- (djm) Merge OpenBSD changes:

   - markus@cvs.openbsd.org  2000/11/06 16:04:56
     [channels.c channels.h clientloop.c nchan.c serverloop.c]
     [session.c ssh.c]
     agent forwarding and -R for ssh2, based on work from
     jhuuskon@messi.uku.fi
   - markus@cvs.openbsd.org  2000/11/06 16:13:27
     [ssh.c sshconnect.c sshd.c]
     do not disabled rhosts(rsa) if server port > 1024; from
     pekkas@netcore.fi
   - markus@cvs.openbsd.org  2000/11/06 16:16:35
     [sshconnect.c]
     downgrade client to 1.3 if server is 1.4; help from mdb@juniper.net
   - markus@cvs.openbsd.org  2000/11/09 18:04:40
     [auth1.c]
     typo; from mouring@pconline.com
   - markus@cvs.openbsd.org  2000/11/12 12:03:28
     [ssh-agent.c]
     off-by-one when removing a key from the agent
   - markus@cvs.openbsd.org  2000/11/12 12:50:39
     [auth-rh-rsa.c auth2.c authfd.c authfd.h]
     [authfile.c hostfile.c kex.c kex.h key.c key.h myproposal.h]
     [readconf.c readconf.h rsa.c rsa.h servconf.c servconf.h ssh-add.c]
     [ssh-agent.c ssh-keygen.1 ssh-keygen.c ssh.1 ssh.c ssh_config]
     [sshconnect1.c sshconnect2.c sshd.8 sshd.c sshd_config ssh-dss.c]
     [ssh-dss.h ssh-rsa.c ssh-rsa.h dsa.c dsa.h]
     add support for RSA to SSH2.  please test.
     there are now 3 types of keys: RSA1 is used by ssh-1 only,
     RSA and DSA are used by SSH2.
     you can use 'ssh-keygen -t rsa -f ssh2_rsa_file' to generate RSA
     keys for SSH2 and use the RSA keys for hostkeys or for user keys.
     SSH2 RSA or DSA keys are added to .ssh/authorised_keys2 as before.
 - (djm) Fix up Makefile and Redhat init script to create RSA host keys
 - (djm) Change to interim version

1 files changed, 7 insertions, 5 deletions

diff --git a/sshconnect.c b/sshconnect.c
index d6072b36c..12ca69fd6 100644
--- a/sshconnect.c
+++ b/sshconnect.c
@@ -13,7 +13,7 @@
  */
 
 #include "includes.h"
-RCSID("$OpenBSD: sshconnect.c,v 1.79 2000/09/17 15:52:51 markus Exp $");
+RCSID("$OpenBSD: sshconnect.c,v 1.81 2000/11/06 23:16:35 markus Exp $");
 
 #include <openssl/bn.h>
 #include <openssl/dsa.h>
@@ -249,9 +249,9 @@ ssh_connect(const char *host, struct sockaddr_storage * hostaddr,
                         /* Create a socket for connecting. */
                         sock = ssh_create_socket(original_real_uid,
 #ifdef HAVE_CYGWIN
-                            !anonymous && port < IPPORT_RESERVED,
+                            !anonymous,
 #else
-                            !anonymous && geteuid() == 0 && port < IPPORT_RESERVED,
+                            !anonymous && geteuid() == 0,
 #endif
                             ai->ai_family);
                         if (sock < 0)
@@ -321,6 +321,7 @@ ssh_exchange_identification()
         int remote_major, remote_minor, i, mismatch;
         int connection_in = packet_get_connection_in();
         int connection_out = packet_get_connection_out();
+        int minor1 = PROTOCOL_MINOR_1; 
 
         /* Read other side\'s version identification. */
         for (;;) {
@@ -374,9 +375,10 @@ ssh_exchange_identification()
                 }
                 if (remote_minor < 3) {
                         fatal("Remote machine has too old SSH software version.");
-                } else if (remote_minor == 3) {
+                } else if (remote_minor == 3 || remote_minor == 4) {
                         /* We speak 1.3, too. */
                         enable_compat13();
+                        minor1 = 3;
                         if (options.forward_agent) {
                                 log("Agent forwarding disabled for protocol 1.3");
                                 options.forward_agent = 0;
@@ -402,7 +404,7 @@ ssh_exchange_identification()
         /* Send our own protocol version identification. */
         snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s\n",
             compat20 ? PROTOCOL_MAJOR_2 : PROTOCOL_MAJOR_1,
-            compat20 ? PROTOCOL_MINOR_2 : PROTOCOL_MINOR_1,
+            compat20 ? PROTOCOL_MINOR_2 : minor1,
             SSH_VERSION);
         if (atomicio(write, connection_out, buf, strlen(buf)) != strlen(buf))
                 fatal("write: %.100s", strerror(errno));