwd(Authctxt *, char *);
 void	session_setup_sia(struct passwd *, char *);
 
 #endif /* HAVE_OSF_SIA */

auth1.c

@@ -307,7 +307,7 @@ do_authentication(Authctxt *authctxt)
 
 #ifdef USE_PAM
 	if (options.use_pam)
-		PRIVSEP(start_pam(user));
+		PRIVSEP(start_pam(authctxt));
 #endif
 
 	/*

auth2.c

@@ -150,24 +150,24 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
 	if (authctxt->attempt++ == 0) {
 		/* setup auth context */
 		authctxt->pw = PRIVSEP(getpwnamallow(user));
+		authctxt->user = xstrdup(user);
 		if (authctxt->pw && strcmp(service, "ssh-connection")==0) {
 			authctxt->valid = 1;
 			debug2("input_userauth_request: setting up authctxt for %s", user);
 #ifdef USE_PAM
 			if (options.use_pam)
-				PRIVSEP(start_pam(authctxt->pw->pw_name));
+				PRIVSEP(start_pam(authctxt));
 #endif
 		} else {
 			logit("input_userauth_request: illegal user %s", user);
 			authctxt->pw = fakepw();
 #ifdef USE_PAM
 			if (options.use_pam)
-				PRIVSEP(start_pam(user));
+				PRIVSEP(start_pam(authctxt));
 #endif
 		}
 		setproctitle("%s%s", authctxt->pw ? user : "unknown",
 		    use_privsep ? " [net]" : "");
-		authctxt->user = xstrdup(user);
 		authctxt->service = xstrdup(service);
 		authctxt->style = style ? xstrdup(style) : NULL;
 		if (use_privsep)

configure.ac

@@ -1,4 +1,4 @@
-# $Id: configure.ac,v 1.202 2004/02/24 05:47:04 tim Exp $
+# $Id: configure.ac,v 1.202.2.2 2004/03/08 11:21:59 dtucker Exp $
 
 AC_INIT
 AC_CONFIG_SRCDIR([ssh.c])
@@ -268,6 +268,9 @@ mips-sony-bsd|mips-sony-newsos4)
 	AC_DEFINE(BROKEN_SAVED_UIDS)
 	;;
 *-*-solaris*)
+	if test "x$withval" != "xno" ; then	
+		need_dash_r=1
+	fi
 	AC_DEFINE(PAM_SUN_CODEBASE)
 	AC_DEFINE(LOGIN_NEEDS_UTMPX)
 	AC_DEFINE(LOGIN_NEEDS_TERM)
@@ -799,7 +802,7 @@ AC_CHECK_FUNCS(\
 	setproctitle setregid setreuid setrlimit \
 	setsid setvbuf sigaction sigvec snprintf socketpair strerror \
 	strlcat strlcpy strmode strnvis strtoul sysconf tcgetpgrp \
-	truncate updwtmpx utimes vhangup vsnprintf waitpid \
+	truncate unsetenv updwtmpx utimes vhangup vsnprintf waitpid \
 )
 
 # IRIX has a const char return value for gai_strerror()

contrib/redhat/sshd.pam

@@ -1,8 +1,8 @@
 #%PAM-1.0
-auth       required     /lib/security/pam_stack.so service=system-auth
-auth       required     /lib/security/pam_nologin.so
-account    required     /lib/security/pam_stack.so service=system-auth
-password   required     /lib/security/pam_stack.so service=system-auth
-session    required     /lib/security/pam_stack.so service=system-auth
-session    required     /lib/security/pam_limits.so
-session    optional     /lib/security/pam_console.so
+auth       required     pam_stack.so service=system-auth
+auth       required     pam_nologin.so
+account    required     pam_stack.so service=system-auth
+password   required     pam_stack.so service=system-auth
+session    required     pam_stack.so service=system-auth
+session    required     pam_limits.so
+session    optional     pam_console.so

defines.h

@@ -25,7 +25,7 @@
 #ifndef _DEFINES_H
 #define _DEFINES_H
 
-/* $Id: defines.h,v 1.110 2004/02/10 02:01:14 dtucker Exp $ */
+/* $Id: defines.h,v 1.110.2.1 2004/03/04 11:56:57 dtucker Exp $ */
 
