pool/openssh
SHA256
2
0
Fork 1
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Accepting request 222365 from home:pcerny:factory

Browse Source 
- Update of the underlying OpenSSH to 6.5p1

- Update to 6.5p1
  Features since 6.4p1:
  * ssh(1), sshd(8): support for key exchange using ECDH in
    Daniel Bernstein's Curve25519; default when both the client
    and server support it.
  * ssh(1), sshd(8): support for Ed25519 as a public key type fo
    rboth server and client.  Ed25519 is an EC signature offering
    better security than ECDSA and DSA and good performance.
  * Add a new private key format that uses a bcrypt KDF to better
    protect keys at rest. Used unconditionally for Ed25519 keys,
    on demand for other key types via the -o ssh-keygen(1)
    option.  Intended to become default in the near future.
    Details documented in PROTOCOL.key.
  * ssh(1), sshd(8): new transport cipher
    "chacha20-poly1305@openssh.com" combining Daniel Bernstein's
    ChaCha20 stream cipher and Poly1305 MAC to build an
    authenticated encryption mode. Details documented
    PROTOCOL.chacha20poly1305.
  * ssh(1), sshd(8): refuse RSA keys from old proprietary clients
    and servers that use the obsolete RSA+MD5 signature scheme.
    It will still be possible to connect with these
    clients/servers but only DSA keys will be accepted, and
    OpenSSH will refuse connection entirely in a future release.
  * ssh(1), sshd(8): refuse old proprietary clients and servers
    that use a weaker key exchange hash calculation.
  * ssh(1): increase the size of the Diffie-Hellman groups
    requested for each symmetric key size. New values from NIST
    Special Publication 800-57 with the upper limit specified by

OBS-URL: https://build.opensuse.org/request/show/222365
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=63
This commit is contained in:
Petr Cerny 2014-02-14 14:54:10 +00:00 committed by Git OBS Bridge
parent b189026b63
commit 08f9072513
44 changed files with 1171 additions and 1002 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

81
openssh-6.4p1-forcepermissions.patch
View File

@ -1,81 +0,0 @@
Index: openssh-6.4p1/sftp-server.8
===================================================================
--- openssh-6.4p1.orig/sftp-server.8
+++ openssh-6.4p1/sftp-server.8
@@ -35,6 +35,7 @@
.Op Fl f Ar log_facility
.Op Fl l Ar log_level
.Op Fl u Ar umask
+.Op Fl m Ar force_file_permissions
.Sh DESCRIPTION
.Nm
is a program that speaks the server side of SFTP protocol
@@ -104,6 +105,10 @@ Sets an explicit
.Xr umask 2
to be applied to newly-created files and directories, instead of the
user's default mask.
+.It Fl m Ar force_file_permissions
+Sets explicit file permissions to be applied to newly-created files instead
+of the default or client requested mode. Numeric values include:
+777, 755, 750, 666, 644, 640, etc. Option -u is ineffective if -m is set.
.El
.Pp
For logging to work,
Index: openssh-6.4p1/sftp-server.c
===================================================================
--- openssh-6.4p1.orig/sftp-server.c
+++ openssh-6.4p1/sftp-server.c
@@ -73,6 +73,10 @@ u_int version;
/* Disable writes */
int readonly;
+/* Force file permissions */
+int permforce = 0;
+long permforcemode;
+
/* portable attributes, etc. */
typedef struct Stat Stat;
@@ -557,6 +561,10 @@ process_open(void)
a = get_attrib();
flags = flags_from_portable(pflags);
mode = (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? a->perm : 0666;
+ if (permforce == 1) {
+ mode = permforcemode;
+ (void)umask(0); /* so umask does not interfere */
+ }
logit("open \"%s\" flags %s mode 0%o",
name, string_from_portable(pflags), mode);
if (readonly &&
@@ -1391,7 +1399,7 @@ sftp_server_usage(void)
fprintf(stderr,
"usage: %s [-ehR] [-d start_directory] [-f log_facility] "
- "[-l log_level]\n\t[-u umask]\n",
+ "[-l log_level]\n\t[-u umask]\n[-m force_file_permissions]\n",
__progname);
exit(1);
}
@@ -1414,7 +1422,7 @@ sftp_server_main(int argc, char **argv,
pw = pwcopy(user_pw);
- while (!skipargs && (ch = getopt(argc, argv, "d:f:l:u:cehR")) != -1) {
+ while (!skipargs && (ch = getopt(argc, argv, "d:f:l:u:m:cehR")) != -1) {
switch (ch) {
case 'R':
readonly = 1;
@@ -1453,6 +1461,13 @@ sftp_server_main(int argc, char **argv,
fatal("Invalid umask \"%s\"", optarg);
(void)umask((mode_t)mask);
break;
+ case 'm':
+ permforce = 1;
+ permforcemode = strtol(optarg, &cp, 8);
+ if (permforcemode < 0 || permforcemode > 0777 || *cp != '\0' ||
+ cp == optarg || (permforcemode == 0 && errno != 0))
+ fatal("Invalid umask \"%s\"", optarg);
+ break;
case 'h':
default:
sftp_server_usage();

46
openssh-6.4p1-saveargv-fix.patch
View File

@ -1,46 +0,0 @@
# related to bnc#49845, upstream bug #529
diff --git a/openssh-6.4p1/sshd.c b/openssh-6.4p1/sshd.c
--- a/openssh-6.4p1/sshd.c
+++ b/openssh-6.4p1/sshd.c
@@ -309,16 +309,17 @@ sighup_handler(int sig)
/*
* Called from the main program after receiving SIGHUP.
* Restarts the server.
*/
static void
sighup_restart(void)
{
+ int i;
logit("Received SIGHUP; restarting.");
close_listen_socks();
close_startup_pipes();
alarm(0); /* alarm timer persists across exec */
signal(SIGHUP, SIG_IGN); /* will be restored after exec */
execv(saved_argv[0], saved_argv);
logit("RESTART FAILED: av[0]='%.100s', error: %.100s.", saved_argv[0],
strerror(errno));
@@ -1382,17 +1383,21 @@ main(int ac, char **av)
saved_argv = xcalloc(ac + 1, sizeof(*saved_argv));
for (i = 0; i < ac; i++)
saved_argv[i] = xstrdup(av[i]);
saved_argv[i] = NULL;
#ifndef HAVE_SETPROCTITLE
/* Prepare for later setproctitle emulation */
compat_init_setproctitle(ac, av);
- av = saved_argv;
+
+ av = xmalloc(sizeof(*saved_argv) * (saved_argc + 1));
+ for (i = 0; i < saved_argc; i++)
+ av[i] = xstrdup(saved_argv[i]);
+ av[i] = NULL;
#endif
if (geteuid() == 0 && setgroups(0, NULL) == -1)
debug("setgroups(): %.200s", strerror(errno));
/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
sanitise_stdfd();

3
openssh-6.4p1.tar.gz
View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:5530f616513b14aea3662c4c373bafd6a97a269938674c006377e381f68975d2
size 1201402

16
openssh-6.4p1-X11-forwarding.patch → openssh-6.5p1-X11-forwarding.patch
View File

@ -2,9 +2,9 @@
# configuration # configuration
# bnc#50836 (was suse #35836) # bnc#50836 (was suse #35836)
diff --git a/openssh-6.4p1/ssh_config b/openssh-6.4p1/ssh_config diff --git a/openssh-6.5p1/ssh_config b/openssh-6.5p1/ssh_config
--- a/openssh-6.4p1/ssh_config --- a/openssh-6.5p1/ssh_config
+++ b/openssh-6.4p1/ssh_config +++ b/openssh-6.5p1/ssh_config
@@ -12,19 +12,30 @@ @@ -12,19 +12,30 @@
# Any configuration value is only changed the first time it is set. # Any configuration value is only changed the first time it is set.
# Thus, host-specific definitions should be at the beginning of the # Thus, host-specific definitions should be at the beginning of the
@ -37,10 +37,10 @@ diff --git a/openssh-6.4p1/ssh_config b/openssh-6.4p1/ssh_config
# GSSAPIDelegateCredentials no # GSSAPIDelegateCredentials no
# BatchMode no # BatchMode no
# CheckHostIP yes # CheckHostIP yes
diff --git a/openssh-6.4p1/sshd_config b/openssh-6.4p1/sshd_config diff --git a/openssh-6.5p1/sshd_config b/openssh-6.5p1/sshd_config
--- a/openssh-6.4p1/sshd_config --- a/openssh-6.5p1/sshd_config
+++ b/openssh-6.4p1/sshd_config +++ b/openssh-6.5p1/sshd_config
@@ -93,17 +93,17 @@ AuthorizedKeysFile .ssh/authorized_keys @@ -94,17 +94,17 @@ AuthorizedKeysFile .ssh/authorized_keys
# If you just want the PAM account and session checks to run without # If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication # PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'. # and ChallengeResponseAuthentication to 'no'.
@ -53,9 +53,9 @@ diff --git a/openssh-6.4p1/sshd_config b/openssh-6.4p1/sshd_config
+X11Forwarding yes +X11Forwarding yes
#X11DisplayOffset 10 #X11DisplayOffset 10
#X11UseLocalhost yes #X11UseLocalhost yes
#PermitTTY yes
#PrintMotd yes #PrintMotd yes
#PrintLastLog yes #PrintLastLog yes
#TCPKeepAlive yes #TCPKeepAlive yes
#UseLogin no #UseLogin no
UsePrivilegeSeparation sandbox # Default for new installations. UsePrivilegeSeparation sandbox # Default for new installations.
#PermitUserEnvironment no

6
openssh-6.4p1-audit1-remove_duplicit_audit.patch → openssh-6.5p1-audit1-remove_duplicit_audit.patch
View File

@ -8,9 +8,9 @@
# #
# PRIVSEP(getpwnamallow()) a few lines above already did this. # PRIVSEP(getpwnamallow()) a few lines above already did this.
diff --git a/openssh-6.4p1/auth2.c b/openssh-6.4p1/auth2.c diff --git a/openssh-6.5p1/auth2.c b/openssh-6.5p1/auth2.c
--- a/openssh-6.4p1/auth2.c --- a/openssh-6.5p1/auth2.c
+++ b/openssh-6.4p1/auth2.c +++ b/openssh-6.5p1/auth2.c
@@ -242,19 +242,16 @@ input_userauth_request(int type, u_int32 @@ -242,19 +242,16 @@ input_userauth_request(int type, u_int32
authctxt->pw = PRIVSEP(getpwnamallow(user)); authctxt->pw = PRIVSEP(getpwnamallow(user));
authctxt->user = xstrdup(user); authctxt->user = xstrdup(user);

100
openssh-6.4p1-audit2-better_audit_of_user_actions.patch → openssh-6.5p1-audit2-better_audit_of_user_actions.patch
View File

@ -4,9 +4,9 @@
# https://bugzilla.mindrot.org/attachment.cgi?id=2011 # https://bugzilla.mindrot.org/attachment.cgi?id=2011
# by jchadima@redhat.com # by jchadima@redhat.com
diff --git a/openssh-6.4p1/audit-bsm.c b/openssh-6.4p1/audit-bsm.c diff --git a/openssh-6.5p1/audit-bsm.c b/openssh-6.5p1/audit-bsm.c
--- a/openssh-6.4p1/audit-bsm.c --- a/openssh-6.5p1/audit-bsm.c
+++ b/openssh-6.4p1/audit-bsm.c +++ b/openssh-6.5p1/audit-bsm.c
@@ -370,20 +370,33 @@ audit_connection_from(const char *host, @@ -370,20 +370,33 @@ audit_connection_from(const char *host,
/* this is used on IPv4-only machines */ /* this is used on IPv4-only machines */
tid->port = (dev_t)port; tid->port = (dev_t)port;
@ -42,9 +42,9 @@ diff --git a/openssh-6.4p1/audit-bsm.c b/openssh-6.4p1/audit-bsm.c
/* not implemented */ /* not implemented */
} }
diff --git a/openssh-6.4p1/audit-linux.c b/openssh-6.4p1/audit-linux.c diff --git a/openssh-6.5p1/audit-linux.c b/openssh-6.5p1/audit-linux.c
--- a/openssh-6.4p1/audit-linux.c --- a/openssh-6.5p1/audit-linux.c
+++ b/openssh-6.4p1/audit-linux.c +++ b/openssh-6.5p1/audit-linux.c
@@ -30,97 +30,210 @@ @@ -30,97 +30,210 @@
#include "includes.h" #include "includes.h"
#if defined(USE_LINUX_AUDIT) #if defined(USE_LINUX_AUDIT)
@ -276,9 +276,9 @@ diff --git a/openssh-6.4p1/audit-linux.c b/openssh-6.4p1/audit-linux.c
} }
#endif /* USE_LINUX_AUDIT */ #endif /* USE_LINUX_AUDIT */
diff --git a/openssh-6.4p1/audit.c b/openssh-6.4p1/audit.c diff --git a/openssh-6.5p1/audit.c b/openssh-6.5p1/audit.c
--- a/openssh-6.4p1/audit.c --- a/openssh-6.5p1/audit.c
+++ b/openssh-6.4p1/audit.c +++ b/openssh-6.5p1/audit.c
@@ -135,16 +135,27 @@ audit_connection_from(const char *host, @@ -135,16 +135,27 @@ audit_connection_from(const char *host,
void void
audit_event(ssh_audit_event_t event) audit_event(ssh_audit_event_t event)
@ -344,9 +344,9 @@ diff --git a/openssh-6.4p1/audit.c b/openssh-6.4p1/audit.c
+ +
# endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */ # endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */
#endif /* SSH_AUDIT_EVENTS */ #endif /* SSH_AUDIT_EVENTS */
diff --git a/openssh-6.4p1/audit.h b/openssh-6.4p1/audit.h diff --git a/openssh-6.5p1/audit.h b/openssh-6.5p1/audit.h
--- a/openssh-6.4p1/audit.h --- a/openssh-6.5p1/audit.h
+++ b/openssh-6.4p1/audit.h +++ b/openssh-6.5p1/audit.h
@@ -44,14 +44,16 @@ enum ssh_audit_event_type { @@ -44,14 +44,16 @@ enum ssh_audit_event_type {
SSH_CONNECTION_CLOSE, /* closed after attempting auth or session */ SSH_CONNECTION_CLOSE, /* closed after attempting auth or session */
SSH_CONNECTION_ABANDON, /* closed without completing auth */ SSH_CONNECTION_ABANDON, /* closed without completing auth */
@ -365,9 +365,9 @@ diff --git a/openssh-6.4p1/audit.h b/openssh-6.4p1/audit.h
ssh_audit_event_t audit_classify_auth(const char *); ssh_audit_event_t audit_classify_auth(const char *);
#endif /* _SSH_AUDIT_H */ #endif /* _SSH_AUDIT_H */
diff --git a/openssh-6.4p1/monitor.c b/openssh-6.4p1/monitor.c diff --git a/openssh-6.5p1/monitor.c b/openssh-6.5p1/monitor.c
--- a/openssh-6.4p1/monitor.c --- a/openssh-6.5p1/monitor.c
+++ b/openssh-6.4p1/monitor.c +++ b/openssh-6.5p1/monitor.c
@@ -181,16 +181,17 @@ int mm_answer_gss_setup_ctx(int, Buffer @@ -181,16 +181,17 @@ int mm_answer_gss_setup_ctx(int, Buffer
int mm_answer_gss_accept_ctx(int, Buffer *); int mm_answer_gss_accept_ctx(int, Buffer *);
int mm_answer_gss_userok(int, Buffer *); int mm_answer_gss_userok(int, Buffer *);
@ -500,9 +500,9 @@ diff --git a/openssh-6.4p1/monitor.c b/openssh-6.4p1/monitor.c
void void
monitor_apply_keystate(struct monitor *pmonitor) monitor_apply_keystate(struct monitor *pmonitor)
{ {
diff --git a/openssh-6.4p1/monitor.h b/openssh-6.4p1/monitor.h diff --git a/openssh-6.5p1/monitor.h b/openssh-6.5p1/monitor.h
--- a/openssh-6.4p1/monitor.h --- a/openssh-6.5p1/monitor.h
+++ b/openssh-6.4p1/monitor.h +++ b/openssh-6.5p1/monitor.h
@@ -64,16 +64,17 @@ enum monitor_reqtype { @@ -64,16 +64,17 @@ enum monitor_reqtype {
MONITOR_REQ_PAM_START = 100, MONITOR_REQ_PAM_START = 100,
@ -521,9 +521,9 @@ diff --git a/openssh-6.4p1/monitor.h b/openssh-6.4p1/monitor.h
int m_recvfd; int m_recvfd;
int m_sendfd; int m_sendfd;
int m_log_recvfd; int m_log_recvfd;
diff --git a/openssh-6.4p1/monitor_wrap.c b/openssh-6.4p1/monitor_wrap.c diff --git a/openssh-6.5p1/monitor_wrap.c b/openssh-6.5p1/monitor_wrap.c
--- a/openssh-6.4p1/monitor_wrap.c --- a/openssh-6.5p1/monitor_wrap.c
+++ b/openssh-6.4p1/monitor_wrap.c +++ b/openssh-6.5p1/monitor_wrap.c
@@ -1186,27 +1186,48 @@ mm_audit_event(ssh_audit_event_t event) @@ -1186,27 +1186,48 @@ mm_audit_event(ssh_audit_event_t event)
buffer_init(&m); buffer_init(&m);
@ -574,9 +574,9 @@ diff --git a/openssh-6.4p1/monitor_wrap.c b/openssh-6.4p1/monitor_wrap.c
OM_uint32 OM_uint32
mm_ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID goid) mm_ssh_gssapi_server_ctx(Gssctxt **ctx, gss_OID goid)
{ {
diff --git a/openssh-6.4p1/monitor_wrap.h b/openssh-6.4p1/monitor_wrap.h diff --git a/openssh-6.5p1/monitor_wrap.h b/openssh-6.5p1/monitor_wrap.h
--- a/openssh-6.4p1/monitor_wrap.h --- a/openssh-6.5p1/monitor_wrap.h
+++ b/openssh-6.4p1/monitor_wrap.h +++ b/openssh-6.5p1/monitor_wrap.h
@@ -69,17 +69,18 @@ void *mm_sshpam_init_ctx(struct Authctxt @@ -69,17 +69,18 @@ void *mm_sshpam_init_ctx(struct Authctxt
int mm_sshpam_query(void *, char **, char **, u_int *, char ***, u_int **); int mm_sshpam_query(void *, char **, char **, u_int *, char ***, u_int **);
int mm_sshpam_respond(void *, u_int, char **); int mm_sshpam_respond(void *, u_int, char **);
@ -597,9 +597,9 @@ diff --git a/openssh-6.4p1/monitor_wrap.h b/openssh-6.4p1/monitor_wrap.h
void mm_session_pty_cleanup2(struct Session *); void mm_session_pty_cleanup2(struct Session *);
/* SSHv1 interfaces */ /* SSHv1 interfaces */
diff --git a/openssh-6.4p1/session.c b/openssh-6.4p1/session.c diff --git a/openssh-6.5p1/session.c b/openssh-6.5p1/session.c
--- a/openssh-6.4p1/session.c --- a/openssh-6.5p1/session.c
+++ b/openssh-6.4p1/session.c +++ b/openssh-6.5p1/session.c
@@ -740,16 +740,24 @@ do_exec_pty(Session *s, const char *comm @@ -740,16 +740,24 @@ do_exec_pty(Session *s, const char *comm
cygwin_set_impersonation_token(INVALID_HANDLE_VALUE); cygwin_set_impersonation_token(INVALID_HANDLE_VALUE);
#endif #endif
@ -625,13 +625,13 @@ diff --git a/openssh-6.4p1/session.c b/openssh-6.4p1/session.c
session_set_fds(s, ptyfd, fdout, -1, 1, 1); session_set_fds(s, ptyfd, fdout, -1, 1, 1);
} else { } else {
server_loop(pid, ptyfd, fdout, -1); server_loop(pid, ptyfd, fdout, -1);
@@ -811,25 +819,29 @@ do_exec(Session *s, const char *command) @@ -834,25 +842,29 @@ do_exec(Session *s, const char *command)
s->is_subsystem = s->is_subsystem ? session_type,
SUBSYSTEM_INT_SFTP : SUBSYSTEM_INT_SFTP_ERROR; tty == NULL ? "" : " on ",
} else if (s->is_subsystem) tty == NULL ? "" : tty,
s->is_subsystem = SUBSYSTEM_EXT; s->pw->pw_name,
debug("Forced command (key option) '%.900s'", command); get_remote_ipaddr(),
} get_remote_port());
#ifdef SSH_AUDIT_EVENTS #ifdef SSH_AUDIT_EVENTS
+ if (s->command != NULL || s->command_handle != -1) + if (s->command != NULL || s->command_handle != -1)
@ -657,7 +657,7 @@ diff --git a/openssh-6.4p1/session.c b/openssh-6.4p1/session.c
original_command = NULL; original_command = NULL;
@@ -1875,16 +1887,17 @@ session_unused(int id) @@ -1903,16 +1915,17 @@ session_unused(int id)
bzero(&sessions[id], sizeof(*sessions)); bzero(&sessions[id], sizeof(*sessions));
sessions[id].self = id; sessions[id].self = id;
sessions[id].used = 0; sessions[id].used = 0;
@ -675,7 +675,7 @@ diff --git a/openssh-6.4p1/session.c b/openssh-6.4p1/session.c
session_new(void) session_new(void)
{ {
Session *s, *tmp; Session *s, *tmp;
@@ -1957,16 +1970,29 @@ session_open(Authctxt *authctxt, int cha @@ -1985,16 +1998,29 @@ session_open(Authctxt *authctxt, int cha
if (s->pw == NULL || !authctxt->valid) if (s->pw == NULL || !authctxt->valid)
fatal("no user for session %d", s->self); fatal("no user for session %d", s->self);
debug("session_open: session %d: link with channel %d", s->self, chanid); debug("session_open: session %d: link with channel %d", s->self, chanid);
@ -705,7 +705,7 @@ diff --git a/openssh-6.4p1/session.c b/openssh-6.4p1/session.c
if (s->used && s->ttyfd != -1 && strcmp(s->tty, tty) == 0) { if (s->used && s->ttyfd != -1 && strcmp(s->tty, tty) == 0) {
debug("session_by_tty: session %d tty %s", i, tty); debug("session_by_tty: session %d tty %s", i, tty);
return s; return s;
@@ -2473,16 +2499,40 @@ session_exit_message(Session *s, int sta @@ -2501,16 +2527,40 @@ session_exit_message(Session *s, int sta
* interested in data we write. * interested in data we write.
* Note that we must not call 'chan_read_failed', since there could * Note that we must not call 'chan_read_failed', since there could
* be some more data waiting in the pipe. * be some more data waiting in the pipe.
@ -746,7 +746,7 @@ diff --git a/openssh-6.4p1/session.c b/openssh-6.4p1/session.c
debug("session_close: session %d pid %ld", s->self, (long)s->pid); debug("session_close: session %d pid %ld", s->self, (long)s->pid);
@@ -2513,16 +2563,20 @@ session_close(Session *s) @@ -2541,16 +2591,20 @@ session_close(Session *s)
int status; int status;
waitpid(pid, &status, 0); waitpid(pid, &status, 0);
@ -765,9 +765,9 @@ diff --git a/openssh-6.4p1/session.c b/openssh-6.4p1/session.c
free(s->auth_display); free(s->auth_display);
free(s->auth_data); free(s->auth_data);
free(s->auth_proto); free(s->auth_proto);
free(s->subsys);
if (s->env != NULL) { if (s->env != NULL) {
for (i = 0; i < s->num_env; i++) { @@ -2755,16 +2809,25 @@ session_setup_x11fwd(Session *s)
@@ -2726,16 +2780,25 @@ session_setup_x11fwd(Session *s)
} }
static void static void
@ -793,7 +793,7 @@ diff --git a/openssh-6.4p1/session.c b/openssh-6.4p1/session.c
debug("do_cleanup"); debug("do_cleanup");
/* no cleanup if we're in the child for login shell */ /* no cleanup if we're in the child for login shell */
@@ -2774,10 +2837,10 @@ do_cleanup(Authctxt *authctxt) @@ -2803,10 +2866,10 @@ do_cleanup(Authctxt *authctxt)
/* remove agent socket */ /* remove agent socket */
auth_sock_cleanup_proc(authctxt->pw); auth_sock_cleanup_proc(authctxt->pw);
@ -805,13 +805,13 @@ diff --git a/openssh-6.4p1/session.c b/openssh-6.4p1/session.c
- session_destroy_all(session_pty_cleanup2); - session_destroy_all(session_pty_cleanup2);
+ session_destroy_all(do_cleanup_one_session); + session_destroy_all(do_cleanup_one_session);
} }
diff --git a/openssh-6.4p1/session.h b/openssh-6.4p1/session.h diff --git a/openssh-6.5p1/session.h b/openssh-6.5p1/session.h
--- a/openssh-6.4p1/session.h --- a/openssh-6.5p1/session.h
+++ b/openssh-6.4p1/session.h +++ b/openssh-6.5p1/session.h
@@ -55,29 +55,37 @@ struct Session { @@ -56,29 +56,37 @@ struct Session {
int chanid;
int *x11_chanids; int *x11_chanids;
int is_subsystem; int is_subsystem;
char *subsys;
u_int num_env; u_int num_env;
struct { struct {
char *name; char *name;
@ -846,10 +846,10 @@ diff --git a/openssh-6.4p1/session.h b/openssh-6.4p1/session.h
const char *value); const char *value);
#endif #endif
diff --git a/openssh-6.4p1/sshd.c b/openssh-6.4p1/sshd.c diff --git a/openssh-6.5p1/sshd.c b/openssh-6.5p1/sshd.c
--- a/openssh-6.4p1/sshd.c --- a/openssh-6.5p1/sshd.c
+++ b/openssh-6.4p1/sshd.c +++ b/openssh-6.5p1/sshd.c
@@ -2487,13 +2487,14 @@ cleanup_exit(int i) @@ -2504,13 +2504,14 @@ cleanup_exit(int i)
if (kill(pmonitor->m_pid, SIGKILL) != 0 && if (kill(pmonitor->m_pid, SIGKILL) != 0 &&
errno != ESRCH) errno != ESRCH)
error("%s: kill(%d): %s", __func__, error("%s: kill(%d): %s", __func__,

72
openssh-6.4p1-audit3-key_auth_usage.patch → openssh-6.5p1-audit3-key_auth_usage.patch
View File

@ -5,9 +5,9 @@
# (replaces: https://bugzilla.mindrot.org/attachment.cgi?id=1975) # (replaces: https://bugzilla.mindrot.org/attachment.cgi?id=1975)
# by jchadima@redhat.com # by jchadima@redhat.com
diff --git a/openssh-6.4p1/audit-bsm.c b/openssh-6.4p1/audit-bsm.c diff --git a/openssh-6.5p1/audit-bsm.c b/openssh-6.5p1/audit-bsm.c
--- a/openssh-6.4p1/audit-bsm.c --- a/openssh-6.5p1/audit-bsm.c
+++ b/openssh-6.4p1/audit-bsm.c +++ b/openssh-6.5p1/audit-bsm.c
@@ -401,16 +401,22 @@ audit_session_open(struct logininfo *li) @@ -401,16 +401,22 @@ audit_session_open(struct logininfo *li)
} }
@ -31,9 +31,9 @@ diff --git a/openssh-6.4p1/audit-bsm.c b/openssh-6.4p1/audit-bsm.c
const char *user = the_authctxt ? the_authctxt->user : "(unknown user)"; const char *user = the_authctxt ? the_authctxt->user : "(unknown user)";
if (cannot_audit(0)) if (cannot_audit(0))
diff --git a/openssh-6.4p1/audit-linux.c b/openssh-6.4p1/audit-linux.c diff --git a/openssh-6.5p1/audit-linux.c b/openssh-6.5p1/audit-linux.c
--- a/openssh-6.4p1/audit-linux.c --- a/openssh-6.5p1/audit-linux.c
+++ b/openssh-6.4p1/audit-linux.c +++ b/openssh-6.5p1/audit-linux.c
@@ -36,16 +36,18 @@ @@ -36,16 +36,18 @@
#include "log.h" #include "log.h"
#include "audit.h" #include "audit.h"
@ -101,9 +101,9 @@ diff --git a/openssh-6.4p1/audit-linux.c b/openssh-6.4p1/audit-linux.c
audit_connection_from(const char *host, int port) audit_connection_from(const char *host, int port)
{ {
/* not implemented */ /* not implemented */
diff --git a/openssh-6.4p1/audit.c b/openssh-6.4p1/audit.c diff --git a/openssh-6.5p1/audit.c b/openssh-6.5p1/audit.c
--- a/openssh-6.4p1/audit.c --- a/openssh-6.5p1/audit.c
+++ b/openssh-6.4p1/audit.c +++ b/openssh-6.5p1/audit.c
@@ -31,16 +31,17 @@ @@ -31,16 +31,17 @@
#ifdef SSH_AUDIT_EVENTS #ifdef SSH_AUDIT_EVENTS
@ -178,9 +178,9 @@ diff --git a/openssh-6.4p1/audit.c b/openssh-6.4p1/audit.c
+} +}
# endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */ # endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */
#endif /* SSH_AUDIT_EVENTS */ #endif /* SSH_AUDIT_EVENTS */
diff --git a/openssh-6.4p1/audit.h b/openssh-6.4p1/audit.h diff --git a/openssh-6.5p1/audit.h b/openssh-6.5p1/audit.h
--- a/openssh-6.4p1/audit.h --- a/openssh-6.5p1/audit.h
+++ b/openssh-6.4p1/audit.h +++ b/openssh-6.5p1/audit.h
@@ -23,16 +23,17 @@ @@ -23,16 +23,17 @@
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
@ -212,9 +212,9 @@ diff --git a/openssh-6.4p1/audit.h b/openssh-6.4p1/audit.h
+void audit_key(int, int *, const Key *); +void audit_key(int, int *, const Key *);
#endif /* _SSH_AUDIT_H */ #endif /* _SSH_AUDIT_H */
diff --git a/openssh-6.4p1/auth-rsa.c b/openssh-6.4p1/auth-rsa.c diff --git a/openssh-6.5p1/auth-rsa.c b/openssh-6.5p1/auth-rsa.c
--- a/openssh-6.4p1/auth-rsa.c --- a/openssh-6.5p1/auth-rsa.c
+++ b/openssh-6.4p1/auth-rsa.c +++ b/openssh-6.5p1/auth-rsa.c
@@ -87,17 +87,20 @@ auth_rsa_generate_challenge(Key *key) @@ -87,17 +87,20 @@ auth_rsa_generate_challenge(Key *key)
return challenge; return challenge;
} }
@ -271,9 +271,9 @@ diff --git a/openssh-6.4p1/auth-rsa.c b/openssh-6.4p1/auth-rsa.c
* our challenge; returns zero if the client gives a wrong answer. * our challenge; returns zero if the client gives a wrong answer.
*/ */
diff --git a/openssh-6.4p1/auth.h b/openssh-6.4p1/auth.h diff --git a/openssh-6.5p1/auth.h b/openssh-6.5p1/auth.h
--- a/openssh-6.4p1/auth.h --- a/openssh-6.5p1/auth.h
+++ b/openssh-6.4p1/auth.h +++ b/openssh-6.5p1/auth.h
@@ -182,16 +182,17 @@ int allowed_user(struct passwd *); @@ -182,16 +182,17 @@ int allowed_user(struct passwd *);
struct passwd * getpwnamallow(const char *user); struct passwd * getpwnamallow(const char *user);
@ -310,10 +310,10 @@ diff --git a/openssh-6.4p1/auth.h b/openssh-6.4p1/auth.h
struct passwd *fakepw(void); struct passwd *fakepw(void);
diff --git a/openssh-6.4p1/auth2-hostbased.c b/openssh-6.4p1/auth2-hostbased.c diff --git a/openssh-6.5p1/auth2-hostbased.c b/openssh-6.5p1/auth2-hostbased.c
--- a/openssh-6.4p1/auth2-hostbased.c --- a/openssh-6.5p1/auth2-hostbased.c
+++ b/openssh-6.4p1/auth2-hostbased.c +++ b/openssh-6.5p1/auth2-hostbased.c
@@ -118,33 +118,45 @@ userauth_hostbased(Authctxt *authctxt) @@ -124,33 +124,45 @@ userauth_hostbased(Authctxt *authctxt)
#endif #endif
pubkey_auth_info(authctxt, key, pubkey_auth_info(authctxt, key,
@ -360,10 +360,10 @@ diff --git a/openssh-6.4p1/auth2-hostbased.c b/openssh-6.4p1/auth2-hostbased.c
const char *resolvedname, *ipaddr, *lookup, *reason; const char *resolvedname, *ipaddr, *lookup, *reason;
HostStatus host_status; HostStatus host_status;
int len; int len;
diff --git a/openssh-6.4p1/auth2-pubkey.c b/openssh-6.4p1/auth2-pubkey.c diff --git a/openssh-6.5p1/auth2-pubkey.c b/openssh-6.5p1/auth2-pubkey.c
--- a/openssh-6.4p1/auth2-pubkey.c --- a/openssh-6.5p1/auth2-pubkey.c
+++ b/openssh-6.4p1/auth2-pubkey.c +++ b/openssh-6.5p1/auth2-pubkey.c
@@ -147,17 +147,17 @@ userauth_pubkey(Authctxt *authctxt) @@ -153,17 +153,17 @@ userauth_pubkey(Authctxt *authctxt)
#ifdef DEBUG_PK #ifdef DEBUG_PK
buffer_dump(&b); buffer_dump(&b);
#endif #endif
@ -382,7 +382,7 @@ diff --git a/openssh-6.4p1/auth2-pubkey.c b/openssh-6.4p1/auth2-pubkey.c
debug("test whether pkalg/pkblob are acceptable"); debug("test whether pkalg/pkblob are acceptable");
packet_check_eom(); packet_check_eom();
@@ -184,16 +184,28 @@ done: @@ -190,16 +190,28 @@ done:
debug2("userauth_pubkey: authenticated %d pkalg %s", authenticated, pkalg); debug2("userauth_pubkey: authenticated %d pkalg %s", authenticated, pkalg);
if (key != NULL) if (key != NULL)
key_free(key); key_free(key);
@ -411,9 +411,9 @@ diff --git a/openssh-6.4p1/auth2-pubkey.c b/openssh-6.4p1/auth2-pubkey.c
int i; int i;
extra = NULL; extra = NULL;
diff --git a/openssh-6.4p1/monitor.c b/openssh-6.4p1/monitor.c diff --git a/openssh-6.5p1/monitor.c b/openssh-6.5p1/monitor.c
--- a/openssh-6.4p1/monitor.c --- a/openssh-6.5p1/monitor.c
+++ b/openssh-6.4p1/monitor.c +++ b/openssh-6.5p1/monitor.c
@@ -1362,26 +1362,30 @@ monitor_valid_hostbasedblob(u_char *data @@ -1362,26 +1362,30 @@ monitor_valid_hostbasedblob(u_char *data
} }
@ -474,9 +474,9 @@ diff --git a/openssh-6.4p1/monitor.c b/openssh-6.4p1/monitor.c
free(signature); free(signature);
free(data); free(data);
diff --git a/openssh-6.4p1/monitor_wrap.c b/openssh-6.4p1/monitor_wrap.c diff --git a/openssh-6.5p1/monitor_wrap.c b/openssh-6.5p1/monitor_wrap.c
--- a/openssh-6.4p1/monitor_wrap.c --- a/openssh-6.5p1/monitor_wrap.c
+++ b/openssh-6.4p1/monitor_wrap.c +++ b/openssh-6.5p1/monitor_wrap.c
@@ -428,30 +428,31 @@ mm_key_allowed(enum mm_keytype type, cha @@ -428,30 +428,31 @@ mm_key_allowed(enum mm_keytype type, cha
/* /*
@ -540,9 +540,9 @@ diff --git a/openssh-6.4p1/monitor_wrap.c b/openssh-6.4p1/monitor_wrap.c
u_int len; u_int len;
Newkeys *newkey = NULL; Newkeys *newkey = NULL;
Enc *enc; Enc *enc;
diff --git a/openssh-6.4p1/monitor_wrap.h b/openssh-6.4p1/monitor_wrap.h diff --git a/openssh-6.5p1/monitor_wrap.h b/openssh-6.5p1/monitor_wrap.h
--- a/openssh-6.4p1/monitor_wrap.h --- a/openssh-6.5p1/monitor_wrap.h
+++ b/openssh-6.4p1/monitor_wrap.h +++ b/openssh-6.5p1/monitor_wrap.h
@@ -44,17 +44,18 @@ int mm_key_sign(Key *, u_char **, u_int @@ -44,17 +44,18 @@ int mm_key_sign(Key *, u_char **, u_int
void mm_inform_authserv(char *, char *); void mm_inform_authserv(char *, char *);
struct passwd *mm_getpwnamallow(const char *); struct passwd *mm_getpwnamallow(const char *);

125
openssh-6.4p1-audit4-kex_results.patch → openssh-6.5p1-audit4-kex_results.patch
View File

