Merge tag '0.77' into ranvis2

Buildscr

@@ -35,7 +35,7 @@ module putty
 ifeq "$(RELEASE)" "" set Ndate $(!builddate)
 ifneq "$(Ndate)" "" in . do echo $(Ndate) | perl -pe 's/(....)(..)(..)/$$1-$$2-$$3/' > date
 ifneq "$(Ndate)" "" read Date date
-set Epoch 17818 # update this at every release
+set Epoch 18136 # update this at every release
 ifneq "$(Ndate)" "" in . do echo $(Ndate) | perl -ne 'use Time::Local; /(....)(..)(..)/ and print timegm(0,0,0,$$3,$$2-1,$$1) / 86400 - $(Epoch)' > days
 ifneq "$(Ndate)" "" read Days days
 

CMakeLists.txt

@@ -82,6 +82,11 @@ add_executable(test_host_strfoo
 target_compile_definitions(test_host_strfoo PRIVATE TEST)
 target_link_libraries(test_host_strfoo utils ${platform_libraries})
 
+add_executable(test_decode_utf8
+  utils/decode_utf8.c)
+target_compile_definitions(test_decode_utf8 PRIVATE TEST)
+target_link_libraries(test_decode_utf8 utils ${platform_libraries})
+
 add_executable(test_tree234
   utils/tree234.c)
 target_compile_definitions(test_tree234 PRIVATE TEST)

LATEST.VER

@@ -1 +1 @@
-0.76
+0.77

README

@@ -8,6 +8,20 @@ the source directory:
   cmake .
   cmake --build .
 
+Then, to install in the simplest way on Linux or Mac:
+
+  cmake --build . --target install
+
+On Unix, pterm would like to be setuid or setgid, as appropriate, to
+permit it to write records of user logins to /var/run/utmp and
+/var/log/wtmp. (Of course it will not use this privilege for
+anything else, and in particular it will drop all privileges before
+starting up complex subsystems like GTK.) The cmake install step
+doesn't attempt to add these privileges, so if you want user login
+recording to work, you should manually ch{own,grp} and chmod the
+pterm binary yourself after installation. If you don't do this,
+pterm will still work, but not update the user login databases.
+
 Documentation (in various formats including Windows Help and Unix
 `man' pages) is built from the Halibut (`.but') files in the `doc'
 subdirectory using `doc/Makefile'. If you aren't using one of our

cmake/cmake.h.in

@@ -13,8 +13,10 @@
 #cmakedefine01 HAVE_GETNAMEDPIPECLIENTPROCESSID
 #cmakedefine01 HAVE_SETDEFAULTDLLDIRECTORIES
 #cmakedefine01 HAVE_STRTOUMAX
+#cmakedefine01 HAVE_DWMAPI_H
 
 #cmakedefine NOT_X_WINDOWS
+#cmakedefine OMIT_UTMP
 
 #cmakedefine01 HAVE_ASM_HWCAP_H
 #cmakedefine01 HAVE_SYS_AUXV_H
@@ -27,6 +29,7 @@
 #cmakedefine01 HAVE_POSIX_OPENPT
 #cmakedefine01 HAVE_PTSNAME
 #cmakedefine01 HAVE_SETRESUID
+#cmakedefine01 HAVE_SETRESGID
 #cmakedefine01 HAVE_STRSIGNAL
 #cmakedefine01 HAVE_UPDWTMPX
 #cmakedefine01 HAVE_FSTATAT

cmake/platforms/unix.cmake

@@ -19,6 +19,7 @@ check_include_file(sys/sysctl.h HAVE_SYS_SYSCTL_H)
 check_include_file(sys/types.h HAVE_SYS_TYPES_H)
 check_include_file(glob.h HAVE_GLOB_H)
 check_include_file(utmp.h HAVE_UTMP_H)
+check_include_file(utmpx.h HAVE_UTMPX_H)
 
 check_symbol_exists(futimes "sys/time.h" HAVE_FUTIMES)
 check_symbol_exists(getaddrinfo "sys/types.h;sys/socket.h;netdb.h"
@@ -56,6 +57,12 @@ else()
   set(NO_IPV6 ON)
 endif()
 
