- (djm) Merge cygwin support from Corinna Vinschen <vinschen@cygnus.com>

22 files changed, 259 insertions, 28 deletions

diff --git a/CREDITS b/CREDITS
index 148a38a49..b2ea280dc 100644
--- a/CREDITS
+++ b/CREDITS
@@ -21,6 +21,7 @@ Chris Saia <csaia@wtower.com> - SuSE packaging
 Chris, the Young One <cky@pobox.com> - Password auth fixes
 Christos Zoulas <christos@zoulas.com> - Autoconf fixes
 Chun-Chung Chen <cjj@u.washington.edu> - RPM fixes
+Corinna Vinschen <vinschen@cygnus.com> - Cygwin support
 Dan Brosemer <odin@linuxfreak.com> - Autoconf support, build fixes
 Darren Hall <dhall@virage.org> - AIX patches
 David Agraz <dagraz@jahoopa.com> - Build fixes
diff --git a/ChangeLog b/ChangeLog
index 9aa9423c8..6b112b6c7 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -38,6 +38,8 @@
      [session.c]
      set SSH_ORIGINAL_COMMAND; from Leakin@dfw.nostrum.com, bet@rahul.net
  - (djm) Cleanup after import. Fix sftp-server compilation, Makefile
+ - (djm) Merge cygwin support from Corinna Vinschen <vinschen@cygnus.com>
+
 20000903
  - (djm) Fix Redhat init script
 
diff --git a/Makefile.in b/Makefile.in
index 7eb84ce63..f8a0ee291 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -29,12 +29,13 @@ INSTALL=@INSTALL@
 PERL=@PERL@
 ENT=@ENT@
 LDFLAGS=-L. @LDFLAGS@
+EXEEXT=@EXEEXT@
 
 INSTALL_SSH_PRNG_CMDS=@INSTALL_SSH_PRNG_CMDS@
 
-TARGETS=ssh sshd ssh-add ssh-keygen ssh-agent scp sftp-server $(EXTRA_TARGETS)
+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) $(EXTRA_TARGETS)
 
-LIBSSH_OBJS=atomicio.o authfd.o authfile.o bufaux.o buffer.o canohost.o channels.o cipher.o compat.o compress.o crc32.o deattack.o dispatch.o dsa.o hmac.o hostfile.o key.o kex.o log.o match.o mpaux.o nchan.o packet.o radix.o entropy.o readpass.o rsa.o tildexpand.o ttymodes.o uidswap.o util.o uuencode.o xmalloc.o 
+LIBSSH_OBJS=atomicio.o authfd.o authfile.o bufaux.o buffer.o canohost.o channels.o cipher.o compat.o compress.o crc32.o cygwin_util.o deattack.o dispatch.o dsa.o hmac.o hostfile.o key.o kex.o log.o match.o mpaux.o nchan.o packet.o radix.o entropy.o readpass.o rsa.o tildexpand.o ttymodes.o uidswap.o util.o uuencode.o xmalloc.o 
 
 LIBOPENBSD_COMPAT_OBJS=bsd-arc4random.o bsd-base64.o bsd-bindresvport.o bsd-daemon.o bsd-inet_aton.o bsd-inet_ntoa.o bsd-misc.o bsd-mktemp.o bsd-rresvport.o bsd-setenv.o bsd-sigaction.o bsd-snprintf.o bsd-strlcat.o bsd-strlcpy.o bsd-strsep.o fake-getaddrinfo.o fake-getnameinfo.o next-posix.o
 
@@ -68,25 +69,25 @@ libssh.a: $(LIBSSH_OBJS)
 	$(AR) rv $@ $(LIBSSH_OBJS)
 	$(RANLIB) $@
 
-ssh: libopenbsd-compat.a libssh.a $(SSHOBJS)
+ssh$(EXEEXT): libopenbsd-compat.a libssh.a $(SSHOBJS)
 	$(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
 
-sshd: libssh.a	libopenbsd-compat.a $(SSHDOBJS)
+sshd$(EXEEXT): libssh.a	libopenbsd-compat.a $(SSHDOBJS)
 	$(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
 
-scp: libopenbsd-compat.a libssh.a scp.o
+scp$(EXEEXT): libopenbsd-compat.a libssh.a scp.o
 	$(LD) -o $@ scp.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) 
 
