* New upstream release (http://www.openssh.com/txt/release-6.3).

  - sftp(1): add support for resuming partial downloads using the "reget"
    command and on the sftp commandline or on the "get" commandline using
    the "-a" (append) option (closes: #158590).
  - ssh(1): add an "IgnoreUnknown" configuration option to selectively
    suppress errors arising from unknown configuration directives (closes:
    #436052).
  - sftp(1): update progressmeter when data is acknowledged, not when it's
    sent (partially addresses #708372).
  - ssh(1): do not fatally exit when attempting to cleanup multiplexing-
    created channels that are incompletely opened (closes: #651357).

1 files changed, 38 insertions, 14 deletions

diff --git a/auth.c b/auth.c
index 514602a0c..7f6c6c8ad 100644
--- a/auth.c
+++ b/auth.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth.c,v 1.101 2013/02/06 00:22:21 dtucker Exp $ */
+/* $OpenBSD: auth.c,v 1.103 2013/05/19 02:42:42 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -73,6 +73,7 @@
 #include "authfile.h"
 #include "monitor_wrap.h"
 #include "krl.h"
+#include "compat.h"
 
 /* import */
 extern ServerOptions options;
@@ -166,17 +167,17 @@ allowed_user(struct passwd * pw)
                 if (stat(shell, &st) != 0) {
                         logit("User %.100s not allowed because shell %.100s "
                             "does not exist", pw->pw_name, shell);
-                        xfree(shell);
+                        free(shell);
                         return 0;
                 }
                 if (S_ISREG(st.st_mode) == 0 ||
                     (st.st_mode & (S_IXOTH|S_IXUSR|S_IXGRP)) == 0) {
                         logit("User %.100s not allowed because shell %.100s "
                             "is not executable", pw->pw_name, shell);
-                        xfree(shell);
+                        free(shell);
                         return 0;
                 }
-                xfree(shell);
+                free(shell);
         }
 
         if (options.num_deny_users > 0 || options.num_allow_users > 0 ||
@@ -253,8 +254,25 @@ allowed_user(struct passwd * pw)
 }
 
 void
+auth_info(Authctxt *authctxt, const char *fmt, ...)
+{
+        va_list ap;
+        int i;
+
+        free(authctxt->info);
+        authctxt->info = NULL;
+
+        va_start(ap, fmt);
+        i = vasprintf(&authctxt->info, fmt, ap);
+        va_end(ap);
+
+        if (i < 0 || authctxt->info == NULL)
+                fatal("vasprintf failed");
+}
+
+void
 auth_log(Authctxt *authctxt, int authenticated, int partial,
-    const char *method, const char *submethod, const char *info)
+    const char *method, const char *submethod)
 {
         void (*authlog) (const char *fmt,...) = verbose;
         char *authmsg;
@@ -276,7 +294,7 @@ auth_log(Authctxt *authctxt, int authenticated, int partial,
         else
                 authmsg = authenticated ? "Accepted" : "Failed";
 
-        authlog("%s %s%s%s for %s%.100s from %.200s port %d%s",
+        authlog("%s %s%s%s for %s%.100s from %.200s port %d %s%s%s",
             authmsg,
             method,
             submethod != NULL ? "/" : "", submethod == NULL ? "" : submethod,
@@ -284,7 +302,11 @@ auth_log(Authctxt *authctxt, int authenticated, int partial,
             authctxt->user,
             get_remote_ipaddr(),
             get_remote_port(),
-            info);
+            compat20 ? "ssh2" : "ssh1",
+            authctxt->info != NULL ? ": " : "",
+            authctxt->info != NULL ? authctxt->info : "");
+        free(authctxt->info);
+        authctxt->info = NULL;
 
 #ifdef CUSTOM_FAILED_LOGIN
         if (authenticated == 0 && !authctxt->postponed &&
@@ -356,7 +378,7 @@ expand_authorized_keys(const char *filename, struct passwd *pw)
         i = snprintf(ret, sizeof(ret), "%s/%s", pw->pw_dir, file);
         if (i < 0 || (size_t)i >= sizeof(ret))
                 fatal("expand_authorized_keys: path too long");
-        xfree(file);
+        free(file);
         return (xstrdup(ret));
 }
 
@@ -397,7 +419,7 @@ check_key_in_hostfiles(struct passwd *pw, Key *key, const char *host,
                         load_hostkeys(hostkeys, host, user_hostfile);
                         restore_uid();
                 }
-                xfree(user_hostfile);
+                free(user_hostfile);
         }
         host_status = check_key_in_hostkeys(hostkeys, key, &found);
         if (host_status == HOST_REVOKED)
@@ -647,7 +669,7 @@ auth_key_is_revoked(Key *key, int hostkey)
                                 logit("Public key %s from %s blacklisted (see "
                                     "ssh-vulnkey(1)); continuing anyway",
                                     key_fp, get_remote_ipaddr());
-                        xfree(key_fp);
+                        free(key_fp);
                 } else {
                         if (hostkey)
                                 error("Host key %s blacklisted (see "
@@ -656,7 +678,7 @@ auth_key_is_revoked(Key *key, int hostkey)
                                 logit("Public key %s from %s blacklisted (see "
                                     "ssh-vulnkey(1))",
                                     key_fp, get_remote_ipaddr());
-                        xfree(key_fp);
+                        free(key_fp);
                         return 1;
                 }
         }
@@ -688,7 +710,7 @@ auth_key_is_revoked(Key *key, int hostkey)
                 key_fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
                 error("WARNING: authentication attempt with a revoked "
                     "%s key %s ", key_type(key), key_fp);
-                xfree(key_fp);
+                free(key_fp);
                 return 1;
         }
         fatal("key_in_file returned junk");
@@ -719,7 +741,7 @@ auth_debug_send(void)
         while (buffer_len(&auth_debug)) {
                 msg = buffer_get_string(&auth_debug, NULL);
                 packet_send_debug("%s", msg);
-                xfree(msg);
+                free(msg);
         }
 }
 
@@ -743,10 +765,12 @@ fakepw(void)
         fake.pw_name = "NOUSER";
         fake.pw_passwd =
             "$2a$06$r3.juUaHZDlIbQaO2dS9FuYxL1W9M81R1Tc92PoSNmzvpEqLkLGrK";
+#ifdef HAVE_STRUCT_PASSWD_PW_GECOS
         fake.pw_gecos = "NOUSER";
+#endif
         fake.pw_uid = privsep_pw == NULL ? (uid_t)-1 : privsep_pw->pw_uid;
         fake.pw_gid = privsep_pw == NULL ? (gid_t)-1 : privsep_pw->pw_gid;
-#ifdef HAVE_PW_CLASS_IN_PASSWD
+#ifdef HAVE_STRUCT_PASSWD_PW_CLASS
         fake.pw_class = "";
 #endif
         fake.pw_dir = "/nonexist";