* New upstream release (closes: #395507, #397961, #420035). Important

  changes not previously backported to 4.3p2:
  - 4.4/4.4p1 (http://www.openssh.org/txt/release-4.4):
    + On portable OpenSSH, fix a GSSAPI authentication abort that could be
      used to determine the validity of usernames on some platforms.
    + Implemented conditional configuration in sshd_config(5) using the
      "Match" directive. This allows some configuration options to be
      selectively overridden if specific criteria (based on user, group,
      hostname and/or address) are met. So far a useful subset of
      post-authentication options are supported and more are expected to
      be added in future releases.
    + Add support for Diffie-Hellman group exchange key agreement with a
      final hash of SHA256.
    + Added a "ForceCommand" directive to sshd_config(5). Similar to the
      command="..." option accepted in ~/.ssh/authorized_keys, this forces
      the execution of the specified command regardless of what the user
      requested. This is very useful in conjunction with the new "Match"
      option.
    + Add a "PermitOpen" directive to sshd_config(5). This mirrors the
      permitopen="..." authorized_keys option, allowing fine-grained
      control over the port-forwardings that a user is allowed to
      establish.
    + Add optional logging of transactions to sftp-server(8).
    + ssh(1) will now record port numbers for hosts stored in
      ~/.ssh/known_hosts when a non-standard port has been requested
      (closes: #50612).
    + Add an "ExitOnForwardFailure" option to cause ssh(1) to exit (with a
      non-zero exit code) when requested port forwardings could not be
      established.
    + Extend sshd_config(5) "SubSystem" declarations to allow the
      specification of command-line arguments.
    + Replacement of all integer overflow susceptible invocations of
      malloc(3) and realloc(3) with overflow-checking equivalents.
    + Many manpage fixes and improvements.
    + Add optional support for OpenSSL hardware accelerators (engines),
      enabled using the --with-ssl-engine configure option.
    + Tokens in configuration files may be double-quoted in order to
      contain spaces (closes: #319639).
    + Move a debug() call out of a SIGCHLD handler, fixing a hang when the
      session exits very quickly (closes: #307890).
    + Fix some incorrect buffer allocation calculations (closes: #410599).
    + ssh-add doesn't ask for a passphrase if key file permissions are too
      liberal (closes: #103677).
    + Likewise, ssh doesn't ask either (closes: #99675).
  - 4.6/4.6p1 (http://www.openssh.org/txt/release-4.6):
    + sshd now allows the enabling and disabling of authentication methods
      on a per user, group, host and network basis via the Match directive
      in sshd_config.
    + Fixed an inconsistent check for a terminal when displaying scp
      progress meter (closes: #257524).
    + Fix "hang on exit" when background processes are running at the time
      of exit on a ttyful/login session (closes: #88337).
* Update to current GSSAPI patch from
  http://www.sxw.org.uk/computing/patches/openssh-4.6p1-gsskex-20070312.patch;
  install ChangeLog.gssapi.

1 files changed, 102 insertions, 45 deletions

diff --git a/ssh.c b/ssh.c
index a86d0e17b..c75decc1b 100644
--- a/ssh.c
+++ b/ssh.c
@@ -1,3 +1,4 @@
+/* $OpenBSD: ssh.c,v 1.295 2007/01/03 03:01:40 stevesk Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -40,20 +41,46 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: ssh.c,v 1.257 2005/12/20 04:41:07 dtucker Exp $");
+
+#include <sys/types.h>
+#ifdef HAVE_SYS_STAT_H
+# include <sys/stat.h>
+#endif
+#include <sys/resource.h>
+#include <sys/ioctl.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+
+#include <ctype.h>
+#include <errno.h>
+#include <fcntl.h>
+#include <netdb.h>
+#ifdef HAVE_PATHS_H
+#include <paths.h>
+#endif
+#include <pwd.h>
+#include <signal.h>
+#include <stdarg.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
 
