Accepting request 922068 from home:hpjansson:branches:network

- Version upgrade to 8.8p1
  * No changes for askpass, see main package changelog for
    details

- Version update to 8.8p1:
  = Security
  * sshd(8) from OpenSSH 6.2 through 8.7 failed to correctly initialise
    supplemental groups when executing an AuthorizedKeysCommand or
    AuthorizedPrincipalsCommand, where a AuthorizedKeysCommandUser or
    AuthorizedPrincipalsCommandUser directive has been set to run the
    command as a different user. Instead these commands would inherit
    the groups that sshd(8) was started with.
    Depending on system configuration, inherited groups may allow
    AuthorizedKeysCommand/AuthorizedPrincipalsCommand helper programs to
    gain unintended privilege.
    Neither AuthorizedKeysCommand nor AuthorizedPrincipalsCommand are
    enabled by default in sshd_config(5).
  = Potentially-incompatible changes
  * This release disables RSA signatures using the SHA-1 hash algorithm
    by default. This change has been made as the SHA-1 hash algorithm is
    cryptographically broken, and it is possible to create chosen-prefix
    hash collisions for <USD$50K.
    For most users, this change should be invisible and there is
    no need to replace ssh-rsa keys. OpenSSH has supported RFC8332
    RSA/SHA-256/512 signatures since release 7.2 and existing ssh-rsa keys
    will automatically use the stronger algorithm where possible.
    Incompatibility is more likely when connecting to older SSH
    implementations that have not been upgraded or have not closely tracked
    improvements in the SSH protocol. For these cases, it may be necessary
    to selectively re-enable RSA/SHA1 to allow connection and/or user
    authentication via the HostkeyAlgorithms and PubkeyAcceptedAlgorithms
    options.
  = New features
  * ssh(1): allow the ssh_config(5) CanonicalizePermittedCNAMEs
    directive to accept a "none" argument to specify the default
    behaviour.
  = Bugfixes
  * scp(1): when using the SFTP protocol, continue transferring files
    after a transfer error occurs, better matching original scp/rcp
    behaviour.
  * ssh(1): fixed a number of memory leaks in multiplexing,
  * ssh-keygen(1): avoid crash when using the -Y find-principals
    command.
  * A number of documentation and manual improvements, including
    bz#3340, PR139, PR215, PR241, PR257
- Additional changes from 8.7p1 release:
  = Potentially-incompatible changes
  * scp(1): this release changes the behaviour of remote to remote
    copies (e.g. "scp host-a:/path host-b:") to transfer through the
    local host by default. This was previously available via the -3
    flag. This mode avoids the need to expose credentials on the
    origin hop, avoids triplicate interpretation of filenames by the
    shell (by the local system, the copy origin and the destination)
    and, in conjunction with the SFTP support for scp(1) mentioned
    below, allows use of all authentication methods to the remote
    hosts (previously, only non-interactive methods could be used).
    A -R flag has been added to select the old behaviour.
  * ssh(1)/sshd(8): both the client and server are now using a
    stricter configuration file parser. The new parser uses more
    shell-like rules for quotes, space and escape characters. It is
    also more strict in rejecting configurations that include options
    lacking arguments. Previously some options (e.g. DenyUsers) could
    appear on a line with no subsequent arguments. This release will
    reject such configurations. The new parser will also reject
    configurations with unterminated quotes and multiple '='
    characters after the option name.
  * ssh(1): when using SSHFP DNS records for host key verification,
    ssh(1) will verify all matching records instead of just those
    with the specific signature type requested. This may cause host
    key verification problems if stale SSHFP records of a different
    or legacy signature type exist alongside other records for a
    particular host. bz#3322
  * ssh-keygen(1): when generating a FIDO key and specifying an
    explicit attestation challenge (using -Ochallenge), the challenge
    will now be hashed by the builtin security key middleware. This
    removes the (undocumented) requirement that challenges be exactly
    32 bytes in length and matches the expectations of libfido2.
  * sshd(8): environment="..." directives in authorized_keys files are
    now first-match-wins and limited to 1024 discrete environment
    variable names.
  = New features
  * scp(1): experimental support for transfers using the SFTP protocol
    as a replacement for the venerable SCP/RCP protocol that it has
    traditionally used. SFTP offers more predictable filename handling
    and does not require expansion of glob(3) patterns via the shell
    on the remote side.
  * sftp-server(8): add a protocol extension to support expansion of
    ~/ and ~user/ prefixed paths. This was added to support these
    paths when used by scp(1) while in SFTP mode.
  * ssh(1): add a ForkAfterAuthentication ssh_config(5) counterpart to
    the ssh(1) -f flag. GHPR231
  * ssh(1): add a StdinNull directive to ssh_config(5) that allows the
    config file to do the same thing as -n does on the ssh(1) command-
    line. GHPR231
  * ssh(1): add a SessionType directive to ssh_config, allowing the
    configuration file to offer equivalent control to the -N (no
    session) and -s (subsystem) command-line flags. GHPR231
  * ssh-keygen(1): allowed signers files used by ssh-keygen(1)
    signatures now support listing key validity intervals alongside
    they key, and ssh-keygen(1) can optionally check during signature
    verification whether a specified time falls inside this interval.
    This feature is intended for use by git to support signing and
    verifying objects using ssh keys.
  * ssh-keygen(8): support printing of the full public key in a sshsig
    signature via a -Oprint-pubkey flag.
  = Bugfixes
  * ssh(1)/sshd(8): start time-based re-keying exactly on schedule in
    the client and server mainloops. Previously the re-key timeout
    could expire but re-keying would not start until a packet was sent
    or received, causing a spin in select() if the connection was
    quiescent.
  * ssh-keygen(1): avoid Y2038 problem in printing certificate
    validity lifetimes. Dates past 2^31-1 seconds since epoch were
    displayed incorrectly on some platforms. bz#3329
  * scp(1): allow spaces to appear in usernames for local to remote
    and scp -3 remote to remote copies. bz#1164
  * ssh(1)/sshd(8): remove references to ChallengeResponseAuthentication
    in favour of KbdInteractiveAuthentication. The former is what was in
    SSHv1, the latter is what is in SSHv2 (RFC4256) and they were
    treated as somewhat but not entirely equivalent. We retain the old
    name as a deprecated alias so configuration files continue to work
    as well as a reference in the man page for people looking for it.
    bz#3303
  * ssh(1)/ssh-add(1)/ssh-keygen(1): fix decoding of X.509 subject name
    when extracting a key from a PKCS#11 certificate. bz#3327
  * ssh(1): restore blocking status on stdio fds before close. ssh(1)
    needs file descriptors in non-blocking mode to operate but it was
    not restoring the original state on exit. This could cause
    problems with fds shared with other programs via the shell,
    bz#3280 and GHPR246
  * ssh(1)/sshd(8): switch both client and server mainloops from
    select(3) to pselect(3). Avoids race conditions where a signal
    may arrive immediately before select(3) and not be processed until
    an event fires. bz#2158
  * ssh(1): sessions started with ControlPersist were incorrectly
    executing a shell when the -N (no shell) option was specified.
    bz#3290
  * ssh(1): check if IPQoS or TunnelDevice are already set before
    overriding. Prevents values in config files from overriding values
    supplied on the command line. bz#3319
  * ssh(1): fix debug message when finding a private key to match a
    certificate being attempted for user authentication. Previously it
    would print the certificate's path, whereas it was supposed to be
    showing the private key's path. GHPR247
  * sshd(8): match host certificates against host public keys, not
    private keys. Allows use of certificates with private keys held in
    a ssh-agent.  bz#3524
  * ssh(1): add a workaround for a bug in OpenSSH 7.4 sshd(8), which
    allows RSA/SHA2 signatures for public key authentication but fails
    to advertise this correctly via SSH2_MSG_EXT_INFO. This causes
    clients of these server to incorrectly match
    PubkeyAcceptedAlgorithmse and potentially refuse to offer valid
    keys. bz#3213
  * sftp(1)/scp(1): degrade gracefully if a sftp-server offers the
    limits@openssh.com extension but fails when the client tries to
    invoke it. bz#3318
  * ssh(1): allow ssh_config SetEnv to override $TERM, which is
    otherwise handled specially by the protocol. Useful in ~/.ssh/config
    to set TERM to something generic (e.g. "xterm" instead of
    "xterm-256color") for destinations that lack terminfo entries.
  * sftp-server(8): the limits@openssh.com extension was incorrectly
    marked as an operation that writes to the filesystem, which made it
    unavailable in sftp-server read-only mode. bz#3318
  * ssh(1): fix SEGV in UpdateHostkeys debug() message, triggered when