 
 /* Constants */
@@ -616,6 +616,13 @@ struct winsize {
 #  define USE_LASTLOG
 #endif
 
+#ifdef HAVE_OSF_SIA
+# ifdef USE_SHADOW
+#  undef USE_SHADOW
+# endif
+# define CUSTOM_SYS_AUTH_PASSWD 1
+#endif
+
 /** end of login recorder definitions */
 
 #endif /* _DEFINES_H */

dh.c

@@ -23,7 +23,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: dh.c,v 1.26 2003/12/16 15:51:54 markus Exp $");
+RCSID("$OpenBSD: dh.c,v 1.29 2004/02/27 22:49:27 dtucker Exp $");
 
 #include "xmalloc.h"
 
@@ -91,6 +91,9 @@ parse_prime(int linenum, char *line, struct dhgroup *dhg)
 	if (BN_num_bits(dhg->p) != dhg->size)
 		goto failclean;
 
+	if (BN_is_zero(dhg->g) || BN_is_one(dhg->g))
+		goto failclean;
+
 	return (1);
 
  failclean:
@@ -105,7 +108,7 @@ DH *
 choose_dh(int min, int wantbits, int max)
 {
 	FILE *f;
-	char line[2048];
+	char line[4096];
 	int best, bestcount, which;
 	int linenum;
 	struct dhgroup dhg;
@@ -194,7 +197,7 @@ dh_pub_is_valid(DH *dh, BIGNUM *dh_pub)
 void
 dh_gen_key(DH *dh, int need)
 {
-	int i, bits_set = 0, tries = 0;
+	int i, bits_set, tries = 0;
 
 	if (dh->p == NULL)
 		fatal("dh_gen_key: dh->p == NULL");
@@ -211,7 +214,7 @@ dh_gen_key(DH *dh, int need)
 			fatal("dh_gen_key: BN_rand failed");
 		if (DH_generate_key(dh) == 0)
 			fatal("DH_generate_key");
-		for (i = 0; i <= BN_num_bits(dh->priv_key); i++)
+		for (i = 0, bits_set = 0; i <= BN_num_bits(dh->priv_key); i++)
 			if (BN_is_bit_set(dh->priv_key, i))
 				bits_set++;
 		debug2("dh_gen_key: priv key bits set: %d/%d",

monitor.c

@@ -782,16 +782,10 @@ mm_answer_skeyrespond(int socket, Buffer *m)
 int
 mm_answer_pam_start(int socket, Buffer *m)
 {
-	char *user;
-
 	if (!options.use_pam)
 		fatal("UsePAM not set, but ended up in %s anyway", __func__);
 
-	user = buffer_get_string(m, NULL);
-
-	start_pam(user);
-
-	xfree(user);
+	start_pam(authctxt);
 
 	monitor_permit(mon_dispatch, MONITOR_REQ_PAM_ACCOUNT, 1);
 

monitor_wrap.c

@@ -686,7 +686,7 @@ mm_session_pty_cleanup2(Session *s)
 
 #ifdef USE_PAM
 void
-mm_start_pam(char *user)
+mm_start_pam(Authctxt *authctxt)
 {
 	Buffer m;
 
@@ -695,8 +695,6 @@ mm_start_pam(char *user)
 		fatal("UsePAM=no, but ended up in %s anyway", __func__);
 
 	buffer_init(&m);
-	buffer_put_cstring(&m, user);
-
 	mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_PAM_START, &m);
 
 	buffer_free(&m);

monitor_wrap.h

@@ -66,7 +66,7 @@ OM_uint32 mm_ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t);
 #endif
 
