o Merge to OPENSSH_3_6_1P2_GSSAPI_20030505.

diff --git a/openssh/CREDITS b/openssh/CREDITS
index 487a41d8cd96189f6dc7f7ac106ab2032a7e4ccd..7ce3e9270476c88799606d6ac379aba781ffba9d 100644 (file)
--- a/openssh/CREDITS
+++ b/openssh/CREDITS
@@ -5,7 +5,7 @@ Theo de Raadt, and Dug Song - Creators of OpenSSH
 
 Alain St-Denis <Alain.St-Denis@ec.gc.ca> - Irix fix
 Alexandre Oliva <oliva@lsd.ic.unicamp.br> - AIX fixes
-Andre Lucas <andre.lucas@dial.pipex.com> - new login code, many fixes
+Andre Lucas <andre@ae-35.com> - new login code, many fixes
 Andreas Steinmetz <ast@domdv.de> - Shadow password expiry support
 Andrew McGill <andrewm@datrix.co.za> - SCO fixes
 Andrew Morgan <morgan@transmeta.com> - PAM bugfixes

diff --git a/openssh/ChangeLog b/openssh/ChangeLog
index ca93b69d28dccb0a929535c15d294837de41f3b5..2cffc92e1af49e3200133492071410aa2553b923 100644 (file)
--- a/openssh/ChangeLog
+++ b/openssh/ChangeLog
@@ -1,3 +1,10 @@
+20030429
+ - (djm) Add back radix.o (used by AFS support), after it went missing from
+   Makefile many moons ago
+ - (djm) Apply "owl-always-auth" patch from Openwall/Solar Designer
+ - (djm) Fix blibpath specification for AIX/gcc
+ - (djm) Some systems have basename in -lgen. Fix from ayamura@ayamura.org
+
 20030401
  - (djm) OpenBSD CVS Sync
    - jmc@cvs.openbsd.org 2003/03/28 10:11:43

diff --git a/openssh/Makefile.in b/openssh/Makefile.in
index 2f15b39bf90cd3584a009ae8feb166c3db89b6fb..e0f023fcb07da7f1658a65edf07c16f05fac86d0 100644 (file)
--- a/openssh/Makefile.in
+++ b/openssh/Makefile.in
@@ -63,7 +63,7 @@ TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keys
 
 LIBSSH_OBJS=authfd.o authfile.o bufaux.o buffer.o canohost.o channels.o \
        cipher.o compat.o compress.o crc32.o deattack.o fatal.o \
-       hostfile.o log.o match.o mpaux.o nchan.o packet.o readpass.o \
+       hostfile.o log.o match.o mpaux.o nchan.o packet.o radix.o readpass.o \
        rsa.o tildexpand.o ttymodes.o xmalloc.o atomicio.o \
        key.o dispatch.o kex.o mac.o uuencode.o misc.o \
        rijndael.o ssh-dss.o ssh-rsa.o dh.o kexdh.o kexgex.o \

diff --git a/openssh/auth-pam.c b/openssh/auth-pam.c
index a8ba48652905daee42e9ffc5d807cd3dfb850dd4..da74bc0a7f9b901ed30823f3c7dd21c57223e653 100644 (file)
--- a/openssh/auth-pam.c
+++ b/openssh/auth-pam.c
@@ -201,7 +201,7 @@ void do_pam_cleanup_proc(void *context)
        }
 }
 
-/* Attempt password authentation using PAM */
+/* Attempt password authentication using PAM */
 int auth_pam_password(Authctxt *authctxt, const char *password)
 {
        extern ServerOptions options;
@@ -215,13 +215,13 @@ int auth_pam_password(Authctxt *authctxt, const char *password)
        pamstate = INITIAL_LOGIN;
        pam_retval = do_pam_authenticate(
            options.permit_empty_passwd == 0 ? PAM_DISALLOW_NULL_AUTHTOK : 0);
-       if (pam_retval == PAM_SUCCESS) {
-               debug("PAM Password authentication accepted for "
-                   "user \"%.100s\"", pw->pw_name);
+       if (pam_retval == PAM_SUCCESS && pw) {
+               debug("PAM password authentication accepted for "
+                   "%.100s", pw->pw_name);
                return 1;
        } else {
-               debug("PAM Password authentication for \"%.100s\" "
-                   "failed[%d]: %s", pw->pw_name, pam_retval, 
+               debug("PAM password authentication failed for "
+                   "%.100s: %s", pw ? pw->pw_name : "an illegal user",
                    PAM_STRERROR(__pamh, pam_retval));
                return 0;
        }

