- markus@cvs.openbsd.org 2006/03/14 16:32:48

[openssh.git] / sshconnect2.c

diff --git a/sshconnect2.c b/sshconnect2.c
index 76670e8a8a778f9d7943b005335a428f3856df2d..f2776edb734583f72d45af4bb1ae4ac4f87f8b29 100644 (file)
--- a/sshconnect2.c
+++ b/sshconnect2.c
@@ -23,7 +23,12 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: sshconnect2.c,v 1.133 2003/11/21 11:57:03 djm Exp $");
+RCSID("$OpenBSD: sshconnect2.c,v 1.146 2006/02/20 17:19:54 stevesk Exp $");
+
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <sys/queue.h>
+#include <sys/stat.h>
 
 #include "openbsd-compat/sys-queue.h"
 
@@ -43,7 +48,7 @@ RCSID("$OpenBSD: sshconnect2.c,v 1.133 2003/11/21 11:57:03 djm Exp $");
 #include "authfd.h"
 #include "log.h"
 #include "readconf.h"
-#include "readpass.h"
+#include "misc.h"
 #include "match.h"
 #include "dispatch.h"
 #include "canohost.h"
@@ -101,10 +106,10 @@ ssh_kex2(char *host, struct sockaddr *hostaddr)
            compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_STOC]);
        if (options.compression) {
                myproposal[PROPOSAL_COMP_ALGS_CTOS] =
-               myproposal[PROPOSAL_COMP_ALGS_STOC] = "zlib,none";
+               myproposal[PROPOSAL_COMP_ALGS_STOC] = "zlib@openssh.com,zlib,none";
        } else {
                myproposal[PROPOSAL_COMP_ALGS_CTOS] =
-               myproposal[PROPOSAL_COMP_ALGS_STOC] = "none,zlib";
+               myproposal[PROPOSAL_COMP_ALGS_STOC] = "none,zlib@openssh.com,zlib";
        }
        if (options.macs != NULL) {
                myproposal[PROPOSAL_MAC_ALGS_CTOS] =
@@ -120,6 +125,7 @@ ssh_kex2(char *host, struct sockaddr *hostaddr)
        /* start key exchange */
        kex = kex_setup(myproposal);
        kex->kex[KEX_DH_GRP1_SHA1] = kexdh_client;
+       kex->kex[KEX_DH_GRP14_SHA1] = kexdh_client;
        kex->kex[KEX_DH_GEX_SHA1] = kexgex_client;
        kex->client_version_string=client_version_string;
        kex->server_version_string=server_version_string;
@@ -351,7 +357,7 @@ void
 input_userauth_error(int type, u_int32_t seq, void *ctxt)
 {
        fatal("input_userauth_error: bad message during authentication: "
-          "type %d", type);
+           "type %d", type);
 }
 
 void
@@ -458,7 +464,7 @@ input_userauth_pk_ok(int type, u_int32_t seq, void *ctxt)
         * moved to the end of the queue.  this also avoids confusion by
         * duplicate keys
         */
-       TAILQ_FOREACH_REVERSE(id, &authctxt->keys, next, idlist) {
+       TAILQ_FOREACH_REVERSE(id, &authctxt->keys, idlist, next) {
                if (key_equal(key, id->key)) {
                        sent = sign_and_send_pubkey(authctxt, id);
                        break;
@@ -481,7 +487,7 @@ userauth_gssapi(Authctxt *authctxt)
 {
        Gssctxt *gssctxt = NULL;
        static gss_OID_set gss_supported = NULL;
-       static int mech = 0;
+       static u_int mech = 0;
        OM_uint32 min;
        int ok = 0;
 
@@ -508,7 +514,8 @@ userauth_gssapi(Authctxt *authctxt)
                }
        }
 
-       if (!ok) return 0;
+       if (!ok)
+               return 0;
 
        authctxt->methoddata=(void *)gssctxt;
 