 #ifdef USE_PAM
-void mm_start_pam(char *);
+void mm_start_pam(struct Authctxt *);
 u_int mm_do_pam_account(void);
 void *mm_sshpam_init_ctx(struct Authctxt *);
 int mm_sshpam_query(void *, char **, char **, u_int *, char ***, u_int **);

openbsd-compat/bsd-misc.h

@@ -1,4 +1,4 @@
-/* $Id: bsd-misc.h,v 1.14 2004/02/17 05:49:55 djm Exp $ */
+/* $Id: bsd-misc.h,v 1.14.2.1 2004/03/08 11:21:59 dtucker Exp $ */
 
 /*
  * Copyright (c) 1999-2004 Damien Miller <djm@mindrot.org>
@@ -89,6 +89,10 @@ pid_t tcgetpgrp(int);
 int tcsendbreak(int, int);
 #endif
 
+#ifndef HAVE_UNSETENV
+void unsetenv(const char *);
+#endif
+
 /* wrapper for signal interface */
 typedef void (*mysig_t)(int);
 mysig_t mysignal(int sig, mysig_t act);

openbsd-compat/fake-rfc2553.h

@@ -1,4 +1,4 @@
-/* $Id: fake-rfc2553.h,v 1.8 2004/02/10 02:05:41 dtucker Exp $ */
+/* $Id: fake-rfc2553.h,v 1.8.2.1 2004/03/10 10:05:43 dtucker Exp $ */
 
 /*
  * Copyright (C) 2000-2003 Damien Miller.  All rights reserved.
@@ -133,6 +133,9 @@ struct addrinfo {
 #endif /* !HAVE_STRUCT_ADDRINFO */
 
 #ifndef HAVE_GETADDRINFO
+#ifdef getaddrinfo
+# undef getaddrinfo
+#endif
 #define getaddrinfo(a,b,c,d)	(ssh_getaddrinfo(a,b,c,d))
 int getaddrinfo(const char *, const char *, 
     const struct addrinfo *, struct addrinfo **);

openbsd-compat/setenv.c

@@ -30,7 +30,7 @@
  */
 
 #include "includes.h"
-#ifndef HAVE_SETENV
+#if !defined(HAVE_SETENV) || !defined(HAVE_UNSETENV)
 
 #if defined(LIBC_SCCS) && !defined(lint)
 static char *rcsid = "$OpenBSD: setenv.c,v 1.6 2003/06/02 20:18:38 millert Exp $";
@@ -77,6 +77,7 @@ __findenv(name, offset)
 	return (NULL);
 }
 
+#ifndef HAVE_SETENV
 /*
  * setenv --
  *	Set the value of the environmental variable "name" to be
@@ -138,7 +139,9 @@ setenv(name, value, rewrite)
 		;
 	return (0);
 }
+#endif /* HAVE_SETENV */
 
+#ifndef HAVE_UNSETENV
 /*
  * unsetenv(name) --
  *	Delete environmental variable "name".
@@ -157,5 +160,6 @@ unsetenv(name)
 			if (!(*P = *(P + 1)))
 				break;
 }
+#endif /* HAVE_UNSETENV */
 
-#endif /* HAVE_SETENV */
+#endif /* !defined(HAVE_SETENV) || !defined(HAVE_UNSETENV) */

openbsd-compat/xcrypt.c

@@ -24,8 +24,6 @@
 
 #include "includes.h"
 
-#if !defined(HAVE_OSF_SIA)
-
 # ifdef HAVE_CRYPT_H
 #  include <crypt.h>
 # endif
@@ -108,5 +106,3 @@ shadow_pw(struct passwd *pw)
 
 	return pw_password;
 }
-
-#endif /* !defined(HAVE_OSF_SIA) */

regress/Makefile

@@ -1,4 +1,4 @@
-#	$OpenBSD: Makefile,v 1.26 2003/10/11 11:49:49 dtucker Exp $
+#	$OpenBSD: Makefile,v 1.27 2004/02/17 08:23:20 dtucker Exp $
 