-ssh-add: libopenbsd-compat.a libssh.a ssh-add.o log-client.o
+ssh-add$(EXEEXT): libopenbsd-compat.a libssh.a ssh-add.o log-client.o
 	$(LD) -o $@ ssh-add.o log-client.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) 
 
-ssh-agent: libopenbsd-compat.a libssh.a ssh-agent.o log-client.o
+ssh-agent$(EXEEXT): libopenbsd-compat.a libssh.a ssh-agent.o log-client.o
 	$(LD) -o $@ ssh-agent.o log-client.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) 
 
-ssh-keygen: libopenbsd-compat.a libssh.a ssh-keygen.o log-client.o
+ssh-keygen$(EXEEXT): libopenbsd-compat.a libssh.a ssh-keygen.o log-client.o
 	$(LD) -o $@ ssh-keygen.o log-client.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) 
 
-sftp-server: libopenbsd-compat.a libssh.a sftp-server.o log-server.o
+sftp-server$(EXEEXT): libopenbsd-compat.a libssh.a sftp-server.o log-server.o
 	$(LD) -o $@ sftp-server.o log-server.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) 
 
 # test driver for the loginrec code - not built by default
@@ -142,7 +143,7 @@ install-files:
 	$(INSTALL) -m 644 sshd.[08].out $(DESTDIR)$(mandir)/$(mansubdir)8/sshd.8
 	$(INSTALL) -m 644 sftp-server.[08].out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
 	-rm -f $(DESTDIR)$(bindir)/slogin
-	ln -s ssh $(DESTDIR)$(bindir)/slogin
+	ln -s ssh$(EXEEXT) $(DESTDIR)$(bindir)/slogin
 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
 	ln -s ssh.1 $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
 	if [ ! -f $(DESTDIR)$(sysconfdir)/ssh_config -a ! -f $(DESTDIR)$(sysconfdir)/sshd_config ]; then \
@@ -155,7 +156,7 @@ install-files:
 		$(INSTALL) -m 644 ssh_prng_cmds.out $(DESTDIR)$(sysconfdir)/ssh_prng_cmds; \
 	fi
 
-host-key: ssh-keygen
+host-key: ssh-keygen$(EXEEXT)
 	if [ -z "$(DESTDIR)" ] ; then \
 		if [ -f "$(DESTDIR)$(sysconfdir)/ssh_host_key" ] ; then \
 			echo "$(DESTDIR)$(sysconfdir)/ssh_host_key already exists, skipping." ; \
@@ -169,7 +170,7 @@ host-key: ssh-keygen
 		fi ; \
 	fi ;
 
-host-key-force: ssh-keygen
+host-key-force: ssh-keygen$(EXEEXT)
 	./ssh-keygen -b 1024 -f $(DESTDIR)$(sysconfdir)/ssh_host_key -N ""
 	./ssh-keygen -d -f $(DESTDIR)$(sysconfdir)/ssh_host_dsa_key -N ""
 
@@ -186,12 +187,12 @@ uninstallall:	uninstall
 	-rmdir $(DESTDIR)$(libexecdir)
 
 uninstall: 
-	-rm -f $(DESTDIR)$(bindir)/ssh
-	-rm -f $(DESTDIR)$(bindir)/scp
-	-rm -f $(DESTDIR)$(bindir)/ssh-add
-	-rm -f $(DESTDIR)$(bindir)/ssh-agent
-	-rm -f $(DESTDIR)$(bindir)/ssh-keygen
-	-rm -f $(DESTDIR)$(sbindir)/sshd
+	-rm -f $(DESTDIR)$(bindir)/ssh$(EXEEXT)
+	-rm -f $(DESTDIR)$(bindir)/scp$(EXEEXT)
+	-rm -f $(DESTDIR)$(bindir)/ssh-add$(EXEEXT)
+	-rm -f $(DESTDIR)$(bindir)/ssh-agent$(EXEEXT)
+	-rm -f $(DESTDIR)$(bindir)/ssh-keygen$(EXEEXT)
+	-rm -f $(DESTDIR)$(sbindir)/sshd$(EXEEXT)
 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
 	-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
diff --git a/acconfig.h b/acconfig.h
index c16ec2bf6..d855d887a 100644
--- a/acconfig.h
+++ b/acconfig.h
@@ -43,6 +43,9 @@
 /* Define if your snprintf is busted */
 #undef BROKEN_SNPRINTF
 