+if(HAVE_UTMPX_H)
+  set(OMIT_UTMP OFF)
+else()
+  set(OMIT_UTMP ON)
+endif()
+
 include(cmake/gtk.cmake)
 
 # See if we have X11 available. This requires libX11 itself, and also

cmake/platforms/windows.cmake

@@ -55,6 +55,21 @@ GCP_RESULTSW gcpw;
 int main(void) { return 0; }
 " HAVE_GCP_RESULTSW)
 
+function(dwmapi_test_wrapper)
+  set(CMAKE_REQUIRED_LIBRARIES ${CMAKE_REQUIRED_LIBRARIES} dwmapi.lib)
+  check_c_source_compiles("
+#include <windows.h>
+#include <dwmapi.h>
+volatile HWND hwnd;
+int main(void) {
+  RECT r;
+  DwmGetWindowAttribute(hwnd, DWMWA_EXTENDED_FRAME_BOUNDS, &r, sizeof(r));
+}
+" HAVE_DWMAPI_H)
+  set(HAVE_DWMAPI_H ${HAVE_DWMAPI_H} PARENT_SCOPE)
+endfunction()
+dwmapi_test_wrapper()
+
 set(NO_SECURITY ${PUTTY_NO_SECURITY})
 
 add_compile_definitions(

cmake/setup.cmake

@@ -4,6 +4,8 @@
 # give a #error if this manoeuvre doesn't do what it needs to.
 string(REPLACE "/DNDEBUG" "" CMAKE_C_FLAGS_RELEASE "${CMAKE_C_FLAGS_RELEASE}")
 string(REPLACE "-DNDEBUG" "" CMAKE_C_FLAGS_RELEASE "${CMAKE_C_FLAGS_RELEASE}")
+string(REPLACE "/DNDEBUG" "" CMAKE_C_FLAGS_RELWITHDEBINFO "${CMAKE_C_FLAGS_RELWITHDEBINFO}")
+string(REPLACE "-DNDEBUG" "" CMAKE_C_FLAGS_RELWITHDEBINFO "${CMAKE_C_FLAGS_RELWITHDEBINFO}")
 
 set(PUTTY_IPV6 ON
   CACHE BOOL "Build PuTTY with IPv6 support if possible")

cmdline.c

@@ -81,10 +81,9 @@ void cmdline_cleanup(void)
  * -1 return means that we aren't capable of processing the prompt and
  * someone else should do it.
  */
-SeatPromptResult cmdline_get_passwd_input(prompts_t *p)
+SeatPromptResult cmdline_get_passwd_input(
+    prompts_t *p, cmdline_get_passwd_input_state *state, bool restartable)
 {
-    static bool tried_once = false;
-
     /*
      * We only handle prompts which don't echo (which we assume to be
      * passwords), and (currently) we only cope with a password prompt
@@ -98,23 +97,32 @@ SeatPromptResult cmdline_get_passwd_input(prompts_t *p)
      * If we've tried once, return utter failure (no more passwords left
      * to try).
      */
-    if (tried_once)
+    if (state->tried)
         return SPR_SW_ABORT("Configured password was not accepted");
 
     /*
      * If we never had a password available in the first place, we
      * can't do anything in any case. (But we delay this test until
-     * after tried_once, so that after we free cmdline_password below,
-     * we'll still remember that we _used_ to have one.)
+     * after trying once, so that even if we free cmdline_password
+     * below, we'll still remember that we _used_ to have one.)
      */
     if (!cmdline_password)
         return SPR_INCOMPLETE;
 
     prompt_set_result(p->prompts[0], cmdline_password);
-    smemclr(cmdline_password, strlen(cmdline_password));
-    sfree(cmdline_password);
-    cmdline_password = NULL;
-    tried_once = true;
+    state->tried = true;
+
+    if (!restartable) {
+        /*
+         * If there's no possibility of needing to do this again after
+         * a 'Restart Session' event, then wipe our copy of the
+         * password out of memory.
+         */
+        smemclr(cmdline_password, strlen(cmdline_password));
+        sfree(cmdline_password);
+        cmdline_password = NULL;
+    }
+
     return SPR_OK;
 }
 
