- (djm) bz#1325: Fix SELinux in permissive mode where it would

incorrectly fatal() on errors. patch from cjwatson AT debian.org; ok dtucker (backport from current)
- [email protected] 2007/06/14 22:48:05
2007-06-28 10:07:43 +10:00 · 2007-06-25 18:59:31 +10:00 · 2007-06-25 18:43:03 +10:00 · 2007-06-25 18:35:49 +10:00 · 2007-06-25 18:33:56 +10:00 · 2007-06-12 23:49:11 +10:00
76 changed files with 402 additions and 2575 deletions
@@ -1,78 +1,3 @@
-20070817
- - (dtucker) [sshd.8] Many Linux variants use a single "!" to denote locked
-   accounts and that's what the code looks for, so make man page and code
-   agree.  Pointed out by Roumen Petrov.
- - (dtucker) [INSTALL] Group the parts describing random options and PAM
-   implementations together which is hopefully more coherent.
- - (dtucker) [INSTALL] the pid file is sshd.pid not ssh.pid.
- - (dtucker) [INSTALL] Give PAM its own heading.
- - (dtucker) [INSTALL] Link to tcpwrappers.
-
-20070816
- - (dtucker) [session.c] Call PAM cleanup functions for unauthenticated
-   connections too.  Based on a patch from Sandro Wefel, with & ok djm@
-
-20070815
- - (dtucker) OpenBSD CVS Sync
-   - [email protected] 2007/08/15 08:14:46
-     [clientloop.c]
-     do NOT fall back to the trused x11 cookie if generation of an untrusted
-     cookie fails; from Jan Pechanec, via security-alert at sun.com;
-     ok dtucker
-   - [email protected] 2007/08/15 08:16:49
-     [version.h]
-     openssh 4.7
-   - [email protected] 2007/08/15 12:13:41
-     [ssh_config.5]
-     tun device forwarding now honours ExitOnForwardFailure; ok markus@
- - (dtucker) [openbsd-compat/bsd-cray.c] Remove debug from signal handler.
-   ok djm@
- - (dtucker) [README contrib/caldera/openssh.spec contrib/redhat/openssh.spec
-   contrib/suse/openssh.spec] Crank version.
-
-20070813
- - (dtucker) [session.c] Bug #1339: ensure that pam_setcred() is always
-   called with PAM_ESTABLISH_CRED at least once, which resolves a problem
-   with pam_dhkeys.  Patch from David Leonard, ok djm@
-
-20070810
- - (dtucker) [auth-pam.c] Use sigdie here too.  ok djm@
- - (dtucker) [configure.ac] Bug #1343: Set DISABLE_FD_PASSING for QNX6. From 
-   Matt Kraai, ok djm@ 
-
-20070809
- - (dtucker) [openbsd-compat/port-aix.c] Comment typo.
- - (dtucker) [README.platform] Document the interaction between PermitRootLogin
-   and the AIX native login restrictions.
- - (dtucker) [defines.h] Remove _PATH_{CSHELL,SHELLS} which aren't
-   used anywhere and are a potential source of warnings.
-
-20070808
- - (djm) OpenBSD CVS Sync
-   - [email protected] 2007/07/12 05:48:05
-     [key.c]
-     Delint: remove some unreachable statements, from Bret Lambert.
-     OK markus@ and dtucker@.
-   - [email protected] 2007/08/06 19:16:06
-     [scp.1 scp.c]
-     the ellipsis is not an optional argument; while here, sync the usage
-     and synopsis of commands
-     lots of good ideas by jmc@
-     ok jmc@
-   - [email protected] 2007/08/07 07:32:53
-     [clientloop.c clientloop.h ssh.c]
-     bz#1232: ensure that any specified LocalCommand is executed after the
-     tunnel device is opened. Also, make failures to open a tunnel device
-     fatal when ExitOnForwardFailure is active.
-     Reported by h.goebel AT goebel-consult.de; ok dtucker markus reyk deraadt
-
-20070724
- - (tim) [openssh.xml.in] make FMRI match what package scripts use.
- - (tim) [openbsd-compat/regress/closefromtest.c] Bug 1345: fix open() call.
-   Report/patch by David.Leonard AT quest.com (and Bernhard Simon)
- - (tim) [buildpkg.sh.in openssh.xml.in] Allow more flexibility where smf(5)
- - (tim) [buildpkg.sh.in] s|$FAKE_ROOT/${sysconfdir}|$FAKE_ROOT${sysconfdir}|
-
 20070628
 - (djm) bz#1325: Fix SELinux in permissive mode where it would
   incorrectly fatal() on errors. patch from cjwatson AT debian.org;
@@ -92,233 +17,48 @@
     when waiting for the multiplex exit status, read until the master end
     writes an entire int of data *and* closes the client_fd; fixes mux
     regression spotted by dtucker, ok dtucker@
-   - [email protected] 2007/06/19 02:04:43
-     [atomicio.c]
-     if the fd passed to atomicio/atomiciov() is non blocking, then poll() to
-     avoid a spin if it is not yet ready for reading/writing; ok dtucker@
-   - [email protected] 2007/06/25 08:20:03
-     [channels.c]
-     Correct test for window updates every three packets; prevents sending
-     window updates for every single packet.  ok markus@
-   - [email protected] 2007/06/25 12:02:27
-     [atomicio.c]
-     Include <poll.h> like the man page says rather than <sys/poll.h>.  ok djm@
- - (dtucker) [atomicio.c] Test for EWOULDBLOCK in atomiciov to match
-   atomicio.
- - (dtucker) [atomicio.c configure.ac openbsd-compat/Makefile.in
-   openbsd-compat/bsd-poll.{c,h} openbsd-compat/openbsd-compat.h]
-   Add an implementation of poll() built on top of select(2).  Code from
-   OpenNTPD with changes suggested by djm.  ok djm@
-
-20070614
- - (dtucker) [cipher-ctr.c umac.c openbsd-compat/openssl-compat.h] Move the
-   USE_BUILTIN_RIJNDAEL compat goop to openssl-compat.h so it can be
-   shared with umac.c.  Allows building with OpenSSL 0.9.5 again including
-   umac support.  With tim@ djm@, ok djm.
- - (dtucker) [openbsd-compat/openssl-compat.h] Merge USE_BUILTIN_RIJNDAEL
-   sections.  Fixes builds with early OpenSSL 0.9.6 versions.
- - (dtucker) [openbsd-compat/openssl-compat.h] Remove redundant definition
-   of USE_BUILTIN_RIJNDAEL since the <0.9.6 test is covered by the
-   subsequent <0.9.7 test.

 20070612
 - (dtucker) OpenBSD CVS Sync
-   - [email protected] 2007/06/11 09:14:00
-     [channels.h]
-     increase default channel windows; ok djm
-   - [email protected] 2007/06/12 07:41:00
-     [ssh-add.1]
-     better document ssh-add's -d option (delete identies from agent), bz#1224
-     new text based on some provided by andrewmc-debian AT celt.dias.ie;
-     ok dtucker@
-   - [email protected] 2007/06/12 08:20:00
-     [ssh-gss.h gss-serv.c gss-genr.c]
-     relocate server-only GSSAPI code from libssh to server; bz #1225
-     patch from simon AT sxw.org.uk; ok markus@ dtucker@
-   - [email protected] 2007/06/12 08:24:20
-     [scp.c]
-     make scp try to skip FIFOs rather than blocking when nothing is listening.
-     depends on the platform supporting sane O_NONBLOCK semantics for open
-     on FIFOs (apparently POSIX does not mandate this), which OpenBSD does.
-     bz #856; report by cjwatson AT debian.org; ok markus@
   - [email protected] 2007/06/12 11:11:08
     [ssh.c]
     fix slave exit value when a control master goes away without passing the
     full exit status by ensuring that the slave reads a full int. bz#1261
     reported by frekko AT gmail.com; ok markus@ dtucker@
-   - djm@cvs.openbsd.org 2007/06/12 11:15:17
-     [ssh.c ssh.1]
-     Add "-K" flag for ssh to set GSSAPIAuthentication=yes and
-     GSSAPIDelegateCredentials=yes. This is symmetric with -k (disable GSSAPI)
-     and is useful for hosts with /home on Kerberised NFS; bz #1312
-     patch from Markus.Kuhn AT cl.cam.ac.uk; ok dtucker@ markus@
-   - [email protected] 2007/06/12 11:45:27
-     [ssh.c]
-     improved exit message from multiplex slave sessions; bz #1262
-     reported by alexandre.nunes AT gmail.com; ok dtucker@
-   - [email protected] 2007/06/12 11:56:15
-     [gss-genr.c]
-     Pass GSS OID to gss_display_status to provide better information in
-     error messages.  Patch from Simon Wilkinson via bz 1220.  ok djm@
-   - [email protected] 2007/06/12 13:41:03
-     [ssh-add.1]
-     identies -> identities;
-   - [email protected] 2007/06/12 13:43:55
-     [ssh.1]
-     add -K to SYNOPSIS;
-   - [email protected] 2007/06/12 13:54:28
-     [scp.c]
-     Encode filename with strnvis if the name contains a newline (which can't
-     be represented in the scp protocol), from bz #891.  ok markus@
+  - dtucker@cvs.openbsd.org 2007/06/12 11:56:15
+    [gss-genr.c]
+    Pass GSS OID to gss_display_status to provide better information in
+    error messages.  Patch from Simon Wilkinson via bz 1220.  ok djm@

 20070611
 - (djm) Bugzilla #1306: silence spurious error messages from hang-on-exit
-   fix; tested by dtucker@ and jochen.kirn AT gmail.com
-   - [email protected] 2007/06/07 19:37:34
-     [kex.h mac.c mac.h monitor_wrap.c myproposal.h packet.c ssh.1]
-     [ssh_config.5 sshd.8 sshd_config.5]
-     Add a new MAC algorithm for data integrity, UMAC-64 (not default yet,
-     must specify [email protected]). Provides about 20% end-to-end speedup
-     compared to hmac-md5. Represents a different approach to message
-     authentication to that of HMAC that may be beneficial if HMAC based on
-     one of its underlying hash algorithms is found to be vulnerable to a
-     new attack.  http://www.ietf.org/rfc/rfc4418.txt
-     in conjunction with and OK djm@
-   - [email protected] 2007/06/08 04:40:40
-     [ssh_config]
-     Add a "MACs" line after "Ciphers" with the default MAC algorithms,
-     to ease people who want to tweak both (eg. for performance reasons).
-     ok deraadt@ djm@ dtucker@
-   - [email protected] 2007/06/08 07:43:46
-     [ssh_config.5]
-     put the MAC list into a display, like we do for ciphers,
-     since groff has trouble handling wide lines;
-   - [email protected] 2007/06/08 07:48:09
-     [sshd_config.5]
-     oops, here too: put the MAC list into a display, like we do for
-     ciphers, since groff has trouble with wide lines;
-   - [email protected] 2007/06/11 08:04:44
-     [channels.c]
-     send 'window adjust' messages every tree packets and do not wait
-     until 50% of the window is consumed.  ok djm dtucker
- - (djm) [configure.ac umac.c] If platform doesn't provide swap32(3), then
-   fallback to provided bit-swizzing functions
- - (dtucker) [openbsd-compat/bsd-misc.c] According to the spec the "remainder"
-   argument to nanosleep may be NULL.  Currently this never happens in OpenSSH,
-   but check anyway in case this changes or the code gets used elsewhere.
+   fix; tested by dtucker@ and jochen.kirn AT gmail.com (backport from HEAD)
 - (dtucker) [includes.h] Bug #1243: HAVE_PATHS -> HAVE_PATHS_H.  Should
   prevent warnings about redefinitions of various things in paths.h.
   Spotted by cartmanltd at hotmail.com.

 20070605
- - (dtucker) OpenBSD CVS Sync
-   - [email protected] 2007/05/22 10:18:52
-     [sshd.c]
-     zap double include; from p_nowaczyk AT o2.pl
-     (not required in -portable, Id sync only)
-   - [email protected] 2007/05/30 05:58:13
-     [kex.c]
-     tidy: KNF, ARGSUSED and u_int
-   - [email protected] 2007/05/31 19:20:16
-     [scp.1 ssh_config.5 sftp-server.8 ssh-agent.1 sshd_config.5 sftp.1
-     ssh-keygen.1 ssh-keyscan.1 ssh-add.1 sshd.8 ssh.1 ssh-keysign.8]
-     convert to new .Dd format;
-     (We will need to teach mdoc2man.awk to understand this too.)
-   - [email protected] 2007/05/31 23:34:29
-     [packet.c]
-     gc unreachable code; spotted by Tavis Ormandy
-   - [email protected] 2007/06/02 09:04:58
-     [bufbn.c]
-     memory leak on error path; from arnaud.lacombe.1 AT ulaval.ca
-   - [email protected] 2007/06/05 06:52:37
-     [kex.c monitor_wrap.c packet.c mac.h kex.h mac.c]
-     Preserve MAC ctx between packets, saving 2xhash calls per-packet.
-     Yields around a 12-16% end-to-end speedup for arcfour256/hmac-md5
-     patch from markus@ tested dtucker@ and myself, ok markus@ and me (I'm
-     committing at his request)
- - (dtucker) [mdoc2man.awk] Teach it to deal with $Mdocdate tags that
-   OpenBSD's cvs now adds.
- - (dtucker) [mdoc2man.awk] Remove trailing "$" from Mdocdate regex so
-   mindrot's cvs doesn't expand it on us.
- - (dtucker) [mdoc2man.awk] Add support for %R references, used for RFCs.
+ - (dtucker) [mdoc2man.awk] Sync with rev 1.8, mainly for %R reference
+   support used for RFCs.

 20070520
 - (dtucker) OpenBSD CVS Sync
-   - [email protected] 2007/04/14 22:01:58
-     [auth2.c]
-     remove unused macro; from Dmitry V. Levin <[email protected]>
-   - [email protected] 2007/04/18 01:12:43
-     [sftp-server.c]
-     cast "%llu" format spec to (unsigned long long); do not assume a
-     u_int64_t arg is the same as 'unsigned long long'.
-     from Dmitry V. Levin <[email protected]>
-     ok markus@ 'Yes, that looks correct' millert@
   - [email protected] 2007/04/23 10:15:39
     [servconf.c]
     Remove debug() left over from development.  ok deraadt@
-   - [email protected] 2007/05/17 07:50:31
-     [log.c]
-     save and restore errno when logging; ok deraadt@
-   - [email protected] 2007/05/17 07:55:29
-     [sftp-server.c]
-     bz#1286 stop reading and processing commands when input or output buffer
-     is nearly full, otherwise sftp-server would happily try to grow the
-     input/output buffers past the maximum supported by the buffer API and
-     promptly fatal()
-     based on patch from Thue Janus Kristensen; feedback & ok dtucker@
-   - [email protected] 2007/05/17 20:48:13
-     [sshconnect2.c]
-     fall back to gethostname() when the outgoing connection is not
-     on a socket, such as is the case when ProxyCommand is used.
-     Gives hostbased auth an opportunity to work; bz#616, report
-     and feedback stuart AT kaloram.com; ok markus@
-   - [email protected] 2007/05/17 20:52:13
-     [monitor.c]
-     pass received SIGINT from monitor to postauth child so it can clean
-     up properly. bz#1196, patch from senthilkumar_sen AT hotpop.com;
-     ok markus@
-   - [email protected] 2007/05/17 23:53:41
-     [sshconnect2.c]
-     djm owes me a vb and a tism cd for breaking ssh compilation
- - (dtucker) [auth-pam.c] malloc+memset -> calloc.  Patch from
-   ldv at altlinux.org.
- - (dtucker) [auth-pam.c] Return empty string if fgets fails in
-   sshpam_tty_conv.  Patch from ldv at altlinux.org.
-
-20070509
- - (tim) [configure.ac] Bug #1287: Add missing test for ucred.h.
+     (This fixes a null pointer deref on startup with Match+debug on some
+     platforms).

 20070429
- - (dtucker) [openbsd-compat/bsd-misc.c] Include unistd.h and sys/types.h
-   for select(2) prototype.
- - (dtucker) [auth-shadow.c loginrec.c] Include time.h for time(2) prototype.
 - (dtucker) [configure.ac openbsd-compat/getrrsetbyname.c] Bug #1299: Use the
   platform's _res if it has one.  Should fix problem of DNSSEC record lookups
   on NetBSD as reported by Curt Sampson.
- - (dtucker) [openbsd-compat/xmmap.c] Include stdlib.h for mkstemp prototype.
- - (dtucker) [configure.ac defines.h] Have configure check for MAXSYMLINKS
-   so we don't get redefinition warnings.
- - (dtucker) [openbsd-compat/xmmap.c] Include stdlib.h for mkstemp prototype.
- - (dtucker) [configure.ac defines.h] Prevent warnings about __attribute__
-   __nonnull__ for versions of GCC that don't support it.
- - (dtucker) [configure.ac defines.h] Have configure check for offsetof
-   to prevent redefinition warnings.
-
-20070406
- - (dtucker) [INSTALL] Update the systems that have PAM as standard.  Link
-   to OpenPAM too.
- - (dtucker) [INSTALL] prngd lives at sourceforge these days.