@ -5,20 +5,21 @@
# (replaces: https://bugzilla.mindrot.org/attachment.cgi?id=1976) # (replaces: https://bugzilla.mindrot.org/attachment.cgi?id=1976)
# by jchadima@redhat.com # by jchadima@redhat.com
diff --git a/openssh-6.4p1/Makefile.in b/openssh-6.4p1/Makefile.in diff --git a/openssh-6.5p1/Makefile.in b/openssh-6.5p1/Makefile.in
--- a/openssh-6.4p1/Makefile.in --- a/openssh-6.5p1/Makefile.in
+++ b/openssh-6.4p1/Makefile.in +++ b/openssh-6.5p1/Makefile.in
@@ -68,17 +68,17 @@ LIBSSH_OBJS=authfd.o authfile.o bufaux.o @@ -71,17 +71,18 @@ LIBSSH_OBJS=authfd.o authfile.o bufaux.o
cipher-bf1.o cipher-ctr.o cipher-3des1.o cleanup.o \
compat.o compress.o crc32.o deattack.o fatal.o hostfile.o \
log.o match.o md-sha256.o moduli.o nchan.o packet.o \
readpass.o rsa.o ttymodes.o xmalloc.o addrmatch.o \ readpass.o rsa.o ttymodes.o xmalloc.o addrmatch.o \
atomicio.o key.o dispatch.o kex.o mac.o uidswap.o uuencode.o misc.o \ atomicio.o key.o dispatch.o kex.o mac.o uidswap.o uuencode.o misc.o \
monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o \ monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o \
kexdh.o kexgex.o kexdhc.o kexgexc.o bufec.o kexecdh.o kexecdhc.o \ kexdh.o kexgex.o kexdhc.o kexgexc.o bufec.o kexecdh.o kexecdhc.o \
msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \ msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \
- jpake.o schnorr.o ssh-pkcs11.o krl.o jpake.o schnorr.o ssh-pkcs11.o krl.o smult_curve25519_ref.o \
+ jpake.o schnorr.o ssh-pkcs11.o krl.o auditstub.o kexc25519.o kexc25519c.o poly1305.o chacha.o cipher-chachapoly.o \
ssh-ed25519.o digest.o \
- sc25519.o ge25519.o fe25519.o ed25519.o verify.o hash.o blocks.o
+ sc25519.o ge25519.o fe25519.o ed25519.o verify.o hash.o blocks.o \
+ auditstub.o
SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \ SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
sshconnect.o sshconnect1.o sshconnect2.o mux.o \ sshconnect.o sshconnect1.o sshconnect2.o mux.o \
@ -27,9 +28,9 @@ diff --git a/openssh-6.4p1/Makefile.in b/openssh-6.4p1/Makefile.in
SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o \ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o \
audit.o audit-bsm.o audit-linux.o platform.o \ audit.o audit-bsm.o audit-linux.o platform.o \
sshpty.o sshlogin.o servconf.o serverloop.o \ sshpty.o sshlogin.o servconf.o serverloop.o \
diff --git a/openssh-6.4p1/audit-bsm.c b/openssh-6.4p1/audit-bsm.c diff --git a/openssh-6.5p1/audit-bsm.c b/openssh-6.5p1/audit-bsm.c
--- a/openssh-6.4p1/audit-bsm.c --- a/openssh-6.5p1/audit-bsm.c
+++ b/openssh-6.4p1/audit-bsm.c +++ b/openssh-6.5p1/audit-bsm.c
@@ -468,9 +468,21 @@ audit_event(ssh_audit_event_t event) @@ -468,9 +468,21 @@ audit_event(ssh_audit_event_t event)
case SSH_AUTH_FAIL_KBDINT: case SSH_AUTH_FAIL_KBDINT:
bsm_audit_bad_login("interactive password entry"); bsm_audit_bad_login("interactive password entry");
@ -52,9 +53,9 @@ diff --git a/openssh-6.4p1/audit-bsm.c b/openssh-6.4p1/audit-bsm.c
+ /* not implemented */ + /* not implemented */
+} +}
#endif /* BSM */ #endif /* BSM */
diff --git a/openssh-6.4p1/audit-linux.c b/openssh-6.4p1/audit-linux.c diff --git a/openssh-6.5p1/audit-linux.c b/openssh-6.5p1/audit-linux.c
--- a/openssh-6.4p1/audit-linux.c --- a/openssh-6.5p1/audit-linux.c
+++ b/openssh-6.4p1/audit-linux.c +++ b/openssh-6.5p1/audit-linux.c
@@ -35,16 +35,18 @@ @@ -35,16 +35,18 @@
#include "log.h" #include "log.h"
@ -140,9 +141,9 @@ diff --git a/openssh-6.4p1/audit-linux.c b/openssh-6.4p1/audit-linux.c
+} +}
+ +
#endif /* USE_LINUX_AUDIT */ #endif /* USE_LINUX_AUDIT */
diff --git a/openssh-6.4p1/audit.c b/openssh-6.4p1/audit.c diff --git a/openssh-6.5p1/audit.c b/openssh-6.5p1/audit.c
--- a/openssh-6.4p1/audit.c --- a/openssh-6.5p1/audit.c
+++ b/openssh-6.4p1/audit.c +++ b/openssh-6.5p1/audit.c
@@ -23,24 +23,27 @@ @@ -23,24 +23,27 @@
* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
@ -232,9 +233,9 @@ diff --git a/openssh-6.4p1/audit.c b/openssh-6.4p1/audit.c
+} +}
# endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */ # endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */
#endif /* SSH_AUDIT_EVENTS */ #endif /* SSH_AUDIT_EVENTS */
diff --git a/openssh-6.4p1/audit.h b/openssh-6.4p1/audit.h diff --git a/openssh-6.5p1/audit.h b/openssh-6.5p1/audit.h
--- a/openssh-6.4p1/audit.h --- a/openssh-6.5p1/audit.h
+++ b/openssh-6.4p1/audit.h +++ b/openssh-6.5p1/audit.h
@@ -53,10 +53,14 @@ void audit_event(ssh_audit_event_t); @@ -53,10 +53,14 @@ void audit_event(ssh_audit_event_t);
void audit_count_session_open(void); void audit_count_session_open(void);
void audit_session_open(struct logininfo *); void audit_session_open(struct logininfo *);
@ -250,10 +251,10 @@ diff --git a/openssh-6.4p1/audit.h b/openssh-6.4p1/audit.h
+void audit_kex_body(int, char *, char *, char *, pid_t, uid_t); +void audit_kex_body(int, char *, char *, char *, pid_t, uid_t);
#endif /* _SSH_AUDIT_H */ #endif /* _SSH_AUDIT_H */
diff --git a/openssh-6.4p1/auditstub.c b/openssh-6.4p1/auditstub.c diff --git a/openssh-6.5p1/auditstub.c b/openssh-6.5p1/auditstub.c
new file mode 100644 new file mode 100644
--- /dev/null --- /dev/null
+++ b/openssh-6.4p1/auditstub.c +++ b/openssh-6.5p1/auditstub.c
@@ -0,0 +1,39 @@ @@ -0,0 +1,39 @@
+/* $Id: auditstub.c,v 1.1 jfch Exp $ */ +/* $Id: auditstub.c,v 1.1 jfch Exp $ */
+ +
@ -294,10 +295,10 @@ new file mode 100644
+{ +{
+} +}
+ +
diff --git a/openssh-6.4p1/cipher.c b/openssh-6.4p1/cipher.c diff --git a/openssh-6.5p1/cipher.c b/openssh-6.5p1/cipher.c
--- a/openssh-6.4p1/cipher.c --- a/openssh-6.5p1/cipher.c
+++ b/openssh-6.4p1/cipher.c +++ b/openssh-6.5p1/cipher.c
@@ -50,29 +50,17 @@ @@ -52,31 +52,17 @@
/* compatibility with old or broken OpenSSL versions */ /* compatibility with old or broken OpenSSL versions */
#include "openbsd-compat/openssl-compat.h" #include "openbsd-compat/openssl-compat.h"
@ -314,7 +315,9 @@ diff --git a/openssh-6.4p1/cipher.c b/openssh-6.4p1/cipher.c
- u_int iv_len; /* defaults to block_size */ - u_int iv_len; /* defaults to block_size */
- u_int auth_len; - u_int auth_len;
- u_int discard_len; - u_int discard_len;
- u_int cbc_mode; - u_int flags;
-#define CFLAG_CBC (1<<0)
-#define CFLAG_CHACHAPOLY (1<<1)
- const EVP_CIPHER *(*evptype)(void); - const EVP_CIPHER *(*evptype)(void);
-}; -};
- -
@ -328,10 +331,10 @@ diff --git a/openssh-6.4p1/cipher.c b/openssh-6.4p1/cipher.c
{ "3des-cbc", SSH_CIPHER_SSH2, 8, 24, 0, 0, 0, 1, EVP_des_ede3_cbc }, { "3des-cbc", SSH_CIPHER_SSH2, 8, 24, 0, 0, 0, 1, EVP_des_ede3_cbc },
{ "blowfish-cbc", { "blowfish-cbc",
SSH_CIPHER_SSH2, 8, 16, 0, 0, 0, 1, EVP_bf_cbc }, SSH_CIPHER_SSH2, 8, 16, 0, 0, 0, 1, EVP_bf_cbc },
diff --git a/openssh-6.4p1/cipher.h b/openssh-6.4p1/cipher.h diff --git a/openssh-6.5p1/cipher.h b/openssh-6.5p1/cipher.h
--- a/openssh-6.4p1/cipher.h --- a/openssh-6.5p1/cipher.h
+++ b/openssh-6.4p1/cipher.h +++ b/openssh-6.5p1/cipher.h
@@ -56,17 +56,28 @@ @@ -58,17 +58,30 @@
#define SSH_CIPHER_MAX 31 #define SSH_CIPHER_MAX 31
#define CIPHER_ENCRYPT 1 #define CIPHER_ENCRYPT 1
@ -349,7 +352,9 @@ diff --git a/openssh-6.4p1/cipher.h b/openssh-6.4p1/cipher.h
+ u_int iv_len; /* defaults to block_size */ + u_int iv_len; /* defaults to block_size */
+ u_int auth_len; + u_int auth_len;
+ u_int discard_len; + u_int discard_len;
+ u_int cbc_mode; + u_int flags;
+#define CFLAG_CBC (1<<0)
+#define CFLAG_CHACHAPOLY (1<<1)
+ const EVP_CIPHER *(*evptype)(void); + const EVP_CIPHER *(*evptype)(void);
+}; +};
+ +
@ -357,15 +362,14 @@ diff --git a/openssh-6.4p1/cipher.h b/openssh-6.4p1/cipher.h
int plaintext; int plaintext;
int encrypt; int encrypt;
EVP_CIPHER_CTX evp; EVP_CIPHER_CTX evp;
struct chachapoly_ctx cp_ctx; /* XXX union with evp? */
const Cipher *cipher; const Cipher *cipher;
}; };
u_int cipher_mask_ssh1(int); diff --git a/openssh-6.5p1/kex.c b/openssh-6.5p1/kex.c
diff --git a/openssh-6.4p1/kex.c b/openssh-6.4p1/kex.c --- a/openssh-6.5p1/kex.c
--- a/openssh-6.4p1/kex.c +++ b/openssh-6.5p1/kex.c
+++ b/openssh-6.4p1/kex.c @@ -45,16 +45,17 @@
@@ -44,16 +44,17 @@
#include "key.h"
#include "kex.h" #include "kex.h"
#include "log.h" #include "log.h"
#include "mac.h" #include "mac.h"
@ -373,6 +377,7 @@ diff --git a/openssh-6.4p1/kex.c b/openssh-6.4p1/kex.c
#include "dispatch.h" #include "dispatch.h"
#include "monitor.h" #include "monitor.h"
#include "roaming.h" #include "roaming.h"
#include "digest.h"
+#include "audit.h" +#include "audit.h"
#if OPENSSL_VERSION_NUMBER >= 0x00907000L #if OPENSSL_VERSION_NUMBER >= 0x00907000L
@ -382,7 +387,7 @@ diff --git a/openssh-6.4p1/kex.c b/openssh-6.4p1/kex.c
extern const EVP_MD *evp_ssh_sha256(void); extern const EVP_MD *evp_ssh_sha256(void);
# endif # endif
#endif #endif
@@ -336,53 +337,65 @@ kex_kexinit_finish(Kex *kex) @@ -346,53 +347,65 @@ kex_kexinit_finish(Kex *kex)
fatal("Unsupported key exchange %d", kex->kex_type); fatal("Unsupported key exchange %d", kex->kex_type);
} }
} }
@ -451,7 +456,7 @@ diff --git a/openssh-6.4p1/kex.c b/openssh-6.4p1/kex.c
comp->type = COMP_NONE; comp->type = COMP_NONE;
} else { } else {
fatal("unsupported comp %s", name); fatal("unsupported comp %s", name);
@@ -487,16 +500,19 @@ kex_choose_conf(Kex *kex) @@ -497,16 +510,19 @@ kex_choose_conf(Kex *kex)
if (authlen == 0) if (authlen == 0)
choose_mac(&newkeys->mac, cprop[nmac], sprop[nmac]); choose_mac(&newkeys->mac, cprop[nmac], sprop[nmac]);
choose_comp(&newkeys->comp, cprop[ncomp], sprop[ncomp]); choose_comp(&newkeys->comp, cprop[ncomp], sprop[ncomp]);
@ -467,13 +472,13 @@ diff --git a/openssh-6.4p1/kex.c b/openssh-6.4p1/kex.c
choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]); choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]);
choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS], choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS],
sprop[PROPOSAL_SERVER_HOST_KEY_ALGS]); sprop[PROPOSAL_SERVER_HOST_KEY_ALGS]);
need = 0; need = dh_need = 0;
for (mode = 0; mode < MODE_MAX; mode++) { for (mode = 0; mode < MODE_MAX; mode++) {
newkeys = kex->newkeys[mode]; newkeys = kex->newkeys[mode];
if (need < newkeys->enc.key_len) need = MAX(need, newkeys->enc.key_len);
diff --git a/openssh-6.4p1/monitor.c b/openssh-6.4p1/monitor.c diff --git a/openssh-6.5p1/monitor.c b/openssh-6.5p1/monitor.c
--- a/openssh-6.4p1/monitor.c --- a/openssh-6.5p1/monitor.c
+++ b/openssh-6.4p1/monitor.c +++ b/openssh-6.5p1/monitor.c
@@ -93,16 +93,17 @@ @@ -93,16 +93,17 @@
#include "monitor_wrap.h" #include "monitor_wrap.h"
#include "monitor_fdpass.h" #include "monitor_fdpass.h"
@ -582,7 +587,7 @@ diff --git a/openssh-6.4p1/monitor.c b/openssh-6.4p1/monitor.c
/* Specifies if a certain message is allowed at the moment */ /* Specifies if a certain message is allowed at the moment */
@@ -2410,8 +2421,52 @@ mm_answer_jpake_check_confirm(int sock, @@ -2411,8 +2422,52 @@ mm_answer_jpake_check_confirm(int sock,
monitor_permit(mon_dispatch, MONITOR_REQ_JPAKE_STEP1, 1); monitor_permit(mon_dispatch, MONITOR_REQ_JPAKE_STEP1, 1);
@ -635,9 +640,9 @@ diff --git a/openssh-6.4p1/monitor.c b/openssh-6.4p1/monitor.c
+} +}
+ +
+#endif /* SSH_AUDIT_EVENTS */ +#endif /* SSH_AUDIT_EVENTS */
diff --git a/openssh-6.4p1/monitor.h b/openssh-6.4p1/monitor.h diff --git a/openssh-6.5p1/monitor.h b/openssh-6.5p1/monitor.h
--- a/openssh-6.4p1/monitor.h --- a/openssh-6.5p1/monitor.h
+++ b/openssh-6.4p1/monitor.h +++ b/openssh-6.5p1/monitor.h
@@ -65,16 +65,18 @@ enum monitor_reqtype { @@ -65,16 +65,18 @@ enum monitor_reqtype {
MONITOR_REQ_PAM_START = 100, MONITOR_REQ_PAM_START = 100,
MONITOR_REQ_PAM_ACCOUNT = 102, MONITOR_ANS_PAM_ACCOUNT = 103, MONITOR_REQ_PAM_ACCOUNT = 102, MONITOR_ANS_PAM_ACCOUNT = 103,
@ -657,9 +662,9 @@ diff --git a/openssh-6.4p1/monitor.h b/openssh-6.4p1/monitor.h
int m_recvfd; int m_recvfd;
int m_sendfd; int m_sendfd;
int m_log_recvfd; int m_log_recvfd;
diff --git a/openssh-6.4p1/monitor_wrap.c b/openssh-6.4p1/monitor_wrap.c diff --git a/openssh-6.5p1/monitor_wrap.c b/openssh-6.5p1/monitor_wrap.c
--- a/openssh-6.4p1/monitor_wrap.c --- a/openssh-6.5p1/monitor_wrap.c
+++ b/openssh-6.4p1/monitor_wrap.c +++ b/openssh-6.5p1/monitor_wrap.c
@@ -1483,8 +1483,46 @@ mm_jpake_check_confirm(const BIGNUM *k, @@ -1483,8 +1483,46 @@ mm_jpake_check_confirm(const BIGNUM *k,
success = buffer_get_int(&m); success = buffer_get_int(&m);
@ -707,9 +712,9 @@ diff --git a/openssh-6.4p1/monitor_wrap.c b/openssh-6.4p1/monitor_wrap.c
+ buffer_free(&m); + buffer_free(&m);
+} +}
+#endif /* SSH_AUDIT_EVENTS */ +#endif /* SSH_AUDIT_EVENTS */
diff --git a/openssh-6.4p1/monitor_wrap.h b/openssh-6.4p1/monitor_wrap.h diff --git a/openssh-6.5p1/monitor_wrap.h b/openssh-6.5p1/monitor_wrap.h
--- a/openssh-6.4p1/monitor_wrap.h --- a/openssh-6.5p1/monitor_wrap.h
+++ b/openssh-6.4p1/monitor_wrap.h +++ b/openssh-6.5p1/monitor_wrap.h
@@ -72,16 +72,18 @@ int mm_sshpam_respond(void *, u_int, cha @@ -72,16 +72,18 @@ int mm_sshpam_respond(void *, u_int, cha
void mm_sshpam_free_ctx(void *); void mm_sshpam_free_ctx(void *);
#endif #endif
@ -729,9 +734,9 @@ diff --git a/openssh-6.4p1/monitor_wrap.h b/openssh-6.4p1/monitor_wrap.h
void mm_session_pty_cleanup2(struct Session *); void mm_session_pty_cleanup2(struct Session *);
/* SSHv1 interfaces */ /* SSHv1 interfaces */
diff --git a/openssh-6.4p1/sshd.c b/openssh-6.4p1/sshd.c diff --git a/openssh-6.5p1/sshd.c b/openssh-6.5p1/sshd.c
--- a/openssh-6.4p1/sshd.c --- a/openssh-6.5p1/sshd.c
+++ b/openssh-6.4p1/sshd.c +++ b/openssh-6.5p1/sshd.c
@@ -114,16 +114,17 @@ @@ -114,16 +114,17 @@
#include "session.h" #include "session.h"
#include "monitor_mm.h" #include "monitor_mm.h"
@ -750,7 +755,7 @@ diff --git a/openssh-6.4p1/sshd.c b/openssh-6.4p1/sshd.c
#include <syslog.h> #include <syslog.h>
int allow_severity; int allow_severity;
int deny_severity; int deny_severity;
@@ -2297,16 +2298,20 @@ do_ssh1_kex(void) @@ -2312,16 +2313,20 @@ do_ssh1_kex(void)
packet_disconnect("Warning: client selects unsupported cipher."); packet_disconnect("Warning: client selects unsupported cipher.");
/* Get check bytes from the packet. These must match those we /* Get check bytes from the packet. These must match those we

138
openssh-6.4p1-audit5-session_key_destruction.patch → openssh-6.5p1-audit5-session_key_destruction.patch
View File

@ -4,9 +4,9 @@
# https://bugzilla.mindrot.org/attachment.cgi?id=2014 # https://bugzilla.mindrot.org/attachment.cgi?id=2014
# by jchadima@redhat.com # by jchadima@redhat.com
diff --git a/openssh-6.4p1/audit-bsm.c b/openssh-6.4p1/audit-bsm.c diff --git a/openssh-6.5p1/audit-bsm.c b/openssh-6.5p1/audit-bsm.c
--- a/openssh-6.4p1/audit-bsm.c --- a/openssh-6.5p1/audit-bsm.c
+++ b/openssh-6.4p1/audit-bsm.c +++ b/openssh-6.5p1/audit-bsm.c
@@ -480,9 +480,15 @@ audit_unsupported_body(int what) @@ -480,9 +480,15 @@ audit_unsupported_body(int what)
/* not implemented */ /* not implemented */
} }
@ -23,9 +23,9 @@ diff --git a/openssh-6.4p1/audit-bsm.c b/openssh-6.4p1/audit-bsm.c
+ /* not implemented */ + /* not implemented */
+} +}
#endif /* BSM */ #endif /* BSM */
diff --git a/openssh-6.4p1/audit-linux.c b/openssh-6.4p1/audit-linux.c diff --git a/openssh-6.5p1/audit-linux.c b/openssh-6.5p1/audit-linux.c
--- a/openssh-6.4p1/audit-linux.c --- a/openssh-6.5p1/audit-linux.c
+++ b/openssh-6.4p1/audit-linux.c +++ b/openssh-6.5p1/audit-linux.c
@@ -289,24 +289,25 @@ audit_unsupported_body(int what) @@ -289,24 +289,25 @@ audit_unsupported_body(int what)
/* no problem, the next instruction will be fatal() */ /* no problem, the next instruction will be fatal() */
return; return;
@ -91,9 +91,9 @@ diff --git a/openssh-6.4p1/audit-linux.c b/openssh-6.4p1/audit-linux.c
+} +}
+ +
#endif /* USE_LINUX_AUDIT */ #endif /* USE_LINUX_AUDIT */
diff --git a/openssh-6.4p1/audit.c b/openssh-6.4p1/audit.c diff --git a/openssh-6.5p1/audit.c b/openssh-6.5p1/audit.c
--- a/openssh-6.4p1/audit.c --- a/openssh-6.5p1/audit.c
+++ b/openssh-6.4p1/audit.c +++ b/openssh-6.5p1/audit.c
@@ -138,16 +138,22 @@ audit_unsupported(int what) @@ -138,16 +138,22 @@ audit_unsupported(int what)
} }
@ -138,9 +138,9 @@ diff --git a/openssh-6.4p1/audit.c b/openssh-6.4p1/audit.c
+} +}
# endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */ # endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */
#endif /* SSH_AUDIT_EVENTS */ #endif /* SSH_AUDIT_EVENTS */
diff --git a/openssh-6.4p1/audit.h b/openssh-6.4p1/audit.h diff --git a/openssh-6.5p1/audit.h b/openssh-6.5p1/audit.h
--- a/openssh-6.4p1/audit.h --- a/openssh-6.5p1/audit.h
+++ b/openssh-6.4p1/audit.h +++ b/openssh-6.5p1/audit.h
@@ -57,10 +57,12 @@ int audit_run_command(const char *); @@ -57,10 +57,12 @@ int audit_run_command(const char *);
void audit_end_command(int, const char *); void audit_end_command(int, const char *);
ssh_audit_event_t audit_classify_auth(const char *); ssh_audit_event_t audit_classify_auth(const char *);
@ -154,9 +154,9 @@ diff --git a/openssh-6.4p1/audit.h b/openssh-6.4p1/audit.h
+void audit_session_key_free_body(int ctos, pid_t, uid_t); +void audit_session_key_free_body(int ctos, pid_t, uid_t);
#endif /* _SSH_AUDIT_H */ #endif /* _SSH_AUDIT_H */
diff --git a/openssh-6.4p1/auditstub.c b/openssh-6.4p1/auditstub.c diff --git a/openssh-6.5p1/auditstub.c b/openssh-6.5p1/auditstub.c
--- a/openssh-6.4p1/auditstub.c --- a/openssh-6.5p1/auditstub.c
+++ b/openssh-6.4p1/auditstub.c +++ b/openssh-6.5p1/auditstub.c
@@ -22,18 +22,29 @@ @@ -22,18 +22,29 @@
* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
@ -187,10 +187,10 @@ diff --git a/openssh-6.4p1/auditstub.c b/openssh-6.4p1/auditstub.c
+audit_session_key_free_body(int ctos, pid_t pid, uid_t uid) +audit_session_key_free_body(int ctos, pid_t pid, uid_t uid)
+{ +{
+} +}
diff --git a/openssh-6.4p1/kex.c b/openssh-6.4p1/kex.c diff --git a/openssh-6.5p1/kex.c b/openssh-6.5p1/kex.c
--- a/openssh-6.4p1/kex.c --- a/openssh-6.5p1/kex.c
+++ b/openssh-6.4p1/kex.c +++ b/openssh-6.5p1/kex.c
@@ -667,8 +667,39 @@ dump_digest(char *msg, u_char *digest, i @@ -698,8 +698,39 @@ dump_digest(char *msg, u_char *digest, i
if (i%32 == 31) if (i%32 == 31)
fprintf(stderr, "\n"); fprintf(stderr, "\n");
else if (i%8 == 7) else if (i%8 == 7)
@ -230,17 +230,17 @@ diff --git a/openssh-6.4p1/kex.c b/openssh-6.4p1/kex.c
+ memset(&newkeys->comp, 0, sizeof(newkeys->comp)); + memset(&newkeys->comp, 0, sizeof(newkeys->comp));
+} +}
+ +
diff --git a/openssh-6.4p1/kex.h b/openssh-6.4p1/kex.h diff --git a/openssh-6.5p1/kex.h b/openssh-6.5p1/kex.h
--- a/openssh-6.4p1/kex.h --- a/openssh-6.5p1/kex.h
+++ b/openssh-6.4p1/kex.h +++ b/openssh-6.5p1/kex.h
@@ -157,16 +157,18 @@ Newkeys *kex_get_newkeys(int); @@ -163,16 +163,18 @@ void kexdh_client(Kex *);
void kexdh_client(Kex *);
void kexdh_server(Kex *); void kexdh_server(Kex *);
void kexgex_client(Kex *); void kexgex_client(Kex *);
void kexgex_server(Kex *); void kexgex_server(Kex *);
void kexecdh_client(Kex *); void kexecdh_client(Kex *);
void kexecdh_server(Kex *); void kexecdh_server(Kex *);
void kexc25519_client(Kex *);
void kexc25519_server(Kex *);
+void newkeys_destroy(Newkeys *newkeys); +void newkeys_destroy(Newkeys *newkeys);
+ +
@ -248,13 +248,13 @@ diff --git a/openssh-6.4p1/kex.h b/openssh-6.4p1/kex.h
kex_dh_hash(char *, char *, char *, int, char *, int, u_char *, int, kex_dh_hash(char *, char *, char *, int, char *, int, u_char *, int,
BIGNUM *, BIGNUM *, BIGNUM *, u_char **, u_int *); BIGNUM *, BIGNUM *, BIGNUM *, u_char **, u_int *);
void void
kexgex_hash(const EVP_MD *, char *, char *, char *, int, char *, kexgex_hash(int, char *, char *, char *, int, char *,
int, u_char *, int, int, int, int, BIGNUM *, BIGNUM *, BIGNUM *, int, u_char *, int, int, int, int, BIGNUM *, BIGNUM *, BIGNUM *,
BIGNUM *, BIGNUM *, u_char **, u_int *); BIGNUM *, BIGNUM *, u_char **, u_int *);
#ifdef OPENSSL_HAS_ECC #ifdef OPENSSL_HAS_ECC
diff --git a/openssh-6.4p1/mac.c b/openssh-6.4p1/mac.c diff --git a/openssh-6.5p1/mac.c b/openssh-6.5p1/mac.c
--- a/openssh-6.4p1/mac.c --- a/openssh-6.5p1/mac.c
+++ b/openssh-6.4p1/mac.c +++ b/openssh-6.5p1/mac.c
@@ -219,16 +219,30 @@ mac_clear(Mac *mac) @@ -219,16 +219,30 @@ mac_clear(Mac *mac)
if (mac->umac_ctx != NULL) if (mac->umac_ctx != NULL)
umac128_delete(mac->umac_ctx); umac128_delete(mac->umac_ctx);
@ -286,22 +286,22 @@ diff --git a/openssh-6.4p1/mac.c b/openssh-6.4p1/mac.c
char *maclist, *cp, *p; char *maclist, *cp, *p;
if (names == NULL || strcmp(names, "") == 0) if (names == NULL || strcmp(names, "") == 0)
diff --git a/openssh-6.4p1/mac.h b/openssh-6.4p1/mac.h diff --git a/openssh-6.5p1/mac.h b/openssh-6.5p1/mac.h
--- a/openssh-6.4p1/mac.h --- a/openssh-6.5p1/mac.h
+++ b/openssh-6.4p1/mac.h +++ b/openssh-6.5p1/mac.h
@@ -24,8 +24,9 @@ @@ -24,8 +24,9 @@
*/ */
int mac_valid(const char *); int mac_valid(const char *);
char *mac_alg_list(void); char *mac_alg_list(char);
int mac_setup(Mac *, char *); int mac_setup(Mac *, char *);
int mac_init(Mac *); int mac_init(Mac *);
u_char *mac_compute(Mac *, u_int32_t, u_char *, int); u_char *mac_compute(Mac *, u_int32_t, u_char *, int);
void mac_clear(Mac *); void mac_clear(Mac *);
+void mac_destroy(Mac *); +void mac_destroy(Mac *);
diff --git a/openssh-6.4p1/monitor.c b/openssh-6.4p1/monitor.c diff --git a/openssh-6.5p1/monitor.c b/openssh-6.5p1/monitor.c
--- a/openssh-6.4p1/monitor.c --- a/openssh-6.5p1/monitor.c
+++ b/openssh-6.4p1/monitor.c +++ b/openssh-6.5p1/monitor.c
@@ -185,16 +185,17 @@ int mm_answer_gss_checkmic(int, Buffer * @@ -185,16 +185,17 @@ int mm_answer_gss_checkmic(int, Buffer *
#endif #endif
@ -389,7 +389,7 @@ diff --git a/openssh-6.4p1/monitor.c b/openssh-6.4p1/monitor.c
/* Specifies if a certain message is allowed at the moment */ /* Specifies if a certain message is allowed at the moment */
@@ -1970,21 +1975,23 @@ mm_get_keystate(struct monitor *pmonitor @@ -1971,21 +1976,23 @@ mm_get_keystate(struct monitor *pmonitor
goto skip; goto skip;
} else { } else {
/* Get the Kex for rekeying */ /* Get the Kex for rekeying */
@ -413,7 +413,7 @@ diff --git a/openssh-6.4p1/monitor.c b/openssh-6.4p1/monitor.c
packets = buffer_get_int(&m); packets = buffer_get_int(&m);
bytes = buffer_get_int64(&m); bytes = buffer_get_int64(&m);
packet_set_state(MODE_OUT, seqnr, blocks, packets, bytes); packet_set_state(MODE_OUT, seqnr, blocks, packets, bytes);
@@ -2020,16 +2027,31 @@ mm_get_keystate(struct monitor *pmonitor @@ -2021,16 +2028,31 @@ mm_get_keystate(struct monitor *pmonitor
/* Roaming */ /* Roaming */
if (compat20) { if (compat20) {
@ -445,7 +445,7 @@ diff --git a/openssh-6.4p1/monitor.c b/openssh-6.4p1/monitor.c
mm_zalloc(struct mm_master *mm, u_int ncount, u_int size) mm_zalloc(struct mm_master *mm, u_int ncount, u_int size)
{ {
size_t len = (size_t) size * ncount; size_t len = (size_t) size * ncount;
@@ -2464,9 +2486,27 @@ mm_answer_audit_kex_body(int sock, Buffe @@ -2465,9 +2487,27 @@ mm_answer_audit_kex_body(int sock, Buffe
free(mac); free(mac);
free(compress); free(compress);
buffer_clear(m); buffer_clear(m);
@ -473,9 +473,9 @@ diff --git a/openssh-6.4p1/monitor.c b/openssh-6.4p1/monitor.c
+ return 0; + return 0;
+} +}
#endif /* SSH_AUDIT_EVENTS */ #endif /* SSH_AUDIT_EVENTS */
diff --git a/openssh-6.4p1/monitor.h b/openssh-6.4p1/monitor.h diff --git a/openssh-6.5p1/monitor.h b/openssh-6.5p1/monitor.h
--- a/openssh-6.4p1/monitor.h --- a/openssh-6.5p1/monitor.h
+++ b/openssh-6.4p1/monitor.h +++ b/openssh-6.5p1/monitor.h
@@ -67,16 +67,17 @@ enum monitor_reqtype { @@ -67,16 +67,17 @@ enum monitor_reqtype {
MONITOR_REQ_PAM_INIT_CTX = 104, MONITOR_ANS_PAM_INIT_CTX = 105, MONITOR_REQ_PAM_INIT_CTX = 104, MONITOR_ANS_PAM_INIT_CTX = 105,
MONITOR_REQ_PAM_QUERY = 106, MONITOR_ANS_PAM_QUERY = 107, MONITOR_REQ_PAM_QUERY = 106, MONITOR_ANS_PAM_QUERY = 107,
@ -494,9 +494,9 @@ diff --git a/openssh-6.4p1/monitor.h b/openssh-6.4p1/monitor.h
int m_recvfd; int m_recvfd;
int m_sendfd; int m_sendfd;
int m_log_recvfd; int m_log_recvfd;
diff --git a/openssh-6.4p1/monitor_wrap.c b/openssh-6.4p1/monitor_wrap.c diff --git a/openssh-6.5p1/monitor_wrap.c b/openssh-6.5p1/monitor_wrap.c
--- a/openssh-6.4p1/monitor_wrap.c --- a/openssh-6.5p1/monitor_wrap.c
+++ b/openssh-6.4p1/monitor_wrap.c +++ b/openssh-6.5p1/monitor_wrap.c
@@ -651,22 +651,24 @@ mm_send_keystate(struct monitor *monitor @@ -651,22 +651,24 @@ mm_send_keystate(struct monitor *monitor
__func__, packet_get_newkeys(MODE_OUT), __func__, packet_get_newkeys(MODE_OUT),
packet_get_newkeys(MODE_IN)); packet_get_newkeys(MODE_IN));
@ -547,9 +547,9 @@ diff --git a/openssh-6.4p1/monitor_wrap.c b/openssh-6.4p1/monitor_wrap.c
+ buffer_free(&m); + buffer_free(&m);
+} +}
#endif /* SSH_AUDIT_EVENTS */ #endif /* SSH_AUDIT_EVENTS */
diff --git a/openssh-6.4p1/monitor_wrap.h b/openssh-6.4p1/monitor_wrap.h diff --git a/openssh-6.5p1/monitor_wrap.h b/openssh-6.5p1/monitor_wrap.h
--- a/openssh-6.4p1/monitor_wrap.h --- a/openssh-6.5p1/monitor_wrap.h
+++ b/openssh-6.4p1/monitor_wrap.h +++ b/openssh-6.5p1/monitor_wrap.h
@@ -74,16 +74,17 @@ void mm_sshpam_free_ctx(void *); @@ -74,16 +74,17 @@ void mm_sshpam_free_ctx(void *);
#ifdef SSH_AUDIT_EVENTS #ifdef SSH_AUDIT_EVENTS
@ -568,9 +568,9 @@ diff --git a/openssh-6.4p1/monitor_wrap.h b/openssh-6.4p1/monitor_wrap.h
void mm_session_pty_cleanup2(struct Session *); void mm_session_pty_cleanup2(struct Session *);
/* SSHv1 interfaces */ /* SSHv1 interfaces */
diff --git a/openssh-6.4p1/packet.c b/openssh-6.4p1/packet.c diff --git a/openssh-6.5p1/packet.c b/openssh-6.5p1/packet.c
--- a/openssh-6.4p1/packet.c --- a/openssh-6.5p1/packet.c
+++ b/openssh-6.4p1/packet.c +++ b/openssh-6.5p1/packet.c
@@ -56,16 +56,17 @@ @@ -56,16 +56,17 @@
#include <stdio.h> #include <stdio.h>
#include <stdlib.h> #include <stdlib.h>
@ -650,7 +650,7 @@ diff --git a/openssh-6.4p1/packet.c b/openssh-6.4p1/packet.c
packet_set_protocol_flags(u_int protocol_flags) packet_set_protocol_flags(u_int protocol_flags)
{ {
active_state->remote_protocol_flags = protocol_flags; active_state->remote_protocol_flags = protocol_flags;
@@ -728,16 +739,35 @@ packet_send1(void) @@ -729,16 +740,35 @@ packet_send1(void)
/* /*
* Note that the packet is now only buffered in output. It won't be * Note that the packet is now only buffered in output. It won't be
@ -686,7 +686,7 @@ diff --git a/openssh-6.4p1/packet.c b/openssh-6.4p1/packet.c
Comp *comp; Comp *comp;
CipherContext *cc; CipherContext *cc;
u_int64_t *max_blocks; u_int64_t *max_blocks;
@@ -753,31 +783,19 @@ set_newkeys(int mode) @@ -754,31 +784,19 @@ set_newkeys(int mode)
} else { } else {
cc = &active_state->receive_context; cc = &active_state->receive_context;
crypt_type = CIPHER_DECRYPT; crypt_type = CIPHER_DECRYPT;
@ -720,7 +720,7 @@ diff --git a/openssh-6.4p1/packet.c b/openssh-6.4p1/packet.c
mac = &active_state->newkeys[mode]->mac; mac = &active_state->newkeys[mode]->mac;
comp = &active_state->newkeys[mode]->comp; comp = &active_state->newkeys[mode]->comp;
if (cipher_authlen(enc->cipher) == 0 && mac_init(mac) == 0) if (cipher_authlen(enc->cipher) == 0 && mac_init(mac) == 0)
@@ -1995,54 +2013,93 @@ packet_get_output(void) @@ -2004,54 +2022,93 @@ packet_get_output(void)
} }
void * void *
@ -823,9 +823,9 @@ diff --git a/openssh-6.4p1/packet.c b/openssh-6.4p1/packet.c
+ backup_state = NULL; + backup_state = NULL;
} }
+ +
diff --git a/openssh-6.4p1/packet.h b/openssh-6.4p1/packet.h diff --git a/openssh-6.5p1/packet.h b/openssh-6.5p1/packet.h
--- a/openssh-6.4p1/packet.h --- a/openssh-6.5p1/packet.h
+++ b/openssh-6.4p1/packet.h +++ b/openssh-6.5p1/packet.h
@@ -119,9 +119,10 @@ void packet_set_rekey_limits(u_int32_t, @@ -119,9 +119,10 @@ void packet_set_rekey_limits(u_int32_t,
time_t packet_get_rekey_timeout(void); time_t packet_get_rekey_timeout(void);
@ -837,10 +837,10 @@ diff --git a/openssh-6.4p1/packet.h b/openssh-6.4p1/packet.h
+void packet_destroy_all(int, int); +void packet_destroy_all(int, int);
#endif /* PACKET_H */ #endif /* PACKET_H */
diff --git a/openssh-6.4p1/session.c b/openssh-6.4p1/session.c diff --git a/openssh-6.5p1/session.c b/openssh-6.5p1/session.c
--- a/openssh-6.4p1/session.c --- a/openssh-6.5p1/session.c
+++ b/openssh-6.4p1/session.c +++ b/openssh-6.5p1/session.c
@@ -1661,16 +1661,19 @@ do_child(Session *s, const char *command @@ -1689,16 +1689,19 @@ do_child(Session *s, const char *command
int env_size; int env_size;
char *argv[ARGV_MAX]; char *argv[ARGV_MAX];
const char *shell, *shell0, *hostname = NULL; const char *shell, *shell0, *hostname = NULL;
@ -860,10 +860,10 @@ diff --git a/openssh-6.4p1/session.c b/openssh-6.4p1/session.c
do_pwchange(s); do_pwchange(s);
exit(1); exit(1);
} }
diff --git a/openssh-6.4p1/sshd.c b/openssh-6.4p1/sshd.c diff --git a/openssh-6.5p1/sshd.c b/openssh-6.5p1/sshd.c
--- a/openssh-6.4p1/sshd.c --- a/openssh-6.5p1/sshd.c
+++ b/openssh-6.4p1/sshd.c +++ b/openssh-6.5p1/sshd.c
@@ -703,16 +703,18 @@ privsep_preauth(Authctxt *authctxt) @@ -711,16 +711,18 @@ privsep_preauth(Authctxt *authctxt)
setproctitle("%s", "[net]"); setproctitle("%s", "[net]");
if (box != NULL) if (box != NULL)
ssh_sandbox_child(box); ssh_sandbox_child(box);
@ -882,7 +882,7 @@ diff --git a/openssh-6.4p1/sshd.c b/openssh-6.4p1/sshd.c
#ifdef DISABLE_FD_PASSING #ifdef DISABLE_FD_PASSING
if (1) { if (1) {
#else #else
@@ -727,16 +729,20 @@ privsep_postauth(Authctxt *authctxt) @@ -735,16 +737,20 @@ privsep_postauth(Authctxt *authctxt)
monitor_reinit(pmonitor); monitor_reinit(pmonitor);
pmonitor->m_pid = fork(); pmonitor->m_pid = fork();
@ -903,7 +903,7 @@ diff --git a/openssh-6.4p1/sshd.c b/openssh-6.4p1/sshd.c
/* child */ /* child */
@@ -2089,16 +2095,17 @@ main(int ac, char **av) @@ -2104,16 +2110,17 @@ main(int ac, char **av)
do_authentication(authctxt); do_authentication(authctxt);
} }
/* /*
@ -921,7 +921,7 @@ diff --git a/openssh-6.4p1/sshd.c b/openssh-6.4p1/sshd.c
* Cancel the alarm we set to limit the time taken for * Cancel the alarm we set to limit the time taken for
* authentication. * authentication.
*/ */
@@ -2141,16 +2148,18 @@ main(int ac, char **av) @@ -2156,16 +2163,18 @@ main(int ac, char **av)
packet_set_timeout(options.client_alive_interval, packet_set_timeout(options.client_alive_interval,
options.client_alive_count_max); options.client_alive_count_max);
@ -940,7 +940,7 @@ diff --git a/openssh-6.4p1/sshd.c b/openssh-6.4p1/sshd.c
verbose("Closing connection to %.500s port %d", remote_ip, remote_port); verbose("Closing connection to %.500s port %d", remote_ip, remote_port);
#ifdef USE_PAM #ifdef USE_PAM
@@ -2480,26 +2489,38 @@ do_ssh2_kex(void) @@ -2497,26 +2506,38 @@ do_ssh2_kex(void)
#endif #endif
debug("KEX done"); debug("KEX done");
} }