diff --git a/openssh/auth-passwd.c b/openssh/auth-passwd.c
index 9901d48425ffcfd327cc24eeaae930b5d38d1a2d..62ea3a52dd6227e66f1d9292c9051ff2ff43e749 100644 (file)
--- a/openssh/auth-passwd.c
+++ b/openssh/auth-passwd.c
@@ -93,6 +93,7 @@ int
 auth_password(Authctxt *authctxt, const char *password)
 {
        struct passwd * pw = authctxt->pw;
+       int ok = authctxt->valid;
 #if !defined(USE_PAM) && !defined(HAVE_OSF_SIA)
        char *encrypted_password;
        char *pw_password;
@@ -115,19 +116,23 @@ auth_password(Authctxt *authctxt, const char *password)
 
        /* deny if no user. */
        if (pw == NULL)
-               return 0;
+               ok = 0;
 #ifndef HAVE_CYGWIN
-       if (pw->pw_uid == 0 && options.permit_root_login != PERMIT_YES)
-               return 0;
+       if (pw && pw->pw_uid == 0 && options.permit_root_login != PERMIT_YES)
+               ok = 0;
 #endif
        if (*password == '\0' && options.permit_empty_passwd == 0)
-               return 0;
+               ok = 0;
 
 #if defined(USE_PAM)
-       return auth_pam_password(authctxt, password);
+       return auth_pam_password(authctxt, password) && ok;
 #elif defined(HAVE_OSF_SIA)
+       if (!ok)
+               return 0;
        return auth_sia_password(authctxt, password);
 #else
+       if (!ok)
+               return 0;
 # ifdef KRB5
        if (options.kerberos_authentication == 1) {
                int ret = auth_krb5_password(authctxt, password);

diff --git a/openssh/auth2-gss.c b/openssh/auth2-gss.c
index 4204528cc64682966f8e063688a296c28de298fb..abbb3822a95285918ea59cdff5a5a5a2d6c0b2ae 100644 (file)
--- a/openssh/auth2-gss.c
+++ b/openssh/auth2-gss.c
@@ -157,14 +157,14 @@ input_gssapi_token(int type, u_int32_t plen, void *ctxt)
         Gssctxt *gssctxt;
         gss_buffer_desc send_tok,recv_tok;
         OM_uint32 maj_status, min_status;
-       int len;
+        u_int len;
         
         if (authctxt == NULL || (authctxt->methoddata == NULL && !use_privsep))
                 fatal("No authentication or GSSAPI context");
                 
         gssctxt=authctxt->methoddata;
         recv_tok.value=packet_get_string(&len);
-        recv_tok.length=len; /* int vs. size_t */
+        recv_tok.length=len; /* u_int vs. size_t */
         
         maj_status=PRIVSEP(ssh_gssapi_accept_ctx(gssctxt, &recv_tok, 
                                                 &send_tok, NULL));

diff --git a/openssh/auth2-none.c b/openssh/auth2-none.c
index c07b2dd814883e80969e780538028d4250845cb1..692a2961f9e7b10cfbfd26d44c78cd725eed950d 100644 (file)
--- a/openssh/auth2-none.c
+++ b/openssh/auth2-none.c
@@ -100,7 +100,7 @@ userauth_none(Authctxt *authctxt)
        if (check_nt_auth(1, authctxt->pw) == 0)
                return(0);
 #endif
-       return (authctxt->valid ? PRIVSEP(auth_password(authctxt, "")) : 0);
+       return PRIVSEP(auth_password(authctxt, "")) && authctxt->valid;
 }
 
 Authmethod method_none = {

diff --git a/openssh/auth2-passwd.c b/openssh/auth2-passwd.c
index ffa27959426a6c8f431dbc7bbbb35316b343e8d1..5026969f89f0f39c637c3da67d3c278d56f345a6 100644 (file)
--- a/openssh/auth2-passwd.c
+++ b/openssh/auth2-passwd.c
@@ -47,11 +47,11 @@ userauth_passwd(Authctxt *authctxt)
                log("password change not supported");
        password = packet_get_string(&len);
        packet_check_eom();
-       if (authctxt->valid &&
+       if (PRIVSEP(auth_password(authctxt, password)) == 1 && authctxt->valid
 #ifdef HAVE_CYGWIN
-           check_nt_auth(1, authctxt->pw) &&
+           && check_nt_auth(1, authctxt->pw)
 #endif
-           PRIVSEP(auth_password(authctxt, password)) == 1)
+           )
                authenticated = 1;
        memset(password, 0, len);
        xfree(password);

