- [email protected] 2010/03/08 00:28:55

[ssh-keygen.1] document permit-agent-forwarding certificate constraint; patch from stevesk@
2010-03-08 11:30:28 +11:00
29 changed files with 139 additions and 313 deletions
@@ -1,120 +1,4 @@
-20100410
- - (dtucker) [configure.ac] Put the check for the existence of getaddrinfo
-   back so we disable the IPv6 tests if we don't have it.
-
-20100409
- - (dtucker) [contrib/cygwin/Makefile] Don't overwrite files with the wrong
-   ones.  Based on a patch from Roumen Petrov.
- - (dtucker) [configure.ac] Bug #1744: use pkg-config for libedit flags if we
-   have it and the path is not provided to --with-libedit.  Based on a patch
-   from Iain Morgan.
- - (dtucker) [configure.ac defines.h loginrec.c logintest.c] Bug #1732: enable
-   utmpx support on FreeBSD where possible.  Patch from Ed Schouten, ok djm@
-
-20100326
- - (djm) [openbsd-compat/bsd-arc4random.c] Fix preprocessor detection
-   for arc4random_buf() and arc4random_uniform(); from Josh Gilkerson
- - (dtucker) [configure.ac] Bug #1741: Add section for Haiku, patch originally
-   by Ingo Weinhold via Scott McCreary, ok djm@
- - (djm) OpenBSD CVS Sync
-   - [email protected] 2010/03/25 23:38:28
-     [servconf.c]
-     from portable: getcwd(NULL, 0) doesn't work on all platforms, so
-     use a stack buffer; ok dtucker@
-   - [email protected] 2010/03/26 00:26:58
-     [ssh.1]
-     mention that -S none disables connection sharing; from Colin Watson
- - (djm) [session.c] Allow ChrootDirectory to work on SELinux platforms -
-   set up SELinux execution context before chroot() call. From Russell
-   Coker via Colin watson; bz#1726 ok dtucker@
- - (djm) [channels.c] Check for EPFNOSUPPORT as a socket() errno; bz#1721
-   ok dtucker@
- - (dtucker) Bug #1725: explicitly link libX11 into gnome-ssh-askpass2 using
-   pkg-config, patch from Colin Watson.  Needed for newer linkers (ie gold).
- - (djm) [contrib/ssh-copy-id] Don't blow up when the agent has no keys;
-   bz#1723 patch from Adeodato Simóvia Colin Watson; ok dtucker@
- - (dtucker) OpenBSD CVS Sync
-   - [email protected] 2010/03/26 01:06:13
-     [ssh_config.5]
-     Reformat default value of PreferredAuthentications entry (current
-     formatting implies ", " is acceptable as a separator, which it's not.
-     ok djm@
-
-20100324
- - (dtucker) [contrib/cygwin/ssh-host-config] Mount the Windows directory
-   containing the services file explicitely case-insensitive.  This allows to
-   tweak the Windows services file reliably.  Patch from vinschen at redhat.
-
-20100321
- - (djm) OpenBSD CVS Sync
-   - [email protected] 2010/03/08 09:41:27
-     [ssh-keygen.1]
-     sort the list of constraints (to -O); ok djm
-   - [email protected] 2010/03/10 07:40:35
-     [ssh-keygen.1]
-     typos; from Ross Richardson
-     closes prs 6334 and 6335
-   - [email protected] 2010/03/10 23:27:17
-     [auth2-pubkey.c]
-     correct certificate logging and make it more consistent between
-     authorized_keys and TrustedCAKeys; ok markus@
-   - [email protected] 2010/03/12 01:06:25
-     [servconf.c]
-     unbreak AuthorizedKeys option with a $HOME-relative path; reported by
-     vinschen AT redhat.com, ok dtucker@
-   - [email protected] 2010/03/12 11:37:40
-     [servconf.c]
-     do not prepend AuthorizedKeysFile with getcwd(), unbreaks relative paths
-     free() (not xfree()) the buffer returned by getcwd()
-   - [email protected] 2010/03/13 21:10:38
-     [clientloop.c]
-     protocol conformance fix: send language tag when disconnecting normally;
-     spotted by 1.41421 AT gmail.com, ok markus@ deraadt@
-   - [email protected] 2010/03/13 21:45:46
-     [ssh-keygen.1]
-     Certificates are named *-cert.pub, not *_cert.pub; committing a diff
-     from stevesk@ ok me
-   - [email protected] 2010/03/13 23:38:13
-     [ssh-keygen.1]
-     fix a formatting error (args need quoted); noted by stevesk
-   - [email protected] 2010/03/15 19:40:02
-     [key.c key.h ssh-keygen.c]
-     also print certificate type (user or host) for ssh-keygen -L
-     ok djm kettenis
-   - [email protected] 2010/03/16 15:46:52
-     [auth-options.c]
-     spelling in error message. ok djm kettenis
-   - [email protected] 2010/03/16 16:36:49
-     [version.h]
-     crank version to openssh-5.5 since we have a few fixes since 5.4;
-     requested deraadt@ kettenis@
- - (djm) [README contrib/caldera/openssh.spec contrib/redhat/openssh.spec]
-   [contrib/suse/openssh.spec] Crank version numbers
-
-20100314
- - (djm) [ssh-pkcs11-helper.c] Move #ifdef to after #defines to fix
-   compilation failure when !HAVE_DLOPEN. Reported by felix-mindrot
-   AT fefe.de
- - (djm) [Makefile.in] Respecify -lssh after -lopenbsd-compat for
-   ssh-pkcs11-helper to repair static builds (we do the same for
-   ssh-keyscan). Reported by felix-mindrot AT fefe.de
-
-20100312
- - (tim) [Makefile.in] Now that scard is gone, no need to make $(datadir)
- - (tim) [Makefile.in] Add missing $(EXEEXT) to install targets.
-   Patch from Corinna Vinschen.
- - (tim) [contrib/cygwin/Makefile] Fix list of documentation files to install
-   on a Cygwin installation. Patch from Corinna Vinschen.
-
-20100311
- - (tim) [contrib/suse/openssh.spec] crank version number here too.
-   report by imorgan AT nas.nasa.gov
-
-20100309
- - (dtucker) [configure.ac] Use a proper AC_CHECK_DECL for BROKEN_GETADDRINFO
-   so setting it in CFLAGS correctly skips IPv6 tests.
-
-20100308
+20100307
 - (djm) OpenBSD CVS Sync
   - [email protected] 2010/03/07 22:16:01
     [ssh-keygen.c]
@@ -1,4 +1,4 @@
-# $Id: Makefile.in,v 1.309 2010/03/13 21:41:34 djm Exp $
+# $Id: Makefile.in,v 1.306 2010/02/24 07:18:51 djm Exp $