107
openssh-6.4p1-audit6-server_key_destruction.patch → openssh-6.5p1-audit6-server_key_destruction.patch
View File

@ -4,9 +4,9 @@
# https://bugzilla.mindrot.org/attachment.cgi?id=2015 # https://bugzilla.mindrot.org/attachment.cgi?id=2015
# by jchadima@redhat.com # by jchadima@redhat.com
diff --git a/openssh-6.4p1/audit-bsm.c b/openssh-6.4p1/audit-bsm.c diff --git a/openssh-6.5p1/audit-bsm.c b/openssh-6.5p1/audit-bsm.c
--- a/openssh-6.4p1/audit-bsm.c --- a/openssh-6.5p1/audit-bsm.c
+++ b/openssh-6.4p1/audit-bsm.c +++ b/openssh-6.5p1/audit-bsm.c
@@ -486,9 +486,27 @@ audit_kex_body(int ctos, char *enc, char @@ -486,9 +486,27 @@ audit_kex_body(int ctos, char *enc, char
/* not implemented */ /* not implemented */
} }
@ -35,9 +35,9 @@ diff --git a/openssh-6.4p1/audit-bsm.c b/openssh-6.4p1/audit-bsm.c
+ /* not implemented */ + /* not implemented */
+} +}
#endif /* BSM */ #endif /* BSM */
diff --git a/openssh-6.4p1/audit-linux.c b/openssh-6.4p1/audit-linux.c diff --git a/openssh-6.5p1/audit-linux.c b/openssh-6.5p1/audit-linux.c
--- a/openssh-6.4p1/audit-linux.c --- a/openssh-6.5p1/audit-linux.c
+++ b/openssh-6.4p1/audit-linux.c +++ b/openssh-6.5p1/audit-linux.c
@@ -351,9 +351,55 @@ audit_session_key_free_body(int ctos, pi @@ -351,9 +351,55 @@ audit_session_key_free_body(int ctos, pi
audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_KEY_USER, audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_KEY_USER,
buf, NULL, get_remote_ipaddr(), NULL, 1); buf, NULL, get_remote_ipaddr(), NULL, 1);
@ -94,9 +94,9 @@ diff --git a/openssh-6.4p1/audit-linux.c b/openssh-6.4p1/audit-linux.c
+ error("cannot write into audit"); + error("cannot write into audit");
+} +}
#endif /* USE_LINUX_AUDIT */ #endif /* USE_LINUX_AUDIT */
diff --git a/openssh-6.4p1/audit.c b/openssh-6.4p1/audit.c diff --git a/openssh-6.5p1/audit.c b/openssh-6.5p1/audit.c
--- a/openssh-6.4p1/audit.c --- a/openssh-6.5p1/audit.c
+++ b/openssh-6.4p1/audit.c +++ b/openssh-6.5p1/audit.c
@@ -285,10 +285,29 @@ audit_kex_body(int ctos, char *enc, char @@ -285,10 +285,29 @@ audit_kex_body(int ctos, char *enc, char
* This will be called on succesfull session key discard * This will be called on succesfull session key discard
*/ */
@ -127,9 +127,9 @@ diff --git a/openssh-6.4p1/audit.c b/openssh-6.4p1/audit.c
+} +}
# endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */ # endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */
#endif /* SSH_AUDIT_EVENTS */ #endif /* SSH_AUDIT_EVENTS */
diff --git a/openssh-6.4p1/audit.h b/openssh-6.4p1/audit.h diff --git a/openssh-6.5p1/audit.h b/openssh-6.5p1/audit.h
--- a/openssh-6.4p1/audit.h --- a/openssh-6.5p1/audit.h
+++ b/openssh-6.4p1/audit.h +++ b/openssh-6.5p1/audit.h
@@ -43,26 +43,30 @@ enum ssh_audit_event_type { @@ -43,26 +43,30 @@ enum ssh_audit_event_type {
SSH_INVALID_USER, SSH_INVALID_USER,
SSH_NOLOGIN, /* denied by /etc/nologin, not implemented */ SSH_NOLOGIN, /* denied by /etc/nologin, not implemented */
@ -161,11 +161,11 @@ diff --git a/openssh-6.4p1/audit.h b/openssh-6.4p1/audit.h
+void audit_generate_ephemeral_server_key(const char *); +void audit_generate_ephemeral_server_key(const char *);
#endif /* _SSH_AUDIT_H */ #endif /* _SSH_AUDIT_H */
diff --git a/openssh-6.4p1/key.c b/openssh-6.4p1/key.c diff --git a/openssh-6.5p1/key.c b/openssh-6.5p1/key.c
--- a/openssh-6.4p1/key.c --- a/openssh-6.5p1/key.c
+++ b/openssh-6.4p1/key.c +++ b/openssh-6.5p1/key.c
@@ -1805,16 +1805,40 @@ key_demote(const Key *k) @@ -1959,16 +1959,41 @@ key_demote(const Key *k)
fatal("key_free: bad key type %d", k->type); fatal("key_demote: bad key type %d", k->type);
break; break;
} }
@ -191,7 +191,8 @@ diff --git a/openssh-6.4p1/key.c b/openssh-6.4p1/key.c
+ return EC_KEY_get0_private_key(k->ecdsa) != NULL; + return EC_KEY_get0_private_key(k->ecdsa) != NULL;
+#endif +#endif
+ default: + default:
+ fatal("key_is_private: bad key type %d", k->type); + /* fatal("key_is_private: bad key type %d", k->type); */
+ debug2("key_is_private: bad key type %d", k->type);
+ return 1; + return 1;
+ } + }
+} +}
@ -201,23 +202,24 @@ diff --git a/openssh-6.4p1/key.c b/openssh-6.4p1/key.c
{ {
if (k == NULL) if (k == NULL)
return 0; return 0;
switch (k->type) { return key_type_is_cert(k->type);
case KEY_RSA_CERT_V00: }
case KEY_DSA_CERT_V00:
case KEY_RSA_CERT: /* Return the cert-less equivalent to a certified key type */
diff --git a/openssh-6.4p1/key.h b/openssh-6.4p1/key.h diff --git a/openssh-6.5p1/key.h b/openssh-6.5p1/key.h
--- a/openssh-6.4p1/key.h --- a/openssh-6.5p1/key.h
+++ b/openssh-6.4p1/key.h +++ b/openssh-6.5p1/key.h
@@ -106,16 +106,17 @@ int key_read(Key *, char **); @@ -113,16 +113,17 @@ int key_read(Key *, char **);
u_int key_size(const Key *); u_int key_size(const Key *);
enum fp_type key_fp_type_select(void); enum fp_type key_fp_type_select(void);
char *key_fp_type_str(enum fp_type); char *key_fp_type_str(enum fp_type);
Key *key_generate(int, u_int); Key *key_generate(int, u_int);
Key *key_from_private(const Key *); Key *key_from_private(const Key *);
int key_type_from_name(char *); int key_type_from_name(char *);
int key_is_cert(const Key *); int key_is_cert(const Key *);
+int key_is_private(const Key *k); +int key_is_private(const Key *k);
int key_type_is_cert(int);
int key_type_plain(int); int key_type_plain(int);
int key_to_certified(Key *, int); int key_to_certified(Key *, int);
int key_drop_cert(Key *); int key_drop_cert(Key *);
@ -225,10 +227,9 @@ diff --git a/openssh-6.4p1/key.h b/openssh-6.4p1/key.h
void key_cert_copy(const Key *, struct Key *); void key_cert_copy(const Key *, struct Key *);
int key_cert_check_authority(const Key *, int, int, const char *, int key_cert_check_authority(const Key *, int, int, const char *,
const char **); const char **);
int key_cert_is_legacy(const Key *); diff --git a/openssh-6.5p1/monitor.c b/openssh-6.5p1/monitor.c
diff --git a/openssh-6.4p1/monitor.c b/openssh-6.4p1/monitor.c --- a/openssh-6.5p1/monitor.c
--- a/openssh-6.4p1/monitor.c +++ b/openssh-6.5p1/monitor.c
+++ b/openssh-6.4p1/monitor.c
@@ -110,16 +110,18 @@ extern u_int utmp_len; @@ -110,16 +110,18 @@ extern u_int utmp_len;
extern Newkeys *current_keys[]; extern Newkeys *current_keys[];
extern z_stream incoming_stream; extern z_stream incoming_stream;
@ -355,7 +356,7 @@ diff --git a/openssh-6.4p1/monitor.c b/openssh-6.4p1/monitor.c
/* Terminate process */ /* Terminate process */
exit(res); exit(res);
@@ -2504,9 +2513,30 @@ mm_answer_audit_session_key_free_body(in @@ -2505,9 +2514,30 @@ mm_answer_audit_session_key_free_body(in
audit_session_key_free_body(ctos, pid, uid); audit_session_key_free_body(ctos, pid, uid);
@ -386,9 +387,9 @@ diff --git a/openssh-6.4p1/monitor.c b/openssh-6.4p1/monitor.c
+ return 0; + return 0;
+} +}
#endif /* SSH_AUDIT_EVENTS */ #endif /* SSH_AUDIT_EVENTS */
diff --git a/openssh-6.4p1/monitor.h b/openssh-6.4p1/monitor.h diff --git a/openssh-6.5p1/monitor.h b/openssh-6.5p1/monitor.h
--- a/openssh-6.4p1/monitor.h --- a/openssh-6.5p1/monitor.h
+++ b/openssh-6.4p1/monitor.h +++ b/openssh-6.5p1/monitor.h
@@ -68,16 +68,17 @@ enum monitor_reqtype { @@ -68,16 +68,17 @@ enum monitor_reqtype {
MONITOR_REQ_PAM_QUERY = 106, MONITOR_ANS_PAM_QUERY = 107, MONITOR_REQ_PAM_QUERY = 106, MONITOR_ANS_PAM_QUERY = 107,
MONITOR_REQ_PAM_RESPOND = 108, MONITOR_ANS_PAM_RESPOND = 109, MONITOR_REQ_PAM_RESPOND = 108, MONITOR_ANS_PAM_RESPOND = 109,
@ -407,9 +408,9 @@ diff --git a/openssh-6.4p1/monitor.h b/openssh-6.4p1/monitor.h
int m_recvfd; int m_recvfd;
int m_sendfd; int m_sendfd;
int m_log_recvfd; int m_log_recvfd;
diff --git a/openssh-6.4p1/monitor_wrap.c b/openssh-6.4p1/monitor_wrap.c diff --git a/openssh-6.5p1/monitor_wrap.c b/openssh-6.5p1/monitor_wrap.c
--- a/openssh-6.4p1/monitor_wrap.c --- a/openssh-6.5p1/monitor_wrap.c
+++ b/openssh-6.4p1/monitor_wrap.c +++ b/openssh-6.5p1/monitor_wrap.c
@@ -1537,9 +1537,25 @@ mm_audit_session_key_free_body(int ctos, @@ -1537,9 +1537,25 @@ mm_audit_session_key_free_body(int ctos,
buffer_put_int(&m, ctos); buffer_put_int(&m, ctos);
buffer_put_int64(&m, pid); buffer_put_int64(&m, pid);
@ -436,9 +437,9 @@ diff --git a/openssh-6.4p1/monitor_wrap.c b/openssh-6.4p1/monitor_wrap.c
+ buffer_free(&m); + buffer_free(&m);
+} +}
#endif /* SSH_AUDIT_EVENTS */ #endif /* SSH_AUDIT_EVENTS */
diff --git a/openssh-6.4p1/monitor_wrap.h b/openssh-6.4p1/monitor_wrap.h diff --git a/openssh-6.5p1/monitor_wrap.h b/openssh-6.5p1/monitor_wrap.h
--- a/openssh-6.4p1/monitor_wrap.h --- a/openssh-6.5p1/monitor_wrap.h
+++ b/openssh-6.4p1/monitor_wrap.h +++ b/openssh-6.5p1/monitor_wrap.h
@@ -75,16 +75,17 @@ void mm_sshpam_free_ctx(void *); @@ -75,16 +75,17 @@ void mm_sshpam_free_ctx(void *);
#ifdef SSH_AUDIT_EVENTS #ifdef SSH_AUDIT_EVENTS
#include "audit.h" #include "audit.h"
@ -457,9 +458,9 @@ diff --git a/openssh-6.4p1/monitor_wrap.h b/openssh-6.4p1/monitor_wrap.h
void mm_session_pty_cleanup2(struct Session *); void mm_session_pty_cleanup2(struct Session *);
/* SSHv1 interfaces */ /* SSHv1 interfaces */
diff --git a/openssh-6.4p1/session.c b/openssh-6.4p1/session.c diff --git a/openssh-6.5p1/session.c b/openssh-6.5p1/session.c
--- a/openssh-6.4p1/session.c --- a/openssh-6.5p1/session.c
+++ b/openssh-6.4p1/session.c +++ b/openssh-6.5p1/session.c
@@ -132,17 +132,17 @@ static int session_pty_req(Session *); @@ -132,17 +132,17 @@ static int session_pty_req(Session *);
/* import */ /* import */
@ -479,7 +480,7 @@ diff --git a/openssh-6.4p1/session.c b/openssh-6.4p1/session.c
/* data */ /* data */
static int sessions_first_unused = -1; static int sessions_first_unused = -1;
static int sessions_nalloc = 0; static int sessions_nalloc = 0;
@@ -1660,17 +1660,17 @@ do_child(Session *s, const char *command @@ -1688,17 +1688,17 @@ do_child(Session *s, const char *command
char **env; char **env;
int env_size; int env_size;
char *argv[ARGV_MAX]; char *argv[ARGV_MAX];
@ -498,9 +499,9 @@ diff --git a/openssh-6.4p1/session.c b/openssh-6.4p1/session.c
if (s->authctxt->force_pwchange) { if (s->authctxt->force_pwchange) {
do_setusercontext(pw); do_setusercontext(pw);
child_close_fds(); child_close_fds();
diff --git a/openssh-6.4p1/sshd.c b/openssh-6.4p1/sshd.c diff --git a/openssh-6.5p1/sshd.c b/openssh-6.5p1/sshd.c
--- a/openssh-6.4p1/sshd.c --- a/openssh-6.5p1/sshd.c
+++ b/openssh-6.4p1/sshd.c +++ b/openssh-6.5p1/sshd.c
@@ -256,17 +256,17 @@ Buffer cfg; @@ -256,17 +256,17 @@ Buffer cfg;
/* message to be displayed after login */ /* message to be displayed after login */
@ -546,7 +547,7 @@ diff --git a/openssh-6.4p1/sshd.c b/openssh-6.4p1/sshd.c
if (startup_pipes) if (startup_pipes)
for (i = 0; i < options.max_startups; i++) for (i = 0; i < options.max_startups; i++)
if (startup_pipes[i] != -1) if (startup_pipes[i] != -1)
@@ -547,60 +556,99 @@ sshd_exchange_identification(int sock_in @@ -554,60 +563,99 @@ sshd_exchange_identification(int sock_in
close(sock_out); close(sock_out);
logit("Protocol major versions differ for %s: %.200s vs. %.200s", logit("Protocol major versions differ for %s: %.200s vs. %.200s",
get_remote_ipaddr(), get_remote_ipaddr(),
@ -649,7 +650,7 @@ diff --git a/openssh-6.4p1/sshd.c b/openssh-6.4p1/sshd.c
} }
static void static void
@@ -1179,16 +1227,17 @@ server_accept_loop(int *sock_in, int *so @@ -1192,16 +1240,17 @@ server_accept_loop(int *sock_in, int *so
/* Wait in select until there is a connection. */ /* Wait in select until there is a connection. */
ret = select(maxfd+1, fdset, NULL, NULL, NULL); ret = select(maxfd+1, fdset, NULL, NULL, NULL);
@ -667,7 +668,7 @@ diff --git a/openssh-6.4p1/sshd.c b/openssh-6.4p1/sshd.c
generate_ephemeral_server_key(); generate_ephemeral_server_key();
key_used = 0; key_used = 0;
key_do_regen = 0; key_do_regen = 0;
@@ -2138,27 +2187,28 @@ main(int ac, char **av) @@ -2153,27 +2202,28 @@ main(int ac, char **av)
/* /*
* In privilege separation, we fork another child and prepare * In privilege separation, we fork another child and prepare
* file descriptor passing. * file descriptor passing.
@ -697,7 +698,7 @@ diff --git a/openssh-6.4p1/sshd.c b/openssh-6.4p1/sshd.c
verbose("Closing connection to %.500s port %d", remote_ip, remote_port); verbose("Closing connection to %.500s port %d", remote_ip, remote_port);
@@ -2377,17 +2427,17 @@ do_ssh1_kex(void) @@ -2392,17 +2442,17 @@ do_ssh1_kex(void)
MD5_Update(&md, sensitive_data.ssh1_cookie, SSH_SESSION_KEY_LENGTH); MD5_Update(&md, sensitive_data.ssh1_cookie, SSH_SESSION_KEY_LENGTH);
MD5_Final(session_key + 16, &md); MD5_Final(session_key + 16, &md);
memset(buf, 0, bytes); memset(buf, 0, bytes);
@ -716,7 +717,7 @@ diff --git a/openssh-6.4p1/sshd.c b/openssh-6.4p1/sshd.c
BN_clear_free(session_key_int); BN_clear_free(session_key_int);
/* Set the session key. From this on all communications will be encrypted. */ /* Set the session key. From this on all communications will be encrypted. */
@@ -2510,16 +2560,18 @@ cleanup_exit(int i) @@ -2527,16 +2577,18 @@ cleanup_exit(int i)
debug("Killing privsep child %d", pmonitor->m_pid); debug("Killing privsep child %d", pmonitor->m_pid);
if (kill(pmonitor->m_pid, SIGKILL) != 0 && if (kill(pmonitor->m_pid, SIGKILL) != 0 &&
errno != ESRCH) errno != ESRCH)

10
openssh-6.4p1-audit7-libaudit_compat.patch → openssh-6.5p1-audit7-libaudit_compat.patch
View File

@ -1,8 +1,8 @@
# definitions for AUDIT_CRYPTO_* symbols fom libaudit 2.x # definitions for AUDIT_CRYPTO_* symbols fom libaudit 2.x
diff --git a/openssh-6.4p1/audit-linux.c b/openssh-6.4p1/audit-linux.c diff --git a/openssh-6.5p1/audit-linux.c b/openssh-6.5p1/audit-linux.c
--- a/openssh-6.4p1/audit-linux.c --- a/openssh-6.5p1/audit-linux.c
+++ b/openssh-6.4p1/audit-linux.c +++ b/openssh-6.5p1/audit-linux.c
@@ -25,16 +25,17 @@ @@ -25,16 +25,17 @@
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
* *
@ -21,10 +21,10 @@ diff --git a/openssh-6.4p1/audit-linux.c b/openssh-6.4p1/audit-linux.c
#include "key.h" #include "key.h"
#include "hostfile.h" #include "hostfile.h"
#include "auth.h" #include "auth.h"
diff --git a/openssh-6.4p1/compat-libaudit.h b/openssh-6.4p1/compat-libaudit.h diff --git a/openssh-6.5p1/compat-libaudit.h b/openssh-6.5p1/compat-libaudit.h
new file mode 100644 new file mode 100644
--- /dev/null --- /dev/null
+++ b/openssh-6.4p1/compat-libaudit.h +++ b/openssh-6.5p1/compat-libaudit.h
@@ -0,0 +1,79 @@ @@ -0,0 +1,79 @@
+/* AUDIT_CRYPTO symbol definitions from libaudit 2.x */ +/* AUDIT_CRYPTO symbol definitions from libaudit 2.x */
+/* libaudit.h -- +/* libaudit.h --

6
openssh-6.4p1-audit8-libaudit_dns_timeouts.patch → openssh-6.5p1-audit8-libaudit_dns_timeouts.patch
View File

@ -4,9 +4,9 @@
# Note that this particular solution causes the logs to always contain # Note that this particular solution causes the logs to always contain
# "hostname=?, addr=?" when DNS lookups are disabled. # "hostname=?, addr=?" when DNS lookups are disabled.
diff --git a/openssh-6.4p1/audit-linux.c b/openssh-6.4p1/audit-linux.c diff --git a/openssh-6.5p1/audit-linux.c b/openssh-6.5p1/audit-linux.c
--- a/openssh-6.4p1/audit-linux.c --- a/openssh-6.5p1/audit-linux.c
+++ b/openssh-6.4p1/audit-linux.c +++ b/openssh-6.5p1/audit-linux.c
@@ -62,17 +62,17 @@ linux_audit_user_logxxx(int uid, const c @@ -62,17 +62,17 @@ linux_audit_user_logxxx(int uid, const c
if (errno == EINVAL || errno == EPROTONOSUPPORT || if (errno == EINVAL || errno == EPROTONOSUPPORT ||
errno == EAFNOSUPPORT) errno == EAFNOSUPPORT)

6
openssh-6.4p1-blocksigalrm.patch → openssh-6.5p1-blocksigalrm.patch
View File

@ -2,9 +2,9 @@
# grace_alarm_handler) # grace_alarm_handler)
# bnc#57354 # bnc#57354
diff --git a/openssh-6.4p1/log.c b/openssh-6.4p1/log.c diff --git a/openssh-6.5p1/log.c b/openssh-6.5p1/log.c
--- a/openssh-6.4p1/log.c --- a/openssh-6.5p1/log.c
+++ b/openssh-6.4p1/log.c +++ b/openssh-6.5p1/log.c
@@ -47,16 +47,17 @@ @@ -47,16 +47,17 @@
#include <unistd.h> #include <unistd.h>
#include <errno.h> #include <errno.h>

6
openssh-6.4p1-default-protocol.patch → openssh-6.5p1-default-protocol.patch
View File

@ -1,8 +1,8 @@
# only enable SSHv2 protocol by default (upstream default is fallback to v1) # only enable SSHv2 protocol by default (upstream default is fallback to v1)
diff --git a/openssh-6.4p1/ssh_config b/openssh-6.4p1/ssh_config diff --git a/openssh-6.5p1/ssh_config b/openssh-6.5p1/ssh_config
--- a/openssh-6.4p1/ssh_config --- a/openssh-6.5p1/ssh_config
+++ b/openssh-6.4p1/ssh_config +++ b/openssh-6.5p1/ssh_config
@@ -41,17 +41,17 @@ ForwardX11Trusted yes @@ -41,17 +41,17 @@ ForwardX11Trusted yes
# CheckHostIP yes # CheckHostIP yes
# AddressFamily any # AddressFamily any

6
openssh-6.4p1-disable-openssl-abi-check.patch → openssh-6.5p1-disable-openssl-abi-check.patch
View File

@ -2,9 +2,9 @@
# reliable indicator of ABI changes and doesn't make much sense in a # reliable indicator of ABI changes and doesn't make much sense in a
# distribution package # distribution package
diff --git a/openssh-6.4p1/entropy.c b/openssh-6.4p1/entropy.c diff --git a/openssh-6.5p1/entropy.c b/openssh-6.5p1/entropy.c
--- a/openssh-6.4p1/entropy.c --- a/openssh-6.5p1/entropy.c
+++ b/openssh-6.4p1/entropy.c +++ b/openssh-6.5p1/entropy.c
@@ -212,22 +212,23 @@ seed_rng(void) @@ -212,22 +212,23 @@ seed_rng(void)
#endif #endif
/* /*

18
openssh-6.4p1-eal3.patch → openssh-6.5p1-eal3.patch
View File

@ -1,9 +1,9 @@
# fix paths and references in sshd man pages # fix paths and references in sshd man pages
diff --git a/openssh-6.4p1/sshd.8 b/openssh-6.4p1/sshd.8 diff --git a/openssh-6.5p1/sshd.8 b/openssh-6.5p1/sshd.8
--- a/openssh-6.4p1/sshd.8 --- a/openssh-6.5p1/sshd.8
+++ b/openssh-6.4p1/sshd.8 +++ b/openssh-6.5p1/sshd.8
@@ -872,17 +872,17 @@ See @@ -875,17 +875,17 @@ See
If this file exists, If this file exists,
.Nm .Nm
refuses to let anyone except root log in. refuses to let anyone except root log in.
@ -22,7 +22,7 @@ diff --git a/openssh-6.4p1/sshd.8 b/openssh-6.4p1/sshd.8
.It Pa /etc/ssh/ssh_host_key .It Pa /etc/ssh/ssh_host_key
.It Pa /etc/ssh/ssh_host_dsa_key .It Pa /etc/ssh/ssh_host_dsa_key
.It Pa /etc/ssh/ssh_host_ecdsa_key .It Pa /etc/ssh/ssh_host_ecdsa_key
@@ -951,17 +951,17 @@ The content of this file is not sensitiv @@ -956,17 +956,17 @@ The content of this file is not sensitiv
.Xr sftp 1 , .Xr sftp 1 ,
.Xr ssh 1 , .Xr ssh 1 ,
.Xr ssh-add 1 , .Xr ssh-add 1 ,
@ -41,9 +41,9 @@ diff --git a/openssh-6.4p1/sshd.8 b/openssh-6.4p1/sshd.8
OpenSSH is a derivative of the original and free OpenSSH is a derivative of the original and free
ssh 1.2.12 release by Tatu Ylonen. ssh 1.2.12 release by Tatu Ylonen.
Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos, Aaron Campbell, Bob Beck, Markus Friedl, Niels Provos,
diff --git a/openssh-6.4p1/sshd_config.5 b/openssh-6.4p1/sshd_config.5 diff --git a/openssh-6.5p1/sshd_config.5 b/openssh-6.5p1/sshd_config.5
--- a/openssh-6.4p1/sshd_config.5 --- a/openssh-6.5p1/sshd_config.5
+++ b/openssh-6.4p1/sshd_config.5 +++ b/openssh-6.5p1/sshd_config.5
@@ -278,18 +278,17 @@ The contents of the specified file are s @@ -278,18 +278,17 @@ The contents of the specified file are s
authentication is allowed. authentication is allowed.
If the argument is If the argument is
@ -64,7 +64,7 @@ diff --git a/openssh-6.4p1/sshd_config.5 b/openssh-6.4p1/sshd_config.5
to after authentication. to after authentication.
All components of the pathname must be root-owned directories that are All components of the pathname must be root-owned directories that are
not writable by any other user or group. not writable by any other user or group.
@@ -565,17 +564,17 @@ and @@ -576,17 +575,17 @@ and
.Pa .shosts .Pa .shosts
files will not be used in files will not be used in
.Cm RhostsRSAAuthentication .Cm RhostsRSAAuthentication

127
openssh-6.4p1-fingerprint_hash.patch → openssh-6.5p1-fingerprint_hash.patch
View File

