/* import */
Index: usr.bin/ssh/channels.h
===================================================================
RCS file: /cvs/src/usr.bin/ssh/channels.h,v
retrieving revision 1.50
retrieving revision 1.51
diff -u -r1.50 -r1.51
--- usr.bin/ssh/channels.h 10 Oct 2001 22:18:47 -0000 1.50
+++ usr.bin/ssh/channels.h 7 Nov 2001 22:53:21 -0000 1.51
@@ -32,7 +32,7 @@
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
-/* RCSID("$OpenBSD: channels.h,v 1.50 2001/10/10 22:18:47 markus Exp $"); */
+/* RCSID("$OpenBSD: channels.h,v 1.51 2001/11/07 22:53:21 markus Exp $"); */
#include "includes.h"
-RCSID("$OpenBSD: clientloop.c,v 1.84 2001/10/11 15:24:00 markus Exp $");
+RCSID("$OpenBSD: clientloop.c,v 1.87 2001/11/09 18:59:23 markus Exp $");
#include "ssh.h"
#include "ssh1.h"
@@ -346,8 +346,8 @@
if (session_closed && !channel_still_open() &&
!packet_have_data_to_write()) {
/* clear mask since we did not call select() */
- memset(*readsetp, 0, *maxfdp);
- memset(*writesetp, 0, *maxfdp);
+ memset(*readsetp, 0, *nallocp);
+ memset(*writesetp, 0, *nallocp);
return;
} else {
FD_SET(connection_in, *readsetp);
@@ -375,8 +375,8 @@
* We have to return, because the mainloop checks for the flags
* set by the signal handlers.
*/
- memset(*readsetp, 0, *maxfdp);
- memset(*writesetp, 0, *maxfdp);
+ memset(*readsetp, 0, *nallocp);
+ memset(*writesetp, 0, *nallocp);
if (errno == EINTR)
return;
@@ -522,36 +522,19 @@
continue;
case '&':
- /* XXX does not work yet with proto 2 */
- if (compat20)
- continue;
/*
* Detach the program (continue to serve connections,
* but put in background and no more new connections).
*/
- if (!stdin_eof) {
- /*
- * Sending SSH_CMSG_EOF alone does not always appear
- * to be enough. So we try to send an EOF character
- * first.
- */
- packet_start(SSH_CMSG_STDIN_DATA);
- packet_put_string("\004", 1);
- packet_send();
- /* Close stdin. */
- stdin_eof = 1;
- if (buffer_len(bin) == 0) {
- packet_start(SSH_CMSG_EOF);
- packet_send();
- }
- }
/* Restore tty modes. */
leave_raw_mode();
/* Stop listening for new connections. */
- channel_close_all(); /* proto1 only XXXX */
+ channel_stop_listening();
if (len != SIGBLOB_LEN) {
Index: usr.bin/ssh/ssh-keygen.1
===================================================================
RCS file: /cvs/src/usr.bin/ssh/ssh-keygen.1,v
retrieving revision 1.49
retrieving revision 1.50
diff -u -r1.49 -r1.50
--- usr.bin/ssh/ssh-keygen.1 5 Sep 2001 06:23:07 -0000 1.49
+++ usr.bin/ssh/ssh-keygen.1 25 Oct 2001 21:14:32 -0000 1.50
@@ -1,4 +1,4 @@
-.\" $OpenBSD: ssh-keygen.1,v 1.49 2001/09/05 06:23:07 deraadt Exp $
+.\" $OpenBSD: ssh-keygen.1,v 1.50 2001/10/25 21:14:32 markus Exp $
.\"
.\" -*- nroff -*-
.\"
@@ -147,6 +147,7 @@
The default is 1024 bits.
.It Fl c
Requests changing the comment in the private and public key files.
+This operation is only supported for RSA1 keys.
The program will prompt for the file containing the private keys, for
the passphrase if the key has one, and for the new comment.
.It Fl e
@@ -168,7 +169,11 @@
This option allows importing keys from several commercial
SSH implementations.