 # uncomment if you run a non bourne compatable shell. Ie. csh
 #SHELL = @SH@
@@ -160,7 +160,7 @@ ssh-keysign$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keysign.o roaming_dummy.o readco
 	$(LD) -o $@ ssh-keysign.o readconf.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)

 ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-pkcs11-helper.o ssh-pkcs11.o
-	$(LD) -o $@ ssh-pkcs11-helper.o ssh-pkcs11.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
+	$(LD) -o $@ ssh-pkcs11-helper.o ssh-pkcs11.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)

 ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o roaming_dummy.o
 	$(LD) -o $@ ssh-keyscan.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
@@ -249,25 +249,26 @@ install-files:
 	$(srcdir)/mkinstalldirs $(DESTDIR)$(bindir)
 	$(srcdir)/mkinstalldirs $(DESTDIR)$(sbindir)
 	$(srcdir)/mkinstalldirs $(DESTDIR)$(mandir)
+	$(srcdir)/mkinstalldirs $(DESTDIR)$(datadir)
 	$(srcdir)/mkinstalldirs $(DESTDIR)$(mandir)/$(mansubdir)1
 	$(srcdir)/mkinstalldirs $(DESTDIR)$(mandir)/$(mansubdir)5
 	$(srcdir)/mkinstalldirs $(DESTDIR)$(mandir)/$(mansubdir)8
 	$(srcdir)/mkinstalldirs $(DESTDIR)$(libexecdir)
 	(umask 022 ; $(srcdir)/mkinstalldirs $(DESTDIR)$(PRIVSEP_PATH))
-	$(INSTALL) -m 0755 $(STRIP_OPT) ssh$(EXEEXT) $(DESTDIR)$(bindir)/ssh$(EXEEXT)
-	$(INSTALL) -m 0755 $(STRIP_OPT) scp$(EXEEXT) $(DESTDIR)$(bindir)/scp$(EXEEXT)
-	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-add$(EXEEXT) $(DESTDIR)$(bindir)/ssh-add$(EXEEXT)
-	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-agent$(EXEEXT) $(DESTDIR)$(bindir)/ssh-agent$(EXEEXT)
-	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-keygen$(EXEEXT) $(DESTDIR)$(bindir)/ssh-keygen$(EXEEXT)
-	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-keyscan$(EXEEXT) $(DESTDIR)$(bindir)/ssh-keyscan$(EXEEXT)
-	$(INSTALL) -m 0755 $(STRIP_OPT) sshd$(EXEEXT) $(DESTDIR)$(sbindir)/sshd$(EXEEXT)
+	$(INSTALL) -m 0755 $(STRIP_OPT) ssh $(DESTDIR)$(bindir)/ssh
+	$(INSTALL) -m 0755 $(STRIP_OPT) scp $(DESTDIR)$(bindir)/scp
+	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-add $(DESTDIR)$(bindir)/ssh-add
+	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-agent $(DESTDIR)$(bindir)/ssh-agent
+	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-keygen $(DESTDIR)$(bindir)/ssh-keygen
+	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-keyscan $(DESTDIR)$(bindir)/ssh-keyscan
+	$(INSTALL) -m 0755 $(STRIP_OPT) sshd $(DESTDIR)$(sbindir)/sshd
 	if test ! -z "$(INSTALL_SSH_RAND_HELPER)" ; then \
-		$(INSTALL) -m 0755 $(STRIP_OPT) ssh-rand-helper$(EXEEXT) $(DESTDIR)$(libexecdir)/ssh-rand-helper$(EXEEXT) ; \
+		$(INSTALL) -m 0755 $(STRIP_OPT) ssh-rand-helper $(DESTDIR)$(libexecdir)/ssh-rand-helper ; \
 	fi
-	$(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign$(EXEEXT) $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
-	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
-	$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
-	$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
+	$(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign $(DESTDIR)$(SSH_KEYSIGN)
+	$(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper $(DESTDIR)$(SSH_PKCS11_HELPER)
+	$(INSTALL) -m 0755 $(STRIP_OPT) sftp $(DESTDIR)$(bindir)/sftp
+	$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server $(DESTDIR)$(SFTP_SERVER)
 	$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
 	$(INSTALL) -m 644 scp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
 	$(INSTALL) -m 644 ssh-add.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
@@ -1,4 +1,4 @@
-See http://www.openssh.com/txt/release-5.5 for the release notes.
+See http://www.openssh.com/txt/release-5.4 for the release notes.

