- (dtucker) [openbsd-compat/bsd-misc.c] Bug #1108 : fix broken strdup().

Reported by olavi at ipunplugged.com and antoine.brodin at laposte.net via FreeBSD.
- (dtucker) [configure.ac] Bug #1104 : Tru64's printf family doesn't
2005-11-02 09:06:50 +11:00 · 2005-10-25 18:51:48 +10:00 · 2005-10-25 18:37:51 +10:00 · 2005-10-17 23:29:09 +10:00 · 2005-10-08 12:06:30 +10:00 · 2005-10-06 01:40:43 +10:00
17 changed files with 317 additions and 602 deletions
@@ -1,3 +1,69 @@
+20051102
+ - (dtucker) [openbsd-compat/bsd-misc.c] Bug #1108: fix broken strdup().
+   Reported by olavi at ipunplugged.com and antoine.brodin at laposte.net
+   via FreeBSD.
+
+  20051030
+   - (djm) [contrib/suse/openssh.spec contrib/suse/rc.
+     sshd contrib/suse/sysconfig.ssh] Bug #1106: Updated SuSE spec and init 
+20051025
+ - (dtucker) [configure.ac] Relocate LLONG_MAX calculation to after the
+   sizeof(long long) checks, to make fixing bug #1104 easier (no changes
+   yet).
+ - (dtucker) [configure.ac] Bug #1104: Tru64's printf family doesn't
+   understand "%lld", even though the compiler has "long long", so handle
+   it as a special case.  Patch tested by mcaskill.scott at epa.gov.
+
+20051017
+ - (dtucker) [configure.ac] Bug #1097: Fix configure for cross-compiling.
+   /etc/default/login report and testing from aabaker at iee.org, corrections
+   from tim@.
+
+20051008
+ - (dtucker) [configure.ac] Bug #1098: define $MAIL for HP-UX; report from
+   brian.smith at agilent com.
+
+20051005
+ - (dtucker) [configure.ac sshd.8] Enable locked account check (a prepended
+   "*LOCKED*" string) for FreeBSD.  Patch jeremie at le-hen.org and
+   senthilkumar_sen at hotpop.com.
+
+20051003
+ - (dtucker) OpenBSD CVS Sync
+   - [email protected] 2005/09/07 08:53:53
+     [channels.c]
+     enforce chanid != NULL; ok djm
+   - [email protected] 2005/09/09 19:18:05
+     [clientloop.c]
+     typo; from mark at mcs.vuw.ac.nz, bug #1082
+   - [email protected] 2005/09/19 11:37:34
+     [ssh_config.5 ssh.1]
+     mention ability to specify bind_address for DynamicForward and -D options;
+     bz#1077 spotted by Haruyama Seigo
+   - [email protected] 2005/09/19 11:47:09
+     [sshd.c]
+     stop connection abort on rekey with delayed compression enabled when
+     post-auth privsep is disabled (e.g. when root is logged in); ok dtucker@
+   - [email protected] 2005/10/03 07:44:42
+     [canohost.c]
+     Relocate check_ip_options call to prevent logging of garbage for
+     connections with IP options set.  bz#1092 from David Leonard,
+     "looks good" deraadt@
+
+20050930
+ - (dtucker) [openbsd-compat/openbsd-compat.h] Bug #1096: Add prototype
+   for strtoll.  Patch from o.flebbe at science-computing.de.
+ - (dtucker) [monitor.c] Bug #1087: Send loginmsg to preauth privsep
+   child during PAM account check without clearing it.  This restores the
+   post-login warnings such as LDAP password expiry.  Patch from Tomas Mraz
+   with help from several others.
+ - (dtucker) [auth-pam.c] Bug #1028: send final non-query messages from
+   PAM via keyboard-interactive.  Patch tested by the folks at Vintela.
+
+20050922
+ - (dtucker) [configure.ac] Use -R linker flag for libedit too; patch from
+   skeleten at shillest.net.
+
 20050901
 - (djm) Update RPM spec file versions

@@ -2989,4 +3055,4 @@
   - (djm) Trim deprecated options from INSTALL. Mention UsePAM
   - (djm) Fix quote handling in sftp; Patch from admorten AT umich.edu