+/* Define if you are on Cygwin */
+#undef HAVE_CYGWIN
+
 /* Define if you are on NeXT */
 #undef HAVE_NEXT
 
@@ -243,6 +246,9 @@
 /* getaddrinfo is broken (if present) */
 #undef BROKEN_GETADDRINFO
 
+/* vhangup is broken (if present) */
+#undef BROKEN_VHANGUP
+
 /* Workaround more Linux IPv6 quirks */
 #undef DONT_TRY_OTHER_AF
 
diff --git a/auth-passwd.c b/auth-passwd.c
index 93756e9e6..850e25834 100644
--- a/auth-passwd.c
+++ b/auth-passwd.c
@@ -37,6 +37,13 @@ RCSID("$OpenBSD: auth-passwd.c,v 1.16 2000/06/20 01:39:38 markus Exp $");
 # include "md5crypt.h"
 #endif /* defined(HAVE_MD5_PASSWORDS) && !defined(HAVE_MD5_CRYPT) */
 
+#ifdef HAVE_CYGWIN
+#undef ERROR
+#include <windows.h>
+#include <sys/cygwin.h>
+#define is_winnt       (GetVersion() < 0x80000000)
+#endif
+
 /*
  * Tries to authenticate the user using password.  Returns true if
  * authentication succeeds.
@@ -63,11 +70,31 @@ auth_password(struct passwd * pw, const char *password)
 	/* deny if no user. */
 	if (pw == NULL)
 		return 0;
+#ifndef HAVE_CYGWIN
 	if (pw->pw_uid == 0 && options.permit_root_login == 2)
 		return 0;
+#endif
+#ifdef HAVE_CYGWIN
+	/*
+	 * Empty password is only possible on NT if the user has _really_
+	 * an empty password and authentication is done, though.
+	 */
+        if (!is_winnt) 
+#endif
 	if (*password == '\0' && options.permit_empty_passwd == 0)
 		return 0;
 
+#ifdef HAVE_CYGWIN
+	if (is_winnt) {
+		HANDLE hToken = cygwin_logon_user(pw, password);
+
+		if (hToken == INVALID_HANDLE_VALUE)
+			return 0;
+		cygwin_set_impersonation_token(hToken);
+		return 1;
+	}
+#endif
+
 #ifdef SKEY
 	if (options.skey_authentication == 1) {
 		int ret = auth_skey_password(pw, password);
diff --git a/auth1.c b/auth1.c
index b043e8a95..3720a7d28 100644
--- a/auth1.c
+++ b/auth1.c
@@ -23,6 +23,11 @@ RCSID("$OpenBSD: auth1.c,v 1.3 2000/08/20 18:42:40 millert Exp $");
 # include <siad.h>
 #endif
 
+#ifdef HAVE_CYGWIN
+#include <windows.h>
+#define is_winnt       (GetVersion() < 0x80000000)
+#endif
+
 /* import */
 extern ServerOptions options;
 extern char *forced_command;
@@ -371,6 +376,23 @@ do_authloop(struct passwd * pw)
 			break;
 		}
 
+#ifdef HAVE_CYGWIN
+		/*
+		 * The only authentication which is able to change the user
+		 * context on NT systems is the password authentication. So
+		 * we deny all requsts for changing the user context if another
+		 * authentication method is used.
+		 * This may change in future when a special openssh
+		 * subauthentication package is available.
+		 */
+		if (is_winnt && type != SSH_CMSG_AUTH_PASSWORD &&
+		    authenticated && geteuid() != pw->pw_uid) {
+			packet_disconnect("Authentication rejected for uid %d.",
+					  (int) pw->pw_uid);
+			authenticated = 0;
+		}
+#endif
+
 		/*
 		 * Check if the user is logging in as root and root logins
 		 * are disallowed.
@@ -491,12 +513,15 @@ do_authentication()
 	start_pam(pw);
 #endif
 
+#ifndef HAVE_CYGWIN
 	/*
 	 * If we are not running as root, the user must have the same uid as
 	 * the server.
+	 * Rule not valid on Windows systems.
 	 */
 	if (getuid() != 0 && pw->pw_uid != getuid())
 		packet_disconnect("Cannot change user when server not running as root.");
+#endif
 
 	debug("Attempting authentication for %.100s.", pw->pw_name);
 
diff --git a/authfile.c b/authfile.c
index 71c4a5d84..4368cb941 100644
--- a/authfile.c
+++ b/authfile.c
@@ -457,7 +457,12 @@ load_private_key(const char *filename, const char *passphrase, Key *key,
 	if (fd < 0)
 		return 0;
 