 #include <openssl/evp.h>
 #include <openssl/err.h>
 
+#include "xmalloc.h"
 #include "ssh.h"
 #include "ssh1.h"
 #include "ssh2.h"
 #include "compat.h"
 #include "cipher.h"
-#include "xmalloc.h"
 #include "packet.h"
 #include "buffer.h"
-#include "bufaux.h"
 #include "channels.h"
 #include "key.h"
 #include "authfd.h"
@@ -72,6 +99,7 @@ RCSID("$OpenBSD: ssh.c,v 1.257 2005/12/20 04:41:07 dtucker Exp $");
 #include "msg.h"
 #include "monitor_fdpass.h"
 #include "uidswap.h"
+#include "version.h"
 
 #ifdef SMARTCARD
 #include "scard.h"
@@ -162,7 +190,7 @@ usage(void)
 "           [-i identity_file] [-L [bind_address:]port:host:hostport]\n"
 "           [-l login_name] [-m mac_spec] [-O ctl_cmd] [-o option] [-p port]\n"
 "           [-R [bind_address:]port:host:hostport] [-S ctl_path]\n"
-"           [-w tunnel:tunnel] [user@]hostname [command]\n"
+"           [-w local_tun[:remote_tun]] [user@]hostname [command]\n"
         );
         exit(255);
 }
@@ -242,7 +270,7 @@ main(int ac, char **av)
         /* Parse command-line arguments. */
         host = NULL;
 
-again:
+ again:
         while ((opt = getopt(ac, av,
             "1246ab:c:e:fgi:kl:m:no:p:qstvxACD:F:I:KL:MNO:PR:S:TVw:XY")) != -1) {
                 switch (opt) {
@@ -594,7 +622,7 @@ again:
                 if (!read_config_file(config, host, &options, 0))
                         fatal("Can't open user config file %.100s: "
                             "%.100s", config, strerror(errno));
-        } else  {
+        } else {
                 snprintf(buf, sizeof buf, "%.100s/%.100s", pw->pw_dir,
                     _PATH_SSH_USER_CONFFILE);
                 (void)read_config_file(buf, host, &options, 1);
@@ -624,7 +652,7 @@ again:
         if (options.host_key_alias != NULL) {
                 for (p = options.host_key_alias; *p; p++)
                         if (isupper(*p))
-                                *p = tolower(*p);
+                                *p = (char)tolower(*p);
         }
 
         /* Get default port if port has not been set. */
@@ -641,11 +669,15 @@ again:
                 options.control_path = NULL;
 
         if (options.control_path != NULL) {
+                char thishost[NI_MAXHOST];
+
+                if (gethostname(thishost, sizeof(thishost)) == -1)
+                        fatal("gethostname: %s", strerror(errno));
                 snprintf(buf, sizeof(buf), "%d", options.port);
                 cp = tilde_expand_filename(options.control_path,
                     original_real_uid);
                 options.control_path = percent_expand(cp, "p", buf, "h", host,
-                    "r", options.user, (char *)NULL);
+                    "r", options.user, "l", thishost, (char *)NULL);
                 xfree(cp);
         }
         if (mux_command != 0 && options.control_path == NULL)
@@ -678,16 +710,16 @@ again:
         if (options.rhosts_rsa_authentication ||
             options.hostbased_authentication) {
                 sensitive_data.nkeys = 3;
-                sensitive_data.keys = xmalloc(sensitive_data.nkeys *
+                sensitive_data.keys = xcalloc(sensitive_data.nkeys,
                     sizeof(Key));
 