-$Id: ChangeLog,v 1.3887 2005/09/01 09:10:48 djm Exp $
+$Id: ChangeLog,v 1.3887.2.15 2005/11/01 22:06:50 dtucker Exp $
@@ -1,458 +0,0 @@
-/* $Id: acconfig.h,v 1.183 2005/07/07 10:33:36 dtucker Exp $ */
-
-/*
- * Copyright (c) 1999-2003 Damien Miller.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef _CONFIG_H
-#define _CONFIG_H
-
-/* Generated automatically from acconfig.h by autoheader. */
-/* Please make your changes there */
-
-@TOP@
-
-/* Define if your platform breaks doing a seteuid before a setuid */
-#undef SETEUID_BREAKS_SETUID
-
-/* Define if your setreuid() is broken */
-#undef BROKEN_SETREUID
-
-/* Define if your setregid() is broken */
-#undef BROKEN_SETREGID
-
-/* Define if your setresuid() is broken */
-#undef BROKEN_SETRESUID
-
-/* Define if your setresgid() is broken */
-#undef BROKEN_SETRESGID
-
-/* Define to a Set Process Title type if your system is */
-/* supported by bsd-setproctitle.c */
-#undef SPT_TYPE
-#undef SPT_PADCHAR
-
-/* SCO workaround */
-#undef BROKEN_SYS_TERMIO_H
-
-/* Define if you have SecureWare-based protected password database */
-#undef HAVE_SECUREWARE
-
-/* If your header files don't define LOGIN_PROGRAM, then use this (detected) */
-/* from environment and PATH */
-#undef LOGIN_PROGRAM_FALLBACK
-
-/* Full path of your "passwd" program */
-#undef _PATH_PASSWD_PROG
-
-/* Define if your password has a pw_class field */
-#undef HAVE_PW_CLASS_IN_PASSWD
-
-/* Define if your password has a pw_expire field */
-#undef HAVE_PW_EXPIRE_IN_PASSWD
-
-/* Define if your password has a pw_change field */
-#undef HAVE_PW_CHANGE_IN_PASSWD
-
-/* Define if your system uses access rights style file descriptor passing */
-#undef HAVE_ACCRIGHTS_IN_MSGHDR
-
-/* Define if your system uses ancillary data style file descriptor passing */
-#undef HAVE_CONTROL_IN_MSGHDR
-
-/* Define if you system's inet_ntoa is busted (e.g. Irix gcc issue) */
-#undef BROKEN_INET_NTOA
-
-/* Define if your system defines sys_errlist[] */
-#undef HAVE_SYS_ERRLIST
-
-/* Define if your system defines sys_nerr */
-#undef HAVE_SYS_NERR
-
-/* Define if your system choked on IP TOS setting */
-#undef IP_TOS_IS_BROKEN
-
-/* Define if you have the getuserattr function.  */
-#undef HAVE_GETUSERATTR
-
-/* Define if you have the basename function. */
-#undef HAVE_BASENAME
-
-/* Work around problematic Linux PAM modules handling of PAM_TTY */
-#undef PAM_TTY_KLUDGE
-
-/* Define if pam_chauthtok wants real uid set to the unpriv'ed user */
-#undef SSHPAM_CHAUTHTOK_NEEDS_RUID
-
-/* Use PIPES instead of a socketpair() */
-#undef USE_PIPES
-
-/* Define if your snprintf is busted */
-#undef BROKEN_SNPRINTF
-
-/* Define if you are on Cygwin */
-#undef HAVE_CYGWIN
-
-/* Define if you have a broken realpath. */
-#undef BROKEN_REALPATH
-
-/* Define if you are on NeXT */
-#undef HAVE_NEXT
-
-/* Define if you want to enable PAM support */
-#undef USE_PAM
-
-/* Define if you want to enable AIX4's authenticate function */
-#undef WITH_AIXAUTHENTICATE
-
-/* Define if your AIX loginfailed() function takes 4 arguments (AIX >= 5.2) */
-#undef AIX_LOGINFAILED_4ARG
-
-/* Define if your skeychallenge() function takes 4 arguments (eg NetBSD) */
-#undef SKEYCHALLENGE_4ARG
-
-/* Define if you have/want arrays (cluster-wide session managment, not C arrays) */
-#undef WITH_IRIX_ARRAY
-
-/* Define if you want IRIX project management */
-#undef WITH_IRIX_PROJECT
-
-/* Define if you want IRIX audit trails */
-#undef WITH_IRIX_AUDIT
-
-/* Define if you want IRIX kernel jobs */
-#undef WITH_IRIX_JOBS
-
-/* Location of PRNGD/EGD random number socket */
-#undef PRNGD_SOCKET
-
-/* Port number of PRNGD/EGD random number socket */
-#undef PRNGD_PORT
-
-/* Builtin PRNG command timeout */
-#undef ENTROPY_TIMEOUT_MSEC
-
-/* non-privileged user for privilege separation */
-#undef SSH_PRIVSEP_USER
-
-/* Define if you want to install preformatted manpages.*/
-#undef MANTYPE
-
-/* Define if your ssl headers are included with #include <openssl/header.h>  */
-#undef HAVE_OPENSSL
-
-/* Define if you are linking against RSAref.  Used only to print the right
- * message at run-time. */
-#undef RSAREF
-
-/* struct timeval */
-#undef HAVE_STRUCT_TIMEVAL
-
-/* struct utmp and struct utmpx fields */
-#undef HAVE_HOST_IN_UTMP
-#undef HAVE_HOST_IN_UTMPX
-#undef HAVE_ADDR_IN_UTMP
-#undef HAVE_ADDR_IN_UTMPX
-#undef HAVE_ADDR_V6_IN_UTMP
-#undef HAVE_ADDR_V6_IN_UTMPX
-#undef HAVE_SYSLEN_IN_UTMPX
-#undef HAVE_PID_IN_UTMP
-#undef HAVE_TYPE_IN_UTMP
-#undef HAVE_TYPE_IN_UTMPX
-#undef HAVE_TV_IN_UTMP
-#undef HAVE_TV_IN_UTMPX
-#undef HAVE_ID_IN_UTMP
-#undef HAVE_ID_IN_UTMPX
-#undef HAVE_EXIT_IN_UTMP
-#undef HAVE_TIME_IN_UTMP
-#undef HAVE_TIME_IN_UTMPX
-
-/* Define if you don't want to use your system's login() call */
-#undef DISABLE_LOGIN
-
-/* Define if you don't want to use pututline() etc. to write [uw]tmp */
-#undef DISABLE_PUTUTLINE
-
-/* Define if you don't want to use pututxline() etc. to write [uw]tmpx */
-#undef DISABLE_PUTUTXLINE
-
-/* Define if you don't want to use lastlog */
-#undef DISABLE_LASTLOG
-
-/* Define if you don't want to use lastlog in session.c */
-#undef NO_SSH_LASTLOG
-
-/* Define if you don't want to use utmp */
-#undef DISABLE_UTMP
-
-/* Define if you don't want to use utmpx */
-#undef DISABLE_UTMPX
-
-/* Define if you don't want to use wtmp */
-#undef DISABLE_WTMP
-
-/* Define if you don't want to use wtmpx */
-#undef DISABLE_WTMPX
-
-/* Some systems need a utmpx entry for /bin/login to work */
-#undef LOGIN_NEEDS_UTMPX
-
-/* Some versions of /bin/login need the TERM supplied on the commandline */
-#undef LOGIN_NEEDS_TERM
-
-/* Define if your login program cannot handle end of options ("--") */
-#undef LOGIN_NO_ENDOPT
-
-/* Define if you want to specify the path to your lastlog file */
-#undef CONF_LASTLOG_FILE
-
-/* Define if you want to specify the path to your utmp file */
-#undef CONF_UTMP_FILE
-
-/* Define if you want to specify the path to your wtmp file */
-#undef CONF_WTMP_FILE
-
-/* Define if you want to specify the path to your utmpx file */
-#undef CONF_UTMPX_FILE
-
-/* Define if you want to specify the path to your wtmpx file */
-#undef CONF_WTMPX_FILE
-
-/* Define if you want external askpass support */