 20070326
 - (tim) [auth.c configure.ac defines.h session.c openbsd-compat/port-uw.c
   openbsd-compat/port-uw.h openbsd-compat/xcrypt.c] Rework libiaf test/defines
   to account for IRIX having libiaf but not set_id(). Patch with & ok dtucker@

-20070325
- - (dtucker) [Makefile.in configure.ac] Replace single-purpose LIBSELINUX,
-   LIBWRAP and LIBPAM variables in Makefile with the general-purpose
-   SSHDLIBS.  "I like" djm@
-
 20070321
 - (dtucker) OpenBSD CVS Sync
   - [email protected] 2007/03/09 05:20:06
@@ -327,44 +67,13 @@
     loaded, which makes ChallengeResponse default to yes again.  This
     was broken by the Match changes and not fixed properly subsequently.
     Found by okan at demirmen.com, ok djm@ "please do it" deraadt@
-   - [email protected] 2007/03/19 01:01:29
-     [sshd_config]
-     Disable the legacy SSH protocol 1 for new installations via
-     a configuration override. In the future, we will change the
-     server's default itself so users who need the legacy protocol
-     will need to turn it on explicitly
-   - [email protected] 2007/03/19 12:16:42
-     [ssh-agent.c]
-     Remove the signal handler that checks if the agent's parent process
-     has gone away, instead check when the select loop returns.  Record when
-     the next key will expire when scanning for expired keys.  Set the select
-     timeout to whichever of these two things happens next.  With djm@, with &
-     ok deraadt@ markus@
-   - [email protected] 2007/03/20 03:56:12
-     [readconf.c clientloop.c]
-     remove some bogus *p tests from charles longeau
-     ok deraadt millert
-   - [email protected] 2007/03/20 15:57:15
-     [sshd.8]
-     - let synopsis and description agree for -f
-     - sort FILES
-     - +.Xr ssh-keyscan 1 ,
-     from Igor Sobrado
- - (dtucker) [configure.ac openbsd-compat/bsd-getpeereid.c] Bug #1287: Use
-   getpeerucred to implement getpeereid (currently only Solaris 10 and up).
-   Patch by Jan.Pechanec at Sun.
- - (dtucker) [regress/agent-getpeereid.sh] Do peereid test if we have
-   HAVE_GETPEERUCRED too.  Also from Jan Pechanec.

 20070313
 - (dtucker) [entropy.c scard-opensc.c ssh-rand-helper.c] Bug #1294: include
   string.h to prevent warnings, from vapier at gentoo.org.
- - (dtucker) [LICENCE] Add Daniel Walsh as a copyright holder for the
-   selinux bits in -portable.
 - (dtucker) [cipher-3des1.c cipher-bf1.c] The OpenSSL 0.9.8e problem in
   bug #1291 also affects Protocol 1 3des.  While at it, use compat-openssl.h
   in cipher-bf1.c.  Patch from Juan Gallego.
- - (dtucker) [README.platform] Info about blibpath on AIX.

 20070306
 - (djm) OpenBSD CVS Sync
@@ -3184,4 +2893,4 @@
   OpenServer 6 and add osr5bigcrypt support so when someone migrates
   passwords between UnixWare and OpenServer they will still work. OK dtucker@

-$Id: ChangeLog,v 1.4738.2.1 2007/09/04 06:49:09 djm Exp $
+$Id: ChangeLog,v 1.4635.2.16 2007/06/28 00:07:43 dtucker Exp $
@@ -14,37 +14,17 @@ Blowfish) do not work correctly.)

 The remaining items are optional.

+OpenSSH can utilise Pluggable Authentication Modules (PAM) if your system
+supports it. PAM is standard on Redhat and Debian Linux, Solaris and
+HP-UX 11.
+
 NB. If you operating system supports /dev/random, you should configure
 OpenSSL to use it. OpenSSH relies on OpenSSL's direct support of
-/dev/random, or failing that, either prngd or egd.  If you don't have
-any of these you will have to rely on ssh-rand-helper, which is inferior
-to a good kernel-based solution or prngd.
-
-PRNGD:
-
-If your system lacks kernel-based random collection, the use of Lutz
-Jaenicke's PRNGd is recommended.
-
-http://prngd.sourceforge.net/
-
-EGD:
-
-The Entropy Gathering Daemon (EGD) is supported if you have a system which
-lacks /dev/random and don't want to use OpenSSH's internal entropy collection.
-
-http://www.lothar.com/tech/crypto/
+/dev/random. If you don't you will have to rely on ssh-rand-helper, which
+is inferior to a good kernel-based solution.

 PAM:
-
-OpenSSH can utilise Pluggable Authentication Modules (PAM) if your
-system supports it. PAM is standard most Linux distributions, Solaris,
-HP-UX 11, AIX >= 5.2, FreeBSD and NetBSD.
-
-Information about the various PAM implementations are available:
-
-Solaris PAM:	http://www.sun.com/software/solaris/pam/
-Linux PAM:	http://www.kernel.org/pub/linux/libs/pam/
-OpenPAM:	http://www.openpam.org/
+http://www.kernel.org/pub/linux/libs/pam/

 If you wish to build the GNOME passphrase requester, you will need the GNOME
 libraries and headers.
@@ -57,14 +37,19 @@ passphrase requester. This is maintained separately at:

 http://www.jmknoble.net/software/x11-ssh-askpass/

-TCP Wrappers:
+PRNGD:

-If you wish to use the TCP wrappers functionality you will need at least
-tcpd.h and libwrap.a, either in the standard include and library paths,
-or in the directory specified by --with-tcp-wrappers.  Version 7.6 is
-known to work.
+If your system lacks Kernel based random collection, the use of Lutz
+Jaenicke's PRNGd is recommended.

-http://ftp.porcupine.org/pub/security/index.html
+http://www.aet.tu-cottbus.de/personen/jaenicke/postfix_tls/prngd.html
+
+EGD:
+
+The Entropy Gathering Daemon (EGD) is supported if you have a system which
+lacks /dev/random and don't want to use OpenSSH's internal entropy collection.
+
+http://www.lothar.com/tech/crypto/

 S/Key Libraries:

@@ -87,7 +72,7 @@ Autoconf:
 If you modify configure.ac or configure doesn't exist (eg if you checked
 the code out of CVS yourself) then you will need autoconf-2.61 to rebuild
 the automatically generated files by running "autoreconf".  Earlier
-versions may also work but this is not guaranteed.
+version may also work but this is not guaranteed.

 http://www.gnu.org/software/autoconf/

@@ -177,7 +162,7 @@ Integration Architecture.  The default for OSF1 machines is enable.
 need the S/Key libraries and header files installed for this to work.

 --with-tcp-wrappers will enable TCP Wrappers (/etc/hosts.allow|deny)
-support.
+support. You will need libwrap.a and tcpd.h installed.

 --with-md5-passwords will enable the use of MD5 passwords. Enable this
 if your operating system uses MD5 passwords and the system crypt() does
@@ -195,7 +180,7 @@ $DISPLAY environment variable. Some broken systems need this.
 --with-default-path=PATH allows you to specify a default $PATH for sessions
 started by sshd. This replaces the standard path entirely.

--with-pid-dir=PATH specifies the directory in which the sshd.pid file is
+--with-pid-dir=PATH specifies the directory in which the ssh.pid file is
 created.

 --with-xauth=PATH specifies the location of the xauth binary
@@ -266,4 +251,4 @@ Please refer to the "reporting bugs" section of the webpage at
 http://www.openssh.com/


-$Id: INSTALL,v 1.84 2007/08/17 12:52:05 dtucker Exp $
+$Id: INSTALL,v 1.77 2007/03/02 06:53:41 dtucker Exp $
@@ -205,7 +205,6 @@ OpenSSH contains no GPL code.
 	Darren Tucker
 	Sun Microsystems
 	The SCO Group
-	Daniel Walsh

     * Redistribution and use in source and binary forms, with or without
     * modification, are permitted provided that the following conditions
@@ -1,4 +1,4 @@
-# $Id: Makefile.in,v 1.285 2007/06/11 04:01:42 djm Exp $
+# $Id: Makefile.in,v 1.283 2006/10/23 21:44:47 tim Exp $

 # uncomment if you run a non bourne compatable shell. Ie. csh
 #SHELL = @SH@
@@ -44,8 +44,11 @@ LD=@LD@
 CFLAGS=@CFLAGS@
 CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ $(PATHS) @DEFS@
 LIBS=@LIBS@
+LIBSELINUX=@LIBSELINUX@
 SSHDLIBS=@SSHDLIBS@
 LIBEDIT=@LIBEDIT@
+LIBPAM=@LIBPAM@
+LIBWRAP=@LIBWRAP@
 AR=@AR@
 AWK=@AWK@
 RANLIB=@RANLIB@
@@ -71,7 +74,7 @@ LIBSSH_OBJS=acss.o authfd.o authfile.o bufaux.o bufbn.o buffer.o \
 	atomicio.o key.o dispatch.o kex.o mac.o uidswap.o uuencode.o misc.o \
 	monitor_fdpass.o rijndael.o ssh-dss.o ssh-rsa.o dh.o kexdh.o \
 	kexgex.o kexdhc.o kexgexc.o scard.o msg.o progressmeter.o dns.o \
-	entropy.o scard-opensc.o gss-genr.o umac.o
+	entropy.o scard-opensc.o gss-genr.o

 SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
 	sshconnect.o sshconnect1.o sshconnect2.o
@@ -136,7 +139,7 @@ ssh$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHOBJS)
 	$(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)

 sshd$(EXEEXT): libssh.a	$(LIBCOMPAT) $(SSHDOBJS)
-	$(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) $(LIBS)
+	$(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBWRAP) $(LIBPAM) $(LIBSELINUX) $(SSHDLIBS) $(LIBS)

 scp$(EXEEXT): $(LIBCOMPAT) libssh.a scp.o progressmeter.o
 	$(LD) -o $@ scp.o progressmeter.o bufaux.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
@@ -1,4 +1,4 @@
-See http://www.openssh.com/txt/release-4.7 for the release notes.
+See http://www.openssh.com/txt/release-4.6 for the release notes.

 - A Japanese translation of this document and of the OpenSSH FAQ is
 - available at http://www.unixuser.org/~haruyama/security/openssh/index.html
@@ -62,4 +62,4 @@ References -
 [6] http://www.openbsd.org/cgi-bin/man.cgi?query=style&sektion=9
 [7] http://www.openssh.com/faq.html

-$Id: README,v 1.66 2007/08/15 09:22:20 dtucker Exp $
+$Id: README,v 1.64.4.1 2007/03/06 10:27:56 djm Exp $
@@ -23,20 +23,6 @@ to force the previous IPv4-only behaviour.
 IPv6 known to work: 5.1ML7 5.2ML2 5.2ML5
 IPv6 known broken: 4.3.3ML11 5.1ML4

-If you wish to use dynamic libraries that aren't in the normal system
-locations (eg IBM's OpenSSL and zlib packages) then you will need to
-define the environment variable blibpath before running configure, eg
-
-blibpath=/lib:/usr/lib:/opt/freeware/lib ./configure \
-  --with-ssl-dir=/opt/freeware --with-zlib=/opt/freeware
-
-If sshd is built with the WITH_AIXAUTHENTICATE option (which is enabled
-by default) then sshd checks that users are permitted via the
-loginrestrictions() function, in particular that the user has the
-"rlogin" attribute set.  This check is not done for the root account,
-instead the PermitRootLogin setting in sshd_config is used.
-
-
 Cygwin
 ------
 To build on Cygwin, OpenSSH requires the following packages:
@@ -81,4 +67,4 @@ account stacks which will prevent authentication entirely, but will still
 return the output from pam_nologin to the client.


-$Id: README.platform,v 1.9 2007/08/09 04:31:53 dtucker Exp $
+$Id: README.platform,v 1.7 2006/06/23 11:05:13 dtucker Exp $
@@ -1,4 +1,4 @@
-/* $OpenBSD: atomicio.c,v 1.25 2007/06/25 12:02:27 dtucker Exp $ */
+/* $OpenBSD: atomicio.c,v 1.23 2006/08/03 03:34:41 deraadt Exp $ */
 /*
 * Copyright (c) 2006 Damien Miller. All rights reserved.
 * Copyright (c) 2005 Anil Madhavapeddy. All rights reserved.
@@ -32,11 +32,7 @@
 #include <sys/uio.h>

 #include <errno.h>
-#ifdef HAVE_POLL_H
-#include <poll.h>
-#endif
 #include <string.h>
-#include <unistd.h>

 #include "atomicio.h"

@@ -49,24 +45,17 @@ atomicio(ssize_t (*f) (int, void *, size_t), int fd, void *_s, size_t n)
 	char *s = _s;
 	size_t pos = 0;
 	ssize_t res;
-	struct pollfd pfd;

-	pfd.fd = fd;
-	pfd.events = f == read ? POLLIN : POLLOUT;
 	while (n > pos) {
 		res = (f) (fd, s + pos, n - pos);
 		switch (res) {
 		case -1:
 #ifdef EWOULDBLOCK
-			if (errno == EINTR || errno == EWOULDBLOCK)
+			if (errno == EINTR || errno == EAGAIN || errno == EWOULDBLOCK)
 #else
-			if (errno == EINTR)
+			if (errno == EINTR || errno == EAGAIN)
 #endif
 				continue;
-			if (errno == EAGAIN) {
-				(void)poll(&pfd, 1, -1);
-				continue;
-			}
 			return 0;
 		case 0:
 			errno = EPIPE;
@@ -88,7 +77,6 @@ atomiciov(ssize_t (*f) (int, const struct iovec *, int), int fd,
 	size_t pos = 0, rem;
 	ssize_t res;
 	struct iovec iov_array[IOV_MAX], *iov = iov_array;
-	struct pollfd pfd;

 	if (iovcnt > IOV_MAX) {
 		errno = EINVAL;
@@ -97,22 +85,12 @@ atomiciov(ssize_t (*f) (int, const struct iovec *, int), int fd,
 	/* Make a copy of the iov array because we may modify it below */
 	memcpy(iov, _iov, iovcnt * sizeof(*_iov));

-	pfd.fd = fd;
-	pfd.events = f == readv ? POLLIN : POLLOUT;
 	for (; iovcnt > 0 && iov[0].iov_len > 0;) {
 		res = (f) (fd, iov, iovcnt);
 		switch (res) {
 		case -1:
-#ifdef EWOULDBLOCK
-			if (errno == EINTR || errno == EWOULDBLOCK)
-#else
-			if (errno == EINTR)
-#endif
+			if (errno == EINTR || errno == EAGAIN)
 				continue;
-			if (errno == EAGAIN) {
-				(void)poll(&pfd, 1, -1);
-				continue;
-			}
 			return 0;
 		case 0:
 			errno = EPIPE;
@@ -161,9 +161,9 @@ sshpam_sigchld_handler(int sig)
 	    WTERMSIG(sshpam_thread_status) == SIGTERM)
 		return;	/* terminated by pthread_cancel */
 	if (!WIFEXITED(sshpam_thread_status))
-		sigdie("PAM: authentication thread exited unexpectedly");
+		fatal("PAM: authentication thread exited unexpectedly");
 	if (WEXITSTATUS(sshpam_thread_status) != 0)
-		sigdie("PAM: authentication thread exited uncleanly");
+		fatal("PAM: authentication thread exited uncleanly");
 }

 /* ARGSUSED */
@@ -686,7 +686,8 @@ sshpam_init_ctx(Authctxt *authctxt)
 		return (NULL);
 	}

-	ctxt = xcalloc(1, sizeof *ctxt);
+	ctxt = xmalloc(sizeof *ctxt);
+	memset(ctxt, 0, sizeof(*ctxt));

 	/* Start the authentication thread */
 	if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, socks) == -1) {
@@ -984,8 +985,7 @@ sshpam_tty_conv(int n, sshpam_const struct pam_message **msg,
 			break;
 		case PAM_PROMPT_ECHO_ON:
 			fprintf(stderr, "%s\n", PAM_MSG_MEMBER(msg, i, msg));
-			if (fgets(input, sizeof input, stdin) == NULL)
-				input[0] = '\0';
+			fgets(input, sizeof input, stdin);
 			if ((reply[i].resp = strdup(input)) == NULL)
 				goto fail;
 			reply[i].resp_retcode = PAM_SUCCESS;
@@ -1130,8 +1130,9 @@ sshpam_passwd_conv(int n, sshpam_const struct pam_message **msg,
 	if (n <= 0 || n > PAM_MAX_NUM_MSG)
 		return (PAM_CONV_ERR);

-	if ((reply = calloc(n, sizeof(*reply))) == NULL)
+	if ((reply = malloc(n * sizeof(*reply))) == NULL)
 		return (PAM_CONV_ERR);
+	memset(reply, 0, n * sizeof(*reply));

 	for (i = 0; i < n; ++i) {
 		switch (PAM_MSG_MEMBER(msg, i, msg_style)) {
@@ -28,7 +28,6 @@
 #include <shadow.h>
 #include <stdarg.h>
 #include <string.h>
-#include <time.h>

 #include "key.h"
 #include "hostfile.h"
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2.c,v 1.115 2007/04/14 22:01:58 stevesk Exp $ */
+/* $OpenBSD: auth2.c,v 1.114 2007/03/01 10:28:02 dtucker Exp $ */
 /*
 * Copyright (c) 2000 Markus Friedl.  All rights reserved.
 *
@@ -281,6 +281,8 @@ userauth_finish(Authctxt *authctxt, int authenticated, char *method)
 	}
 }

+#define	DELIM	","
+
 static char *
 authmethods_get(void)
 {
@@ -1,4 +1,4 @@
-/* $OpenBSD: bufbn.c,v 1.6 2007/06/02 09:04:58 djm Exp $*/
+/* $OpenBSD: bufbn.c,v 1.5 2007/02/14 14:32:00 stevesk Exp $*/
 /*
 * Author: Tatu Ylonen <ylo@cs.hut.fi>
 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -201,14 +201,12 @@ buffer_get_bignum2_ret(Buffer *buffer, BIGNUM *value)
 		return (-1);
 	}
 	if (len > 8 * 1024) {
-		error("buffer_get_bignum2_ret: cannot handle BN of size %d",
-		    len);
+		error("buffer_get_bignum2_ret: cannot handle BN of size %d", len);
 		xfree(bin);
 		return (-1);
 	}
 	if (BN_bin2bn(bin, len, value) == NULL) {
 		error("buffer_get_bignum2_ret: BN_bin2bn failed");
-		xfree(bin);
 		return (-1);
 	}
 	xfree(bin);
@@ -49,8 +49,6 @@ PKG_REQUEST_LOCAL=../pkg-request.local
 OPENSSHD=opensshd.init
 OPENSSH_MANIFEST=openssh.xml
 OPENSSH_FMRI=svc:/site/${SYSVINIT_NAME}:default
-SMF_METHOD_DIR=/lib/svc/method/site
-SMF_MANIFEST_DIR=/var/svc/manifest/site