                 PRIV_START;
                 sensitive_data.keys[0] = key_load_private_type(KEY_RSA1,
-                    _PATH_HOST_KEY_FILE, "", NULL);
+                    _PATH_HOST_KEY_FILE, "", NULL, NULL);
                 sensitive_data.keys[1] = key_load_private_type(KEY_DSA,
-                    _PATH_HOST_DSA_KEY_FILE, "", NULL);
+                    _PATH_HOST_DSA_KEY_FILE, "", NULL, NULL);
                 sensitive_data.keys[2] = key_load_private_type(KEY_RSA,
-                    _PATH_HOST_RSA_KEY_FILE, "", NULL);
+                    _PATH_HOST_RSA_KEY_FILE, "", NULL, NULL);
                 PRIV_END;
 
                 if (options.hostbased_authentication == 1 &&
@@ -803,6 +835,8 @@ ssh_init_forwarding(void)
                     options.local_forwards[i].connect_port,
                     options.gateway_ports);
         }
+        if (i > 0 && success != i && options.exit_on_forward_failure)
+                fatal("Could not request local forwarding.");
         if (i > 0 && success == 0)
                 error("Could not request local forwarding.");
 
@@ -815,11 +849,17 @@ ssh_init_forwarding(void)
                     options.remote_forwards[i].listen_port,
                     options.remote_forwards[i].connect_host,
                     options.remote_forwards[i].connect_port);
-                channel_request_remote_forwarding(
+                if (channel_request_remote_forwarding(
                     options.remote_forwards[i].listen_host,
                     options.remote_forwards[i].listen_port,
                     options.remote_forwards[i].connect_host,
-                    options.remote_forwards[i].connect_port);
+                    options.remote_forwards[i].connect_port) < 0) {
+                        if (options.exit_on_forward_failure)
+                                fatal("Could not request remote forwarding.");
+                        else
+                                logit("Warning: Could not request remote "
+                                    "forwarding.");
+                }
         }
 }
 
@@ -880,10 +920,10 @@ ssh_session(void)
                 /* Store window size in the packet. */
                 if (ioctl(fileno(stdin), TIOCGWINSZ, &ws) < 0)
                         memset(&ws, 0, sizeof(ws));
-                packet_put_int(ws.ws_row);
-                packet_put_int(ws.ws_col);
-                packet_put_int(ws.ws_xpixel);
-                packet_put_int(ws.ws_ypixel);
+                packet_put_int((u_int)ws.ws_row);
+                packet_put_int((u_int)ws.ws_col);
+                packet_put_int((u_int)ws.ws_xpixel);
+                packet_put_int((u_int)ws.ws_ypixel);
 
                 /* Store tty modes in the packet. */
                 tty_make_modes(fileno(stdin), NULL);
@@ -1001,9 +1041,16 @@ client_global_request_reply_fwd(int type, u_int32_t seq, void *ctxt)
             options.remote_forwards[i].listen_port,
             options.remote_forwards[i].connect_host,
             options.remote_forwards[i].connect_port);
-        if (type == SSH2_MSG_REQUEST_FAILURE)
-                logit("Warning: remote port forwarding failed for listen "
-                    "port %d", options.remote_forwards[i].listen_port);
+        if (type == SSH2_MSG_REQUEST_FAILURE) {
+                if (options.exit_on_forward_failure)
+                        fatal("Error: remote port forwarding failed for "
+                            "listen port %d",
+                            options.remote_forwards[i].listen_port);
+                else
+                        logit("Warning: remote port forwarding failed for "
+                            "listen port %d",
+                            options.remote_forwards[i].listen_port);
+        }
 }
 
 static void
@@ -1032,7 +1079,7 @@ ssh_control_listener(void)
                 fatal("%s socket(): %s", __func__, strerror(errno));
 
         old_umask = umask(0177);
-        if (bind(control_fd, (struct sockaddr*)&addr, addr_len) == -1) {
+        if (bind(control_fd, (struct sockaddr *)&addr, addr_len) == -1) {
                 control_fd = -1;
                 if (errno == EINVAL || errno == EADDRINUSE)
                         fatal("ControlSocket %s already exists",
@@ -1184,15 +1231,16 @@ ssh_session2(void)
 static void
 load_public_identity_files(void)
 {
-        char *filename;
+        char *filename, *cp, thishost[NI_MAXHOST];
         int i = 0;
         Key *public;
+        struct passwd *pw;
 #ifdef SMARTCARD
         Key **keys;
 