 REGRESS_TARGETS=	t1 t2 t3 t4 t5 t6 t7 t-exec
 tests:		$(REGRESS_TARGETS)
@@ -21,6 +21,7 @@ LTESTS= 	connect \
 		broken-pipe \
 		try-ciphers \
 		yes-head \
+		login-timeout \
 		agent \
 		agent-getpeereid \
 		agent-timeout \

regress/dynamic-forward.sh

@@ -1,4 +1,4 @@
-#	$OpenBSD: dynamic-forward.sh,v 1.2 2003/07/03 08:21:46 markus Exp $
+#	$OpenBSD: dynamic-forward.sh,v 1.3 2004/02/28 12:16:57 dtucker Exp $
 #	Placed in the Public Domain.
 
 tid="dynamic forwarding"
@@ -7,7 +7,7 @@ PORT=4242
 FWDPORT=4243
 DATA=/bin/ls${EXEEXT}
 
-if have_prog nc && nc -h 2>&1 | grep "x proxy address" >/dev/null; then
+if have_prog nc && nc -h 2>&1 | grep "proxy address" >/dev/null; then
 	proxycmd="nc -x 127.0.0.1:$FWDPORT -X"
 elif have_prog connect; then
 	proxycmd="connect -S 127.0.0.1:$FWDPORT -"

regress/login-timeout.sh

@@ -0,0 +1,29 @@
+#	$OpenBSD: login-timeout.sh,v 1.1 2004/02/17 08:23:20 dtucker Exp $
+#	Placed in the Public Domain.
+
+tid="connect after login grace timeout"
+
+trace "test login grace with privsep"
+echo "LoginGraceTime 10s" >> $OBJ/sshd_config
+echo "MaxStartups 1" >> $OBJ/sshd_config
+start_sshd
+
+(echo SSH-2.0-fake; sleep 60) | telnet localhost ${PORT} >/dev/null 2>&1 & 
+sleep 15
+${SSH} -F $OBJ/ssh_config somehost true
+if [ $? -ne 0 ]; then
+	fail "ssh connect after login grace timeout failed with privsep"
+fi
+
+kill `cat $PIDFILE`
+
+trace "test login grace without privsep"
+echo "UsePrivilegeSeparation no" >>sshd_config
+start_sshd
+
+(echo SSH-2.0-fake; sleep 60) | telnet localhost ${PORT} >/dev/null 2>&1 & 
+sleep 15
+${SSH} -F $OBJ/ssh_config somehost true
+if [ $? -ne 0 ]; then
+	fail "ssh connect after login grace timeout failed without privsep"
+fi

regress/ssh-com-client.sh

@@ -1,4 +1,4 @@
-#	$OpenBSD: ssh-com-client.sh,v 1.5 2003/05/14 22:08:27 markus Exp $
+#	$OpenBSD: ssh-com-client.sh,v 1.6 2004/02/24 17:06:52 markus Exp $
 #	Placed in the Public Domain.
 
 tid="connect with ssh.com client"
@@ -19,6 +19,9 @@ VERSIONS="
 	3.2.0
 	3.2.2
 	3.2.3
+	3.2.5
+	3.2.9
+	3.2.9.1
 	3.3.0"
 
 # 2.0.10 2.0.12 2.0.13 don't like the test setup

regress/ssh-com-keygen.sh

@@ -1,4 +1,4 @@
-#	$OpenBSD: ssh-com-keygen.sh,v 1.3 2003/05/14 22:08:27 markus Exp $
+#	$OpenBSD: ssh-com-keygen.sh,v 1.4 2004/02/24 17:06:52 markus Exp $
 #	Placed in the Public Domain.
 
 tid="ssh.com key import"
@@ -22,6 +22,9 @@ VERSIONS="
 	3.2.0
 	3.2.2
 	3.2.3
+	3.2.5
+	3.2.9
+	3.2.9.1
 	3.3.0"
 
 COMPRV=${OBJ}/comkey

regress/ssh-com-sftp.sh

@@ -1,4 +1,4 @@
-#	$OpenBSD: ssh-com-sftp.sh,v 1.4 2003/05/14 22:08:27 markus Exp $
+#	$OpenBSD: ssh-com-sftp.sh,v 1.5 2004/02/24 17:06:52 markus Exp $
 #	Placed in the Public Domain.
 