 PATH_GROUPADD_PROG=@PATH_GROUPADD_PROG@
 PATH_USERADD_PROG=@PATH_USERADD_PROG@
@@ -198,17 +196,15 @@ then
 	# For Solaris' SMF, /lib/svc/method/site is the preferred place
 	# for start/stop scripts that aren't supplied with the OS, and
 	# similarly /var/svc/manifest/site for manifests.
-	mkdir -p $FAKE_ROOT${TEST_DIR}${SMF_METHOD_DIR}
-	mkdir -p $FAKE_ROOT${TEST_DIR}${SMF_MANIFEST_DIR}
+	mkdir -p $FAKE_ROOT${TEST_DIR}/lib/svc/method/site
+	mkdir -p $FAKE_ROOT${TEST_DIR}/var/svc/manifest/site

-	cp ${OPENSSHD} $FAKE_ROOT${TEST_DIR}${SMF_METHOD_DIR}/${SYSVINIT_NAME}
-	chmod 744 $FAKE_ROOT${TEST_DIR}${SMF_METHOD_DIR}/${SYSVINIT_NAME}
+	cp ${OPENSSHD} $FAKE_ROOT${TEST_DIR}/lib/svc/method/site/${SYSVINIT_NAME}
+	chmod 744 $FAKE_ROOT${TEST_DIR}/lib/svc/method/site/${SYSVINIT_NAME}

-	cat ${OPENSSH_MANIFEST} | \
-	    sed -e "s|__SYSVINIT_NAME__|${SYSVINIT_NAME}|" \
-	    -e "s|__SMF_METHOD_DIR__|${SMF_METHOD_DIR}|" \
-	    > $FAKE_ROOT${TEST_DIR}${SMF_MANIFEST_DIR}/${SYSVINIT_NAME}.xml
-	chmod 644 $FAKE_ROOT${TEST_DIR}${SMF_MANIFEST_DIR}/${SYSVINIT_NAME}.xml
+	cat ${OPENSSH_MANIFEST} | sed "s|__SYSVINIT_NAME__|${SYSVINIT_NAME}|" \
+	    > $FAKE_ROOT${TEST_DIR}/var/svc/manifest/site/${SYSVINIT_NAME}.xml
+	chmod 644 $FAKE_ROOT${TEST_DIR}/var/svc/manifest/site/${SYSVINIT_NAME}.xml
 else
 	mkdir -p $FAKE_ROOT${TEST_DIR}/etc/init.d

@@ -218,19 +214,19 @@ fi

 [ "${PERMIT_ROOT_LOGIN}" = no ]  &&  \
 	perl -p -i -e "s/#PermitRootLogin yes/PermitRootLogin no/" \
-		$FAKE_ROOT${sysconfdir}/sshd_config
+		$FAKE_ROOT/${sysconfdir}/sshd_config
 [ "${X11_FORWARDING}" = yes ]  &&  \
 	perl -p -i -e "s/#X11Forwarding no/X11Forwarding yes/" \
-		$FAKE_ROOT${sysconfdir}/sshd_config
+		$FAKE_ROOT/${sysconfdir}/sshd_config
 # fix PrintMotd
 perl -p -i -e "s/#PrintMotd yes/PrintMotd no/" \
-	$FAKE_ROOT${sysconfdir}/sshd_config
+	$FAKE_ROOT/${sysconfdir}/sshd_config

 # We don't want to overwrite config files on multiple installs
-mv $FAKE_ROOT${sysconfdir}/ssh_config $FAKE_ROOT${sysconfdir}/ssh_config.default
-mv $FAKE_ROOT${sysconfdir}/sshd_config $FAKE_ROOT${sysconfdir}/sshd_config.default
-[ -f $FAKE_ROOT${sysconfdir}/ssh_prng_cmds ]  &&  \
-mv $FAKE_ROOT${sysconfdir}/ssh_prng_cmds $FAKE_ROOT${sysconfdir}/ssh_prng_cmds.default
+mv $FAKE_ROOT/${sysconfdir}/ssh_config $FAKE_ROOT/${sysconfdir}/ssh_config.default
+mv $FAKE_ROOT/${sysconfdir}/sshd_config $FAKE_ROOT/${sysconfdir}/sshd_config.default
+[ -f $FAKE_ROOT/${sysconfdir}/ssh_prng_cmds ]  &&  \
+mv $FAKE_ROOT/${sysconfdir}/ssh_prng_cmds $FAKE_ROOT/${sysconfdir}/ssh_prng_cmds.default

 # local tweeks here
 [ -s "${POST_MAKE_INSTALL_FIXES}" ]  &&  . ${POST_MAKE_INSTALL_FIXES}
@@ -340,7 +336,7 @@ then
 		svccfg delete -f $OPENSSH_FMRI
 	fi
 	# NOTE, The manifest disables sshd by default.
-	svccfg import ${TEST_DIR}${SMF_MANIFEST_DIR}/${SYSVINIT_NAME}.xml
+	svccfg import ${TEST_DIR}/var/svc/manifest/site/${SYSVINIT_NAME}.xml
 else
 	if [ "\${USE_SYM_LINKS}" = yes ]
 	then
@@ -1,4 +1,4 @@
-/* $OpenBSD: channels.c,v 1.270 2007/06/25 08:20:03 dtucker Exp $ */
+/* $OpenBSD: channels.c,v 1.268 2007/01/03 03:01:40 stevesk Exp $ */
 /*
 * Author: Tatu Ylonen <ylo@cs.hut.fi>
 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1657,9 +1657,7 @@ channel_check_window(Channel *c)
 {
 	if (c->type == SSH_CHANNEL_OPEN &&
 	    !(c->flags & (CHAN_CLOSE_SENT|CHAN_CLOSE_RCVD)) &&
-	    ((c->local_window_max - c->local_window >
-	    c->local_maxpacket*3) ||
-	    c->local_window < c->local_window_max/2) &&
+	    c->local_window < c->local_window_max/2 &&
 	    c->local_consumed > 0) {
 		packet_start(SSH2_MSG_CHANNEL_WINDOW_ADJUST);
 		packet_put_int(c->remote_id);
@@ -1,4 +1,4 @@
-/* $OpenBSD: channels.h,v 1.89 2007/06/11 09:14:00 markus Exp $ */
+/* $OpenBSD: channels.h,v 1.88 2006/08/03 03:34:42 deraadt Exp $ */

 /*
 * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -122,9 +122,9 @@ struct Channel {

 /* default window/packet sizes for tcp/x11-fwd-channel */
 #define CHAN_SES_PACKET_DEFAULT	(32*1024)
-#define CHAN_SES_WINDOW_DEFAULT	(64*CHAN_SES_PACKET_DEFAULT)
+#define CHAN_SES_WINDOW_DEFAULT	(4*CHAN_SES_PACKET_DEFAULT)
 #define CHAN_TCP_PACKET_DEFAULT	(32*1024)
-#define CHAN_TCP_WINDOW_DEFAULT	(64*CHAN_TCP_PACKET_DEFAULT)
+#define CHAN_TCP_WINDOW_DEFAULT	(4*CHAN_TCP_PACKET_DEFAULT)
 #define CHAN_X11_PACKET_DEFAULT	(16*1024)
 #define CHAN_X11_WINDOW_DEFAULT	(4*CHAN_X11_PACKET_DEFAULT)

@@ -29,7 +29,13 @@
 /* compatibility with old or broken OpenSSL versions */
 #include "openbsd-compat/openssl-compat.h"

-#ifndef USE_BUILTIN_RIJNDAEL
+#ifdef USE_BUILTIN_RIJNDAEL
+#include "rijndael.h"
+#define AES_KEY rijndael_ctx
+#define AES_BLOCK_SIZE 16
+#define AES_encrypt(a, b, c) rijndael_encrypt(c, a, b)
+#define AES_set_encrypt_key(a, b, c) rijndael_set_key(c, (char *)a, b, 1)
+#else
 #include <openssl/aes.h>
 #endif

@@ -1,4 +1,4 @@
-/* $OpenBSD: clientloop.c,v 1.181 2007/08/15 08:14:46 markus Exp $ */
+/* $OpenBSD: clientloop.c,v 1.178 2007/02/20 10:25:14 djm Exp $ */
 /*
 * Author: Tatu Ylonen <ylo@cs.hut.fi>
 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -290,29 +290,19 @@ client_x11_get_proto(const char *display, const char *xauth_path,
 					generated = 1;
 			}
 		}
-
-		/*
-		 * When in untrusted mode, we read the cookie only if it was
-		 * successfully generated as an untrusted one in the step
-		 * above.
-		 */
-		if (trusted || generated) {
-			snprintf(cmd, sizeof(cmd),
-			    "%s %s%s list %s 2>" _PATH_DEVNULL,
-			    xauth_path,
-			    generated ? "-f " : "" ,
-			    generated ? xauthfile : "",
-			    display);
-			debug2("x11_get_proto: %s", cmd);
-			f = popen(cmd, "r");
-			if (f && fgets(line, sizeof(line), f) &&
-			    sscanf(line, "%*s %511s %511s", proto, data) == 2)
-				got_data = 1;
-			if (f)
-				pclose(f);
-		} else
-			error("Warning: untrusted X11 forwarding setup failed: "
-			    "xauth key data not generated");
+		snprintf(cmd, sizeof(cmd),
+		    "%s %s%s list %s 2>" _PATH_DEVNULL,
+		    xauth_path,
+		    generated ? "-f " : "" ,
+		    generated ? xauthfile : "",
+		    display);
+		debug2("x11_get_proto: %s", cmd);
+		f = popen(cmd, "r");
+		if (f && fgets(line, sizeof(line), f) &&
+		    sscanf(line, "%*s %511s %511s", proto, data) == 2)
+			got_data = 1;
+		if (f)
+			pclose(f);
 	}

 	if (do_unlink) {
@@ -945,7 +935,7 @@ process_cmdline(void)
 	cmd = s = read_passphrase("\r\nssh> ", RP_ECHO);
 	if (s == NULL)
 		goto out;
-	while (isspace(*s))
+	while (*s && isspace(*s))
 		s++;
 	if (*s == '-')
 		s++;	/* Skip cmdline '-', if any */
@@ -992,8 +982,9 @@ process_cmdline(void)
 		goto out;
 	}

-	while (isspace(*++s))
-		;
+	s++;
+	while (*s && isspace(*s))
+		s++;

 	if (delete) {
 		cancel_port = 0;
@@ -1783,50 +1774,6 @@ client_request_agent(const char *request_type, int rchan)
 	return c;
 }

-int
-client_request_tun_fwd(int tun_mode, int local_tun, int remote_tun)
-{
-	Channel *c;
-	int fd;
-
-	if (tun_mode == SSH_TUNMODE_NO)
-		return 0;
-
-	if (!compat20) {
-		error("Tunnel forwarding is not support for protocol 1");
-		return -1;
-	}
-
-	debug("Requesting tun unit %d in mode %d", local_tun, tun_mode);
-
-	/* Open local tunnel device */
-	if ((fd = tun_open(local_tun, tun_mode)) == -1) {
-		error("Tunnel device open failed.");
-		return -1;
-	}
-
-	c = channel_new("tun", SSH_CHANNEL_OPENING, fd, fd, -1,
-	    CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0, "tun", 1);
-	c->datagram = 1;
-
-#if defined(SSH_TUN_FILTER)
-	if (options.tun_open == SSH_TUNMODE_POINTOPOINT)
-		channel_register_filter(c->self, sys_tun_infilter,
-		    sys_tun_outfilter);
-#endif
-
-	packet_start(SSH2_MSG_CHANNEL_OPEN);
-	packet_put_cstring("[email protected]");
-	packet_put_int(c->self);
-	packet_put_int(c->local_window_max);
-	packet_put_int(c->local_maxpacket);
-	packet_put_int(tun_mode);
-	packet_put_int(remote_tun);
-	packet_send();
-
-	return 0;
-}
-
 /* XXXX move to generic input handler */
 static void
 client_input_channel_open(int type, u_int32_t seq, void *ctxt)
@@ -1,4 +1,4 @@
-/* $OpenBSD: clientloop.h,v 1.17 2007/08/07 07:32:53 djm Exp $ */
+/* $OpenBSD: clientloop.h,v 1.16 2006/03/25 22:22:42 djm Exp $ */

 /*
 * Author: Tatu Ylonen <ylo@cs.hut.fi>
@@ -44,7 +44,6 @@ void	 client_x11_get_proto(const char *, const char *, u_int,
 void	 client_global_request_reply_fwd(int, u_int32_t, void *);
 void	 client_session2_setup(int, int, int, const char *, struct termios *,
 	    int, Buffer *, char **, dispatch_fn *);
-int	 client_request_tun_fwd(int, int, int);

 /* Multiplexing protocol version */
 #define SSHMUX_VER			1
@@ -1,4 +1,4 @@
-# $Id: configure.ac,v 1.383 2007/08/10 04:36:12 dtucker Exp $
+# $Id: configure.ac,v 1.372.2.2 2007/04/29 03:58:47 dtucker Exp $
 #
 # Copyright (c) 1999-2004 Damien Miller
 #
@@ -15,7 +15,7 @@
 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

 AC_INIT(OpenSSH, Portable, [email protected])
-AC_REVISION($Revision: 1.383 $)
+AC_REVISION($Revision: 1.372.2.2 $)
 AC_CONFIG_SRCDIR([ssh.c])

 AC_CONFIG_HEADER(config.h)
@@ -94,12 +94,9 @@ if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
 	CFLAGS="$CFLAGS -Wall -Wpointer-arith -Wuninitialized"
 	GCC_VER=`$CC -v 2>&1 | $AWK '/gcc version /{print $3}'`
 	case $GCC_VER in
-		1.*) no_attrib_nonnull=1 ;;
-		2.8* | 2.9*)
-		     CFLAGS="$CFLAGS -Wsign-compare"
-		     no_attrib_nonnull=1
-		     ;;
-		2.*) no_attrib_nonnull=1 ;;
+		1.*) ;;
+		2.8* | 2.9*) CFLAGS="$CFLAGS -Wsign-compare" ;;
+		2.*) ;;
 		3.*) CFLAGS="$CFLAGS -Wsign-compare" ;;
 		4.*) CFLAGS="$CFLAGS -Wsign-compare -Wno-pointer-sign" ;;
 		*) ;;
@@ -118,10 +115,6 @@ if test "$GCC" = "yes" || test "$GCC" = "egcs"; then
 	fi
 fi

-if test "x$no_attrib_nonnull" != "x1" ; then
-	AC_DEFINE(HAVE_ATTRIBUTE__NONNULL__, 1, [Have attribute nonnull])
-fi
-
 AC_ARG_WITH(rpath,
 	[  --without-rpath         Disable auto-added -R linker paths],
 	[
@@ -205,7 +198,6 @@ AC_CHECK_HEADERS( \
 	netgroup.h \
 	pam/pam_appl.h \
 	paths.h \
-	poll.h \
 	pty.h \
 	readpassphrase.h \
 	rpc/types.h \
@@ -237,7 +229,6 @@ AC_CHECK_HEADERS( \
 	time.h \
 	tmpdir.h \
 	ttyent.h \
-	ucred.h \
 	unistd.h \
 	usersec.h \
 	util.h \
@@ -786,11 +777,6 @@ mips-sony-bsd|mips-sony-newsos4)
 	AC_DEFINE(DISABLE_LASTLOG)
 	AC_DEFINE(SSHD_ACQUIRES_CTTY)
 	enable_etc_default_login=no	# has incompatible /etc/default/login
-	case "$host" in
-	*-*-nto-qnx6*)
-		AC_DEFINE(DISABLE_FD_PASSING)
-		;;
-	esac
 	;;

 *-*-ultrix*)
@@ -1123,7 +1109,8 @@ AC_ARG_WITH(tcp-wrappers,
 					CPPFLAGS="-I${withval} ${CPPFLAGS}"
 				fi
 			fi
-			LIBS="-lwrap $LIBS"
+			LIBWRAP="-lwrap"
+			LIBS="$LIBWRAP $LIBS"
 			AC_MSG_CHECKING(for libwrap)
 			AC_TRY_LINK(
 				[
@@ -1139,7 +1126,7 @@ AC_ARG_WITH(tcp-wrappers,
 					AC_DEFINE(LIBWRAP, 1,
 						[Define if you want
 						TCP Wrappers support])
-					SSHDLIBS="$SSHDLIBS -lwrap"
+					AC_SUBST(LIBWRAP)
 					TCPW_MSG="yes"
 				],
 				[
@@ -1254,7 +1241,6 @@ AC_CHECK_FUNCS( \
 	getnameinfo \
 	getopt \
 	getpeereid \
-	getpeerucred \
 	_getpty \
 	getrlimit \
 	getttyent \
@@ -1273,7 +1259,6 @@ AC_CHECK_FUNCS( \
 	ogetaddrinfo \
 	openlog_r \
 	openpty \
-	poll \
 	prctl \
 	pstat \
 	readpassphrase \
@@ -1307,7 +1292,6 @@ AC_CHECK_FUNCS( \
 	strtonum \
 	strtoll \
 	strtoul \
-	swap32 \
 	sysconf \
 	tcgetpgrp \
 	truncate \
@@ -1380,14 +1364,6 @@ AC_CHECK_DECLS(writev, , , [
 #include <unistd.h>
 	])

