===================================================================
RCS file: /cvsrepo/anoncvs/cvs/src/usr.bin/ssh/ssh-agent.c,v
retrieving revision 1.85.2.3
retrieving revision 1.86
diff -u -r1.85.2.3 -r1.86
--- src/usr.bin/ssh/ssh-agent.c	2003/04/03 22:35:17	1.85.2.3
+++ src/usr.bin/ssh/ssh-agent.c	2002/06/05 16:08:07	1.86
@@ -35,7 +35,7 @@
 
 #include "includes.h"
 #include <sys/queue.h>
-RCSID("$OpenBSD: ssh-agent.c,v 1.85.2.3 2003/04/03 22:35:17 miod Exp $");
+RCSID("$OpenBSD: ssh-agent.c,v 1.86 2002/06/05 16:08:07 markus Exp $");
 
 #include <openssl/evp.h>
 #include <openssl/md5.h>
@@ -50,8 +50,6 @@
 #include "authfd.h"
 #include "compat.h"
 #include "log.h"
-#include "readpass.h"
-#include "misc.h"
 
 #ifdef SMARTCARD
 #include "scard.h"
@@ -68,7 +66,6 @@
 	sock_type type;
 	Buffer input;
 	Buffer output;
-	Buffer request;
 } SocketEntry;
 
 u_int sockets_alloc = 0;
@@ -78,8 +75,6 @@
 	TAILQ_ENTRY(identity) next;
 	Key *key;
 	char *comment;
-	u_int death;
-	u_int confirm;
 } Identity;
 
 typedef struct {
@@ -99,31 +94,12 @@
 char socket_name[1024];
 char socket_dir[1024];
 
-/* locking */
-int locked = 0;
-char *lock_passwd = NULL;
-
 extern char *__progname;
 
-/* Default lifetime (0 == forever) */
-static int lifetime = 0;
-
 static void
-close_socket(SocketEntry *e)
-{
-	close(e->fd);
-	e->fd = -1;
-	e->type = AUTH_UNUSED;
-	buffer_free(&e->input);
-	buffer_free(&e->output);
-	buffer_free(&e->request);
-}
-
-static void
 idtab_init(void)
 {
 	int i;
-
 	for (i = 0; i <=2; i++) {
 		TAILQ_INIT(&idtable[i].idlist);
 		idtable[i].nentries = 0;
@@ -139,14 +115,6 @@
 	return &idtable[version];
 }
 
-static void
-free_identity(Identity *id)
-{
-	key_free(id->key);
-	xfree(id->comment);
-	xfree(id);
-}
-
 /* return matching private key for given public key */
 static Identity *
 lookup_identity(Key *key, int version)
@@ -161,28 +129,12 @@
 	return (NULL);
 }
 
-/* Check confirmation of keysign request */
-static int
-confirm_key(Identity *id)
+static void
+free_identity(Identity *id)
 {
-	char *p, prompt[1024];
-	int ret = -1;
-
-	p = key_fingerprint(id->key, SSH_FP_MD5, SSH_FP_HEX);
-	snprintf(prompt, sizeof(prompt), "Allow use of key %s?\n"
-	    "Key fingerprint %s.", id->comment, p);
-	xfree(p);
-	p = read_passphrase(prompt, RP_ALLOW_EOF);
-	if (p != NULL) {
-		/*
-		 * Accept empty responses and responses consisting 
-		 * of the word "yes" as affirmative.
-		 */
-		if (*p == '\0' || *p == '\n' || strcasecmp(p, "yes") == 0)
-			ret = 0;
-		xfree(p);
-	}
-	return (ret);
+	key_free(id->key);
+	xfree(id->comment);
+	xfree(id);
 }
 
 /* send list of supported public keys to 'client' */
@@ -190,8 +142,8 @@
 process_request_identities(SocketEntry *e, int version)
 {
 	Idtab *tab = idtab_lookup(version);
-	Identity *id;
 	Buffer msg;
+	Identity *id;
 
 	buffer_init(&msg);
 	buffer_put_char(&msg, (version == 1) ?
@@ -220,35 +172,35 @@
 static void
 process_authentication_challenge1(SocketEntry *e)
 {
-	u_char buf[32], mdbuf[16], session_id[16];
-	u_int response_type;
-	BIGNUM *challenge;
 	Identity *id;
+	Key *key;
+	BIGNUM *challenge;
 	int i, len;
 	Buffer msg;
 	MD5_CTX md;
-	Key *key;
+	u_char buf[32], mdbuf[16], session_id[16];
+	u_int response_type;
 
 	buffer_init(&msg);
 	key = key_new(KEY_RSA1);
 	if ((challenge = BN_new()) == NULL)
 		fatal("process_authentication_challenge1: BN_new failed");
 