-#undef USE_EXTERNAL_ASKPASS
-
-/* Define if libc defines __progname */
-#undef HAVE___PROGNAME
-
-/* Define if compiler implements __FUNCTION__ */
-#undef HAVE___FUNCTION__
-
-/* Define if compiler implements __func__ */
-#undef HAVE___func__
-
-/* Define this is you want GSSAPI support in the version 2 protocol */
-#undef GSSAPI
-
-/* Define if you want Kerberos 5 support */
-#undef KRB5
-
-/* Define this if you are using the Heimdal version of Kerberos V5 */
-#undef HEIMDAL
-
-/* Define this if you want to use libkafs' AFS support */
-#undef USE_AFS
-
-/* Define if you want S/Key support */
-#undef SKEY
-
-/* Define if you want TCP Wrappers support */
-#undef LIBWRAP
-
-/* Define if your libraries define login() */
-#undef HAVE_LOGIN
-
-/* Define if your libraries define daemon() */
-#undef HAVE_DAEMON
-
-/* Define if your libraries define getpagesize() */
-#undef HAVE_GETPAGESIZE
-
-/* Define if xauth is found in your path */
-#undef XAUTH_PATH
-
-/* Define if you want to allow MD5 passwords */
-#undef HAVE_MD5_PASSWORDS
-
-/* Define if you want to disable shadow passwords */
-#undef DISABLE_SHADOW
-
-/* Define if you want to use shadow password expire field */
-#undef HAS_SHADOW_EXPIRE
-
-/* Define if you have Digital Unix Security Integration Architecture */
-#undef HAVE_OSF_SIA
-
-/* Define if you have getpwanam(3) [SunOS 4.x] */
-#undef HAVE_GETPWANAM
-
-/* Define if you have an old version of PAM which takes only one argument */
-/* to pam_strerror */
-#undef HAVE_OLD_PAM
-
-/* Define if you are using Solaris-derived PAM which passes pam_messages  */
-/* to the conversation function with an extra level of indirection */
-#undef PAM_SUN_CODEBASE
-
-/* Set this to your mail directory if you don't have maillock.h */
-#undef MAIL_DIRECTORY
-
-/* Data types */
-#undef HAVE_U_INT
-#undef HAVE_INTXX_T
-#undef HAVE_U_INTXX_T
-#undef HAVE_UINTXX_T
-#undef HAVE_INT64_T
-#undef HAVE_U_INT64_T
-#undef HAVE_U_CHAR
-#undef HAVE_SIZE_T
-#undef HAVE_SSIZE_T
-#undef HAVE_CLOCK_T
-#undef HAVE_MODE_T
-#undef HAVE_PID_T
-#undef HAVE_SA_FAMILY_T
-#undef HAVE_STRUCT_SOCKADDR_STORAGE
-#undef HAVE_STRUCT_ADDRINFO
-#undef HAVE_STRUCT_IN6_ADDR
-#undef HAVE_STRUCT_SOCKADDR_IN6
-
-/* Fields in struct sockaddr_storage */
-#undef HAVE_SS_FAMILY_IN_SS
-#undef HAVE___SS_FAMILY_IN_SS
-
-/* Define if you have /dev/ptmx */
-#undef HAVE_DEV_PTMX
-
-/* Define if you have /dev/ptc */
-#undef HAVE_DEV_PTS_AND_PTC
-
-/* Define if you need to use IP address instead of hostname in $DISPLAY */
-#undef IPADDR_IN_DISPLAY
-
-/* Specify default $PATH */
-#undef USER_PATH
-
-/* Specify location of ssh.pid */
-#undef _PATH_SSH_PIDDIR
-
-/* getaddrinfo is broken (if present) */
-#undef BROKEN_GETADDRINFO
-
-/* updwtmpx is broken (if present) */
-#undef BROKEN_UPDWTMPX
-
-/* Workaround more Linux IPv6 quirks */
-#undef DONT_TRY_OTHER_AF
-
-/* Detect IPv4 in IPv6 mapped addresses and treat as IPv4 */
-#undef IPV4_IN_IPV6
-
-/* Define if you have BSD auth support */
-#undef BSD_AUTH
-
-/* Define if X11 doesn't support AF_UNIX sockets on that system */
-#undef NO_X11_UNIX_SOCKETS
-
-/* Define if the concept of ports only accessible to superusers isn't known */
-#undef NO_IPPORT_RESERVED_CONCEPT
-
-/* Needed for SCO and NeXT */
-#undef BROKEN_SAVED_UIDS
-
-/* Define if your system glob() function has the GLOB_ALTDIRFUNC extension */
-#undef GLOB_HAS_ALTDIRFUNC
-
-/* Define if your system glob() function has gl_matchc options in glob_t */
-#undef GLOB_HAS_GL_MATCHC
-
-/* Define in your struct dirent expects you to allocate extra space for d_name */
-#undef BROKEN_ONE_BYTE_DIRENT_D_NAME
-
-/* Define if your system has /etc/default/login */
-#undef HAVE_ETC_DEFAULT_LOGIN
-
-/* Define if your getopt(3) defines and uses optreset */
-#undef HAVE_GETOPT_OPTRESET
-
-/* Define on *nto-qnx systems */
-#undef MISSING_NFDBITS
-
-/* Define on *nto-qnx systems */
-#undef MISSING_HOWMANY
-
-/* Define on *nto-qnx systems */
-#undef MISSING_FD_MASK
-
-/* Define if you want smartcard support */
-#undef SMARTCARD
-
-/* Define if you want smartcard support using sectok */
-#undef USE_SECTOK
-
-/* Define if you want smartcard support using OpenSC */
-#undef USE_OPENSC
-
-/* Define if you want to use OpenSSL's internally seeded PRNG only */
-#undef OPENSSL_PRNG_ONLY
-
-/* Define if you shouldn't strip 'tty' from your ttyname in [uw]tmp */
-#undef WITH_ABBREV_NO_TTY
-
-/* Define if you want a different $PATH for the superuser */
-#undef SUPERUSER_PATH
-
-/* Path that unprivileged child will chroot() to in privep mode */
-#undef PRIVSEP_PATH
-
-/* Define if your platform needs to skip post auth file descriptor passing */
-#undef DISABLE_FD_PASSING
-
-/* Silly mkstemp() */
-#undef HAVE_STRICT_MKSTEMP
-
-/* Some systems put this outside of libc */
-#undef HAVE_NANOSLEEP
-
-/* Define if sshd somehow reacquires a controlling TTY after setsid() */
-#undef SSHD_ACQUIRES_CTTY
-
-/* Define if cmsg_type is not passed correctly */
-#undef BROKEN_CMSG_TYPE
-
-/*
- * Define to whatever link() returns for "not supported" if it doesn't
- * return EOPNOTSUPP.
- */
-#undef LINK_OPNOTSUPP_ERRNO
-
-/* Strings used in /etc/passwd to denote locked account */
-#undef LOCKED_PASSWD_STRING
-#undef LOCKED_PASSWD_PREFIX
-#undef LOCKED_PASSWD_SUBSTR
-
-/* Define if getrrsetbyname() exists */
-#undef HAVE_GETRRSETBYNAME
-
-/* Define if HEADER.ad exists in arpa/nameser.h */
-#undef HAVE_HEADER_AD
-
-/* Define if your resolver libs need this for getrrsetbyname */
-#undef BIND_8_COMPAT
-
-/* Define if you have /proc/$pid/fd */
-#undef HAVE_PROC_PID
-
-@BOTTOM@
-
-/* ******************* Shouldn't need to edit below this line ************** */
-
-#endif /* _CONFIG_H */
@@ -1,4 +1,4 @@
-dnl $Id: aclocal.m4,v 1.5 2001/10/22 00:53:59 tim Exp $
+dnl $Id: aclocal.m4,v 1.6 2005/09/19 16:33:39 tim Exp $
 dnl
 dnl OpenSSH-specific autoconf macros
 dnl
@@ -26,7 +26,7 @@ AC_DEFUN(OSSH_CHECK_HEADER_FOR_FIELD, [
 	if test -n "`echo $ossh_varname`"; then
 		AC_MSG_RESULT($ossh_result)
 		if test "x$ossh_result" = "xyes"; then
-			AC_DEFINE($3)
+			AC_DEFINE($3, 1, [Define if you have $1 in $2])
 		fi
 	else
 		AC_MSG_RESULT(no)
@@ -47,7 +47,7 @@