 - A Japanese translation of this document and of the OpenSSH FAQ is
 - available at http://www.unixuser.org/~haruyama/security/openssh/index.html
@@ -62,4 +62,4 @@ References -
 [6] http://www.openbsd.org/cgi-bin/man.cgi?query=style&sektion=9
 [7] http://www.openssh.com/faq.html

-$Id: README,v 1.73 2010/03/21 19:11:55 djm Exp $
+$Id: README,v 1.72 2010/03/07 22:41:02 djm Exp $
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth-options.c,v 1.49 2010/03/16 15:46:52 stevesk Exp $ */
+/* $OpenBSD: auth-options.c,v 1.48 2010/03/07 11:57:13 dtucker Exp $ */
 /*
 * Author: Tatu Ylonen <ylo@cs.hut.fi>
 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -434,7 +434,7 @@ auth_cert_constraints(Buffer *c_orig, struct passwd *pw)
 				goto out;
 			}
 			if (strlen(command) != clen) {
-				error("force-command constraint contains \\0");
+				error("force-command constrain contains \\0");
 				goto out;
 			}
 			if (cert_forced_command != NULL) {
@@ -454,7 +454,7 @@ auth_cert_constraints(Buffer *c_orig, struct passwd *pw)
 				goto out;
 			}
 			if (strlen(allowed) != clen) {
-				error("source-address constraint contains \\0");
+				error("source-address constrain contains \\0");
 				goto out;
 			}
 			if (cert_source_address_done++) {
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-pubkey.c,v 1.22 2010/03/10 23:27:17 djm Exp $ */
+/* $OpenBSD: auth2-pubkey.c,v 1.21 2010/03/04 10:36:03 djm Exp $ */
 /*
 * Copyright (c) 2000 Markus Friedl.  All rights reserved.
 *
@@ -240,26 +240,22 @@ user_key_allowed2(struct passwd *pw, Key *key, char *file)
 				continue;
 			if (!key_equal(found, key->cert->signature_key))
 				continue;
+			debug("matching CA found: file %s, line %lu",
+			    file, linenum);
 			fp = key_fingerprint(found, SSH_FP_MD5,
 			    SSH_FP_HEX);
-			debug("matching CA found: file %s, line %lu, %s %s",
-			    file, linenum, key_type(found), fp);
+			verbose("Found matching %s CA: %s",
+			    key_type(found), fp);
+			xfree(fp);
 			if (key_cert_check_authority(key, 0, 0, pw->pw_name,
 			    &reason) != 0) {
-				xfree(fp);
 				error("%s", reason);
 				auth_debug_add("%s", reason);
 				continue;
 			}
 			if (auth_cert_constraints(&key->cert->constraints,
-			    pw) != 0) {
-				xfree(fp);
+			    pw) != 0)
 				continue;
-			}
-			verbose("Accepted certificate ID \"%s\" "
-			    "signed by %s CA %s via %s", key->cert->key_id,
-			    key_type(found), fp, file);
-			xfree(fp);
 			found_key = 1;
 			break;
 		} else if (!key_is_cert_authority && key_equal(found, key)) {
@@ -285,15 +281,15 @@ user_key_allowed2(struct passwd *pw, Key *key, char *file)
 static int
 user_cert_trusted_ca(struct passwd *pw, Key *key)
 {
-	char *ca_fp;
+	char *key_fp, *ca_fp;
 	const char *reason;
 	int ret = 0;

 	if (!key_is_cert(key) || options.trusted_user_ca_keys == NULL)
 		return 0;

-	ca_fp = key_fingerprint(key->cert->signature_key,
-	    SSH_FP_MD5, SSH_FP_HEX);
+	key_fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+	ca_fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);

 	if (key_in_file(key->cert->signature_key,
 	    options.trusted_user_ca_keys, 1) != 1) {
@@ -310,12 +306,13 @@ user_cert_trusted_ca(struct passwd *pw, Key *key)
 	if (auth_cert_constraints(&key->cert->constraints, pw) != 0)
 		goto out;

-	verbose("Accepted certificate ID \"%s\" signed by %s CA %s via %s",
-	    key->cert->key_id, key_type(key->cert->signature_key), ca_fp,
-	    options.trusted_user_ca_keys);
+	verbose("%s certificate %s allowed by trusted %s key %s",
+	    key_type(key), key_fp, key_type(key->cert->signature_key), ca_fp);
 	ret = 1;

 out:
+	if (key_fp != NULL)
+		xfree(key_fp);
 	if (ca_fp != NULL)
 		xfree(ca_fp);
 	return ret;
@@ -3252,11 +3252,7 @@ x11_create_display_inet(int x11_display_offset, int x11_use_localhost,
 			sock = socket(ai->ai_family, ai->ai_socktype,
 			    ai->ai_protocol);
 			if (sock < 0) {
-				if ((errno != EINVAL) && (errno != EAFNOSUPPORT)
-#ifdef EPFNOSUPPORT
-				    && (errno != EPFNOSUPPORT)
-#endif 
-				    ) {
+				if ((errno != EINVAL) && (errno != EAFNOSUPPORT)) {
 					error("socket: %.100s", strerror(errno));
 					freeaddrinfo(aitop);
 					return -1;
@@ -1,4 +1,4 @@
-/* $OpenBSD: clientloop.c,v 1.219 2010/03/13 21:10:38 djm Exp $ */
+/* $OpenBSD: clientloop.c,v 1.218 2010/01/28 00:21:18 djm Exp $ */
 /*
 * Author: Tatu Ylonen <ylo@cs.hut.fi>
 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1484,7 +1484,6 @@ client_loop(int have_pty, int escape_char_arg, int ssh2_chan_id)
 		packet_start(SSH2_MSG_DISCONNECT);
 		packet_put_int(SSH2_DISCONNECT_BY_APPLICATION);
 		packet_put_cstring("disconnected by user");
-		packet_put_cstring(""); /* language tag */
 		packet_send();
 		packet_write_wait();
 	}
@@ -1,4 +1,4 @@
-# $Id: configure.ac,v 1.449 2010/04/10 12:58:01 dtucker Exp $
+# $Id: configure.ac,v 1.444 2010/03/05 04:04:35 djm Exp $
 #
 # Copyright (c) 1999-2004 Damien Miller
 #
@@ -15,7 +15,7 @@
 # OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