-AC_CHECK_DECLS(MAXSYMLINKS, , , [
-#include <sys/param.h>
-	])
-
-AC_CHECK_DECLS(offsetof, , , [
-#include <stddef.h>
-	])
-
 AC_CHECK_FUNCS(setresuid, [
 	dnl Some platorms have setresuid that isn't implemented, test for this
 	AC_MSG_CHECKING(if setresuid seems to work)
@@ -1513,7 +1489,7 @@ AC_COMPILE_IFELSE([AC_LANG_SOURCE([[#include <stdio.h>

 # Check for missing getpeereid (or equiv) support
 NO_PEERCHECK=""
-if test "x$ac_cv_func_getpeereid" != "xyes" -a "x$ac_cv_func_getpeerucred" != "xyes"; then
+if test "x$ac_cv_func_getpeereid" != "xyes" ; then
 	AC_MSG_CHECKING([whether system supports SO_PEERCRED getsockopt])
 	AC_TRY_COMPILE(
 		[#include <sys/types.h>
@@ -2056,7 +2032,7 @@ AC_ARG_WITH(pam,

 			PAM_MSG="yes"

-			SSHDLIBS="$SSHDLIBS -lpam"
+			LIBPAM="-lpam"
 			AC_DEFINE(USE_PAM, 1,
 				[Define if you want to enable PAM support])

@@ -2066,10 +2042,11 @@ AC_ARG_WITH(pam,
 					# libdl already in LIBS
 					;;
 				*)
-					SSHDLIBS="$SSHDLIBS -ldl"
+					LIBPAM="$LIBPAM -ldl"
 					;;
 				esac
 			fi
+			AC_SUBST(LIBPAM)
 		fi
 	]
 )
@@ -3203,18 +3180,19 @@ LIBSELINUX=""
 AC_ARG_WITH(selinux,
 	[  --with-selinux   Enable SELinux support],
 	[ if test "x$withval" != "xno" ; then
-		save_LIBS="$LIBS"
 		AC_DEFINE(WITH_SELINUX,1,[Define if you want SELinux support.])
 		SELINUX_MSG="yes"
 		AC_CHECK_HEADER([selinux/selinux.h], ,
 		    AC_MSG_ERROR(SELinux support requires selinux.h header))
 		AC_CHECK_LIB(selinux, setexeccon, [ LIBSELINUX="-lselinux" ],
 		    AC_MSG_ERROR(SELinux support requires libselinux library))
-		SSHDLIBS="$SSHDLIBS $LIBSELINUX"
+		save_LIBS="$LIBS"
+		LIBS="$LIBS $LIBSELINUX"
 		AC_CHECK_FUNCS(getseuserbyname get_default_context_with_level)
 		LIBS="$save_LIBS"
 	fi ]
 )
+AC_SUBST(LIBSELINUX)

 # Check whether user wants Kerberos 5 support
 KRB5_MSG="no"
@@ -4050,10 +4028,7 @@ echo "          Compiler: ${CC}"
 echo "    Compiler flags: ${CFLAGS}"
 echo "Preprocessor flags: ${CPPFLAGS}"
 echo "      Linker flags: ${LDFLAGS}"
-echo "         Libraries: ${LIBS}"
-if test ! -z "${SSHDLIBS}"; then
-echo "         +for sshd: ${SSHDLIBS}"
-fi
+echo "         Libraries: ${LIBWRAP} ${LIBPAM} ${LIBS}"

 echo ""

@@ -4079,12 +4054,12 @@ if test ! -z "$RAND_HELPER_CMDHASH" ; then
 fi

 if test ! -z "$NO_PEERCHECK" ; then
-	echo "WARNING: the operating system that you are using does not"
-	echo "appear to support getpeereid(), getpeerucred() or the"
-	echo "SO_PEERCRED getsockopt() option. These facilities are used to"
-	echo "enforce security checks to prevent unauthorised connections to"
-	echo "ssh-agent. Their absence increases the risk that a malicious"
-	echo "user can connect to your agent."
+	echo "WARNING: the operating system that you are using does not "
+	echo "appear to support either the getpeereid() API nor the "
+	echo "SO_PEERCRED getsockopt() option. These facilities are used to "
+	echo "enforce security checks to prevent unauthorised connections to "
+	echo "ssh-agent. Their absence increases the risk that a malicious "
+	echo "user can connect to your agent. "
 	echo ""
 fi

@@ -17,7 +17,7 @@
 #old cvs stuff.  please update before use.  may be deprecated.
 %define use_stable	1
 %if %{use_stable}
-  %define version 	4.7p1
+  %define version 	4.6p1
  %define cvs		%{nil}
  %define release 	1
 %else
@@ -357,4 +357,4 @@ fi
 * Mon Jan 01 1998 ...
 Template Version: 1.31

-$Id: openssh.spec,v 1.61 2007/08/15 09:22:20 dtucker Exp $
+$Id: openssh.spec,v 1.60 2007/03/06 10:23:27 djm Exp $
@@ -1,4 +1,4 @@
-%define ver 4.7p1
+%define ver 4.6p1
 %define rel 1

 # OpenSSH privilege separation requires a user & group ID
@@ -13,7 +13,7 @@

 Summary:	OpenSSH, a free Secure Shell (SSH) protocol implementation
 Name:		openssh
-Version:	4.7p1
+Version:	4.6p1
 URL:		http://www.openssh.com/
 Release:	1
 Source0:	openssh-%{version}.tar.gz
@@ -25,7 +25,7 @@
 #ifndef _DEFINES_H
 #define _DEFINES_H

-/* $Id: defines.h,v 1.143 2007/08/09 04:37:52 dtucker Exp $ */
+/* $Id: defines.h,v 1.138.6.1 2007/03/27 09:07:48 dtucker Exp $ */


 /* Constants */
@@ -68,7 +68,7 @@ enum
 # endif
 #endif

-#if defined(HAVE_DECL_MAXSYMLINKS) && HAVE_DECL_MAXSYMLINKS == 0
+#ifndef MAXSYMLINKS
 # define MAXSYMLINKS 5
 #endif

@@ -321,6 +321,12 @@ struct winsize {
 #ifndef _PATH_BSHELL
 # define _PATH_BSHELL "/bin/sh"
 #endif
+#ifndef _PATH_CSHELL
+# define _PATH_CSHELL "/bin/csh"
+#endif
+#ifndef _PATH_SHELLS
+# define _PATH_SHELLS "/etc/shells"
+#endif

 #ifdef USER_PATH
 # ifdef _PATH_STDPATH
@@ -443,10 +449,6 @@ struct winsize {
 # define __bounded__(x, y, z)
 #endif

-#if !defined(HAVE_ATTRIBUTE__NONNULL__) && !defined(__nonnull__)
-# define __nonnull__(x)
-#endif
-
 /* *-*-nto-qnx doesn't define this macro in the system headers */
 #ifdef MISSING_HOWMANY
 # define howmany(x,y)	(((x)+((y)-1))/(y))
@@ -485,7 +487,7 @@ struct winsize {
 	 (struct cmsghdr *)NULL)
 #endif /* CMSG_FIRSTHDR */

-#if defined(HAVE_DECL_OFFSETOF) && HAVE_DECL_OFFSETOF == 0
+#ifndef offsetof
 # define offsetof(type, member) ((size_t) &((type *)0)->member)
 #endif

@@ -1,4 +1,4 @@
-/* $OpenBSD: gss-genr.c,v 1.19 2007/06/12 11:56:15 dtucker Exp $ */
+/* $OpenBSD: gss-genr.c,v 1.17 2006/08/29 12:02:30 dtucker Exp $ */

 /*
 * Copyright (c) 2001-2007 Simon Wilkinson. All rights reserved.
@@ -226,6 +226,39 @@ ssh_gssapi_import_name(Gssctxt *ctx, const char *host)
 	return (ctx->major);
 }

+/* Acquire credentials for a server running on the current host.
+ * Requires that the context structure contains a valid OID
+ */
+
+/* Returns a GSSAPI error code */
+OM_uint32
+ssh_gssapi_acquire_cred(Gssctxt *ctx)
+{
+	OM_uint32 status;
+	char lname[MAXHOSTNAMELEN];
+	gss_OID_set oidset;
+
+	gss_create_empty_oid_set(&status, &oidset);
+	gss_add_oid_set_member(&status, ctx->oid, &oidset);
+
+	if (gethostname(lname, MAXHOSTNAMELEN)) {
+		gss_release_oid_set(&status, &oidset);
+		return (-1);
+	}
+
+	if (GSS_ERROR(ssh_gssapi_import_name(ctx, lname))) {
+		gss_release_oid_set(&status, &oidset);
+		return (ctx->major);
+	}
+
+	if ((ctx->major = gss_acquire_cred(&ctx->minor,
+	    ctx->name, 0, oidset, GSS_C_ACCEPT, &ctx->creds, NULL, NULL)))
+		ssh_gssapi_error(ctx);
+
+	gss_release_oid_set(&status, &oidset);
+	return (ctx->major);
+}
+
 OM_uint32
 ssh_gssapi_sign(Gssctxt *ctx, gss_buffer_t buffer, gss_buffer_t hash)
 {
@@ -248,6 +281,16 @@ ssh_gssapi_buildmic(Buffer *b, const char *user, const char *service,
 	buffer_put_cstring(b, context);
 }

+OM_uint32
+ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid)
+{
+	if (*ctx)
+		ssh_gssapi_delete_ctx(ctx);
+	ssh_gssapi_build_ctx(ctx);
+	ssh_gssapi_set_oid(*ctx, oid);
+	return (ssh_gssapi_acquire_cred(*ctx));
+}
+
 int
 ssh_gssapi_check_mechanism(Gssctxt **ctx, gss_OID oid, const char *host)
 {
@@ -1,4 +1,4 @@
-/* $OpenBSD: gss-serv.c,v 1.21 2007/06/12 08:20:00 djm Exp $ */
+/* $OpenBSD: gss-serv.c,v 1.20 2006/08/03 03:34:42 deraadt Exp $ */

 /*
 * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
@@ -29,7 +29,6 @@
 #ifdef GSSAPI

 #include <sys/types.h>
-#include <sys/param.h>

 #include <stdarg.h>
 #include <string.h>
@@ -65,53 +64,6 @@ ssh_gssapi_mech* supported_mechs[]= {
 	&gssapi_null_mech,
 };

-
-/*
- * Acquire credentials for a server running on the current host.
- * Requires that the context structure contains a valid OID
- */
-
-/* Returns a GSSAPI error code */
-/* Privileged (called from ssh_gssapi_server_ctx) */
-static OM_uint32
-ssh_gssapi_acquire_cred(Gssctxt *ctx)
-{
-	OM_uint32 status;
-	char lname[MAXHOSTNAMELEN];
-	gss_OID_set oidset;
-
-	gss_create_empty_oid_set(&status, &oidset);
-	gss_add_oid_set_member(&status, ctx->oid, &oidset);
-
-	if (gethostname(lname, MAXHOSTNAMELEN)) {
-		gss_release_oid_set(&status, &oidset);
-		return (-1);
-	}
-
-	if (GSS_ERROR(ssh_gssapi_import_name(ctx, lname))) {
-		gss_release_oid_set(&status, &oidset);
-		return (ctx->major);
-	}
-
-	if ((ctx->major = gss_acquire_cred(&ctx->minor,
-	    ctx->name, 0, oidset, GSS_C_ACCEPT, &ctx->creds, NULL, NULL)))
-		ssh_gssapi_error(ctx);
-
-	gss_release_oid_set(&status, &oidset);
-	return (ctx->major);
-}
-
-/* Privileged */
-OM_uint32
-ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID oid)
-{
-	if (*ctx)
-		ssh_gssapi_delete_ctx(ctx);
-	ssh_gssapi_build_ctx(ctx);
-	ssh_gssapi_set_oid(*ctx, oid);
-	return (ssh_gssapi_acquire_cred(*ctx));
-}
-
 /* Unprivileged */
 void
 ssh_gssapi_supported_oids(gss_OID_set *oidset)
@@ -1,4 +1,4 @@
-/* $OpenBSD: kex.c,v 1.79 2007/06/05 06:52:37 djm Exp $ */
+/* $OpenBSD: kex.c,v 1.77 2007/01/21 01:41:54 stevesk Exp $ */
 /*
 * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
 *
@@ -87,7 +87,7 @@ static char **
 kex_buf2prop(Buffer *raw, int *first_kex_follows)
 {
 	Buffer b;
-	u_int i;
+	int i;
 	char **proposal;

 	proposal = xcalloc(PROPOSAL_MAX, sizeof(char *));
@@ -108,7 +108,7 @@ kex_buf2prop(Buffer *raw, int *first_kex_follows)
 		*first_kex_follows = i;
 	debug2("kex_parse_kexinit: first_kex_follows %d ", i);
 	i = buffer_get_int(&b);
-	debug2("kex_parse_kexinit: reserved %u ", i);
+	debug2("kex_parse_kexinit: reserved %d ", i);
 	buffer_free(&b);
 	return proposal;
 }
@@ -123,7 +123,6 @@ kex_prop_free(char **proposal)
 	xfree(proposal);
 }

-/* ARGSUSED */
 static void
 kex_protocol_error(int type, u_int32_t seq, void *ctxt)
 {
@@ -195,7 +194,6 @@ kex_send_kexinit(Kex *kex)
 	kex->flags |= KEX_INIT_SENT;
 }

-/* ARGSUSED */
 void
 kex_input_kexinit(int type, u_int32_t seq, void *ctxt)
 {
@@ -260,8 +258,7 @@ choose_enc(Enc *enc, char *client, char *server)
 {
 	char *name = match_list(client, server, NULL);
 	if (name == NULL)
-		fatal("no matching cipher found: client %s server %s",
-		    client, server);
+		fatal("no matching cipher found: client %s server %s", client, server);
 	if ((enc->cipher = cipher_by_name(name)) == NULL)
 		fatal("matching cipher is not supported: %s", name);
 	enc->name = name;
@@ -277,9 +274,8 @@ choose_mac(Mac *mac, char *client, char *server)
 {
 	char *name = match_list(client, server, NULL);
 	if (name == NULL)
-		fatal("no matching mac found: client %s server %s",
-		    client, server);
-	if (mac_setup(mac, name) < 0)
+		fatal("no matching mac found: client %s server %s", client, server);
+	if (mac_init(mac, name) < 0)
 		fatal("unsupported mac %s", name);
 	/* truncate the key */
 	if (datafellows & SSH_BUG_HMAC)
@@ -312,7 +308,7 @@ choose_kex(Kex *k, char *client, char *server)
 {
 	k->name = match_list(client, server, NULL);
 	if (k->name == NULL)
-		fatal("Unable to negotiate a key exchange method");
+		fatal("no kex alg");
 	if (strcmp(k->name, KEX_DH1) == 0) {
 		k->kex_type = KEX_DH_GRP1_SHA1;
 		k->evp_md = EVP_sha1();
@@ -392,8 +388,7 @@ kex_choose_conf(Kex *kex)
 	for (mode = 0; mode < MODE_MAX; mode++) {
 		newkeys = xcalloc(1, sizeof(*newkeys));
 		kex->newkeys[mode] = newkeys;
-		ctos = (!kex->server && mode == MODE_OUT) ||
-		    (kex->server && mode == MODE_IN);
+		ctos = (!kex->server && mode == MODE_OUT) || (kex->server && mode == MODE_IN);
 		nenc  = ctos ? PROPOSAL_ENC_ALGS_CTOS  : PROPOSAL_ENC_ALGS_STOC;
 		nmac  = ctos ? PROPOSAL_MAC_ALGS_CTOS  : PROPOSAL_MAC_ALGS_STOC;
 		ncomp = ctos ? PROPOSAL_COMP_ALGS_CTOS : PROPOSAL_COMP_ALGS_STOC;
@@ -1,4 +1,4 @@
-/* $OpenBSD: kex.h,v 1.46 2007/06/07 19:37:34 pvalchev Exp $ */
+/* $OpenBSD: kex.h,v 1.44 2006/08/03 03:34:42 deraadt Exp $ */

 /*
 * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
@@ -28,7 +28,6 @@

 #include <signal.h>
 #include <openssl/evp.h>
-#include <openssl/hmac.h>

 #define	KEX_DH1			"diffie-hellman-group1-sha1"
 #define	KEX_DH14		"diffie-hellman-group14-sha1"
@@ -87,13 +86,10 @@ struct Enc {
 struct Mac {
 	char	*name;
 	int	enabled;
+	const EVP_MD	*md;
 	u_int	mac_len;
 	u_char	*key;
 	u_int	key_len;
-	int	type;
-	const EVP_MD	*evp_md;
-	HMAC_CTX	evp_ctx;
-	struct umac_ctx *umac_ctx;
 };
 struct Comp {
 	int	type;
@@ -1,4 +1,4 @@
-/* $OpenBSD: key.c,v 1.69 2007/07/12 05:48:05 ray Exp $ */
+/* $OpenBSD: key.c,v 1.68 2006/11/06 21:25:28 markus Exp $ */
 /*
 * read_bignum():
 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -170,7 +170,9 @@ key_equal(const Key *a, const Key *b)
 		    BN_cmp(a->dsa->pub_key, b->dsa->pub_key) == 0;
 	default:
 		fatal("key_equal: bad key type %d", a->type);
+		break;
 	}
+	return 0;
 }

 u_char*
@@ -1,4 +1,4 @@
-/* $OpenBSD: log.c,v 1.40 2007/05/17 07:50:31 djm Exp $ */
+/* $OpenBSD: log.c,v 1.39 2006/08/18 09:13:25 deraadt Exp $ */
 /*
 * Author: Tatu Ylonen <ylo@cs.hut.fi>
 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -44,7 +44,6 @@
 #include <string.h>
 #include <syslog.h>
 #include <unistd.h>
-#include <errno.h>
 #if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H)
 # include <vis.h>
 #endif
@@ -314,7 +313,6 @@ do_log(LogLevel level, const char *fmt, va_list args)
 	char fmtbuf[MSGBUFSIZ];
 	char *txt = NULL;
 	int pri = LOG_INFO;
-	int saved_errno = errno;

 	if (level > log_level)
 		return;
@@ -375,5 +373,4 @@ do_log(LogLevel level, const char *fmt, va_list args)
 		closelog();
 #endif
 	}
-	errno = saved_errno;
 }
@@ -161,7 +161,6 @@
 #include <pwd.h>
 #include <stdarg.h>
 #include <string.h>
-#include <time.h>
 #include <unistd.h>