@ -1,13 +1,13 @@
# HG changeset patch # HG changeset patch
# Parent d41afe56fd49d0a9669738b1f4d53ddae0cb195a # Parent 450c3933f35c6801a682ea32c588e4c9ff73414a
# select fingerprint hash algorithms based on the environment variable # select fingerprint hash algorithms based on the environment variable
# SSH_FP_TYPE_ENVVAR and append it to hex and randomart fingerprints # SSH_FP_TYPE_ENVVAR and append it to hex and randomart fingerprints
# Petr Cerny <pcerny@suse.cz> # Petr Cerny <pcerny@suse.cz>
diff --git a/openssh-6.4p1/auth-rsa.c b/openssh-6.4p1/auth-rsa.c diff --git a/openssh-6.5p1/auth-rsa.c b/openssh-6.5p1/auth-rsa.c
--- a/openssh-6.4p1/auth-rsa.c --- a/openssh-6.5p1/auth-rsa.c
+++ b/openssh-6.4p1/auth-rsa.c +++ b/openssh-6.5p1/auth-rsa.c
@@ -226,17 +226,17 @@ rsa_key_allowed_in_file(struct passwd *p @@ -226,17 +226,17 @@ rsa_key_allowed_in_file(struct passwd *p
/* check the real bits */ /* check the real bits */
@ -27,9 +27,9 @@ diff --git a/openssh-6.4p1/auth-rsa.c b/openssh-6.4p1/auth-rsa.c
if (auth_key_is_revoked(key)) if (auth_key_is_revoked(key))
break; break;
diff --git a/openssh-6.4p1/auth.c b/openssh-6.4p1/auth.c diff --git a/openssh-6.5p1/auth.c b/openssh-6.5p1/auth.c
--- a/openssh-6.4p1/auth.c --- a/openssh-6.5p1/auth.c
+++ b/openssh-6.4p1/auth.c +++ b/openssh-6.5p1/auth.c
@@ -680,17 +680,17 @@ auth_key_is_revoked(Key *key) @@ -680,17 +680,17 @@ auth_key_is_revoked(Key *key)
case -1: case -1:
/* Error opening revoked_keys_file: refuse all keys */ /* Error opening revoked_keys_file: refuse all keys */
@ -49,10 +49,10 @@ diff --git a/openssh-6.4p1/auth.c b/openssh-6.4p1/auth.c
fatal("key_in_file returned junk"); fatal("key_in_file returned junk");
} }
diff --git a/openssh-6.4p1/auth2-hostbased.c b/openssh-6.4p1/auth2-hostbased.c diff --git a/openssh-6.5p1/auth2-hostbased.c b/openssh-6.5p1/auth2-hostbased.c
--- a/openssh-6.4p1/auth2-hostbased.c --- a/openssh-6.5p1/auth2-hostbased.c
+++ b/openssh-6.4p1/auth2-hostbased.c +++ b/openssh-6.5p1/auth2-hostbased.c
@@ -196,23 +196,23 @@ hostbased_key_allowed(struct passwd *pw, @@ -202,23 +202,23 @@ hostbased_key_allowed(struct passwd *pw,
_PATH_SSH_SYSTEM_HOSTFILE2, _PATH_SSH_SYSTEM_HOSTFILE2,
options.ignore_user_known_hosts ? NULL : options.ignore_user_known_hosts ? NULL :
_PATH_SSH_USER_HOSTFILE2); _PATH_SSH_USER_HOSTFILE2);
@ -78,10 +78,10 @@ diff --git a/openssh-6.4p1/auth2-hostbased.c b/openssh-6.4p1/auth2-hostbased.c
return (host_status == HOST_OK); return (host_status == HOST_OK);
} }
diff --git a/openssh-6.4p1/auth2-pubkey.c b/openssh-6.4p1/auth2-pubkey.c diff --git a/openssh-6.5p1/auth2-pubkey.c b/openssh-6.5p1/auth2-pubkey.c
--- a/openssh-6.4p1/auth2-pubkey.c --- a/openssh-6.5p1/auth2-pubkey.c
+++ b/openssh-6.4p1/auth2-pubkey.c +++ b/openssh-6.5p1/auth2-pubkey.c
@@ -202,25 +202,25 @@ pubkey_auth_info(Authctxt *authctxt, con @@ -208,25 +208,25 @@ pubkey_auth_info(Authctxt *authctxt, con
i = vasprintf(&extra, fmt, ap); i = vasprintf(&extra, fmt, ap);
va_end(ap); va_end(ap);
if (i < 0 || extra == NULL) if (i < 0 || extra == NULL)
@ -109,7 +109,7 @@ diff --git a/openssh-6.4p1/auth2-pubkey.c b/openssh-6.4p1/auth2-pubkey.c
} }
static int static int
@@ -354,17 +354,17 @@ check_authkeys_file(FILE *f, char *file, @@ -360,17 +360,17 @@ check_authkeys_file(FILE *f, char *file,
if (key_is_cert(key)) { if (key_is_cert(key)) {
if (!key_equal(found, key->cert->signature_key)) if (!key_equal(found, key->cert->signature_key))
continue; continue;
@ -128,7 +128,7 @@ diff --git a/openssh-6.4p1/auth2-pubkey.c b/openssh-6.4p1/auth2-pubkey.c
* a key option, then prefer that list to matching * a key option, then prefer that list to matching
* their username in the certificate principals list. * their username in the certificate principals list.
*/ */
@@ -395,17 +395,17 @@ check_authkeys_file(FILE *f, char *file, @@ -401,17 +401,17 @@ check_authkeys_file(FILE *f, char *file,
break; break;
} else if (key_equal(found, key)) { } else if (key_equal(found, key)) {
if (auth_parse_options(pw, key_options, file, if (auth_parse_options(pw, key_options, file,
@ -147,7 +147,7 @@ diff --git a/openssh-6.4p1/auth2-pubkey.c b/openssh-6.4p1/auth2-pubkey.c
} }
if (found != NULL) if (found != NULL)
key_free(found); key_free(found);
@@ -421,17 +421,17 @@ user_cert_trusted_ca(struct passwd *pw, @@ -427,17 +427,17 @@ user_cert_trusted_ca(struct passwd *pw,
char *ca_fp, *principals_file = NULL; char *ca_fp, *principals_file = NULL;
const char *reason; const char *reason;
int ret = 0; int ret = 0;
@ -166,13 +166,13 @@ diff --git a/openssh-6.4p1/auth2-pubkey.c b/openssh-6.4p1/auth2-pubkey.c
options.trusted_user_ca_keys); options.trusted_user_ca_keys);
goto out; goto out;
} }
diff --git a/openssh-6.4p1/key.c b/openssh-6.4p1/key.c diff --git a/openssh-6.5p1/key.c b/openssh-6.5p1/key.c
--- a/openssh-6.4p1/key.c --- a/openssh-6.5p1/key.c
+++ b/openssh-6.4p1/key.c +++ b/openssh-6.5p1/key.c
@@ -390,30 +390,38 @@ key_fingerprint_raw(const Key *k, enum f @@ -420,30 +420,39 @@ key_fingerprint_raw(const Key *k, enum f
free(blob); *dgst_raw_length = ssh_digest_bytes(hash_alg);
} else { } else {
fatal("key_fingerprint_raw: blob is null"); fatal("%s: blob is null", __func__);
} }
return retval; return retval;
} }
@ -185,6 +185,7 @@ diff --git a/openssh-6.4p1/key.c b/openssh-6.4p1/key.c
u_int i; u_int i;
- retval = xcalloc(1, dgst_raw_len * 3 + 1); - retval = xcalloc(1, dgst_raw_len * 3 + 1);
+ /* reserve space for both the key hash and the string for the hash type */
+ retval = xcalloc(1, dgst_raw_len * 3 + 1 + SSH_FP_TYPE_STRLEN + 2); + retval = xcalloc(1, dgst_raw_len * 3 + 1 + SSH_FP_TYPE_STRLEN + 2);
for (i = 0; i < dgst_raw_len; i++) { for (i = 0; i < dgst_raw_len; i++) {
char hex[4]; char hex[4];
@ -211,7 +212,7 @@ diff --git a/openssh-6.4p1/key.c b/openssh-6.4p1/key.c
{ {
char vowels[] = { 'a', 'e', 'i', 'o', 'u', 'y' }; char vowels[] = { 'a', 'e', 'i', 'o', 'u', 'y' };
char consonants[] = { 'b', 'c', 'd', 'f', 'g', 'h', 'k', 'l', 'm', char consonants[] = { 'b', 'c', 'd', 'f', 'g', 'h', 'k', 'l', 'm',
@@ -488,17 +496,18 @@ key_fingerprint_bubblebabble(u_char *dgs @@ -518,17 +527,18 @@ key_fingerprint_bubblebabble(u_char *dgs
* can be in the exact middle of the picture, and FLDBASE should be >=8 . * can be in the exact middle of the picture, and FLDBASE should be >=8 .
* Else pictures would be too dense, and drawing the frame would * Else pictures would be too dense, and drawing the frame would
* fail, too, because the key type would not fit in anymore. * fail, too, because the key type would not fit in anymore.
@ -231,7 +232,7 @@ diff --git a/openssh-6.4p1/key.c b/openssh-6.4p1/key.c
char *augmentation_string = " .o+=*BOX@%&#/^SE"; char *augmentation_string = " .o+=*BOX@%&#/^SE";
char *retval, *p; char *retval, *p;
u_char field[FLDSIZE_X][FLDSIZE_Y]; u_char field[FLDSIZE_X][FLDSIZE_Y];
@@ -555,18 +564,19 @@ key_fingerprint_randomart(u_char *dgst_r @@ -585,18 +595,19 @@ key_fingerprint_randomart(u_char *dgst_r
*p++ = '|'; *p++ = '|';
for (x = 0; x < FLDSIZE_X; x++) for (x = 0; x < FLDSIZE_X; x++)
*p++ = augmentation_string[MIN(field[x][y], len)]; *p++ = augmentation_string[MIN(field[x][y], len)];
@ -253,7 +254,7 @@ diff --git a/openssh-6.4p1/key.c b/openssh-6.4p1/key.c
char * char *
key_fingerprint(const Key *k, enum fp_type dgst_type, enum fp_rep dgst_rep) key_fingerprint(const Key *k, enum fp_type dgst_type, enum fp_rep dgst_rep)
@@ -575,34 +585,91 @@ key_fingerprint(const Key *k, enum fp_ty @@ -605,34 +616,91 @@ key_fingerprint(const Key *k, enum fp_ty
u_char *dgst_raw; u_char *dgst_raw;
u_int dgst_raw_len; u_int dgst_raw_len;
@ -347,10 +348,10 @@ diff --git a/openssh-6.4p1/key.c b/openssh-6.4p1/key.c
* the buffer containing the number. * the buffer containing the number.
*/ */
static int static int
diff --git a/openssh-6.4p1/key.h b/openssh-6.4p1/key.h diff --git a/openssh-6.5p1/key.h b/openssh-6.5p1/key.h
--- a/openssh-6.4p1/key.h --- a/openssh-6.5p1/key.h
+++ b/openssh-6.4p1/key.h +++ b/openssh-6.5p1/key.h
@@ -51,16 +51,18 @@ enum fp_type { @@ -53,16 +53,18 @@ enum fp_type {
SSH_FP_MD5, SSH_FP_MD5,
SSH_FP_SHA256 SSH_FP_SHA256
}; };
@ -369,7 +370,7 @@ diff --git a/openssh-6.4p1/key.h b/openssh-6.4p1/key.h
struct KeyCert { struct KeyCert {
Buffer certblob; /* Kept around for use on wire */ Buffer certblob; /* Kept around for use on wire */
u_int type; /* SSH2_CERT_TYPE_USER or SSH2_CERT_TYPE_HOST */ u_int type; /* SSH2_CERT_TYPE_USER or SSH2_CERT_TYPE_HOST */
@@ -97,16 +99,18 @@ int key_equal_public(const Key *, cons @@ -104,16 +106,18 @@ int key_equal_public(const Key *, cons
int key_equal(const Key *, const Key *); int key_equal(const Key *, const Key *);
char *key_fingerprint(const Key *, enum fp_type, enum fp_rep); char *key_fingerprint(const Key *, enum fp_type, enum fp_rep);
u_char *key_fingerprint_raw(const Key *, enum fp_type, u_int *); u_char *key_fingerprint_raw(const Key *, enum fp_type, u_int *);
@ -379,19 +380,19 @@ diff --git a/openssh-6.4p1/key.h b/openssh-6.4p1/key.h
int key_read(Key *, char **); int key_read(Key *, char **);
u_int key_size(const Key *); u_int key_size(const Key *);
+enum fp_type key_fp_type_select(void); +enum fp_type key_fp_type_select(void);
+char *key_fp_type_str(enum fp_type); +char *key_fp_type_str(enum fp_type);
Key *key_generate(int, u_int); Key *key_generate(int, u_int);
Key *key_from_private(const Key *); Key *key_from_private(const Key *);
int key_type_from_name(char *); int key_type_from_name(char *);
int key_is_cert(const Key *); int key_is_cert(const Key *);
int key_type_is_cert(int);
int key_type_plain(int); int key_type_plain(int);
int key_to_certified(Key *, int); int key_to_certified(Key *, int);
int key_drop_cert(Key *); diff --git a/openssh-6.5p1/ssh-add.c b/openssh-6.5p1/ssh-add.c
diff --git a/openssh-6.4p1/ssh-add.c b/openssh-6.4p1/ssh-add.c --- a/openssh-6.5p1/ssh-add.c
--- a/openssh-6.4p1/ssh-add.c +++ b/openssh-6.5p1/ssh-add.c
+++ b/openssh-6.4p1/ssh-add.c @@ -325,17 +325,17 @@ list_identities(AuthenticationConnection
@@ -321,17 +321,17 @@ list_identities(AuthenticationConnection
int version; int version;
for (version = 1; version <= 2; version++) { for (version = 1; version <= 2; version++) {
@ -410,9 +411,9 @@ diff --git a/openssh-6.4p1/ssh-add.c b/openssh-6.4p1/ssh-add.c
if (!key_write(key, stdout)) if (!key_write(key, stdout))
fprintf(stderr, "key_write failed"); fprintf(stderr, "key_write failed");
fprintf(stdout, " %s\n", comment); fprintf(stdout, " %s\n", comment);
diff --git a/openssh-6.4p1/ssh-agent.c b/openssh-6.4p1/ssh-agent.c diff --git a/openssh-6.5p1/ssh-agent.c b/openssh-6.5p1/ssh-agent.c
--- a/openssh-6.4p1/ssh-agent.c --- a/openssh-6.5p1/ssh-agent.c
+++ b/openssh-6.4p1/ssh-agent.c +++ b/openssh-6.5p1/ssh-agent.c
@@ -193,17 +193,17 @@ lookup_identity(Key *key, int version) @@ -193,17 +193,17 @@ lookup_identity(Key *key, int version)
/* Check confirmation of keysign request */ /* Check confirmation of keysign request */
@ -432,10 +433,10 @@ diff --git a/openssh-6.4p1/ssh-agent.c b/openssh-6.4p1/ssh-agent.c
return (ret); return (ret);
} }
diff --git a/openssh-6.4p1/ssh-keygen.c b/openssh-6.4p1/ssh-keygen.c diff --git a/openssh-6.5p1/ssh-keygen.c b/openssh-6.5p1/ssh-keygen.c
--- a/openssh-6.4p1/ssh-keygen.c --- a/openssh-6.5p1/ssh-keygen.c
+++ b/openssh-6.4p1/ssh-keygen.c +++ b/openssh-6.5p1/ssh-keygen.c
@@ -725,27 +725,27 @@ do_download(struct passwd *pw) @@ -741,27 +741,27 @@ do_download(struct passwd *pw)
{ {
#ifdef ENABLE_PKCS11 #ifdef ENABLE_PKCS11
Key **keys = NULL; Key **keys = NULL;
@ -465,7 +466,7 @@ diff --git a/openssh-6.4p1/ssh-keygen.c b/openssh-6.4p1/ssh-keygen.c
free(ra); free(ra);
free(fp); free(fp);
} else { } else {
@@ -768,29 +768,29 @@ do_fingerprint(struct passwd *pw) @@ -784,29 +784,29 @@ do_fingerprint(struct passwd *pw)
FILE *f; FILE *f;
Key *public; Key *public;
char *comment = NULL, *cp, *ep, line[16*1024], *fp, *ra; char *comment = NULL, *cp, *ep, line[16*1024], *fp, *ra;
@ -497,7 +498,7 @@ diff --git a/openssh-6.4p1/ssh-keygen.c b/openssh-6.4p1/ssh-keygen.c
free(comment); free(comment);
free(ra); free(ra);
free(fp); free(fp);
@@ -846,17 +846,17 @@ do_fingerprint(struct passwd *pw) @@ -862,17 +862,17 @@ do_fingerprint(struct passwd *pw)
public = key_new(KEY_UNSPEC); public = key_new(KEY_UNSPEC);
if (key_read(public, &cp) != 1) { if (key_read(public, &cp) != 1) {
key_free(public); key_free(public);
@ -516,7 +517,7 @@ diff --git a/openssh-6.4p1/ssh-keygen.c b/openssh-6.4p1/ssh-keygen.c
free(fp); free(fp);
key_free(public); key_free(public);
invalid = 0; invalid = 0;
@@ -967,20 +967,20 @@ do_gen_all_hostkeys(struct passwd *pw) @@ -983,20 +983,20 @@ do_gen_all_hostkeys(struct passwd *pw)
static void static void
printhost(FILE *f, const char *name, Key *public, int ca, int hash) printhost(FILE *f, const char *name, Key *public, int ca, int hash)
{ {
@ -539,7 +540,7 @@ diff --git a/openssh-6.4p1/ssh-keygen.c b/openssh-6.4p1/ssh-keygen.c
free(fp); free(fp);
} else { } else {
if (hash && (name = host_hash(name, NULL, 0)) == NULL) if (hash && (name = host_hash(name, NULL, 0)) == NULL)
@@ -1850,19 +1850,19 @@ do_show_cert(struct passwd *pw) @@ -1873,19 +1873,19 @@ do_show_cert(struct passwd *pw)
if (stat(identity_file, &st) < 0) if (stat(identity_file, &st) < 0)
fatal("%s: %s: %s", __progname, identity_file, strerror(errno)); fatal("%s: %s: %s", __progname, identity_file, strerror(errno));
if ((key = key_load_public(identity_file, NULL)) == NULL) if ((key = key_load_public(identity_file, NULL)) == NULL)
@ -561,7 +562,7 @@ diff --git a/openssh-6.4p1/ssh-keygen.c b/openssh-6.4p1/ssh-keygen.c
printf(" Signing CA: %s %s\n", printf(" Signing CA: %s %s\n",
key_type(key->cert->signature_key), ca_fp); key_type(key->cert->signature_key), ca_fp);
printf(" Key ID: \"%s\"\n", key->cert->key_id); printf(" Key ID: \"%s\"\n", key->cert->key_id);
@@ -2650,18 +2650,18 @@ passphrase_again: @@ -2681,18 +2681,18 @@ passphrase_again:
exit(1); exit(1);
} }
if (!key_write(public, f)) if (!key_write(public, f))
@ -582,10 +583,10 @@ diff --git a/openssh-6.4p1/ssh-keygen.c b/openssh-6.4p1/ssh-keygen.c
printf("The key's randomart image is:\n"); printf("The key's randomart image is:\n");
printf("%s\n", ra); printf("%s\n", ra);
free(ra); free(ra);
diff --git a/openssh-6.4p1/sshconnect.c b/openssh-6.4p1/sshconnect.c diff --git a/openssh-6.5p1/sshconnect.c b/openssh-6.5p1/sshconnect.c
--- a/openssh-6.4p1/sshconnect.c --- a/openssh-6.5p1/sshconnect.c
+++ b/openssh-6.4p1/sshconnect.c +++ b/openssh-6.5p1/sshconnect.c
@@ -825,18 +825,18 @@ check_host_key(char *hostname, struct so @@ -906,18 +906,18 @@ check_host_key(char *hostname, struct so
"address '%.128s' to the list of known " "address '%.128s' to the list of known "
"hosts (%.30s).", type, ip, "hosts (%.30s).", type, ip,
user_hostfiles[0]); user_hostfiles[0]);
@ -606,7 +607,7 @@ diff --git a/openssh-6.4p1/sshconnect.c b/openssh-6.4p1/sshconnect.c
break; break;
case HOST_NEW: case HOST_NEW:
if (options.host_key_alias == NULL && port != 0 && if (options.host_key_alias == NULL && port != 0 &&
@@ -866,18 +866,18 @@ check_host_key(char *hostname, struct so @@ -947,18 +947,18 @@ check_host_key(char *hostname, struct so
if (show_other_keys(host_hostkeys, host_key)) if (show_other_keys(host_hostkeys, host_key))
snprintf(msg1, sizeof(msg1), snprintf(msg1, sizeof(msg1),
@ -627,7 +628,7 @@ diff --git a/openssh-6.4p1/sshconnect.c b/openssh-6.4p1/sshconnect.c
"Matching host key fingerprint" "Matching host key fingerprint"
" found in DNS.\n"); " found in DNS.\n");
else else
@@ -1131,17 +1131,17 @@ fail: @@ -1212,17 +1212,17 @@ fail:
/* returns 0 if key verifies or -1 if key does NOT verify */ /* returns 0 if key verifies or -1 if key does NOT verify */
int int
@ -646,7 +647,7 @@ diff --git a/openssh-6.4p1/sshconnect.c b/openssh-6.4p1/sshconnect.c
verify_host_key_dns(host, hostaddr, host_key, &flags) == 0) { verify_host_key_dns(host, hostaddr, host_key, &flags) == 0) {
if (flags & DNS_VERIFY_FOUND) { if (flags & DNS_VERIFY_FOUND) {
@@ -1233,18 +1233,18 @@ show_other_keys(struct hostkeys *hostkey @@ -1319,18 +1319,18 @@ show_other_keys(struct hostkeys *hostkey
char *fp, *ra; char *fp, *ra;
const struct hostkey_entry *found; const struct hostkey_entry *found;
@ -667,7 +668,7 @@ diff --git a/openssh-6.4p1/sshconnect.c b/openssh-6.4p1/sshconnect.c
key_type(found->key), fp); key_type(found->key), fp);
if (options.visual_host_key) if (options.visual_host_key)
logit("%s", ra); logit("%s", ra);
@@ -1255,17 +1255,17 @@ show_other_keys(struct hostkeys *hostkey @@ -1341,17 +1341,17 @@ show_other_keys(struct hostkeys *hostkey
return ret; return ret;
} }
@ -686,10 +687,10 @@ diff --git a/openssh-6.4p1/sshconnect.c b/openssh-6.4p1/sshconnect.c
error("Someone could be eavesdropping on you right now (man-in-the-middle attack)!"); error("Someone could be eavesdropping on you right now (man-in-the-middle attack)!");
error("It is also possible that a host key has just been changed."); error("It is also possible that a host key has just been changed.");
error("The fingerprint for the %s key sent by the remote host is\n%s.", error("The fingerprint for the %s key sent by the remote host is\n%s.",
diff --git a/openssh-6.4p1/sshconnect2.c b/openssh-6.4p1/sshconnect2.c diff --git a/openssh-6.5p1/sshconnect2.c b/openssh-6.5p1/sshconnect2.c
--- a/openssh-6.4p1/sshconnect2.c --- a/openssh-6.5p1/sshconnect2.c
+++ b/openssh-6.4p1/sshconnect2.c +++ b/openssh-6.5p1/sshconnect2.c
@@ -590,17 +590,17 @@ input_userauth_pk_ok(int type, u_int32_t @@ -592,17 +592,17 @@ input_userauth_pk_ok(int type, u_int32_t
goto done; goto done;
} }
if (key->type != pktype) { if (key->type != pktype) {
@ -708,7 +709,7 @@ diff --git a/openssh-6.4p1/sshconnect2.c b/openssh-6.4p1/sshconnect2.c
* moved to the end of the queue. this also avoids confusion by * moved to the end of the queue. this also avoids confusion by
* duplicate keys * duplicate keys
*/ */
@@ -1204,17 +1204,17 @@ sign_and_send_pubkey(Authctxt *authctxt, @@ -1206,17 +1206,17 @@ sign_and_send_pubkey(Authctxt *authctxt,
Buffer b; Buffer b;
u_char *blob, *signature; u_char *blob, *signature;
u_int bloblen, slen; u_int bloblen, slen;

80
openssh-6.4p1-fips.patch → openssh-6.5p1-fips.patch
View File

@ -4,9 +4,9 @@
# HG changeset patch # HG changeset patch
# Parent 6536ed881743cbf05afe962021b985f9b1eab495 # Parent 6536ed881743cbf05afe962021b985f9b1eab495
diff --git a/openssh-6.4p1/Makefile.in b/openssh-6.4p1/Makefile.in diff --git a/openssh-6.5p1/Makefile.in b/openssh-6.5p1/Makefile.in
--- a/openssh-6.4p1/Makefile.in --- a/openssh-6.5p1/Makefile.in
+++ b/openssh-6.4p1/Makefile.in +++ b/openssh-6.5p1/Makefile.in
@@ -72,17 +72,17 @@ LIBSSH_OBJS=authfd.o authfile.o bufaux.o @@ -72,17 +72,17 @@ LIBSSH_OBJS=authfd.o authfile.o bufaux.o
cipher-bf1.o cipher-ctr.o cipher-3des1.o cleanup.o \ cipher-bf1.o cipher-ctr.o cipher-3des1.o cleanup.o \
compat.o compress.o crc32.o deattack.o fatal.o hostfile.o \ compat.o compress.o crc32.o deattack.o fatal.o hostfile.o \
@ -26,9 +26,9 @@ diff --git a/openssh-6.4p1/Makefile.in b/openssh-6.4p1/Makefile.in
SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o \ SSHDOBJS=sshd.o auth-rhosts.o auth-passwd.o auth-rsa.o auth-rh-rsa.o \
audit.o audit-bsm.o audit-linux.o platform.o \ audit.o audit-bsm.o audit-linux.o platform.o \
sshpty.o sshlogin.o servconf.o serverloop.o \ sshpty.o sshlogin.o servconf.o serverloop.o \
diff --git a/openssh-6.4p1/auth-rsa.c b/openssh-6.4p1/auth-rsa.c diff --git a/openssh-6.5p1/auth-rsa.c b/openssh-6.5p1/auth-rsa.c
--- a/openssh-6.4p1/auth-rsa.c --- a/openssh-6.5p1/auth-rsa.c
+++ b/openssh-6.4p1/auth-rsa.c +++ b/openssh-6.5p1/auth-rsa.c
@@ -15,17 +15,17 @@ @@ -15,17 +15,17 @@
*/ */
@ -171,9 +171,9 @@ diff --git a/openssh-6.4p1/auth-rsa.c b/openssh-6.4p1/auth-rsa.c
return (success); return (success);
} }
diff --git a/openssh-6.4p1/cipher-ctr.c b/openssh-6.4p1/cipher-ctr.c diff --git a/openssh-6.5p1/cipher-ctr.c b/openssh-6.5p1/cipher-ctr.c
--- a/openssh-6.4p1/cipher-ctr.c --- a/openssh-6.5p1/cipher-ctr.c
+++ b/openssh-6.4p1/cipher-ctr.c +++ b/openssh-6.5p1/cipher-ctr.c
@@ -21,16 +21,17 @@ @@ -21,16 +21,17 @@
#include <stdarg.h> #include <stdarg.h>
@ -208,9 +208,9 @@ diff --git a/openssh-6.4p1/cipher-ctr.c b/openssh-6.4p1/cipher-ctr.c
} }
#endif /* OPENSSL_HAVE_EVPCTR */ #endif /* OPENSSL_HAVE_EVPCTR */
diff --git a/openssh-6.4p1/cipher.c b/openssh-6.4p1/cipher.c diff --git a/openssh-6.5p1/cipher.c b/openssh-6.5p1/cipher.c
--- a/openssh-6.4p1/cipher.c --- a/openssh-6.5p1/cipher.c
+++ b/openssh-6.4p1/cipher.c +++ b/openssh-6.5p1/cipher.c
@@ -42,16 +42,17 @@ @@ -42,16 +42,17 @@
#include <openssl/md5.h> #include <openssl/md5.h>
@ -373,10 +373,10 @@ diff --git a/openssh-6.4p1/cipher.c b/openssh-6.4p1/cipher.c
/* /*
* Exports an IV from the CipherContext required to export the key * Exports an IV from the CipherContext required to export the key
* state back from the unprivileged child to the privileged parent * state back from the unprivileged child to the privileged parent
diff --git a/openssh-6.4p1/fips.c b/openssh-6.4p1/fips.c diff --git a/openssh-6.5p1/fips.c b/openssh-6.5p1/fips.c
new file mode 100644 new file mode 100644
--- /dev/null --- /dev/null
+++ b/openssh-6.4p1/fips.c +++ b/openssh-6.5p1/fips.c
@@ -0,0 +1,176 @@ @@ -0,0 +1,176 @@
+/* +/*
+ * Copyright (c) 2012 Petr Cerny. All rights reserved. + * Copyright (c) 2012 Petr Cerny. All rights reserved.
@ -554,10 +554,10 @@ new file mode 100644
+ return EVP_get_digestbynid(fips_hash_nid_min()); + return EVP_get_digestbynid(fips_hash_nid_min());
+} +}
+ +
diff --git a/openssh-6.4p1/fips.h b/openssh-6.4p1/fips.h diff --git a/openssh-6.5p1/fips.h b/openssh-6.5p1/fips.h
new file mode 100644 new file mode 100644
--- /dev/null --- /dev/null
+++ b/openssh-6.4p1/fips.h +++ b/openssh-6.5p1/fips.h
@@ -0,0 +1,54 @@ @@ -0,0 +1,54 @@
+/* +/*
+ * Copyright (c) 2012 Petr Cerny. All rights reserved. + * Copyright (c) 2012 Petr Cerny. All rights reserved.
@ -613,9 +613,9 @@ new file mode 100644
+ +
+#endif +#endif
+ +
diff --git a/openssh-6.4p1/key.c b/openssh-6.4p1/key.c diff --git a/openssh-6.5p1/key.c b/openssh-6.5p1/key.c
--- a/openssh-6.4p1/key.c --- a/openssh-6.5p1/key.c
+++ b/openssh-6.4p1/key.c +++ b/openssh-6.5p1/key.c
@@ -49,16 +49,17 @@ @@ -49,16 +49,17 @@
#include "xmalloc.h" #include "xmalloc.h"
#include "key.h" #include "key.h"
@ -654,9 +654,9 @@ diff --git a/openssh-6.4p1/key.c b/openssh-6.4p1/key.c
/* /*
* string lengths must be less or equal to SSH_FP_TYPE_STRLEN (defined in * string lengths must be less or equal to SSH_FP_TYPE_STRLEN (defined in
* key.h) as to fit into the fingerprint string buffer * key.h) as to fit into the fingerprint string buffer
diff --git a/openssh-6.4p1/mac.c b/openssh-6.4p1/mac.c diff --git a/openssh-6.5p1/mac.c b/openssh-6.5p1/mac.c
--- a/openssh-6.4p1/mac.c --- a/openssh-6.5p1/mac.c
+++ b/openssh-6.4p1/mac.c +++ b/openssh-6.5p1/mac.c
@@ -36,34 +36,35 @@ @@ -36,34 +36,35 @@
#include "xmalloc.h" #include "xmalloc.h"
#include "log.h" #include "log.h"
@ -760,9 +760,9 @@ diff --git a/openssh-6.4p1/mac.c b/openssh-6.4p1/mac.c
mac_setup_by_id(mac, i); mac_setup_by_id(mac, i);
debug2("mac_setup: found %s", name); debug2("mac_setup: found %s", name);
return (0); return (0);
diff --git a/openssh-6.4p1/myproposal.h b/openssh-6.4p1/myproposal.h diff --git a/openssh-6.5p1/myproposal.h b/openssh-6.5p1/myproposal.h
--- a/openssh-6.4p1/myproposal.h --- a/openssh-6.5p1/myproposal.h
+++ b/openssh-6.4p1/myproposal.h +++ b/openssh-6.5p1/myproposal.h
@@ -71,16 +71,20 @@ @@ -71,16 +71,20 @@
"ssh-dss" "ssh-dss"
@ -804,9 +804,9 @@ diff --git a/openssh-6.4p1/myproposal.h b/openssh-6.4p1/myproposal.h
static char *myproposal[PROPOSAL_MAX] = { static char *myproposal[PROPOSAL_MAX] = {
KEX_DEFAULT_KEX, KEX_DEFAULT_KEX,
KEX_DEFAULT_PK_ALG, KEX_DEFAULT_PK_ALG,
diff --git a/openssh-6.4p1/openbsd-compat/bsd-arc4random.c b/openssh-6.4p1/openbsd-compat/bsd-arc4random.c diff --git a/openssh-6.5p1/openbsd-compat/bsd-arc4random.c b/openssh-6.5p1/openbsd-compat/bsd-arc4random.c
--- a/openssh-6.4p1/openbsd-compat/bsd-arc4random.c --- a/openssh-6.5p1/openbsd-compat/bsd-arc4random.c
+++ b/openssh-6.4p1/openbsd-compat/bsd-arc4random.c +++ b/openssh-6.5p1/openbsd-compat/bsd-arc4random.c
@@ -18,34 +18,35 @@ @@ -18,34 +18,35 @@
#include <sys/types.h> #include <sys/types.h>
@ -930,9 +930,9 @@ diff --git a/openssh-6.4p1/openbsd-compat/bsd-arc4random.c b/openssh-6.4p1/openb
{ {
size_t i; size_t i;
u_int32_t r = 0; u_int32_t r = 0;
diff --git a/openssh-6.4p1/ssh-rsa.c b/openssh-6.4p1/ssh-rsa.c diff --git a/openssh-6.5p1/ssh-rsa.c b/openssh-6.5p1/ssh-rsa.c
--- a/openssh-6.4p1/ssh-rsa.c --- a/openssh-6.5p1/ssh-rsa.c
+++ b/openssh-6.4p1/ssh-rsa.c +++ b/openssh-6.5p1/ssh-rsa.c
@@ -27,16 +27,17 @@ @@ -27,16 +27,17 @@
#include "xmalloc.h" #include "xmalloc.h"
@ -987,9 +987,9 @@ diff --git a/openssh-6.4p1/ssh-rsa.c b/openssh-6.4p1/ssh-rsa.c
EVP_DigestInit(&md, evp_md); EVP_DigestInit(&md, evp_md);
EVP_DigestUpdate(&md, data, datalen); EVP_DigestUpdate(&md, data, datalen);
EVP_DigestFinal(&md, digest, &dlen); EVP_DigestFinal(&md, digest, &dlen);
diff --git a/openssh-6.4p1/ssh.c b/openssh-6.4p1/ssh.c diff --git a/openssh-6.5p1/ssh.c b/openssh-6.5p1/ssh.c
--- a/openssh-6.4p1/ssh.c --- a/openssh-6.5p1/ssh.c
+++ b/openssh-6.4p1/ssh.c +++ b/openssh-6.5p1/ssh.c
@@ -99,16 +99,17 @@ @@ -99,16 +99,17 @@
#include "kex.h" #include "kex.h"
#include "mac.h" #include "mac.h"
@ -1051,9 +1051,9 @@ diff --git a/openssh-6.4p1/ssh.c b/openssh-6.4p1/ssh.c
options.use_privileged_port, options.use_privileged_port,
#else #else
original_effective_uid == 0 && options.use_privileged_port, original_effective_uid == 0 && options.use_privileged_port,
diff --git a/openssh-6.4p1/sshconnect2.c b/openssh-6.4p1/sshconnect2.c diff --git a/openssh-6.5p1/sshconnect2.c b/openssh-6.5p1/sshconnect2.c
--- a/openssh-6.4p1/sshconnect2.c --- a/openssh-6.5p1/sshconnect2.c
+++ b/openssh-6.4p1/sshconnect2.c +++ b/openssh-6.5p1/sshconnect2.c
@@ -67,16 +67,17 @@ @@ -67,16 +67,17 @@
#include "dispatch.h" #include "dispatch.h"
#include "canohost.h" #include "canohost.h"
@ -1110,9 +1110,9 @@ diff --git a/openssh-6.4p1/sshconnect2.c b/openssh-6.4p1/sshconnect2.c
/* Prefer algorithms that we already have keys for */ /* Prefer algorithms that we already have keys for */
myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
order_hostkeyalgs(host, hostaddr, port); order_hostkeyalgs(host, hostaddr, port);
diff --git a/openssh-6.4p1/sshd.c b/openssh-6.4p1/sshd.c diff --git a/openssh-6.5p1/sshd.c b/openssh-6.5p1/sshd.c
--- a/openssh-6.4p1/sshd.c --- a/openssh-6.5p1/sshd.c
+++ b/openssh-6.4p1/sshd.c +++ b/openssh-6.5p1/sshd.c
@@ -118,16 +118,17 @@ @@ -118,16 +118,17 @@
#ifdef GSSAPI #ifdef GSSAPI
#include "ssh-gss.h" #include "ssh-gss.h"

180
openssh-6.4p1-gssapi_key_exchange.patch → openssh-6.5p1-gssapi_key_exchange.patch
View File