 AC_INIT(OpenSSH, Portable, [email protected])
-AC_REVISION($Revision: 1.449 $)
+AC_REVISION($Revision: 1.444 $)
 AC_CONFIG_SRCDIR([ssh.c])

 AC_CONFIG_HEADER(config.h)
@@ -488,12 +488,6 @@ main() { if (NSVersionOfRunTimeLibrary("System") >= (60 << 16))
 *-*-dragonfly*)
 	SSHDLIBS="$SSHDLIBS -lcrypt"
 	;;
-*-*-haiku*) 
-    LIBS="$LIBS -lbsd "
-    AC_CHECK_LIB(network, socket)
-    AC_DEFINE(HAVE_U_INT64_T)
-    MANTYPE=man 
-    ;; 
 *-*-hpux*)
 	# first we define all of the options common to all HP-UX releases
 	CPPFLAGS="$CPPFLAGS -D_HPUX_SOURCE -D_XOPEN_SOURCE -D_XOPEN_SOURCE_EXTENDED=1"
@@ -1254,18 +1248,7 @@ LIBEDIT_MSG="no"
 AC_ARG_WITH(libedit,
 	[  --with-libedit[[=PATH]]   Enable libedit support for sftp],
 	[ if test "x$withval" != "xno" ; then
-		if test "x$withval" = "xyes" ; then
-			AC_PATH_PROG(PKGCONFIG, pkg-config, no)
-			if test "x$PKGCONFIG" != "xno"; then
-				AC_MSG_CHECKING(if $PKGCONFIG knows about libedit)
-			 	if "$PKGCONFIG" libedit; then
-					AC_MSG_RESULT(yes)
-					use_pkgconfig_for_libedit=yes
-				else
-					AC_MSG_RESULT(no)
-				fi
-			fi
-		else
+		if test "x$withval" != "xyes"; then
 			CPPFLAGS="$CPPFLAGS -I${withval}/include"
 			if test -n "${need_dash_r}"; then
 				LDFLAGS="-L${withval}/lib -R${withval}/lib ${LDFLAGS}"
@@ -1273,20 +1256,14 @@ AC_ARG_WITH(libedit,
 				LDFLAGS="-L${withval}/lib ${LDFLAGS}"
 			fi
 		fi
-		if test "x$use_pkgconfig_for_libedit" == "xyes"; then
-			LIBEDIT=`$PKGCONFIG --libs-only-l libedit`
-			CPPFLAGS="$CPPFLAGS `$PKGCONFIG --cflags libedit`"
-		else
-			LIBEDIT="-ledit -lcurses"
-		fi
-		OTHERLIBS=`echo $LIBEDIT | sed 's/-ledit//'`
 		AC_CHECK_LIB(edit, el_init,
 			[ AC_DEFINE(USE_LIBEDIT, 1, [Use libedit for sftp])
+			  LIBEDIT="-ledit -lcurses"
 			  LIBEDIT_MSG="yes"
 			  AC_SUBST(LIBEDIT)
 			],
 			[ AC_MSG_ERROR(libedit not found) ],
-			[ $OTHERLIBS ]
+			[ -lcurses ]
 		)
 		AC_MSG_CHECKING(if libedit version is compatible)
 		AC_COMPILE_IFELSE(
@@ -1557,8 +1534,8 @@ dnl    Checks for utmp functions
 AC_CHECK_FUNCS(endutent getutent getutid getutline pututline setutent)
 AC_CHECK_FUNCS(utmpname)
 dnl    Checks for utmpx functions
-AC_CHECK_FUNCS(endutxent getutxent getutxid getutxline getutxuser pututxline)
-AC_CHECK_FUNCS(setutxdb setutxent utmpxname)
+AC_CHECK_FUNCS(endutxent getutxent getutxid getutxline pututxline )
+AC_CHECK_FUNCS(setutxent utmpxname)
 dnl    Checks for lastlog functions
 AC_CHECK_FUNCS(getlastlogxbyname)

@@ -4087,6 +4064,34 @@ if test -n "$conf_wtmp_location"; then
 fi


+dnl utmpx detection - I don't know any system so perverse as to require
+dnl  utmpx, but not define UTMPX_FILE (ditto wtmpx.) No doubt it's out
+dnl  there, though.
+AC_MSG_CHECKING([if your system defines UTMPX_FILE])
+AC_TRY_COMPILE([
+#include <sys/types.h>
+#include <utmp.h>
+#ifdef HAVE_UTMPX_H
+#include <utmpx.h>
+#endif
+#ifdef HAVE_PATHS_H
+#  include <paths.h>
+#endif
+	],
+	[ char *utmpx = UTMPX_FILE; ],
+	[ AC_MSG_RESULT(yes) ],
+	[ AC_MSG_RESULT(no)
+	  system_utmpx_path=no ]
+)
+if test -z "$conf_utmpx_location"; then
+	if test x"$system_utmpx_path" = x"no" ; then
+		AC_DEFINE(DISABLE_UTMPX)
+	fi
+else
+	AC_DEFINE_UNQUOTED(CONF_UTMPX_FILE, "$conf_utmpx_location",
+		[Define if you want to specify the path to your utmpx file])
+fi
+
 dnl wtmpx detection
 AC_MSG_CHECKING([if your system defines WTMPX_FILE])
 AC_TRY_COMPILE([
@@ -4123,13 +4128,12 @@ dnl Adding -Werror to CFLAGS early prevents configure tests from running.
 dnl Add now.
 CFLAGS="$CFLAGS $werror_flags"