         if (options.smartcard_device != NULL &&
             options.num_identity_files < SSH_MAX_IDENTITY_FILES &&
-            (keys = sc_get_keys(options.smartcard_device, NULL)) != NULL ) {
+            (keys = sc_get_keys(options.smartcard_device, NULL)) != NULL) {
                 int count = 0;
                 for (i = 0; keys[i] != NULL; i++) {
                         count++;
@@ -1210,9 +1258,18 @@ load_public_identity_files(void)
                 xfree(keys);
         }
 #endif /* SMARTCARD */
+        if ((pw = getpwuid(original_real_uid)) == NULL)
+                fatal("load_public_identity_files: getpwuid failed");
+        if (gethostname(thishost, sizeof(thishost)) == -1)
+                fatal("load_public_identity_files: gethostname: %s",
+                    strerror(errno));
         for (; i < options.num_identity_files; i++) {
-                filename = tilde_expand_filename(options.identity_files[i],
+                cp = tilde_expand_filename(options.identity_files[i],
                     original_real_uid);
+                filename = percent_expand(cp, "d", pw->pw_dir,
+                    "u", pw->pw_name, "l", thishost, "h", host,
+                    "r", options.user, (char *)NULL);
+                xfree(cp);
                 public = key_load_public(filename, NULL);
                 debug("identity file %s type %d", filename,
                     public ? public->type : -1);
@@ -1238,14 +1295,14 @@ control_client_sigrelay(int signo)
 static int
 env_permitted(char *env)
 {
-        int i;
+        int i, ret;
         char name[1024], *cp;
 
-        strlcpy(name, env, sizeof(name));
-        if ((cp = strchr(name, '=')) == NULL)
+        if ((cp = strchr(env, '=')) == NULL || cp == env)
                 return (0);
-
-        *cp = '\0';
+        ret = snprintf(name, sizeof(name), "%.*s", (int)(cp - env), env);
+        if (ret <= 0 || (size_t)ret >= sizeof(name))
+                fatal("env_permitted: name '%.100s...' too long", env);
 
         for (i = 0; i < options.num_send_env; i++)
                 if (match_pattern(name, options.send_env[i]))
@@ -1290,29 +1347,29 @@ control_client(const char *path)
         if ((sock = socket(PF_UNIX, SOCK_STREAM, 0)) < 0)
                 fatal("%s socket(): %s", __func__, strerror(errno));
 
-        if (connect(sock, (struct sockaddr*)&addr, addr_len) == -1) {
+        if (connect(sock, (struct sockaddr *)&addr, addr_len) == -1) {
                 if (mux_command != SSHMUX_COMMAND_OPEN) {
                         fatal("Control socket connect(%.100s): %s", path,
                             strerror(errno));
                 }
                 if (errno == ENOENT)
-                        debug("Control socket \"%.100s\" does not exist", path);
+                        debug("Control socket \"%.100s\" does not exist", path);
                 else {
-                        error("Control socket connect(%.100s): %s", path,
+                        error("Control socket connect(%.100s): %s", path,
                             strerror(errno));
                 }
-                close(sock);
-                return;
-        }
-
-        if (stdin_null_flag) {
-                if ((fd = open(_PATH_DEVNULL, O_RDONLY)) == -1)
-                        fatal("open(/dev/null): %s", strerror(errno));
-                if (dup2(fd, STDIN_FILENO) == -1)
-                        fatal("dup2: %s", strerror(errno));
-                if (fd > STDERR_FILENO)
-                        close(fd);
-        }
+                close(sock);
+                return;
+        }
+
+        if (stdin_null_flag) {
+                if ((fd = open(_PATH_DEVNULL, O_RDONLY)) == -1)
+                        fatal("open(/dev/null): %s", strerror(errno));
+                if (dup2(fd, STDIN_FILENO) == -1)
+                        fatal("dup2: %s", strerror(errno));
+                if (fd > STDERR_FILENO)
+                        close(fd);
+        }
 
         term = getenv("TERM");