3 files changed, 13 insertions, 3 deletions

diff --git a/ChangeLog b/ChangeLog
index 25fe5918f..62f026e2e 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -8,6 +8,12 @@
    [regress/README.regress] Remove ssh-rand-helper and all its
    tentacles. PRNGd seeding has been rolled into entropy.c directly.
    Thanks to tim@ for testing on affected platforms.
+ - OpenBSD CVS Sync
+   - djm@cvs.openbsd.org 2011/03/10 02:52:57
+     [auth2-gss.c auth2.c]
+     allow GSSAPI authentication to detect when a server-side failure causes
+     authentication failure and don't count such failures against MaxAuthTries;
+     bz#1244 from simon AT sxw.org.uk; ok markus@ before lock
 
 20110221
  - (dtucker) [contrib/cygwin/ssh-host-config] From Corinna: revamp of the
diff --git a/auth2-gss.c b/auth2-gss.c
index 0e08d889c..0d59b2177 100644
--- a/auth2-gss.c
+++ b/auth2-gss.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2-gss.c,v 1.16 2007/10/29 00:52:45 dtucker Exp $ */
+/* $OpenBSD: auth2-gss.c,v 1.17 2011/03/10 02:52:57 djm Exp $ */
 
 /*
  * Copyright (c) 2001-2003 Simon Wilkinson. All rights reserved.
@@ -102,6 +102,7 @@ userauth_gssapi(Authctxt *authctxt)
 
         if (!present) {
                 xfree(doid);
+                authctxt->server_caused_failure = 1;
                 return (0);
         }
 
@@ -109,6 +110,7 @@ userauth_gssapi(Authctxt *authctxt)
                 if (ctxt != NULL)
                         ssh_gssapi_delete_ctx(&ctxt);
                 xfree(doid);
+                authctxt->server_caused_failure = 1;
                 return (0);
         }
 
diff --git a/auth2.c b/auth2.c
index 95820f96f..c06c95f06 100644
--- a/auth2.c
+++ b/auth2.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: auth2.c,v 1.122 2010/08/31 09:58:37 djm Exp $ */
+/* $OpenBSD: auth2.c,v 1.123 2011/03/10 02:52:57 djm Exp $ */
 /*
  * Copyright (c) 2000 Markus Friedl.  All rights reserved.
  *
@@ -274,6 +274,7 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
 #endif
 
         authctxt->postponed = 0;
+        authctxt->server_caused_failure = 0;
 
         /* try to authenticate user */
         m = authmethod_lookup(method);
@@ -346,7 +347,8 @@ userauth_finish(Authctxt *authctxt, int authenticated, char *method)
         } else {
 
                 /* Allow initial try of "none" auth without failure penalty */
-                if (authctxt->attempt > 1 || strcmp(method, "none") != 0)
+                if (!authctxt->server_caused_failure &&
+                    (authctxt->attempt > 1 || strcmp(method, "none") != 0))
                         authctxt->failures++;
                 if (authctxt->failures >= options.max_authtries) {
 #ifdef SSH_AUDIT_EVENTS