-if test "x$ac_cv_func_getaddrinfo" != "xyes" ; then
-	TEST_SSH_IPV6=no
+if grep "#define BROKEN_GETADDRINFO 1" confdefs.h >/dev/null || \
+    test "x$ac_cv_func_getaddrinfo" != "xyes" ; then
+	AC_SUBST(TEST_SSH_IPV6, no)
 else
-	TEST_SSH_IPV6=yes
+	AC_SUBST(TEST_SSH_IPV6, yes)
 fi
-AC_CHECK_DECL(BROKEN_GETADDRINFO,  TEST_SSH_IPV6=no)
-AC_SUBST(TEST_SSH_IPV6, $TEST_SSH_IPV6)

 AC_EXEEXT
 AC_CONFIG_FILES([Makefile buildpkg.sh opensshd.init openssh.xml \
@@ -9,7 +9,7 @@ gnome-ssh-askpass1: gnome-ssh-askpass1.c
 gnome-ssh-askpass2: gnome-ssh-askpass2.c
 	$(CC) `pkg-config --cflags gtk+-2.0` \
 		gnome-ssh-askpass2.c -o gnome-ssh-askpass2 \
-		`pkg-config --libs gtk+-2.0 x11`
+		`pkg-config --libs gtk+-2.0`

 clean:
 	rm -f *.o gnome-ssh-askpass1 gnome-ssh-askpass2 gnome-ssh-askpass
@@ -17,11 +17,11 @@
 #old cvs stuff.  please update before use.  may be deprecated.
 %define use_stable	1
 %if %{use_stable}
-  %define version 	5.5p1
+  %define version 	5.4p1
  %define cvs		%{nil}
  %define release 	1
 %else
-  %define version 	5.5p1
+  %define version 	5.4p1
  %define cvs		cvs20050315
  %define release 	0r1
 %endif
@@ -360,4 +360,4 @@ fi
 * Mon Jan 01 1998 ...
 Template Version: 1.31

-$Id: openssh.spec,v 1.70 2010/03/21 19:11:58 djm Exp $
+$Id: openssh.spec,v 1.69 2010/03/07 22:41:03 djm Exp $
@@ -42,13 +42,11 @@ install-sshdoc:
 	$(INSTALL) -m 644 $(srcdir)/OVERVIEW $(DESTDIR)$(sshdocdir)/OVERVIEW
 	$(INSTALL) -m 644 $(srcdir)/PROTOCOL $(DESTDIR)$(sshdocdir)/PROTOCOL
 	$(INSTALL) -m 644 $(srcdir)/PROTOCOL.agent $(DESTDIR)$(sshdocdir)/PROTOCOL.agent
-	$(INSTALL) -m 644 $(srcdir)/PROTOCOL.certkeys $(DESTDIR)$(sshdocdir)/PROTOCOL.certkeys
-	$(INSTALL) -m 644 $(srcdir)/PROTOCOL.mux $(DESTDIR)$(sshdocdir)/PROTOCOL.mux
 	$(INSTALL) -m 644 $(srcdir)/README $(DESTDIR)$(sshdocdir)/README
 	$(INSTALL) -m 644 $(srcdir)/README.dns $(DESTDIR)$(sshdocdir)/README.dns
 	$(INSTALL) -m 644 $(srcdir)/README.platform $(DESTDIR)$(sshdocdir)/README.platform
 	$(INSTALL) -m 644 $(srcdir)/README.privsep $(DESTDIR)$(sshdocdir)/README.privsep
-	$(INSTALL) -m 644 $(srcdir)/README.tun $(DESTDIR)$(sshdocdir)/README.tun
+	$(INSTALL) -m 644 $(srcdir)/README.smartcard $(DESTDIR)$(sshdocdir)/README.smartcard
 	$(INSTALL) -m 644 $(srcdir)/TODO $(DESTDIR)$(sshdocdir)/TODO
 	$(INSTALL) -m 644 $(srcdir)/WARNING.RNG $(DESTDIR)$(sshdocdir)/WARNING.RNG

@@ -90,7 +90,7 @@ update_services_file() {
  fi
  _serv_tmp="${_my_etcdir}/srv.out.$$"

-  mount -o text,posix=0,noacl -f "${_win_etcdir}" "${_my_etcdir}"
+  mount -o text -f "${_win_etcdir}" "${_my_etcdir}"

  # Depends on the above mount
  _wservices=`cygpath -w "${_services}"`
@@ -1,4 +1,4 @@
-%define ver 5.5p1
+%define ver 5.4p1
 %define rel 1

 # OpenSSH privilege separation requires a user & group ID
@@ -19,7 +19,7 @@ if [ "-i" = "$1" ]; then
    shift         # and this should leave $1 as the target name
  fi
 else
-  if [ x$SSH_AUTH_SOCK != x ] && ssh-add -L >/dev/null 2>&1; then
+  if [ x$SSH_AUTH_SOCK != x ] ; then
    GET_ID="$GET_ID ssh-add -L"
  fi
 fi
@@ -13,7 +13,7 @@