.It Fl l
-Show fingerprint of specified private or public key file.
+Show fingerprint of specified public key file.
+Private RSA1 keys are also supported.
+For RSA and DSA keys
+.Nm
+tries to find the matching public key file and prints its fingerprint.
.It Fl p
Requests changing the passphrase of a private key file instead of
creating a new private key.
Index: usr.bin/ssh/ssh-keygen.c
===================================================================
RCS file: /cvs/src/usr.bin/ssh/ssh-keygen.c,v
retrieving revision 1.82
retrieving revision 1.83
diff -u -r1.82 -r1.83
--- usr.bin/ssh/ssh-keygen.c 28 Sep 2001 12:07:09 -0000 1.82
+++ usr.bin/ssh/ssh-keygen.c 25 Oct 2001 21:14:32 -0000 1.83
@@ -12,7 +12,7 @@
*/
#include <openssl/evp.h>
#include <openssl/err.h>
@@ -54,6 +54,10 @@
error("ssh_rsa_sign: no RSA key");
return -1;
}
+ if (datafellows & SSH_BUG_SIGBLOB) {
+ error("ssh_rsa_sign: SSH_BUG_SIGBLOB not supported");
+ return -1;
+ }
nid = (datafellows & SSH_BUG_RSASIGMD5) ? NID_md5 : NID_sha1;
if ((evp_md = EVP_get_digestbynid(nid)) == NULL) {
error("ssh_rsa_sign: EVP_get_digestbynid %d failed", nid);
@@ -124,6 +128,10 @@
error("ssh_rsa_verify: no RSA key");
return -1;
}
+ if (datafellows & SSH_BUG_SIGBLOB) {
+ error("ssh_rsa_verify: SSH_BUG_SIGBLOB not supported");
+ return -1;
+ }
if (BN_num_bits(key->rsa->n) < 768) {
error("ssh_rsa_verify: n too small: %d bits",
BN_num_bits(key->rsa->n));
@@ -143,14 +151,14 @@
rlen = buffer_len(&b);
buffer_free(&b);
if(rlen != 0) {
- xfree(sigblob);
error("ssh_rsa_verify: remaining bytes in signature %d", rlen);
+ xfree(sigblob);
return -1;
}
nid = (datafellows & SSH_BUG_RSASIGMD5) ? NID_md5 : NID_sha1;
if ((evp_md = EVP_get_digestbynid(nid)) == NULL) {
- xfree(sigblob);
error("ssh_rsa_verify: EVP_get_digestbynid %d failed", nid);
+ xfree(sigblob);
return -1;
}
dlen = evp_md->md_size;
Index: usr.bin/ssh/ssh.1
===================================================================
RCS file: /cvs/src/usr.bin/ssh/ssh.1,v
retrieving revision 1.139
retrieving revision 1.141
diff -u -r1.139 -r1.141
--- usr.bin/ssh/ssh.1 1 Oct 2001 21:51:16 -0000 1.139
+++ usr.bin/ssh/ssh.1 8 Nov 2001 17:49:53 -0000 1.141
@@ -34,7 +34,7 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.\" $OpenBSD: ssh.1,v 1.139 2001/10/01 21:51:16 markus Exp $
+.\" $OpenBSD: ssh.1,v 1.141 2001/11/08 17:49:53 markus Exp $
.Dd September 25, 1999
.Dt SSH 1
.Os
@@ -294,7 +294,7 @@
List forwarded connections
.It Cm ~&
Background ssh at logout when waiting for forwarded connection / X11 sessions
-to terminate (protocol version 1 only)
+to terminate
.It Cm ~?
Display a list of escape characters
.It Cm ~R
@@ -1389,6 +1389,15 @@
values that are not specified in the user's configuration file, and
for those users who do not have a configuration file.
This file must be world-readable.
+.It Pa /etc/ssh_host_key, /etc/ssh_host_dsa_key, /etc/ssh_host_rsa_key
+These three files contain the private parts of the host keys
+and are used for
+.Cm RhostsRSAAuthentication
+and
+.Cm HostbasedAuthentication .