-	(void) buffer_get_int(&e->request);			/* ignored */
-	buffer_get_bignum(&e->request, key->rsa->e);
-	buffer_get_bignum(&e->request, key->rsa->n);
-	buffer_get_bignum(&e->request, challenge);
+	buffer_get_int(&e->input);				/* ignored */
+	buffer_get_bignum(&e->input, key->rsa->e);
+	buffer_get_bignum(&e->input, key->rsa->n);
+	buffer_get_bignum(&e->input, challenge);
 
 	/* Only protocol 1.1 is supported */
-	if (buffer_len(&e->request) == 0)
+	if (buffer_len(&e->input) == 0)
 		goto failure;
-	buffer_get(&e->request, session_id, 16);
-	response_type = buffer_get_int(&e->request);
+	buffer_get(&e->input, session_id, 16);
+	response_type = buffer_get_int(&e->input);
 	if (response_type != 1)
 		goto failure;
 
 	id = lookup_identity(key, 1);
-	if (id != NULL && (!id->confirm || confirm_key(id) == 0)) {
+	if (id != NULL) {
 		Key *private = id->key;
 		/* Decrypt the challenge using the private key. */
 		if (rsa_private_decrypt(challenge, challenge, private->rsa) <= 0)
@@ -289,26 +241,27 @@
 static void
 process_sign_request2(SocketEntry *e)
 {
+	extern int datafellows;
+	Key *key;
 	u_char *blob, *data, *signature = NULL;
 	u_int blen, dlen, slen = 0;
-	extern int datafellows;
-	int ok = -1, flags;
+	int flags;
 	Buffer msg;
-	Key *key;
+	int ok = -1;
 
 	datafellows = 0;
 
-	blob = buffer_get_string(&e->request, &blen);
-	data = buffer_get_string(&e->request, &dlen);
+	blob = buffer_get_string(&e->input, &blen);
+	data = buffer_get_string(&e->input, &dlen);
 
-	flags = buffer_get_int(&e->request);
+	flags = buffer_get_int(&e->input);
 	if (flags & SSH_AGENT_OLD_SIGNATURE)
 		datafellows = SSH_BUG_SIGBLOB;
 
 	key = key_from_blob(blob, blen);
 	if (key != NULL) {
 		Identity *id = lookup_identity(key, 2);
-		if (id != NULL && (!id->confirm || confirm_key(id) == 0))
+		if (id != NULL)
 			ok = key_sign(id->key, &signature, &slen, data, dlen);
 	}
 	key_free(key);
@@ -333,24 +286,25 @@
 static void
 process_remove_identity(SocketEntry *e, int version)
 {
-	u_int blen, bits;
-	int success = 0;
 	Key *key = NULL;
 	u_char *blob;
+	u_int blen;
+	u_int bits;
+	int success = 0;
 
 	switch (version) {
 	case 1:
 		key = key_new(KEY_RSA1);
-		bits = buffer_get_int(&e->request);
-		buffer_get_bignum(&e->request, key->rsa->e);
-		buffer_get_bignum(&e->request, key->rsa->n);
+		bits = buffer_get_int(&e->input);
+		buffer_get_bignum(&e->input, key->rsa->e);
+		buffer_get_bignum(&e->input, key->rsa->n);
 
 		if (bits != key_size(key))
-			log("Warning: identity keysize mismatch: actual %u, announced %u",
+			log("Warning: identity keysize mismatch: actual %d, announced %d",
 			    key_size(key), bits);
 		break;
 	case 2:
-		blob = buffer_get_string(&e->request, &blen);
+		blob = buffer_get_string(&e->input, &blen);
 		key = key_from_blob(blob, blen);
 		xfree(blob);
 		break;
@@ -401,121 +355,75 @@
 	/* Send success. */
 	buffer_put_int(&e->output, 1);
 	buffer_put_char(&e->output, SSH_AGENT_SUCCESS);
+	return;
 }
 