 /* Based on $FreeBSD: src/crypto/openssh/auth2-pam-freebsd.c,v 1.11 2003/03/31 13:48:18 des Exp $ */
 #include "includes.h"
-RCSID("$Id: auth-pam.c,v 1.126 2005/07/17 07:18:50 djm Exp $");
+RCSID("$Id: auth-pam.c,v 1.126.2.1 2005/09/30 00:55:17 dtucker Exp $");

 #ifdef USE_PAM
 #if defined(HAVE_SECURITY_PAM_APPL_H)
@@ -716,8 +716,18 @@ sshpam_query(void *ctx, char **name, char **info,
 			plen++;
 			xfree(msg);
 			break;
-		case PAM_SUCCESS:
 		case PAM_AUTH_ERR:
+			debug3("PAM: PAM_AUTH_ERR");
+			if (**prompts != NULL && strlen(**prompts) != 0) {
+				*info = **prompts;
+				**prompts = NULL;
+				*num = 0;
+				**echo_on = 0;
+				ctxt->pam_done = -1;
+				return 0;
+			}
+			/* FALLTHROUGH */
+		case PAM_SUCCESS:
 			if (**prompts != NULL) {
 				/* drain any accumulated messages */
 				debug("PAM: %s", **prompts);
@@ -12,7 +12,7 @@
 */

 #include "includes.h"
-RCSID("$OpenBSD: canohost.c,v 1.44 2005/06/17 02:44:32 djm Exp $");
+RCSID("$OpenBSD: canohost.c,v 1.45 2005/10/03 07:44:42 dtucker Exp $");

 #include "packet.h"
 #include "xmalloc.h"
@@ -43,9 +43,6 @@ get_remote_hostname(int sock, int use_dns)
 		cleanup_exit(255);
 	}

-	if (from.ss_family == AF_INET)
-		check_ip_options(sock, ntop);
-
 	ipv64_normalise_mapped(&from, &fromlen);

 	if (from.ss_family == AF_INET6)
@@ -55,6 +52,9 @@ get_remote_hostname(int sock, int use_dns)
 	    NULL, 0, NI_NUMERICHOST) != 0)
 		fatal("get_remote_hostname: getnameinfo NI_NUMERICHOST failed");

+	if (from.ss_family == AF_INET)
+		check_ip_options(sock, ntop);
+
 	if (!use_dns)
 		return xstrdup(ntop);

@@ -39,7 +39,7 @@
 */

 #include "includes.h"
-RCSID("$OpenBSD: channels.c,v 1.223 2005/07/17 07:17:54 djm Exp $");
+RCSID("$OpenBSD: channels.c,v 1.224 2005/09/07 08:53:53 markus Exp $");

 #include "ssh.h"
 #include "ssh1.h"
@@ -2668,6 +2668,9 @@ x11_create_display_inet(int x11_display_offset, int x11_use_localhost,
 	char strport[NI_MAXSERV];
 	int gaierr, n, num_socks = 0, socks[NUM_SOCKS];

+	if (chanids == NULL)
+		return -1;
+
 	for (display_number = x11_display_offset;
 	    display_number < MAX_DISPLAYS;
 	    display_number++) {
@@ -2749,8 +2752,7 @@ x11_create_display_inet(int x11_display_offset, int x11_use_localhost,
 	}

 	/* Allocate a channel for each socket. */
-	if (chanids != NULL)
-		*chanids = xmalloc(sizeof(**chanids) * (num_socks + 1));
+	*chanids = xmalloc(sizeof(**chanids) * (num_socks + 1));
 	for (n = 0; n < num_socks; n++) {
 		sock = socks[n];
 		nc = channel_new("x11 listener",
@@ -2758,11 +2760,9 @@ x11_create_display_inet(int x11_display_offset, int x11_use_localhost,
 		    CHAN_X11_WINDOW_DEFAULT, CHAN_X11_PACKET_DEFAULT,
 		    0, "X11 inet listener", 1);
 		nc->single_connection = single_connection;
-		if (*chanids != NULL)
-			(*chanids)[n] = nc->self;
+		(*chanids)[n] = nc->self;
 	}
-	if (*chanids != NULL)
-		(*chanids)[n] = -1;
+	(*chanids)[n] = -1;

 	/* Return the display number for the DISPLAY environment variable. */
 	*display_numberp = display_number;
@@ -59,7 +59,7 @@
 */

 #include "includes.h"
-RCSID("$OpenBSD: clientloop.c,v 1.141 2005/07/16 01:35:24 djm Exp $");
+RCSID("$OpenBSD: clientloop.c,v 1.142 2005/09/09 19:18:05 markus Exp $");

 #include "ssh.h"
 #include "ssh1.h"
@@ -266,7 +266,7 @@ client_x11_get_proto(const char *display, const char *xauth_path,
 			}
 		}
 		snprintf(cmd, sizeof(cmd),
-		    "%s %s%s list %s . 2>" _PATH_DEVNULL,
+		    "%s %s%s list %s 2>" _PATH_DEVNULL,
 		    xauth_path,
 		    generated ? "-f " : "" ,
 		    generated ? xauthfile : "",
@@ -1,4 +1,4 @@
-# $Id: configure.ac,v 1.292 2005/08/31 16:59:49 tim Exp $
+# $Id: configure.ac,v 1.292.2.6 2005/10/25 08:37:52 dtucker Exp $
 #
 # Copyright (c) 1999-2004 Damien Miller
 #
@@ -103,70 +103,6 @@ if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
 	fi
 fi