    the update removed more host keys than remain present.
  * Many manual page fixes.
- Additional changes from 8.6p1 release:
  = Security
  * sshd(8): OpenSSH 8.5 introduced the LogVerbose keyword. When this
    option was enabled with a set of patterns that activated logging
    in code that runs in the low-privilege sandboxed sshd process, the
    log messages were constructed in such a way that printf(3) format
    strings could effectively be specified the low-privilege code.
  = New features
  * sftp-server(8): add a new limits@openssh.com protocol extension
    that allows a client to discover various server limits, including
    maximum packet size and maximum read/write length.
  * sftp(1): use the new limits@openssh.com extension (when available)
    to select better transfer lengths in the client.
  * sshd(8): Add ModuliFile keyword to sshd_config to specify the
    location of the "moduli" file containing the groups for DH-GEX.
  * unit tests: Add a TEST_SSH_ELAPSED_TIMES environment variable to
    enable printing of the elapsed time in seconds of each test.
  = Bugfixes
  * ssh_config(5), sshd_config(5): sync CASignatureAlgorithms lists in
    manual pages with the current default. GHPR174
  * ssh(1): ensure that pkcs11_del_provider() is called before exit.
    GHPR234
  * ssh(1), sshd(8): fix problems in string->argv conversion. Multiple
    backslashes were not being dequoted correctly and quoted space in
    the middle of a string was being incorrectly split. GHPR223
  * ssh(1): return non-zero exit status when killed by signal; bz#3281
  * sftp-server(8): increase maximum SSH2_FXP_READ to match the maximum
    packet size. Also handle zero-length reads that are not explicitly
    banned by the spec.
- Additional changes from 8.5p1 release:
  = Security
  * ssh-agent(1): fixed a double-free memory corruption that was
    introduced in OpenSSH 8.2 . We treat all such memory faults as
    potentially exploitable. This bug could be reached by an attacker
    with access to the agent socket.
  = Potentially-incompatible changes
  * ssh(1), sshd(8): this release changes the first-preference signature
    algorithm from ECDSA to ED25519.
  * ssh(1), sshd(8): set the TOS/DSCP specified in the configuration
    for interactive use prior to TCP connect. The connection phase of
    the SSH session is time-sensitive and often explicitly interactive.
    The ultimate interactive/bulk TOS/DSCP will be set after
    authentication completes.
  * ssh(1), sshd(8): remove the pre-standardization cipher
    rijndael-cbc@lysator.liu.se. It is an alias for aes256-cbc before
    it was standardized in RFC4253 (2006), has been deprecated and
    disabled by default since OpenSSH 7.2 (2016) and was only briefly
    documented in ssh.1 in 2001.
  * ssh(1), sshd(8): update/replace the experimental post-quantum
    hybrid key exchange method based on Streamlined NTRU Prime coupled
    with X25519. The previous sntrup4591761x25519-sha512@tinyssh.org
    method is replaced with sntrup761x25519-sha512@openssh.com.
  * ssh(1): disable CheckHostIP by default. It provides insignificant
    benefits while making key rotation significantly more difficult,
    especially for hosts behind IP-based load-balancers.
  = New features
  * ssh(1): this release enables UpdateHostkeys by default subject to
    some conservative preconditions:
    - The key was matched in the UserKnownHostsFile (and not in the
      GlobalKnownHostsFile).
    - The same key does not exist under another name.
    - A certificate host key is not in use.
    - known_hosts contains no matching wildcard hostname pattern.
    - VerifyHostKeyDNS is not enabled.
    - The default UserKnownHostsFile is in use.
  * ssh(1), sshd(8): add a new LogVerbose configuration directive for
    that allows forcing maximum debug logging by file/function/line
    pattern-lists.
  * ssh(1): when prompting the user to accept a new hostkey, display
    any other host names/addresses already associated with the key.
  * ssh(1): allow UserKnownHostsFile=none to indicate that no
    known_hosts file should be used to identify host keys.
  * ssh(1): add a ssh_config KnownHostsCommand option that allows the
    client to obtain known_hosts data from a command in addition to
    the usual files.
  * ssh(1): add a ssh_config PermitRemoteOpen option that allows the
    client to restrict the destination when RemoteForward is used
    with SOCKS.
  * ssh(1): for FIDO keys, if a signature operation fails with a
    "incorrect PIN" reason and no PIN was initially requested from the
    user, then request a PIN and retry the operation. This supports
    some biometric devices that fall back to requiring PIN when reading
    of the biometric failed, and devices that require PINs for all
    hosted credentials.
  * sshd(8): implement client address-based rate-limiting via new
    sshd_config(5) PerSourceMaxStartups and PerSourceNetBlockSize
    directives that provide more fine-grained control on a per-origin
    address basis than the global MaxStartups limit.
  = Bugfixes
   * ssh(1): Prefix keyboard interactive prompts with "(user@host)" to
   make it easier to determine which connection they are associated
   with in cases like scp -3, ProxyJump, etc. bz#3224
  * sshd(8): fix sshd_config SetEnv directives located inside Match
    blocks. GHPR201
  * ssh(1): when requesting a FIDO token touch on stderr, inform the
    user once the touch has been recorded.
  * ssh(1): prevent integer overflow when ridiculously large
    ConnectTimeout values are specified, capping the effective value
    (for most platforms) at 24 days. bz#3229
  * ssh(1): consider the ECDSA key subtype when ordering host key
    algorithms in the client.
  * ssh(1), sshd(8): rename the PubkeyAcceptedKeyTypes keyword to
    PubkeyAcceptedAlgorithms. The previous name incorrectly suggested
    that it control allowed key algorithms, when this option actually
    specifies the signature algorithms that are accepted. The previous
    name remains available as an alias. bz#3253
  * ssh(1), sshd(8): similarly, rename HostbasedKeyTypes (ssh) and
    HostbasedAcceptedKeyTypes (sshd) to HostbasedAcceptedAlgorithms.
  * sftp-server(8): add missing lsetstat@openssh.com documentation
    and advertisement in the server's SSH2_FXP_VERSION hello packet.
  * ssh(1), sshd(8): more strictly enforce KEX state-machine by
    banning packet types once they are received. Fixes memleak caused
    by duplicate SSH2_MSG_KEX_DH_GEX_REQUEST (oss-fuzz #30078).
  * sftp(1): allow the full range of UIDs/GIDs for chown/chgrp on 32bit
    platforms instead of being limited by LONG_MAX. bz#3206
  * Minor man page fixes (capitalization, commas, etc.) bz#3223
  * sftp(1): when doing an sftp recursive upload or download of a
    read-only directory, ensure that the directory is created with
    write and execute permissions in the interim so that the transfer
    can actually complete, then set the directory permission as the
    final step. bz#3222
  * ssh-keygen(1): document the -Z, check the validity of its argument
    earlier and provide a better error message if it's not correct.
    bz#2879
  * ssh(1): ignore comments at the end of config lines in ssh_config,
    similar to what we already do for sshd_config. bz#2320
  * sshd_config(5): mention that DisableForwarding is valid in a
    sshd_config Match block. bz3239
  * sftp(1): fix incorrect sorting of "ls -ltr" under some
    circumstances. bz3248.
  * ssh(1), sshd(8): fix potential integer truncation of (unlikely)
    timeout values. bz#3250
  * ssh(1): make hostbased authentication send the signature algorithm
    in its SSH2_MSG_USERAUTH_REQUEST packets instead of the key type.
    This make HostbasedAcceptedAlgorithms do what it is supposed to -
    filter on signature algorithm and not key type.
- Rebased patches:
  * openssh-7.7p1-IPv6_X_forwarding.patch
  * openssh-7.7p1-X11_trusted_forwarding.patch
  * openssh-7.7p1-X_forward_with_disabled_ipv6.patch
  * openssh-7.7p1-cavstest-ctr.patch
  * openssh-7.7p1-cavstest-kdf.patch
  * openssh-7.7p1-disable_openssl_abi_check.patch
  * openssh-7.7p1-eal3.patch
  * openssh-7.7p1-enable_PAM_by_default.patch
  * openssh-7.7p1-fips.patch
  * openssh-7.7p1-fips_checks.patch
  * openssh-7.7p1-host_ident.patch
  * openssh-7.7p1-hostname_changes_when_forwarding_X.patch
  * openssh-7.7p1-ldap.patch
  * openssh-7.7p1-no_fork-no_pid_file.patch
  * openssh-7.7p1-pam_check_locks.patch
  * openssh-7.7p1-pts_names_formatting.patch
  * openssh-7.7p1-remove_xauth_cookies_on_exit.patch
  * openssh-7.7p1-seccomp_ipc_flock.patch
  * openssh-7.7p1-seccomp_stat.patch
  * openssh-7.7p1-send_locale.patch
  * openssh-7.7p1-sftp_force_permissions.patch
  * openssh-7.7p1-sftp_print_diagnostic_messages.patch
  * openssh-7.7p1-systemd-notify.patch
  * openssh-7.9p1-keygen-preserve-perms.patch
  * openssh-7.9p1-revert-new-qos-defaults.patch
  * openssh-8.0p1-gssapi-keyex.patch
  * openssh-8.1p1-audit.patch
  * openssh-8.1p1-seccomp-clock_gettime64.patch
  * openssh-8.1p1-seccomp-clock_nanosleep.patch
  * openssh-8.1p1-seccomp-clock_nanosleep_time64.patch
  * openssh-8.1p1-use-openssl-kdf.patch
  * openssh-8.4p1-vendordir.patch
  * openssh-fips-ensure-approved-moduli.patch
  * openssh-link-with-sk.patch
  * openssh-reenable-dh-group14-sha1-default.patch
  * openssh-whitelist-syscalls.patch
- Removed openssh-fix-ssh-copy-id.patch (fixed upstream).