-	/* check owner and modes */
+#ifndef HAVE_CYGWIN
+	/*
+	 * check owner and modes.
+	 * This won't work on Windows under all circumstances so we drop
+	 * that check for now.
+	 */
 	if (fstat(fd, &st) < 0 ||
 	    (st.st_uid != 0 && st.st_uid != getuid()) ||
 	    (st.st_mode & 077) != 0) {
@@ -470,6 +475,7 @@ load_private_key(const char *filename, const char *passphrase, Key *key,
 		error("It is recommended that your private key files are NOT accessible by others.");
 		return 0;
 	}
+#endif
 	switch (key->type) {
 	case KEY_RSA:
 		if (key->rsa->e != NULL) {
diff --git a/bsd-daemon.c b/bsd-daemon.c
index de829958c..f704a9048 100644
--- a/bsd-daemon.c
+++ b/bsd-daemon.c
@@ -51,6 +51,13 @@ daemon(nochdir, noclose)
 	case 0:
 		break;
 	default:
+#ifdef HAVE_CYGWIN
+		/*
+		 * This sleep avoids a race condition which kills the
+		 * child process if parent is started by a NT/W2K service.
+		 */
+		sleep(1);
+#endif
 		_exit(0);
 	}
 
diff --git a/bsd-mktemp.c b/bsd-mktemp.c
index e8ffd0219..9ed1bc80f 100644
--- a/bsd-mktemp.c
+++ b/bsd-mktemp.c
@@ -42,6 +42,11 @@
 static char rcsid[] = "$OpenBSD: mktemp.c,v 1.13 1998/06/30 23:03:13 deraadt Exp $";
 #endif /* LIBC_SCCS and not lint */
 
+#ifdef HAVE_CYGWIN
+#define open binary_open
+extern int binary_open();
+#endif
+
 static int _gettemp(char *, int *, int, int);
 
 int
diff --git a/channels.c b/channels.c
index c77f6b96a..4ac48a77a 100644
--- a/channels.c
+++ b/channels.c
@@ -1567,6 +1567,7 @@ channel_input_port_forward_request(int is_root, int gateway_ports)
 	hostname = packet_get_string(NULL);
 	host_port = packet_get_int();
 
+#ifndef HAVE_CYGWIN
 	/*
 	 * Check that an unprivileged user is not trying to forward a
 	 * privileged port.
@@ -1574,6 +1575,7 @@ channel_input_port_forward_request(int is_root, int gateway_ports)
 	if (port < IPPORT_RESERVED && !is_root)
 		packet_disconnect("Requested forwarding of port %d but user is not root.",
 				  port);
+#endif
 	/*
 	 * Initiate forwarding,
 	 */
diff --git a/configure.in b/configure.in
index b1dd1d067..9fb78f1ff 100644
--- a/configure.in
+++ b/configure.in
@@ -54,6 +54,18 @@ case "$host" in
 	MANTYPE='$(CATMAN)'
 	mansubdir=cat
 	;;
+*-*-cygwin*)
+	LIBS="$LIBS /usr/lib/textmode.o"
+	AC_DEFINE(HAVE_CYGWIN)
+	AC_DEFINE(DISABLE_PAM)
+	AC_DEFINE(DISABLE_SHADOW)
+	AC_DEFINE(IPV4_DEFAULT)
+	AC_DEFINE(IP_TOS_IS_BROKEN)
+	AC_DEFINE(BROKEN_VHANGUP)
+	no_pam=1
+	no_libsocket=1
+	no_libnsl=1
+	;;
 *-*-hpux10*)
 	if test -z "$GCC"; then
 		CFLAGS="$CFLAGS -Ae"
@@ -1400,6 +1412,8 @@ if test ! -z "$blibpath" ; then
 	AC_MSG_WARN([Please check and edit -blibpath in LDFLAGS in Makefile])
 fi
 
+AC_EXEEXT
+
 AC_OUTPUT(Makefile ssh_prng_cmds)
 