 static void
-reaper(void)
-{
-	u_int now = time(NULL);
-	Identity *id, *nxt;
-	int version;
-	Idtab *tab;
-
-	for (version = 1; version < 3; version++) {
-		tab = idtab_lookup(version);
-		for (id = TAILQ_FIRST(&tab->idlist); id; id = nxt) {
-			nxt = TAILQ_NEXT(id, next);
-			if (id->death != 0 && now >= id->death) {
-				TAILQ_REMOVE(&tab->idlist, id, next);
-				free_identity(id);
-				tab->nentries--;
-			}
-		}
-	}
-}
-
-static void
 process_add_identity(SocketEntry *e, int version)
 {
-	Idtab *tab = idtab_lookup(version);
-	int type, success = 0, death = 0, confirm = 0;
-	char *type_name, *comment;
 	Key *k = NULL;
+	char *type_name;
+	char *comment;
+	int type, success = 0;
+	Idtab *tab = idtab_lookup(version);
 
 	switch (version) {
 	case 1:
 		k = key_new_private(KEY_RSA1);
-		(void) buffer_get_int(&e->request);		/* ignored */
-		buffer_get_bignum(&e->request, k->rsa->n);
-		buffer_get_bignum(&e->request, k->rsa->e);
-		buffer_get_bignum(&e->request, k->rsa->d);
-		buffer_get_bignum(&e->request, k->rsa->iqmp);
+		buffer_get_int(&e->input);			/* ignored */
+		buffer_get_bignum(&e->input, k->rsa->n);
+		buffer_get_bignum(&e->input, k->rsa->e);
+		buffer_get_bignum(&e->input, k->rsa->d);
+		buffer_get_bignum(&e->input, k->rsa->iqmp);
 
 		/* SSH and SSL have p and q swapped */
-		buffer_get_bignum(&e->request, k->rsa->q);	/* p */
-		buffer_get_bignum(&e->request, k->rsa->p);	/* q */
+		buffer_get_bignum(&e->input, k->rsa->q);	/* p */
+		buffer_get_bignum(&e->input, k->rsa->p);	/* q */
 
 		/* Generate additional parameters */
 		rsa_generate_additional_parameters(k->rsa);
 		break;
 	case 2:
-		type_name = buffer_get_string(&e->request, NULL);
+		type_name = buffer_get_string(&e->input, NULL);
 		type = key_type_from_name(type_name);
 		xfree(type_name);
 		switch (type) {
 		case KEY_DSA:
 			k = key_new_private(type);
-			buffer_get_bignum2(&e->request, k->dsa->p);
-			buffer_get_bignum2(&e->request, k->dsa->q);
-			buffer_get_bignum2(&e->request, k->dsa->g);
-			buffer_get_bignum2(&e->request, k->dsa->pub_key);
-			buffer_get_bignum2(&e->request, k->dsa->priv_key);
+			buffer_get_bignum2(&e->input, k->dsa->p);
+			buffer_get_bignum2(&e->input, k->dsa->q);
+			buffer_get_bignum2(&e->input, k->dsa->g);
+			buffer_get_bignum2(&e->input, k->dsa->pub_key);
+			buffer_get_bignum2(&e->input, k->dsa->priv_key);
 			break;
 		case KEY_RSA:
 			k = key_new_private(type);
-			buffer_get_bignum2(&e->request, k->rsa->n);
-			buffer_get_bignum2(&e->request, k->rsa->e);
-			buffer_get_bignum2(&e->request, k->rsa->d);
-			buffer_get_bignum2(&e->request, k->rsa->iqmp);
-			buffer_get_bignum2(&e->request, k->rsa->p);
-			buffer_get_bignum2(&e->request, k->rsa->q);
+			buffer_get_bignum2(&e->input, k->rsa->n);
+			buffer_get_bignum2(&e->input, k->rsa->e);
+			buffer_get_bignum2(&e->input, k->rsa->d);
+			buffer_get_bignum2(&e->input, k->rsa->iqmp);
+			buffer_get_bignum2(&e->input, k->rsa->p);
+			buffer_get_bignum2(&e->input, k->rsa->q);
 