OBS-URL: https://build.opensuse.org/request/show/922068
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=235
This commit is contained in:
Marcus Meissner 2021-10-07 08:06:58 +00:00 committed by Git OBS Bridge
parent 34c2098366
commit 3fed02069e
45 changed files with 1387 additions and 1195 deletions

View File

@ -5,15 +5,11 @@ Correctly parse DISPLAY variable for cases where it contains an IPv6 address
bnc#847710 - https://bugzilla.novell.com/show_bug.cgi?id=847710 bnc#847710 - https://bugzilla.novell.com/show_bug.cgi?id=847710
diff --git a/openssh-7.7p1/channels.c b/openssh-7.7p1/channels.c Index: openssh-8.8p1/channels.c
--- openssh-7.7p1/channels.c ===================================================================
+++ openssh-7.7p1/channels.c --- openssh-8.8p1.orig/channels.c
@@ -4590,33 +4590,42 @@ x11_connect_display(struct ssh *ssh) +++ openssh-8.8p1/channels.c
return -1; @@ -4776,9 +4776,10 @@ x11_connect_display(struct ssh *ssh)
/* OK, we now have a connection to the display. */
return sock;
}
/* /*
* Connect to an inet socket. The DISPLAY value is supposedly * Connect to an inet socket. The DISPLAY value is supposedly
* hostname:d[.s], where hostname may also be numeric IP address. * hostname:d[.s], where hostname may also be numeric IP address.
@ -25,14 +21,7 @@ diff --git a/openssh-7.7p1/channels.c b/openssh-7.7p1/channels.c
if (!cp) { if (!cp) {
error("Could not find ':' in DISPLAY: %.100s", display); error("Could not find ':' in DISPLAY: %.100s", display);
return -1; return -1;
} @@ -4793,6 +4794,14 @@ x11_connect_display(struct ssh *ssh)
*cp = 0;
/*
* buf now contains the host name. But first we parse the
* display number.
*/
if (sscanf(cp + 1, "%u", &display_number) != 1) {
error("Could not parse display number from DISPLAY: %.100s",
display); display);
return -1; return -1;
} }
@ -47,8 +36,3 @@ diff --git a/openssh-7.7p1/channels.c b/openssh-7.7p1/channels.c
/* Look up the host address */ /* Look up the host address */
memset(&hints, 0, sizeof(hints)); memset(&hints, 0, sizeof(hints));
hints.ai_family = ssh->chanctxt->IPv4or6;
hints.ai_socktype = SOCK_STREAM;
snprintf(strport, sizeof strport, "%u", 6000 + display_number);
if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) {
error("%.100s: unknown host. (%s)", buf,