@@ -585,6 +593,11 @@ int cmdline_process_param(const char *p, char *value,
             cmdline_error("the -pw option can only be used with the "
                           "SSH protocol");
         else {
+            if (cmdline_password) {
+                smemclr(cmdline_password, strlen(cmdline_password));
+                sfree(cmdline_password);
+            }
+
             cmdline_password = dupstr(value);
             /* Assuming that `value' is directly from argv, make a good faith
              * attempt to trample it, to stop it showing up in `ps' output
@@ -608,6 +621,11 @@ int cmdline_process_param(const char *p, char *value,
             if (!fp) {
                 cmdline_error("unable to open password file '%s'", value);
             } else {
+                if (cmdline_password) {
+                    smemclr(cmdline_password, strlen(cmdline_password));
+                    sfree(cmdline_password);
+                }
+
                 cmdline_password = chomp(fgetline(fp));
                 if (!cmdline_password) {
                     cmdline_error("unable to read a password from file '%s'",
@@ -731,11 +749,13 @@ int cmdline_process_param(const char *p, char *value,
 
     if (!strcmp(p, "-4") || !strcmp(p, "-ipv4")) {
         RETURN(1);
+        UNAVAILABLE_IN(TOOLTYPE_NONNETWORK);
         SAVEABLE(1);
         conf_set_int(conf, CONF_addressfamily, ADDRTYPE_IPV4);
     }
     if (!strcmp(p, "-6") || !strcmp(p, "-ipv6")) {
         RETURN(1);
+        UNAVAILABLE_IN(TOOLTYPE_NONNETWORK);
         SAVEABLE(1);
         conf_set_int(conf, CONF_addressfamily, ADDRTYPE_IPV6);
     }

defs.h

@@ -42,6 +42,8 @@
 #define SIZEx "Ix"
 #define SIZEu "Iu"
 uintmax_t strtoumax(const char *nptr, char **endptr, int base);
+/* Also, define a LEGACY_WINDOWS flag to enable other workarounds */
+#define LEGACY_WINDOWS
 #else
 #include <inttypes.h>
 /* Because we still support older MSVC libraries which don't recognise the
@@ -116,6 +118,8 @@ typedef struct Seat Seat;
 typedef struct SeatVtable SeatVtable;
 typedef struct SeatPromptResult SeatPromptResult;
 
+typedef struct cmdline_get_passwd_input_state cmdline_get_passwd_input_state;
+
 typedef struct TermWin TermWin;
 typedef struct TermWinVtable TermWinVtable;
 
@@ -192,6 +196,8 @@ typedef struct logblank_t logblank_t;
 typedef struct BinaryPacketProtocol BinaryPacketProtocol;
 typedef struct PacketProtocolLayer PacketProtocolLayer;
 
+struct unicode_data;
+
 /* Do a compile-time type-check of 'to_check' (without evaluating it),
  * as a side effect of returning the value 'to_return'. Note that
  * although this macro double-*expands* to_return, it always

doc/config.but

@@ -1956,10 +1956,11 @@ in \W{http://www.ietf.org/rfc/rfc2817.txt}{RFC 2817}.
 connections through a \i{SOCKS server}.
 
 \b Many firewalls implement a less formal type of proxy in which a
-user can make a Telnet connection directly to the firewall machine
+user can make a Telnet or TCP connection directly to the firewall machine
 and enter a command such as \c{connect myhost.com 22} to connect
 through to an external host. Selecting \I{Telnet proxy}\q{Telnet}
-allows you to tell PuTTY to use this type of proxy.
+allows you to tell PuTTY to use this type of proxy, with the precise           
+command specified as described in \k{config-proxy-command}.
 
 \b Selecting \q{SSH} causes PuTTY to make a secondary SSH connection
 to the proxy host (sometimes called a \q{\i{jump host}} in this
@@ -2057,15 +2058,30 @@ is a protocol extension (SOCKS 4A) which does support it, but not
 all SOCKS 4 servers provide this extension. If you enable proxy DNS
 and your SOCKS 4 server cannot deal with it, this might be why.
 