 # Print summary of options
diff --git a/cygwin_util.c b/cygwin_util.c
new file mode 100644
index 000000000..13bd66347
--- /dev/null
+++ b/cygwin_util.c
@@ -0,0 +1,35 @@
+/*
+ *
+ * cygwin_util.c
+ *
+ * Author: Corinna Vinschen <vinschen@cygnus.com>
+ *
+ * Copyright (c) 2000 Corinna Vinschen <vinschen@cygnus.com>, Duisburg, Germany
+ *                    All rights reserved
+ *
+ * Created: Sat Sep 02 12:17:00 2000 cv
+ *
+ * This file contains functions for forcing opened file descriptors to
+ * binary mode on Windows systems.
+ */
+
+#include "config.h"
+
+#ifdef HAVE_CYGWIN
+#include <fcntl.h>
+#include <io.h>
+
+int binary_open(const char *filename, int flags, mode_t mode)
+{
+       return open(filename, flags | O_BINARY, mode);
+}
+
+int binary_pipe(int fd[2])
+{
+       int ret = pipe(fd);
+       if (!ret) {
+               setmode (fd[0], O_BINARY);
+               setmode (fd[1], O_BINARY);
+       }
+}
+#endif
diff --git a/defines.h b/defines.h
index 6bbb5166b..69b8baf27 100644
--- a/defines.h
+++ b/defines.h
@@ -322,6 +322,10 @@ typedef int mode_t;
 # define atexit(a) on_exit(a)
 #endif /* !defined(HAVE_ATEXIT) && defined(HAVE_ON_EXIT) */
 
+#if defined(HAVE_VHANGUP) && !defined(BROKEN_VHANGUP)
+#  define USE_VHANGUP
+#endif /* defined(HAVE_VHANGUP) && !defined(BROKEN_VHANGUP) */
+
 /**
  ** login recorder definitions
  **/
diff --git a/includes.h b/includes.h
index 5102c97ad..27569e18f 100644
--- a/includes.h
+++ b/includes.h
@@ -29,7 +29,9 @@ static /**/const char *const rcsid[] = { (char *)rcsid, "\100(#)" msg }
 #include <sys/wait.h>
 #include <sys/resource.h>
 
+#ifndef HAVE_CYGWIN
 #include <netinet/tcp.h>
+#endif
 #include <arpa/inet.h>
 #include <netdb.h>
 
@@ -46,6 +48,9 @@ static /**/const char *const rcsid[] = { (char *)rcsid, "\100(#)" msg }
 #include <grp.h>
 #include <time.h>
 #include <dirent.h>
+#ifdef HAVE_CYGWIN
+#include <getopt.h>
+#endif
 
 #ifdef HAVE_BSTRING_H
 # include <bstring.h>
@@ -110,4 +115,11 @@ static /**/const char *const rcsid[] = { (char *)rcsid, "\100(#)" msg }
  */
 /* #define USE_PIPES 1 */
 
+#ifdef HAVE_CYGWIN
+#define open binary_open
+#define pipe binary_pipe
+extern int binary_open();
+extern int binary_pipe();
+#endif
+
 #endif				/* INCLUDES_H */
diff --git a/loginrec.c b/loginrec.c
index 61bceb180..0e1f344b9 100644
--- a/loginrec.c
+++ b/loginrec.c
@@ -161,7 +161,7 @@
 #include "xmalloc.h"
 #include "loginrec.h"
 
-RCSID("$Id: loginrec.c,v 1.22 2000/08/29 03:30:37 djm Exp $");
+RCSID("$Id: loginrec.c,v 1.23 2000/09/05 05:13:07 djm Exp $");
 
 /**
  ** prototypes for helper functions in this file
@@ -401,10 +401,12 @@ login_set_addr(struct logininfo *li, const struct sockaddr *sa,
 int
 login_write (struct logininfo *li)
 {
+#ifndef HAVE_CYGWIN
 	if ((int)geteuid() != 0) {
 	  log("Attempt to write login records by non-root user (aborting)");
 	  return 1;
 	}
+#endif
 
