resolved conflicts with import of OpenSSH 3.3p1

[gssapi-openssh.git] / openssh / sshd.c

diff --git a/openssh/sshd.c b/openssh/sshd.c
index a29dde6cdf19d284c1eb15fe7c2a93b07634a87e..76089f86e796b00044584eeed9a7ef5a4915254b 100644 (file)
--- a/openssh/sshd.c
+++ b/openssh/sshd.c
@@ -42,7 +42,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: sshd.c,v 1.242 2002/05/15 15:47:49 mouring Exp $");
+RCSID("$OpenBSD: sshd.c,v 1.246 2002/06/20 23:05:56 markus Exp $");
 
 #include <openssl/dh.h>
 #include <openssl/bn.h>
@@ -387,7 +387,7 @@ sshd_exchange_identification(int sock_in, int sock_out)
                        fatal_cleanup();
                }
 
-               /* Read other side's version identification. */
+               /* Read other sides version identification. */
                memset(buf, 0, sizeof(buf));
                for (i = 0; i < sizeof(buf) - 1; i++) {
                        if (atomicio(read, sock_in, &buf[i], 1) != 1) {
@@ -583,7 +583,7 @@ privsep_preauth(void)
        if (pid == -1) {
                fatal("fork of unprivileged child failed");
        } else if (pid != 0) {
-               debug2("Network child is on pid %d", pid);
+               debug2("Network child is on pid %ld", (long)pid);
 
                close(pmonitor->m_recvfd);
                authctxt = monitor_child_preauth(pmonitor);
@@ -639,7 +639,7 @@ privsep_postauth(Authctxt *authctxt)
        if (pmonitor->m_pid == -1)
                fatal("fork of unprivileged child failed");
        else if (pmonitor->m_pid != 0) {
-               debug2("User child is on pid %d", pmonitor->m_pid);
+               debug2("User child is on pid %ld", (long)pmonitor->m_pid);
                close(pmonitor->m_recvfd);
                monitor_child_postauth(pmonitor);
 
@@ -1013,6 +1013,19 @@ main(int ac, char **av)
                }
        }
 
+       if (use_privsep) {
+               struct passwd *pw;
+               struct stat st;
+
+               if ((pw = getpwnam(SSH_PRIVSEP_USER)) == NULL)
+                       fatal("Privilege separation user %s does not exist",
+                           SSH_PRIVSEP_USER);
+               if ((stat(_PATH_PRIVSEP_CHROOT_DIR, &st) == -1) ||
+                   (S_ISDIR(st.st_mode) == 0))
+                       fatal("Missing privilege separation directory: %s",
+                           _PATH_PRIVSEP_CHROOT_DIR);
+       }
+
        /* Configuration looks good, so exit if in test mode. */
        if (test_flag)
                exit(0);
@@ -1021,7 +1034,6 @@ main(int ac, char **av)
        ssh_gssapi_clean_env();
 #endif /* GSSAPI */
 
-#ifndef HAVE_CYGWIN
        /*
         * Clear out any supplemental groups we may have inherited.  This
         * prevents inadvertent creation of files with bad modes (in the
@@ -1031,7 +1043,6 @@ main(int ac, char **av)
         */
        if (setgroups(0, NULL) < 0)
                debug("setgroups() failed: %.200s", strerror(errno));
-#endif /* !HAVE_CYGWIN */
 
        /* Initialize the log (it is reinitialized below in case we forked). */
        if (debug_flag && !inetd_flag)
@@ -1176,7 +1187,7 @@ main(int ac, char **av)
                         */
                        f = fopen(options.pid_file, "wb");
                        if (f) {
-                               fprintf(f, "%u\n", (u_int) getpid());
+                               fprintf(f, "%ld\n", (long) getpid());
                                fclose(f);
                        }
                }
@@ -1323,7 +1334,7 @@ main(int ac, char **av)
                                if (pid < 0)
                                        error("fork: %.100s", strerror(errno));
                                else
-                                       debug("Forked child %d.", pid);
+                                       debug("Forked child %ld.", (long)pid);
 
                                close(startup_p[1]);
 
@@ -1433,7 +1444,7 @@ main(int ac, char **av)
        sshd_exchange_identification(sock_in, sock_out);
        /*
         * Check that the connection comes from a privileged port.
-        * Rhosts-Authentication only makes sense from priviledged
+        * Rhosts-Authentication only makes sense from privileged
         * programs.  Of course, if the intruder has root access on his local
         * machine, he can connect from any port.  So do not use these
         * authentication methods from machines that you do not trust.
@@ -1792,7 +1803,7 @@ do_ssh1_kex(void)
 
        debug("Received session key; encryption turned on.");
 
-       /* Send an acknowledgement packet.  Note that this packet is sent encrypted. */
+       /* Send an acknowledgment packet.  Note that this packet is sent encrypted. */
        packet_start(SSH_SMSG_SUCCESS);
        packet_send();
        packet_write_wait();
@@ -1819,6 +1830,10 @@ do_ssh2_kex(void)
                myproposal[PROPOSAL_MAC_ALGS_CTOS] =
                myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
        }
+       if (!options.compression) {
+               myproposal[PROPOSAL_COMP_ALGS_CTOS] =
+               myproposal[PROPOSAL_COMP_ALGS_STOC] = "none";
+       }
        myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = list_hostkey_types();
 
 #ifdef GSSAPI