-if test -z "$have_llong_max"; then
-	AC_MSG_CHECKING([for max value of long long])
-	AC_RUN_IFELSE(
-		[AC_LANG_SOURCE([[
-#include <stdio.h>
-/* Why is this so damn hard? */
-#ifdef __GNUC__
-# undef __GNUC__
-#endif
-#define __USE_ISOC99
-#include <limits.h>
-#define DATA "conftest.llminmax"
-int main(void) {
-	FILE *f;
-	long long i, llmin, llmax = 0;
-
-	if((f = fopen(DATA,"w")) == NULL)
-		exit(1);
-
-#if defined(LLONG_MIN) && defined(LLONG_MAX)
-	fprintf(stderr, "Using system header for LLONG_MIN and LLONG_MAX\n");
-	llmin = LLONG_MIN;
-	llmax = LLONG_MAX;
-#else
-	fprintf(stderr, "Calculating  LLONG_MIN and LLONG_MAX\n");
-	/* This will work on one's complement and two's complement */
-	for (i = 1; i > llmax; i <<= 1, i++)
-		llmax = i;
-	llmin = llmax + 1LL;	/* wrap */
-#endif
-
-	/* Sanity check */
-	if (llmin + 1 < llmin || llmin - 1 < llmin || llmax + 1 > llmax
-	    || llmax - 1 > llmax) {
-		fprintf(f, "unknown unknown\n");
-		exit(2);
-	}
-
-	if (fprintf(f ,"%lld %lld", llmin, llmax) < 0)
-		exit(3);
-
-	exit(0);
-}
-		]])],
-		[
-			llong_min=`$AWK '{print $1}' conftest.llminmax`
-			llong_max=`$AWK '{print $2}' conftest.llminmax`
-			AC_MSG_RESULT($llong_max)
-			AC_DEFINE_UNQUOTED(LLONG_MAX, [${llong_max}LL],
-			    [max value of long long calculated by configure])
-			AC_MSG_CHECKING([for min value of long long])
-			AC_MSG_RESULT($llong_min)
-			AC_DEFINE_UNQUOTED(LLONG_MIN, [${llong_min}LL],
-			    [min value of long long calculated by configure])
-		],
-		[
-			AC_MSG_RESULT(not found)
-		],
-		[
-			AC_MSG_WARN([cross compiling: not checking])
-		]
-	)
-fi
-
 AC_ARG_WITH(rpath,
 	[  --without-rpath         Disable auto-added -R linker paths],
 	[
@@ -276,6 +212,7 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
 	AC_DEFINE(LOGIN_NEEDS_UTMPX)
 	AC_DEFINE(LOCKED_PASSWD_STRING, "*")
 	AC_DEFINE(SPT_TYPE,SPT_PSTAT)
+	MAIL="/var/mail/username"
 	LIBS="$LIBS -lsec"
 	AC_CHECK_LIB(xnet, t_error, ,
 	    AC_MSG_ERROR([*** -lxnet needed on HP-UX - check config.log ***]))
@@ -358,6 +295,7 @@ mips-sony-bsd|mips-sony-newsos4)
 	;;
 *-*-freebsd*)
 	check_for_libcrypt_later=1
+	AC_DEFINE(LOCKED_PASSWD_PREFIX, "*LOCKED*", [Account locked with pw(1)])
 	;;
 *-*-bsdi*)
 	AC_DEFINE(SETEUID_BREAKS_SETUID)
@@ -715,8 +653,8 @@ AC_CHECK_FUNCS(dirname, [AC_CHECK_HEADERS(libgen.h)] ,[
 			ac_cv_have_broken_dirname, [
 			save_LIBS="$LIBS"
 			LIBS="$LIBS -lgen"
-			AC_TRY_RUN(
-				[
+			AC_RUN_IFELSE(
+				[AC_LANG_SOURCE([[
 #include <libgen.h>
 #include <string.h>

@@ -731,9 +669,10 @@ int main(int argc, char **argv) {
 	exit(0);
    }
 }
-				],
+				]])],
+				[ ac_cv_have_broken_dirname="no" ],
+				[ ac_cv_have_broken_dirname="yes" ],
 				[ ac_cv_have_broken_dirname="no" ],
-				[ ac_cv_have_broken_dirname="yes" ]
 			)
 			LIBS="$save_LIBS"
 		])
@@ -940,12 +879,12 @@ AC_ARG_WITH(skey,
 			SKEY_MSG="yes"

 			AC_MSG_CHECKING([for s/key support])
-			AC_TRY_RUN(
-				[
+			AC_LINK_IFELSE(
+				[AC_LANG_SOURCE([[
 #include <stdio.h>
 #include <skey.h>
 int main() { char *ff = skey_keyinfo(""); ff=""; exit(0); }
-				],
+				]])],
 				[AC_MSG_RESULT(yes)],
 				[
 					AC_MSG_RESULT(no)
@@ -1027,8 +966,12 @@ AC_ARG_WITH(libedit,
 	[  --with-libedit[[=PATH]]   Enable libedit support for sftp],
 	[ if test "x$withval" != "xno" ; then
 		if test "x$withval" != "xyes"; then
-			CPPFLAGS="$CPPFLAGS -I$withval/include"
-			LDFLAGS="$LDFLAGS -L$withval/lib"
+			CPPFLAGS="$CPPFLAGS -I${withval}/include"
+			if test -n "${need_dash_r}"; then
+				LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
+			else
+				LDFLAGS="-L${withval}/lib ${LDFLAGS}"
+			fi
 		fi
 		AC_CHECK_LIB(edit, el_init,
 			[ AC_DEFINE(USE_LIBEDIT, [], [Use libedit for sftp])
@@ -1300,15 +1243,15 @@ fi
 dnl see whether mkstemp() requires XXXXXX
 if test "x$ac_cv_func_mkdtemp" = "xyes" ; then
 AC_MSG_CHECKING([for (overly) strict mkstemp])
-AC_TRY_RUN(
-	[
+AC_RUN_IFELSE(
+	[AC_LANG_SOURCE([[
 #include <stdlib.h>
 main() { char template[]="conftest.mkstemp-test";
 if (mkstemp(template) == -1)
 	exit(1);
 unlink(template); exit(0);
 }
-	],
+	]])],
 	[
 		AC_MSG_RESULT(no)
 	],
@@ -1326,8 +1269,8 @@ fi
 dnl make sure that openpty does not reacquire controlling terminal
 if test ! -z "$check_for_openpty_ctty_bug"; then
 	AC_MSG_CHECKING(if openpty correctly handles controlling tty)
-	AC_TRY_RUN(
-		[
+	AC_RUN_IFELSE(
+		[AC_LANG_SOURCE([[
 #include <stdio.h>
 #include <sys/fcntl.h>
 #include <sys/types.h>
@@ -1359,13 +1302,16 @@ main()
 			exit(0);	/* Did not acquire ctty: OK */
 	}
 }
-		],
+		]])],
 		[
 			AC_MSG_RESULT(yes)
 		],
 		[
 			AC_MSG_RESULT(no)
 			AC_DEFINE(SSHD_ACQUIRES_CTTY)
+		],
+		[
+			AC_MSG_RESULT(cross-compiling, assuming yes)
 		]
 	)
 fi
@@ -1373,8 +1319,8 @@ fi
 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
    test "x$check_for_hpux_broken_getaddrinfo" = "x1"; then
 	AC_MSG_CHECKING(if getaddrinfo seems to work)
-	AC_TRY_RUN(
-		[
+	AC_RUN_IFELSE(
+		[AC_LANG_SOURCE([[
 #include <stdio.h>
 #include <sys/socket.h>
 #include <netdb.h>
@@ -1428,13 +1374,16 @@ main(void)
 	}
 	exit(0);
 }
-		],
+		]])],
 		[
 			AC_MSG_RESULT(yes)
 		],
 		[
 			AC_MSG_RESULT(no)
 			AC_DEFINE(BROKEN_GETADDRINFO)
+		],
+		[
+			AC_MSG_RESULT(cross-compiling, assuming yes)
 		]
 	)
 fi
@@ -1442,8 +1391,8 @@ fi
 if test "x$ac_cv_func_getaddrinfo" = "xyes" && \
    test "x$check_for_aix_broken_getaddrinfo" = "x1"; then
 	AC_MSG_CHECKING(if getaddrinfo seems to work)
-	AC_TRY_RUN(
-		[
+	AC_RUN_IFELSE(
+		[AC_LANG_SOURCE([[
 #include <stdio.h>
 #include <sys/socket.h>
 #include <netdb.h>
@@ -1485,7 +1434,7 @@ main(void)
 	}
 	exit(0);
 }
-		],
+		]])],
 		[
 			AC_MSG_RESULT(yes)
 			AC_DEFINE(AIX_GETNAMEINFO_HACK, [],
@@ -1494,6 +1443,8 @@ main(void)
 		[
 			AC_MSG_RESULT(no)
 			AC_DEFINE(BROKEN_GETADDRINFO)
+		],
+			AC_MSG_RESULT(cross-compiling, assuming no)
 		]
 	)
 fi
@@ -1953,6 +1904,84 @@ if test "x$ac_cv_sizeof_long_long_int" = "x4" ; then
 	ac_cv_sizeof_long_long_int=0
 fi