 #include "xmalloc.h"
@@ -1,4 +1,4 @@
-/* $OpenBSD: mac.c,v 1.14 2007/06/07 19:37:34 pvalchev Exp $ */
+/* $OpenBSD: mac.c,v 1.12 2006/08/03 03:34:42 deraadt Exp $ */
 /*
 * Copyright (c) 2001 Markus Friedl.  All rights reserved.
 *
@@ -42,126 +42,63 @@
 #include "mac.h"
 #include "misc.h"

-#include "umac.h"
-
-#define SSH_EVP		1	/* OpenSSL EVP-based MAC */
-#define SSH_UMAC	2	/* UMAC (not integrated with OpenSSL) */
-
 struct {
 	char		*name;
-	int		type;
 	const EVP_MD *	(*mdfunc)(void);
 	int		truncatebits;	/* truncate digest if != 0 */
-	int		key_len;	/* just for UMAC */
-	int		len;		/* just for UMAC */
 } macs[] = {
-	{ "hmac-sha1",			SSH_EVP, EVP_sha1, 0, -1, -1 },
-	{ "hmac-sha1-96",		SSH_EVP, EVP_sha1, 96, -1, -1 },
-	{ "hmac-md5",			SSH_EVP, EVP_md5, 0, -1, -1 },
-	{ "hmac-md5-96",		SSH_EVP, EVP_md5, 96, -1, -1 },
-	{ "hmac-ripemd160",		SSH_EVP, EVP_ripemd160, 0, -1, -1 },
-	{ "[email protected]",	SSH_EVP, EVP_ripemd160, 0, -1, -1 },
-	{ "[email protected]",	SSH_UMAC, NULL, 0, 128, 64 },
-	{ NULL,				0, NULL, 0, -1, -1 }
+	{ "hmac-sha1",			EVP_sha1, 0, },
+	{ "hmac-sha1-96",		EVP_sha1, 96 },
+	{ "hmac-md5",			EVP_md5, 0 },
+	{ "hmac-md5-96",		EVP_md5, 96 },
+	{ "hmac-ripemd160",		EVP_ripemd160, 0 },
+	{ "[email protected]",	EVP_ripemd160, 0 },
+	{ NULL,				NULL, 0 }
 };

-static void
-mac_setup_by_id(Mac *mac, int which)
-{
-	int evp_len;
-	mac->type = macs[which].type;
-	if (mac->type == SSH_EVP) {
-		mac->evp_md = (*macs[which].mdfunc)();
-		if ((evp_len = EVP_MD_size(mac->evp_md)) <= 0)
-			fatal("mac %s len %d", mac->name, evp_len);
-		mac->key_len = mac->mac_len = (u_int)evp_len;
-	} else {
-		mac->mac_len = macs[which].len / 8;
-		mac->key_len = macs[which].key_len / 8;
-		mac->umac_ctx = NULL;
-	}
-	if (macs[which].truncatebits != 0)
-		mac->mac_len = macs[which].truncatebits / 8;
-}
-
 int
-mac_setup(Mac *mac, char *name)
+mac_init(Mac *mac, char *name)
 {
-	int i;
+	int i, evp_len;

 	for (i = 0; macs[i].name; i++) {
 		if (strcmp(name, macs[i].name) == 0) {
-			if (mac != NULL)
-				mac_setup_by_id(mac, i);
-			debug2("mac_setup: found %s", name);
+			if (mac != NULL) {
+				mac->md = (*macs[i].mdfunc)();
+				if ((evp_len = EVP_MD_size(mac->md)) <= 0)
+					fatal("mac %s len %d", name, evp_len);
+				mac->key_len = mac->mac_len = (u_int)evp_len;
+				if (macs[i].truncatebits != 0)
+					mac->mac_len = macs[i].truncatebits/8;
+			}
+			debug2("mac_init: found %s", name);
 			return (0);
 		}
 	}
-	debug2("mac_setup: unknown %s", name);
+	debug2("mac_init: unknown %s", name);
 	return (-1);
 }

-int
-mac_init(Mac *mac)
-{
-	if (mac->key == NULL)
-		fatal("mac_init: no key");
-	switch (mac->type) {
-	case SSH_EVP:
-		if (mac->evp_md == NULL)
-			return -1;
-		HMAC_Init(&mac->evp_ctx, mac->key, mac->key_len, mac->evp_md);
-		return 0;
-	case SSH_UMAC:
-		mac->umac_ctx = umac_new(mac->key);
-		return 0;
-	default:
-		return -1;
-	}
-}
-
 u_char *
 mac_compute(Mac *mac, u_int32_t seqno, u_char *data, int datalen)
 {
+	HMAC_CTX c;
 	static u_char m[EVP_MAX_MD_SIZE];
-	u_char b[4], nonce[8];
+	u_char b[4];

+	if (mac->key == NULL)
+		fatal("mac_compute: no key");
 	if (mac->mac_len > sizeof(m))
-		fatal("mac_compute: mac too long %u %lu",
-		    mac->mac_len, sizeof(m));
-
-	switch (mac->type) {
-	case SSH_EVP:
-		put_u32(b, seqno);
-		/* reset HMAC context */
-		HMAC_Init(&mac->evp_ctx, NULL, 0, NULL);
-		HMAC_Update(&mac->evp_ctx, b, sizeof(b));
-		HMAC_Update(&mac->evp_ctx, data, datalen);
-		HMAC_Final(&mac->evp_ctx, m, NULL);
-		break;
-	case SSH_UMAC:
-		put_u64(nonce, seqno);
-		umac_update(mac->umac_ctx, data, datalen);
-		umac_final(mac->umac_ctx, m, nonce);
-		break;
-	default:
-		fatal("mac_compute: unknown MAC type");
-	}
+		fatal("mac_compute: mac too long");
+	HMAC_Init(&c, mac->key, mac->key_len, mac->md);
+	put_u32(b, seqno);
+	HMAC_Update(&c, b, sizeof(b));
+	HMAC_Update(&c, data, datalen);
+	HMAC_Final(&c, m, NULL);
+	HMAC_cleanup(&c);
 	return (m);
 }

-void
-mac_clear(Mac *mac)
-{
-	if (mac->type == SSH_UMAC) {
-		if (mac->umac_ctx != NULL)
-			umac_delete(mac->umac_ctx);
-	} else if (mac->evp_md != NULL)
-		HMAC_cleanup(&mac->evp_ctx);
-	mac->evp_md = NULL;
-	mac->umac_ctx = NULL;
-}
-
 /* XXX copied from ciphers_valid */
 #define	MAC_SEP	","
 int
@@ -174,7 +111,7 @@ mac_valid(const char *names)
 	maclist = cp = xstrdup(names);
 	for ((p = strsep(&cp, MAC_SEP)); p && *p != '\0';
 	    (p = strsep(&cp, MAC_SEP))) {
-		if (mac_setup(NULL, p) < 0) {
+		if (mac_init(NULL, p) < 0) {
 			debug("bad mac %s [%s]", p, names);
 			xfree(maclist);
 			return (0);
@@ -1,4 +1,4 @@
-/* $OpenBSD: mac.h,v 1.6 2007/06/07 19:37:34 pvalchev Exp $ */
+/* $OpenBSD: mac.h,v 1.4 2006/03/25 22:22:43 djm Exp $ */
 /*
 * Copyright (c) 2001 Markus Friedl.  All rights reserved.
 *
@@ -24,7 +24,5 @@
 */

 int	 mac_valid(const char *);
-int	 mac_setup(Mac *, char *);
-int	 mac_init(Mac *);
+int	 mac_init(Mac *, char *);
 u_char	*mac_compute(Mac *, u_int32_t, u_char *, int);
-void	 mac_clear(Mac *);
@@ -1,6 +1,6 @@
 #!/usr/bin/awk
 #
-# $Id: mdoc2man.awk,v 1.8 2007/06/05 10:01:16 dtucker Exp $
+# $Id: mdoc2man.awk,v 1.5.10.1 2007/06/05 10:05:38 dtucker Exp $
 #
 # Version history:
 #  v4+ Adapted for OpenSSH Portable (see cvs Id and history)
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor.c,v 1.91 2007/05/17 20:52:13 djm Exp $ */
+/* $OpenBSD: monitor.c,v 1.90 2007/02/19 10:45:58 dtucker Exp $ */
 /*
 * Copyright 2002 Niels Provos <provos@citi.umich.edu>
 * Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -409,7 +409,6 @@ monitor_child_postauth(struct monitor *pmonitor)
 	monitor_set_child_handler(pmonitor->m_pid);
 	signal(SIGHUP, &monitor_child_handler);
 	signal(SIGTERM, &monitor_child_handler);
-	signal(SIGINT, &monitor_child_handler);

 	if (compat20) {
 		mon_dispatch = mon_dispatch_postauth20;
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor_wrap.c,v 1.57 2007/06/07 19:37:34 pvalchev Exp $ */
+/* $OpenBSD: monitor_wrap.c,v 1.55 2007/02/19 10:45:58 dtucker Exp $ */
 /*
 * Copyright 2002 Niels Provos <provos@citi.umich.edu>
 * Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -476,8 +476,8 @@ mm_newkeys_from_blob(u_char *blob, int blen)

 	/* Mac structure */
 	mac->name = buffer_get_string(&b, NULL);
-	if (mac->name == NULL || mac_setup(mac, mac->name) == -1)
-		fatal("%s: can not setup mac %s", __func__, mac->name);
+	if (mac->name == NULL || mac_init(mac, mac->name) == -1)
+		fatal("%s: can not init mac %s", __func__, mac->name);
 	mac->enabled = buffer_get_int(&b);
 	mac->key = buffer_get_string(&b, &len);
 	if (len > mac->key_len)
@@ -1,4 +1,4 @@
-/* $OpenBSD: myproposal.h,v 1.22 2007/06/07 19:37:34 pvalchev Exp $ */
+/* $OpenBSD: myproposal.h,v 1.21 2006/03/25 22:22:43 djm Exp $ */

 /*
 * Copyright (c) 2000 Markus Friedl.  All rights reserved.
@@ -47,7 +47,7 @@
 	"aes192-cbc,aes256-cbc,[email protected]," \
 	"aes128-ctr,aes192-ctr,aes256-ctr"
 #define	KEX_DEFAULT_MAC \
-	"hmac-md5,hmac-sha1,[email protected],hmac-ripemd160," \
+	"hmac-md5,hmac-sha1,hmac-ripemd160," \
 	"[email protected]," \
 	"hmac-sha1-96,hmac-md5-96"
 #define	KEX_DEFAULT_COMP	"none,[email protected],zlib"
@@ -1,4 +1,4 @@
-# $Id: Makefile.in,v 1.41 2007/06/25 12:15:13 dtucker Exp $
+# $Id: Makefile.in,v 1.40 2006/08/30 17:24:41 djm Exp $

 sysconfdir=@sysconfdir@
 piddir=@piddir@
@@ -18,7 +18,7 @@ LDFLAGS=-L. @LDFLAGS@

 OPENBSD=base64.o basename.o bindresvport.o daemon.o dirname.o getcwd.o getgrouplist.o getopt.o getrrsetbyname.o glob.o inet_aton.o inet_ntoa.o inet_ntop.o mktemp.o readpassphrase.o realpath.o rresvport.o setenv.o setproctitle.o sha2.o sigact.o strlcat.o strlcpy.o strmode.o strsep.o strtonum.o strtoll.o strtoul.o vis.o

-COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-snprintf.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o
+COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-snprintf.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o

 PORTS=port-aix.o port-irix.o port-linux.o port-solaris.o port-tun.o port-uw.o

@@ -1,5 +1,5 @@
 /* 
- * $Id: bsd-cray.c,v 1.17 2007/08/15 09:17:43 dtucker Exp $
+ * $Id: bsd-cray.c,v 1.16 2006/09/01 05:38:41 djm Exp $
 *
 * bsd-cray.c
 *
@@ -751,6 +751,8 @@ cray_job_termination_handler(int sig)
 	char *login = NULL;
 	struct jtab jtab;

+	debug("received signal %d",sig);
+
 	if ((jid = waitjob(&jtab)) == -1 ||
 	    (login = uid2nam(jtab.j_uid)) == NULL)
 		return;
@@ -37,28 +37,6 @@ getpeereid(int s, uid_t *euid, gid_t *gid)

 	return (0);
 }
-#elif defined(HAVE_GETPEERUCRED)
-
-#ifdef HAVE_UCRED_H
-# include <ucred.h>
-#endif
-
-int
-getpeereid(int s, uid_t *euid, gid_t *gid)
-{
-	ucred_t *ucred = NULL;
-
-	if (getpeerucred(s, &ucred) == -1)
-		return (-1);
-	if ((*euid = ucred_geteuid(ucred)) == -1)
-		return (-1);
-	if ((*gid = ucred_getrgid(ucred)) == -1)
-		return (-1);
-
-	ucred_free(ucred);
-
-	return (0);
-}
 #else
 int
 getpeereid(int s, uid_t *euid, gid_t *gid)
@@ -17,7 +17,6 @@

 #include "includes.h"

-#include <sys/types.h>
 #ifdef HAVE_SYS_SELECT_H
 # include <sys/select.h>
 #endif
@@ -28,7 +27,6 @@
 #include <string.h>
 #include <signal.h>
 #include <stdlib.h>
-#include <unistd.h>

 #include "xmalloc.h"

@@ -158,8 +156,7 @@ int nanosleep(const struct timespec *req, struct timespec *rem)
 		tremain.tv_sec = 0;
 		tremain.tv_usec = 0;
 	}
-	if (rem != NULL)
-		TIMEVAL_TO_TIMESPEC(&tremain, rem)
+	TIMEVAL_TO_TIMESPEC(&tremain, rem)

 	return(rc);
 }
@@ -1,117 +0,0 @@
-/* $Id: bsd-poll.c,v 1.1 2007/06/25 12:15:13 dtucker Exp $ */
-
-/*
- * Copyright (c) 2004, 2005, 2007 Darren Tucker (dtucker at zip com au).
- *
- * Permission to use, copy, modify, and distribute this software for any
- * purpose with or without fee is hereby granted, provided that the above
- * copyright notice and this permission notice appear in all copies.
- *
- * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
- * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
- * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
- * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
- * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
- * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
- */
-
-#include "includes.h"
-#if !defined(HAVE_POLL) && defined(HAVE_SELECT)
-
-#ifdef HAVE_SYS_SELECT_H
-# include <sys/select.h>
-#endif
-
-#include <errno.h>
-#include "bsd-poll.h"
-
-/*
- * A minimal implementation of poll(2), built on top of select(2).
- *
- * Only supports POLLIN and POLLOUT flags in pfd.events, and POLLIN, POLLOUT
- * and POLLERR flags in revents.
- *
- * Supports pfd.fd = -1 meaning "unused" although it's not standard.
- */
-
-int
-poll(struct pollfd *fds, nfds_t nfds, int timeout)
-{
-	nfds_t i;
-	int saved_errno, ret, fd, maxfd = 0;
-	fd_set *readfds = NULL, *writefds = NULL, *exceptfds = NULL;
-	size_t nmemb;
-	struct timeval tv, *tvp = NULL;
-
-	for (i = 0; i < nfds; i++) {
-		if (fd >= FD_SETSIZE) {
-			errno = EINVAL;
-			return -1;
-		}
-		maxfd = MAX(maxfd, fds[i].fd);
-	}
-
-	nmemb = howmany(maxfd + 1 , NFDBITS);
-	if ((readfds = calloc(nmemb, sizeof(fd_mask))) == NULL ||
-	    (writefds = calloc(nmemb, sizeof(fd_mask))) == NULL ||
-	    (exceptfds = calloc(nmemb, sizeof(fd_mask))) == NULL) {
-		saved_errno = ENOMEM;
-		ret = -1;
-		goto out;
-	}
-
-	/* populate event bit vectors for the events we're interested in */
-	for (i = 0; i < nfds; i++) {
-		fd = fds[i].fd;
-		if (fd == -1)
-			continue;
-		if (fds[i].events & POLLIN) {
-			FD_SET(fd, readfds);
-			FD_SET(fd, exceptfds);
-		}
-		if (fds[i].events & POLLOUT) {
-			FD_SET(fd, writefds);
-			FD_SET(fd, exceptfds);
-		}
-	}
-
-	/* poll timeout is msec, select is timeval (sec + usec) */
-	if (timeout >= 0) {
-		tv.tv_sec = timeout / 1000;
-		tv.tv_usec = (timeout % 1000) * 1000;
-		tvp = &tv;
-	}
-
-	ret = select(maxfd + 1, readfds, writefds, exceptfds, tvp);
-	saved_errno = errno;
-
-	/* scan through select results and set poll() flags */
-	for (i = 0; i < nfds; i++) {
-		fd = fds[i].fd;
-		fds[i].revents = 0;
-		if (fd == -1)
-			continue;
-		if (FD_ISSET(fd, readfds)) {
-			fds[i].revents |= POLLIN;
-		}
-		if (FD_ISSET(fd, writefds)) {
-			fds[i].revents |= POLLOUT;
-		}
-		if (FD_ISSET(fd, exceptfds)) {
-			fds[i].revents |= POLLERR;
-		}
-	}
-
-out:
-	if (readfds != NULL)
-		free(readfds);
-	if (writefds != NULL)
-		free(writefds);
-	if (exceptfds != NULL)
-		free(exceptfds);
-	if (ret == -1)
-		errno = saved_errno;
-	return ret;
-}
-#endif
@@ -1,61 +0,0 @@
-/*	$OpenBSD: poll.h,v 1.11 2003/12/10 23:10:08 millert Exp $ */
-
-/*
- * Copyright (c) 1996 Theo de Raadt
- * All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
- * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
- * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
- * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-/* OPENBSD ORIGINAL: sys/sys/poll.h */
-
-#if !defined(HAVE_POLL) && !defined(HAVE_POLL_H)
-#ifndef	_COMPAT_POLL_H_
-#define	_COMPAT_POLL_H_
-
-typedef struct pollfd {
-	int 	fd;
-	short	events;
-	short	revents;
-} pollfd_t;
-
-typedef unsigned int	nfds_t;
-
-#define	POLLIN		0x0001
-#define	POLLOUT		0x0004
-#define	POLLERR		0x0008
-#if 0
-/* the following are currently not implemented */
-#define	POLLPRI		0x0002
-#define	POLLHUP		0x0010
-#define	POLLNVAL	0x0020
-#define	POLLRDNORM	0x0040
-#define POLLNORM	POLLRDNORM
-#define POLLWRNORM      POLLOUT
-#define	POLLRDBAND	0x0080
-#define	POLLWRBAND	0x0100
-#endif
-
-#define INFTIM		(-1)	/* not standard */
-
-int   poll(struct pollfd *, nfds_t, int);
-#endif /* !_COMPAT_POLL_H_ */
-#endif /* !HAVE_POLL_H */
@@ -1,4 +1,4 @@
-/* $Id: openbsd-compat.h,v 1.43 2007/06/25 12:15:13 dtucker Exp $ */
+/* $Id: openbsd-compat.h,v 1.42 2006/09/03 12:44:50 dtucker Exp $ */