 	/* set the timestamp */
 	login_set_current_time(li);
diff --git a/pty.c b/pty.c
index f5bb86124..d610a4543 100644
--- a/pty.c
+++ b/pty.c
@@ -118,6 +118,7 @@ pty_allocate(int *ptyfd, int *ttyfd, char *namebuf, int namebuflen)
 		close(*ptyfd);
 		return 0;
 	}
+#ifndef HAVE_CYGWIN
 	/* Push the appropriate streams modules, as described in Solaris pts(7). */
 	if (ioctl(*ttyfd, I_PUSH, "ptem") < 0)
 		error("ioctl I_PUSH ptem: %.100s", strerror(errno));
@@ -127,6 +128,7 @@ pty_allocate(int *ptyfd, int *ttyfd, char *namebuf, int namebuflen)
 	if (ioctl(*ttyfd, I_PUSH, "ttcompat") < 0)
 		error("ioctl I_PUSH ttcompat: %.100s", strerror(errno));
 #endif
+#endif
 	return 1;
 #else /* HAVE_DEV_PTMX */
 #ifdef HAVE_DEV_PTS_AND_PTC
@@ -208,9 +210,9 @@ void
 pty_make_controlling_tty(int *ttyfd, const char *ttyname)
 {
 	int fd;
-#ifdef HAVE_VHANGUP
+#ifdef USE_VHANGUP
 	void *old;
-#endif /* HAVE_VHANGUP */
+#endif /* USE_VHANGUP */
 
 	/* First disconnect from the old controlling tty. */
 #ifdef TIOCNOTTY
@@ -242,21 +244,21 @@ pty_make_controlling_tty(int *ttyfd, const char *ttyname)
 	 */
 	ioctl(*ttyfd, TIOCSCTTY, NULL);
 #endif /* TIOCSCTTY */
-#ifdef HAVE_VHANGUP
+#ifdef USE_VHANGUP
 	old = signal(SIGHUP, SIG_IGN);
 	vhangup();
 	signal(SIGHUP, old);
-#endif /* HAVE_VHANGUP */
+#endif /* USE_VHANGUP */
 	fd = open(ttyname, O_RDWR);
 	if (fd < 0) {
 		error("%.100s: %.100s", ttyname, strerror(errno));
 	} else {
-#ifdef HAVE_VHANGUP
+#ifdef USE_VHANGUP
 		close(*ttyfd);
 		*ttyfd = fd;
-#else /* HAVE_VHANGUP */
+#else /* USE_VHANGUP */
 		close(fd);
-#endif /* HAVE_VHANGUP */
+#endif /* USE_VHANGUP */
 	}
 	/* Verify that we now have a controlling tty. */
 	fd = open("/dev/tty", O_WRONLY);
diff --git a/readconf.c b/readconf.c
index f31b1c4e6..c9e0f5944 100644
--- a/readconf.c
+++ b/readconf.c
@@ -174,9 +174,11 @@ add_local_forward(Options *options, u_short port, const char *host,
 		  u_short host_port)
 {
 	Forward *fwd;
+#ifndef HAVE_CYGWIN
 	extern uid_t original_real_uid;
 	if (port < IPPORT_RESERVED && original_real_uid != 0)
 		fatal("Privileged ports can only be forwarded by root.\n");
+#endif
 	if (options->num_local_forwards >= SSH_MAX_FORWARDS_PER_DIRECTION)
 		fatal("Too many local forwards (max %d).", SSH_MAX_FORWARDS_PER_DIRECTION);
 	fwd = &options->local_forwards[options->num_local_forwards++];
diff --git a/scp.c b/scp.c
index 33bd0a5ff..23ecc41ca 100644
--- a/scp.c
+++ b/scp.c
@@ -1117,8 +1117,17 @@ foregroundproc()
 	if (pgrp == -1)
 		pgrp = getpgrp();
 
+#ifdef HAVE_CYGWIN
+	/*
+	 * Cygwin only supports tcgetpgrp() for getting the controlling tty
+         * currently.
+	 */
+	return ((ctty_pgrp = tcgetpgrp(STDOUT_FILENO)) != -1 &&
+		ctty_pgrp == pgrp);
+#else
 	return ((ioctl(STDOUT_FILENO, TIOCGPGRP, &ctty_pgrp) != -1 &&
 		 ctty_pgrp == pgrp));
+#endif
 }
 
 void
diff --git a/session.c b/session.c
index d5faf4cf3..a537efdd4 100644
--- a/session.c
+++ b/session.c
@@ -41,6 +41,12 @@ RCSID("$OpenBSD: session.c,v 1.35 2000/09/04 19:07:21 markus Exp $");
 # include <siad.h>
 #endif
 