 			/* Generate additional parameters */
 			rsa_generate_additional_parameters(k->rsa);
 			break;
 		default:
-			buffer_clear(&e->request);
+			buffer_clear(&e->input);
 			goto send;
 		}
 		break;
 	}
-	/* enable blinding */
-	switch (k->type) {
-	case KEY_RSA:
-	case KEY_RSA1:
-		if (RSA_blinding_on(k->rsa, NULL) != 1) {
-			error("process_add_identity: RSA_blinding_on failed");
-			key_free(k);
-			goto send;
-		}
-		break;
-	}
-	comment = buffer_get_string(&e->request, NULL);
+	comment = buffer_get_string(&e->input, NULL);
 	if (k == NULL) {
 		xfree(comment);
 		goto send;
 	}
 	success = 1;
-	while (buffer_len(&e->request)) {
-		switch (buffer_get_char(&e->request)) {
-		case SSH_AGENT_CONSTRAIN_LIFETIME:
-			death = time(NULL) + buffer_get_int(&e->request);
-			break;
-		case SSH_AGENT_CONSTRAIN_CONFIRM:
-			confirm = 1;
-			break;
-		default:
-			break;
-		}
-	}
-	if (lifetime && !death)
-		death = time(NULL) + lifetime;
 	if (lookup_identity(k, version) == NULL) {
 		Identity *id = xmalloc(sizeof(Identity));
 		id->key = k;
 		id->comment = comment;
-		id->death = death;
-		id->confirm = confirm;
 		TAILQ_INSERT_TAIL(&tab->idlist, id, next);
 		/* Increment the number of identities. */
 		tab->nentries++;
@@ -529,60 +437,19 @@
 	    success ? SSH_AGENT_SUCCESS : SSH_AGENT_FAILURE);
 }
 
-/* XXX todo: encrypt sensitive data with passphrase */
-static void
-process_lock_agent(SocketEntry *e, int lock)
-{
-	int success = 0;
-	char *passwd;
 
-	passwd = buffer_get_string(&e->request, NULL);
-	if (locked && !lock && strcmp(passwd, lock_passwd) == 0) {
-		locked = 0;
-		memset(lock_passwd, 0, strlen(lock_passwd));
-		xfree(lock_passwd);
-		lock_passwd = NULL;
-		success = 1;
-	} else if (!locked && lock) {
-		locked = 1;
-		lock_passwd = xstrdup(passwd);
-		success = 1;
-	}
-	memset(passwd, 0, strlen(passwd));
-	xfree(passwd);
-
-	buffer_put_int(&e->output, 1);
-	buffer_put_char(&e->output,
-	    success ? SSH_AGENT_SUCCESS : SSH_AGENT_FAILURE);
-}
-
-static void
-no_identities(SocketEntry *e, u_int type)
-{
-	Buffer msg;
-
-	buffer_init(&msg);
-	buffer_put_char(&msg,
-	    (type == SSH_AGENTC_REQUEST_RSA_IDENTITIES) ?
-	    SSH_AGENT_RSA_IDENTITIES_ANSWER : SSH2_AGENT_IDENTITIES_ANSWER);
-	buffer_put_int(&msg, 0);
-	buffer_put_int(&e->output, buffer_len(&msg));
-	buffer_append(&e->output, buffer_ptr(&msg), buffer_len(&msg));
-	buffer_free(&msg);
-}
-
 #ifdef SMARTCARD
 static void
 process_add_smartcard_key (SocketEntry *e)
 {
-	char *sc_reader_id = NULL, *pin;
-	int i, version, success = 0;
-	Key **keys, *k;
 	Identity *id;
 	Idtab *tab;
+	Key **keys, *k;
+	char *sc_reader_id = NULL, *pin;
+	int i, version, success = 0;
 