 /*
 * Copyright (c) 1999-2003 Damien Miller.  All rights reserved.
@@ -140,7 +140,6 @@ int writev(int, struct iovec *, int);
 /* Home grown routines */
 #include "bsd-misc.h"
 #include "bsd-waitpid.h"
-#include "bsd-poll.h"

 #ifndef HAVE_GETPEEREID
 int getpeereid(int , uid_t *, gid_t *);
@@ -1,4 +1,4 @@
-/* $Id: openssl-compat.h,v 1.10 2007/06/14 13:47:31 dtucker Exp $ */
+/* $Id: openssl-compat.h,v 1.7 2007/03/05 07:25:20 dtucker Exp $ */

 /*
 * Copyright (c) 2005 Darren Tucker <dtucker@zip.com.au>
@@ -29,11 +29,6 @@
 #endif

 #ifdef USE_BUILTIN_RIJNDAEL
-# include "rijndael.h"
-# define AES_KEY rijndael_ctx
-# define AES_BLOCK_SIZE 16
-# define AES_encrypt(a, b, c)		rijndael_encrypt(c, a, b)
-# define AES_set_encrypt_key(a, b, c)	rijndael_set_key(c, (char *)a, b, 1)
 # define EVP_aes_128_cbc evp_rijndael
 # define EVP_aes_192_cbc evp_rijndael
 # define EVP_aes_256_cbc evp_rijndael
@@ -240,7 +240,7 @@ sys_auth_allowed_user(struct passwd *pw, Buffer *loginmsg)

 	/*
 	 * Don't perform checks for root account (PermitRootLogin controls
-	 * logins via ssh) or if running as non-root user (since
+	 * logins via * ssh) or if running as non-root user (since
 	 * loginrestrictions will always fail due to insufficient privilege).
 	 */
 	if (pw->pw_uid == 0 || geteuid() != 0) {
@@ -1,4 +1,4 @@
-/* $Id: port-linux.c,v 1.4 2007/06/27 22:48:03 djm Exp $ */
+/* $Id: port-linux.c,v 1.3.6.1 2007/06/28 00:07:44 dtucker Exp $ */

 /*
 * Copyright (c) 2005 Daniel Walsh <dwalsh@redhat.com>
@@ -38,7 +38,7 @@ main(void)
 	char buf[512];

 	for (i = 0; i < NUM_OPENS; i++)
-		if ((fds[i] = open("/dev/null", O_RDONLY)) == -1)
+		if ((fds[i] = open("/dev/null", "r")) == -1)
 			exit(0);	/* can't test */
 	max = i - 1;

@@ -23,7 +23,7 @@
 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */

-/* $Id: xmmap.c,v 1.14 2007/06/11 02:52:24 djm Exp $ */
+/* $Id: xmmap.c,v 1.12 2006/08/24 09:58:36 dtucker Exp $ */

 #include "includes.h"

@@ -38,14 +38,12 @@
 #endif
 #include <errno.h>
 #include <stdarg.h>
-#include <stdlib.h>
 #include <string.h>
 #include <unistd.h>

 #include "log.h"

-void *
-xmmap(size_t size)
+void *xmmap(size_t size)
 {
 #ifdef HAVE_MMAP
 	void *address;
@@ -19,7 +19,7 @@
 <service_bundle type='manifest' name='OpenSSH server'>

    <service
-        name='site/__SYSVINIT_NAME__'
+        name='site/openssh'
        type='service'
        version='1'>

@@ -56,7 +56,7 @@
        <exec_method
            name='start'
            type='method'
-            exec='__SMF_METHOD_DIR__/__SYSVINIT_NAME__ start'
+            exec='/lib/svc/method/site/__SYSVINIT_NAME__ start'
            timeout_seconds='60'>
            <method_context/>
        </exec_method>
@@ -1,4 +1,4 @@
-/* $OpenBSD: packet.c,v 1.148 2007/06/07 19:37:34 pvalchev Exp $ */
+/* $OpenBSD: packet.c,v 1.145 2006/09/19 21:14:08 markus Exp $ */
 /*
 * Author: Tatu Ylonen <ylo@cs.hut.fi>
 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -629,7 +629,7 @@ set_newkeys(int mode)
 		enc  = &newkeys[mode]->enc;
 		mac  = &newkeys[mode]->mac;
 		comp = &newkeys[mode]->comp;
-		mac_clear(mac);
+		memset(mac->key, 0, mac->key_len);
 		xfree(enc->name);
 		xfree(enc->iv);
 		xfree(enc->key);
@@ -644,15 +644,14 @@ set_newkeys(int mode)
 	enc  = &newkeys[mode]->enc;
 	mac  = &newkeys[mode]->mac;
 	comp = &newkeys[mode]->comp;
-	if (mac_init(mac) == 0)
+	if (mac->md != NULL)
 		mac->enabled = 1;
 	DBG(debug("cipher_init_context: %d", mode));
 	cipher_init(cc, enc->cipher, enc->key, enc->key_len,
 	    enc->iv, enc->block_size, crypt_type);
 	/* Deleting the keys does not gain extra security */
 	/* memset(enc->iv,  0, enc->block_size);
-	   memset(enc->key, 0, enc->key_len);
-	   memset(mac->key, 0, mac->key_len); */
+	   memset(enc->key, 0, enc->key_len); */
 	if ((comp->type == COMP_ZLIB ||
 	    (comp->type == COMP_DELAYED && after_authentication)) &&
 	    comp->enabled == 0) {
@@ -1236,6 +1235,7 @@ packet_read_poll_seqnr(u_int32_t *seqnr_p)
 				logit("Received disconnect from %s: %.400s",
 				    get_remote_ipaddr(), msg);
 				cleanup_exit(255);
+				xfree(msg);
 				break;
 			default:
 				if (type)
@@ -1,4 +1,4 @@
-/* $OpenBSD: readconf.c,v 1.162 2007/03/20 03:56:12 tedu Exp $ */
+/* $OpenBSD: readconf.c,v 1.161 2007/01/21 01:45:35 stevesk Exp $ */
 /*
 * Author: Tatu Ylonen <ylo@cs.hut.fi>
 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1224,7 +1224,7 @@ parse_forward(Forward *fwd, const char *fwdspec)
 	cp = p = xstrdup(fwdspec);

 	/* skip leading spaces */
-	while (isspace(*cp))
+	while (*cp && isspace(*cp))
 		cp++;

 	for (i = 0; i < 4; ++i)
@@ -7,9 +7,7 @@ UNPRIV=nobody
 ASOCK=${OBJ}/agent
 SSH_AUTH_SOCK=/nonexistant

-if grep "#undef.*HAVE_GETPEEREID" ${BUILDDIR}/config.h >/dev/null 2>&1 && \
-	grep "#undef.*HAVE_GETPEERUCRED" ${BUILDDIR}/config.h >/dev/null && \
-	grep "#undef.*HAVE_SO_PEERCRED" ${BUILDDIR}/config.h >/dev/null
+if grep "#undef.*HAVE_GETPEEREID" ${BUILDDIR}/config.h >/dev/null 2>&1
 then
 	echo "skipped (not supported on this platform)"
 	exit 0
@@ -9,9 +9,9 @@
 .\"
 .\" Created: Sun May  7 00:14:37 1995 ylo
 .\"
-.\" $OpenBSD: scp.1,v 1.42 2007/08/06 19:16:06 sobrado Exp $
+.\" $OpenBSD: scp.1,v 1.40 2006/07/18 07:56:28 jmc Exp $
 .\"
-.Dd $Mdocdate: August 6 2007 $
+.Dd September 25, 1999
 .Dt SCP 1
 .Os
 .Sh NAME
@@ -34,7 +34,7 @@
 .Ar host1 No :
 .Oc Ns Ar file1
 .Sm on
-.Ar ...
+.Op Ar ...
 .Sm off
 .Oo
 .Op Ar user No @
@@ -1,4 +1,4 @@
-/* $OpenBSD: scp.c,v 1.160 2007/08/06 19:16:06 sobrado Exp $ */
+/* $OpenBSD: scp.c,v 1.156 2007/01/22 13:06:21 djm Exp $ */
 /*
 * scp - secure remote copy.  This is basically patched BSD rcp which
 * uses ssh to do the data transfer (instead of using rcmd).
@@ -96,9 +96,6 @@
 #include <string.h>
 #include <time.h>
 #include <unistd.h>
-#if defined(HAVE_STRNVIS) && defined(HAVE_VIS_H)
-#include <vis.h>
-#endif

 #include "xmalloc.h"
 #include "atomicio.h"
@@ -585,7 +582,7 @@ source(int argc, char **argv)
 	off_t i, amt, statbytes;
 	size_t result;
 	int fd = -1, haderr, indx;
-	char *last, *name, buf[2048], encname[MAXPATHLEN];
+	char *last, *name, buf[2048];
 	int len;

 	for (indx = 0; indx < argc; ++indx) {
@@ -594,17 +591,17 @@ source(int argc, char **argv)
 		len = strlen(name);
 		while (len > 1 && name[len-1] == '/')
 			name[--len] = '\0';
-		if ((fd = open(name, O_RDONLY|O_NONBLOCK, 0)) < 0)
-			goto syserr;
 		if (strchr(name, '\n') != NULL) {
-			strnvis(encname, name, sizeof(encname), VIS_NL);
-			name = encname;
+			run_err("%s: skipping, filename contains a newline",
+			    name);
+			goto next;
 		}
+		if ((fd = open(name, O_RDONLY, 0)) < 0)
+			goto syserr;
 		if (fstat(fd, &stb) < 0) {
 syserr:			run_err("%s: %s", name, strerror(errno));
 			goto next;
 		}
-		unset_nonblock(fd);
 		switch (stb.st_mode & S_IFMT) {
 		case S_IFREG:
 			break;
@@ -1120,7 +1117,7 @@ usage(void)
 	(void) fprintf(stderr,
 	    "usage: scp [-1246BCpqrv] [-c cipher] [-F ssh_config] [-i identity_file]\n"
 	    "           [-l limit] [-o ssh_option] [-P port] [-S program]\n"
-	    "           [[user@]host1:]file1 ... [[user@]host2:]file2\n");
+	    "           [[user@]host1:]file1 [...] [[user@]host2:]file2\n");
 	exit(1);
 }

@@ -1310,7 +1310,7 @@ do_setusercontext(struct passwd *pw)
 # ifdef USE_PAM
 		if (options.use_pam) {
 			do_pam_session();
-			do_pam_setcred(use_privsep);
+			do_pam_setcred(0);
 		}
 # endif /* USE_PAM */
 		if (setusercontext(lc, pw, pw->pw_uid,
@@ -1352,7 +1352,7 @@ do_setusercontext(struct passwd *pw)
 		 */
 		if (options.use_pam) {
 			do_pam_session();
-			do_pam_setcred(use_privsep);
+			do_pam_setcred(0);
 		}
 # endif /* USE_PAM */
 # if defined(WITH_IRIX_PROJECT) || defined(WITH_IRIX_JOBS) || defined(WITH_IRIX_ARRAY)
@@ -2478,19 +2478,8 @@ do_cleanup(Authctxt *authctxt)
 		return;
 	called = 1;

-	if (authctxt == NULL)
+	if (authctxt == NULL || !authctxt->authenticated)
 		return;
-
-#ifdef USE_PAM
-	if (options.use_pam) {
-		sshpam_cleanup();
-		sshpam_thread_cleanup();
-	}
-#endif
-
-	if (!authctxt->authenticated)
-		return;
-
 #ifdef KRB5
 	if (options.kerberos_ticket_cleanup &&
 	    authctxt->krb5_ctx)
@@ -2502,6 +2491,13 @@ do_cleanup(Authctxt *authctxt)
 		ssh_gssapi_cleanup_creds();
 #endif

+#ifdef USE_PAM
+	if (options.use_pam) {
+		sshpam_cleanup();
+		sshpam_thread_cleanup();
+	}
+#endif
+
 	/* remove agent socket */
 	auth_sock_cleanup_proc(authctxt->pw);

@@ -1,4 +1,4 @@
-.\" $OpenBSD: sftp-server.8,v 1.12 2007/05/31 19:20:16 jmc Exp $
+.\" $OpenBSD: sftp-server.8,v 1.11 2006/07/06 10:47:57 djm Exp $
 .\"
 .\" Copyright (c) 2000 Markus Friedl.  All rights reserved.
 .\"
@@ -22,7 +22,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: May 31 2007 $
+.Dd August 30, 2000
 .Dt SFTP-SERVER 8
 .Os
 .Sh NAME
@@ -1,4 +1,4 @@
-/* $OpenBSD: sftp-server.c,v 1.73 2007/05/17 07:55:29 djm Exp $ */
+/* $OpenBSD: sftp-server.c,v 1.71 2007/01/03 07:22:36 stevesk Exp $ */
 /*
 * Copyright (c) 2000-2004 Markus Friedl.  All rights reserved.
 *
@@ -319,8 +319,7 @@ handle_log_close(int handle, char *emsg)
 		logit("%s%sclose \"%s\" bytes read %llu written %llu",
 		    emsg == NULL ? "" : emsg, emsg == NULL ? "" : " ",
 		    handle_to_name(handle),
-		    (unsigned long long)handle_bytes_read(handle),
-		    (unsigned long long)handle_bytes_write(handle));
+		    handle_bytes_read(handle), handle_bytes_write(handle));
 	} else {
 		logit("%s%sclosedir \"%s\"",
 		    emsg == NULL ? "" : emsg, emsg == NULL ? "" : " ",
@@ -703,8 +702,7 @@ process_setstat(void)
 	a = get_attrib();
 	debug("request %u: setstat name \"%s\"", id, name);
 	if (a->flags & SSH2_FILEXFER_ATTR_SIZE) {
-		logit("set \"%s\" size %llu",
-		    name, (unsigned long long)a->size);
+		logit("set \"%s\" size %llu", name, a->size);
 		ret = truncate(name, a->size);
 		if (ret == -1)
 			status = errno_to_portable(errno);
@@ -756,8 +754,7 @@ process_fsetstat(void)
 		char *name = handle_to_name(handle);

 		if (a->flags & SSH2_FILEXFER_ATTR_SIZE) {
-			logit("set \"%s\" size %llu",
-			    name, (unsigned long long)a->size);
+			logit("set \"%s\" size %llu", name, a->size);
 			ret = ftruncate(fd, a->size);
 			if (ret == -1)
 				status = errno_to_portable(errno);
@@ -1214,7 +1211,7 @@ main(int argc, char **argv)
 	int in, out, max, ch, skipargs = 0, log_stderr = 0;
 	ssize_t len, olen, set_size;
 	SyslogFacility log_facility = SYSLOG_FACILITY_AUTH;
-	char *cp, buf[4*4096];
+	char *cp;

 	extern char *optarg;
 	extern char *__progname;
@@ -1298,15 +1295,7 @@ main(int argc, char **argv)
 		memset(rset, 0, set_size);
 		memset(wset, 0, set_size);

-		/*
-		 * Ensure that we can read a full buffer and handle
-		 * the worst-case length packet it can generate,
-		 * otherwise apply backpressure by stopping reads.
-		 */
-		if (buffer_check_alloc(&iqueue, sizeof(buf)) &&
-		    buffer_check_alloc(&oqueue, SFTP_MAX_MSG_LENGTH))
-			FD_SET(in, rset);
-
+		FD_SET(in, rset);
 		olen = buffer_len(&oqueue);
 		if (olen > 0)
 			FD_SET(out, wset);
@@ -1320,6 +1309,7 @@ main(int argc, char **argv)