+#ifdef HAVE_CYGWIN
+#include <windows.h>
+#include <sys/cygwin.h>
+#define is_winnt       (GetVersion() < 0x80000000)
+#endif
+
 /* AIX limits */
 #if defined(HAVE_GETUSERATTR) && !defined(S_UFSIZE_HARD) && defined(S_UFSIZE)
 # define S_UFSIZE_HARD  S_UFSIZE "_hard"
@@ -503,6 +509,10 @@ do_exec_no_pty(Session *s, const char *command, struct passwd * pw)
 		do_child(command, pw, NULL, s->display, s->auth_proto, s->auth_data, NULL);
 		/* NOTREACHED */
 	}
+#ifdef HAVE_CYGWIN
+	if (is_winnt)
+		cygwin_set_impersonation_token(INVALID_HANDLE_VALUE);
+#endif
 	if (pid < 0)
 		packet_disconnect("fork failed: %.100s", strerror(errno));
 	s->pid = pid;
@@ -594,6 +604,10 @@ do_exec_pty(Session *s, const char *command, struct passwd * pw)
 		    s->auth_data, s->tty);
 		/* NOTREACHED */
 	}
+#ifdef HAVE_CYGWIN
+	if (is_winnt)
+		cygwin_set_impersonation_token(INVALID_HANDLE_VALUE);
+#endif
 	if (pid < 0)
 		packet_disconnect("fork failed: %.100s", strerror(errno));
 	s->pid = pid;
@@ -973,7 +987,11 @@ do_child(const char *command, struct passwd * pw, const char *term,
 			exit(1);
 		}
 #else /* HAVE_OSF_SIA */
+#ifdef HAVE_CYGWIN
+		if (is_winnt) {
+#else
 		if (getuid() == 0 || geteuid() == 0) {
+#endif
 # ifdef HAVE_GETUSERATTR
 			set_limits_from_userattr(pw->pw_name);
 # endif /* HAVE_GETUSERATTR */
@@ -1018,6 +1036,9 @@ do_child(const char *command, struct passwd * pw, const char *term,
 		}
 #endif /* HAVE_OSF_SIA */
 
+#ifdef HAVE_CYGWIN
+		if (is_winnt)
+#endif
 		if (getuid() != pw->pw_uid || geteuid() != pw->pw_uid)
 			fatal("Failed to set uids to %u.", (u_int) pw->pw_uid);
 	}
@@ -1047,6 +1068,22 @@ do_child(const char *command, struct passwd * pw, const char *term,
 	env = xmalloc(envsize * sizeof(char *));
 	env[0] = NULL;
 
+#ifdef HAVE_CYGWIN
+	/*
+	 * The Windows environment contains some setting which are
+	 * important for a running system. They must not be dropped.
+	 */
+	{
+		char **ep;
+		for (ep = environ; *ep; ++ep) {
+			char *esp = strchr(*ep, '=');
+			*esp = '\0';
+			child_set_env(&env, &envsize, *ep, esp + 1);
+			*esp = '=';
+		}
+	}
+#endif
+
 	if (!options.use_login) {
 		/* Set basic environment. */
 		child_set_env(&env, &envsize, "USER", pw->pw_name);
@@ -1056,8 +1093,16 @@ do_child(const char *command, struct passwd * pw, const char *term,
 		(void) setusercontext(lc, pw, pw->pw_uid, LOGIN_SETPATH);
 		child_set_env(&env, &envsize, "PATH", getenv("PATH"));
 #else
+#ifndef HAVE_CYGWIN
+		/*
+		 * There's no standard path on Windows. The path contains
+		 * important components pointing to the system directories,
+		 * needed for loading shared libraries. So the path better
+		 * remains intact here.
+		 */
 		child_set_env(&env, &envsize, "PATH", _PATH_STDPATH);
 #endif
+#endif
 