+# compute LLONG_MIN and LLONG_MAX if we don't know them.
+if test -z "$have_llong_max"; then
+	AC_MSG_CHECKING([for max value of long long])
+	AC_RUN_IFELSE(
+		[AC_LANG_SOURCE([[
+#include <stdio.h>
+/* Why is this so damn hard? */
+#ifdef __GNUC__
+# undef __GNUC__
+#endif
+#define __USE_ISOC99
+#include <limits.h>
+#define DATA "conftest.llminmax"
+int main(void) {
+	FILE *f;
+	long long i, llmin, llmax = 0;
+
+	if((f = fopen(DATA,"w")) == NULL)
+		exit(1);
+
+#if defined(LLONG_MIN) && defined(LLONG_MAX)
+	fprintf(stderr, "Using system header for LLONG_MIN and LLONG_MAX\n");
+	llmin = LLONG_MIN;
+	llmax = LLONG_MAX;
+#else
+	fprintf(stderr, "Calculating  LLONG_MIN and LLONG_MAX\n");
+	/* This will work on one's complement and two's complement */
+	for (i = 1; i > llmax; i <<= 1, i++)
+		llmax = i;
+	llmin = llmax + 1LL;	/* wrap */
+#endif
+
+	/* Sanity check */
+	if (llmin + 1 < llmin || llmin - 1 < llmin || llmax + 1 > llmax
+	    || llmax - 1 > llmax) {
+		fprintf(f, "unknown unknown\n");
+		exit(2);
+	}
+
+	if (fprintf(f ,"%lld %lld", llmin, llmax) < 0)
+		exit(3);
+
+	exit(0);
+}
+		]])],
+		[
+			llong_min=`$AWK '{print $1}' conftest.llminmax`
+			llong_max=`$AWK '{print $2}' conftest.llminmax`
+
+			# snprintf on some Tru64s doesn't understand "%lld"
+			case "$host" in
+			alpha-dec-osf*)
+				if test "x$ac_cv_sizeof_long_long_int" = "x8" &&
+				  test "x$llong_max" = "xld"; then
+					llong_min="-9223372036854775808"
+					llong_max="9223372036854775807"
+				fi
+				;;
+			esac
+
+			AC_MSG_RESULT($llong_max)
+			AC_DEFINE_UNQUOTED(LLONG_MAX, [${llong_max}LL],
+			    [max value of long long calculated by configure])
+			AC_MSG_CHECKING([for min value of long long])
+			AC_MSG_RESULT($llong_min)
+			AC_DEFINE_UNQUOTED(LLONG_MIN, [${llong_min}LL],
+			    [min value of long long calculated by configure])
+		],
+		[
+			AC_MSG_RESULT(not found)
+		],
+		[
+			AC_MSG_WARN([cross compiling: not checking])
+		]
+	)
+fi
+
+
 # More checks for data types
 AC_CACHE_CHECK([for u_int type], ac_cv_have_u_int, [
 	AC_TRY_COMPILE(
@@ -2956,16 +2985,19 @@ AC_ARG_ENABLE(etc-default-login,
 	  else
 		etc_default_login=yes
 	  fi ],
-	[ etc_default_login=yes ]
+	[ if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes";
+	  then
+		AC_MSG_WARN([cross compiling: not checking /etc/default/login])
+		etc_default_login=no
+	  else
+		etc_default_login=yes
+	  fi ]
 )

 if test "x$etc_default_login" != "xno"; then
 	AC_CHECK_FILE("/etc/default/login",
 	    [ external_path_file=/etc/default/login ])
-	if test ! -z "$cross_compiling" && test "x$cross_compiling" = "xyes";
-	then
-		AC_MSG_WARN([cross compiling: Disabling /etc/default/login test])
-	elif test "x$external_path_file" = "x/etc/default/login"; then
+	if test "x$external_path_file" = "x/etc/default/login"; then
 		AC_DEFINE(HAVE_ETC_DEFAULT_LOGIN)
 	fi
 fi
@@ -3003,8 +3035,8 @@ $external_path_file .])
 If PATH is defined in $external_path_file, ensure the path to scp is included,
 otherwise scp will not work.])
 		fi
-		AC_TRY_RUN(
-			[
+		AC_RUN_IFELSE(
+			[AC_LANG_SOURCE([[
 /* find out what STDPATH is */
 #include <stdio.h>
 #ifdef HAVE_PATHS_H
@@ -3036,7 +3068,8 @@ main()

 	exit(0);
 }
-		], [ user_path=`cat conftest.stdpath` ],
+		]])],
+		[ user_path=`cat conftest.stdpath` ],
 		[ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ],
 		[ user_path="/usr/bin:/bin:/usr/sbin:/sbin" ]
 	)
@@ -25,7 +25,7 @@
 #ifndef _DEFINES_H
 #define _DEFINES_H

-/* $Id: defines.h,v 1.127 2005/08/31 16:59:49 tim Exp $ */
+/* $Id: defines.h,v 1.128 2005/09/09 05:04:59 tim Exp $ */


 /* Constants */
@@ -688,7 +688,7 @@ struct winsize {
 # define CUSTOM_SYS_AUTH_PASSWD 1
 #endif

-#if defined(HAVE_LIBIAF)  &&  !defined(BROKEN_LIBIAF)
+#ifdef HAVE_LIBIAF
 # define CUSTOM_SYS_AUTH_PASSWD 1
 #endif

@@ -834,9 +834,7 @@ mm_answer_pam_account(int sock, Buffer *m)
 	ret = do_pam_account();

 	buffer_put_int(m, ret);
-	buffer_append(&loginmsg, "\0", 1);
-	buffer_put_cstring(m, buffer_ptr(&loginmsg));
-	buffer_clear(&loginmsg);
+	buffer_put_string(m, buffer_ptr(&loginmsg), buffer_len(&loginmsg));

 	mm_request_send(sock, MONITOR_ANS_PAM_ACCOUNT, m);

@@ -18,7 +18,7 @@
 #include "includes.h"
 #include "xmalloc.h"

-RCSID("$Id: bsd-misc.c,v 1.27 2005/05/27 11:13:41 dtucker Exp $");
+RCSID("$Id: bsd-misc.c,v 1.27.2.1 2005/11/01 22:06:50 dtucker Exp $");