 		/* copy stdin to iqueue */
 		if (FD_ISSET(in, rset)) {
+			char buf[4*4096];
 			len = read(in, buf, sizeof buf);
 			if (len == 0) {
 				debug("read eof");
@@ -1341,13 +1331,7 @@ main(int argc, char **argv)
 				buffer_consume(&oqueue, len);
 			}
 		}
-
-		/*
-		 * Process requests from client if we can fit the results
-		 * into the output buffer, otherwise stop processing input
-		 * and let the output queue drain.
-		 */
-		if (buffer_check_alloc(&oqueue, SFTP_MAX_MSG_LENGTH))
-			process();
+		/* process requests from client */
+		process();
 	}
 }
@@ -1,4 +1,4 @@
-.\" $OpenBSD: sftp.1,v 1.64 2007/05/31 19:20:16 jmc Exp $
+.\" $OpenBSD: sftp.1,v 1.63 2006/01/20 00:14:55 dtucker Exp $
 .\"
 .\" Copyright (c) 2001 Damien Miller.  All rights reserved.
 .\"
@@ -22,7 +22,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: May 31 2007 $
+.Dd February 4, 2001
 .Dt SFTP 1
 .Os
 .Sh NAME
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: ssh-add.1,v 1.46 2007/06/12 13:41:03 jmc Exp $
+.\"	$OpenBSD: ssh-add.1,v 1.43 2005/04/21 06:17:50 djm Exp $
 .\"
 .\"  -*- nroff -*-
 .\"
@@ -37,7 +37,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: June 12 2007 $
+.Dd September 25, 1999
 .Dt SSH-ADD 1
 .Os
 .Sh NAME
@@ -89,18 +89,7 @@ program, rather than text entered into the requester.
 .It Fl D
 Deletes all identities from the agent.
 .It Fl d
-Instead of adding identities, removes identities from the agent.
-If
-.Nm
-has been run without arguments, the keys for the default identities will
-be removed.
-Otherwise, the argument list will be interpreted as a list of paths to
-public key files and matching keys will be removed from the agent.
-If no public key is found at a given path,
-.Nm
-will append
-.Pa .pub
-and retry.
+Instead of adding the identity, removes the identity from the agent.
 .It Fl e Ar reader
 Remove key in smartcard
 .Ar reader .
@@ -1,4 +1,4 @@
-.\" $OpenBSD: ssh-agent.1,v 1.45 2007/05/31 19:20:16 jmc Exp $
+.\" $OpenBSD: ssh-agent.1,v 1.44 2006/07/18 08:03:09 jmc Exp $
 .\"
 .\" Author: Tatu Ylonen <[email protected]>
 .\" Copyright (c) 1995 Tatu Ylonen <[email protected]>, Espoo, Finland
@@ -34,7 +34,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: May 31 2007 $
+.Dd September 25, 1999
 .Dt SSH-AGENT 1
 .Os
 .Sh NAME
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-agent.c,v 1.155 2007/03/19 12:16:42 dtucker Exp $ */
+/* $OpenBSD: ssh-agent.c,v 1.154 2007/02/28 00:55:30 dtucker Exp $ */
 /*
 * Author: Tatu Ylonen <ylo@cs.hut.fi>
 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -120,7 +120,6 @@ int max_fd = 0;

 /* pid of shell == parent of agent */
 pid_t parent_pid = -1;
-u_int parent_alive_interval = 0;

 /* pathname and directory for AUTH_SOCKET */
 char socket_name[MAXPATHLEN];
@@ -422,11 +421,10 @@ process_remove_all_identities(SocketEntry *e, int version)
 	buffer_put_char(&e->output, SSH_AGENT_SUCCESS);
 }

-/* removes expired keys and returns number of seconds until the next expiry */
-static u_int
+static void
 reaper(void)
 {
-	u_int deadline = 0, now = time(NULL);
+	u_int now = time(NULL);
 	Identity *id, *nxt;
 	int version;
 	Idtab *tab;
@@ -435,22 +433,14 @@ reaper(void)
 		tab = idtab_lookup(version);
 		for (id = TAILQ_FIRST(&tab->idlist); id; id = nxt) {
 			nxt = TAILQ_NEXT(id, next);
-			if (id->death == 0)
-				continue;
-			if (now >= id->death) {
+			if (id->death != 0 && now >= id->death) {
 				debug("expiring key '%s'", id->comment);
 				TAILQ_REMOVE(&tab->idlist, id, next);
 				free_identity(id);
 				tab->nentries--;
-			} else
-				deadline = (deadline == 0) ? id->death :
-				    MIN(deadline, id->death);
+			}
 		}
 	}
-	if (deadline == 0 || deadline <= now)
-		return 0;
-	else
-		return (deadline - now);
 }

 static void
@@ -836,12 +826,10 @@ new_socket(sock_type type, int fd)
 }

 static int
-prepare_select(fd_set **fdrp, fd_set **fdwp, int *fdl, u_int *nallocp,
-    struct timeval **tvpp)
+prepare_select(fd_set **fdrp, fd_set **fdwp, int *fdl, u_int *nallocp)
 {
-	u_int i, sz, deadline;
+	u_int i, sz;
 	int n = 0;
-	static struct timeval tv;

 	for (i = 0; i < sockets_alloc; i++) {
 		switch (sockets[i].type) {
@@ -885,17 +873,6 @@ prepare_select(fd_set **fdrp, fd_set **fdwp, int *fdl, u_int *nallocp,
 			break;
 		}
 	}
-	deadline = reaper();
-	if (parent_alive_interval != 0)
-		deadline = (deadline == 0) ? parent_alive_interval :
-		    MIN(deadline, parent_alive_interval);
-	if (deadline == 0) {
-		*tvpp = NULL;
-	} else {
-		tv.tv_sec = deadline;
-		tv.tv_usec = 0;
-		*tvpp = &tv;
-	}
 	return (1);
 }

@@ -1003,14 +980,19 @@ cleanup_handler(int sig)
 	_exit(2);
 }

+/*ARGSUSED*/
 static void
-check_parent_exists(void)
+check_parent_exists(int sig)
 {
+	int save_errno = errno;
+
 	if (parent_pid != -1 && kill(parent_pid, 0) < 0) {
 		/* printf("Parent has died - Authentication agent exiting.\n"); */
-		cleanup_socket();
-		_exit(2);
+		cleanup_handler(sig); /* safe */
 	}
+	mysignal(SIGALRM, check_parent_exists);
+	alarm(10);
+	errno = save_errno;
 }

 static void
@@ -1045,7 +1027,7 @@ main(int ac, char **av)
 	extern char *optarg;
 	pid_t pid;
 	char pidstrbuf[1 + 3 * sizeof pid];
-	struct timeval *tvp = NULL;
+	struct timeval tv;

 	/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
 	sanitise_stdfd();
@@ -1246,8 +1228,10 @@ main(int ac, char **av)

 skip:
 	new_socket(AUTH_SOCKET, sock);
-	if (ac > 0)
-		parent_alive_interval = 10;
+	if (ac > 0) {
+		mysignal(SIGALRM, check_parent_exists);
+		alarm(10);
+	}
 	idtab_init();
 	if (!d_flag)
 		signal(SIGINT, SIG_IGN);
@@ -1257,12 +1241,12 @@ skip:
 	nalloc = 0;

 	while (1) {
-		prepare_select(&readsetp, &writesetp, &max_fd, &nalloc, &tvp);
-		result = select(max_fd + 1, readsetp, writesetp, NULL, tvp);
+		tv.tv_sec = 10;
+		tv.tv_usec = 0;
+		prepare_select(&readsetp, &writesetp, &max_fd, &nalloc);
+		result = select(max_fd + 1, readsetp, writesetp, NULL, &tv);
 		saved_errno = errno;
-		if (parent_alive_interval != 0)
-			check_parent_exists();
-		(void) reaper();	/* remove expired keys */
+		reaper();	/* remove expired keys */
 		if (result < 0) {
 			if (saved_errno == EINTR)
 				continue;
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-gss.h,v 1.10 2007/06/12 08:20:00 djm Exp $ */
+/* $OpenBSD: ssh-gss.h,v 1.9 2006/08/18 14:40:34 djm Exp $ */
 /*
 * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
 *
@@ -105,6 +105,7 @@ void ssh_gssapi_supported_oids(gss_OID_set *);
 ssh_gssapi_mech *ssh_gssapi_get_ctype(Gssctxt *);

 OM_uint32 ssh_gssapi_import_name(Gssctxt *, const char *);
+OM_uint32 ssh_gssapi_acquire_cred(Gssctxt *);
 OM_uint32 ssh_gssapi_init_ctx(Gssctxt *, int,
    gss_buffer_desc *, gss_buffer_desc *, OM_uint32 *);
 OM_uint32 ssh_gssapi_accept_ctx(Gssctxt *,
@@ -115,11 +116,11 @@ char *ssh_gssapi_last_error(Gssctxt *, OM_uint32 *, OM_uint32 *);
 void ssh_gssapi_build_ctx(Gssctxt **);
 void ssh_gssapi_delete_ctx(Gssctxt **);
 OM_uint32 ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t);
+OM_uint32 ssh_gssapi_server_ctx(Gssctxt **, gss_OID);
 void ssh_gssapi_buildmic(Buffer *, const char *, const char *, const char *);
 int ssh_gssapi_check_mechanism(Gssctxt **, gss_OID, const char *);

 /* In the server */
-OM_uint32 ssh_gssapi_server_ctx(Gssctxt **, gss_OID);
 int ssh_gssapi_userok(char *name);
 OM_uint32 ssh_gssapi_checkmic(Gssctxt *, gss_buffer_t, gss_buffer_t);
 void ssh_gssapi_do_child(char ***, u_int *);
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: ssh-keygen.1,v 1.75 2007/05/31 19:20:16 jmc Exp $
+.\"	$OpenBSD: ssh-keygen.1,v 1.74 2007/01/12 20:20:41 jmc Exp $
 .\"
 .\"  -*- nroff -*-
 .\"
@@ -37,7 +37,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: May 31 2007 $
+.Dd September 25, 1999
 .Dt SSH-KEYGEN 1
 .Os
 .Sh NAME
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: ssh-keyscan.1,v 1.23 2007/05/31 19:20:16 jmc Exp $
+.\"	$OpenBSD: ssh-keyscan.1,v 1.22 2006/09/25 04:55:38 ray Exp $
 .\"
 .\" Copyright 1995, 1996 by David Mazieres <[email protected]>.
 .\"
@@ -6,7 +6,7 @@
 .\" permitted provided that due credit is given to the author and the
 .\" OpenBSD project by leaving this copyright notice intact.
 .\"
-.Dd $Mdocdate: May 31 2007 $
+.Dd January 1, 1996
 .Dt SSH-KEYSCAN 1
 .Os
 .Sh NAME
@@ -1,4 +1,4 @@
-.\" $OpenBSD: ssh-keysign.8,v 1.9 2007/05/31 19:20:16 jmc Exp $
+.\" $OpenBSD: ssh-keysign.8,v 1.8 2006/02/24 20:22:16 jmc Exp $
 .\"
 .\" Copyright (c) 2002 Markus Friedl.  All rights reserved.
 .\"
@@ -22,7 +22,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: May 31 2007 $
+.Dd May 24, 2002
 .Dt SSH-KEYSIGN 8
 .Os
 .Sh NAME
@@ -34,8 +34,8 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: ssh.1,v 1.270 2007/06/12 13:43:55 jmc Exp $
-.Dd $Mdocdate: June 12 2007 $
+.\" $OpenBSD: ssh.1,v 1.266 2006/12/11 21:25:46 markus Exp $
+.Dd September 25, 1999
 .Dt SSH 1
 .Os
 .Sh NAME
@@ -43,7 +43,7 @@
 .Nd OpenSSH SSH client (remote login program)
 .Sh SYNOPSIS
 .Nm ssh
-.Op Fl 1246AaCfgKkMNnqsTtVvXxY
+.Op Fl 1246AaCfgkMNnqsTtVvXxY
 .Op Fl b Ar bind_address
 .Op Fl c Ar cipher_spec
 .Oo Fl D\ \&
@@ -315,9 +315,6 @@ It is possible to have multiple
 .Fl i
 options (and multiple identities specified in
 configuration files).
-.It Fl K
-Enables GSSAPI-based authentication and forwarding (delegation) of GSSAPI
-credentials to the server.
 .It Fl k
 Disables forwarding (delegation) of GSSAPI credentials to the server.
 .It Fl L Xo
@@ -677,7 +674,7 @@ Both protocols support similar authentication methods,
 but protocol 2 is preferred since
 it provides additional mechanisms for confidentiality
 (the traffic is encrypted using AES, 3DES, Blowfish, CAST128, or Arcfour)
-and integrity (hmac-md5, hmac-sha1, umac-64, hmac-ripemd160).
+and integrity (hmac-md5, hmac-sha1, hmac-ripemd160).
 Protocol 1 lacks a strong mechanism for ensuring the
 integrity of the connection.
 .Pp
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh.c,v 1.301 2007/08/07 07:32:53 djm Exp $ */
+/* $OpenBSD: ssh.c,v 1.296 2007/06/12 11:11:08 djm Exp $ */
 /*
 * Author: Tatu Ylonen <ylo@cs.hut.fi>
 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -185,7 +185,7 @@ static void
 usage(void)
 {
 	fprintf(stderr,
-"usage: ssh [-1246AaCfgKkMNnqsTtVvXxY] [-b bind_address] [-c cipher_spec]\n"
+"usage: ssh [-1246AaCfgkMNnqsTtVvXxY] [-b bind_address] [-c cipher_spec]\n"
 "           [-D [bind_address:]port] [-e escape_char] [-F configfile]\n"
 "           [-i identity_file] [-L [bind_address:]port:host:hostport]\n"
 "           [-l login_name] [-m mac_spec] [-O ctl_cmd] [-o option] [-p port]\n"
@@ -272,7 +272,7 @@ main(int ac, char **av)

 again:
 	while ((opt = getopt(ac, av,
-	    "1246ab:c:e:fgi:kl:m:no:p:qstvxACD:F:I:KL:MNO:PR:S:TVw:XY")) != -1) {
+	    "1246ab:c:e:fgi:kl:m:no:p:qstvxACD:F:I:L:MNO:PR:S:TVw:XY")) != -1) {
 		switch (opt) {
 		case '1':
 			options.protocol = SSH_PROTO_1;
@@ -326,10 +326,6 @@ main(int ac, char **av)
 		case 'k':
 			options.gss_deleg_creds = 0;
 			break;
-		case 'K':
-			options.gss_authentication = 1;
-			options.gss_deleg_creds = 1;
-			break;
 		case 'i':
 			if (stat(optarg, &st) < 0) {
 				fprintf(stderr, "Warning: Identity file %s "
@@ -857,17 +853,6 @@ ssh_init_forwarding(void)
 				    "forwarding.");
 		}
 	}
-
-	/* Initiate tunnel forwarding. */
-	if (options.tun_open != SSH_TUNMODE_NO) {
-		if (client_request_tun_fwd(options.tun_open,
-		    options.tun_local, options.tun_remote) == -1) {
-			if (options.exit_on_forward_failure)
-				fatal("Could not request tunnel forwarding.");
-			else
-				error("Could not request tunnel forwarding.");
-		}
-	}			
 }

 static void
@@ -1130,6 +1115,33 @@ ssh_session2_setup(int id, void *arg)
 		packet_send();
 	}

+	if (options.tun_open != SSH_TUNMODE_NO) {
+		Channel *c;
+		int fd;
+
+		debug("Requesting tun.");
+		if ((fd = tun_open(options.tun_local,
+		    options.tun_open)) >= 0) {
+			c = channel_new("tun", SSH_CHANNEL_OPENING, fd, fd, -1,
+			    CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT,
+			    0, "tun", 1);
+			c->datagram = 1;
+#if defined(SSH_TUN_FILTER)
+			if (options.tun_open == SSH_TUNMODE_POINTOPOINT)
+				channel_register_filter(c->self, sys_tun_infilter,
+				    sys_tun_outfilter);
+#endif
+			packet_start(SSH2_MSG_CHANNEL_OPEN);
+			packet_put_cstring("[email protected]");
+			packet_put_int(c->self);
+			packet_put_int(c->local_window_max);
+			packet_put_int(c->local_maxpacket);
+			packet_put_int(options.tun_open);
+			packet_put_int(options.tun_remote);
+			packet_send();
+		}
+	}
+
 	client_session2_setup(id, tty_flag, subsystem_flag, getenv("TERM"),
 	    NULL, fileno(stdin), &command, environ, &ssh_subsystem_reply);

@@ -1189,6 +1201,7 @@ ssh_session2(void)

 	/* XXX should be pre-session */
 	ssh_init_forwarding();
+	ssh_control_listener();

 	if (!no_shell_flag || (datafellows & SSH_BUG_DUMMYCHAN))
 		id = ssh_session2_open();
@@ -1198,9 +1211,6 @@ ssh_session2(void)
 	    options.permit_local_command)
 		ssh_local_cmd(options.local_command);

-	/* Start listening for multiplex clients */
-	ssh_control_listener();
-
 	/* If requested, let ssh continue in the background. */
 	if (fork_after_authentication_flag)
 		if (daemon(1, 1) < 0)
@@ -1,4 +1,4 @@
-#	$OpenBSD: ssh_config,v 1.23 2007/06/08 04:40:40 pvalchev Exp $
+#	$OpenBSD: ssh_config,v 1.22 2006/05/29 12:56:33 dtucker Exp $