 		snprintf(buf, sizeof buf, "%.200s/%.50s",
 			 _PATH_MAILDIR, pw->pw_name);
@@ -1234,11 +1279,13 @@ do_child(const char *command, struct passwd * pw, const char *term,
 					    "Running %.100s add %.100s %.100s %.100s\n",
 					    options.xauth_location, display,
 					    auth_proto, auth_data);
+#ifndef HAVE_CYGWIN
 					if (screen != NULL)
 						fprintf(stderr,
 						    "Adding %.*s/unix%s %s %s\n",
 						    (int)(screen-display), display,
 						    screen, auth_proto, auth_data);
+#endif
 				}
 				snprintf(cmd, sizeof cmd, "%s -q -",
 				    options.xauth_location);
@@ -1246,10 +1293,12 @@ do_child(const char *command, struct passwd * pw, const char *term,
 				if (f) {
 					fprintf(f, "add %s %s %s\n", display,
 					    auth_proto, auth_data);
+#ifndef HAVE_CYGWIN
 					if (screen != NULL) 
 						fprintf(f, "add %.*s/unix%s %s %s\n",
 						    (int)(screen-display), display,
 						    screen, auth_proto, auth_data);
+#endif
 					pclose(f);
 				} else {
 					fprintf(stderr, "Could not run %s\n",
diff --git a/ssh.c b/ssh.c
index 71d8f96fe..c117ad5ed 100644
--- a/ssh.c
+++ b/ssh.c
@@ -215,6 +215,7 @@ main(int ac, char **av)
 	original_real_uid = getuid();
 	original_effective_uid = geteuid();
 
+#ifndef HAVE_CYGWIN
 	/* If we are installed setuid root be careful to not drop core. */
 	if (original_real_uid != original_effective_uid) {
 		struct rlimit rlim;
@@ -222,6 +223,7 @@ main(int ac, char **av)
 		if (setrlimit(RLIMIT_CORE, &rlim) < 0)
 			fatal("setrlimit failed: %.100s", strerror(errno));
 	}
+#endif
 	/*
 	 * Use uid-swapping to give up root privileges for the duration of
 	 * option processing.  We will re-instantiate the rights when we are
@@ -253,8 +255,17 @@ main(int ac, char **av)
 		cp = strrchr(av0, '/') + 1;
 	else
 		cp = av0;
+#ifdef HAVE_CYGWIN
+	if (strcasecmp(cp, "rsh") && strcasecmp(cp, "ssh") &&
+	    strcasecmp(cp, "rlogin") && strcasecmp(cp, "slogin") &&
+	    strcasecmp(cp, "remsh") &&
+	    strcasecmp(cp, "rsh.exe") && strcasecmp(cp, "ssh.exe") &&
+	    strcasecmp(cp, "rlogin.exe") && strcasecmp(cp, "slogin.exe") &&
+	    strcasecmp(cp, "remsh.exe"))
+#else
 	if (strcmp(cp, "rsh") && strcmp(cp, "ssh") && strcmp(cp, "rlogin") &&
 	    strcmp(cp, "slogin") && strcmp(cp, "remsh"))
+#endif
 		host = cp;
 
 	for (optind = 1; optind < ac; optind++) {
@@ -551,7 +562,12 @@ main(int ac, char **av)
 		}
 	}
 	/* Disable rhosts authentication if not running as root. */
+#ifdef HAVE_CYGWIN
+	/* Ignore uid if running under Windows */
+	if (!options.use_privileged_port) {
+#else
 	if (original_effective_uid != 0 || !options.use_privileged_port) {
+#endif
 		options.rhosts_authentication = 0;
 		options.rhosts_rsa_authentication = 0;
 	}
diff --git a/sshconnect.c b/sshconnect.c
index 21eff6c6b..7c47ebe94 100644
--- a/sshconnect.c
+++ b/sshconnect.c
@@ -243,7 +243,11 @@ ssh_connect(const char *host, struct sockaddr_storage * hostaddr,
 
 			/* Create a socket for connecting. */
 			sock = ssh_create_socket(original_real_uid,
+#ifdef HAVE_CYGWIN
+			    !anonymous && port < IPPORT_RESERVED,
+#else
 			    !anonymous && geteuid() == 0 && port < IPPORT_RESERVED,
+#endif
 			    ai->ai_family);
 			if (sock < 0)
 				continue;
diff --git a/sshd.c b/sshd.c
index e3903c783..f01df902a 100644
--- a/sshd.c
+++ b/sshd.c
@@ -765,7 +765,7 @@ main(int ac, char **av)
 			 * fail if there already is a daemon, and this will
 			 * overwrite any old pid in the file.
 			 */
-			f = fopen(options.pid_file, "w");
+			f = fopen(options.pid_file, "wb");
 			if (f) {
 				fprintf(f, "%u\n", (unsigned int) getpid());
 				fclose(f);