View File

@ -6,10 +6,10 @@
Enable Trusted X11 forwarding by default, since the security benefits of Enable Trusted X11 forwarding by default, since the security benefits of
having it disabled are negligible these days with XI2 being widely used. having it disabled are negligible these days with XI2 being widely used.
Index: openssh-7.8p1/ssh_config Index: openssh-8.8p1/ssh_config
=================================================================== ===================================================================
--- openssh-7.8p1.orig/ssh_config --- openssh-8.8p1.orig/ssh_config
+++ openssh-7.8p1/ssh_config +++ openssh-8.8p1/ssh_config
@@ -17,9 +17,20 @@ @@ -17,9 +17,20 @@
# list of available options, their meanings and defaults, please see the # list of available options, their meanings and defaults, please see the
# ssh_config(5) man page. # ssh_config(5) man page.
@ -32,10 +32,10 @@ Index: openssh-7.8p1/ssh_config
# PasswordAuthentication yes # PasswordAuthentication yes
# HostbasedAuthentication no # HostbasedAuthentication no
# GSSAPIAuthentication no # GSSAPIAuthentication no
Index: openssh-7.8p1/sshd_config Index: openssh-8.8p1/sshd_config
=================================================================== ===================================================================
--- openssh-7.8p1.orig/sshd_config --- openssh-8.8p1.orig/sshd_config
+++ openssh-7.8p1/sshd_config +++ openssh-8.8p1/sshd_config
@@ -84,7 +84,7 @@ AuthorizedKeysFile .ssh/authorized_keys @@ -84,7 +84,7 @@ AuthorizedKeysFile .ssh/authorized_keys
#AllowAgentForwarding yes #AllowAgentForwarding yes
#AllowTcpForwarding yes #AllowTcpForwarding yes

View File

@ -3,13 +3,13 @@
Do not throw away already open sockets for X11 forwarding if another socket Do not throw away already open sockets for X11 forwarding if another socket
family is not available for bind() family is not available for bind()
diff --git a/channels.c b/channels.c Index: openssh-8.8p1/channels.c
index f51b7e3..95af47e 100644 ===================================================================
--- a/channels.c --- openssh-8.8p1.orig/channels.c
+++ b/channels.c +++ openssh-8.8p1/channels.c
@@ -4637,6 +4637,13 @@ x11_create_display_inet(struct ssh *ssh, int x11_display_offset, @@ -4607,6 +4607,13 @@ x11_create_display_inet(struct ssh *ssh,
debug2("%s: bind port %d: %.100s", __func__, debug2_f("bind port %d: %.100s", port,
port, strerror(errno)); strerror(errno));
close(sock); close(sock);
+ /* do not remove successfully opened sockets if + /* do not remove successfully opened sockets if
+ * the request failed because the protocol + * the request failed because the protocol

View File

@ -2,11 +2,11 @@
# Parent cc1022edba2c5eeb0facba08468f65afc2466b63 # Parent cc1022edba2c5eeb0facba08468f65afc2466b63
CAVS test for OpenSSH's own CTR encryption mode implementation CAVS test for OpenSSH's own CTR encryption mode implementation
Index: openssh-8.4p1/Makefile.in Index: openssh-8.8p1/Makefile.in
=================================================================== ===================================================================
--- openssh-8.4p1.orig/Makefile.in --- openssh-8.8p1.orig/Makefile.in
+++ openssh-8.4p1/Makefile.in +++ openssh-8.8p1/Makefile.in
@@ -25,6 +25,7 @@ SFTP_SERVER=$(libexecdir)/sftp-server @@ -26,6 +26,7 @@ SFTP_SERVER=$(libexecdir)/sftp-server
SSH_KEYSIGN=$(libexecdir)/ssh-keysign SSH_KEYSIGN=$(libexecdir)/ssh-keysign
SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper
@ -14,7 +14,7 @@ Index: openssh-8.4p1/Makefile.in
PRIVSEP_PATH=@PRIVSEP_PATH@ PRIVSEP_PATH=@PRIVSEP_PATH@
SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@ SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
STRIP_OPT=@STRIP_OPT@ STRIP_OPT=@STRIP_OPT@
@@ -68,6 +69,8 @@ MKDIR_P=@MKDIR_P@ @@ -69,6 +70,8 @@ MKDIR_P=@MKDIR_P@
TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT) TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT)
@ -23,7 +23,7 @@ Index: openssh-8.4p1/Makefile.in
XMSS_OBJS=\ XMSS_OBJS=\
ssh-xmss.o \ ssh-xmss.o \
sshkey-xmss.o \ sshkey-xmss.o \
@@ -242,6 +245,10 @@ sftp-server$(EXEEXT): $(LIBCOMPAT) libss @@ -245,6 +248,10 @@ sftp-server$(EXEEXT): $(LIBCOMPAT) libss
sftp$(EXEEXT): $(LIBCOMPAT) libssh.a $(SFTP_OBJS) sftp$(EXEEXT): $(LIBCOMPAT) libssh.a $(SFTP_OBJS)
$(LD) -o $@ $(SFTP_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LIBEDIT) $(LD) -o $@ $(SFTP_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LIBEDIT)
@ -34,7 +34,7 @@ Index: openssh-8.4p1/Makefile.in
# test driver for the loginrec code - not built by default # test driver for the loginrec code - not built by default
logintest: logintest.o $(LIBCOMPAT) libssh.a loginrec.o logintest: logintest.o $(LIBCOMPAT) libssh.a loginrec.o
$(LD) -o $@ logintest.o $(LDFLAGS) loginrec.o -lopenbsd-compat -lssh $(LIBS) $(LD) -o $@ logintest.o $(LDFLAGS) loginrec.o -lopenbsd-compat -lssh $(LIBS)
@@ -400,6 +407,7 @@ install-files: @@ -407,6 +414,7 @@ install-files:
$(INSTALL) -m 0755 $(STRIP_OPT) ssh-sk-helper$(EXEEXT) $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT) $(INSTALL) -m 0755 $(STRIP_OPT) ssh-sk-helper$(EXEEXT) $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT)
$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT) $(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT) $(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
@ -42,10 +42,10 @@ Index: openssh-8.4p1/Makefile.in
$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1 $(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
$(INSTALL) -m 644 scp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1 $(INSTALL) -m 644 scp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
$(INSTALL) -m 644 ssh-add.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1 $(INSTALL) -m 644 ssh-add.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
Index: openssh-8.4p1/cavstest-ctr.c Index: openssh-8.8p1/cavstest-ctr.c
=================================================================== ===================================================================
--- /dev/null --- /dev/null
+++ openssh-8.4p1/cavstest-ctr.c +++ openssh-8.8p1/cavstest-ctr.c
@@ -0,0 +1,214 @@ @@ -0,0 +1,214 @@
+/* +/*
+ * + *
@ -261,10 +261,10 @@ Index: openssh-8.4p1/cavstest-ctr.c
+ printf("\n"); + printf("\n");
+ return 0; + return 0;
+} +}
Index: openssh-8.4p1/cipher.c Index: openssh-8.8p1/cipher.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/cipher.c --- openssh-8.8p1.orig/cipher.c
+++ openssh-8.4p1/cipher.c +++ openssh-8.8p1/cipher.c
@@ -58,15 +58,6 @@ @@ -58,15 +58,6 @@
#define EVP_CIPHER_CTX void #define EVP_CIPHER_CTX void
#endif #endif
@ -281,10 +281,10 @@ Index: openssh-8.4p1/cipher.c
struct sshcipher { struct sshcipher {
char *name; char *name;
u_int block_size; u_int block_size;
Index: openssh-8.4p1/cipher.h Index: openssh-8.8p1/cipher.h
=================================================================== ===================================================================
--- openssh-8.4p1.orig/cipher.h --- openssh-8.8p1.orig/cipher.h
+++ openssh-8.4p1/cipher.h +++ openssh-8.8p1/cipher.h
@@ -48,7 +48,15 @@ @@ -48,7 +48,15 @@
#define CIPHER_DECRYPT 0 #define CIPHER_DECRYPT 0