@ -1,10 +1,10 @@
# HG changeset patch # HG changeset patch
# Parent a72dad36a987a441e9c92807b1d654e43ddee409 # Parent a72dad36a987a441e9c92807b1d654e43ddee409
diff --git a/openssh-6.4p1/ChangeLog.gssapi b/openssh-6.4p1/ChangeLog.gssapi diff --git a/openssh-6.5p1/ChangeLog.gssapi b/openssh-6.5p1/ChangeLog.gssapi
new file mode 100644 new file mode 100644
--- /dev/null --- /dev/null
+++ b/openssh-6.4p1/ChangeLog.gssapi +++ b/openssh-6.5p1/ChangeLog.gssapi
@@ -0,0 +1,113 @@ @@ -0,0 +1,113 @@
+20110101 +20110101
+ - Finally update for OpenSSH 5.6p1 + - Finally update for OpenSSH 5.6p1
@ -119,9 +119,9 @@ new file mode 100644
+ add support for GssapiTrustDns option for gssapi-with-mic + add support for GssapiTrustDns option for gssapi-with-mic
+ (from jbasney AT ncsa.uiuc.edu) + (from jbasney AT ncsa.uiuc.edu)
+ <gssapi-with-mic support is Bugzilla #1008> + <gssapi-with-mic support is Bugzilla #1008>
diff --git a/openssh-6.4p1/Makefile.in b/openssh-6.4p1/Makefile.in diff --git a/openssh-6.5p1/Makefile.in b/openssh-6.5p1/Makefile.in
--- a/openssh-6.4p1/Makefile.in --- a/openssh-6.5p1/Makefile.in
+++ b/openssh-6.4p1/Makefile.in +++ b/openssh-6.5p1/Makefile.in
@@ -71,33 +71,34 @@ LIBSSH_OBJS=authfd.o authfile.o bufaux.o @@ -71,33 +71,34 @@ LIBSSH_OBJS=authfd.o authfile.o bufaux.o
canohost.o channels.o cipher.o cipher-aes.o \ canohost.o channels.o cipher.o cipher-aes.o \
cipher-bf1.o cipher-ctr.o cipher-3des1.o cleanup.o \ cipher-bf1.o cipher-ctr.o cipher-3des1.o cleanup.o \
@ -158,9 +158,9 @@ diff --git a/openssh-6.4p1/Makefile.in b/openssh-6.4p1/Makefile.in
MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out sshd_config.5.out ssh_config.5.out ssh-ldap-helper.8.out ssh-ldap.conf.5.out MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out sshd_config.5.out ssh_config.5.out ssh-ldap-helper.8.out ssh-ldap.conf.5.out
MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 sshd_config.5 ssh_config.5 ssh-ldap-helper.8 ssh-ldap.conf.5 MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 sshd_config.5 ssh_config.5 ssh-ldap-helper.8 ssh-ldap.conf.5
diff --git a/openssh-6.4p1/auth-krb5.c b/openssh-6.4p1/auth-krb5.c diff --git a/openssh-6.5p1/auth-krb5.c b/openssh-6.5p1/auth-krb5.c
--- a/openssh-6.4p1/auth-krb5.c --- a/openssh-6.5p1/auth-krb5.c
+++ b/openssh-6.4p1/auth-krb5.c +++ b/openssh-6.5p1/auth-krb5.c
@@ -165,18 +165,23 @@ auth_krb5_password(Authctxt *authctxt, c @@ -165,18 +165,23 @@ auth_krb5_password(Authctxt *authctxt, c
if (problem) if (problem)
goto out; goto out;
@ -229,9 +229,9 @@ diff --git a/openssh-6.4p1/auth-krb5.c b/openssh-6.4p1/auth-krb5.c
} }
#endif /* !HEIMDAL */ #endif /* !HEIMDAL */
#endif /* KRB5 */ #endif /* KRB5 */
diff --git a/openssh-6.4p1/auth2-gss.c b/openssh-6.4p1/auth2-gss.c diff --git a/openssh-6.5p1/auth2-gss.c b/openssh-6.5p1/auth2-gss.c
--- a/openssh-6.4p1/auth2-gss.c --- a/openssh-6.5p1/auth2-gss.c
+++ b/openssh-6.4p1/auth2-gss.c +++ b/openssh-6.5p1/auth2-gss.c
@@ -1,12 +1,12 @@ @@ -1,12 +1,12 @@
/* $OpenBSD: auth2-gss.c,v 1.18 2012/12/02 20:34:09 djm Exp $ */ /* $OpenBSD: auth2-gss.c,v 1.18 2012/12/02 20:34:09 djm Exp $ */
@ -357,9 +357,9 @@ diff --git a/openssh-6.4p1/auth2-gss.c b/openssh-6.4p1/auth2-gss.c
Authmethod method_gssapi_old = { Authmethod method_gssapi_old = {
"gssapi", "gssapi",
diff --git a/openssh-6.4p1/auth2.c b/openssh-6.4p1/auth2.c diff --git a/openssh-6.5p1/auth2.c b/openssh-6.5p1/auth2.c
--- a/openssh-6.4p1/auth2.c --- a/openssh-6.5p1/auth2.c
+++ b/openssh-6.4p1/auth2.c +++ b/openssh-6.5p1/auth2.c
@@ -64,27 +64,29 @@ extern Buffer loginmsg; @@ -64,27 +64,29 @@ extern Buffer loginmsg;
/* methods */ /* methods */
@ -390,9 +390,9 @@ diff --git a/openssh-6.4p1/auth2.c b/openssh-6.4p1/auth2.c
#endif #endif
&method_passwd, &method_passwd,
&method_kbdint, &method_kbdint,
diff --git a/openssh-6.4p1/clientloop.c b/openssh-6.4p1/clientloop.c diff --git a/openssh-6.5p1/clientloop.c b/openssh-6.5p1/clientloop.c
--- a/openssh-6.4p1/clientloop.c --- a/openssh-6.5p1/clientloop.c
+++ b/openssh-6.4p1/clientloop.c +++ b/openssh-6.5p1/clientloop.c
@@ -106,16 +106,20 @@ @@ -106,16 +106,20 @@
#include "authfd.h" #include "authfd.h"
#include "atomicio.h" #include "atomicio.h"
@ -440,9 +440,9 @@ diff --git a/openssh-6.4p1/clientloop.c b/openssh-6.4p1/clientloop.c
} }
} }
diff --git a/openssh-6.4p1/configure.ac b/openssh-6.4p1/configure.ac diff --git a/openssh-6.5p1/configure.ac b/openssh-6.5p1/configure.ac
--- a/openssh-6.4p1/configure.ac --- a/openssh-6.5p1/configure.ac
+++ b/openssh-6.4p1/configure.ac +++ b/openssh-6.5p1/configure.ac
@@ -528,16 +528,40 @@ main() { if (NSVersionOfRunTimeLibrary(" @@ -528,16 +528,40 @@ main() { if (NSVersionOfRunTimeLibrary("
AC_DEFINE([BROKEN_GLOB], [1], [OS X glob does not do what we expect]) AC_DEFINE([BROKEN_GLOB], [1], [OS X glob does not do what we expect])
AC_DEFINE_UNQUOTED([BIND_8_COMPAT], [1], AC_DEFINE_UNQUOTED([BIND_8_COMPAT], [1],
@ -484,9 +484,9 @@ diff --git a/openssh-6.4p1/configure.ac b/openssh-6.4p1/configure.ac
[Define if pututxline updates lastlog too]) [Define if pututxline updates lastlog too])
) )
AC_DEFINE([SPT_TYPE], [SPT_REUSEARGV], AC_DEFINE([SPT_TYPE], [SPT_REUSEARGV],
diff --git a/openssh-6.4p1/gss-genr.c b/openssh-6.4p1/gss-genr.c diff --git a/openssh-6.5p1/gss-genr.c b/openssh-6.5p1/gss-genr.c
--- a/openssh-6.4p1/gss-genr.c --- a/openssh-6.5p1/gss-genr.c
+++ b/openssh-6.4p1/gss-genr.c +++ b/openssh-6.5p1/gss-genr.c
@@ -1,12 +1,12 @@ @@ -1,12 +1,12 @@
/* $OpenBSD: gss-genr.c,v 1.20 2009/06/22 05:39:28 dtucker Exp $ */ /* $OpenBSD: gss-genr.c,v 1.20 2009/06/22 05:39:28 dtucker Exp $ */
@ -874,9 +874,9 @@ diff --git a/openssh-6.4p1/gss-genr.c b/openssh-6.4p1/gss-genr.c
+} +}
+ +
#endif /* GSSAPI */ #endif /* GSSAPI */
diff --git a/openssh-6.4p1/gss-serv-krb5.c b/openssh-6.4p1/gss-serv-krb5.c diff --git a/openssh-6.5p1/gss-serv-krb5.c b/openssh-6.5p1/gss-serv-krb5.c
--- a/openssh-6.4p1/gss-serv-krb5.c --- a/openssh-6.5p1/gss-serv-krb5.c
+++ b/openssh-6.4p1/gss-serv-krb5.c +++ b/openssh-6.5p1/gss-serv-krb5.c
@@ -1,12 +1,12 @@ @@ -1,12 +1,12 @@
/* $OpenBSD: gss-serv-krb5.c,v 1.7 2006/08/03 03:34:42 deraadt Exp $ */ /* $OpenBSD: gss-serv-krb5.c,v 1.7 2006/08/03 03:34:42 deraadt Exp $ */
@ -1023,9 +1023,9 @@ diff --git a/openssh-6.4p1/gss-serv-krb5.c b/openssh-6.4p1/gss-serv-krb5.c
#endif /* KRB5 */ #endif /* KRB5 */
#endif /* GSSAPI */ #endif /* GSSAPI */
diff --git a/openssh-6.4p1/gss-serv.c b/openssh-6.4p1/gss-serv.c diff --git a/openssh-6.5p1/gss-serv.c b/openssh-6.5p1/gss-serv.c
--- a/openssh-6.4p1/gss-serv.c --- a/openssh-6.5p1/gss-serv.c
+++ b/openssh-6.4p1/gss-serv.c +++ b/openssh-6.5p1/gss-serv.c
@@ -1,12 +1,12 @@ @@ -1,12 +1,12 @@
/* $OpenBSD: gss-serv.c,v 1.23 2011/08/01 19:18:15 markus Exp $ */ /* $OpenBSD: gss-serv.c,v 1.23 2011/08/01 19:18:15 markus Exp $ */
@ -1412,9 +1412,9 @@ diff --git a/openssh-6.4p1/gss-serv.c b/openssh-6.4p1/gss-serv.c
} }
#endif #endif
diff --git a/openssh-6.4p1/kex.c b/openssh-6.4p1/kex.c diff --git a/openssh-6.5p1/kex.c b/openssh-6.5p1/kex.c
--- a/openssh-6.4p1/kex.c --- a/openssh-6.5p1/kex.c
+++ b/openssh-6.4p1/kex.c +++ b/openssh-6.5p1/kex.c
@@ -46,16 +46,24 @@ @@ -46,16 +46,24 @@
#include "log.h" #include "log.h"
#include "mac.h" #include "mac.h"
@ -1471,9 +1471,9 @@ diff --git a/openssh-6.4p1/kex.c b/openssh-6.4p1/kex.c
choose_hostkeyalg(Kex *k, char *client, char *server) choose_hostkeyalg(Kex *k, char *client, char *server)
{ {
char *hostkeyalg = match_list(client, server, NULL); char *hostkeyalg = match_list(client, server, NULL);
diff --git a/openssh-6.4p1/kex.h b/openssh-6.4p1/kex.h diff --git a/openssh-6.5p1/kex.h b/openssh-6.5p1/kex.h
--- a/openssh-6.4p1/kex.h --- a/openssh-6.5p1/kex.h
+++ b/openssh-6.4p1/kex.h +++ b/openssh-6.5p1/kex.h
@@ -68,16 +68,19 @@ enum kex_modes { @@ -68,16 +68,19 @@ enum kex_modes {
}; };
@ -1539,10 +1539,10 @@ diff --git a/openssh-6.4p1/kex.h b/openssh-6.4p1/kex.h
kexgex_hash(const EVP_MD *, char *, char *, char *, int, char *, kexgex_hash(const EVP_MD *, char *, char *, char *, int, char *,
int, u_char *, int, int, int, int, BIGNUM *, BIGNUM *, BIGNUM *, int, u_char *, int, int, int, int, BIGNUM *, BIGNUM *, BIGNUM *,
BIGNUM *, BIGNUM *, u_char **, u_int *); BIGNUM *, BIGNUM *, u_char **, u_int *);
diff --git a/openssh-6.4p1/kexgssc.c b/openssh-6.4p1/kexgssc.c diff --git a/openssh-6.5p1/kexgssc.c b/openssh-6.5p1/kexgssc.c
new file mode 100644 new file mode 100644
--- /dev/null --- /dev/null
+++ b/openssh-6.4p1/kexgssc.c +++ b/openssh-6.5p1/kexgssc.c
@@ -0,0 +1,334 @@ @@ -0,0 +1,334 @@
+/* +/*
+ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved. + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
@ -1878,10 +1878,10 @@ new file mode 100644
+} +}
+ +
+#endif /* GSSAPI */ +#endif /* GSSAPI */
diff --git a/openssh-6.4p1/kexgsss.c b/openssh-6.4p1/kexgsss.c diff --git a/openssh-6.5p1/kexgsss.c b/openssh-6.5p1/kexgsss.c
new file mode 100644 new file mode 100644
--- /dev/null --- /dev/null
+++ b/openssh-6.4p1/kexgsss.c +++ b/openssh-6.5p1/kexgsss.c
@@ -0,0 +1,288 @@ @@ -0,0 +1,288 @@
+/* +/*
+ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved. + * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
@ -2171,9 +2171,9 @@ new file mode 100644
+ ssh_gssapi_rekey_creds(); + ssh_gssapi_rekey_creds();
+} +}
+#endif /* GSSAPI */ +#endif /* GSSAPI */
diff --git a/openssh-6.4p1/key.c b/openssh-6.4p1/key.c diff --git a/openssh-6.5p1/key.c b/openssh-6.5p1/key.c
--- a/openssh-6.4p1/key.c --- a/openssh-6.5p1/key.c
+++ b/openssh-6.4p1/key.c +++ b/openssh-6.5p1/key.c
@@ -1038,16 +1038,18 @@ key_ssh_name_from_type_nid(int type, int @@ -1038,16 +1038,18 @@ key_ssh_name_from_type_nid(int type, int
return "ecdsa-sha2-nistp384-cert-v01@openssh.com"; return "ecdsa-sha2-nistp384-cert-v01@openssh.com";
case NID_secp521r1: case NID_secp521r1:
@ -2212,9 +2212,9 @@ diff --git a/openssh-6.4p1/key.c b/openssh-6.4p1/key.c
int int
key_ecdsa_nid_from_name(const char *name) key_ecdsa_nid_from_name(const char *name)
diff --git a/openssh-6.4p1/key.h b/openssh-6.4p1/key.h diff --git a/openssh-6.5p1/key.h b/openssh-6.5p1/key.h
--- a/openssh-6.4p1/key.h --- a/openssh-6.5p1/key.h
+++ b/openssh-6.4p1/key.h +++ b/openssh-6.5p1/key.h
@@ -39,16 +39,17 @@ enum types { @@ -39,16 +39,17 @@ enum types {
KEY_RSA, KEY_RSA,
KEY_DSA, KEY_DSA,
@ -2233,9 +2233,9 @@ diff --git a/openssh-6.4p1/key.h b/openssh-6.4p1/key.h
SSH_FP_SHA256 SSH_FP_SHA256
}; };
enum fp_rep { enum fp_rep {
diff --git a/openssh-6.4p1/monitor.c b/openssh-6.4p1/monitor.c diff --git a/openssh-6.5p1/monitor.c b/openssh-6.5p1/monitor.c
--- a/openssh-6.4p1/monitor.c --- a/openssh-6.5p1/monitor.c
+++ b/openssh-6.4p1/monitor.c +++ b/openssh-6.5p1/monitor.c
@@ -178,16 +178,18 @@ int mm_answer_pam_respond(int, Buffer *) @@ -178,16 +178,18 @@ int mm_answer_pam_respond(int, Buffer *)
int mm_answer_pam_free_ctx(int, Buffer *); int mm_answer_pam_free_ctx(int, Buffer *);
#endif #endif
@ -2532,9 +2532,9 @@ diff --git a/openssh-6.4p1/monitor.c b/openssh-6.4p1/monitor.c
{ {
struct jpake_ctx *pctx; struct jpake_ctx *pctx;
u_char *x3_proof, *x4_proof; u_char *x3_proof, *x4_proof;
diff --git a/openssh-6.4p1/monitor.h b/openssh-6.4p1/monitor.h diff --git a/openssh-6.5p1/monitor.h b/openssh-6.5p1/monitor.h
--- a/openssh-6.4p1/monitor.h --- a/openssh-6.5p1/monitor.h
+++ b/openssh-6.4p1/monitor.h +++ b/openssh-6.5p1/monitor.h
@@ -70,16 +70,19 @@ enum monitor_reqtype { @@ -70,16 +70,19 @@ enum monitor_reqtype {
MONITOR_REQ_PAM_FREE_CTX = 110, MONITOR_ANS_PAM_FREE_CTX = 111, MONITOR_REQ_PAM_FREE_CTX = 110, MONITOR_ANS_PAM_FREE_CTX = 111,
MONITOR_REQ_AUDIT_EVENT = 112, MONITOR_REQ_AUDIT_COMMAND = 113, MONITOR_REQ_AUDIT_EVENT = 112, MONITOR_REQ_AUDIT_COMMAND = 113,
@ -2555,9 +2555,9 @@ diff --git a/openssh-6.4p1/monitor.h b/openssh-6.4p1/monitor.h
int m_sendfd; int m_sendfd;
int m_log_recvfd; int m_log_recvfd;
int m_log_sendfd; int m_log_sendfd;
diff --git a/openssh-6.4p1/monitor_wrap.c b/openssh-6.4p1/monitor_wrap.c diff --git a/openssh-6.5p1/monitor_wrap.c b/openssh-6.5p1/monitor_wrap.c
--- a/openssh-6.4p1/monitor_wrap.c --- a/openssh-6.5p1/monitor_wrap.c
+++ b/openssh-6.4p1/monitor_wrap.c +++ b/openssh-6.5p1/monitor_wrap.c
@@ -1303,33 +1303,78 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss @@ -1303,33 +1303,78 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss
&m); &m);
@ -2638,9 +2638,9 @@ diff --git a/openssh-6.4p1/monitor_wrap.c b/openssh-6.4p1/monitor_wrap.c
char **hash_scheme, char **salt) char **hash_scheme, char **salt)
{ {
Buffer m; Buffer m;
diff --git a/openssh-6.4p1/monitor_wrap.h b/openssh-6.4p1/monitor_wrap.h diff --git a/openssh-6.5p1/monitor_wrap.h b/openssh-6.5p1/monitor_wrap.h
--- a/openssh-6.4p1/monitor_wrap.h --- a/openssh-6.5p1/monitor_wrap.h
+++ b/openssh-6.4p1/monitor_wrap.h +++ b/openssh-6.5p1/monitor_wrap.h
@@ -54,18 +54,20 @@ int mm_user_key_verify(Key *, u_char *, @@ -54,18 +54,20 @@ int mm_user_key_verify(Key *, u_char *,
int mm_auth_rsa_key_allowed(struct passwd *, BIGNUM *, Key **); int mm_auth_rsa_key_allowed(struct passwd *, BIGNUM *, Key **);
int mm_auth_rsa_verify_response(Key *, BIGNUM *, u_char *); int mm_auth_rsa_verify_response(Key *, BIGNUM *, u_char *);
@ -2663,9 +2663,9 @@ diff --git a/openssh-6.4p1/monitor_wrap.h b/openssh-6.4p1/monitor_wrap.h
void *mm_sshpam_init_ctx(struct Authctxt *); void *mm_sshpam_init_ctx(struct Authctxt *);
int mm_sshpam_query(void *, char **, char **, u_int *, char ***, u_int **); int mm_sshpam_query(void *, char **, char **, u_int *, char ***, u_int **);
int mm_sshpam_respond(void *, u_int, char **); int mm_sshpam_respond(void *, u_int, char **);
diff --git a/openssh-6.4p1/readconf.c b/openssh-6.4p1/readconf.c diff --git a/openssh-6.5p1/readconf.c b/openssh-6.5p1/readconf.c
--- a/openssh-6.4p1/readconf.c --- a/openssh-6.5p1/readconf.c
+++ b/openssh-6.4p1/readconf.c +++ b/openssh-6.5p1/readconf.c
@@ -124,16 +124,18 @@ typedef enum { @@ -124,16 +124,18 @@ typedef enum {
oUsePrivilegedPort, oLogLevel, oCiphers, oProtocol, oMacs, oUsePrivilegedPort, oLogLevel, oCiphers, oProtocol, oMacs,
oGlobalKnownHostsFile2, oUserKnownHostsFile2, oPubkeyAuthentication, oGlobalKnownHostsFile2, oUserKnownHostsFile2, oPubkeyAuthentication,
@ -2813,9 +2813,9 @@ diff --git a/openssh-6.4p1/readconf.c b/openssh-6.4p1/readconf.c
options->rhosts_rsa_authentication = 0; options->rhosts_rsa_authentication = 0;
if (options->hostbased_authentication == -1) if (options->hostbased_authentication == -1)
options->hostbased_authentication = 0; options->hostbased_authentication = 0;
diff --git a/openssh-6.4p1/readconf.h b/openssh-6.4p1/readconf.h diff --git a/openssh-6.5p1/readconf.h b/openssh-6.5p1/readconf.h
--- a/openssh-6.4p1/readconf.h --- a/openssh-6.5p1/readconf.h
+++ b/openssh-6.4p1/readconf.h +++ b/openssh-6.5p1/readconf.h
@@ -43,18 +43,23 @@ typedef struct { @@ -43,18 +43,23 @@ typedef struct {
int rhosts_rsa_authentication; /* Try rhosts with RSA int rhosts_rsa_authentication; /* Try rhosts with RSA
* authentication. */ * authentication. */
@ -2840,9 +2840,9 @@ diff --git a/openssh-6.4p1/readconf.h b/openssh-6.4p1/readconf.h
int batch_mode; /* Batch mode: do not ask for passwords. */ int batch_mode; /* Batch mode: do not ask for passwords. */
int check_host_ip; /* Also keep track of keys for IP address */ int check_host_ip; /* Also keep track of keys for IP address */
int strict_host_key_checking; /* Strict host key checking. */ int strict_host_key_checking; /* Strict host key checking. */
diff --git a/openssh-6.4p1/servconf.c b/openssh-6.4p1/servconf.c diff --git a/openssh-6.5p1/servconf.c b/openssh-6.5p1/servconf.c
--- a/openssh-6.4p1/servconf.c --- a/openssh-6.5p1/servconf.c
+++ b/openssh-6.4p1/servconf.c +++ b/openssh-6.5p1/servconf.c
@@ -98,18 +98,21 @@ initialize_server_options(ServerOptions @@ -98,18 +98,21 @@ initialize_server_options(ServerOptions
options->hostbased_uses_name_from_packet_only = -1; options->hostbased_uses_name_from_packet_only = -1;
options->rsa_authentication = -1; options->rsa_authentication = -1;
@ -3000,9 +3000,9 @@ diff --git a/openssh-6.4p1/servconf.c b/openssh-6.4p1/servconf.c
dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication); dump_cfg_fmtint(sPasswordAuthentication, o->password_authentication);
dump_cfg_fmtint(sKbdInteractiveAuthentication, dump_cfg_fmtint(sKbdInteractiveAuthentication,
o->kbd_interactive_authentication); o->kbd_interactive_authentication);
diff --git a/openssh-6.4p1/servconf.h b/openssh-6.4p1/servconf.h diff --git a/openssh-6.5p1/servconf.h b/openssh-6.5p1/servconf.h
--- a/openssh-6.4p1/servconf.h --- a/openssh-6.5p1/servconf.h
+++ b/openssh-6.4p1/servconf.h +++ b/openssh-6.5p1/servconf.h
@@ -105,18 +105,21 @@ typedef struct { @@ -105,18 +105,21 @@ typedef struct {
* authentication mechanism, * authentication mechanism,
* such as SecurID or * such as SecurID or
@ -3025,9 +3025,9 @@ diff --git a/openssh-6.4p1/servconf.h b/openssh-6.4p1/servconf.h
/* If true, permit jpake auth */ /* If true, permit jpake auth */
int permit_empty_passwd; /* If false, do not permit empty int permit_empty_passwd; /* If false, do not permit empty
* passwords. */ * passwords. */
diff --git a/openssh-6.4p1/ssh-gss.h b/openssh-6.4p1/ssh-gss.h diff --git a/openssh-6.5p1/ssh-gss.h b/openssh-6.5p1/ssh-gss.h
--- a/openssh-6.4p1/ssh-gss.h --- a/openssh-6.5p1/ssh-gss.h
+++ b/openssh-6.4p1/ssh-gss.h +++ b/openssh-6.5p1/ssh-gss.h
@@ -1,11 +1,11 @@ @@ -1,11 +1,11 @@
/* $OpenBSD: ssh-gss.h,v 1.10 2007/06/12 08:20:00 djm Exp $ */ /* $OpenBSD: ssh-gss.h,v 1.10 2007/06/12 08:20:00 djm Exp $ */
/* /*
@ -3151,9 +3151,9 @@ diff --git a/openssh-6.4p1/ssh-gss.h b/openssh-6.4p1/ssh-gss.h
#endif /* GSSAPI */ #endif /* GSSAPI */
#endif /* _SSH_GSS_H */ #endif /* _SSH_GSS_H */
diff --git a/openssh-6.4p1/ssh_config b/openssh-6.4p1/ssh_config diff --git a/openssh-6.5p1/ssh_config b/openssh-6.5p1/ssh_config
--- a/openssh-6.4p1/ssh_config --- a/openssh-6.5p1/ssh_config
+++ b/openssh-6.4p1/ssh_config +++ b/openssh-6.5p1/ssh_config
@@ -32,16 +32,18 @@ Host * @@ -32,16 +32,18 @@ Host *
ForwardX11Trusted yes ForwardX11Trusted yes
@ -3173,9 +3173,9 @@ diff --git a/openssh-6.4p1/ssh_config b/openssh-6.4p1/ssh_config
# IdentityFile ~/.ssh/identity # IdentityFile ~/.ssh/identity
# IdentityFile ~/.ssh/id_rsa # IdentityFile ~/.ssh/id_rsa
# IdentityFile ~/.ssh/id_dsa # IdentityFile ~/.ssh/id_dsa
diff --git a/openssh-6.4p1/ssh_config.5 b/openssh-6.4p1/ssh_config.5 diff --git a/openssh-6.5p1/ssh_config.5 b/openssh-6.5p1/ssh_config.5
--- a/openssh-6.4p1/ssh_config.5 --- a/openssh-6.5p1/ssh_config.5
+++ b/openssh-6.4p1/ssh_config.5 +++ b/openssh-6.5p1/ssh_config.5
@@ -525,21 +525,53 @@ host key database, separated by whitespa @@ -525,21 +525,53 @@ host key database, separated by whitespa
The default is The default is
.Pa /etc/ssh/ssh_known_hosts , .Pa /etc/ssh/ssh_known_hosts ,
@ -3231,9 +3231,9 @@ diff --git a/openssh-6.4p1/ssh_config.5 b/openssh-6.4p1/ssh_config.5
These hashed names may be used normally by These hashed names may be used normally by
.Xr ssh 1 .Xr ssh 1
and and
diff --git a/openssh-6.4p1/sshconnect2.c b/openssh-6.4p1/sshconnect2.c diff --git a/openssh-6.5p1/sshconnect2.c b/openssh-6.5p1/sshconnect2.c
--- a/openssh-6.4p1/sshconnect2.c --- a/openssh-6.5p1/sshconnect2.c
+++ b/openssh-6.4p1/sshconnect2.c +++ b/openssh-6.5p1/sshconnect2.c
@@ -155,19 +155,44 @@ order_hostkeyalgs(char *host, struct soc @@ -155,19 +155,44 @@ order_hostkeyalgs(char *host, struct soc
return ret; return ret;
} }
@ -3503,9 +3503,9 @@ diff --git a/openssh-6.4p1/sshconnect2.c b/openssh-6.4p1/sshconnect2.c
/* initial userauth request */ /* initial userauth request */
packet_start(SSH2_MSG_USERAUTH_REQUEST); packet_start(SSH2_MSG_USERAUTH_REQUEST);
packet_put_cstring(authctxt->server_user); packet_put_cstring(authctxt->server_user);
diff --git a/openssh-6.4p1/sshd.c b/openssh-6.4p1/sshd.c diff --git a/openssh-6.5p1/sshd.c b/openssh-6.5p1/sshd.c
--- a/openssh-6.4p1/sshd.c --- a/openssh-6.5p1/sshd.c
+++ b/openssh-6.4p1/sshd.c +++ b/openssh-6.5p1/sshd.c
@@ -119,16 +119,24 @@ @@ -119,16 +119,24 @@
#include "ssh-gss.h" #include "ssh-gss.h"
#endif #endif
@ -3812,9 +3812,9 @@ diff --git a/openssh-6.4p1/sshd.c b/openssh-6.4p1/sshd.c
kex->host_key_index=&get_hostkey_index; kex->host_key_index=&get_hostkey_index;
xxx_kex = kex; xxx_kex = kex;
diff --git a/openssh-6.4p1/sshd_config b/openssh-6.4p1/sshd_config diff --git a/openssh-6.5p1/sshd_config b/openssh-6.5p1/sshd_config
--- a/openssh-6.4p1/sshd_config --- a/openssh-6.5p1/sshd_config
+++ b/openssh-6.4p1/sshd_config +++ b/openssh-6.5p1/sshd_config
@@ -75,16 +75,18 @@ PasswordAuthentication no @@ -75,16 +75,18 @@ PasswordAuthentication no
#KerberosAuthentication no #KerberosAuthentication no
#KerberosOrLocalPasswd yes #KerberosOrLocalPasswd yes
@ -3834,9 +3834,9 @@ diff --git a/openssh-6.4p1/sshd_config b/openssh-6.4p1/sshd_config
#GSSAPIEnableMITMAttack no #GSSAPIEnableMITMAttack no
diff --git a/openssh-6.4p1/sshd_config.5 b/openssh-6.4p1/sshd_config.5 diff --git a/openssh-6.5p1/sshd_config.5 b/openssh-6.5p1/sshd_config.5
--- a/openssh-6.4p1/sshd_config.5 --- a/openssh-6.5p1/sshd_config.5
+++ b/openssh-6.4p1/sshd_config.5 +++ b/openssh-6.5p1/sshd_config.5
@@ -475,22 +475,50 @@ to force remote port forwardings to bind @@ -475,22 +475,50 @@ to force remote port forwardings to bind
to allow the client to select the address to which the forwarding is bound. to allow the client to select the address to which the forwarding is bound.
The default is The default is

94
openssh-6.4p1-gssapimitm.patch → openssh-6.5p1-gssapimitm.patch
View File

@ -13,9 +13,9 @@
# recommended to use the 'gssapi-with-mic' mechanism. Existing installations # recommended to use the 'gssapi-with-mic' mechanism. Existing installations
# are encouraged to upgrade as soon as possible. # are encouraged to upgrade as soon as possible.
diff --git a/openssh-6.4p1/auth2-gss.c b/openssh-6.4p1/auth2-gss.c diff --git a/openssh-6.5p1/auth2-gss.c b/openssh-6.5p1/auth2-gss.c
--- a/openssh-6.4p1/auth2-gss.c --- a/openssh-6.5p1/auth2-gss.c
+++ b/openssh-6.4p1/auth2-gss.c +++ b/openssh-6.5p1/auth2-gss.c
@@ -173,16 +173,25 @@ input_gssapi_token(int type, u_int32_t p @@ -173,16 +173,25 @@ input_gssapi_token(int type, u_int32_t p
dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL); dispatch_set(SSH2_MSG_USERAUTH_GSSAPI_TOKEN, NULL);
if (flags & GSS_C_INTEG_FLAG) if (flags & GSS_C_INTEG_FLAG)
@ -58,9 +58,9 @@ diff --git a/openssh-6.4p1/auth2-gss.c b/openssh-6.4p1/auth2-gss.c
+}; +};
+ +
#endif /* GSSAPI */ #endif /* GSSAPI */
diff --git a/openssh-6.4p1/auth2.c b/openssh-6.4p1/auth2.c diff --git a/openssh-6.5p1/auth2.c b/openssh-6.5p1/auth2.c
--- a/openssh-6.4p1/auth2.c --- a/openssh-6.5p1/auth2.c
+++ b/openssh-6.4p1/auth2.c +++ b/openssh-6.5p1/auth2.c
@@ -65,26 +65,28 @@ extern Buffer loginmsg; @@ -65,26 +65,28 @@ extern Buffer loginmsg;
extern Authmethod method_none; extern Authmethod method_none;
@ -90,10 +90,10 @@ diff --git a/openssh-6.4p1/auth2.c b/openssh-6.4p1/auth2.c
&method_kbdint, &method_kbdint,
&method_hostbased, &method_hostbased,
NULL NULL
diff --git a/openssh-6.4p1/readconf.c b/openssh-6.4p1/readconf.c diff --git a/openssh-6.5p1/readconf.c b/openssh-6.5p1/readconf.c
--- a/openssh-6.4p1/readconf.c --- a/openssh-6.5p1/readconf.c
+++ b/openssh-6.4p1/readconf.c +++ b/openssh-6.5p1/readconf.c
@@ -126,17 +126,17 @@ typedef enum { @@ -134,17 +134,17 @@ typedef enum {
oCompressionLevel, oTCPKeepAlive, oNumberOfPasswordPrompts, oCompressionLevel, oTCPKeepAlive, oNumberOfPasswordPrompts,
oUsePrivilegedPort, oLogLevel, oCiphers, oProtocol, oMacs, oUsePrivilegedPort, oLogLevel, oCiphers, oProtocol, oMacs,
oGlobalKnownHostsFile2, oUserKnownHostsFile2, oPubkeyAuthentication, oGlobalKnownHostsFile2, oUserKnownHostsFile2, oPubkeyAuthentication,
@ -109,10 +109,10 @@ diff --git a/openssh-6.4p1/readconf.c b/openssh-6.4p1/readconf.c
oHashKnownHosts, oHashKnownHosts,
oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand, oTunnel, oTunnelDevice, oLocalCommand, oPermitLocalCommand,
oVisualHostKey, oUseRoaming, oZeroKnowledgePasswordAuthentication, oVisualHostKey, oUseRoaming, oZeroKnowledgePasswordAuthentication,
oKexAlgorithms, oIPQoS, oRequestTTY, oIgnoreUnknown, oKexAlgorithms, oIPQoS, oRequestTTY, oIgnoreUnknown, oProxyUseFdpass,
oIgnoredUnknownOption, oDeprecated, oUnsupported oCanonicalDomains, oCanonicalizeHostname, oCanonicalizeMaxDots,
} OpCodes; oCanonicalizeFallbackLocal, oCanonicalizePermittedCNAMEs,
@@ -168,19 +168,21 @@ static struct { @@ -178,19 +178,21 @@ static struct {
{ "skeyauthentication", oChallengeResponseAuthentication }, /* alias */ { "skeyauthentication", oChallengeResponseAuthentication }, /* alias */
{ "tisauthentication", oChallengeResponseAuthentication }, /* alias */ { "tisauthentication", oChallengeResponseAuthentication }, /* alias */
{ "kerberosauthentication", oUnsupported }, { "kerberosauthentication", oUnsupported },
@ -134,7 +134,7 @@ diff --git a/openssh-6.4p1/readconf.c b/openssh-6.4p1/readconf.c
{ "identitiesonly", oIdentitiesOnly }, { "identitiesonly", oIdentitiesOnly },
{ "hostname", oHostName }, { "hostname", oHostName },
{ "hostkeyalias", oHostKeyAlias }, { "hostkeyalias", oHostKeyAlias },
@@ -514,16 +516,20 @@ parse_flag: @@ -837,16 +839,20 @@ parse_time:
case oGssAuthentication: case oGssAuthentication:
intptr = &options->gss_authentication; intptr = &options->gss_authentication;
@ -155,7 +155,7 @@ diff --git a/openssh-6.4p1/readconf.c b/openssh-6.4p1/readconf.c
case oCheckHostIP: case oCheckHostIP:
intptr = &options->check_host_ip; intptr = &options->check_host_ip;
goto parse_flag; goto parse_flag;
@@ -1164,16 +1170,17 @@ initialize_options(Options * options) @@ -1484,16 +1490,17 @@ initialize_options(Options * options)
options->xauth_location = NULL; options->xauth_location = NULL;
options->gateway_ports = -1; options->gateway_ports = -1;
options->use_privileged_port = -1; options->use_privileged_port = -1;
@ -173,7 +173,7 @@ diff --git a/openssh-6.4p1/readconf.c b/openssh-6.4p1/readconf.c
options->batch_mode = -1; options->batch_mode = -1;
options->check_host_ip = -1; options->check_host_ip = -1;
options->strict_host_key_checking = -1; options->strict_host_key_checking = -1;
@@ -1265,16 +1272,18 @@ fill_default_options(Options * options) @@ -1591,16 +1598,18 @@ fill_default_options(Options * options)
if (options->pubkey_authentication == -1) if (options->pubkey_authentication == -1)
options->pubkey_authentication = 1; options->pubkey_authentication = 1;
if (options->challenge_response_authentication == -1) if (options->challenge_response_authentication == -1)
@ -192,10 +192,10 @@ diff --git a/openssh-6.4p1/readconf.c b/openssh-6.4p1/readconf.c
options->rhosts_rsa_authentication = 0; options->rhosts_rsa_authentication = 0;
if (options->hostbased_authentication == -1) if (options->hostbased_authentication == -1)
options->hostbased_authentication = 0; options->hostbased_authentication = 0;
diff --git a/openssh-6.4p1/readconf.h b/openssh-6.4p1/readconf.h diff --git a/openssh-6.5p1/readconf.h b/openssh-6.5p1/readconf.h
--- a/openssh-6.4p1/readconf.h --- a/openssh-6.5p1/readconf.h
+++ b/openssh-6.4p1/readconf.h +++ b/openssh-6.5p1/readconf.h
@@ -44,16 +44,17 @@ typedef struct { @@ -50,16 +50,17 @@ typedef struct {
* authentication. */ * authentication. */
int rsa_authentication; /* Try RSA authentication. */ int rsa_authentication; /* Try RSA authentication. */
int pubkey_authentication; /* Try ssh2 pubkey authentication. */ int pubkey_authentication; /* Try ssh2 pubkey authentication. */
@ -213,10 +213,10 @@ diff --git a/openssh-6.4p1/readconf.h b/openssh-6.4p1/readconf.h
int batch_mode; /* Batch mode: do not ask for passwords. */ int batch_mode; /* Batch mode: do not ask for passwords. */
int check_host_ip; /* Also keep track of keys for IP address */ int check_host_ip; /* Also keep track of keys for IP address */
int strict_host_key_checking; /* Strict host key checking. */ int strict_host_key_checking; /* Strict host key checking. */
diff --git a/openssh-6.4p1/servconf.c b/openssh-6.4p1/servconf.c diff --git a/openssh-6.5p1/servconf.c b/openssh-6.5p1/servconf.c
--- a/openssh-6.4p1/servconf.c --- a/openssh-6.5p1/servconf.c
+++ b/openssh-6.4p1/servconf.c +++ b/openssh-6.5p1/servconf.c
@@ -103,16 +103,17 @@ initialize_server_options(ServerOptions @@ -104,16 +104,17 @@ initialize_server_options(ServerOptions
options->rsa_authentication = -1; options->rsa_authentication = -1;
options->pubkey_authentication = -1; options->pubkey_authentication = -1;
options->kerberos_authentication = -1; options->kerberos_authentication = -1;
@ -234,7 +234,7 @@ diff --git a/openssh-6.4p1/servconf.c b/openssh-6.4p1/servconf.c
options->use_login = -1; options->use_login = -1;
options->compression = -1; options->compression = -1;
options->rekey_limit = -1; options->rekey_limit = -1;
@@ -237,16 +238,18 @@ fill_default_server_options(ServerOption @@ -242,16 +243,18 @@ fill_default_server_options(ServerOption
if (options->kerberos_ticket_cleanup == -1) if (options->kerberos_ticket_cleanup == -1)
options->kerberos_ticket_cleanup = 1; options->kerberos_ticket_cleanup = 1;
if (options->kerberos_get_afs_token == -1) if (options->kerberos_get_afs_token == -1)
@ -253,7 +253,7 @@ diff --git a/openssh-6.4p1/servconf.c b/openssh-6.4p1/servconf.c
options->challenge_response_authentication = 1; options->challenge_response_authentication = 1;
if (options->permit_empty_passwd == -1) if (options->permit_empty_passwd == -1)
options->permit_empty_passwd = 0; options->permit_empty_passwd = 0;
@@ -333,17 +336,17 @@ typedef enum { @@ -338,17 +341,17 @@ typedef enum {
sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression, sPermitUserEnvironment, sUseLogin, sAllowTcpForwarding, sCompression,
sRekeyLimit, sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups, sRekeyLimit, sAllowUsers, sDenyUsers, sAllowGroups, sDenyGroups,
sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile, sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
@ -272,7 +272,7 @@ diff --git a/openssh-6.4p1/servconf.c b/openssh-6.4p1/servconf.c
sAuthorizedKeysCommand, sAuthorizedKeysCommandUser, sAuthorizedKeysCommand, sAuthorizedKeysCommandUser,
sAuthenticationMethods, sHostKeyAgent, sAuthenticationMethods, sHostKeyAgent,
sDeprecated, sUnsupported sDeprecated, sUnsupported
@@ -400,19 +403,21 @@ static struct { @@ -405,19 +408,21 @@ static struct {
{ "kerberosticketcleanup", sUnsupported, SSHCFG_GLOBAL }, { "kerberosticketcleanup", sUnsupported, SSHCFG_GLOBAL },
{ "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL }, { "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
#endif #endif
@ -294,7 +294,7 @@ diff --git a/openssh-6.4p1/servconf.c b/openssh-6.4p1/servconf.c
#ifdef JPAKE #ifdef JPAKE
{ "zeroknowledgepasswordauthentication", sZeroKnowledgePasswordAuthentication, SSHCFG_ALL }, { "zeroknowledgepasswordauthentication", sZeroKnowledgePasswordAuthentication, SSHCFG_ALL },
#else #else
@@ -1072,16 +1077,20 @@ process_server_config_line(ServerOptions @@ -1093,16 +1098,20 @@ process_server_config_line(ServerOptions
case sGssAuthentication: case sGssAuthentication:
intptr = &options->gss_authentication; intptr = &options->gss_authentication;
goto parse_flag; goto parse_flag;
@ -315,10 +315,10 @@ diff --git a/openssh-6.4p1/servconf.c b/openssh-6.4p1/servconf.c
intptr = &options->zero_knowledge_password_authentication; intptr = &options->zero_knowledge_password_authentication;
goto parse_flag; goto parse_flag;
diff --git a/openssh-6.4p1/servconf.h b/openssh-6.4p1/servconf.h diff --git a/openssh-6.5p1/servconf.h b/openssh-6.5p1/servconf.h
--- a/openssh-6.4p1/servconf.h --- a/openssh-6.5p1/servconf.h
+++ b/openssh-6.4p1/servconf.h +++ b/openssh-6.5p1/servconf.h
@@ -107,16 +107,17 @@ typedef struct { @@ -108,16 +108,17 @@ typedef struct {
* such as SecurID or * such as SecurID or
* /etc/passwd */ * /etc/passwd */
int kerberos_ticket_cleanup; /* If true, destroy ticket int kerberos_ticket_cleanup; /* If true, destroy ticket
@ -336,9 +336,9 @@ diff --git a/openssh-6.4p1/servconf.h b/openssh-6.4p1/servconf.h
/* If true, permit jpake auth */ /* If true, permit jpake auth */
int permit_empty_passwd; /* If false, do not permit empty int permit_empty_passwd; /* If false, do not permit empty
* passwords. */ * passwords. */
diff --git a/openssh-6.4p1/ssh_config b/openssh-6.4p1/ssh_config diff --git a/openssh-6.5p1/ssh_config b/openssh-6.5p1/ssh_config
--- a/openssh-6.4p1/ssh_config --- a/openssh-6.5p1/ssh_config
+++ b/openssh-6.4p1/ssh_config +++ b/openssh-6.5p1/ssh_config
@@ -51,9 +51,16 @@ ForwardX11Trusted yes @@ -51,9 +51,16 @@ ForwardX11Trusted yes
# Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc # Ciphers aes128-ctr,aes192-ctr,aes256-ctr,arcfour256,arcfour128,aes128-cbc,3des-cbc
# MACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160 # MACs hmac-md5,hmac-sha1,umac-64@openssh.com,hmac-ripemd160
@ -356,10 +356,10 @@ diff --git a/openssh-6.4p1/ssh_config b/openssh-6.4p1/ssh_config
+# GSSAPIEnableMITMAttack no +# GSSAPIEnableMITMAttack no
+ +
# RekeyLimit 1G 1h # RekeyLimit 1G 1h
diff --git a/openssh-6.4p1/sshconnect2.c b/openssh-6.4p1/sshconnect2.c diff --git a/openssh-6.5p1/sshconnect2.c b/openssh-6.5p1/sshconnect2.c
--- a/openssh-6.4p1/sshconnect2.c --- a/openssh-6.5p1/sshconnect2.c
+++ b/openssh-6.4p1/sshconnect2.c +++ b/openssh-6.5p1/sshconnect2.c
@@ -322,16 +322,21 @@ static char *authmethods_get(void); @@ -324,16 +324,21 @@ static char *authmethods_get(void);
Authmethod authmethods[] = { Authmethod authmethods[] = {
#ifdef GSSAPI #ifdef GSSAPI
@ -381,7 +381,7 @@ diff --git a/openssh-6.4p1/sshconnect2.c b/openssh-6.4p1/sshconnect2.c
NULL}, NULL},
{"publickey", {"publickey",
userauth_pubkey, userauth_pubkey,
@@ -696,17 +701,19 @@ process_gssapi_token(void *ctxt, gss_buf @@ -698,17 +703,19 @@ process_gssapi_token(void *ctxt, gss_buf
packet_put_string(send_tok.value, send_tok.length); packet_put_string(send_tok.value, send_tok.length);
packet_send(); packet_send();
@ -402,10 +402,10 @@ diff --git a/openssh-6.4p1/sshconnect2.c b/openssh-6.4p1/sshconnect2.c
gssbuf.value = buffer_ptr(&b); gssbuf.value = buffer_ptr(&b);
gssbuf.length = buffer_len(&b); gssbuf.length = buffer_len(&b);
diff --git a/openssh-6.4p1/sshd_config b/openssh-6.4p1/sshd_config diff --git a/openssh-6.5p1/sshd_config b/openssh-6.5p1/sshd_config
--- a/openssh-6.4p1/sshd_config --- a/openssh-6.5p1/sshd_config
+++ b/openssh-6.4p1/sshd_config +++ b/openssh-6.5p1/sshd_config
@@ -79,16 +79,23 @@ PasswordAuthentication no @@ -80,16 +80,23 @@ PasswordAuthentication no
#KerberosOrLocalPasswd yes #KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes #KerberosTicketCleanup yes
#KerberosGetAFSToken no #KerberosGetAFSToken no
@ -421,8 +421,8 @@ diff --git a/openssh-6.4p1/sshd_config b/openssh-6.4p1/sshd_config
+#GSSAPIEnableMITMAttack no +#GSSAPIEnableMITMAttack no
+ +
+ +
# Set this to 'yes' to enable PAM authentication, account processing, # Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will # and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and # be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration, # PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass # PAM authentication via ChallengeResponseAuthentication may bypass