 #ifndef HAVE___PROGNAME
 char *__progname;
@@ -223,10 +223,7 @@ strdup(const char *str)
 	len = strlen(str) + 1;
 	cp = malloc(len);
 	if (cp != NULL)
-		if (strlcpy(cp, str, len) != len) {
-			free(cp);
-			return NULL;
-		}
-	return cp;
+		return(memcpy(cp, str, len));
+	return NULL;
 }
 #endif
@@ -1,4 +1,4 @@
-/* $Id: openbsd-compat.h,v 1.30 2005/08/26 20:15:20 tim Exp $ */
+/* $Id: openbsd-compat.h,v 1.30.2.1 2005/09/29 23:55:14 dtucker Exp $ */

 /*
 * Copyright (c) 1999-2003 Damien Miller.  All rights reserved.
@@ -152,6 +152,10 @@ int openpty(int *, int *, char *, struct termios *, struct winsize *);
 int snprintf(char *, size_t, const char *, ...);
 #endif 

+#ifndef HAVE_STRTOLL
+long long strtoll(const char *, char **, int);
+#endif
+
 #ifndef HAVE_STRTONUM
 long long strtonum(const char *, long long, long long, const char **);
 #endif
@@ -25,7 +25,7 @@

 #include "includes.h"

-#if defined(HAVE_LIBIAF)  &&  !defined(BROKEN_LIBIAF)
+#ifdef HAVE_LIBIAF
 #ifdef HAVE_CRYPT_H
 #include <crypt.h>
 #endif
@@ -42,7 +42,6 @@ int
 sys_auth_passwd(Authctxt *authctxt, const char *password)
 {
 	struct passwd *pw = authctxt->pw;
-	char *encrypted_password;
 	char *salt;
 	int result;

@@ -55,21 +54,24 @@ sys_auth_passwd(Authctxt *authctxt, const char *password)

 	/* Encrypt the candidate password using the proper salt. */
 	salt = (pw_password[0] && pw_password[1]) ? pw_password : "xx";
-#ifdef UNIXWARE_LONG_PASSWORDS
-	if (!nischeck(pw->pw_name))
-		encrypted_password = bigcrypt(password, salt);
-	else
-#endif /* UNIXWARE_LONG_PASSWORDS */
-		encrypted_password = xcrypt(password, salt);

 	/*
 	 * Authentication is accepted if the encrypted passwords
 	 * are identical.
 	 */
-	result = (strcmp(encrypted_password, pw_password) == 0);
+#ifdef UNIXWARE_LONG_PASSWORDS
+	if (!nischeck(pw->pw_name)) {
+		result = ((strcmp(bigcrypt(password, salt), pw_password) == 0)
+		||  (strcmp(osr5bigcrypt(password, salt), pw_password) == 0));
+	}
+	else
+#endif /* UNIXWARE_LONG_PASSWORDS */
+		result = (strcmp(xcrypt(password, salt), pw_password) == 0);

+#if !defined(BROKEN_LIBIAF)
 	if (authctxt->valid)
 		free(pw_password);
+#endif
 	return(result);
 }

@@ -114,6 +116,7 @@ nischeck(char *namep)
 	functions that call shadow_pw() will need to free
 */

+#if !defined(BROKEN_LIBIAF)
 char *
 get_iaf_password(struct passwd *pw)
 {
@@ -130,5 +133,6 @@ get_iaf_password(struct passwd *pw)
 	else
 		fatal("ia_openinfo: Unable to open the shadow passwd file");
 }
-#endif /* HAVE_LIBIAF  && !BROKEN_LIBIAF */
+#endif /* !BROKEN_LIBIAF */
+#endif /* HAVE_LIBIAF */

@@ -34,7 +34,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: ssh.1,v 1.209 2005/07/06 09:33:05 dtucker Exp $
+.\" $OpenBSD: ssh.1,v 1.210 2005/09/19 11:37:34 djm Exp $
 .Dd September 25, 1999
 .Dt SSH 1
 .Os
@@ -47,7 +47,12 @@
 .Op Fl 1246AaCfgkMNnqsTtVvXxY
 .Op Fl b Ar bind_address
 .Op Fl c Ar cipher_spec
-.Op Fl D Ar port
+.Oo Fl D\ \&
+.Sm off
+.Oo Ar bind_address : Oc
+.Ar port
+.Sm on
+.Oc
 .Op Fl e Ar escape_char
 .Op Fl F Ar configfile
 .Op Fl i Ar identity_file
@@ -494,13 +499,20 @@ The default is
    arcfour256,arcfour,aes192-cbc,aes256-cbc,aes128-ctr,
    aes192-ctr,aes256-ctr''
 .Ed
-.It Fl D Ar port
+.It Fl D Xo
+.Sm off
+.Oo Ar bind_address : Oc
+.Ar port
+.Sm on
+.Xc
 Specifies a local
 .Dq dynamic
 application-level port forwarding.
 This works by allocating a socket to listen to
 .Ar port
-on the local side, and whenever a connection is made to this port, the
+on the local side, optionally bound to the specified
+.Ar bind_address .
+Whenever a connection is made to this port, the
 connection is forwarded over the secure channel, and the application
 protocol is then used to determine where to connect to from the
 remote machine.
@@ -509,6 +521,30 @@ Currently the SOCKS4 and SOCKS5 protocols are supported, and
 will act as a SOCKS server.
 Only root can forward privileged ports.
 Dynamic port forwardings can also be specified in the configuration file.
+.Pp
+IPv6 addresses can be specified with an alternative syntax:
+.Sm off
+.Xo
+.Op Ar bind_address No /
+.Ar port
+.Xc
+.Sm on
+or by enclosing the address in square brackets.
+Only the superuser can forward privileged ports.
+By default, the local port is bound in accordance with the
+.Cm GatewayPorts
+setting.
+However, an explicit
+.Ar bind_address
+may be used to bind the connection to a specific address.
+The
+.Ar bind_address
+of
+.Dq localhost
+indicates that the listening port be bound for local use only, while an
+empty address or
+.Sq *
+indicates that the port should be available from all interfaces.
 .It Fl e Ar ch | ^ch | none
 Sets the escape character for sessions with a pty (default:
 .Ql ~ ) .
@@ -34,7 +34,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: ssh_config.5,v 1.61 2005/07/08 12:53:10 jmc Exp $
+.\" $OpenBSD: ssh_config.5,v 1.62 2005/09/19 11:37:34 djm Exp $
 .Dd September 25, 1999
 .Dt SSH_CONFIG 5
 .Os
@@ -320,7 +320,29 @@ Specifies that a TCP/IP port on the local machine be forwarded
 over the secure channel, and the application
 protocol is then used to determine where to connect to from the
 remote machine.
-The argument must be a port number.
+.Pp
+The argument must be
+.Sm off
+.Oo Ar bind_address : Oc Ar port .
+.Sm on
+IPv6 addresses can be specified by enclosing addresses in square brackets or
+by using an alternative syntax:
+.Oo Ar bind_address Ns / Oc Ns Ar port .
+By default, the local port is bound in accordance with the
+.Cm GatewayPorts
+setting.
+However, an explicit
+.Ar bind_address
+may be used to bind the connection to a specific address.
+The
+.Ar bind_address
+of
+.Dq localhost
+indicates that the listening port be bound for local use only, while an
+empty address or
+.Sq *
+indicates that the port should be available from all interfaces.
+.Pp
 Currently the SOCKS4 and SOCKS5 protocols are supported, and
 .Nm ssh
 will act as a SOCKS server.
@@ -123,7 +123,10 @@ on Solaris,
 .Ql \&*
 on HP-UX, containing
 .Ql Nologin
-on Tru64 and a leading
+on Tru64,
+a leading
+.Ql \&*LOCKED\&*
+on FreeBSD and a leading
 .Ql \&!!
 on Linux).  If there is a requirement to disable password authentication
 for the account while allowing still public-key, then the passwd field
@@ -42,7 +42,7 @@
 */