+Since they are readable only by root
+.Nm
+must be setuid root if these authentication methods are desired.
.It Pa $HOME/.rhosts
This file is used in
.Pa \&.rhosts
Index: usr.bin/ssh/ssh.c
===================================================================
RCS file: /cvs/src/usr.bin/ssh/ssh.c,v
retrieving revision 1.147
retrieving revision 1.149
diff -u -r1.147 -r1.149
--- usr.bin/ssh/ssh.c 8 Oct 2001 19:05:05 -0000 1.147
+++ usr.bin/ssh/ssh.c 24 Oct 2001 08:51:35 -0000 1.149
@@ -39,7 +39,7 @@
*/
#include "includes.h"
-RCSID("$OpenBSD: ssh.c,v 1.147 2001/10/08 19:05:05 markus Exp $");
+RCSID("$OpenBSD: ssh.c,v 1.149 2001/10/24 08:51:35 markus Exp $");
#include <openssl/evp.h>
#include <openssl/err.h>
@@ -123,14 +123,6 @@
/* socket address the host resolves to */
struct sockaddr_storage hostaddr;
-/*
- * Flag to indicate that we have received a window change signal which has
- * not yet been processed. This will cause a message indicating the new
- * window size to be sent to the server a little later. This is volatile
- * because this is updated in a signal handler.
- */
-volatile int received_window_change_signal = 0;
-
/* Private host keys. */
struct {
Key **keys;
@@ -739,6 +731,8 @@
tilde_expand_filename(options.system_hostfile2, original_real_uid);
options.user_hostfile2 =
tilde_expand_filename(options.user_hostfile2, original_real_uid);
+
+ signal(SIGPIPE, SIG_IGN); /* ignore SIGPIPE early */
/* Log into the remote system. This never returns if the login fails. */
ssh_login(sensitive_data.keys, sensitive_data.nkeys,
Index: usr.bin/ssh/sshconnect2.c
===================================================================
RCS file: /cvs/src/usr.bin/ssh/sshconnect2.c,v
retrieving revision 1.83
retrieving revision 1.85
diff -u -r1.83 -r1.85
--- usr.bin/ssh/sshconnect2.c 6 Oct 2001 11:18:19 -0000 1.83
+++ usr.bin/ssh/sshconnect2.c 7 Nov 2001 16:03:17 -0000 1.85
@@ -23,7 +23,7 @@
*/
#include "includes.h"
-RCSID("$OpenBSD: sshconnect2.c,v 1.83 2001/10/06 11:18:19 markus Exp $");
+RCSID("$OpenBSD: sshconnect2.c,v 1.85 2001/11/07 16:03:17 markus Exp $");
@@ -836,16 +836,6 @@
u_int blen, slen;
int ok, i, len, found = 0;
- p = get_local_name(packet_get_connection_in());
- if (p == NULL) {
- error("userauth_hostbased: cannot get local ipaddr/name");
- return 0;
- }
- len = strlen(p) + 2;
- chost = xmalloc(len);
- strlcpy(chost, p, len);
- strlcat(chost, ".", len);
- debug2("userauth_hostbased: chost %s", chost);
/* check for a useful key */
for (i = 0; i < authctxt->nkeys; i++) {
private = authctxt->keys[i];
@@ -857,14 +847,26 @@
}
}
if (!found) {
- xfree(chost);
+ debug("userauth_hostbased: no more client hostkeys");
return 0;
}
if (key_to_blob(private, &blob, &blen) == 0) {
key_free(private);
- xfree(chost);
return 0;
}
+ /* figure out a name for the client host */
+ p = get_local_name(packet_get_connection_in());
+ if (p == NULL) {
+ error("userauth_hostbased: cannot get local ipaddr/name");
+ key_free(private);
+ return 0;
+ }
+ len = strlen(p) + 2;
+ chost = xmalloc(len);
+ strlcpy(chost, p, len);
+ strlcat(chost, ".", len);
+ debug2("userauth_hostbased: chost %s", chost);
+
