* New upstream release (closes: #453367).

  - CVE-2007-4752: Prevent ssh(1) from using a trusted X11 cookie if
    creation of an untrusted cookie fails; found and fixed by Jan Pechanec
    (closes: #444738).
  - sshd(8) in new installations defaults to SSH Protocol 2 only. Existing
    installations are unchanged.
  - The SSH channel window size has been increased, and both ssh(1)
    sshd(8) now send window updates more aggressively. These improves
    performance on high-BDP (Bandwidth Delay Product) networks.
  - ssh(1) and sshd(8) now preserve MAC contexts between packets, which
    saves 2 hash calls per packet and results in 12-16% speedup for
    arcfour256/hmac-md5.
  - A new MAC algorithm has been added, UMAC-64 (RFC4418) as
    "umac-64@openssh.com". UMAC-64 has been measured to be approximately
    20% faster than HMAC-MD5.
  - Failure to establish a ssh(1) TunnelForward is now treated as a fatal
    error when the ExitOnForwardFailure option is set.
  - ssh(1) returns a sensible exit status if the control master goes away
    without passing the full exit status.
  - When using a ProxyCommand in ssh(1), set the outgoing hostname with
    gethostname(2), allowing hostbased authentication to work.
  - Make scp(1) skip FIFOs rather than hanging (closes: #246774).
  - Encode non-printing characters in scp(1) filenames. These could cause
    copies to be aborted with a "protocol error".
  - Handle SIGINT in sshd(8) privilege separation child process to ensure
    that wtmp and lastlog records are correctly updated.
  - Report GSSAPI mechanism in errors, for libraries that support multiple
    mechanisms.
  - Improve documentation for ssh-add(1)'s -d option.
  - Rearrange and tidy GSSAPI code, removing server-only code being linked
    into the client.
  - Delay execution of ssh(1)'s LocalCommand until after all forwardings
    have been established.
  - In scp(1), do not truncate non-regular files.
  - Improve exit message from ControlMaster clients.
  - Prevent sftp-server(8) from reading until it runs out of buffer space,
    whereupon it would exit with a fatal error (closes: #365541).
  - pam_end() was not being called if authentication failed
    (closes: #405041).
  - Manual page datestamps updated (closes: #433181).

1 files changed, 71 insertions, 18 deletions

diff --git a/clientloop.c b/clientloop.c
index 766a4b3bf..aa8697900 100644
--- a/clientloop.c
+++ b/clientloop.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: clientloop.c,v 1.178 2007/02/20 10:25:14 djm Exp $ */
+/* $OpenBSD: clientloop.c,v 1.181 2007/08/15 08:14:46 markus Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -290,19 +290,29 @@ client_x11_get_proto(const char *display, const char *xauth_path,
                                         generated = 1;
                         }
                 }
-                snprintf(cmd, sizeof(cmd),
-                    "%s %s%s list %s 2>" _PATH_DEVNULL,
-                    xauth_path,
-                    generated ? "-f " : "" ,
-                    generated ? xauthfile : "",
-                    display);
-                debug2("x11_get_proto: %s", cmd);
-                f = popen(cmd, "r");
-                if (f && fgets(line, sizeof(line), f) &&
-                    sscanf(line, "%*s %511s %511s", proto, data) == 2)
-                        got_data = 1;
-                if (f)
-                        pclose(f);
+
+                /*
+                 * When in untrusted mode, we read the cookie only if it was
+                 * successfully generated as an untrusted one in the step
+                 * above.
+                 */
+                if (trusted || generated) {
+                        snprintf(cmd, sizeof(cmd),
+                            "%s %s%s list %s 2>" _PATH_DEVNULL,
+                            xauth_path,
+                            generated ? "-f " : "" ,
+                            generated ? xauthfile : "",
+                            display);
+                        debug2("x11_get_proto: %s", cmd);
+                        f = popen(cmd, "r");
+                        if (f && fgets(line, sizeof(line), f) &&
+                            sscanf(line, "%*s %511s %511s", proto, data) == 2)
+                                got_data = 1;
+                        if (f)
+                                pclose(f);
+                } else
+                        error("Warning: untrusted X11 forwarding setup failed: "
+                            "xauth key data not generated");
         }
 
         if (do_unlink) {
@@ -940,7 +950,7 @@ process_cmdline(void)
         cmd = s = read_passphrase("\r\nssh> ", RP_ECHO);
         if (s == NULL)
                 goto out;
-        while (*s && isspace(*s))
+        while (isspace(*s))
                 s++;
         if (*s == '-')
                 s++;    /* Skip cmdline '-', if any */
@@ -987,9 +997,8 @@ process_cmdline(void)
                 goto out;
         }
 
-        s++;
-        while (*s && isspace(*s))
-                s++;
+        while (isspace(*++s))
+                ;
 
         if (delete) {
                 cancel_port = 0;
@@ -1781,6 +1790,50 @@ client_request_agent(const char *request_type, int rchan)
         return c;
 }
 
+int
+client_request_tun_fwd(int tun_mode, int local_tun, int remote_tun)
+{
+        Channel *c;
+        int fd;
+
+        if (tun_mode == SSH_TUNMODE_NO)
+                return 0;
+
+        if (!compat20) {
+                error("Tunnel forwarding is not support for protocol 1");
+                return -1;
+        }
+
+        debug("Requesting tun unit %d in mode %d", local_tun, tun_mode);
+
+        /* Open local tunnel device */
+        if ((fd = tun_open(local_tun, tun_mode)) == -1) {
+                error("Tunnel device open failed.");
+                return -1;
+        }
+
+        c = channel_new("tun", SSH_CHANNEL_OPENING, fd, fd, -1,
+            CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0, "tun", 1);
+        c->datagram = 1;
+
+#if defined(SSH_TUN_FILTER)
+        if (options.tun_open == SSH_TUNMODE_POINTOPOINT)
+                channel_register_filter(c->self, sys_tun_infilter,
+                    sys_tun_outfilter);
+#endif
+
+        packet_start(SSH2_MSG_CHANNEL_OPEN);
+        packet_put_cstring("tun@openssh.com");
+        packet_put_int(c->self);
+        packet_put_int(c->local_window_max);
+        packet_put_int(c->local_maxpacket);
+        packet_put_int(tun_mode);
+        packet_put_int(remote_tun);
+        packet_send();
+
+        return 0;
+}
+
 /* XXXX move to generic input handler */
 static void
 client_input_channel_open(int type, u_int32_t seq, void *ctxt)