View File

@ -2,11 +2,11 @@
# Parent 1e1d5a2ab8bddfc800f570755f9ea1addcc878c1 # Parent 1e1d5a2ab8bddfc800f570755f9ea1addcc878c1
CAVS test for KDF implementation in OpenSSH CAVS test for KDF implementation in OpenSSH
Index: openssh-8.4p1/Makefile.in Index: openssh-8.8p1/Makefile.in
=================================================================== ===================================================================
--- openssh-8.4p1.orig/Makefile.in --- openssh-8.8p1.orig/Makefile.in
+++ openssh-8.4p1/Makefile.in +++ openssh-8.8p1/Makefile.in
@@ -26,6 +26,7 @@ SSH_KEYSIGN=$(libexecdir)/ssh-keysign @@ -27,6 +27,7 @@ SSH_KEYSIGN=$(libexecdir)/ssh-keysign
SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper
CAVSTEST_CTR=$(libexecdir)/cavstest-ctr CAVSTEST_CTR=$(libexecdir)/cavstest-ctr
@ -14,7 +14,7 @@ Index: openssh-8.4p1/Makefile.in
PRIVSEP_PATH=@PRIVSEP_PATH@ PRIVSEP_PATH=@PRIVSEP_PATH@
SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@ SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
STRIP_OPT=@STRIP_OPT@ STRIP_OPT=@STRIP_OPT@
@@ -69,7 +70,7 @@ MKDIR_P=@MKDIR_P@ @@ -70,7 +71,7 @@ MKDIR_P=@MKDIR_P@
TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT) TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT)
@ -23,7 +23,7 @@ Index: openssh-8.4p1/Makefile.in
XMSS_OBJS=\ XMSS_OBJS=\
ssh-xmss.o \ ssh-xmss.o \
@@ -249,6 +250,9 @@ sftp$(EXEEXT): $(LIBCOMPAT) libssh.a $(S @@ -252,6 +253,9 @@ sftp$(EXEEXT): $(LIBCOMPAT) libssh.a $(S
cavstest-ctr$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-sk.o sk-usbhid.o cavstest-ctr.o cavstest-ctr$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-sk.o sk-usbhid.o cavstest-ctr.o
$(LD) -o $@ cavstest-ctr.o ssh-sk.o sk-usbhid.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS) $(LIBFIDO2) $(LD) -o $@ cavstest-ctr.o ssh-sk.o sk-usbhid.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS) $(LIBFIDO2)
@ -33,7 +33,7 @@ Index: openssh-8.4p1/Makefile.in
# test driver for the loginrec code - not built by default # test driver for the loginrec code - not built by default
logintest: logintest.o $(LIBCOMPAT) libssh.a loginrec.o logintest: logintest.o $(LIBCOMPAT) libssh.a loginrec.o
$(LD) -o $@ logintest.o $(LDFLAGS) loginrec.o -lopenbsd-compat -lssh $(LIBS) $(LD) -o $@ logintest.o $(LDFLAGS) loginrec.o -lopenbsd-compat -lssh $(LIBS)
@@ -408,6 +412,7 @@ install-files: @@ -415,6 +419,7 @@ install-files:
$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT) $(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT) $(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
$(INSTALL) -m 0755 $(STRIP_OPT) cavstest-ctr$(EXEEXT) $(DESTDIR)$(libexecdir)/cavstest-ctr$(EXEEXT) $(INSTALL) -m 0755 $(STRIP_OPT) cavstest-ctr$(EXEEXT) $(DESTDIR)$(libexecdir)/cavstest-ctr$(EXEEXT)
@ -41,10 +41,10 @@ Index: openssh-8.4p1/Makefile.in
$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1 $(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
$(INSTALL) -m 644 scp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1 $(INSTALL) -m 644 scp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
$(INSTALL) -m 644 ssh-add.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1 $(INSTALL) -m 644 ssh-add.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
Index: openssh-8.4p1/cavstest-kdf.c Index: openssh-8.8p1/cavstest-kdf.c
=================================================================== ===================================================================
--- /dev/null --- /dev/null
+++ openssh-8.4p1/cavstest-kdf.c +++ openssh-8.8p1/cavstest-kdf.c
@@ -0,0 +1,402 @@ @@ -0,0 +1,402 @@
+/* +/*
+ * Copyright (C) 2015, Stephan Mueller <smueller@chronox.de> + * Copyright (C) 2015, Stephan Mueller <smueller@chronox.de>
@ -249,8 +249,8 @@ Index: openssh-8.4p1/cavstest-kdf.c
+ goto out; + goto out;
+ } + }
+ +
+ kex.session_id = test->session_id; + kex.session_id = sshbuf_new();
+ kex.session_id_len = test->session_id_len; + sshbuf_put(kex.session_id, test->session_id, test->session_id_len);
+ +
+ /* setup kex */ + /* setup kex */
+ +

View File

@ -4,11 +4,11 @@ disable run-time check for OpenSSL ABI by version number as that is not a
reliable indicator of ABI changes and doesn't make much sense in a reliable indicator of ABI changes and doesn't make much sense in a
distribution package distribution package
diff --git a/configure.ac b/configure.ac Index: openssh-8.8p1/configure.ac
index 42ffd95..20a1884 100644 ===================================================================
--- a/configure.ac --- openssh-8.8p1.orig/configure.ac
+++ b/configure.ac +++ openssh-8.8p1/configure.ac
@@ -4878,6 +4878,19 @@ AC_ARG_WITH([bsd-auth], @@ -5236,6 +5236,19 @@ AC_ARG_WITH([bsd-auth],
] ]
) )
@ -28,11 +28,11 @@ index 42ffd95..20a1884 100644
# Where to place sshd.pid # Where to place sshd.pid
piddir=/var/run piddir=/var/run
# make sure the directory exists # make sure the directory exists
diff --git a/entropy.c b/entropy.c Index: openssh-8.8p1/entropy.c
index f8b9f42..4957b23 100644 ===================================================================
--- a/entropy.c --- openssh-8.8p1.orig/entropy.c
+++ b/entropy.c +++ openssh-8.8p1/entropy.c
@@ -223,11 +223,13 @@ seed_rng(void) @@ -100,11 +100,13 @@ seed_rng(void)
/* Initialise libcrypto */ /* Initialise libcrypto */
ssh_libcrypto_init(); ssh_libcrypto_init();