service = datafellows & SSH_BUG_HBSERVICE ? "ssh-userauth" :
authctxt->service;
pkalg = xstrdup(key_ssh_name(private));
@@ -882,7 +884,6 @@
#ifdef DEBUG_PK
buffer_dump(&b);
#endif
- debug2("xxx: chost %s", chost);
ok = key_sign(private, &signature, &slen, buffer_ptr(&b), buffer_len(&b));
key_free(private);
buffer_free(&b);
Index: usr.bin/ssh/sshd.8
===================================================================
RCS file: /cvs/src/usr.bin/ssh/sshd.8,v
retrieving revision 1.153
retrieving revision 1.154
diff -u -r1.153 -r1.154
--- usr.bin/ssh/sshd.8 27 Sep 2001 17:53:24 -0000 1.153
+++ usr.bin/ssh/sshd.8 7 Nov 2001 22:12:01 -0000 1.154
@@ -34,7 +34,7 @@
.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
.\"
-.\" $OpenBSD: sshd.8,v 1.153 2001/09/27 17:53:24 camield Exp $
+.\" $OpenBSD: sshd.8,v 1.154 2001/11/07 22:12:01 markus Exp $
.Dd September 25, 1999
.Dt SSHD 8
.Os
@@ -402,11 +402,11 @@
.Nm
will disconnect the client, terminating the session. It is important
to note that the use of client alive messages is very different from
-.Cm Keepalive
+.Cm KeepAlive
(below). The client alive messages are sent through the
encrypted channel and therefore will not be spoofable. The TCP keepalive
option enabled by
-.Cm Keepalive
+.Cm KeepAlive
is spoofable. The client alive mechanism is valuable when the client or
server depend on knowing when a connection has become inactive.
.Pp
Index: usr.bin/ssh/sshd.c
===================================================================
RCS file: /cvs/src/usr.bin/ssh/sshd.c,v
retrieving revision 1.206
retrieving revision 1.209
diff -u -r1.206 -r1.209
--- usr.bin/ssh/sshd.c 2 Oct 2001 22:56:09 -0000 1.206
+++ usr.bin/ssh/sshd.c 10 Nov 2001 13:19:45 -0000 1.209
@@ -40,7 +40,7 @@
*/
#include <openssl/dh.h>
#include <openssl/bn.h>
@@ -328,7 +328,7 @@
/* Send our protocol version identification. */
if (atomicio(write, sock_out, server_version_string, strlen(server_version_string))
!= strlen(server_version_string)) {
- log("Could not write ident string to %s.", get_remote_ipaddr());
+ log("Could not write ident string to %s", get_remote_ipaddr());
fatal_cleanup();
}
@@ -336,7 +336,7 @@
memset(buf, 0, sizeof(buf));
for (i = 0; i < sizeof(buf) - 1; i++) {
if (atomicio(read, sock_in, &buf[i], 1) != 1) {
- log("Did not receive identification string from %s.",
+ log("Did not receive identification string from %s",
get_remote_ipaddr());
fatal_cleanup();
}
@@ -1106,9 +1106,8 @@
remote_port = get_remote_port();
remote_ip = get_remote_ipaddr();
- /* Check whether logins are denied from this host. */
#ifdef LIBWRAP
- /* XXX LIBWRAP noes not know about IPv6 */
+ /* Check whether logins are denied from this host. */
{
struct request_info req;
@@ -1116,13 +1115,14 @@
fromhost(&req);
if (!hosts_access(&req)) {
+ debug("Connection refused by tcp wrapper");
refuse(&req);
- close(sock_in);
- close(sock_out);
+ /* NOTREACHED */
+ fatal("libwrap refuse returns");
}
-/*XXX IPv6 verbose("Connection from %.500s port %d", eval_client(&req), remote_port); */
}
#endif /* LIBWRAP */
+
/* Log the connection. */
verbose("Connection from %.500s port %d", remote_ip, remote_port);