-	sc_reader_id = buffer_get_string(&e->request, NULL);
-	pin = buffer_get_string(&e->request, NULL);
+	sc_reader_id = buffer_get_string(&e->input, NULL);
+	pin = buffer_get_string(&e->input, NULL);
 	keys = sc_get_keys(sc_reader_id, pin);
 	xfree(sc_reader_id);
 	xfree(pin);
@@ -599,8 +466,6 @@
 			id = xmalloc(sizeof(Identity));
 			id->key = k;
 			id->comment = xstrdup("smartcard key");
-			id->death = 0;
-			id->confirm = 0;
 			TAILQ_INSERT_TAIL(&tab->idlist, id, next);
 			tab->nentries++;
 			success = 1;
@@ -619,14 +484,14 @@
 static void
 process_remove_smartcard_key(SocketEntry *e)
 {
-	char *sc_reader_id = NULL, *pin;
-	int i, version, success = 0;
-	Key **keys, *k = NULL;
 	Identity *id;
 	Idtab *tab;
+	Key **keys, *k = NULL;
+	char *sc_reader_id = NULL, *pin;
+	int i, version, success = 0;
 
-	sc_reader_id = buffer_get_string(&e->request, NULL);
-	pin = buffer_get_string(&e->request, NULL);
+	sc_reader_id = buffer_get_string(&e->input, NULL);
+	pin = buffer_get_string(&e->input, NULL);
 	keys = sc_get_keys(sc_reader_id, pin);
 	xfree(sc_reader_id);
 	xfree(pin);
@@ -640,7 +505,7 @@
 		version = k->type == KEY_RSA1 ? 1 : 2;
 		if ((id = lookup_identity(k, version)) != NULL) {
 			tab = idtab_lookup(version);
-			TAILQ_REMOVE(&tab->idlist, id, next);
+                        TAILQ_REMOVE(&tab->idlist, id, next);
 			tab->nentries--;
 			free_identity(id);
 			success = 1;
@@ -661,53 +526,26 @@
 static void
 process_message(SocketEntry *e)
 {
-	u_int msg_len, type;
+	u_int msg_len;
+	u_int type;
 	u_char *cp;
-
-	/* kill dead keys */
-	reaper();
-
 	if (buffer_len(&e->input) < 5)
 		return;		/* Incomplete message. */
 	cp = buffer_ptr(&e->input);
 	msg_len = GET_32BIT(cp);
 	if (msg_len > 256 * 1024) {
-		close_socket(e);
+		shutdown(e->fd, SHUT_RDWR);
+		close(e->fd);
+		e->type = AUTH_UNUSED;
 		return;
 	}
 	if (buffer_len(&e->input) < msg_len + 4)
 		return;
-
-	/* move the current input to e->request */
 	buffer_consume(&e->input, 4);
-	buffer_clear(&e->request);
-	buffer_append(&e->request, buffer_ptr(&e->input), msg_len);
-	buffer_consume(&e->input, msg_len);
-	type = buffer_get_char(&e->request);
+	type = buffer_get_char(&e->input);
 
-	/* check wheter agent is locked */
-	if (locked && type != SSH_AGENTC_UNLOCK) {
-		buffer_clear(&e->request);
-		switch (type) {
-		case SSH_AGENTC_REQUEST_RSA_IDENTITIES:
-		case SSH2_AGENTC_REQUEST_IDENTITIES:
-			/* send empty lists */
-			no_identities(e, type);
-			break;
-		default:
-			/* send a fail message for all other request types */
-			buffer_put_int(&e->output, 1);
-			buffer_put_char(&e->output, SSH_AGENT_FAILURE);
-		}
-		return;
-	}
-
 	debug("type %d", type);
 	switch (type) {
-	case SSH_AGENTC_LOCK:
-	case SSH_AGENTC_UNLOCK:
-		process_lock_agent(e, type == SSH_AGENTC_LOCK);
-		break;
 	/* ssh1 */
 	case SSH_AGENTC_RSA_CHALLENGE:
 		process_authentication_challenge1(e);
@@ -716,7 +554,6 @@
 		process_request_identities(e, 1);
 		break;
 	case SSH_AGENTC_ADD_RSA_IDENTITY:
-	case SSH_AGENTC_ADD_RSA_ID_CONSTRAINED:
 		process_add_identity(e, 1);
 		break;
 	case SSH_AGENTC_REMOVE_RSA_IDENTITY:
@@ -733,7 +570,6 @@
 		process_request_identities(e, 2);
 		break;
 	case SSH2_AGENTC_ADD_IDENTITY:
-	case SSH2_AGENTC_ADD_ID_CONSTRAINED:
 		process_add_identity(e, 2);
 		break;
 	case SSH2_AGENTC_REMOVE_IDENTITY:
@@ -753,7 +589,7 @@
 	default:
 		/* Unknown message.  Respond with failure. */
 		error("Unknown message %d", type);
-		buffer_clear(&e->request);
+		buffer_clear(&e->input);
 		buffer_put_int(&e->output, 1);
 		buffer_put_char(&e->output, SSH_AGENT_FAILURE);
 		break;
@@ -764,7 +600,6 @@
 new_socket(sock_type type, int fd)
 {
 	u_int i, old_alloc;
-
 	if (fcntl(fd, F_SETFL, O_NONBLOCK) < 0)
 		error("fcntl O_NONBLOCK: %s", strerror(errno));
 