 Summary:	OpenSSH, a free Secure Shell (SSH) protocol implementation
 Name:		openssh
-Version:	5.5p1
+Version:	5.3p1
 URL:		http://www.openssh.com/
 Release:	1
 Source0:	openssh-%{version}.tar.gz
@@ -25,7 +25,7 @@
 #ifndef _DEFINES_H
 #define _DEFINES_H

-/* $Id: defines.h,v 1.160 2010/04/09 08:13:27 dtucker Exp $ */
+/* $Id: defines.h,v 1.159 2010/01/13 23:44:34 tim Exp $ */


 /* Constants */
@@ -674,7 +674,7 @@ struct winsize {
 #else
 /* Simply select your favourite login types. */
 /* Can't do if-else because some systems use several... <sigh> */
-#  if !defined(DISABLE_UTMPX)
+#  if defined(UTMPX_FILE) && !defined(DISABLE_UTMPX)
 #    define USE_UTMPX
 #  endif
 #  if defined(UTMP_FILE) && !defined(DISABLE_UTMP)
@@ -1,4 +1,4 @@
-/* $OpenBSD: key.c,v 1.86 2010/03/15 19:40:02 stevesk Exp $ */
+/* $OpenBSD: key.c,v 1.85 2010/03/04 01:44:57 djm Exp $ */
 /*
 * read_bignum():
 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -801,19 +801,6 @@ key_type(const Key *k)
 	return "unknown";
 }

-const char *
-key_cert_type(const Key *k)
-{
-	switch (k->cert->type) {
-	case SSH2_CERT_TYPE_USER:
-		return "user";
-	case SSH2_CERT_TYPE_HOST:
-		return "host";
-	default:
-		return "unknown";
-	}
-}
-
 const char *
 key_ssh_name(const Key *k)
 {
@@ -1,4 +1,4 @@
-/* $OpenBSD: key.h,v 1.29 2010/03/15 19:40:02 stevesk Exp $ */
+/* $OpenBSD: key.h,v 1.28 2010/02/26 20:29:54 djm Exp $ */

 /*
 * Copyright (c) 2000, 2001 Markus Friedl.  All rights reserved.
@@ -82,7 +82,6 @@ int		 key_equal(const Key *, const Key *);
 char		*key_fingerprint(Key *, enum fp_type, enum fp_rep);
 u_char		*key_fingerprint_raw(Key *, enum fp_type, u_int *);
 const char	*key_type(const Key *);
-const char	*key_cert_type(const Key *);
 int		 key_write(const Key *, FILE *);
 int		 key_read(Key *, char **);
 u_int		 key_size(const Key *);
@@ -207,7 +207,6 @@ int syslogin_write_entry(struct logininfo *li);

 int getlast_entry(struct logininfo *li);
 int lastlog_get_entry(struct logininfo *li);
-int utmpx_get_entry(struct logininfo *li);
 int wtmp_get_entry(struct logininfo *li);
 int wtmpx_get_entry(struct logininfo *li);

@@ -509,10 +508,6 @@ getlast_entry(struct logininfo *li)
 #ifdef USE_LASTLOG
 	return(lastlog_get_entry(li));
 #else /* !USE_LASTLOG */
-#if defined(USE_UTMPX) && defined(HAVE_SETUTXDB) && \
-    defined(UTXDB_LASTLOGIN) && defined(HAVE_GETUTXUSER)
-	return (utmpx_get_entry(li));
-#endif

 #if defined(DISABLE_LASTLOG)
 	/* On some systems we shouldn't even try to obtain last login
@@ -1613,32 +1608,6 @@ lastlog_get_entry(struct logininfo *li)
 #endif /* HAVE_GETLASTLOGXBYNAME */
 #endif /* USE_LASTLOG */

-#if defined(USE_UTMPX) && defined(HAVE_SETUTXDB) && \
-    defined(UTXDB_LASTLOGIN) && defined(HAVE_GETUTXUSER)
-int
-utmpx_get_entry(struct logininfo *li)
-{
-	struct utmpx *utx;
-
-	if (setutxdb(UTXDB_LASTLOGIN, NULL) != 0)
-		return (0);
-	utx = getutxuser(li->username);
-	if (utx == NULL) {
-		endutxent();
-		return (0);
-	}
-
-	line_fullname(li->line, utx->ut_line,
-	    MIN_SIZEOF(li->line, utx->ut_line));
-	strlcpy(li->hostname, utx->ut_host,
-	    MIN_SIZEOF(li->hostname, utx->ut_host));
-	li->tv_sec = utx->ut_tv.tv_sec;
-	li->tv_usec = utx->ut_tv.tv_usec;
-	endutxent();
-	return (1);
-}
-#endif /* USE_UTMPX && HAVE_SETUTXDB && UTXDB_LASTLOGIN && HAVE_GETUTXUSER */
-
 #ifdef USE_BTMP
  /*
   * Logs failed login attempts in _PATH_BTMP if that exists.
@@ -264,7 +264,7 @@ showOptions(void)
 	printf("\tUSE_UTMP (UTMP_FILE=%s)\n", UTMP_FILE);
 #endif
 #ifdef USE_UTMPX
-	printf("\tUSE_UTMPX\n");
+	printf("\tUSE_UTMPX (UTMPX_FILE=%s)\n", UTMPX_FILE);
 #endif
 #ifdef USE_WTMP
 	printf("\tUSE_WTMP (WTMP_FILE=%s)\n", WTMP_FILE);
@@ -84,7 +84,7 @@ arc4random_stir(void)
 }
 #endif /* !HAVE_ARC4RANDOM */