 #include "includes.h"
-RCSID("$OpenBSD: sshd.c,v 1.312 2005/07/25 11:59:40 markus Exp $");
+RCSID("$OpenBSD: sshd.c,v 1.314 2005/09/19 11:47:09 djm Exp $");

 #include <openssl/dh.h>
 #include <openssl/bn.h>
@@ -633,9 +633,8 @@ privsep_postauth(Authctxt *authctxt)
 	if (authctxt->pw->pw_uid == 0 || options.use_login) {
 #endif
 		/* File descriptor passing is broken or root login */
-		monitor_apply_keystate(pmonitor);
 		use_privsep = 0;
-		return;
+		goto out;
 	}

 	/* Authentication complete */
@@ -669,6 +668,7 @@ privsep_postauth(Authctxt *authctxt)
 	/* Drop privileges */
 	do_setusercontext(authctxt->pw);

+ out:
 	/* It is safe now to apply the key state */
 	monitor_apply_keystate(pmonitor);
Author	SHA1	Message	Date
Darren Tucker	e8121e2215	- (dtucker) [openbsd-compat/bsd-misc.c] Bug #1108 : fix broken strdup(). Reported by olavi at ipunplugged.com and antoine.brodin at laposte.net via FreeBSD.	2005-11-02 09:06:50 +11:00
Darren Tucker	aa080fd376	- (dtucker) [configure.ac] Bug #1104 : Tru64's printf family doesn't understand "%lld", even though the compiler has "long long", so handle it as a special case. Patch tested by mcaskill.scott at epa.gov. (actually, was included in previous commit)	2005-10-25 18:51:48 +10:00
Darren Tucker	a0e7f10508	- (dtucker) [configure.ac] Relocate LLONG_MAX calculation to after the sizeof(long long) checks, to make fixing bug #1104 easier (no changes yet).	2005-10-25 18:37:51 +10:00
Darren Tucker	314c1be7e2	- (dtucker) [configure.ac] Bug #1097 : Fix configure for cross-compiling. /etc/default/login report and testing from aabaker at iee.org, corrections from tim@.	2005-10-17 23:29:09 +10:00
Darren Tucker	f99940bb9f	- (dtucker) [configure.ac] Bug #1098 : define $MAIL for HP-UX; report from brian.smith at agilent com.	2005-10-08 12:06:30 +10:00
Darren Tucker	52582a9535	typo	2005-10-06 01:40:43 +10:00
Darren Tucker	7bb9f1cbf8	typo	2005-10-05 23:03:23 +10:00
Darren Tucker	da11f7bb52	- (dtucker) [configure.ac sshd.8] Enable locked account check (a prepended "LOCKED" string) for FreeBSD. Patch jeremie at le-hen.org and senthilkumar_sen at hotpop.com.	2005-10-05 22:59:08 +10:00
Darren Tucker	c99ee82478	- [email protected] 2005/10/03 07:44:42 [canohost.c] Relocate check_ip_options call to prevent logging of garbage for connections with IP options set. bz#1092 from David Leonard, "looks good" deraadt@	2005-10-03 18:23:57 +10:00
Darren Tucker	bc9f9699ec	- [email protected] 2005/09/19 11:47:09 [sshd.c] stop connection abort on rekey with delayed compression enabled when post-auth privsep is disabled (e.g. when root is logged in); ok dtucker@	2005-10-03 18:16:27 +10:00
Darren Tucker	6a2798f655	- [email protected] 2005/09/19 11:37:34 [ssh_config.5 ssh.1] mention ability to specify bind_address for DynamicForward and -D options; bz#1077 spotted by Haruyama Seigo	2005-10-03 18:14:14 +10:00
Darren Tucker	4cc0fae3a9	- [email protected] 2005/09/09 19:18:05 [clientloop.c] typo; from mark at mcs.vuw.ac.nz, bug #1082	2005-10-03 18:05:43 +10:00
Darren Tucker	303fa18d3e	- [email protected] 2005/09/07 08:53:53 [channels.c] enforce chanid != NULL; ok djm	2005-10-03 18:03:33 +10:00
Darren Tucker	8c4d25fd31	- (dtucker) [auth-pam.c] Bug #1028 : send final non-query messages from PAM via keyboard-interactive. Patch tested by the folks at Vintela.	2005-09-30 10:55:17 +10:00
Darren Tucker	da221e306f	- (dtucker) [monitor.c] Bug #1087 : Send loginmsg to preauth privsep child during PAM account check without clearing it. This restores the post-login warnings such as LDAP password expiry. Patch from Tomas Mraz with help from several others.	2005-09-30 10:22:45 +10:00
Darren Tucker	e4b1734886	- (dtucker) [openbsd-compat/openbsd-compat.h] Bug #1096 : Add prototype for strtoll. Patch from o.flebbe at science-computing.de.	2005-09-30 09:55:12 +10:00
Darren Tucker	310c18b342	- (dtucker) [configure.ac] Use -R linker flag for libedit too; patch from skeleten at shillest.net.	2005-09-22 20:14:24 +10:00
Tim Rice	542f62b9d2	remove acconfig.h	2005-09-19 09:36:55 -07:00
Tim Rice	7df8d39a5f	- (tim) [aclocal.m4 configure.ac] Delete acconfig.h and add templates to AC_DEFINE and AC_DEFINE_UNQUOTED to quiet autoconf 2.59 warning messages.	2005-09-19 09:33:39 -07:00
Tim Rice	fd9e9e3ba6	- (tim) [configure.ac] Bug 1078. Fix --without-kerberos5. Reported by Mike Frysinger.	2005-09-12 17:36:10 -07:00
Tim Rice	784d4f538f	Last commit skipped defines.h - (tim) [defines.h openbsd-compat/port-uw.c] Add long password support to OpenServer 6 and add osr5bigcrypt support so when someone migrates passwords between UnixWare and OpenServer they will still work. OK dtucker@	2005-09-08 22:04:59 -07:00
Tim Rice	64ead485ac	- (tim) [defines.h openbsd-compat/port-uw.c] Add long password support to OpenServer 6 and add osr5bigcrypt support so when someone migrates passwords between UnixWare and OpenServer they will still work. OK dtucker@	2005-09-08 21:56:33 -07:00