View File

@ -2,15 +2,11 @@
# Parent 8fd4e445c3a5c823568661a4f71b064cbcb217a9 # Parent 8fd4e445c3a5c823568661a4f71b064cbcb217a9
fix paths and references in sshd man pages fix paths and references in sshd man pages
diff --git a/openssh-7.7p1/Makefile.in b/openssh-7.7p1/Makefile.in Index: openssh-8.8p1/Makefile.in
--- openssh-7.7p1/Makefile.in ===================================================================
+++ openssh-7.7p1/Makefile.in --- openssh-8.8p1.orig/Makefile.in
@@ -127,17 +127,18 @@ MANTYPE = @MANTYPE@ +++ openssh-8.8p1/Makefile.in
CONFIGFILES=sshd_config.out ssh_config.out moduli.out @@ -165,7 +165,8 @@ PATHSUBS = \
CONFIGFILES_IN=sshd_config ssh_config moduli
PATHSUBS = \
-e 's|/etc/ssh/ssh_config|$(sysconfdir)/ssh_config|g' \
-e 's|/etc/ssh/ssh_known_hosts|$(sysconfdir)/ssh_known_hosts|g' \ -e 's|/etc/ssh/ssh_known_hosts|$(sysconfdir)/ssh_known_hosts|g' \
-e 's|/etc/ssh/sshd_config|$(sysconfdir)/sshd_config|g' \ -e 's|/etc/ssh/sshd_config|$(sysconfdir)/sshd_config|g' \
-e 's|/usr/libexec|$(libexecdir)|g' \ -e 's|/usr/libexec|$(libexecdir)|g' \
@ -20,8 +16,3 @@ diff --git a/openssh-7.7p1/Makefile.in b/openssh-7.7p1/Makefile.in
-e 's|/etc/ssh/ssh_host_key|$(sysconfdir)/ssh_host_key|g' \ -e 's|/etc/ssh/ssh_host_key|$(sysconfdir)/ssh_host_key|g' \
-e 's|/etc/ssh/ssh_host_ecdsa_key|$(sysconfdir)/ssh_host_ecdsa_key|g' \ -e 's|/etc/ssh/ssh_host_ecdsa_key|$(sysconfdir)/ssh_host_ecdsa_key|g' \
-e 's|/etc/ssh/ssh_host_dsa_key|$(sysconfdir)/ssh_host_dsa_key|g' \ -e 's|/etc/ssh/ssh_host_dsa_key|$(sysconfdir)/ssh_host_dsa_key|g' \
-e 's|/etc/ssh/ssh_host_rsa_key|$(sysconfdir)/ssh_host_rsa_key|g' \
-e 's|/etc/ssh/ssh_host_ed25519_key|$(sysconfdir)/ssh_host_ed25519_key|g' \
-e 's|/var/run/sshd.pid|$(piddir)/sshd.pid|g' \
-e 's|/etc/moduli|$(sysconfdir)/moduli|g' \
-e 's|/etc/ssh/moduli|$(sysconfdir)/moduli|g' \

View File

@ -4,25 +4,16 @@
# bnc#46749 # bnc#46749
# --used to be called '-pam-fix2' # --used to be called '-pam-fix2'
diff --git a/openssh-7.7p1/sshd_config b/openssh-7.7p1/sshd_config Index: openssh-8.8p1/sshd_config
--- openssh-7.7p1/sshd_config ===================================================================
+++ openssh-7.7p1/sshd_config --- openssh-8.8p1.orig/sshd_config
@@ -74,17 +74,17 @@ AuthorizedKeysFile .ssh/authorized_keys +++ openssh-8.8p1/sshd_config
# and session processing. If this is enabled, PAM authentication will @@ -79,7 +79,7 @@ AuthorizedKeysFile .ssh/authorized_keys
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
# If you just want the PAM account and session checks to run without # If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication # PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'. # and KbdInteractiveAuthentication to 'no'.
-#UsePAM no -#UsePAM no
+UsePAM yes +UsePAM yes
#AllowAgentForwarding yes #AllowAgentForwarding yes
#AllowTcpForwarding yes #AllowTcpForwarding yes
#GatewayPorts no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes

View File

@ -3,11 +3,11 @@
FIPS 140-2 compliance. Perform selftests on start and use only FIPS approved FIPS 140-2 compliance. Perform selftests on start and use only FIPS approved
algorithms. algorithms.
Index: openssh-8.4p1/Makefile.in Index: openssh-8.8p1/Makefile.in
=================================================================== ===================================================================
--- openssh-8.4p1.orig/Makefile.in --- openssh-8.8p1.orig/Makefile.in
+++ openssh-8.4p1/Makefile.in +++ openssh-8.8p1/Makefile.in
@@ -112,6 +112,8 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \ @@ -113,6 +113,8 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
SKOBJS= ssh-sk-client.o SKOBJS= ssh-sk-client.o
@ -16,10 +16,10 @@ Index: openssh-8.4p1/Makefile.in
SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \ SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
sshconnect.o sshconnect2.o mux.o $(SKOBJS) sshconnect.o sshconnect2.o mux.o $(SKOBJS)
Index: openssh-8.4p1/cipher-ctr.c Index: openssh-8.8p1/cipher-ctr.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/cipher-ctr.c --- openssh-8.8p1.orig/cipher-ctr.c
+++ openssh-8.4p1/cipher-ctr.c +++ openssh-8.8p1/cipher-ctr.c
@@ -27,6 +27,8 @@ @@ -27,6 +27,8 @@
#include "xmalloc.h" #include "xmalloc.h"
#include "log.h" #include "log.h"
@ -38,10 +38,10 @@ Index: openssh-8.4p1/cipher-ctr.c
#endif #endif
return (&aes_ctr); return (&aes_ctr);
} }
Index: openssh-8.4p1/cipher.c Index: openssh-8.8p1/cipher.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/cipher.c --- openssh-8.8p1.orig/cipher.c
+++ openssh-8.4p1/cipher.c +++ openssh-8.8p1/cipher.c
@@ -51,6 +51,9 @@ @@ -51,6 +51,9 @@
#include "openbsd-compat/openssl-compat.h" #include "openbsd-compat/openssl-compat.h"
@ -61,7 +61,7 @@ Index: openssh-8.4p1/cipher.c
#ifdef WITH_OPENSSL #ifdef WITH_OPENSSL
#ifndef OPENSSL_NO_DES #ifndef OPENSSL_NO_DES
{ "3des-cbc", 8, 24, 0, 0, CFLAG_CBC, EVP_des_ede3_cbc }, { "3des-cbc", 8, 24, 0, 0, CFLAG_CBC, EVP_des_ede3_cbc },
@@ -114,8 +117,52 @@ static const struct sshcipher ciphers[] @@ -112,8 +115,52 @@ static const struct sshcipher ciphers[]
{ NULL, 0, 0, 0, 0, 0, NULL } { NULL, 0, 0, 0, 0, 0, NULL }
}; };
@ -114,7 +114,7 @@ Index: openssh-8.4p1/cipher.c
/* Returns a comma-separated list of supported ciphers. */ /* Returns a comma-separated list of supported ciphers. */
char * char *
cipher_alg_list(char sep, int auth_only) cipher_alg_list(char sep, int auth_only)
@@ -124,7 +171,7 @@ cipher_alg_list(char sep, int auth_only) @@ -122,7 +169,7 @@ cipher_alg_list(char sep, int auth_only)
size_t nlen, rlen = 0; size_t nlen, rlen = 0;
const struct sshcipher *c; const struct sshcipher *c;
@ -123,7 +123,7 @@ Index: openssh-8.4p1/cipher.c
if ((c->flags & CFLAG_INTERNAL) != 0) if ((c->flags & CFLAG_INTERNAL) != 0)
continue; continue;
if (auth_only && c->auth_len == 0) if (auth_only && c->auth_len == 0)
@@ -207,7 +254,7 @@ const struct sshcipher * @@ -205,7 +252,7 @@ const struct sshcipher *
cipher_by_name(const char *name) cipher_by_name(const char *name)
{ {
const struct sshcipher *c; const struct sshcipher *c;
@ -132,10 +132,10 @@ Index: openssh-8.4p1/cipher.c
if (strcmp(c->name, name) == 0) if (strcmp(c->name, name) == 0)
return c; return c;
return NULL; return NULL;
Index: openssh-8.4p1/fips.c Index: openssh-8.8p1/fips.c
=================================================================== ===================================================================
--- /dev/null --- /dev/null
+++ openssh-8.4p1/fips.c +++ openssh-8.8p1/fips.c
@@ -0,0 +1,212 @@ @@ -0,0 +1,212 @@
+/* +/*
+ * Copyright (c) 2012 Petr Cerny. All rights reserved. + * Copyright (c) 2012 Petr Cerny. All rights reserved.
@ -349,10 +349,10 @@ Index: openssh-8.4p1/fips.c
+ return dgst; + return dgst;
+} +}
+ +
Index: openssh-8.4p1/fips.h Index: openssh-8.8p1/fips.h
=================================================================== ===================================================================
--- /dev/null --- /dev/null
+++ openssh-8.4p1/fips.h +++ openssh-8.8p1/fips.h
@@ -0,0 +1,44 @@ @@ -0,0 +1,44 @@
+/* +/*
+ * Copyright (c) 2012 Petr Cerny. All rights reserved. + * Copyright (c) 2012 Petr Cerny. All rights reserved.
@ -398,10 +398,10 @@ Index: openssh-8.4p1/fips.h
+ +
+#endif +#endif
+ +
Index: openssh-8.4p1/hmac.c Index: openssh-8.8p1/hmac.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/hmac.c --- openssh-8.8p1.orig/hmac.c
+++ openssh-8.4p1/hmac.c +++ openssh-8.8p1/hmac.c
@@ -145,7 +145,7 @@ hmac_test(void *key, size_t klen, void * @@ -145,7 +145,7 @@ hmac_test(void *key, size_t klen, void *
size_t i; size_t i;
u_char digest[16]; u_char digest[16];
@ -411,10 +411,10 @@ Index: openssh-8.4p1/hmac.c
printf("ssh_hmac_start failed"); printf("ssh_hmac_start failed");
if (ssh_hmac_init(ctx, key, klen) < 0 || if (ssh_hmac_init(ctx, key, klen) < 0 ||
ssh_hmac_update(ctx, m, mlen) < 0 || ssh_hmac_update(ctx, m, mlen) < 0 ||
Index: openssh-8.4p1/kex.c Index: openssh-8.8p1/kex.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/kex.c --- openssh-8.8p1.orig/kex.c
+++ openssh-8.4p1/kex.c +++ openssh-8.8p1/kex.c
@@ -62,6 +62,8 @@ @@ -62,6 +62,8 @@
#include "sshbuf.h" #include "sshbuf.h"
#include "digest.h" #include "digest.h"
@ -433,7 +433,7 @@ Index: openssh-8.4p1/kex.c
#ifdef WITH_OPENSSL #ifdef WITH_OPENSSL
{ KEX_DH1, KEX_DH_GRP1_SHA1, 0, SSH_DIGEST_SHA1 }, { KEX_DH1, KEX_DH_GRP1_SHA1, 0, SSH_DIGEST_SHA1 },
{ KEX_DH14_SHA1, KEX_DH_GRP14_SHA1, 0, SSH_DIGEST_SHA1 }, { KEX_DH14_SHA1, KEX_DH_GRP14_SHA1, 0, SSH_DIGEST_SHA1 },
@@ -116,6 +118,47 @@ static const struct kexalg kexalgs[] = { @@ -118,6 +120,47 @@ static const struct kexalg kexalgs[] = {
{ NULL, 0, -1, -1}, { NULL, 0, -1, -1},
}; };
@ -481,7 +481,7 @@ Index: openssh-8.4p1/kex.c
char * char *
kex_alg_list(char sep) kex_alg_list(char sep)
{ {
@@ -123,7 +166,7 @@ kex_alg_list(char sep) @@ -125,7 +168,7 @@ kex_alg_list(char sep)
size_t nlen, rlen = 0; size_t nlen, rlen = 0;
const struct kexalg *k; const struct kexalg *k;
@ -490,7 +490,7 @@ Index: openssh-8.4p1/kex.c
if (ret != NULL) if (ret != NULL)
ret[rlen++] = sep; ret[rlen++] = sep;
nlen = strlen(k->name); nlen = strlen(k->name);
@@ -143,7 +186,7 @@ kex_alg_by_name(const char *name) @@ -145,7 +188,7 @@ kex_alg_by_name(const char *name)
{ {
const struct kexalg *k; const struct kexalg *k;
@ -499,7 +499,7 @@ Index: openssh-8.4p1/kex.c
if (strcmp(k->name, name) == 0) if (strcmp(k->name, name) == 0)
return k; return k;
} }
@@ -163,7 +206,10 @@ kex_names_valid(const char *names) @@ -165,7 +208,10 @@ kex_names_valid(const char *names)
for ((p = strsep(&cp, ",")); p && *p != '\0'; for ((p = strsep(&cp, ",")); p && *p != '\0';
(p = strsep(&cp, ","))) { (p = strsep(&cp, ","))) {
if (kex_alg_by_name(p) == NULL) { if (kex_alg_by_name(p) == NULL) {
@ -510,10 +510,10 @@ Index: openssh-8.4p1/kex.c
free(s); free(s);
return 0; return 0;
} }
Index: openssh-8.4p1/mac.c Index: openssh-8.8p1/mac.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/mac.c --- openssh-8.8p1.orig/mac.c