diff --git a/openssh/configure.ac b/openssh/configure.ac
index a7f56cb08a0ed7d678d72ab103869b1df26674a8..217088f5f10fc7379d7cfcd357da38434cbc6c1d 100644 (file)
--- a/openssh/configure.ac
+++ b/openssh/configure.ac
@@ -57,20 +57,24 @@ case "$host" in
        AFS_LIBS="-lld"
        CPPFLAGS="$CPPFLAGS -I/usr/local/include"
        LDFLAGS="$LDFLAGS -L/usr/local/lib"
-       if (test "$LD" != "gcc" && test -z "$blibpath"); then
-               AC_MSG_CHECKING([if linkage editor ($LD) accepts -blibpath])
-               saved_LDFLAGS="$LDFLAGS"
-               LDFLAGS="$LDFLAGS -blibpath:/usr/lib:/lib:/usr/local/lib"
-               AC_TRY_LINK([],
-                       [],
-                       [
-                               AC_MSG_RESULT(yes)
-                               blibpath="/usr/lib:/lib:/usr/local/lib"
-                       ],
-                       [ AC_MSG_RESULT(no) ]
-               )
-               LDFLAGS="$saved_LDFLAGS"
+       AC_MSG_CHECKING([how to specify blibpath for linker ($LD)]) 
+       if (test -z "$blibpath"); then
+               blibpath="/usr/lib:/lib:/usr/local/lib"
        fi
+       saved_LDFLAGS="$LDFLAGS"
+       for tryflags in -blibpath: -Wl,-blibpath: -Wl,-rpath, ;do
+               if (test -z "$blibflags"); then
+                       LDFLAGS="$saved_LDFLAGS $tryflags$blibpath"
+                       AC_TRY_LINK([], [], [blibflags=$tryflags])
+               fi
+       done
+       if (test -z "$blibflags"); then
+               AC_MSG_RESULT(not found)
+               AC_MSG_ERROR([*** must be able to specify blibpath on AIX - check config.log])
+       else
+               AC_MSG_RESULT($blibflags)
+       fi
+       LDFLAGS="$saved_LDFLAGS"
        AC_CHECK_FUNC(authenticate, [AC_DEFINE(WITH_AIXAUTHENTICATE)],
                [AC_CHECK_LIB(s,authenticate,
                        [ AC_DEFINE(WITH_AIXAUTHENTICATE)
@@ -741,6 +745,7 @@ AC_CHECK_FUNCS(\
 )
 
 AC_SEARCH_LIBS(nanosleep, rt posix4, AC_DEFINE(HAVE_NANOSLEEP))
+AC_SEARCH_LIBS(basename, gen, AC_DEFINE(HAVE_BASENAME))
 
 dnl IRIX has basename() in libgen
 AC_SEARCH_LIBS(basename, gen, AC_DEFINE(HAVE_BASENAME))
@@ -2637,8 +2642,8 @@ fi
 
 
 if test ! -z "$blibpath" ; then
-       LDFLAGS="$LDFLAGS -blibpath:$blibpath"
-       AC_MSG_WARN([Please check and edit -blibpath in LDFLAGS in Makefile])
+       LDFLAGS="$LDFLAGS $blibflags$blibpath"
+       AC_MSG_WARN([Please check and edit blibpath in LDFLAGS in Makefile])
 fi
 
 dnl remove pam and dl because they are in $LIBPAM

diff --git a/openssh/contrib/caldera/openssh.spec b/openssh/contrib/caldera/openssh.spec
index 63aaa2124b32519a1197ce279056261f03a7223a..68e59c76b890a890c4a1d8a7b096dcb04fb5e27c 100644 (file)
--- a/openssh/contrib/caldera/openssh.spec
+++ b/openssh/contrib/caldera/openssh.spec
@@ -17,7 +17,7 @@
 #old cvs stuff.  please update before use.  may be deprecated.
 %define use_stable     1
 %if %{use_stable}
-  %define version      3.6.1p1
+  %define version      3.6.1p2
   %define cvs          %{nil}
   %define release      2
 %else

diff --git a/openssh/contrib/redhat/openssh.spec b/openssh/contrib/redhat/openssh.spec
index 7488357fbd5708303ae36bca8261c33b1123936a..e7c3bb121a495a9ecc04062a7d73a90e661045cb 100644 (file)
--- a/openssh/contrib/redhat/openssh.spec
+++ b/openssh/contrib/redhat/openssh.spec
@@ -1,4 +1,4 @@
-%define ver 3.6.1p1
+%define ver 3.6.1p2
 %define rel 1
 