@@ -543,10 +550,11 @@ process_gssapi_token(void *ctxt, gss_buffer_t recv_tok)
        Authctxt *authctxt = ctxt;
        Gssctxt *gssctxt = authctxt->methoddata;
        gss_buffer_desc send_tok = GSS_C_EMPTY_BUFFER;
-       gss_buffer_desc gssbuf, mic;
+       gss_buffer_desc mic = GSS_C_EMPTY_BUFFER;
+       gss_buffer_desc gssbuf;
        OM_uint32 status, ms, flags;
        Buffer b;
-       
+
        status = ssh_gssapi_init_ctx(gssctxt, options.gss_deleg_creds,
            recv_tok, &send_tok, &flags);
 
@@ -555,12 +563,12 @@ process_gssapi_token(void *ctxt, gss_buffer_t recv_tok)
                        packet_start(SSH2_MSG_USERAUTH_GSSAPI_ERRTOK);
                else
                        packet_start(SSH2_MSG_USERAUTH_GSSAPI_TOKEN);
-                       
+
                packet_put_string(send_tok.value, send_tok.length);
                packet_send();
                gss_release_buffer(&ms, &send_tok);
        }
-       
+
        if (status == GSS_S_COMPLETE) {
                /* send either complete or MIC, depending on mechanism */
                if (!(flags & GSS_C_INTEG_FLAG)) {
@@ -572,21 +580,21 @@ process_gssapi_token(void *ctxt, gss_buffer_t recv_tok)
 
                        gssbuf.value = buffer_ptr(&b);
                        gssbuf.length = buffer_len(&b);
-                       
+
                        status = ssh_gssapi_sign(gssctxt, &gssbuf, &mic);
-                       
+
                        if (!GSS_ERROR(status)) {
                                packet_start(SSH2_MSG_USERAUTH_GSSAPI_MIC);
                                packet_put_string(mic.value, mic.length);
-                               
+
                                packet_send();
                        }
-                               
+
                        buffer_free(&b);
                        gss_release_buffer(&ms, &mic);
-               }       
+               }
        }
-       
+
        return status;
 }
 
@@ -677,7 +685,7 @@ input_gssapi_errtok(int type, u_int32_t plen, void *ctxt)
 
        /* Stick it into GSSAPI and see what it says */
        status = ssh_gssapi_init_ctx(gssctxt, options.gss_deleg_creds,
-                                    &recv_tok, &send_tok, NULL);
+           &recv_tok, &send_tok, NULL);
 
        xfree(recv_tok.value);
        gss_release_buffer(&ms, &send_tok);
@@ -699,7 +707,7 @@ input_gssapi_error(int type, u_int32_t plen, void *ctxt)
 
        packet_check_eom();
 
-       debug("Server GSSAPI Error:\n%s\n", msg);
+       debug("Server GSSAPI Error:\n%s", msg);
        xfree(msg);
        xfree(lang);
 }
@@ -1044,7 +1052,7 @@ pubkey_prepare(Authctxt *authctxt)
                                        break;
                                }
                        }
-                       if (!found) {
+                       if (!found && !options.identities_only) {
                                id = xmalloc(sizeof(*id));
                                memset(id, 0, sizeof(*id));
                                id->key = key;
@@ -1267,7 +1275,7 @@ ssh_keysign(Key *key, u_char **sigp, u_int *lenp,
 
        if (ssh_msg_recv(from[0], &b) < 0) {
                error("ssh_keysign: no reply");
-               buffer_clear(&b);
+               buffer_free(&b);
                return -1;
        }
        close(from[0]);
@@ -1279,11 +1287,11 @@ ssh_keysign(Key *key, u_char **sigp, u_int *lenp,
 
        if (buffer_get_char(&b) != version) {
                error("ssh_keysign: bad version");
-               buffer_clear(&b);
+               buffer_free(&b);
                return -1;
        }
        *sigp = buffer_get_string(&b, lenp);
-       buffer_clear(&b);
+       buffer_free(&b);
 
        return 0;
 }