8
openssh-6.4p1-host_ident.patch → openssh-6.5p1-host_ident.patch
View File

@ -1,10 +1,10 @@
# identify hashed hosts in known_hosts and suggest command line for their # identify hashed hosts in known_hosts and suggest command line for their
# removal # removal
diff --git a/openssh-6.4p1/sshconnect.c b/openssh-6.4p1/sshconnect.c diff --git a/openssh-6.5p1/sshconnect.c b/openssh-6.5p1/sshconnect.c
--- a/openssh-6.4p1/sshconnect.c --- a/openssh-6.5p1/sshconnect.c
+++ b/openssh-6.4p1/sshconnect.c +++ b/openssh-6.5p1/sshconnect.c
@@ -986,16 +986,21 @@ check_host_key(char *hostname, struct so @@ -1067,16 +1067,21 @@ check_host_key(char *hostname, struct so
ip_found->file, ip_found->line); ip_found->file, ip_found->line);
} }
/* The host key has changed. */ /* The host key has changed. */

16
openssh-6.4p1-key-converter.patch → openssh-6.5p1-key-converter.patch
View File

@ -1,9 +1,9 @@
# SSHv1 to SSHv2 RSA keys converter # SSHv1 to SSHv2 RSA keys converter
diff --git a/openssh-6.4p1/converter/Makefile b/openssh-6.4p1/converter/Makefile diff --git a/openssh-6.5p1/converter/Makefile b/openssh-6.5p1/converter/Makefile
new file mode 100644 new file mode 100644
--- /dev/null --- /dev/null
+++ b/openssh-6.4p1/converter/Makefile +++ b/openssh-6.5p1/converter/Makefile
@@ -0,0 +1,17 @@ @@ -0,0 +1,17 @@
+ +
+bindir=/usr/bin +bindir=/usr/bin
@ -12,20 +12,20 @@ new file mode 100644
+all : ssh-keyconverter +all : ssh-keyconverter
+ +
+ssh-keyconverter.o: ssh-keyconverter.c ../key.h ../authfile.h ../misc.h ../xmalloc.h +ssh-keyconverter.o: ssh-keyconverter.c ../key.h ../authfile.h ../misc.h ../xmalloc.h
+ gcc $(CFLAGS) $(RPM_OPT_FLAGS) -c -I../ $< -o $@ + gcc $(RPM_OPT_FLAGS) -c -I../ $< -o $@
+ +
+ssh-keyconverter: ssh-keyconverter.o ../libssh.a ../openbsd-compat/libopenbsd-compat.a +ssh-keyconverter: ssh-keyconverter.o ../libssh.a ../openbsd-compat/libopenbsd-compat.a
+ gcc $< $(LDFLAGS) $(RPM_OPT_FLAGS) -L../ -L../openbsd-compat/ -lcrypto -lssh -lopenbsd-compat -lcrypto -lssh -lopenbsd-compat -lpam -ldl -lwrap -lutil -lz -lnsl -lcrypt -lssl -o $@ + gcc $< -Wl,--no-as-needed $(RPM_OPT_FLAGS) -L../ -L../openbsd-compat/ -lcrypto -lssh -lopenbsd-compat -lssh -lopenbsd-compat -lpam -ldl -lwrap -lutil -lz -lnsl -lcrypt -lssl -o $@
+ +
+install: ssh-keyconverter ssh-keyconverter.1 +install: ssh-keyconverter ssh-keyconverter.1
+ if [ ! -d $(DESTDIR)$(bindir) ]; then install -d -m 755 $(DESTDIR)$(bindir); fi + if [ ! -d $(DESTDIR)$(bindir) ]; then install -d -m 755 $(DESTDIR)$(bindir); fi
+ install -m 755 ssh-keyconverter $(DESTDIR)$(bindir) + install -m 755 ssh-keyconverter $(DESTDIR)$(bindir)
+ if [ ! -d $(DESTDIR)$(mandir)/man1 ]; then install -d -m 755 $(DESTDIR)$(mandir)/man1; fi + if [ ! -d $(DESTDIR)$(mandir)/man1 ]; then install -d -m 755 $(DESTDIR)$(mandir)/man1; fi
+ install -m 644 ssh-keyconverter.1 $(DESTDIR)$(mandir)/man1 + install -m 644 ssh-keyconverter.1 $(DESTDIR)$(mandir)/man1
diff --git a/openssh-6.4p1/converter/ssh-keyconverter.1 b/openssh-6.4p1/converter/ssh-keyconverter.1 diff --git a/openssh-6.5p1/converter/ssh-keyconverter.1 b/openssh-6.5p1/converter/ssh-keyconverter.1
new file mode 100644 new file mode 100644
--- /dev/null --- /dev/null
+++ b/openssh-6.4p1/converter/ssh-keyconverter.1 +++ b/openssh-6.5p1/converter/ssh-keyconverter.1
@@ -0,0 +1,155 @@ @@ -0,0 +1,155 @@
+.\" Manpage for ssh-keyconverter +.\" Manpage for ssh-keyconverter
+.\" +.\"
@ -182,10 +182,10 @@ new file mode 100644
+.%D March 2001 +.%D March 2001
+.%O work in progress material +.%O work in progress material
+.Re +.Re
diff --git a/openssh-6.4p1/converter/ssh-keyconverter.c b/openssh-6.4p1/converter/ssh-keyconverter.c diff --git a/openssh-6.5p1/converter/ssh-keyconverter.c b/openssh-6.5p1/converter/ssh-keyconverter.c
new file mode 100644 new file mode 100644
--- /dev/null --- /dev/null
+++ b/openssh-6.4p1/converter/ssh-keyconverter.c +++ b/openssh-6.5p1/converter/ssh-keyconverter.c
@@ -0,0 +1,345 @@ @@ -0,0 +1,345 @@
+/* +/*
+ * SSH v1 to v2 RSA key converter. + * SSH v1 to v2 RSA key converter.

6
openssh-6.4p1-lastlog.patch → openssh-6.5p1-lastlog.patch
View File

@ -1,9 +1,9 @@
# set uid for functions that use it to seek in lastlog and wtmp files # set uid for functions that use it to seek in lastlog and wtmp files
# bnc#18024 (was suse #3024) # bnc#18024 (was suse #3024)
diff --git a/openssh-6.4p1/sshlogin.c b/openssh-6.4p1/sshlogin.c diff --git a/openssh-6.5p1/sshlogin.c b/openssh-6.5p1/sshlogin.c
--- a/openssh-6.4p1/sshlogin.c --- a/openssh-6.5p1/sshlogin.c
+++ b/openssh-6.4p1/sshlogin.c +++ b/openssh-6.5p1/sshlogin.c
@@ -128,16 +128,17 @@ record_login(pid_t pid, const char *tty, @@ -128,16 +128,17 @@ record_login(pid_t pid, const char *tty,
{ {
struct logininfo *li; struct logininfo *li;

120
openssh-6.4p1-ldap.patch → openssh-6.5p1-ldap.patch
View File

@ -8,10 +8,10 @@
# internal versions. ssh-keyconverter consequently fails to link as it lacks # internal versions. ssh-keyconverter consequently fails to link as it lacks
# the proper flags, and libopenbsd-compat doesn't contain the b64_* functions) # the proper flags, and libopenbsd-compat doesn't contain the b64_* functions)
diff --git a/openssh-6.4p1/HOWTO.ldap-keys b/openssh-6.4p1/HOWTO.ldap-keys diff --git a/openssh-6.5p1/HOWTO.ldap-keys b/openssh-6.5p1/HOWTO.ldap-keys
new file mode 100644 new file mode 100644
--- /dev/null --- /dev/null
+++ b/openssh-6.4p1/HOWTO.ldap-keys +++ b/openssh-6.5p1/HOWTO.ldap-keys
@@ -0,0 +1,108 @@ @@ -0,0 +1,108 @@
+ +
+HOW TO START +HOW TO START
@ -121,9 +121,9 @@ new file mode 100644
+ - frederic peters. + - frederic peters.
+ - Finlay dobbie. + - Finlay dobbie.
+ - Stefan Fisher. + - Stefan Fisher.
diff --git a/openssh-6.4p1/Makefile.in b/openssh-6.4p1/Makefile.in diff --git a/openssh-6.5p1/Makefile.in b/openssh-6.5p1/Makefile.in
--- a/openssh-6.4p1/Makefile.in --- a/openssh-6.5p1/Makefile.in
+++ b/openssh-6.4p1/Makefile.in +++ b/openssh-6.5p1/Makefile.in
@@ -20,16 +20,18 @@ srcdir=@srcdir@ @@ -20,16 +20,18 @@ srcdir=@srcdir@
top_srcdir=@top_srcdir@ top_srcdir=@top_srcdir@
@ -164,14 +164,14 @@ diff --git a/openssh-6.4p1/Makefile.in b/openssh-6.4p1/Makefile.in
log.o match.o md-sha256.o moduli.o nchan.o packet.o \ log.o match.o md-sha256.o moduli.o nchan.o packet.o \
readpass.o rsa.o ttymodes.o xmalloc.o addrmatch.o \ readpass.o rsa.o ttymodes.o xmalloc.o addrmatch.o \
atomicio.o key.o dispatch.o kex.o mac.o uidswap.o uuencode.o misc.o \ atomicio.o key.o dispatch.o kex.o mac.o uidswap.o uuencode.o misc.o \
@@ -90,18 +94,18 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passw @@ -94,18 +98,18 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passw
auth-krb5.o \ kexc25519s.o auth-krb5.o \
auth2-gss.o gss-serv.o gss-serv-krb5.o \ auth2-gss.o gss-serv.o gss-serv-krb5.o \
loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \ loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \
sftp-server.o sftp-common.o \ sftp-server.o sftp-common.o \
roaming_common.o roaming_serv.o \ roaming_common.o roaming_serv.o \
sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o \ sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o \
sandbox-seccomp-filter.o sandbox-seccomp-filter.o sandbox-capsicum.o
-MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out sshd_config.5.out ssh_config.5.out -MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out sshd_config.5.out ssh_config.5.out
-MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 sshd_config.5 ssh_config.5 -MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 sshd_config.5 ssh_config.5
@ -185,7 +185,7 @@ diff --git a/openssh-6.4p1/Makefile.in b/openssh-6.4p1/Makefile.in
PATHSUBS = \ PATHSUBS = \
-e 's|/etc/ssh/ssh_config|$(sysconfdir)/ssh_config|g' \ -e 's|/etc/ssh/ssh_config|$(sysconfdir)/ssh_config|g' \
-e 's|/etc/ssh/ssh_known_hosts|$(sysconfdir)/ssh_known_hosts|g' \ -e 's|/etc/ssh/ssh_known_hosts|$(sysconfdir)/ssh_known_hosts|g' \
@@ -164,16 +168,19 @@ ssh-keysign$(EXEEXT): $(LIBCOMPAT) libss @@ -169,16 +173,19 @@ ssh-keysign$(EXEEXT): $(LIBCOMPAT) libss
$(LD) -o $@ ssh-keysign.o readconf.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LD) -o $@ ssh-keysign.o readconf.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-pkcs11-helper.o ssh-pkcs11.o ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-pkcs11-helper.o ssh-pkcs11.o
@ -205,7 +205,7 @@ diff --git a/openssh-6.4p1/Makefile.in b/openssh-6.4p1/Makefile.in
# test driver for the loginrec code - not built by default # test driver for the loginrec code - not built by default
logintest: logintest.o $(LIBCOMPAT) libssh.a loginrec.o logintest: logintest.o $(LIBCOMPAT) libssh.a loginrec.o
@@ -266,30 +273,38 @@ install-files: @@ -271,30 +278,38 @@ install-files:
$(INSTALL) -m 0755 $(STRIP_OPT) ssh-agent$(EXEEXT) $(DESTDIR)$(bindir)/ssh-agent$(EXEEXT) $(INSTALL) -m 0755 $(STRIP_OPT) ssh-agent$(EXEEXT) $(DESTDIR)$(bindir)/ssh-agent$(EXEEXT)
$(INSTALL) -m 0755 $(STRIP_OPT) ssh-keygen$(EXEEXT) $(DESTDIR)$(bindir)/ssh-keygen$(EXEEXT) $(INSTALL) -m 0755 $(STRIP_OPT) ssh-keygen$(EXEEXT) $(DESTDIR)$(bindir)/ssh-keygen$(EXEEXT)
$(INSTALL) -m 0755 $(STRIP_OPT) ssh-keyscan$(EXEEXT) $(DESTDIR)$(bindir)/ssh-keyscan$(EXEEXT) $(INSTALL) -m 0755 $(STRIP_OPT) ssh-keyscan$(EXEEXT) $(DESTDIR)$(bindir)/ssh-keyscan$(EXEEXT)
@ -244,7 +244,7 @@ diff --git a/openssh-6.4p1/Makefile.in b/openssh-6.4p1/Makefile.in
install-sysconf: install-sysconf:
if [ ! -d $(DESTDIR)$(sysconfdir) ]; then \ if [ ! -d $(DESTDIR)$(sysconfdir) ]; then \
$(srcdir)/mkinstalldirs $(DESTDIR)$(sysconfdir); \ $(srcdir)/mkinstalldirs $(DESTDIR)$(sysconfdir); \
@@ -309,16 +324,23 @@ install-sysconf: @@ -314,16 +329,23 @@ install-sysconf:
echo "moving $(DESTDIR)$(sysconfdir)/primes to $(DESTDIR)$(sysconfdir)/moduli"; \ echo "moving $(DESTDIR)$(sysconfdir)/primes to $(DESTDIR)$(sysconfdir)/moduli"; \
mv "$(DESTDIR)$(sysconfdir)/primes" "$(DESTDIR)$(sysconfdir)/moduli"; \ mv "$(DESTDIR)$(sysconfdir)/primes" "$(DESTDIR)$(sysconfdir)/moduli"; \
else \ else \
@ -268,7 +268,7 @@ diff --git a/openssh-6.4p1/Makefile.in b/openssh-6.4p1/Makefile.in
else \ else \
./ssh-keygen -t rsa1 -f $(sysconfdir)/ssh_host_key -N "" ; \ ./ssh-keygen -t rsa1 -f $(sysconfdir)/ssh_host_key -N "" ; \
fi ; \ fi ; \
@@ -366,27 +388,30 @@ uninstall: @@ -377,27 +399,30 @@ uninstall:
-rm -f $(DESTDIR)$(bindir)/ssh-agent$(EXEEXT) -rm -f $(DESTDIR)$(bindir)/ssh-agent$(EXEEXT)
-rm -f $(DESTDIR)$(bindir)/ssh-keygen$(EXEEXT) -rm -f $(DESTDIR)$(bindir)/ssh-keygen$(EXEEXT)
-rm -f $(DESTDIR)$(bindir)/ssh-keyscan$(EXEEXT) -rm -f $(DESTDIR)$(bindir)/ssh-keyscan$(EXEEXT)
@ -299,10 +299,10 @@ diff --git a/openssh-6.4p1/Makefile.in b/openssh-6.4p1/Makefile.in
ln -s `cd $(srcdir) && pwd`/regress/Makefile `pwd`/regress/Makefile ln -s `cd $(srcdir) && pwd`/regress/Makefile `pwd`/regress/Makefile
$(CC) $(CFLAGS) $(CPPFLAGS) -o $@ $? \ $(CC) $(CFLAGS) $(CPPFLAGS) -o $@ $? \
$(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
diff --git a/openssh-6.4p1/configure.ac b/openssh-6.4p1/configure.ac diff --git a/openssh-6.5p1/configure.ac b/openssh-6.5p1/configure.ac
--- a/openssh-6.4p1/configure.ac --- a/openssh-6.5p1/configure.ac
+++ b/openssh-6.4p1/configure.ac +++ b/openssh-6.5p1/configure.ac
@@ -1519,16 +1519,116 @@ AC_ARG_WITH([audit], @@ -1573,16 +1573,116 @@ AC_ARG_WITH([audit],
AC_MSG_RESULT([no]) AC_MSG_RESULT([no])
;; ;;
*) *)
@ -411,18 +411,18 @@ diff --git a/openssh-6.4p1/configure.ac b/openssh-6.4p1/configure.ac
+) +)
+AC_SUBST(INSTALL_SSH_LDAP_HELPER) +AC_SUBST(INSTALL_SSH_LDAP_HELPER)
+ +
dnl Checks for library functions. Please keep in alphabetical order AC_ARG_WITH([pie],
AC_CHECK_FUNCS([ \ [ --with-pie Build Position Independent Executables if possible], [
arc4random \ if test "x$withval" = "xno"; then
arc4random_buf \ use_pie=no
arc4random_uniform \ fi
asprintf \ if test "x$withval" = "xyes"; then
b64_ntop \ use_pie=yes
__b64_ntop \ fi
diff --git a/openssh-6.4p1/ldap-helper.c b/openssh-6.4p1/ldap-helper.c diff --git a/openssh-6.5p1/ldap-helper.c b/openssh-6.5p1/ldap-helper.c
new file mode 100644 new file mode 100644
--- /dev/null --- /dev/null
+++ b/openssh-6.4p1/ldap-helper.c +++ b/openssh-6.5p1/ldap-helper.c
@@ -0,0 +1,155 @@ @@ -0,0 +1,155 @@
+/* $OpenBSD: ssh-pka-ldap.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */ +/* $OpenBSD: ssh-pka-ldap.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/* +/*
@ -579,10 +579,10 @@ new file mode 100644
+void *buffer_get_string(Buffer *b, u_int *l) { return NULL; } +void *buffer_get_string(Buffer *b, u_int *l) { return NULL; }
+void buffer_put_string(Buffer *b, const void *f, u_int l) {} +void buffer_put_string(Buffer *b, const void *f, u_int l) {}
+ +
diff --git a/openssh-6.4p1/ldap-helper.h b/openssh-6.4p1/ldap-helper.h diff --git a/openssh-6.5p1/ldap-helper.h b/openssh-6.5p1/ldap-helper.h
new file mode 100644 new file mode 100644
--- /dev/null --- /dev/null
+++ b/openssh-6.4p1/ldap-helper.h +++ b/openssh-6.5p1/ldap-helper.h
@@ -0,0 +1,32 @@ @@ -0,0 +1,32 @@
+/* $OpenBSD: ldap-helper.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */ +/* $OpenBSD: ldap-helper.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/* +/*
@ -616,10 +616,10 @@ new file mode 100644
+extern int config_warning_config_file; +extern int config_warning_config_file;
+ +
+#endif /* LDAP_HELPER_H */ +#endif /* LDAP_HELPER_H */
diff --git a/openssh-6.4p1/ldap.conf b/openssh-6.4p1/ldap.conf diff --git a/openssh-6.5p1/ldap.conf b/openssh-6.5p1/ldap.conf
new file mode 100644 new file mode 100644
--- /dev/null --- /dev/null
+++ b/openssh-6.4p1/ldap.conf +++ b/openssh-6.5p1/ldap.conf
@@ -0,0 +1,88 @@ @@ -0,0 +1,88 @@
+# $Id: openssh-5.5p1-ldap.patch,v 1.3 2010/07/07 13:48:36 jfch2222 Exp $ +# $Id: openssh-5.5p1-ldap.patch,v 1.3 2010/07/07 13:48:36 jfch2222 Exp $
+# +#
@ -709,10 +709,10 @@ new file mode 100644
+#tls_cert +#tls_cert
+#tls_key +#tls_key
+ +
diff --git a/openssh-6.4p1/ldapbody.c b/openssh-6.4p1/ldapbody.c diff --git a/openssh-6.5p1/ldapbody.c b/openssh-6.5p1/ldapbody.c
new file mode 100644 new file mode 100644
--- /dev/null --- /dev/null
+++ b/openssh-6.4p1/ldapbody.c +++ b/openssh-6.5p1/ldapbody.c
@@ -0,0 +1,494 @@ @@ -0,0 +1,494 @@
+/* $OpenBSD: ldapbody.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */ +/* $OpenBSD: ldapbody.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/* +/*
@ -1208,10 +1208,10 @@ new file mode 100644
+ return; + return;
+} +}
+ +
diff --git a/openssh-6.4p1/ldapbody.h b/openssh-6.4p1/ldapbody.h diff --git a/openssh-6.5p1/ldapbody.h b/openssh-6.5p1/ldapbody.h
new file mode 100644 new file mode 100644
--- /dev/null --- /dev/null
+++ b/openssh-6.4p1/ldapbody.h +++ b/openssh-6.5p1/ldapbody.h
@@ -0,0 +1,37 @@ @@ -0,0 +1,37 @@
+/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */ +/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/* +/*
@ -1250,10 +1250,10 @@ new file mode 100644
+ +
+#endif /* LDAPBODY_H */ +#endif /* LDAPBODY_H */
+ +
diff --git a/openssh-6.4p1/ldapconf.c b/openssh-6.4p1/ldapconf.c diff --git a/openssh-6.5p1/ldapconf.c b/openssh-6.5p1/ldapconf.c
new file mode 100644 new file mode 100644
--- /dev/null --- /dev/null
+++ b/openssh-6.4p1/ldapconf.c +++ b/openssh-6.5p1/ldapconf.c
@@ -0,0 +1,682 @@ @@ -0,0 +1,682 @@
+/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */ +/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/* +/*
@ -1937,10 +1937,10 @@ new file mode 100644
+ dump_cfg_string(lSSH_Filter, options.ssh_filter); + dump_cfg_string(lSSH_Filter, options.ssh_filter);
+} +}
+ +
diff --git a/openssh-6.4p1/ldapconf.h b/openssh-6.4p1/ldapconf.h diff --git a/openssh-6.5p1/ldapconf.h b/openssh-6.5p1/ldapconf.h
new file mode 100644 new file mode 100644
--- /dev/null --- /dev/null
+++ b/openssh-6.4p1/ldapconf.h +++ b/openssh-6.5p1/ldapconf.h
@@ -0,0 +1,71 @@ @@ -0,0 +1,71 @@
+/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */ +/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/* +/*
@ -2013,10 +2013,10 @@ new file mode 100644
+void dump_config(void); +void dump_config(void);
+ +
+#endif /* LDAPCONF_H */ +#endif /* LDAPCONF_H */
diff --git a/openssh-6.4p1/ldapincludes.h b/openssh-6.4p1/ldapincludes.h diff --git a/openssh-6.5p1/ldapincludes.h b/openssh-6.5p1/ldapincludes.h
new file mode 100644 new file mode 100644
--- /dev/null --- /dev/null
+++ b/openssh-6.4p1/ldapincludes.h +++ b/openssh-6.5p1/ldapincludes.h
@@ -0,0 +1,41 @@ @@ -0,0 +1,41 @@
+/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */ +/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/* +/*
@ -2059,10 +2059,10 @@ new file mode 100644
+#endif +#endif
+ +
+#endif /* LDAPINCLUDES_H */ +#endif /* LDAPINCLUDES_H */
diff --git a/openssh-6.4p1/ldapmisc.c b/openssh-6.4p1/ldapmisc.c diff --git a/openssh-6.5p1/ldapmisc.c b/openssh-6.5p1/ldapmisc.c
new file mode 100644 new file mode 100644
--- /dev/null --- /dev/null
+++ b/openssh-6.4p1/ldapmisc.c +++ b/openssh-6.5p1/ldapmisc.c
@@ -0,0 +1,79 @@ @@ -0,0 +1,79 @@
+ +
+#include "ldapincludes.h" +#include "ldapincludes.h"
@ -2143,10 +2143,10 @@ new file mode 100644
+} +}
+#endif +#endif
+ +
diff --git a/openssh-6.4p1/ldapmisc.h b/openssh-6.4p1/ldapmisc.h diff --git a/openssh-6.5p1/ldapmisc.h b/openssh-6.5p1/ldapmisc.h
new file mode 100644 new file mode 100644
--- /dev/null --- /dev/null
+++ b/openssh-6.4p1/ldapmisc.h +++ b/openssh-6.5p1/ldapmisc.h
@@ -0,0 +1,35 @@ @@ -0,0 +1,35 @@
+/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */ +/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/* +/*
@ -2183,9 +2183,9 @@ new file mode 100644
+ +
+#endif /* LDAPMISC_H */ +#endif /* LDAPMISC_H */
+ +
diff --git a/openssh-6.4p1/openbsd-compat/base64.c b/openssh-6.4p1/openbsd-compat/base64.c diff --git a/openssh-6.5p1/openbsd-compat/base64.c b/openssh-6.5p1/openbsd-compat/base64.c
--- a/openssh-6.4p1/openbsd-compat/base64.c --- a/openssh-6.5p1/openbsd-compat/base64.c
+++ b/openssh-6.4p1/openbsd-compat/base64.c +++ b/openssh-6.5p1/openbsd-compat/base64.c
@@ -41,17 +41,17 @@ @@ -41,17 +41,17 @@
* OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE, EVEN * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE, EVEN
* IF IBM IS APPRISED OF THE POSSIBILITY OF SUCH DAMAGES. * IF IBM IS APPRISED OF THE POSSIBILITY OF SUCH DAMAGES.
@ -2243,9 +2243,9 @@ diff --git a/openssh-6.4p1/openbsd-compat/base64.c b/openssh-6.4p1/openbsd-compa
*/ */
int int
diff --git a/openssh-6.4p1/openbsd-compat/base64.h b/openssh-6.4p1/openbsd-compat/base64.h diff --git a/openssh-6.5p1/openbsd-compat/base64.h b/openssh-6.5p1/openbsd-compat/base64.h
--- a/openssh-6.4p1/openbsd-compat/base64.h --- a/openssh-6.5p1/openbsd-compat/base64.h
+++ b/openssh-6.4p1/openbsd-compat/base64.h +++ b/openssh-6.5p1/openbsd-compat/base64.h
@@ -42,24 +42,24 @@ @@ -42,24 +42,24 @@
* IF IBM IS APPRISED OF THE POSSIBILITY OF SUCH DAMAGES. * IF IBM IS APPRISED OF THE POSSIBILITY OF SUCH DAMAGES.
*/ */
@ -2275,10 +2275,10 @@ diff --git a/openssh-6.4p1/openbsd-compat/base64.h b/openssh-6.4p1/openbsd-compa
#endif /* HAVE___B64_PTON */ #endif /* HAVE___B64_PTON */
#endif /* _BSD_BASE64_H */ #endif /* _BSD_BASE64_H */
diff --git a/openssh-6.4p1/openssh-lpk-openldap.schema b/openssh-6.4p1/openssh-lpk-openldap.schema diff --git a/openssh-6.5p1/openssh-lpk-openldap.schema b/openssh-6.5p1/openssh-lpk-openldap.schema
new file mode 100644 new file mode 100644
--- /dev/null --- /dev/null
+++ b/openssh-6.4p1/openssh-lpk-openldap.schema +++ b/openssh-6.5p1/openssh-lpk-openldap.schema
@@ -0,0 +1,21 @@ @@ -0,0 +1,21 @@
+# +#
+# LDAP Public Key Patch schema for use with openssh-ldappubkey +# LDAP Public Key Patch schema for use with openssh-ldappubkey
@ -2301,10 +2301,10 @@ new file mode 100644
+ DESC 'MANDATORY: OpenSSH LPK objectclass' + DESC 'MANDATORY: OpenSSH LPK objectclass'
+ MUST ( sshPublicKey $ uid ) + MUST ( sshPublicKey $ uid )
+ ) + )
diff --git a/openssh-6.4p1/openssh-lpk-sun.schema b/openssh-6.4p1/openssh-lpk-sun.schema diff --git a/openssh-6.5p1/openssh-lpk-sun.schema b/openssh-6.5p1/openssh-lpk-sun.schema
new file mode 100644 new file mode 100644
--- /dev/null --- /dev/null
+++ b/openssh-6.4p1/openssh-lpk-sun.schema +++ b/openssh-6.5p1/openssh-lpk-sun.schema
@@ -0,0 +1,23 @@ @@ -0,0 +1,23 @@
+# +#
+# LDAP Public Key Patch schema for use with openssh-ldappubkey +# LDAP Public Key Patch schema for use with openssh-ldappubkey
@ -2329,10 +2329,10 @@ new file mode 100644
+ DESC 'MANDATORY: OpenSSH LPK objectclass' + DESC 'MANDATORY: OpenSSH LPK objectclass'
+ MUST ( sshPublicKey $ uid ) + MUST ( sshPublicKey $ uid )
+ ) + )
diff --git a/openssh-6.4p1/ssh-ldap-helper.8 b/openssh-6.4p1/ssh-ldap-helper.8 diff --git a/openssh-6.5p1/ssh-ldap-helper.8 b/openssh-6.5p1/ssh-ldap-helper.8
new file mode 100644 new file mode 100644
--- /dev/null --- /dev/null
+++ b/openssh-6.4p1/ssh-ldap-helper.8 +++ b/openssh-6.5p1/ssh-ldap-helper.8
@@ -0,0 +1,79 @@ @@ -0,0 +1,79 @@
+.\" $OpenBSD: ssh-ldap-helper.8,v 1.1 2010/02/10 23:20:38 markus Exp $ +.\" $OpenBSD: ssh-ldap-helper.8,v 1.1 2010/02/10 23:20:38 markus Exp $
+.\" +.\"
@ -2413,19 +2413,19 @@ new file mode 100644
+OpenSSH 5.5 + PKA-LDAP . +OpenSSH 5.5 + PKA-LDAP .
+.Sh AUTHORS +.Sh AUTHORS
+.An Jan F. Chadima Aq jchadima@redhat.com +.An Jan F. Chadima Aq jchadima@redhat.com
diff --git a/openssh-6.4p1/ssh-ldap-wrapper b/openssh-6.4p1/ssh-ldap-wrapper diff --git a/openssh-6.5p1/ssh-ldap-wrapper b/openssh-6.5p1/ssh-ldap-wrapper
new file mode 100644 new file mode 100644
--- /dev/null --- /dev/null
+++ b/openssh-6.4p1/ssh-ldap-wrapper +++ b/openssh-6.5p1/ssh-ldap-wrapper
@@ -0,0 +1,4 @@ @@ -0,0 +1,4 @@
+#!/bin/sh +#!/bin/sh
+ +
+exec @LIBEXECDIR@/ssh-ldap-helper -s "$1" +exec @LIBEXECDIR@/ssh-ldap-helper -s "$1"
+ +
diff --git a/openssh-6.4p1/ssh-ldap.conf.5 b/openssh-6.4p1/ssh-ldap.conf.5 diff --git a/openssh-6.5p1/ssh-ldap.conf.5 b/openssh-6.5p1/ssh-ldap.conf.5
new file mode 100644 new file mode 100644
--- /dev/null --- /dev/null
+++ b/openssh-6.4p1/ssh-ldap.conf.5 +++ b/openssh-6.5p1/ssh-ldap.conf.5
@@ -0,0 +1,376 @@ @@ -0,0 +1,376 @@
+.\" $OpenBSD: ssh-ldap.conf.5,v 1.1 2010/02/10 23:20:38 markus Exp $ +.\" $OpenBSD: ssh-ldap.conf.5,v 1.1 2010/02/10 23:20:38 markus Exp $
+.\" +.\"

10
openssh-6.4p1-login_options.patch → openssh-6.5p1-login_options.patch
View File

@ -4,16 +4,16 @@
# #
# bnc#833605 # bnc#833605
diff --git a/openssh-6.4p1/configure.ac b/openssh-6.4p1/configure.ac diff --git a/openssh-6.5p1/configure.ac b/openssh-6.5p1/configure.ac
--- a/openssh-6.4p1/configure.ac --- a/openssh-6.5p1/configure.ac
+++ b/openssh-6.4p1/configure.ac +++ b/openssh-6.5p1/configure.ac
@@ -657,16 +657,18 @@ main() { if (NSVersionOfRunTimeLibrary(" @@ -695,16 +695,18 @@ main() { if (NSVersionOfRunTimeLibrary("
AC_DEFINE([SPT_TYPE], [SPT_REUSEARGV])
AC_DEFINE([_PATH_BTMP], ["/var/log/btmp"], [log for bad login attempts]) AC_DEFINE([_PATH_BTMP], ["/var/log/btmp"], [log for bad login attempts])
AC_DEFINE([USE_BTMP], [1], [Use btmp to log bad logins]) AC_DEFINE([USE_BTMP], [1], [Use btmp to log bad logins])
;; ;;
*-*-linux*) *-*-linux*)
no_dev_ptmx=1 no_dev_ptmx=1
use_pie=auto
check_for_libcrypt_later=1 check_for_libcrypt_later=1
check_for_openpty_ctty_bug=1 check_for_openpty_ctty_bug=1
+ AC_DEFINE([LOGIN_NO_ENDOPT], [1], + AC_DEFINE([LOGIN_NO_ENDOPT], [1],

8
openssh-6.4p1-no_fork-no_pid_file.patch → openssh-6.5p1-no_fork-no_pid_file.patch
View File

@ -1,9 +1,9 @@
# Do not write a PID file when not daemonizing (e.g. when running from systemd) # Do not write a PID file when not daemonizing (e.g. when running from systemd)
diff --git a/openssh-6.4p1/sshd.c b/openssh-6.4p1/sshd.c diff --git a/openssh-6.5p1/sshd.c b/openssh-6.5p1/sshd.c
--- a/openssh-6.4p1/sshd.c --- a/openssh-6.5p1/sshd.c
+++ b/openssh-6.4p1/sshd.c +++ b/openssh-6.5p1/sshd.c
@@ -1959,17 +1959,17 @@ main(int ac, char **av) @@ -1973,17 +1973,17 @@ main(int ac, char **av)
signal(SIGCHLD, main_sigchld_handler); signal(SIGCHLD, main_sigchld_handler);
signal(SIGTERM, sigterm_handler); signal(SIGTERM, sigterm_handler);
signal(SIGQUIT, sigterm_handler); signal(SIGQUIT, sigterm_handler);

44
openssh-6.4p1-pam-check-locks.patch → openssh-6.5p1-pam-check-locks.patch
View File