 # OpenSSH privilege separation requires a user & group ID

diff --git a/openssh/contrib/suse/openssh.spec b/openssh/contrib/suse/openssh.spec
index 194dbb7d10b3776dfff06464a67d7f4e15377812..707c3a221d8bbe3d674dc1ec4c0dc4a628c5d11f 100644 (file)
--- a/openssh/contrib/suse/openssh.spec
+++ b/openssh/contrib/suse/openssh.spec
@@ -1,6 +1,6 @@
 Summary: OpenSSH, a free Secure Shell (SSH) protocol implementation
 Name: openssh
-Version: 3.6.1p1
+Version: 3.6.1p2
 URL: http://www.openssh.com/
 Release: 1
 Source0: openssh-%{version}.tar.gz

diff --git a/openssh/kex.h b/openssh/kex.h
index d907e5ab10f86535dcacb1df7403a3e0de27f34f..50b8659e9bb4f50a20f2ff85101f5bae27b612f7 100644 (file)
--- a/openssh/kex.h
+++ b/openssh/kex.h
@@ -114,7 +114,6 @@ struct Kex {
        Buffer  peer;
        int     done;
        int     flags;
-       char    *host;
        char    *client_version_string;
        char    *server_version_string;
        struct  KexOptions options;

diff --git a/openssh/kexgssc.c b/openssh/kexgssc.c
index b5afa52a76d07ca39570f8daa22938aa12aae674..52b569f62febe5cb19ddb33ce8c95998c8e0df45 100644 (file)
--- a/openssh/kexgssc.c
+++ b/openssh/kexgssc.c
@@ -36,9 +36,9 @@
 #include "log.h"
 #include "packet.h"
 #include "dh.h"
+#include "canohost.h"
 #include "ssh2.h"
 #include "ssh-gss.h"
-#include "canohost.h"
 
 void
 kexgss_client(Kex *kex)
@@ -57,13 +57,15 @@ kexgss_client(Kex *kex)
        char *lang;
        int type = 0;
        int first = 1;
-       int slen = 0, strlen;
+       int slen = 0;
+       u_int strlen;
        
        /* Initialise our GSSAPI world */
        ssh_gssapi_build_ctx(&ctxt);
        if (ssh_gssapi_client_id_kex(ctxt,kex->name)==NULL) {
                fatal("Couldn't identify host exchange");
        }
+
        if (ssh_gssapi_import_name(ctxt,get_canonical_hostname(1))) {
                fatal("Couldn't import hostname ");
        }
@@ -92,7 +94,6 @@ kexgss_client(Kex *kex)
 
                if (GSS_ERROR(maj_status)) {
                        if (send_tok.length!=0) {
-                               /* Hmmm - not sure about this */
                                packet_start(SSH2_MSG_KEXGSS_CONTINUE);
                                packet_put_string(send_tok.value,
                                                  send_tok.length);
@@ -148,19 +149,19 @@ kexgss_client(Kex *kex)
                                if (maj_status == GSS_S_COMPLETE) 
                                        fatal("GSSAPI Continue received from server when complete");
                                recv_tok.value=packet_get_string(&strlen);
-                               recv_tok.length=strlen; /* int vs. size_t */
+                               recv_tok.length=strlen; /* u_int vs. size_t */
                                break;
                        case SSH2_MSG_KEXGSS_COMPLETE:
                                debug("Received GSSAPI_COMPLETE");
                                packet_get_bignum2(dh_server_pub);
                                msg_tok.value=packet_get_string(&strlen);
-                               msg_tok.length=strlen; /* int vs. size_t */
+                               msg_tok.length=strlen; /* u_int vs. size_t */
 
