update version number for patch release today

[gssapi-openssh.git] / openssh / sshd.c

diff --git a/openssh/sshd.c b/openssh/sshd.c
index 1770ca33c081da6e3a32dd04123b0ba231d61aeb..12000b1bf5a625add52e281b2c3b878b75aaa4c9 100644 (file)
--- a/openssh/sshd.c
+++ b/openssh/sshd.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: sshd.c,v 1.366 2009/01/22 10:02:34 djm Exp $ */
+/* $OpenBSD: sshd.c,v 1.367 2009/05/28 16:50:16 andreas Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -117,6 +117,7 @@
 #include "ssh-gss.h"
 #endif
 #include "monitor_wrap.h"
+#include "roaming.h"
 #include "version.h"
 
 #ifdef USE_SECURITY_SESSION_API
@@ -426,7 +427,7 @@ sshd_exchange_identification(int sock_in, int sock_out)
        server_version_string = xstrdup(buf);
 
        /* Send our protocol version identification. */
-       if (atomicio(vwrite, sock_out, server_version_string,
+       if (roaming_atomicio(vwrite, sock_out, server_version_string,
            strlen(server_version_string))
            != strlen(server_version_string)) {
                logit("Could not write ident string to %s", get_remote_ipaddr());
@@ -436,7 +437,7 @@ sshd_exchange_identification(int sock_in, int sock_out)
        /* Read other sides version identification. */
        memset(buf, 0, sizeof(buf));
        for (i = 0; i < sizeof(buf) - 1; i++) {
-               if (atomicio(read, sock_in, &buf[i], 1) != 1) {
+               if (roaming_atomicio(read, sock_in, &buf[i], 1) != 1) {
                        logit("Did not receive identification string from %s",
                            get_remote_ipaddr());
                        cleanup_exit(255);
@@ -587,7 +588,7 @@ demote_sensitive_data(void)
 static void
 privsep_preauth_child(void)
 {
-       u_int32_t rnd[256];
+       u_int32_t rnd[256];
        gid_t gidset[1];
 
        /* Enable challenge-response authentication for privilege separation */
@@ -1907,6 +1908,13 @@ main(int ac, char **av)
                alarm(options.login_grace_time);
 
        sshd_exchange_identification(sock_in, sock_out);
+#if defined(AFS_KRB5)
+       /* If machine has AFS, set process authentication group. */
+       if (k_hasafs()) {
+               k_setpag();
+               k_unlog();
+       }
+#endif /* AFS || AFS_KRB5 */
 
        /* In inetd mode, generate ephemeral key only for proto 1 connections */
        if (!compat20 && inetd_flag && sensitive_data.server_key == NULL)
@@ -1965,7 +1973,7 @@ main(int ac, char **av)
 #endif
 
 #ifdef GSSAPI
-       if (options.gss_authentication) {
+       if (options.gss_authentication && options.gss_deleg_creds) {
                temporarily_use_uid(authctxt->pw);
                ssh_gssapi_storecreds();
                restore_uid();