 # This is the ssh client system-wide configuration file.  See
 # ssh_config(5) for more information.  This file provides defaults for
@@ -38,7 +38,6 @@
 #   Protocol 2,1
 #   Cipher 3des
 #   Ciphers aes128-cbc,3des-cbc,blowfish-cbc,cast128-cbc,arcfour,aes192-cbc,aes256-cbc
-#   MACs hmac-md5,hmac-sha1,[email protected],hmac-ripemd160
 #   EscapeChar ~
 #   Tunnel no
 #   TunnelDevice any:any
@@ -34,8 +34,8 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: ssh_config.5,v 1.102 2007/08/15 12:13:41 stevesk Exp $
-.Dd $Mdocdate: August 15 2007 $
+.\" $OpenBSD: ssh_config.5,v 1.98 2007/01/10 13:23:22 jmc Exp $
+.Dd September 25, 1999
 .Dt SSH_CONFIG 5
 .Os
 .Sh NAME
@@ -387,7 +387,7 @@ data).
 Specifies whether
 .Xr ssh 1
 should terminate the connection if it cannot set up all requested
-dynamic, tunnel, local, and remote port forwardings.
+dynamic, local, and remote port forwardings.
 The argument must be
 .Dq yes
 or
@@ -641,10 +641,7 @@ The MAC algorithm is used in protocol version 2
 for data integrity protection.
 Multiple algorithms must be comma-separated.
 The default is:
-.Bd -literal -offset indent
-hmac-md5,hmac-sha1,[email protected],
-hmac-ripemd160,hmac-sha1-96,hmac-md5-96
-.Ed
+.Dq hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96 .
 .It Cm NoHostAuthenticationForLocalhost
 This option can be used if the home directory is shared across machines.
 In this case localhost will refer to a different machine on each of
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshconnect2.c,v 1.164 2007/05/17 23:53:41 jolan Exp $ */
+/* $OpenBSD: sshconnect2.c,v 1.162 2006/08/30 00:06:51 dtucker Exp $ */
 /*
 * Copyright (c) 2000 Markus Friedl.  All rights reserved.
 *
@@ -31,7 +31,6 @@
 #include <sys/stat.h>

 #include <errno.h>
-#include <netdb.h>
 #include <pwd.h>
 #include <signal.h>
 #include <stdarg.h>
@@ -1308,7 +1307,7 @@ userauth_hostbased(Authctxt *authctxt)
 	Sensitive *sensitive = authctxt->sensitive;
 	Buffer b;
 	u_char *signature, *blob;
-	char *chost, *pkalg, *p, myname[NI_MAXHOST];
+	char *chost, *pkalg, *p;
 	const char *service;
 	u_int blen, slen;
 	int ok, i, len, found = 0;
@@ -1332,16 +1331,7 @@ userauth_hostbased(Authctxt *authctxt)
 		return 0;
 	}
 	/* figure out a name for the client host */
-	p = NULL;
-	if (packet_connection_is_on_socket())
-		p = get_local_name(packet_get_connection_in());
-	if (p == NULL) {
-		if (gethostname(myname, sizeof(myname)) == -1) {
-			verbose("userauth_hostbased: gethostname: %s", 
-			    strerror(errno));
-		} else
-			p = xstrdup(myname);
-	}
+	p = get_local_name(packet_get_connection_in());
 	if (p == NULL) {
 		error("userauth_hostbased: cannot get local ipaddr/name");
 		key_free(private);
@@ -34,8 +34,8 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: sshd.8,v 1.237 2007/06/07 19:37:34 pvalchev Exp $
-.Dd $Mdocdate: June 11 2007 $
+.\" $OpenBSD: sshd.8,v 1.234 2006/08/21 08:15:57 dtucker Exp $
+.Dd September 25, 1999
 .Dt SSHD 8
 .Os
 .Sh NAME
@@ -58,11 +58,8 @@
 .Nm
 (OpenSSH Daemon) is the daemon program for
 .Xr ssh 1 .
-Together these programs replace
-.Xr rlogin 1
-and
-.Xr rsh 1 ,
-and provide secure encrypted communications between two untrusted hosts
+Together these programs replace rlogin and rsh, and
+provide secure encrypted communications between two untrusted hosts
 over an insecure network.
 .Pp
 .Nm
@@ -120,7 +117,7 @@ Maximum is 3.
 When this option is specified,
 .Nm
 will send the output to the standard error instead of the system log.
-.It Fl f Ar config_file
+.It Fl f Ar configuration_file
 Specifies the name of the configuration file.
 The default is
 .Pa /etc/ssh/sshd_config .
@@ -276,7 +273,7 @@ The client selects the encryption algorithm
 to use from those offered by the server.
 Additionally, session integrity is provided
 through a cryptographic message authentication code
-(hmac-md5, hmac-sha1, umac-64 or hmac-ripemd160).
+(hmac-sha1 or hmac-md5).
 .Pp
 Finally, the server and the client enter an authentication dialog.
 The client tries to authenticate itself using
@@ -302,9 +299,8 @@ on Tru64,
 a leading
 .Ql \&*LOCKED\&*
 on FreeBSD and a leading
-.Ql \&!
-on most Linuxes).
-If there is a requirement to disable password authentication
+.Ql \&!!
+on Linux).  If there is a requirement to disable password authentication
 for the account while allowing still public-key, then the passwd field
 should be set to something other than these values (eg
 .Ql NP
@@ -762,6 +758,15 @@ This file is used in exactly the same way as
 but allows host-based authentication without permitting login with
 rlogin/rsh.
 .Pp
+.It /etc/ssh/ssh_known_hosts
+Systemwide list of known host keys.
+This file should be prepared by the
+system administrator to contain the public host keys of all machines in the
+organization.
+The format of this file is described above.
+This file should be writable only by root/the owner and
+should be world-readable.
+.Pp
 .It /etc/ssh/ssh_host_key
 .It /etc/ssh/ssh_host_dsa_key
 .It /etc/ssh/ssh_host_rsa_key
@@ -785,15 +790,6 @@ the user so their contents can be copied to known hosts files.
 These files are created using
 .Xr ssh-keygen 1 .
 .Pp
-.It /etc/ssh/ssh_known_hosts
-Systemwide list of known host keys.
-This file should be prepared by the
-system administrator to contain the public host keys of all machines in the
-organization.
-The format of this file is described above.
-This file should be writable only by root/the owner and
-should be world-readable.
-.Pp
 .It /etc/ssh/sshd_config
 Contains configuration data for
 .Nm sshd .
@@ -830,7 +826,6 @@ The content of this file is not sensitive; it can be world-readable.
 .Xr ssh-add 1 ,
 .Xr ssh-agent 1 ,
 .Xr ssh-keygen 1 ,
-.Xr ssh-keyscan 1 ,
 .Xr chroot 2 ,
 .Xr hosts_access 5 ,
 .Xr login.conf 5 ,
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshd.c,v 1.351 2007/05/22 10:18:52 djm Exp $ */
+/* $OpenBSD: sshd.c,v 1.350 2007/03/09 05:20:06 dtucker Exp $ */
 /*
 * Author: Tatu Ylonen <ylo@cs.hut.fi>
 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1,4 +1,4 @@
-#	$OpenBSD: sshd_config,v 1.75 2007/03/19 01:01:29 djm Exp $
+#	$OpenBSD: sshd_config,v 1.74 2006/07/19 13:07:10 dtucker Exp $

 # This is the sshd server system-wide configuration file.  See
 # sshd_config(5) for more information.
@@ -11,15 +11,11 @@
 # default value.

 #Port 22
+#Protocol 2,1
 #AddressFamily any
 #ListenAddress 0.0.0.0
 #ListenAddress ::

-# Disable legacy (protocol version 1) support in the server for new
-# installations. In future the default will change to require explicit
-# activation of protocol 1
-Protocol 2
-
 # HostKey for protocol version 1
 #HostKey /etc/ssh/ssh_host_key
 # HostKeys for protocol version 2
@@ -34,8 +34,8 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: sshd_config.5,v 1.77 2007/06/08 07:48:09 jmc Exp $
-.Dd $Mdocdate: June 8 2007 $
+.\" $OpenBSD: sshd_config.5,v 1.74 2007/03/01 16:19:33 jmc Exp $
+.Dd September 25, 1999
 .Dt SSHD_CONFIG 5
 .Os
 .Sh NAME
@@ -489,10 +489,7 @@ The MAC algorithm is used in protocol version 2
 for data integrity protection.
 Multiple algorithms must be comma-separated.
 The default is:
-.Bd -literal -offset indent
-hmac-md5,hmac-sha1,[email protected],
-hmac-ripemd160,hmac-sha1-96,hmac-md5-96
-.Ed
+.Dq hmac-md5,hmac-sha1,hmac-ripemd160,hmac-sha1-96,hmac-md5-96 .
 .It Cm Match
 Introduces a conditional block.
 If all of the criteria on the
@@ -1,123 +0,0 @@
-/* $OpenBSD: umac.h,v 1.1 2007/06/07 19:37:34 pvalchev Exp $ */
-/* -----------------------------------------------------------------------
- * 
- * umac.h -- C Implementation UMAC Message Authentication
- *
- * Version 0.93a of rfc4418.txt -- 2006 July 14
- *
- * For a full description of UMAC message authentication see the UMAC
- * world-wide-web page at http://www.cs.ucdavis.edu/~rogaway/umac
- * Please report bugs and suggestions to the UMAC webpage.
- *
- * Copyright (c) 1999-2004 Ted Krovetz
- *                                                                 
- * Permission to use, copy, modify, and distribute this software and
- * its documentation for any purpose and with or without fee, is hereby
- * granted provided that the above copyright notice appears in all copies
- * and in supporting documentation, and that the name of the copyright
- * holder not be used in advertising or publicity pertaining to
- * distribution of the software without specific, written prior permission.
- *
- * Comments should be directed to Ted Krovetz (tdk@acm.org)                                        
- *                                                                   
- * ---------------------------------------------------------------------- */
- 
- /* ////////////////////// IMPORTANT NOTES /////////////////////////////////
-  *
-  * 1) This version does not work properly on messages larger than 16MB
-  *
-  * 2) If you set the switch to use SSE2, then all data must be 16-byte
-  *    aligned
-  *
-  * 3) When calling the function umac(), it is assumed that msg is in
-  * a writable buffer of length divisible by 32 bytes. The message itself
-  * does not have to fill the entire buffer, but bytes beyond msg may be
-  * zeroed.
-  *
-  * 4) Two free AES implementations are supported by this implementation of
-  * UMAC. Paulo Barreto's version is in the public domain and can be found
-  * at http://www.esat.kuleuven.ac.be/~rijmen/rijndael/ (search for
-  * "Barreto"). The only two files needed are rijndael-alg-fst.c and
-  * rijndael-alg-fst.h.
-  * Brian Gladman's version is distributed with GNU Public lisence
-  * and can be found at http://fp.gladman.plus.com/AES/index.htm. It
-  * includes a fast IA-32 assembly version.
-  *
-  /////////////////////////////////////////////////////////////////////// */
-#ifndef HEADER_UMAC_H
-#define HEADER_UMAC_H
-
-
-#ifdef __cplusplus
-    extern "C" {
-#endif
-
-struct umac_ctx *umac_new(u_char key[]);
-/* Dynamically allocate a umac_ctx struct, initialize variables, 
- * generate subkeys from key.
- */
-
-#if 0
-int umac_reset(struct umac_ctx *ctx);
-/* Reset a umac_ctx to begin authenicating a new message */
-#endif
-
-int umac_update(struct umac_ctx *ctx, u_char *input, long len);
-/* Incorporate len bytes pointed to by input into context ctx */
-
-int umac_final(struct umac_ctx *ctx, u_char tag[], u_char nonce[8]);
-/* Incorporate any pending data and the ctr value, and return tag. 
- * This function returns error code if ctr < 0. 
- */
-
-int umac_delete(struct umac_ctx *ctx);
-/* Deallocate the context structure */
-
-#if 0
-int umac(struct umac_ctx *ctx, u_char *input, 
-         long len, u_char tag[],
-         u_char nonce[8]);
-/* All-in-one implementation of the functions Reset, Update and Final */
-#endif
-
-/* uhash.h */
-
-
-#if 0
-typedef struct uhash_ctx *uhash_ctx_t;
-  /* The uhash_ctx structure is defined by the implementation of the    */
-  /* UHASH functions.                                                   */
- 
-uhash_ctx_t uhash_alloc(u_char key[16]);
-  /* Dynamically allocate a uhash_ctx struct and generate subkeys using */
-  /* the kdf and kdf_key passed in. If kdf_key_len is 0 then RC6 is     */
-  /* used to generate key with a fixed key. If kdf_key_len > 0 but kdf  */
-  /* is NULL then the first 16 bytes pointed at by kdf_key is used as a */
-  /* key for an RC6 based KDF.                                          */
-  
-int uhash_free(uhash_ctx_t ctx);
-
-int uhash_set_params(uhash_ctx_t ctx,
-                   void       *params);
-
-int uhash_reset(uhash_ctx_t ctx);
-
-int uhash_update(uhash_ctx_t ctx,
-               u_char       *input,
-               long        len);
-
-int uhash_final(uhash_ctx_t ctx,
-              u_char        ouput[]);
-
-int uhash(uhash_ctx_t ctx,
-        u_char       *input,
-        long        len,
-        u_char        output[]);
-
-#endif
-
-#ifdef __cplusplus
-    }
-#endif
-
-#endif /* HEADER_UMAC_H */
@@ -1,6 +1,6 @@
-/* $OpenBSD: version.h,v 1.50 2007/08/15 08:16:49 markus Exp $ */
+/* $OpenBSD: version.h,v 1.49 2007/03/06 10:13:14 djm Exp $ */

-#define SSH_VERSION	"OpenSSH_4.7"
+#define SSH_VERSION	"OpenSSH_4.6"

 #define SSH_PORTABLE	"p1"
 #define SSH_RELEASE	SSH_VERSION SSH_PORTABLE
Author	SHA1	Message	Date
Darren Tucker	4f606dd5c3	- (djm) bz#1325: Fix SELinux in permissive mode where it would incorrectly fatal() on errors. patch from cjwatson AT debian.org; ok dtucker (backport from current)	2007-06-28 10:07:43 +10:00
Darren Tucker	202c17be30	- [email protected] 2007/06/14 22:48:05 [ssh.c] when waiting for the multiplex exit status, read until the master end writes an entire int of data and closes the client_fd; fixes mux regression spotted by dtucker, ok dtucker@	2007-06-25 18:59:31 +10:00
Darren Tucker	20c4012e60	- [email protected] 2007/06/14 21:43:25 [ssh.c] handle EINTR when waiting for mux exit status properly	2007-06-25 18:43:03 +10:00
Darren Tucker	a422cfcd46	- [email protected] 2007/06/14 21:43:25 [ssh.c] handle EINTR when waiting for mux exit status properly	2007-06-25 18:35:49 +10:00
Darren Tucker	e64ad08d0c	- [email protected] 2007/06/13 00:21:27 [scp.c] don't ftruncate() non-regular files; bz#1236 reported by wood AT xmission.com; ok dtucker@	2007-06-25 18:33:56 +10:00
Darren Tucker	1ed2740f13	- [email protected] 2007/06/12 11:11:08 [ssh.c] fix slave exit value when a control master goes away without passing the full exit status by ensuring that the slave reads a full int. bz#1261 reported by frekko AT gmail.com; ok markus@ dtucker@	2007-06-12 23:49:11 +10:00
Darren Tucker	c3244a98df	- [email protected] 2007/06/12 11:56:15 [gss-genr.c] Pass GSS OID to gss_display_status to provide better information in error messages. Patch from Simon Wilkinson via bz 1220. ok djm@	2007-06-12 23:47:25 +10:00
Darren Tucker	2b359f9541	- (dtucker) [includes.h] Bug #1243 : HAVE_PATHS -> HAVE_PATHS_H. Should prevent warnings about redefinitions of various things in paths.h. Spotted by cartmanltd at hotmail.com.	2007-06-11 14:44:17 +10:00
Darren Tucker	98015ba05e	- (djm) Bugzilla #1306 : silence spurious error messages from hang-on-exit fix; tested by dtucker@ and jochen.kirn AT gmail.com (backport from HEAD)	2007-06-11 14:32:30 +10:00
Darren Tucker	a50bfccd46	- (dtucker) [mdoc2man.awk] Sync with rev 1.8, mainly for %R reference support used for RFCs.	2007-06-05 20:05:37 +10:00
Darren Tucker	cd58e4d4da	- [email protected] 2007/04/23 10:15:39 [servconf.c] Remove debug() left over from development. ok deraadt@ (This fixes a null pointer deref on startup with Match+debug on some platforms).	2007-05-20 15:06:11 +10:00
Darren Tucker	b7bbc8b9bd	- (dtucker) [configure.ac openbsd-compat/getrrsetbyname.c] Bug #1299 : Use the platform's _res if it has one. Should fix problem of DNSSEC record lookups on NetBSD as reported by Curt Sampson.	2007-04-29 13:58:47 +10:00
Darren Tucker	02cd252e4a	- (tim) [auth.c configure.ac defines.h session.c openbsd-compat/port-uw.c openbsd-compat/port-uw.h openbsd-compat/xcrypt.c] Rework libiaf test/defines to account for IRIX having libiaf but not set_id(). Patch with & ok dtucker@ (backport from -HEAD)	2007-03-27 19:07:48 +10:00
Darren Tucker	05f577f5a6	- [email protected] 2007/03/09 05:20:06 [servconf.c sshd.c] Move C/R -> kbdint special case to after the defaults have been loaded, which makes ChallengeResponse default to yes again. This was broken by the Match changes and not fixed properly subsequently. Found by okan at demirmen.com, ok djm@ "please do it" deraadt@	2007-03-21 20:40:10 +11:00
Darren Tucker	05974bf67c	- (dtucker) [cipher-3des1.c cipher-bf1.c] The OpenSSL 0.9.8e problem in bug #1291 also affects Protocol 1 3des. While at it, use compat-openssl.h in cipher-bf1.c. Patch from Juan Gallego.	2007-03-13 18:49:31 +11:00
Darren Tucker	d19f416144	- (dtucker) [entropy.c scard-opensc.c ssh-rand-helper.c] Bug #1294 : include string.h to prevent warnings, from vapier at gentoo.org.	2007-03-13 07:33:34 +11:00
Damien Miller	4ee72c71e3	- (djm) [README] correct link to release notes	2007-03-06 21:27:55 +11:00