                                /* Is there a token included? */
                                if (packet_get_char()) {
                                        recv_tok.value=
                                            packet_get_string(&strlen);
-                                       recv_tok.length=strlen; /*int/size_t*/
+                                       recv_tok.length=strlen; /*u_int/size_t*/
                                        /* If we're already complete - protocol error */
                                        if (maj_status == GSS_S_COMPLETE)
                                                packet_disconnect("Protocol error: received token when complete");

diff --git a/openssh/monitor.c b/openssh/monitor.c
index 6e8d03db07b930bbe53c252b49d63758ca5c6552..25fbd748629a35a6214bd90f4ab16c0ea895a933 100644 (file)
--- a/openssh/monitor.c
+++ b/openssh/monitor.c
@@ -678,7 +678,7 @@ mm_answer_authpassword(int socket, Buffer *m)
        passwd = buffer_get_string(m, &plen);
        /* Only authenticate if the context is valid */
        authenticated = options.password_authentication &&
-           authctxt->valid && auth_password(authctxt, passwd);
+           auth_password(authctxt, passwd) && authctxt->valid;
        memset(passwd, 0, strlen(passwd));
        xfree(passwd);
 
@@ -1730,7 +1730,7 @@ int
 mm_answer_gss_setup_ctx(int socket, Buffer *m) {
         gss_OID_desc oid;
         OM_uint32 major;
-       int len;
+        u_int len;
 
         oid.elements=buffer_get_string(m,&len);
        oid.length=len;

diff --git a/openssh/monitor_wrap.c b/openssh/monitor_wrap.c
index b68003287135e495c0ee2f501e18f3de11611f59..6c16863f606e6627747abb8c57d00a9d52f344cd 100644 (file)
--- a/openssh/monitor_wrap.c
+++ b/openssh/monitor_wrap.c
@@ -1072,8 +1072,8 @@ mm_ssh_gssapi_userok(char *user) {
         int authenticated = 0;
 
         buffer_init(&m);
+        
         mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSUSEROK, &m);
-
         mm_request_receive_expect(pmonitor->m_recvfd, MONITOR_ANS_GSSUSEROK,
                                   &m);
 
@@ -1134,6 +1134,8 @@ mm_gss_indicate_mechs(OM_uint32 *minor_status, gss_OID_set *mech_set)
        OM_uint32 major,minor;
        int count;
        gss_OID_desc oid;
+        u_int length;
+
        buffer_init(&m);
 
        mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_GSSMECHS, &m);
@@ -1144,7 +1146,6 @@ mm_gss_indicate_mechs(OM_uint32 *minor_status, gss_OID_set *mech_set)
        
         gss_create_empty_oid_set(&minor,mech_set);
        while(count-->0) {
-           u_int length;
            oid.elements=buffer_get_string(&m,&length);
            oid.length=length;
            gss_add_oid_set_member(&minor,&oid,mech_set);

diff --git a/openssh/ssh-gss.h b/openssh/ssh-gss.h
index 5dbf7f1eba68ac163627d4c658a6cb1a383d3b5a..87f6c491614999d24e19f0c1780575bfc0d26735 100644 (file)
--- a/openssh/ssh-gss.h
+++ b/openssh/ssh-gss.h
@@ -38,7 +38,6 @@
 #include <gssapi_generic.h>
 
 /* MIT Kerberos doesn't seem to define GSS_NT_HOSTBASED_SERVICE */
-
 #ifndef GSS_C_NT_HOSTBASED_SERVICE
 #define GSS_C_NT_HOSTBASED_SERVICE gss_nt_service_name
 #endif /* GSS_C_NT_... */

diff --git a/openssh/sshconnect2.c b/openssh/sshconnect2.c
index b5d1ba1010425a62bbe9054558ae7335a322d5ad..cc6563f68a8e0f34bf1efb1a36918d773f251116 100644 (file)
--- a/openssh/sshconnect2.c
+++ b/openssh/sshconnect2.c
@@ -155,7 +155,6 @@ ssh_kex2(char *host, struct sockaddr *hostaddr)
        kex->client_version_string=client_version_string;
        kex->server_version_string=server_version_string;
        kex->verify_host_key=&verify_host_key_callback;
-       kex->host=host;
 #ifdef GSSAPI
        kex->options.gss_deleg_creds=options.gss_deleg_creds;
 #endif

diff --git a/openssh/version.h b/openssh/version.h
index 75a2b2554c4ab17990f7fe01b6d57193c81e24a3..3b2a35d9160768369712db276c0204c79641572c 100644 (file)
--- a/openssh/version.h
+++ b/openssh/version.h
@@ -1,3 +1,3 @@
 /* $OpenBSD: version.h,v 1.37 2003/04/01 10:56:46 markus Exp $ */
 
-#define SSH_VERSION    "OpenSSH_3.6.1p1"
+#define SSH_VERSION    "OpenSSH_3.6.1p2"