@@ -777,7 +612,6 @@
 			sockets[i].type = type;
 			buffer_init(&sockets[i].input);
 			buffer_init(&sockets[i].output);
-			buffer_init(&sockets[i].request);
 			return;
 		}
 	old_alloc = sockets_alloc;
@@ -792,7 +626,6 @@
 	sockets[old_alloc].fd = fd;
 	buffer_init(&sockets[old_alloc].input);
 	buffer_init(&sockets[old_alloc].output);
-	buffer_init(&sockets[old_alloc].request);
 }
 
 static int
@@ -849,13 +682,11 @@
 static void
 after_select(fd_set *readset, fd_set *writeset)
 {
-	struct sockaddr_un sunaddr;
+	u_int i;
+	int len, sock;
 	socklen_t slen;
 	char buf[1024];
-	int len, sock;
-	u_int i;
-	uid_t euid;
-	gid_t egid;
+	struct sockaddr_un sunaddr;
 
 	for (i = 0; i < sockets_alloc; i++)
 		switch (sockets[i].type) {
@@ -871,19 +702,6 @@
 					    strerror(errno));
 					break;
 				}
-				if (getpeereid(sock, &euid, &egid) < 0) {
-					error("getpeereid %d failed: %s",
-					    sock, strerror(errno));
-					close(sock);
-					break;
-				}
-				if ((euid != 0) && (getuid() != euid)) {
-					error("uid mismatch: "
-					    "peer euid %u != uid %u",
-					    (u_int) euid, (u_int) getuid());
-					close(sock);
-					break;
-				}
 				new_socket(AUTH_CONNECTION, sock);
 			}
 			break;
@@ -900,7 +718,11 @@
 					break;
 				} while (1);
 				if (len <= 0) {
-					close_socket(&sockets[i]);
+					shutdown(sockets[i].fd, SHUT_RDWR);
+					close(sockets[i].fd);
+					sockets[i].type = AUTH_UNUSED;
+					buffer_free(&sockets[i].input);
+					buffer_free(&sockets[i].output);
 					break;
 				}
 				buffer_consume(&sockets[i].output, len);
@@ -914,7 +736,11 @@
 					break;
 				} while (1);
 				if (len <= 0) {
-					close_socket(&sockets[i]);
+					shutdown(sockets[i].fd, SHUT_RDWR);
+					close(sockets[i].fd);
+					sockets[i].type = AUTH_UNUSED;
+					buffer_free(&sockets[i].input);
+					buffer_free(&sockets[i].output);
 					break;
 				}
 				buffer_append(&sockets[i].input, buf, len);
@@ -974,31 +800,24 @@
 	fprintf(stderr, "  -k          Kill the current agent.\n");
 	fprintf(stderr, "  -d          Debug mode.\n");
 	fprintf(stderr, "  -a socket   Bind agent socket to given name.\n");
-	fprintf(stderr, "  -t life     Default identity lifetime (seconds).\n");
 	exit(1);
 }
 
 int
 main(int ac, char **av)
 {
-	int c_flag = 0, d_flag = 0, k_flag = 0, s_flag = 0;
-	int sock, fd,  ch, nalloc;
-	char *shell, *format, *pidstr, *agentsocket = NULL;
-	fd_set *readsetp = NULL, *writesetp = NULL;
+	int sock, c_flag = 0, d_flag = 0, k_flag = 0, s_flag = 0, ch, nalloc;
 	struct sockaddr_un sunaddr;
 	struct rlimit rlim;
-	extern int optind;
-	extern char *optarg;
 	pid_t pid;
-	char pidstrbuf[1 + 3 * sizeof pid];
+	char *shell, *format, *pidstr, pidstrbuf[1 + 3 * sizeof pid];
+	char *agentsocket = NULL;
+	extern int optind;
+	fd_set *readsetp = NULL, *writesetp = NULL;
 