-#ifndef HAVE_ARC4RANDOM_BUF
+#ifndef ARC4RANDOM_BUF
 void
 arc4random_buf(void *_buf, size_t n)
 {
@@ -102,7 +102,7 @@ arc4random_buf(void *_buf, size_t n)
 }
 #endif /* !HAVE_ARC4RANDOM_BUF */

-#ifndef HAVE_ARC4RANDOM_UNIFORM
+#ifndef ARC4RANDOM_UNIFORM
 /*
 * Calculate a uniformly distributed random number less than upper_bound
 * avoiding "modulo bias".
@@ -1,4 +1,4 @@
-/* $OpenBSD: servconf.c,v 1.207 2010/03/25 23:38:28 djm Exp $ */
+/* $OpenBSD: servconf.c,v 1.204 2010/03/04 10:36:03 djm Exp $ */
 /*
 * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
 *                    All rights reserved
@@ -470,14 +470,15 @@ parse_token(const char *cp, const char *filename,
 char *
 derelativise_path(const char *path)
 {
-	char *expanded, *ret, cwd[MAXPATHLEN];
+	char *expanded, *ret, *cwd;

 	expanded = tilde_expand_filename(path, getuid());
 	if (*expanded == '/')
 		return expanded;
-	if (getcwd(cwd, sizeof(cwd)) == NULL)
+	if ((cwd = getcwd(NULL, 0)) == NULL)
 		fatal("%s: getcwd: %s", __func__, strerror(errno));
 	xasprintf(&ret, "%s/%s", cwd, expanded);
+	xfree(cwd);
 	xfree(expanded);
 	return ret;
 }
@@ -1222,17 +1223,7 @@ process_server_config_line(ServerOptions *options, char *line,
 		charptr = (opcode == sAuthorizedKeysFile) ?
 		    &options->authorized_keys_file :
 		    &options->authorized_keys_file2;
-		arg = strdelim(&cp);
-		if (!arg || *arg == '\0')
-			fatal("%s line %d: missing file name.",
-			    filename, linenum);
-		if (*activep && *charptr == NULL) {
-			*charptr = tilde_expand_filename(arg, getuid());
-			/* increase optional counter */
-			if (intptr != NULL)
-				*intptr = *intptr + 1;
-		}
-		break;
+		goto parse_filename;

 	case sClientAliveInterval:
 		intptr = &options->client_alive_interval;
@@ -1551,10 +1551,6 @@ do_setusercontext(struct passwd *pw)
 		}
 #endif /* HAVE_SETPCRED */

-#ifdef WITH_SELINUX
-		ssh_selinux_setup_exec_context(pw->pw_name);
-#endif
-
 		if (options.chroot_directory != NULL &&
 		    strcasecmp(options.chroot_directory, "none") != 0) {
                        tmp = tilde_expand_filename(options.chroot_directory,
@@ -1579,6 +1575,10 @@ do_setusercontext(struct passwd *pw)

 	if (getuid() != pw->pw_uid || geteuid() != pw->pw_uid)
 		fatal("Failed to set uids to %u.", (u_int) pw->pw_uid);
+
+#ifdef WITH_SELINUX
+	ssh_selinux_setup_exec_context(pw->pw_name);
+#endif
 }