@ -2,9 +2,9 @@
# UsePAM is used # UsePAM is used
# bnc#708678, FATE#312033 # bnc#708678, FATE#312033
diff --git a/openssh-6.4p1/auth.c b/openssh-6.4p1/auth.c diff --git a/openssh-6.5p1/auth.c b/openssh-6.5p1/auth.c
--- a/openssh-6.4p1/auth.c --- a/openssh-6.5p1/auth.c
+++ b/openssh-6.4p1/auth.c +++ b/openssh-6.5p1/auth.c
@@ -103,17 +103,17 @@ allowed_user(struct passwd * pw) @@ -103,17 +103,17 @@ allowed_user(struct passwd * pw)
struct spwd *spw = NULL; struct spwd *spw = NULL;
#endif #endif
@ -43,9 +43,9 @@ diff --git a/openssh-6.4p1/auth.c b/openssh-6.4p1/auth.c
#endif #endif
#ifdef LOCKED_PASSWD_PREFIX #ifdef LOCKED_PASSWD_PREFIX
if (strncmp(passwd, LOCKED_PASSWD_PREFIX, if (strncmp(passwd, LOCKED_PASSWD_PREFIX,
diff --git a/openssh-6.4p1/servconf.c b/openssh-6.4p1/servconf.c diff --git a/openssh-6.5p1/servconf.c b/openssh-6.5p1/servconf.c
--- a/openssh-6.4p1/servconf.c --- a/openssh-6.5p1/servconf.c
+++ b/openssh-6.4p1/servconf.c +++ b/openssh-6.5p1/servconf.c
@@ -66,16 +66,17 @@ extern Buffer cfg; @@ -66,16 +66,17 @@ extern Buffer cfg;
void void
@ -64,7 +64,7 @@ diff --git a/openssh-6.4p1/servconf.c b/openssh-6.4p1/servconf.c
options->address_family = -1; options->address_family = -1;
options->num_host_key_files = 0; options->num_host_key_files = 0;
options->num_host_cert_files = 0; options->num_host_cert_files = 0;
@@ -157,16 +158,18 @@ initialize_server_options(ServerOptions @@ -158,16 +159,18 @@ initialize_server_options(ServerOptions
} }
void void
@ -83,7 +83,7 @@ diff --git a/openssh-6.4p1/servconf.c b/openssh-6.4p1/servconf.c
/* fill default hostkeys for protocols */ /* fill default hostkeys for protocols */
if (options->protocol & SSH_PROTO_1) if (options->protocol & SSH_PROTO_1)
options->host_key_files[options->num_host_key_files++] = options->host_key_files[options->num_host_key_files++] =
@@ -315,17 +318,17 @@ fill_default_server_options(ServerOption @@ -320,17 +323,17 @@ fill_default_server_options(ServerOption
#endif #endif
} }
@ -102,7 +102,7 @@ diff --git a/openssh-6.4p1/servconf.c b/openssh-6.4p1/servconf.c
sKerberosGetAFSToken, sKerberosGetAFSToken,
sKerberosTgtPassing, sChallengeResponseAuthentication, sKerberosTgtPassing, sChallengeResponseAuthentication,
sPasswordAuthentication, sKbdInteractiveAuthentication, sPasswordAuthentication, sKbdInteractiveAuthentication,
@@ -360,18 +363,20 @@ typedef enum { @@ -365,18 +368,20 @@ typedef enum {
static struct { static struct {
const char *name; const char *name;
ServerOpCodes opcode; ServerOpCodes opcode;
@ -123,7 +123,7 @@ diff --git a/openssh-6.4p1/servconf.c b/openssh-6.4p1/servconf.c
{ "hostdsakey", sHostKeyFile, SSHCFG_GLOBAL }, /* alias */ { "hostdsakey", sHostKeyFile, SSHCFG_GLOBAL }, /* alias */
{ "hostkeyagent", sHostKeyAgent, SSHCFG_GLOBAL }, { "hostkeyagent", sHostKeyAgent, SSHCFG_GLOBAL },
{ "pidfile", sPidFile, SSHCFG_GLOBAL }, { "pidfile", sPidFile, SSHCFG_GLOBAL },
@@ -857,16 +862,19 @@ process_server_config_line(ServerOptions @@ -878,16 +883,19 @@ process_server_config_line(ServerOptions
} }
} }
@ -143,10 +143,10 @@ diff --git a/openssh-6.4p1/servconf.c b/openssh-6.4p1/servconf.c
/* ignore ports from configfile if cmdline specifies ports */ /* ignore ports from configfile if cmdline specifies ports */
if (options->ports_from_cmdline) if (options->ports_from_cmdline)
return 0; return 0;
diff --git a/openssh-6.4p1/servconf.h b/openssh-6.4p1/servconf.h diff --git a/openssh-6.5p1/servconf.h b/openssh-6.5p1/servconf.h
--- a/openssh-6.4p1/servconf.h --- a/openssh-6.5p1/servconf.h
+++ b/openssh-6.4p1/servconf.h +++ b/openssh-6.5p1/servconf.h
@@ -161,16 +161,17 @@ typedef struct { @@ -162,16 +162,17 @@ typedef struct {
*/ */
u_int num_authkeys_files; /* Files containing public keys */ u_int num_authkeys_files; /* Files containing public keys */
@ -164,10 +164,10 @@ diff --git a/openssh-6.4p1/servconf.h b/openssh-6.4p1/servconf.h
char *chroot_directory; char *chroot_directory;
char *revoked_keys_file; char *revoked_keys_file;
char *trusted_user_ca_keys; char *trusted_user_ca_keys;
diff --git a/openssh-6.4p1/sshd_config.0 b/openssh-6.4p1/sshd_config.0 diff --git a/openssh-6.5p1/sshd_config.0 b/openssh-6.5p1/sshd_config.0
--- a/openssh-6.4p1/sshd_config.0 --- a/openssh-6.5p1/sshd_config.0
+++ b/openssh-6.4p1/sshd_config.0 +++ b/openssh-6.5p1/sshd_config.0
@@ -706,16 +706,24 @@ DESCRIPTION @@ -720,16 +720,24 @@ DESCRIPTION
Because PAM challenge-response authentication usually serves an Because PAM challenge-response authentication usually serves an
equivalent role to password authentication, you should disable equivalent role to password authentication, you should disable
@ -192,10 +192,10 @@ diff --git a/openssh-6.4p1/sshd_config.0 b/openssh-6.4p1/sshd_config.0
privilege separation is to prevent privilege escalation by privilege separation is to prevent privilege escalation by
containing any corruption within the unprivileged processes. The containing any corruption within the unprivileged processes. The
default is ``yes''. If UsePrivilegeSeparation is set to default is ``yes''. If UsePrivilegeSeparation is set to
diff --git a/openssh-6.4p1/sshd_config.5 b/openssh-6.4p1/sshd_config.5 diff --git a/openssh-6.5p1/sshd_config.5 b/openssh-6.5p1/sshd_config.5
--- a/openssh-6.4p1/sshd_config.5 --- a/openssh-6.5p1/sshd_config.5
+++ b/openssh-6.4p1/sshd_config.5 +++ b/openssh-6.5p1/sshd_config.5
@@ -1178,16 +1178,28 @@ or @@ -1199,16 +1199,28 @@ or
.Pp .Pp
If If
.Cm UsePAM .Cm UsePAM

14
openssh-6.4p1-pam-fix2.patch → openssh-6.5p1-pam-fix2.patch
View File

@ -1,10 +1,10 @@
# force PAM in defaullt install (this was removed from upstream in 3.8p1) # force PAM in defaullt install (this was removed from upstream in 3.8p1)
# bnc#46749 # bnc#46749
diff --git a/openssh-6.4p1/sshd_config b/openssh-6.4p1/sshd_config diff --git a/openssh-6.5p1/sshd_config b/openssh-6.5p1/sshd_config
--- a/openssh-6.4p1/sshd_config --- a/openssh-6.5p1/sshd_config
+++ b/openssh-6.4p1/sshd_config +++ b/openssh-6.5p1/sshd_config
@@ -63,17 +63,17 @@ AuthorizedKeysFile .ssh/authorized_keys @@ -64,17 +64,17 @@ AuthorizedKeysFile .ssh/authorized_keys
#HostbasedAuthentication no #HostbasedAuthentication no
# Change to yes if you don't trust ~/.ssh/known_hosts for # Change to yes if you don't trust ~/.ssh/known_hosts for
# RhostsRSAAuthentication and HostbasedAuthentication # RhostsRSAAuthentication and HostbasedAuthentication
@ -23,8 +23,8 @@ diff --git a/openssh-6.4p1/sshd_config b/openssh-6.4p1/sshd_config
# Kerberos options # Kerberos options
#KerberosAuthentication no #KerberosAuthentication no
#KerberosOrLocalPasswd yes #KerberosOrLocalPasswd yes
@@ -88,17 +88,17 @@ AuthorizedKeysFile .ssh/authorized_keys @@ -89,17 +89,17 @@ AuthorizedKeysFile .ssh/authorized_keys
# and session processing. If this is enabled, PAM authentication will # and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and # be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration, # PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass # PAM authentication via ChallengeResponseAuthentication may bypass
@ -41,4 +41,4 @@ diff --git a/openssh-6.4p1/sshd_config b/openssh-6.4p1/sshd_config
X11Forwarding yes X11Forwarding yes
#X11DisplayOffset 10 #X11DisplayOffset 10
#X11UseLocalhost yes #X11UseLocalhost yes
#PrintMotd yes #PermitTTY yes

8
openssh-6.4p1-pam-fix3.patch → openssh-6.5p1-pam-fix3.patch
View File

@ -1,10 +1,10 @@
# posix threads are generally not supported nor safe # posix threads are generally not supported nor safe
# (see upstream log from 2005-05-24) # (see upstream log from 2005-05-24)
diff --git a/openssh-6.4p1/auth-pam.c b/openssh-6.4p1/auth-pam.c diff --git a/openssh-6.5p1/auth-pam.c b/openssh-6.5p1/auth-pam.c
--- a/openssh-6.4p1/auth-pam.c --- a/openssh-6.5p1/auth-pam.c
+++ b/openssh-6.4p1/auth-pam.c +++ b/openssh-6.5p1/auth-pam.c
@@ -779,17 +779,19 @@ sshpam_query(void *ctx, char **name, cha @@ -781,17 +781,19 @@ sshpam_query(void *ctx, char **name, cha
} }
if (type == PAM_SUCCESS) { if (type == PAM_SUCCESS) {
if (!sshpam_authctxt->valid || if (!sshpam_authctxt->valid ||

10
openssh-6.4p1-pts.patch → openssh-6.5p1-pts.patch
View File

@ -1,10 +1,10 @@
# use same lines naming as utempter (prevents problems with using different # use same lines naming as utempter (prevents problems with using different
# formats in ?tmp? files) # formats in ?tmp? files)
diff --git a/openssh-6.4p1/loginrec.c b/openssh-6.4p1/loginrec.c diff --git a/openssh-6.5p1/loginrec.c b/openssh-6.5p1/loginrec.c
--- a/openssh-6.4p1/loginrec.c --- a/openssh-6.5p1/loginrec.c
+++ b/openssh-6.4p1/loginrec.c +++ b/openssh-6.5p1/loginrec.c
@@ -535,17 +535,17 @@ getlast_entry(struct logininfo *li) @@ -538,17 +538,17 @@ getlast_entry(struct logininfo *li)
/* /*
* 'line' string utility functions * 'line' string utility functions
* *
@ -23,7 +23,7 @@ diff --git a/openssh-6.4p1/loginrec.c b/openssh-6.4p1/loginrec.c
*/ */
@@ -596,16 +596,20 @@ line_abbrevname(char *dst, const char *s @@ -599,16 +599,20 @@ line_abbrevname(char *dst, const char *s
/* Always skip prefix if present */ /* Always skip prefix if present */
if (strncmp(src, "/dev/", 5) == 0) if (strncmp(src, "/dev/", 5) == 0)
src += 5; src += 5;

28
openssh-6.5p1-saveargv-fix.patch Normal file
View File

@ -0,0 +1,28 @@
# related to bnc#49845, upstream bug #529
diff --git a/openssh-6.5p1/sshd.c b/openssh-6.5p1/sshd.c
--- a/openssh-6.5p1/sshd.c
+++ b/openssh-6.5p1/sshd.c
@@ -1399,17 +1399,21 @@ main(int ac, char **av)
saved_argv = xcalloc(ac + 1, sizeof(*saved_argv));
for (i = 0; i < ac; i++)
saved_argv[i] = xstrdup(av[i]);
saved_argv[i] = NULL;
#ifndef HAVE_SETPROCTITLE
/* Prepare for later setproctitle emulation */
compat_init_setproctitle(ac, av);
- av = saved_argv;
+
+ av = xmalloc(sizeof(*saved_argv) * (saved_argc + 1));
+ for (i = 0; i < saved_argc; i++)
+ av[i] = xstrdup(saved_argv[i]);
+ av[i] = NULL;
#endif
if (geteuid() == 0 && setgroups(0, NULL) == -1)
debug("setgroups(): %.200s", strerror(errno));
/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
sanitise_stdfd();

108
openssh-6.4p1-seed-prng.patch → openssh-6.5p1-seed-prng.patch
View File

@ -1,9 +1,9 @@
# extended support for (re-)seeding the OpenSSL PRNG from /dev/random # extended support for (re-)seeding the OpenSSL PRNG from /dev/random
# bnc#703221, FATE#312172 # bnc#703221, FATE#312172
diff --git a/openssh-6.4p1/audit-bsm.c b/openssh-6.4p1/audit-bsm.c diff --git a/openssh-6.5p1/audit-bsm.c b/openssh-6.5p1/audit-bsm.c
--- a/openssh-6.4p1/audit-bsm.c --- a/openssh-6.5p1/audit-bsm.c
+++ b/openssh-6.4p1/audit-bsm.c +++ b/openssh-6.5p1/audit-bsm.c
@@ -504,9 +504,15 @@ audit_destroy_sensitive_data(const char @@ -504,9 +504,15 @@ audit_destroy_sensitive_data(const char
/* not implemented */ /* not implemented */
} }
@ -20,9 +20,9 @@ diff --git a/openssh-6.4p1/audit-bsm.c b/openssh-6.4p1/audit-bsm.c
+ /* not implemented */ + /* not implemented */
+} +}
#endif /* BSM */ #endif /* BSM */
diff --git a/openssh-6.4p1/audit-linux.c b/openssh-6.4p1/audit-linux.c diff --git a/openssh-6.5p1/audit-linux.c b/openssh-6.5p1/audit-linux.c
--- a/openssh-6.4p1/audit-linux.c --- a/openssh-6.5p1/audit-linux.c
+++ b/openssh-6.4p1/audit-linux.c +++ b/openssh-6.5p1/audit-linux.c
@@ -398,9 +398,31 @@ audit_generate_ephemeral_server_key(cons @@ -398,9 +398,31 @@ audit_generate_ephemeral_server_key(cons
} }
audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_KEY_USER, audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_KEY_USER,
@ -55,9 +55,9 @@ diff --git a/openssh-6.4p1/audit-linux.c b/openssh-6.4p1/audit-linux.c
+ error("cannot write into audit"); + error("cannot write into audit");
+} +}
#endif /* USE_LINUX_AUDIT */ #endif /* USE_LINUX_AUDIT */
diff --git a/openssh-6.4p1/audit.c b/openssh-6.4p1/audit.c diff --git a/openssh-6.5p1/audit.c b/openssh-6.5p1/audit.c
--- a/openssh-6.4p1/audit.c --- a/openssh-6.5p1/audit.c
+++ b/openssh-6.4p1/audit.c +++ b/openssh-6.5p1/audit.c
@@ -304,10 +304,16 @@ audit_destroy_sensitive_data(const char @@ -304,10 +304,16 @@ audit_destroy_sensitive_data(const char
/* /*
* This will be called on generation of the ephemeral server key * This will be called on generation of the ephemeral server key
@ -75,9 +75,9 @@ diff --git a/openssh-6.4p1/audit.c b/openssh-6.4p1/audit.c
+} +}
# endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */ # endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */
#endif /* SSH_AUDIT_EVENTS */ #endif /* SSH_AUDIT_EVENTS */
diff --git a/openssh-6.4p1/audit.h b/openssh-6.4p1/audit.h diff --git a/openssh-6.5p1/audit.h b/openssh-6.5p1/audit.h
--- a/openssh-6.4p1/audit.h --- a/openssh-6.5p1/audit.h
+++ b/openssh-6.4p1/audit.h +++ b/openssh-6.5p1/audit.h
@@ -63,10 +63,11 @@ void audit_key(int, int *, const Key *); @@ -63,10 +63,11 @@ void audit_key(int, int *, const Key *);
void audit_unsupported(int); void audit_unsupported(int);
void audit_kex(int, char *, char *, char *); void audit_kex(int, char *, char *, char *);
@ -90,9 +90,9 @@ diff --git a/openssh-6.4p1/audit.h b/openssh-6.4p1/audit.h
+void audit_linux_prng_seed(long, const char *); +void audit_linux_prng_seed(long, const char *);
#endif /* _SSH_AUDIT_H */ #endif /* _SSH_AUDIT_H */
diff --git a/openssh-6.4p1/entropy.c b/openssh-6.4p1/entropy.c diff --git a/openssh-6.5p1/entropy.c b/openssh-6.5p1/entropy.c
--- a/openssh-6.4p1/entropy.c --- a/openssh-6.5p1/entropy.c
+++ b/openssh-6.4p1/entropy.c +++ b/openssh-6.5p1/entropy.c
@@ -45,16 +45,17 @@ @@ -45,16 +45,17 @@
#include "ssh.h" #include "ssh.h"
@ -126,17 +126,17 @@ diff --git a/openssh-6.4p1/entropy.c b/openssh-6.4p1/entropy.c
if (RAND_status() != 1) if (RAND_status() != 1)
fatal("PRNG is not seeded"); fatal("PRNG is not seeded");
} }
diff --git a/openssh-6.4p1/openbsd-compat/Makefile.in b/openssh-6.4p1/openbsd-compat/Makefile.in diff --git a/openssh-6.5p1/openbsd-compat/Makefile.in b/openssh-6.5p1/openbsd-compat/Makefile.in
--- a/openssh-6.4p1/openbsd-compat/Makefile.in --- a/openssh-6.5p1/openbsd-compat/Makefile.in
+++ b/openssh-6.4p1/openbsd-compat/Makefile.in +++ b/openssh-6.5p1/openbsd-compat/Makefile.in
@@ -15,17 +15,17 @@ AR=@AR@ @@ -15,17 +15,17 @@ AR=@AR@
RANLIB=@RANLIB@ RANLIB=@RANLIB@
INSTALL=@INSTALL@ INSTALL=@INSTALL@
LDFLAGS=-L. @LDFLAGS@ LDFLAGS=-L. @LDFLAGS@
OPENBSD=base64.o basename.o bindresvport.o daemon.o dirname.o fmt_scaled.o getcwd.o getgrouplist.o getopt_long.o getrrsetbyname.o glob.o inet_aton.o inet_ntoa.o inet_ntop.o mktemp.o pwcache.o readpassphrase.o realpath.o rresvport.o setenv.o setproctitle.o sha2.o sigact.o strlcat.o strlcpy.o strmode.o strnlen.o strptime.o strsep.o strtonum.o strtoll.o strtoul.o strtoull.o timingsafe_bcmp.o vis.o OPENBSD=base64.o basename.o bcrypt_pbkdf.o bindresvport.o blowfish.o daemon.o dirname.o fmt_scaled.o getcwd.o getgrouplist.o getopt_long.o getrrsetbyname.o glob.o inet_aton.o inet_ntoa.o inet_ntop.o mktemp.o pwcache.o readpassphrase.o realpath.o rresvport.o setenv.o setproctitle.o sha2.o sigact.o strlcat.o strlcpy.o strmode.o strnlen.o strptime.o strsep.o strtonum.o strtoll.o strtoul.o strtoull.o timingsafe_bcmp.o vis.o blowfish.o bcrypt_pbkdf.o
COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o getrrsetbyname-ldns.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-setres_id.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o COMPAT=arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o getrrsetbyname-ldns.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-setres_id.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o
-PORTS=port-aix.o port-irix.o port-linux.o port-solaris.o port-tun.o port-uw.o -PORTS=port-aix.o port-irix.o port-linux.o port-solaris.o port-tun.o port-uw.o
+PORTS=port-aix.o port-irix.o port-linux.o port-linux-prng.o port-solaris.o port-tun.o port-uw.o +PORTS=port-aix.o port-irix.o port-linux.o port-linux-prng.o port-solaris.o port-tun.o port-uw.o
@ -148,10 +148,10 @@ diff --git a/openssh-6.4p1/openbsd-compat/Makefile.in b/openssh-6.4p1/openbsd-co
$(COMPAT): ../config.h $(COMPAT): ../config.h
$(OPENBSD): ../config.h $(OPENBSD): ../config.h
diff --git a/openssh-6.4p1/openbsd-compat/port-linux-prng.c b/openssh-6.4p1/openbsd-compat/port-linux-prng.c diff --git a/openssh-6.5p1/openbsd-compat/port-linux-prng.c b/openssh-6.5p1/openbsd-compat/port-linux-prng.c
new file mode 100644 new file mode 100644
--- /dev/null --- /dev/null
+++ b/openssh-6.4p1/openbsd-compat/port-linux-prng.c +++ b/openssh-6.5p1/openbsd-compat/port-linux-prng.c
@@ -0,0 +1,79 @@ @@ -0,0 +1,79 @@
+/* +/*
+ * Copyright (c) 2011 Jan F. Chadima <jchadima@redhat.com> + * Copyright (c) 2011 Jan F. Chadima <jchadima@redhat.com>
@ -232,9 +232,9 @@ new file mode 100644
+ fatal ("EOF reading %s", random); + fatal ("EOF reading %s", random);
+ } + }
+} +}
diff --git a/openssh-6.4p1/openbsd-compat/port-linux.h b/openssh-6.4p1/openbsd-compat/port-linux.h diff --git a/openssh-6.5p1/openbsd-compat/port-linux.h b/openssh-6.5p1/openbsd-compat/port-linux.h
--- a/openssh-6.4p1/openbsd-compat/port-linux.h --- a/openssh-6.5p1/openbsd-compat/port-linux.h
+++ b/openssh-6.4p1/openbsd-compat/port-linux.h +++ b/openssh-6.5p1/openbsd-compat/port-linux.h
@@ -14,16 +14,20 @@ @@ -14,16 +14,20 @@
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
@ -256,10 +256,10 @@ diff --git a/openssh-6.4p1/openbsd-compat/port-linux.h b/openssh-6.4p1/openbsd-c
void ssh_selinux_setfscreatecon(const char *); void ssh_selinux_setfscreatecon(const char *);
#endif #endif
diff --git a/openssh-6.4p1/ssh-add.1 b/openssh-6.4p1/ssh-add.1 diff --git a/openssh-6.5p1/ssh-add.1 b/openssh-6.5p1/ssh-add.1
--- a/openssh-6.4p1/ssh-add.1 --- a/openssh-6.5p1/ssh-add.1
+++ b/openssh-6.4p1/ssh-add.1 +++ b/openssh-6.5p1/ssh-add.1
@@ -155,16 +155,30 @@ or related script. @@ -156,16 +156,30 @@ or related script.
(Note that on some machines it (Note that on some machines it
may be necessary to redirect the input from may be necessary to redirect the input from
.Pa /dev/null .Pa /dev/null
@ -290,10 +290,10 @@ diff --git a/openssh-6.4p1/ssh-add.1 b/openssh-6.4p1/ssh-add.1
.It Pa ~/.ssh/id_dsa .It Pa ~/.ssh/id_dsa
Contains the protocol version 2 DSA authentication identity of the user. Contains the protocol version 2 DSA authentication identity of the user.
.It Pa ~/.ssh/id_ecdsa .It Pa ~/.ssh/id_ecdsa
diff --git a/openssh-6.4p1/ssh-agent.1 b/openssh-6.4p1/ssh-agent.1 diff --git a/openssh-6.5p1/ssh-agent.1 b/openssh-6.5p1/ssh-agent.1
--- a/openssh-6.4p1/ssh-agent.1 --- a/openssh-6.5p1/ssh-agent.1
+++ b/openssh-6.4p1/ssh-agent.1 +++ b/openssh-6.5p1/ssh-agent.1
@@ -193,16 +193,33 @@ Contains the protocol version 2 ECDSA au @@ -196,16 +196,33 @@ Contains the protocol version 2 ED25519
.It Pa ~/.ssh/id_rsa .It Pa ~/.ssh/id_rsa
Contains the protocol version 2 RSA authentication identity of the user. Contains the protocol version 2 RSA authentication identity of the user.
.It Pa $TMPDIR/ssh-XXXXXXXXXX/agent.\*(Ltppid\*(Gt .It Pa $TMPDIR/ssh-XXXXXXXXXX/agent.\*(Ltppid\*(Gt
@ -327,10 +327,10 @@ diff --git a/openssh-6.4p1/ssh-agent.1 b/openssh-6.4p1/ssh-agent.1
.Sh AUTHORS .Sh AUTHORS
OpenSSH is a derivative of the original and free OpenSSH is a derivative of the original and free
ssh 1.2.12 release by Tatu Ylonen. ssh 1.2.12 release by Tatu Ylonen.
diff --git a/openssh-6.4p1/ssh-keygen.1 b/openssh-6.4p1/ssh-keygen.1 diff --git a/openssh-6.5p1/ssh-keygen.1 b/openssh-6.5p1/ssh-keygen.1
--- a/openssh-6.4p1/ssh-keygen.1 --- a/openssh-6.5p1/ssh-keygen.1
+++ b/openssh-6.4p1/ssh-keygen.1 +++ b/openssh-6.5p1/ssh-keygen.1
@@ -800,16 +800,33 @@ on all machines @@ -827,16 +827,33 @@ on all machines
where the user wishes to log in using public key authentication. where the user wishes to log in using public key authentication.
There is no need to keep the contents of this file secret. There is no need to keep the contents of this file secret.
.Pp .Pp
@ -364,14 +364,14 @@ diff --git a/openssh-6.4p1/ssh-keygen.1 b/openssh-6.4p1/ssh-keygen.1
.Xr sshd 8 .Xr sshd 8
.Rs .Rs
.%R RFC 4716 .%R RFC 4716
diff --git a/openssh-6.4p1/ssh-keysign.8 b/openssh-6.4p1/ssh-keysign.8 diff --git a/openssh-6.5p1/ssh-keysign.8 b/openssh-6.5p1/ssh-keysign.8
--- a/openssh-6.4p1/ssh-keysign.8 --- a/openssh-6.5p1/ssh-keysign.8
+++ b/openssh-6.4p1/ssh-keysign.8 +++ b/openssh-6.5p1/ssh-keysign.8
@@ -73,16 +73,33 @@ Since they are readable only by root, @@ -75,16 +75,33 @@ must be set-uid root if host-based authe
must be set-uid root if host-based authentication is used.
.Pp .Pp
.It Pa /etc/ssh/ssh_host_dsa_key-cert.pub .It Pa /etc/ssh/ssh_host_dsa_key-cert.pub
.It Pa /etc/ssh/ssh_host_ecdsa_key-cert.pub .It Pa /etc/ssh/ssh_host_ecdsa_key-cert.pub
.It Pa /etc/ssh/ssh_host_ed25519_key-cert.pub
.It Pa /etc/ssh/ssh_host_rsa_key-cert.pub .It Pa /etc/ssh/ssh_host_rsa_key-cert.pub
If these files exist they are assumed to contain public certificate If these files exist they are assumed to contain public certificate
information corresponding with the private keys above. information corresponding with the private keys above.
@ -401,10 +401,10 @@ diff --git a/openssh-6.4p1/ssh-keysign.8 b/openssh-6.4p1/ssh-keysign.8
.Sh HISTORY .Sh HISTORY
.Nm .Nm
first appeared in first appeared in
diff --git a/openssh-6.4p1/ssh.1 b/openssh-6.4p1/ssh.1 diff --git a/openssh-6.5p1/ssh.1 b/openssh-6.5p1/ssh.1
--- a/openssh-6.4p1/ssh.1 --- a/openssh-6.5p1/ssh.1
+++ b/openssh-6.4p1/ssh.1 +++ b/openssh-6.5p1/ssh.1
@@ -1290,16 +1290,30 @@ reads @@ -1304,16 +1304,30 @@ reads
and adds lines of the format and adds lines of the format
.Dq VARNAME=value .Dq VARNAME=value
to the environment if the file exists and users are allowed to to the environment if the file exists and users are allowed to
@ -435,10 +435,10 @@ diff --git a/openssh-6.4p1/ssh.1 b/openssh-6.4p1/ssh.1
world-readable if the user's home directory is on an NFS partition, world-readable if the user's home directory is on an NFS partition,
because because
.Xr sshd 8 .Xr sshd 8
diff --git a/openssh-6.4p1/sshd.8 b/openssh-6.4p1/sshd.8 diff --git a/openssh-6.5p1/sshd.8 b/openssh-6.5p1/sshd.8
--- a/openssh-6.4p1/sshd.8 --- a/openssh-6.5p1/sshd.8
+++ b/openssh-6.4p1/sshd.8 +++ b/openssh-6.5p1/sshd.8
@@ -941,16 +941,33 @@ and not group or world-writable. @@ -946,16 +946,33 @@ and not group or world-writable.
.It Pa /var/run/sshd.pid .It Pa /var/run/sshd.pid
Contains the process ID of the Contains the process ID of the
.Nm .Nm
@ -472,9 +472,9 @@ diff --git a/openssh-6.4p1/sshd.8 b/openssh-6.4p1/sshd.8
.Xr ssh-agent 1 , .Xr ssh-agent 1 ,
.Xr ssh-keygen 1 , .Xr ssh-keygen 1 ,
.Xr ssh-keyscan 1 , .Xr ssh-keyscan 1 ,
diff --git a/openssh-6.4p1/sshd.c b/openssh-6.4p1/sshd.c diff --git a/openssh-6.5p1/sshd.c b/openssh-6.5p1/sshd.c
--- a/openssh-6.4p1/sshd.c --- a/openssh-6.5p1/sshd.c
+++ b/openssh-6.4p1/sshd.c +++ b/openssh-6.5p1/sshd.c
@@ -50,16 +50,18 @@ @@ -50,16 +50,18 @@
#ifdef HAVE_SYS_STAT_H #ifdef HAVE_SYS_STAT_H
# include <sys/stat.h> # include <sys/stat.h>
@ -518,7 +518,7 @@ diff --git a/openssh-6.4p1/sshd.c b/openssh-6.4p1/sshd.c
/* This is set to true when a signal is received. */ /* This is set to true when a signal is received. */
static volatile sig_atomic_t received_sighup = 0; static volatile sig_atomic_t received_sighup = 0;
static volatile sig_atomic_t received_sigterm = 0; static volatile sig_atomic_t received_sigterm = 0;
@@ -1300,16 +1309,21 @@ server_accept_loop(int *sock_in, int *so @@ -1313,16 +1322,21 @@ server_accept_loop(int *sock_in, int *so
for (j = 0; j < options.max_startups; j++) for (j = 0; j < options.max_startups; j++)
if (startup_pipes[j] == -1) { if (startup_pipes[j] == -1) {
startup_pipes[j] = startup_p[0]; startup_pipes[j] = startup_p[0];

15
openssh-6.4p1-send_locale.patch → openssh-6.5p1-send_locale.patch
View File

@ -1,9 +1,9 @@
# send locales in default configuration # send locales in default configuration
# bnc#65747 # bnc#65747
diff --git a/openssh-6.4p1/ssh_config b/openssh-6.4p1/ssh_config diff --git a/openssh-6.5p1/ssh_config b/openssh-6.5p1/ssh_config
--- a/openssh-6.4p1/ssh_config --- a/openssh-6.5p1/ssh_config
+++ b/openssh-6.4p1/ssh_config +++ b/openssh-6.5p1/ssh_config
@@ -58,9 +58,14 @@ ForwardX11Trusted yes @@ -58,9 +58,14 @@ ForwardX11Trusted yes
# ProxyCommand ssh -q -W %h:%p gateway.example.com # ProxyCommand ssh -q -W %h:%p gateway.example.com
@ -19,10 +19,10 @@ diff --git a/openssh-6.4p1/ssh_config b/openssh-6.4p1/ssh_config
+SendEnv LC_IDENTIFICATION LC_ALL +SendEnv LC_IDENTIFICATION LC_ALL
+ +
# RekeyLimit 1G 1h # RekeyLimit 1G 1h
diff --git a/openssh-6.4p1/sshd_config b/openssh-6.4p1/sshd_config diff --git a/openssh-6.5p1/sshd_config b/openssh-6.5p1/sshd_config
--- a/openssh-6.4p1/sshd_config --- a/openssh-6.5p1/sshd_config
+++ b/openssh-6.4p1/sshd_config +++ b/openssh-6.5p1/sshd_config
@@ -125,13 +125,18 @@ UsePrivilegeSeparation sandbox # Defaul @@ -127,14 +127,19 @@ UsePrivilegeSeparation sandbox # Defaul
#VersionAddendum none #VersionAddendum none
# no default banner path # no default banner path
@ -40,4 +40,5 @@ diff --git a/openssh-6.4p1/sshd_config b/openssh-6.4p1/sshd_config
#Match User anoncvs #Match User anoncvs
# X11Forwarding no # X11Forwarding no
# AllowTcpForwarding no # AllowTcpForwarding no
# PermitTTY no
# ForceCommand cvs server # ForceCommand cvs server

155
openssh-6.5p1-sftp_force_permissions.patch Normal file
View File

@ -0,0 +1,155 @@
# additional option for sftp-server to force file mode for new files
# FATE#312774
# http://lists.mindrot.org/pipermail/openssh-unix-dev/2010-November/029044.html
# http://marc.info/?l=openssh-unix-dev&m=128896838930893
diff --git a/openssh-6.5p1/sftp-server.8 b/openssh-6.5p1/sftp-server.8
--- a/openssh-6.5p1/sftp-server.8
+++ b/openssh-6.5p1/sftp-server.8
@@ -33,16 +33,17 @@
.Bk -words
.Op Fl ehR
.Op Fl d Ar start_directory
.Op Fl f Ar log_facility
.Op Fl l Ar log_level
.Op Fl P Ar blacklisted_requests
.Op Fl p Ar whitelisted_requests
.Op Fl u Ar umask
+.Op Fl m Ar force_file_permissions
.Ek
.Nm
.Fl Q Ar protocol_feature
.Sh DESCRIPTION
.Nm
is a program that speaks the server side of SFTP protocol
to stdout and expects client requests from stdin.
.Nm
@@ -133,16 +134,20 @@ Places this instance of
into a read-only mode.
Attempts to open files for writing, as well as other operations that change
the state of the filesystem, will be denied.
.It Fl u Ar umask
Sets an explicit
.Xr umask 2
to be applied to newly-created files and directories, instead of the
user's default mask.
+.It Fl m Ar force_file_permissions
+Sets explicit file permissions to be applied to newly-created files instead
+of the default or client requested mode. Numeric values include:
+777, 755, 750, 666, 644, 640, etc. Option -u is ineffective if -m is set.
.El
.Pp
For logging to work,
.Nm
must be able to access
.Pa /dev/log .
Use of
.Nm
diff --git a/openssh-6.5p1/sftp-server.c b/openssh-6.5p1/sftp-server.c
--- a/openssh-6.5p1/sftp-server.c
+++ b/openssh-6.5p1/sftp-server.c
@@ -75,16 +75,20 @@ static u_int version;
static int init_done;
/* Disable writes */
static int readonly;
/* Requests that are allowed/denied */
static char *request_whitelist, *request_blacklist;
+/* Force file permissions */
+int permforce = 0;
+long permforcemode;
+
/* portable attributes, etc. */
typedef struct Stat Stat;
struct Stat {
char *name;
char *long_name;
Attrib attrib;
};
@@ -670,16 +674,20 @@ process_open(u_int32_t id)
int handle, fd, flags, mode, status = SSH2_FX_FAILURE;
name = get_string(NULL);
pflags = get_int(); /* portable flags */
debug3("request %u: open flags %d", id, pflags);
a = get_attrib();
flags = flags_from_portable(pflags);
mode = (a->flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? a->perm : 0666;
+ if (permforce == 1) {
+ mode = permforcemode;
+ (void)umask(0); /* so umask does not interfere */
+ }
logit("open \"%s\" flags %s mode 0%o",
name, string_from_portable(pflags), mode);
if (readonly &&
((flags & O_ACCMODE) == O_WRONLY ||
(flags & O_ACCMODE) == O_RDWR)) {
verbose("Refusing open request in read-only mode");
status = SSH2_FX_PERMISSION_DENIED;
} else {
@@ -1425,17 +1433,18 @@ sftp_server_cleanup_exit(int i)
static void
sftp_server_usage(void)
{
extern char *__progname;
fprintf(stderr,
"usage: %s [-ehR] [-d start_directory] [-f log_facility] "
"[-l log_level]\n\t[-P blacklisted_requests] "
- "[-p whitelisted_requests] [-u umask]\n"
+ "[-p whitelisted_requests] [-u umask]\n\t"
+ "[-m force_file_permissions]\n",
" %s -Q protocol_feature\n",
__progname, __progname);
exit(1);
}
int
sftp_server_main(int argc, char **argv, struct passwd *user_pw)
{
@@ -1450,17 +1459,17 @@ sftp_server_main(int argc, char **argv,
extern char *__progname;
__progname = ssh_get_progname(argv[0]);
log_init(__progname, log_level, log_facility, log_stderr);
pw = pwcopy(user_pw);
while (!skipargs && (ch = getopt(argc, argv,
- "d:f:l:P:p:Q:u:cehR")) != -1) {
+ "d:f:l:P:p:Q:u:m:cehR")) != -1) {
switch (ch) {
case 'Q':
if (strcasecmp(optarg, "requests") != 0) {
fprintf(stderr, "Invalid query type\n");
exit(1);
}
for (i = 0; handlers[i].handler != NULL; i++)
printf("%s\n", handlers[i].name);
@@ -1510,16 +1519,23 @@ sftp_server_main(int argc, char **argv,
case 'u':
errno = 0;
mask = strtol(optarg, &cp, 8);
if (mask < 0 || mask > 0777 || *cp != '\0' ||
cp == optarg || (mask == 0 && errno != 0))
fatal("Invalid umask \"%s\"", optarg);
(void)umask((mode_t)mask);
break;
+ case 'm':
+ permforce = 1;
+ permforcemode = strtol(optarg, &cp, 8);
+ if (permforcemode < 0 || permforcemode > 0777 || *cp != '\0' ||
+ cp == optarg || (permforcemode == 0 && errno != 0))
+ fatal("Invalid umask \"%s\"", optarg);
+ break;
case 'h':
default:
sftp_server_usage();
}
}
log_init(__progname, log_level, log_facility, log_stderr);

90
openssh-6.4p1-sftp_homechroot.patch → openssh-6.5p1-sftp_homechroot.patch
View File