-	/* drop */
-	setegid(getgid());
-	setgid(getgid());
-
 	SSLeay_add_all_algorithms();
 
-	while ((ch = getopt(ac, av, "cdksa:t:")) != -1) {
+	while ((ch = getopt(ac, av, "cdksa:")) != -1) {
 		switch (ch) {
 		case 'c':
 			if (s_flag)
@@ -1021,12 +840,6 @@
 		case 'a':
 			agentsocket = optarg;
 			break;
-		case 't':
-			if ((lifetime = convtime(optarg)) == -1) {
-				fprintf(stderr, "Invalid lifetime\n");
-				usage();
-			}
-			break;
 		default:
 			usage();
 		}
@@ -1062,7 +875,7 @@
 		format = c_flag ? "unsetenv %s;\n" : "unset %s;\n";
 		printf(format, SSH_AUTHSOCKET_ENV_NAME);
 		printf(format, SSH_AGENTPID_ENV_NAME);
-		printf("echo Agent pid %ld killed;\n", (long)pid);
+		printf("echo Agent pid %d killed;\n", pid);
 		exit(0);
 	}
 	parent_pid = getpid();
@@ -1074,8 +887,8 @@
 			perror("mkdtemp: private socket dir");
 			exit(1);
 		}
-		snprintf(socket_name, sizeof socket_name, "%s/agent.%ld", socket_dir,
-		    (long)parent_pid);
+		snprintf(socket_name, sizeof socket_name, "%s/agent.%d", socket_dir,
+		    parent_pid);
 	} else {
 		/* Try to use specified agent socket */
 		socket_dir[0] = '\0';
@@ -1098,7 +911,7 @@
 		perror("bind");
 		cleanup_exit(1);
 	}
-	if (listen(sock, 128) < 0) {
+	if (listen(sock, 5) < 0) {
 		perror("listen");
 		cleanup_exit(1);
 	}
@@ -1112,7 +925,7 @@
 		format = c_flag ? "setenv %s %s;\n" : "%s=%s; export %s;\n";
 		printf(format, SSH_AUTHSOCKET_ENV_NAME, socket_name,
 		    SSH_AUTHSOCKET_ENV_NAME);
-		printf("echo Agent pid %ld;\n", (long)parent_pid);
+		printf("echo Agent pid %d;\n", parent_pid);
 		goto skip;
 	}
 	pid = fork();
@@ -1122,14 +935,14 @@
 	}
 	if (pid != 0) {		/* Parent - execute the given command. */
 		close(sock);
-		snprintf(pidstrbuf, sizeof pidstrbuf, "%ld", (long)pid);
+		snprintf(pidstrbuf, sizeof pidstrbuf, "%d", pid);
 		if (ac == 0) {
 			format = c_flag ? "setenv %s %s;\n" : "%s=%s; export %s;\n";
 			printf(format, SSH_AUTHSOCKET_ENV_NAME, socket_name,
 			    SSH_AUTHSOCKET_ENV_NAME);
 			printf(format, SSH_AGENTPID_ENV_NAME, pidstrbuf,
 			    SSH_AGENTPID_ENV_NAME);
-			printf("echo Agent pid %ld;\n", (long)pid);
+			printf("echo Agent pid %d;\n", pid);
 			exit(0);
 		}
 		if (setenv(SSH_AUTHSOCKET_ENV_NAME, socket_name, 1) == -1 ||
@@ -1150,14 +963,9 @@
 	}
 
 	(void)chdir("/");
-	if ((fd = open(_PATH_DEVNULL, O_RDWR, 0)) != -1) {
-		/* XXX might close listen socket */
-		(void)dup2(fd, STDIN_FILENO);
-		(void)dup2(fd, STDOUT_FILENO);
-		(void)dup2(fd, STDERR_FILENO);
-		if (fd > 2)
-			close(fd);
-	}
+	close(0);
+	close(1);
+	close(2);
 
 	/* deny core dumps, since memory contains unencrypted private keys */
 	rlim.rlim_cur = rlim.rlim_max = 0;