 tid="basic sftp put/get with ssh.com server"
@@ -35,6 +35,9 @@ VERSIONS="
 	3.2.0
 	3.2.2
 	3.2.3
+	3.2.5
+	3.2.9
+	3.2.9.1
 	3.3.0"
 
 # go for it

regress/ssh-com.sh

@@ -1,4 +1,4 @@
-#	$OpenBSD: ssh-com.sh,v 1.6 2003/11/07 10:16:44 jmc Exp $
+#	$OpenBSD: ssh-com.sh,v 1.7 2004/02/24 17:06:52 markus Exp $
 #	Placed in the Public Domain.
 
 tid="connect to ssh.com server"
@@ -20,6 +20,9 @@ VERSIONS="
 	3.2.0
 	3.2.2
 	3.2.3
+	3.2.5
+	3.2.9
+	3.2.9.1
 	3.3.0"
 # 2.0.10 does not support UserConfigDirectory
 # 2.3.1 requires a config in $HOME/.ssh2

regress/test-exec.sh

@@ -1,4 +1,4 @@
-#	$OpenBSD: test-exec.sh,v 1.14 2002/04/15 15:19:48 markus Exp $
+#	$OpenBSD: test-exec.sh,v 1.15 2004/02/24 16:56:30 markus Exp $
 #	Placed in the Public Domain.
 
 PORT=4242
@@ -49,28 +49,28 @@ SFTP=sftp
 SFTPSERVER=/usr/libexec/openssh/sftp-server
 
 if [ "x$TEST_SSH_SSH" != "x" ]; then
-	SSH=${TEST_SSH_SSH}
+	SSH="${TEST_SSH_SSH}"
 fi
 if [ "x$TEST_SSH_SSHD" != "x" ]; then
-	SSHD=${TEST_SSH_SSHD}
+	SSHD="${TEST_SSH_SSHD}"
 fi
 if [ "x$TEST_SSH_SSHAGENT" != "x" ]; then
-	SSHAGENT=${TEST_SSH_SSHAGENT}
+	SSHAGENT="${TEST_SSH_SSHAGENT}"
 fi
 if [ "x$TEST_SSH_SSHADD" != "x" ]; then
-	SSHADD=${TEST_SSH_SSHADD}
+	SSHADD="${TEST_SSH_SSHADD}"
 fi
 if [ "x$TEST_SSH_SSHKEYGEN" != "x" ]; then
-	SSHKEYGEN=${TEST_SSH_SSHKEYGEN}
+	SSHKEYGEN="${TEST_SSH_SSHKEYGEN}"
 fi
 if [ "x$TEST_SSH_SSHKEYSCAN" != "x" ]; then
-	SSHKEYSCAN=${TEST_SSH_SSHKEYSCAN}
+	SSHKEYSCAN="${TEST_SSH_SSHKEYSCAN}"
 fi
 if [ "x$TEST_SSH_SFTP" != "x" ]; then
-	SFTP=${TEST_SSH_SFTP}
+	SFTP="${TEST_SSH_SFTP}"
 fi
 if [ "x$TEST_SSH_SFTPSERVER" != "x" ]; then
-	SFTPSERVER=${TEST_SSH_SFTPSERVER}
+	SFTPSERVER="${TEST_SSH_SFTPSERVER}"
 fi
 
 # these should be used in tests

regress/try-ciphers.sh

@@ -1,4 +1,4 @@
-#	$OpenBSD: try-ciphers.sh,v 1.8 2003/06/12 15:40:01 markus Exp $
+#	$OpenBSD: try-ciphers.sh,v 1.9 2004/02/28 13:44:45 dtucker Exp $
 #	Placed in the Public Domain.
 