 static void
@@ -1,4 +1,4 @@
-.\"	$OpenBSD: ssh-keygen.1,v 1.92 2010/03/13 23:38:13 jmc Exp $
+.\"	$OpenBSD: ssh-keygen.1,v 1.88 2010/03/08 00:28:55 djm Exp $
 .\"
 .\"  -*- nroff -*-
 .\"
@@ -37,7 +37,7 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.Dd $Mdocdate: March 13 2010 $
+.Dd $Mdocdate: March 8 2010 $
 .Dt SSH-KEYGEN 1
 .Os
 .Sh NAME
@@ -307,15 +307,8 @@ Please see the
 section for details.
 The constraints that are valid for user certificates are:
 .Bl -tag -width Ds
-.It Ic clear
-Clear all enabled permissions.
-This is useful for clearing the default set of permissions so permissions may
-be added individually.
-.It Ic force-command Ns = Ns Ar command
-Forces the execution of
-.Ar command
-instead of any shell or command specified by the user when
-the certificate is used for authentication.
+.It Ic no-x11-forwarding
+Disable X11 forwarding (permitted by default).
 .It Ic no-agent-forwarding
 Disable
 .Xr ssh-agent 1
@@ -330,8 +323,12 @@ Disable execution of
 by
 .Xr sshd 8
 (permitted by default).
-.It Ic no-x11-forwarding
-Disable X11 forwarding (permitted by default).
+.It Ic clear
+Clear all enabled permissions.
+This is useful for clearing the default set of permissions so permissions may
+be added individually.
+.It Ic permit-x11-forwarding
+Allows X11 forwarding.
 .It Ic permit-agent-forwarding
 Allows
 .Xr ssh-agent 1
@@ -345,10 +342,14 @@ Allows execution of
 .Pa ~/.ssh/rc
 by
 .Xr sshd 8 .
-.It Ic permit-x11-forwarding
-Allows X11 forwarding.
-.It Ic source-address Ns = Ns Ar address_list
-Restrict the source addresses from which the certificate is considered valid.
+.It Ic force-command=command
+Forces the execution of
+.Ar command
+instead of any shell or command specified by the user when
+the certificate is used for authentication.
+.It Ic source-address=address_list
+Restrict the source addresses from which the certificate is considered valid
+from.
 The
 .Ar address_list
 is a comma-separated list of one or more address/netmask pairs in CIDR
@@ -413,7 +414,7 @@ in YYYYMMDDHHMMSS format or a relative time (to the current time) consisting
 of a minus sign followed by a relative time in the format described in the
 .Sx TIME FORMATS
 section of
-.Xr sshd_config 5 .
+.Xr ssh_config 5 .
 The end time may be specified as a YYYYMMDD date, a YYYYMMDDHHMMSS time or
 a relative time starting with a plus character.
 .Pp
@@ -518,7 +519,7 @@ To generate a user certificate:
 .Dl $ ssh-keygen -s /path/to/ca_key -I key_id /path/to/user_key.pub
 .Pp
 The resultant certificate will be placed in
-.Pa /path/to/user_key-cert.pub .
+.Pa /path/to/user_key_cert.pub .
 A host certificate requires the
 .Fl h
 option:
@@ -526,7 +527,7 @@ option:
 .Dl $ ssh-keygen -s /path/to/ca_key -I key_id -h /path/to/host_key.pub
 .Pp
 The host certificate will be output to
-.Pa /path/to/host_key-cert.pub .
+.Pa /path/to/host_key_cert.pub .
 In both cases,
 .Ar key_id
 is a "key identifier" that is logged by the server when the certificate
@@ -538,7 +539,7 @@ By default, generated certificates are valid for all users or hosts.
 To generate a certificate for a specified set of principals:
 .Pp
 .Dl $ ssh-keygen -s ca_key -I key_id -n user1,user2 user_key.pub
-.Dl "$ ssh-keygen -s ca_key -I key_id -h -n host.domain user_key.pub"
+.Dl $ ssh-keygen -s ca_key -I key_id -h -n host.domain user_key.pub
 .Pp
 Additional limitations on the validity and use of user certificates may
 be specified through certificate constraints.
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-keygen.c,v 1.185 2010/03/15 19:40:02 stevesk Exp $ */
+/* $OpenBSD: ssh-keygen.c,v 1.184 2010/03/07 22:16:01 djm Exp $ */
 /*
 * Author: Tatu Ylonen <ylo@cs.hut.fi>
 * Copyright (c) 1994 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -1393,8 +1393,7 @@ do_show_cert(struct passwd *pw)
 	    SSH_FP_MD5, SSH_FP_HEX);

 	printf("%s:\n", identity_file);
-	printf("        %s %s certificate %s\n", key_type(key),
-	    key_cert_type(key), key_fp);
+	printf("        %s certificate %s\n", key_type(key), key_fp);
 	printf("        Signed by %s CA %s\n",
 	    key_type(key->cert->signature_key), ca_fp);
 	printf("        Key ID \"%s\"\n", key->cert->key_id);
@@ -17,6 +17,8 @@

 #include "includes.h"

+#ifdef ENABLE_PKCS11
+
 #include <sys/types.h>
 #ifdef HAVE_SYS_TIME_H
 # include <sys/time.h>
@@ -37,8 +39,6 @@
 #include "authfd.h"
 #include "ssh-pkcs11.h"

-#ifdef ENABLE_PKCS11
-
 /* borrows code from sftp-server and ssh-agent */

 struct pkcs11_keyinfo {
@@ -34,8 +34,8 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: ssh.1,v 1.303 2010/03/26 00:26:58 djm Exp $
-.Dd $Mdocdate: March 26 2010 $
+.\" $OpenBSD: ssh.1,v 1.302 2010/03/05 10:28:21 djm Exp $
+.Dd $Mdocdate: March 5 2010 $
 .Dt SSH 1
 .Os
 .Sh NAME
@@ -558,10 +558,7 @@ argument is
 the listen port will be dynamically allocated on the server and reported
 to the client at run time.
 .It Fl S Ar ctl_path
-Specifies the location of a control socket for connection sharing
-or the string
-.Dq none
-to disable connection sharing.
+Specifies the location of a control socket for connection sharing.
 Refer to the description of
 .Cm ControlPath
 and
@@ -34,8 +34,8 @@
 .\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 .\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $OpenBSD: ssh_config.5,v 1.130 2010/03/26 01:06:13 dtucker Exp $
-.Dd $Mdocdate: March 26 2010 $
+.\" $OpenBSD: ssh_config.5,v 1.129 2010/03/05 10:28:21 djm Exp $
+.Dd $Mdocdate: March 5 2010 $
 .Dt SSH_CONFIG 5
 .Os
 .Sh NAME
@@ -734,7 +734,11 @@ This allows a client to prefer one method (e.g.\&
 over another method (e.g.\&
 .Cm password )
 The default for this option is:
-.Do gssapi-with-mic,hostbased,publickey,keyboard-interactive,password
+.Do gssapi-with-mic ,
+hostbased,
+publickey,
+keyboard-interactive,
+password
 .Dc .
 .It Cm Protocol
 Specifies the protocol versions
@@ -1,6 +1,6 @@
-/* $OpenBSD: version.h,v 1.58 2010/03/16 16:36:49 djm Exp $ */
+/* $OpenBSD: version.h,v 1.57 2010/03/07 22:01:32 djm Exp $ */

-#define SSH_VERSION	"OpenSSH_5.5"
+#define SSH_VERSION	"OpenSSH_5.4"

 #define SSH_PORTABLE	"p1"
 #define SSH_RELEASE	SSH_VERSION SSH_PORTABLE