import openssh-5.1p1-gsskex-cjwatson-20080722.patch

1 files changed, 23 insertions, 10 deletions

diff --git a/monitor.c b/monitor.c
index d512d0b36..ef46938c4 100644
--- a/monitor.c
+++ b/monitor.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: monitor.c,v 1.91 2007/05/17 20:52:13 djm Exp $ */
+/* $OpenBSD: monitor.c,v 1.99 2008/07/10 18:08:11 markus Exp $ */
 /*
  * Copyright 2002 Niels Provos <provos@citi.umich.edu>
  * Copyright 2002 Markus Friedl <markus@openbsd.org>
@@ -51,6 +51,7 @@
 
 #include <openssl/dh.h>
 
+#include "openbsd-compat/sys-queue.h"
 #include "xmalloc.h"
 #include "ssh.h"
 #include "key.h"
@@ -658,11 +659,11 @@ mm_answer_pwnamallow(int sock, Buffer *m)
 #endif
         buffer_put_cstring(m, pwent->pw_dir);
         buffer_put_cstring(m, pwent->pw_shell);
+
+ out:
         buffer_put_string(m, &options, sizeof(options));
         if (options.banner != NULL)
                 buffer_put_cstring(m, options.banner);
-
- out:
         debug3("%s: sending MONITOR_ANS_PWNAM: %d", __func__, allowed);
         mm_request_send(sock, MONITOR_ANS_PWNAM, m);
 
@@ -1029,6 +1030,8 @@ mm_answer_keyallowed(int sock, Buffer *m)
                         allowed = options.pubkey_authentication &&
                             user_key_allowed(authctxt->pw, key);
                         auth_method = "publickey";
+                        if (options.pubkey_authentication && allowed != 1)
+                                auth_clear_options();
                         break;
                 case MM_HOSTKEY:
                         allowed = options.hostbased_authentication &&
@@ -1041,6 +1044,8 @@ mm_answer_keyallowed(int sock, Buffer *m)
                         allowed = options.rhosts_rsa_authentication &&
                             auth_rhosts_rsa_key_allowed(authctxt->pw,
                             cuser, chost, key);
+                        if (options.rhosts_rsa_authentication && allowed != 1)
+                                auth_clear_options();
                         auth_method = "rsa";
                         break;
                 default:
@@ -1070,7 +1075,7 @@ mm_answer_keyallowed(int sock, Buffer *m)
         }
 
         debug3("%s: key %p is %s",
-            __func__, key, allowed ? "allowed" : "disallowed");
+            __func__, key, allowed ? "allowed" : "not allowed");
 
         buffer_clear(m);
         buffer_put_int(m, allowed);
@@ -1287,7 +1292,7 @@ mm_session_close(Session *s)
                 debug3("%s: tty %s ptyfd %d", __func__, s->tty, s->ptyfd);
                 session_pty_cleanup2(s);
         }
-        s->used = 0;
+        session_unused(s->self);
 }
 
 int
@@ -1329,8 +1334,9 @@ mm_answer_pty(int sock, Buffer *m)
 
         mm_request_send(sock, MONITOR_ANS_PTY, m);
 
-        mm_send_fd(sock, s->ptyfd);
-        mm_send_fd(sock, s->ttyfd);
+        if (mm_send_fd(sock, s->ptyfd) == -1 ||
+            mm_send_fd(sock, s->ttyfd) == -1)
+                fatal("%s: send fds failed", __func__);
 
         /* make sure nothing uses fd 0 */
         if ((fd0 = open(_PATH_DEVNULL, O_RDONLY)) < 0)
@@ -1561,6 +1567,11 @@ mm_answer_term(int sock, Buffer *req)
         /* The child is terminating */
         session_destroy_all(&mm_session_close);
 
+#ifdef USE_PAM
+        if (options.use_pam)
+                sshpam_cleanup();
+#endif
+
         while (waitpid(pmonitor->m_pid, &status, 0) == -1)
                 if (errno != EINTR)
                         exit(1);
@@ -1714,7 +1725,7 @@ mm_get_keystate(struct monitor *pmonitor)
         u_char *blob, *p;
         u_int bloblen, plen;
         u_int32_t seqnr, packets;
-        u_int64_t blocks;
+        u_int64_t blocks, bytes;
 
         debug3("%s: Waiting for new keys", __func__);
 
@@ -1747,11 +1758,13 @@ mm_get_keystate(struct monitor *pmonitor)
         seqnr = buffer_get_int(&m);
         blocks = buffer_get_int64(&m);
         packets = buffer_get_int(&m);
-        packet_set_state(MODE_OUT, seqnr, blocks, packets);
+        bytes = buffer_get_int64(&m);
+        packet_set_state(MODE_OUT, seqnr, blocks, packets, bytes);
         seqnr = buffer_get_int(&m);
         blocks = buffer_get_int64(&m);
         packets = buffer_get_int(&m);
-        packet_set_state(MODE_IN, seqnr, blocks, packets);
+        bytes = buffer_get_int64(&m);
+        packet_set_state(MODE_IN, seqnr, blocks, packets, bytes);
 
  skip:
         /* Get the key context */