+If you want to avoid PuTTY making \e{any} DNS query related to your
+destination host name (for example, because your local DNS resolver is
+very slow to return a negative response in that situation), then as
+well as setting this control to \q{Yes}, you may also need to turn off
+GSSAPI authentication and GSSAPI key exchange in SSH (see
+\k{config-ssh-auth-gssapi} and \k{config-ssh-gssapi-kex}
+respectively). This is because GSSAPI setup also involves a DNS query
+for the destination host name, and that query is performed by the
+separate GSSAPI library, so PuTTY can't override or reconfigure it.
+
 \S{config-proxy-auth} \I{proxy username}Username and \I{proxy password}password
 
-If your proxy requires \I{proxy authentication}authentication, you can
-enter a username and a password in the \q{Username} and \q{Password} boxes.
+You can enter a username and a password in the \q{Username} and
+\q{Password} boxes, which will be used if your proxy requires
+\I{proxy authentication}authentication.
 
 \I{security hazard}Note that if you save your session, the proxy
 password will be saved in plain text, so anyone who can access your PuTTY
 configuration data will be able to discover it.
 
+If PuTTY discovers that it needs a proxy username or password and you
+have not specified one here, PuTTY will prompt for it interactively in
+the terminal window.
+
 Authentication is not fully supported for all forms of proxy:
 
 \b Username and password authentication is supported for HTTP
@@ -2089,22 +2105,16 @@ passwords.
 
 \b SSH proxying can use all the same forms of SSH authentication
 supported by PuTTY for its main connection. If the SSH server requests
-password authentication, the configured proxy password will be used,
-but other authentication methods such as public keys will be tried
-first, just as for a primary SSH connection.
+password authentication, any configured proxy password will be used,
+but other authentication methods such as public keys and GSSAPI will
+be tried first, just as for a primary SSH connection, and if they
+require credentials such as a key passphrase, PuTTY will interactively
+prompt for these.
 
 \b You can specify a way to include a username and password in the
-Telnet/Local proxy command (see \k{config-proxy-command}).
-
-If PuTTY discovers that it needs a proxy username or password and you
-have not specified one in the configuration, it will prompt for it
-interactively in the terminal.
-
-(For SSH proxying, this will also happen in the case of other
-interactive SSH login prompts, such as SSH key passphrases or GSSAPI.
-For the Telnet and Local proxy types, PuTTY will prompt for a username
-or password if you included \c{%user} or \c{%pass} in the command
-string and did not provide a corresponding configuration entry.)
+Telnet/Local proxy command (see \k{config-proxy-command}). If you do
+so, and don't also specify the actual username and/or password in the
+configuration, PuTTY will interactively prompt for them.
 
 \S{config-proxy-command} Specifying the Telnet or Local proxy command
 
@@ -2125,7 +2135,8 @@ itself.
 Also, the special strings \c{%host} and \c{%port} will be replaced
 by the host name and port number you want to connect to. The strings
 \c{%user} and \c{%pass} will be replaced by the proxy username and
-password you specify. The strings \c{%proxyhost} and \c{%proxyport}
+password (which, if not specified in the configuration, will be
+prompted for). The strings \c{%proxyhost} and \c{%proxyport}
 will be replaced by the host details specified on the \e{Proxy} panel,
 if any (this is most likely to be useful for the Local proxy type).
 To get a literal \c{%} sign, enter \c{%%}.
@@ -2138,8 +2149,8 @@ before commands can be sent, you can use a command such as:
 This will send your username and password as the first two lines to
 the proxy, followed by a command to connect to the desired host and
 port. Note that if you do not include the \c{%user} or \c{%pass}
-tokens in the Telnet command, then the \q{Username} and \q{Password}
-configuration fields will be ignored.
+tokens in the Telnet command, then anything specified in \q{Username}
+and \q{Password} configuration fields will be ignored.
 
 \S{config-proxy-logging} Controlling \i{proxy logging}
 

doc/index.but

@@ -867,6 +867,11 @@ saved sessions from
 \IM{authentication agent} agent, authentication
 
 \IM{-c-pageant} \c{-c} Pageant command-line option
+\IM{--keylist} \c{--keylist} Pageant command-line option
+\IM{--openssh-config} \c{--openssh-config} Pageant command-line option
+
+\IM{Windows OpenSSH} Windows OpenSSH
+\IM{Windows OpenSSH} OpenSSH, on Windows
 
 \IM{FAQ} FAQ
 \IM{FAQ} Frequently Asked Questions