 tid="try ciphers"
@@ -28,3 +28,19 @@ for c in $ciphers; do
 		fail "ssh -1 failed with cipher $c"
 	fi
 done
+
+if ! ${SSH} -oCiphers=[email protected] 2>&1 | grep "Bad SSH2 cipher" >/dev/null
+then
+
+echo "Ciphers [email protected]" >> $OBJ/sshd_proxy
+c=[email protected]
+for m in $macs; do
+	trace "proto 2 $c mac $m"
+	verbose "test $tid: proto 2 cipher $c mac $m"
+	${SSH} -F $OBJ/ssh_proxy -2 -m $m -c $c somehost true
+	if [ $? -ne 0 ]; then
+		fail "ssh -2 failed with mac $m cipher $c"
+	fi
+done
+
+fi

sshd.c

@@ -101,7 +101,6 @@ extern char *__progname;
 #else
 char *__progname;
 #endif
-extern char **environ;
 
 /* Server configuration options. */
 ServerOptions options;
@@ -940,6 +939,13 @@ main(int ac, char **av)
 	    SYSLOG_FACILITY_AUTH : options.log_facility,
 	    log_stderr || !inetd_flag);
 
+#ifdef _AIX
+	/*
+	 * Unset KRB5CCNAME, otherwise the user's session may inherit it from
+	 * root's environment
+	 */ 
+	unsetenv("KRB5CCNAME");
+#endif /* _AIX */
 #ifdef _UNICOS
 	/* Cray can define user privs drop all prives now!
 	 * Not needed on PRIV_SU systems!
@@ -1106,11 +1112,6 @@ main(int ac, char **av)
 	   unmounted if desired. */
 	chdir("/");
 
-#ifndef HAVE_CYGWIN
-	/* Clear environment */
-	environ[0] = NULL;
-#endif
-
 	/* ignore SIGPIPE */
 	signal(SIGPIPE, SIG_IGN);
 

sshlogin.c

@@ -52,11 +52,11 @@ u_long
 get_last_login_time(uid_t uid, const char *logname,
     char *buf, u_int bufsize)
 {
-  struct logininfo li;
+	struct logininfo li;
 
-  login_get_lastlog(&li, uid);
-  strlcpy(buf, li.hostname, bufsize);
-  return li.tv_sec;
+	login_get_lastlog(&li, uid);
+	strlcpy(buf, li.hostname, bufsize);
+	return li.tv_sec;
 }
 
 /*
@@ -67,12 +67,12 @@ void
 record_login(pid_t pid, const char *ttyname, const char *user, uid_t uid,
     const char *host, struct sockaddr * addr, socklen_t addrlen)
 {
-  struct logininfo *li;
+	struct logininfo *li;
 
-  li = login_alloc_entry(pid, user, host, ttyname);
-  login_set_addr(li, addr, addrlen);
-  login_login(li);
-  login_free_entry(li);
+	li = login_alloc_entry(pid, user, host, ttyname);
+	login_set_addr(li, addr, addrlen);
+	login_login(li);
+	login_free_entry(li);
 }
 
 #ifdef LOGIN_NEEDS_UTMPX
@@ -80,12 +80,12 @@ void
 record_utmp_only(pid_t pid, const char *ttyname, const char *user,
 		 const char *host, struct sockaddr * addr, socklen_t addrlen)
 {
-  struct logininfo *li;
+	struct logininfo *li;
 
-  li = login_alloc_entry(pid, user, host, ttyname);
-  login_set_addr(li, addr, addrlen);
-  login_utmp_only(li);
-  login_free_entry(li);
+	li = login_alloc_entry(pid, user, host, ttyname);
+	login_set_addr(li, addr, addrlen);
+	login_utmp_only(li);
+	login_free_entry(li);
 }
 #endif
 
@@ -93,9 +93,9 @@ record_utmp_only(pid_t pid, const char *ttyname, const char *user,
 void
 record_logout(pid_t pid, const char *ttyname, const char *user)
 {
-  struct logininfo *li;
+	struct logininfo *li;
 
-  li = login_alloc_entry(pid, user, NULL, ttyname);
-  login_logout(li);
-  login_free_entry(li);
+	li = login_alloc_entry(pid, user, NULL, ttyname);
+	login_logout(li);
+	login_free_entry(li);
 }