@ -1,8 +1,8 @@
# run sftp sessions inside a chroot # run sftp sessions inside a chroot
diff --git a/openssh-6.4p1/session.c b/openssh-6.4p1/session.c diff --git a/openssh-6.5p1/session.c b/openssh-6.5p1/session.c
--- a/openssh-6.4p1/session.c --- a/openssh-6.5p1/session.c
+++ b/openssh-6.4p1/session.c +++ b/openssh-6.5p1/session.c
@@ -120,16 +120,18 @@ int do_exec(Session *, const char *); @@ -120,16 +120,18 @@ int do_exec(Session *, const char *);
void do_login(Session *, const char *); void do_login(Session *, const char *);
#ifdef LOGIN_NEEDS_UTMPX #ifdef LOGIN_NEEDS_UTMPX
@ -22,13 +22,13 @@ diff --git a/openssh-6.4p1/session.c b/openssh-6.4p1/session.c
/* import */ /* import */
extern ServerOptions options; extern ServerOptions options;
extern char *__progname; extern char *__progname;
@@ -818,16 +820,21 @@ do_exec(Session *s, const char *command) @@ -827,16 +829,21 @@ do_exec(Session *s, const char *command)
if (IS_INTERNAL_SFTP(command)) { "subsystem '%.900s'", s->subsys);
s->is_subsystem = s->is_subsystem ? } else if (command == NULL) {
SUBSYSTEM_INT_SFTP : SUBSYSTEM_INT_SFTP_ERROR; snprintf(session_type, sizeof(session_type), "shell");
} else if (s->is_subsystem) } else {
s->is_subsystem = SUBSYSTEM_EXT; /* NB. we don't log unforced commands to preserve privacy */
debug("Forced command (key option) '%.900s'", command); snprintf(session_type, sizeof(session_type), "command");
} }
+ if ((s->is_subsystem != SUBSYSTEM_INT_SFTP) && chroot_no_tree) { + if ((s->is_subsystem != SUBSYSTEM_INT_SFTP) && chroot_no_tree) {
@ -36,15 +36,15 @@ diff --git a/openssh-6.4p1/session.c b/openssh-6.4p1/session.c
+ exit (1); + exit (1);
+ } + }
+ +
#ifdef SSH_AUDIT_EVENTS if (s->ttyfd != -1) {
if (s->command != NULL || s->command_handle != -1) tty = s->tty;
fatal("do_exec: command already set"); if (strncmp(tty, "/dev/", 5) == 0)
if (command != NULL) tty += 5;
s->command = xstrdup(command); }
else if (s->ttyfd == -1) {
char *shell = s->pw->pw_shell;
@@ -1435,67 +1442,132 @@ do_nologin(struct passwd *pw) verbose("Starting session: %s%s%s for %s from %.200s port %d",
session_type,
@@ -1458,67 +1465,132 @@ do_nologin(struct passwd *pw)
while (fgets(buf, sizeof(buf), f)) while (fgets(buf, sizeof(buf), f))
fputs(buf, stderr); fputs(buf, stderr);
fclose(f); fclose(f);
@ -179,10 +179,10 @@ diff --git a/openssh-6.4p1/session.c b/openssh-6.4p1/session.c
do_setusercontext(struct passwd *pw) do_setusercontext(struct passwd *pw)
{ {
char *chroot_path, *tmp; char *chroot_path, *tmp;
diff --git a/openssh-6.4p1/sftp-chrootenv.h b/openssh-6.4p1/sftp-chrootenv.h diff --git a/openssh-6.5p1/sftp-chrootenv.h b/openssh-6.5p1/sftp-chrootenv.h
new file mode 100644 new file mode 100644
--- /dev/null --- /dev/null
+++ b/openssh-6.4p1/sftp-chrootenv.h +++ b/openssh-6.5p1/sftp-chrootenv.h
@@ -0,0 +1,30 @@ @@ -0,0 +1,30 @@
+/* +/*
+ * Copyright (c) 2009 Jan F Chadima. All rights reserved. + * Copyright (c) 2009 Jan F Chadima. All rights reserved.
@ -214,10 +214,10 @@ new file mode 100644
+ +
+#endif +#endif
+ +
diff --git a/openssh-6.4p1/sftp-common.c b/openssh-6.4p1/sftp-common.c diff --git a/openssh-6.5p1/sftp-common.c b/openssh-6.5p1/sftp-common.c
--- a/openssh-6.4p1/sftp-common.c --- a/openssh-6.5p1/sftp-common.c
+++ b/openssh-6.4p1/sftp-common.c +++ b/openssh-6.5p1/sftp-common.c
@@ -41,16 +41,17 @@ @@ -42,16 +42,17 @@
#endif #endif
#include "xmalloc.h" #include "xmalloc.h"
@ -235,13 +235,13 @@ diff --git a/openssh-6.4p1/sftp-common.c b/openssh-6.4p1/sftp-common.c
a->flags = 0; a->flags = 0;
a->size = 0; a->size = 0;
a->uid = 0; a->uid = 0;
@@ -191,23 +192,23 @@ ls_file(const char *name, const struct s @@ -193,23 +194,23 @@ ls_file(const char *name, const struct s
{
int ulen, glen, sz = 0; int ulen, glen, sz = 0;
struct tm *ltime = localtime(&st->st_mtime); struct tm *ltime = localtime(&st->st_mtime);
char *user, *group; char *user, *group;
char buf[1024], mode[11+1], tbuf[12+1], ubuf[11+1], gbuf[11+1]; char buf[1024], mode[11+1], tbuf[12+1], ubuf[11+1], gbuf[11+1];
char sbuf[FMT_SCALED_STRSIZE]; char sbuf[FMT_SCALED_STRSIZE];
time_t now;
strmode(st->st_mode, mode); strmode(st->st_mode, mode);
- if (!remote) { - if (!remote) {
@ -259,11 +259,11 @@ diff --git a/openssh-6.4p1/sftp-common.c b/openssh-6.4p1/sftp-common.c
group = gbuf; group = gbuf;
} }
if (ltime != NULL) { if (ltime != NULL) {
if (time(NULL) - st->st_mtime < (365*24*60*60)/2) now = time(NULL);
sz = strftime(tbuf, sizeof tbuf, "%b %e %H:%M", ltime); if (now - (365*24*60*60)/2 < st->st_mtime &&
diff --git a/openssh-6.4p1/sftp-server-main.c b/openssh-6.4p1/sftp-server-main.c diff --git a/openssh-6.5p1/sftp-server-main.c b/openssh-6.5p1/sftp-server-main.c
--- a/openssh-6.4p1/sftp-server-main.c --- a/openssh-6.5p1/sftp-server-main.c
+++ b/openssh-6.4p1/sftp-server-main.c +++ b/openssh-6.5p1/sftp-server-main.c
@@ -17,21 +17,24 @@ @@ -17,21 +17,24 @@
#include "includes.h" #include "includes.h"
@ -289,10 +289,10 @@ diff --git a/openssh-6.4p1/sftp-server-main.c b/openssh-6.4p1/sftp-server-main.c
int int
main(int argc, char **argv) main(int argc, char **argv)
diff --git a/openssh-6.4p1/sftp.c b/openssh-6.4p1/sftp.c diff --git a/openssh-6.5p1/sftp.c b/openssh-6.5p1/sftp.c
--- a/openssh-6.4p1/sftp.c --- a/openssh-6.5p1/sftp.c
+++ b/openssh-6.4p1/sftp.c +++ b/openssh-6.5p1/sftp.c
@@ -106,16 +106,18 @@ struct complete_ctx { @@ -109,16 +109,18 @@ struct complete_ctx {
char **remote_pathp; char **remote_pathp;
}; };
@ -311,9 +311,9 @@ diff --git a/openssh-6.4p1/sftp.c b/openssh-6.4p1/sftp.c
#define LS_SHORT_VIEW 0x0002 /* Single row view ala ls -1 */ #define LS_SHORT_VIEW 0x0002 /* Single row view ala ls -1 */
#define LS_NUMERIC_VIEW 0x0004 /* Long view with numeric uid/gid */ #define LS_NUMERIC_VIEW 0x0004 /* Long view with numeric uid/gid */
#define LS_NAME_SORT 0x0008 /* Sort by name (default) */ #define LS_NAME_SORT 0x0008 /* Sort by name (default) */
diff --git a/openssh-6.4p1/sshd_config.0 b/openssh-6.4p1/sshd_config.0 diff --git a/openssh-6.5p1/sshd_config.0 b/openssh-6.5p1/sshd_config.0
--- a/openssh-6.4p1/sshd_config.0 --- a/openssh-6.5p1/sshd_config.0
+++ b/openssh-6.4p1/sshd_config.0 +++ b/openssh-6.5p1/sshd_config.0
@@ -189,16 +189,24 @@ DESCRIPTION @@ -189,16 +189,24 @@ DESCRIPTION
session this requires at least a shell, typically sh(1), and session this requires at least a shell, typically sh(1), and
basic /dev nodes such as null(4), zero(4), stdin(4), stdout(4), basic /dev nodes such as null(4), zero(4), stdin(4), stdout(4),
@ -335,13 +335,13 @@ diff --git a/openssh-6.4p1/sshd_config.0 b/openssh-6.4p1/sshd_config.0
Ciphers Ciphers
Specifies the ciphers allowed for protocol version 2. Multiple Specifies the ciphers allowed for protocol version 2. Multiple
ciphers must be comma-separated. The supported ciphers are ciphers must be comma-separated. The supported ciphers are:
``3des-cbc'', ``aes128-cbc'', ``aes192-cbc'', ``aes256-cbc'', ``3des-cbc'', ``aes128-cbc'', ``aes192-cbc'', ``aes256-cbc'',
``aes128-ctr'', ``aes192-ctr'', ``aes256-ctr'', ``aes128-ctr'', ``aes192-ctr'', ``aes256-ctr'',
``aes128-gcm@openssh.com'', ``aes256-gcm@openssh.com'', diff --git a/openssh-6.5p1/sshd_config.5 b/openssh-6.5p1/sshd_config.5
diff --git a/openssh-6.4p1/sshd_config.5 b/openssh-6.4p1/sshd_config.5 --- a/openssh-6.5p1/sshd_config.5
--- a/openssh-6.4p1/sshd_config.5 +++ b/openssh-6.5p1/sshd_config.5
+++ b/openssh-6.4p1/sshd_config.5
@@ -324,16 +324,27 @@ For file transfer sessions using @@ -324,16 +324,27 @@ For file transfer sessions using
no additional configuration of the environment is necessary if the no additional configuration of the environment is necessary if the
in-process sftp server is used, in-process sftp server is used,
@ -367,6 +367,6 @@ diff --git a/openssh-6.4p1/sshd_config.5 b/openssh-6.4p1/sshd_config.5
.It Cm Ciphers .It Cm Ciphers
Specifies the ciphers allowed for protocol version 2. Specifies the ciphers allowed for protocol version 2.
Multiple ciphers must be comma-separated. Multiple ciphers must be comma-separated.
The supported ciphers are The supported ciphers are:
.Pp
.Dq 3des-cbc , .Dq 3des-cbc ,
.Dq aes128-cbc ,

8
openssh-6.4p1-xauth.patch → openssh-6.5p1-xauth.patch
View File

@ -1,10 +1,10 @@
# try to remove xauth cookies on logout # try to remove xauth cookies on logout
# bnc#98815 # bnc#98815
diff --git a/openssh-6.4p1/session.c b/openssh-6.4p1/session.c diff --git a/openssh-6.5p1/session.c b/openssh-6.5p1/session.c
--- a/openssh-6.4p1/session.c --- a/openssh-6.5p1/session.c
+++ b/openssh-6.4p1/session.c +++ b/openssh-6.5p1/session.c
@@ -2477,18 +2477,50 @@ session_exit_message(Session *s, int sta @@ -2505,18 +2505,50 @@ session_exit_message(Session *s, int sta
if (c->ostate != CHAN_OUTPUT_CLOSED) if (c->ostate != CHAN_OUTPUT_CLOSED)
chan_write_failed(c); chan_write_failed(c);
} }

18
openssh-6.4p1-xauthlocalhostname.patch → openssh-6.5p1-xauthlocalhostname.patch
View File

@ -1,10 +1,10 @@
# handle hostname changes when forwarding X # handle hostname changes when forwarding X
# bnc#98627 # bnc#98627
diff --git a/openssh-6.4p1/session.c b/openssh-6.4p1/session.c diff --git a/openssh-6.5p1/session.c b/openssh-6.5p1/session.c
--- a/openssh-6.4p1/session.c --- a/openssh-6.5p1/session.c
+++ b/openssh-6.4p1/session.c +++ b/openssh-6.5p1/session.c
@@ -1118,17 +1118,17 @@ copy_environment(char **source, char *** @@ -1141,17 +1141,17 @@ copy_environment(char **source, char ***
debug3("Copy environment: %s=%s", var_name, var_val); debug3("Copy environment: %s=%s", var_name, var_val);
child_set_env(env, envsize, var_name, var_val); child_set_env(env, envsize, var_name, var_val);
@ -23,7 +23,7 @@ diff --git a/openssh-6.4p1/session.c b/openssh-6.4p1/session.c
#if !defined (HAVE_LOGIN_CAP) && !defined (HAVE_CYGWIN) #if !defined (HAVE_LOGIN_CAP) && !defined (HAVE_CYGWIN)
char *path = NULL; char *path = NULL;
#endif #endif
@@ -1305,25 +1305,27 @@ do_setup_env(Session *s, const char *she @@ -1328,25 +1328,27 @@ do_setup_env(Session *s, const char *she
read_environment_file(&env, &envsize, buf); read_environment_file(&env, &envsize, buf);
} }
if (debug_flag) { if (debug_flag) {
@ -52,7 +52,7 @@ diff --git a/openssh-6.4p1/session.c b/openssh-6.4p1/session.c
do_xauth = do_xauth =
s->display != NULL && s->auth_proto != NULL && s->auth_data != NULL; s->display != NULL && s->auth_proto != NULL && s->auth_data != NULL;
@@ -1367,22 +1369,30 @@ do_rc_files(Session *s, const char *shel @@ -1390,22 +1392,30 @@ do_rc_files(Session *s, const char *shel
"%.500s add %.100s %.100s %.100s\n", "%.500s add %.100s %.100s %.100s\n",
options.xauth_location, s->auth_display, options.xauth_location, s->auth_display,
s->auth_proto, s->auth_data); s->auth_proto, s->auth_data);
@ -83,7 +83,7 @@ diff --git a/openssh-6.4p1/session.c b/openssh-6.4p1/session.c
} }
static void static void
@@ -1631,16 +1641,17 @@ child_close_fds(void) @@ -1659,16 +1669,17 @@ child_close_fds(void)
* ids, and executing the command or shell. * ids, and executing the command or shell.
*/ */
#define ARGV_MAX 10 #define ARGV_MAX 10
@ -101,7 +101,7 @@ diff --git a/openssh-6.4p1/session.c b/openssh-6.4p1/session.c
/* remove hostkey from the child's memory */ /* remove hostkey from the child's memory */
destroy_sensitive_data(); destroy_sensitive_data();
@@ -1697,17 +1708,17 @@ do_child(Session *s, const char *command @@ -1725,17 +1736,17 @@ do_child(Session *s, const char *command
* legal, and means /bin/sh. * legal, and means /bin/sh.
*/ */
shell = (pw->pw_shell[0] == '\0') ? _PATH_BSHELL : pw->pw_shell; shell = (pw->pw_shell[0] == '\0') ? _PATH_BSHELL : pw->pw_shell;
@ -120,7 +120,7 @@ diff --git a/openssh-6.4p1/session.c b/openssh-6.4p1/session.c
/* we have to stash the hostname before we close our socket. */ /* we have to stash the hostname before we close our socket. */
if (options.use_login) if (options.use_login)
hostname = get_remote_name_or_ip(utmp_len, hostname = get_remote_name_or_ip(utmp_len,
@@ -1766,17 +1777,17 @@ do_child(Session *s, const char *command @@ -1794,17 +1805,17 @@ do_child(Session *s, const char *command
strerror(errno)); strerror(errno));
if (r) if (r)
exit(1); exit(1);

3
openssh-6.5p1.tar.gz Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:a1195ed55db945252d5a1730d4a2a2a5c1c9a6aa01ef2e5af750a962623d9027
size 1293187

5
openssh-askpass-gnome.changes
View File

@ -1,3 +1,8 @@
-------------------------------------------------------------------
Wed Feb 12 01:24:16 UTC 2014 - pcerny@suse.com
- Update of the underlying OpenSSH to 6.5p1
------------------------------------------------------------------- -------------------------------------------------------------------
Fri Jan 24 15:13:09 UTC 2014 - pcerny@suse.com Fri Jan 24 15:13:09 UTC 2014 - pcerny@suse.com

2
openssh-askpass-gnome.spec
View File

@ -26,7 +26,7 @@ BuildRequires: openssl-devel
BuildRequires: pam-devel BuildRequires: pam-devel
BuildRequires: tcpd-devel BuildRequires: tcpd-devel
BuildRequires: update-desktop-files BuildRequires: update-desktop-files
Version: 6.4p1 Version: 6.5p1
Release: 0 Release: 0
Requires: openssh = %{version} Requires: openssh = %{version}
Summary: A GNOME-Based Passphrase Dialog for OpenSSH Summary: A GNOME-Based Passphrase Dialog for OpenSSH

95
openssh.changes
View File

@ -1,3 +1,98 @@
-------------------------------------------------------------------
Wed Feb 12 01:24:16 UTC 2014 - pcerny@suse.com
- Update to 6.5p1
Features since 6.4p1:
* ssh(1), sshd(8): support for key exchange using ECDH in
Daniel Bernstein's Curve25519; default when both the client
and server support it.
* ssh(1), sshd(8): support for Ed25519 as a public key type fo
rboth server and client. Ed25519 is an EC signature offering
better security than ECDSA and DSA and good performance.
* Add a new private key format that uses a bcrypt KDF to better
protect keys at rest. Used unconditionally for Ed25519 keys,
on demand for other key types via the -o ssh-keygen(1)
option. Intended to become default in the near future.
Details documented in PROTOCOL.key.
* ssh(1), sshd(8): new transport cipher
"chacha20-poly1305@openssh.com" combining Daniel Bernstein's
ChaCha20 stream cipher and Poly1305 MAC to build an
authenticated encryption mode. Details documented
PROTOCOL.chacha20poly1305.
* ssh(1), sshd(8): refuse RSA keys from old proprietary clients
and servers that use the obsolete RSA+MD5 signature scheme.
It will still be possible to connect with these
clients/servers but only DSA keys will be accepted, and
OpenSSH will refuse connection entirely in a future release.
* ssh(1), sshd(8): refuse old proprietary clients and servers
that use a weaker key exchange hash calculation.
* ssh(1): increase the size of the Diffie-Hellman groups
requested for each symmetric key size. New values from NIST
Special Publication 800-57 with the upper limit specified by
RFC4419.
* ssh(1), ssh-agent(1): support pkcs#11 tokens that only
provide X.509 certs instead of raw public keys (requested as
bz#1908).
* ssh(1): new ssh_config(5) "Match" keyword that allows
conditional configuration to be applied by matching on
hostname, user and result of arbitrary commands.
* ssh(1): support for client-side hostname canonicalisation
using a set of DNS suffixes and rules in ssh_config(5). This
allows unqualified names to be canonicalised to
fully-qualified domain names to eliminate ambiguity when
looking up keys in known_hosts or checking host certificate
names.
* sftp-server(8): ability to whitelist and/or blacklist sftp
protocol requests by name.
* sftp-server(8): sftp "fsync@openssh.com" to support calling
fsync(2) on an open file handle.
* sshd(8): ssh_config(5) PermitTTY to disallow TTY allocation,
mirroring the longstanding no-pty authorized_keys option.
* ssh(1): ssh_config ProxyUseFDPass option that supports the
use of ProxyCommands that establish a connection and then
pass a connected file descriptor back to ssh(1). This allows
the ProxyCommand to exit rather than staying around to
transfer data.
Bugfixes since 6.4p1:
* ssh(1), sshd(8): fix potential stack exhaustion caused by
nested certificates.
* ssh(1): bz#1211: make BindAddress work with
UsePrivilegedPort.
* sftp(1): bz#2137: fix the progress meter for resumed
transfer.
* ssh-add(1): bz#2187: do not request smartcard PIN when
removing keys from ssh-agent.
* sshd(8): bz#2139: fix re-exec fallback when original sshd
binary cannot be executed.
* ssh-keygen(1): make relative-specified certificate expiry
times relative to current time and not the validity start
time.
* sshd(8): bz#2161: fix AuthorizedKeysCommand inside a Match
block.
* sftp(1): bz#2129: symlinking a file would incorrectly
canonicalise the target path.
* ssh-agent(1): bz#2175: fix a use-after-free in the PKCS#11
agent helper executable.
* sshd(8): improve logging of sessions to include the user
name, remote host and port, the session type (shell, command,
etc.) and allocated TTY (if any).
* sshd(8): bz#1297: tell the client (via a debug message) when
their preferred listen address has been overridden by the
server's GatewayPorts setting.
* sshd(8): bz#2162: include report port in bad protocol banner
message.
* sftp(1): bz#2163: fix memory leak in error path in
do_readdir().
* sftp(1): bz#2171: don't leak file descriptor on error.
* sshd(8): include the local address and port in "Connection
from ..." message (only shown at loglevel>=verbose).
- systemd systems
* create sysconfig file on systemd systems as well, yet do not
require it at run-time (bnc#862600)
* symlink rcsshd to /usr/bin/service
- rename "-forcepermissions" patch to "-sftp_force_permissions"
- disable key converter - ssh-keygen is able to do the same
------------------------------------------------------------------- -------------------------------------------------------------------
Tue Feb 11 07:42:09 UTC 2014 - meissner@suse.com Tue Feb 11 07:42:09 UTC 2014 - meissner@suse.com

171
openssh.spec
View File

@ -41,17 +41,22 @@
%endif %endif
%if 0%{?suse_version} > 1140 %if 0%{?suse_version} > 1140
%define has_systemd 1
%define has_krb_mini 1 %define has_krb_mini 1
%else %else
%define has_systemd 0
%define has_krb_mini 0 %define has_krb_mini 0
%endif %endif
%if 0%{?suse_version} >= 1230 %if 0%{?suse_version} > 1220
%define init_script_allowed 0 %define uses_systemd 1
%else %else
%define init_script_allowed 1 %define uses_systemd 0
%endif
%define sandbox_seccomp 0
%ifarch %ix86 x86_64
%if 0%{?suse_version} > 1220
%define sandbox_seccomp 1
%endif
%endif %endif
%define _fwdir %{_sysconfdir}/sysconfig/SuSEfirewall2.d %define _fwdir %{_sysconfdir}/sysconfig/SuSEfirewall2.d
@ -77,17 +82,16 @@ BuildRequires: libselinux-devel
BuildRequires: openldap2-devel BuildRequires: openldap2-devel
BuildRequires: openssl-devel BuildRequires: openssl-devel
BuildRequires: pam-devel BuildRequires: pam-devel
%if %{has_systemd} %if %{uses_systemd}
BuildRequires: pkgconfig(systemd) BuildRequires: pkgconfig(systemd)
%{?systemd_requires} %{?systemd_requires}
%endif %endif
BuildRequires: tcpd-devel BuildRequires: tcpd-devel
Requires: /bin/netstat
PreReq: pwdutils %{insserv_prereq} %{fillup_prereq} coreutils PreReq: pwdutils %{insserv_prereq} %{fillup_prereq} coreutils
Conflicts: nonfreessh Conflicts: nonfreessh
Recommends: xauth Recommends: xauth
Recommends: %{name}-helpers Recommends: %{name}-helpers
Version: 6.4p1 Version: 6.5p1
Release: 0 Release: 0
Summary: Secure Shell Client and Server (Remote Login Program) Summary: Secure Shell Client and Server (Remote Login Program)
License: BSD-3-Clause and MIT License: BSD-3-Clause and MIT
@ -104,40 +108,41 @@ Source7: sshd.fw
Source8: sysconfig.ssh Source8: sysconfig.ssh
Source9: sshd-gen-keys-start Source9: sshd-gen-keys-start
Source10: sshd.service Source10: sshd.service
Patch1: openssh-6.4p1-key-converter.patch Patch1: openssh-6.5p1-key-converter.patch
Patch2: openssh-6.4p1-X11-forwarding.patch Patch2: openssh-6.5p1-X11-forwarding.patch
Patch3: openssh-6.4p1-lastlog.patch Patch3: openssh-6.5p1-lastlog.patch
Patch4: openssh-6.4p1-pam-fix2.patch Patch4: openssh-6.5p1-pam-fix2.patch
Patch5: openssh-6.4p1-saveargv-fix.patch Patch5: openssh-6.5p1-saveargv-fix.patch
Patch6: openssh-6.4p1-pam-fix3.patch Patch6: openssh-6.5p1-pam-fix3.patch
Patch7: openssh-6.4p1-gssapimitm.patch Patch7: openssh-6.5p1-gssapimitm.patch
Patch8: openssh-6.4p1-eal3.patch Patch8: openssh-6.5p1-eal3.patch
Patch9: openssh-6.4p1-blocksigalrm.patch Patch9: openssh-6.5p1-blocksigalrm.patch
Patch10: openssh-6.4p1-send_locale.patch Patch10: openssh-6.5p1-send_locale.patch
Patch11: openssh-6.4p1-xauthlocalhostname.patch Patch11: openssh-6.5p1-xauthlocalhostname.patch
Patch12: openssh-6.4p1-xauth.patch Patch12: openssh-6.5p1-xauth.patch
Patch13: openssh-6.4p1-default-protocol.patch Patch13: openssh-6.5p1-default-protocol.patch
Patch14: openssh-6.4p1-pts.patch Patch14: openssh-6.5p1-pts.patch
Patch15: openssh-6.4p1-pam-check-locks.patch Patch15: openssh-6.5p1-pam-check-locks.patch
Patch16: openssh-6.4p1-fingerprint_hash.patch Patch16: openssh-6.5p1-fingerprint_hash.patch
Patch17: openssh-6.4p1-audit1-remove_duplicit_audit.patch Patch17: openssh-6.5p1-audit1-remove_duplicit_audit.patch
Patch18: openssh-6.4p1-audit2-better_audit_of_user_actions.patch Patch18: openssh-6.5p1-audit2-better_audit_of_user_actions.patch
Patch19: openssh-6.4p1-audit3-key_auth_usage.patch Patch19: openssh-6.5p1-audit3-key_auth_usage.patch
Patch20: openssh-6.4p1-audit4-kex_results.patch Patch20: openssh-6.5p1-audit4-kex_results.patch
Patch21: openssh-6.4p1-audit5-session_key_destruction.patch Patch21: openssh-6.5p1-audit5-session_key_destruction.patch
Patch22: openssh-6.4p1-audit6-server_key_destruction.patch Patch22: openssh-6.5p1-audit6-server_key_destruction.patch
Patch23: openssh-6.4p1-audit7-libaudit_compat.patch Patch23: openssh-6.5p1-audit7-libaudit_compat.patch
Patch24: openssh-6.4p1-audit8-libaudit_dns_timeouts.patch Patch24: openssh-6.5p1-audit8-libaudit_dns_timeouts.patch
Patch25: openssh-6.4p1-seed-prng.patch Patch25: openssh-6.5p1-seed-prng.patch
Patch26: openssh-6.4p1-ldap.patch Patch26: openssh-6.5p1-ldap.patch
Patch27: openssh-6.4p1-fips.patch Patch27: openssh-6.5p1-fips.patch
Patch28: openssh-6.4p1-gssapi_key_exchange.patch Patch28: openssh-6.5p1-gssapi_key_exchange.patch
Patch29: openssh-6.4p1-login_options.patch Patch29: openssh-6.5p1-login_options.patch
Patch30: openssh-6.4p1-disable-openssl-abi-check.patch Patch30: openssh-6.5p1-disable-openssl-abi-check.patch
Patch31: openssh-6.4p1-no_fork-no_pid_file.patch Patch31: openssh-6.5p1-no_fork-no_pid_file.patch
Patch32: openssh-6.4p1-host_ident.patch Patch32: openssh-6.5p1-host_ident.patch
Patch33: openssh-6.4p1-sftp_homechroot.patch Patch33: openssh-6.5p1-sftp_homechroot.patch
Patch34: openssh-6.4p1-forcepermissions.patch Patch34: openssh-6.5p1-sftp_force_permissions.patch
BuildRoot: %{_tmppath}/%{name}-%{version}-build BuildRoot: %{_tmppath}/%{name}-%{version}-build
%description %description
@ -162,7 +167,7 @@ Helper applications for OpenSSH which retrieve keys from various sources.
%prep %prep
%setup -q %setup -q
%patch1 -p2 #patch1 -p2
%patch2 -p2 %patch2 -p2
%patch3 -p2 %patch3 -p2
%patch4 -p2 %patch4 -p2
@ -195,7 +200,7 @@ Helper applications for OpenSSH which retrieve keys from various sources.
%patch31 -p2 %patch31 -p2
%patch32 -p2 %patch32 -p2
%patch33 -p2 %patch33 -p2
%patch34 -p1 %patch34 -p2
cp %{SOURCE3} %{SOURCE4} . cp %{SOURCE3} %{SOURCE4} .
%build %build
@ -212,14 +217,14 @@ PIEFLAGS="-fPIE"
PIEFLAGS="-fpie" PIEFLAGS="-fpie"
%endif %endif
CFLAGS="%{optflags} $PIEFLAGS -fstack-protector" CFLAGS="%{optflags} $PIEFLAGS -fstack-protector"
%if 0%{?suse_version} < 1230 #%if 0%{?suse_version} < 1230
CFLAGS="-lrt $CFLAGS" #CFLAGS="-lrt $CFLAGS"
%endif #%endif
CXXFLAGS="%{optflags} $PIEFLAGS -fstack-protector" CXXFLAGS="%{optflags} $PIEFLAGS -fstack-protector"
LDFLAGS="-pie -Wl,--as-needed" LDFLAGS="-pie -Wl,--as-needed"
%if 0%{?suse_version} < 1230 #%if 0%{?suse_version} < 1230
LDFLAGS="-lrt $LDFLAGS" #LDFLAGS="-lrt $LDFLAGS"
%endif #%endif
#CPPFLAGS="%{optflags} -DUSE_INTERNAL_B64" #CPPFLAGS="%{optflags} -DUSE_INTERNAL_B64"
export LDFLAGS CFLAGS CXXFLAGS CPPFLAGS export LDFLAGS CFLAGS CXXFLAGS CPPFLAGS
./configure \ ./configure \
@ -232,14 +237,18 @@ export LDFLAGS CFLAGS CXXFLAGS CPPFLAGS
%if %{has_libselinux} %if %{has_libselinux}
--with-selinux \ --with-selinux \
%endif %endif
%if %{has_systemd} %if %{uses_systemd}
--with-pid-dir=/run \ --with-pid-dir=/run \
%endif %endif
--with-ssl-engine \ --with-ssl-engine \
--with-pam \ --with-pam \
--with-kerberos5=%{_prefix} \ --with-kerberos5=%{_prefix} \
--with-privsep-path=/var/lib/empty \ --with-privsep-path=/var/lib/empty \
%if %{sandbox_seccomp}
--with-sandbox=seccomp_filter \
%else
--with-sandbox=rlimit \ --with-sandbox=rlimit \
%endif
%ifnarch s390 s390x %ifnarch s390 s390x
--with-opensc \ --with-opensc \
%endif %endif
@ -253,24 +262,28 @@ export LDFLAGS CFLAGS CXXFLAGS CPPFLAGS
--target=%{_target_cpu}-suse-linux \ --target=%{_target_cpu}-suse-linux \
### configure end ### configure end
make -j 1 make %{?_smp_mflags}
make -j 1 -C converter #make %{?_smp_mflags} -C converter
%install %install
make install DESTDIR=%{buildroot} make install DESTDIR=%{buildroot}
make install DESTDIR=%{buildroot} -C converter #make install DESTDIR=%{buildroot} -C converter
install -d -m 755 %{buildroot}%{_sysconfdir}/pam.d install -d -m 755 %{buildroot}%{_sysconfdir}/pam.d
install -d -m 755 %{buildroot}/var/lib/sshd install -d -m 755 %{buildroot}/var/lib/sshd
install -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/pam.d/sshd install -m 644 %{SOURCE2} %{buildroot}%{_sysconfdir}/pam.d/sshd
install -d -m 755 %{buildroot}%{_sysconfdir}/slp.reg.d/ install -d -m 755 %{buildroot}%{_sysconfdir}/slp.reg.d/
install -m 644 %{SOURCE5} %{buildroot}%{_sysconfdir}/slp.reg.d/ install -m 644 %{SOURCE5} %{buildroot}%{_sysconfdir}/slp.reg.d/
install -d -m 755 %{buildroot}%{_initddir} install -d -m 755 %{buildroot}%{_initddir}
%if %{init_script_allowed} %if %{uses_systemd}
install -m 755 %{SOURCE1} %{buildroot}%{_initddir}/sshd install -m 0755 %{SOURCE1} .
ln -vs ../..%{_initddir}/sshd %{buildroot}%{_sbindir}/rcsshd install -D -m 0644 %{SOURCE10} %{buildroot}%{_unitdir}/sshd.service
ln -s /usr/sbin/service %{buildroot}%{_sbindir}/rcsshd
%else %else
install -m 755 %{SOURCE1} . install -D -m 0755 %{SOURCE1} %{buildroot}%{_initddir}/sshd
install -m 0644 %{SOURCE10} .
ln -s ../..%{_initddir}/sshd %{buildroot}%{_sbindir}/rcsshd
%endif %endif
install -d -m 755 %{buildroot}/var/adm/fillup-templates install -d -m 755 %{buildroot}/var/adm/fillup-templates
install -m 644 %{SOURCE8} %{buildroot}/var/adm/fillup-templates install -m 644 %{SOURCE8} %{buildroot}/var/adm/fillup-templates
@ -289,44 +302,38 @@ install -m 644 %{SOURCE7} %{buildroot}%{_fwdefdir}/sshd
# askpass wrapper # askpass wrapper
sed -e "s,@LIBEXECDIR@,%{_libexecdir},g" < %{SOURCE6} > %{buildroot}%{_libexecdir}/ssh/ssh-askpass sed -e "s,@LIBEXECDIR@,%{_libexecdir},g" < %{SOURCE6} > %{buildroot}%{_libexecdir}/ssh/ssh-askpass
rm -f %{buildroot}%{_datadir}/Ssh.bin rm -f %{buildroot}%{_datadir}/Ssh.bin
# sshd keys generator wrapper
%if %{has_systemd}
install -D -m 0755 %{SOURCE9} %{buildroot}%{_sbindir}/sshd-gen-keys-start install -D -m 0755 %{SOURCE9} %{buildroot}%{_sbindir}/sshd-gen-keys-start
install -D -m 0644 %{SOURCE10} %{buildroot}%{_unitdir}/sshd.service
ln -s /usr/sbin/service %{buildroot}%{_sbindir}/rcsshd
%endif
%pre %pre
getent group sshd >/dev/null || %{_sbindir}/groupadd -r sshd getent group sshd >/dev/null || %{_sbindir}/groupadd -r sshd
getent passwd sshd >/dev/null || %{_sbindir}/useradd -r -g sshd -d /var/lib/sshd -s /bin/false -c "SSH daemon" sshd getent passwd sshd >/dev/null || %{_sbindir}/useradd -r -g sshd -d /var/lib/sshd -s /bin/false -c "SSH daemon" sshd
%if %{has_systemd} %if %{uses_systemd}
%service_add_pre sshd.service %service_add_pre sshd.service
%endif %endif
%post %post
%if %{init_script_allowed} %if %{uses_systemd}
%{fillup_and_insserv -n ssh sshd} %{fillup_only -n ssh sshd}
%endif
%if %{has_systemd}
%service_add_post sshd.service %service_add_post sshd.service
%else
%{fillup_and_insserv -n ssh sshd}
%endif %endif
%preun %preun
%if %{init_script_allowed} %if %{uses_systemd}
%stop_on_removal sshd
%endif
%if %{has_systemd}
%service_del_preun sshd.service %service_del_preun sshd.service
%else
%stop_on_removal sshd
%endif %endif
%postun %postun
%if %{init_script_allowed} %if %{uses_systemd}
%service_del_postun sshd.service
%else
%restart_on_update sshd %restart_on_update sshd
%{insserv_cleanup} %{insserv_cleanup}
%endif %endif
%if %{has_systemd}
%service_del_postun sshd.service
%endif
%files %files
%defattr(-,root,root) %defattr(-,root,root)
@ -337,10 +344,12 @@ getent passwd sshd >/dev/null || %{_sbindir}/useradd -r -g sshd -d /var/lib/sshd
%verify(not mode) %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ssh/ssh_config %verify(not mode) %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/ssh/ssh_config
%verify(not mode) %attr(0640,root,root) %config(noreplace) %{_sysconfdir}/ssh/sshd_config %verify(not mode) %attr(0640,root,root) %config(noreplace) %{_sysconfdir}/ssh/sshd_config
%attr(0644,root,root) %config(noreplace) %{_sysconfdir}/pam.d/sshd %attr(0644,root,root) %config(noreplace) %{_sysconfdir}/pam.d/sshd
%if %{init_script_allowed} %if %{uses_systemd}
%attr(0755,root,root) %config %{_initddir}/sshd
%else
%doc sshd.init %doc sshd.init
%attr(0644,root,root) %config %{_unitdir}/sshd.service
%else
%attr(0755,root,root) %config %{_initddir}/sshd
%doc sshd.service
%endif %endif
%attr(0755,root,root) %{_bindir}/* %attr(0755,root,root) %{_bindir}/*
%attr(0755,root,root) %{_sbindir}/* %attr(0755,root,root) %{_sbindir}/*
@ -353,10 +362,6 @@ getent passwd sshd >/dev/null || %{_sbindir}/useradd -r -g sshd -d /var/lib/sshd
%dir %{_sysconfdir}/slp.reg.d %dir %{_sysconfdir}/slp.reg.d
%config %{_sysconfdir}/slp.reg.d/ssh.reg %config %{_sysconfdir}/slp.reg.d/ssh.reg
/var/adm/fillup-templates/sysconfig.ssh /var/adm/fillup-templates/sysconfig.ssh
%if %{has_systemd}
%{_sbindir}/sshd-gen-keys-start
%{_unitdir}/sshd.service
%endif
%if %{has_fw_dir} %if %{has_fw_dir}
%if %{needs_all_dirs} %if %{needs_all_dirs}
%dir %{_fwdir} %dir %{_fwdir}

2
sshd.init
View File

@ -56,7 +56,7 @@ rc_reset
case "$1" in case "$1" in
start) start)
ssh-keygen -A /usr/sbin/sshd-gen-keys-start
echo -n "Starting SSH daemon" echo -n "Starting SSH daemon"
## Start daemon with startproc(8). If this fails ## Start daemon with startproc(8). If this fails
## the echo return value is set appropriate. ## the echo return value is set appropriate.

2
sshd.service
View File

@ -3,7 +3,7 @@ Description=OpenSSH Daemon
After=network.target After=network.target
[Service] [Service]
EnvironmentFile=/etc/sysconfig/ssh EnvironmentFile=-/etc/sysconfig/ssh
ExecStartPre=/usr/sbin/sshd-gen-keys-start ExecStartPre=/usr/sbin/sshd-gen-keys-start
ExecStart=/usr/sbin/sshd -D $SSHD_OPTS ExecStart=/usr/sbin/sshd -D $SSHD_OPTS
ExecReload=/bin/kill -HUP $MAINPID ExecReload=/bin/kill -HUP $MAINPID