+++ openssh-8.4p1/mac.c +++ openssh-8.8p1/mac.c
@@ -41,6 +41,9 @@ @@ -41,6 +41,9 @@
#include "openbsd-compat/openssl-compat.h" #include "openbsd-compat/openssl-compat.h"
@ -593,10 +593,10 @@ Index: openssh-8.4p1/mac.c
if (strcmp(name, m->name) != 0) if (strcmp(name, m->name) != 0)
continue; continue;
if (mac != NULL) if (mac != NULL)
Index: openssh-8.4p1/readconf.c Index: openssh-8.8p1/readconf.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/readconf.c --- openssh-8.8p1.orig/readconf.c
+++ openssh-8.4p1/readconf.c +++ openssh-8.8p1/readconf.c
@@ -68,6 +68,8 @@ @@ -68,6 +68,8 @@
#include "myproposal.h" #include "myproposal.h"
#include "digest.h" #include "digest.h"
@ -606,8 +606,8 @@ Index: openssh-8.4p1/readconf.c
/* Format of the configuration file: /* Format of the configuration file:
# Configuration data is parsed as follows: # Configuration data is parsed as follows:
@@ -1949,6 +1951,23 @@ option_clear_or_none(const char *o) @@ -2307,6 +2309,23 @@ config_has_permitted_cnames(Options *opt
return o == NULL || strcasecmp(o, "none") == 0; return options->num_permitted_cnames > 0;
} }
+/* remove algorithms not approved for use in FIPS mode, when running in FIPS +/* remove algorithms not approved for use in FIPS mode, when running in FIPS
@ -630,7 +630,7 @@ Index: openssh-8.4p1/readconf.c
/* /*
* Initializes options to special values that indicate that they have not yet * Initializes options to special values that indicate that they have not yet
* been set. Read_config_file will only set options with this value. Options * been set. Read_config_file will only set options with this value. Options
@@ -2240,6 +2259,9 @@ fill_default_options(Options * options) @@ -2618,6 +2637,9 @@ fill_default_options(Options * options)
options->canonicalize_hostname = SSH_CANONICALISE_NO; options->canonicalize_hostname = SSH_CANONICALISE_NO;
if (options->fingerprint_hash == -1) if (options->fingerprint_hash == -1)
options->fingerprint_hash = SSH_FP_HASH_DEFAULT; options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
@ -640,28 +640,20 @@ Index: openssh-8.4p1/readconf.c
#ifdef ENABLE_SK_INTERNAL #ifdef ENABLE_SK_INTERNAL
if (options->sk_provider == NULL) if (options->sk_provider == NULL)
options->sk_provider = xstrdup("internal"); options->sk_provider = xstrdup("internal");
@@ -2273,6 +2295,7 @@ fill_default_options(Options * options) @@ -2654,6 +2676,8 @@ fill_default_options(Options * options)
ASSEMBLE(pubkey_key_types, def_key, all_key);
ASSEMBLE(ca_sign_algorithms, def_sig, all_sig); ASSEMBLE(ca_sign_algorithms, def_sig, all_sig);
#undef ASSEMBLE #undef ASSEMBLE
+
free(all_cipher);
free(all_mac);
free(all_kex);
@@ -2284,6 +2307,8 @@ fill_default_options(Options * options)
kex_default_pk_alg_filtered = def_key; /* save for later use */
free(def_sig);
+ filter_fips_algorithms(options); + filter_fips_algorithms(options);
+ +
#define CLEAR_ON_NONE(v) \ #define CLEAR_ON_NONE(v) \
do { \ do { \
if (option_clear_or_none(v)) { \ if (option_clear_or_none(v)) { \
Index: openssh-8.4p1/readconf.h Index: openssh-8.8p1/readconf.h
=================================================================== ===================================================================
--- openssh-8.4p1.orig/readconf.h --- openssh-8.8p1.orig/readconf.h
+++ openssh-8.4p1/readconf.h +++ openssh-8.8p1/readconf.h
@@ -200,6 +200,7 @@ typedef struct { @@ -212,6 +212,7 @@ typedef struct {
#define SSH_STRICT_HOSTKEY_YES 2 #define SSH_STRICT_HOSTKEY_YES 2
#define SSH_STRICT_HOSTKEY_ASK 3 #define SSH_STRICT_HOSTKEY_ASK 3
@ -669,10 +661,10 @@ Index: openssh-8.4p1/readconf.h
const char *kex_default_pk_alg(void); const char *kex_default_pk_alg(void);
char *ssh_connection_hash(const char *thishost, const char *host, char *ssh_connection_hash(const char *thishost, const char *host,
const char *portstr, const char *user); const char *portstr, const char *user);
Index: openssh-8.4p1/servconf.c Index: openssh-8.8p1/servconf.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/servconf.c --- openssh-8.8p1.orig/servconf.c
+++ openssh-8.4p1/servconf.c +++ openssh-8.8p1/servconf.c
@@ -70,6 +70,7 @@ @@ -70,6 +70,7 @@
#include "auth.h" #include "auth.h"
#include "myproposal.h" #include "myproposal.h"
@ -681,7 +673,7 @@ Index: openssh-8.4p1/servconf.c
static void add_listen_addr(ServerOptions *, const char *, static void add_listen_addr(ServerOptions *, const char *,
const char *, int); const char *, int);
@@ -201,6 +202,23 @@ option_clear_or_none(const char *o) @@ -205,6 +206,23 @@ option_clear_or_none(const char *o)
return o == NULL || strcasecmp(o, "none") == 0; return o == NULL || strcasecmp(o, "none") == 0;
} }
@ -705,7 +697,7 @@ Index: openssh-8.4p1/servconf.c
static void static void
assemble_algorithms(ServerOptions *o) assemble_algorithms(ServerOptions *o)
{ {
@@ -242,6 +260,8 @@ assemble_algorithms(ServerOptions *o) @@ -246,6 +264,8 @@ assemble_algorithms(ServerOptions *o)
free(def_kex); free(def_kex);
free(def_key); free(def_key);
free(def_sig); free(def_sig);
@ -713,8 +705,8 @@ Index: openssh-8.4p1/servconf.c
+ filter_fips_algorithms_s(o); + filter_fips_algorithms_s(o);
} }
static void void
@@ -454,6 +474,8 @@ fill_default_server_options(ServerOption @@ -438,6 +458,8 @@ fill_default_server_options(ServerOption
options->fwd_opts.streamlocal_bind_unlink = 0; options->fwd_opts.streamlocal_bind_unlink = 0;
if (options->fingerprint_hash == -1) if (options->fingerprint_hash == -1)
options->fingerprint_hash = SSH_FP_HASH_DEFAULT; options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
@ -723,20 +715,20 @@ Index: openssh-8.4p1/servconf.c
if (options->disable_forwarding == -1) if (options->disable_forwarding == -1)
options->disable_forwarding = 0; options->disable_forwarding = 0;
if (options->expose_userauth_info == -1) if (options->expose_userauth_info == -1)
Index: openssh-8.4p1/ssh-keygen.c Index: openssh-8.8p1/ssh-keygen.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/ssh-keygen.c --- openssh-8.8p1.orig/ssh-keygen.c
+++ openssh-8.4p1/ssh-keygen.c +++ openssh-8.8p1/ssh-keygen.c
@@ -66,6 +66,8 @@ @@ -67,6 +67,8 @@
#include "ssh-sk.h"
#include "sk-api.h" /* XXX for SSH_SK_USER_PRESENCE_REQD; remove */ #include "sk-api.h" /* XXX for SSH_SK_USER_PRESENCE_REQD; remove */
#include "cipher.h"
+#include "fips.h" +#include "fips.h"
+ +
#ifdef WITH_OPENSSL #ifdef WITH_OPENSSL
# define DEFAULT_KEY_TYPE_NAME "rsa" # define DEFAULT_KEY_TYPE_NAME "rsa"
#else #else
@@ -1036,11 +1038,13 @@ do_fingerprint(struct passwd *pw) @@ -1037,11 +1039,13 @@ do_fingerprint(struct passwd *pw)
static void static void
do_gen_all_hostkeys(struct passwd *pw) do_gen_all_hostkeys(struct passwd *pw)
{ {
@ -752,7 +744,7 @@ Index: openssh-8.4p1/ssh-keygen.c
#ifdef WITH_OPENSSL #ifdef WITH_OPENSSL
{ "rsa", "RSA" ,_PATH_HOST_RSA_KEY_FILE }, { "rsa", "RSA" ,_PATH_HOST_RSA_KEY_FILE },
{ "dsa", "DSA", _PATH_HOST_DSA_KEY_FILE }, { "dsa", "DSA", _PATH_HOST_DSA_KEY_FILE },
@@ -1055,6 +1059,17 @@ do_gen_all_hostkeys(struct passwd *pw) @@ -1056,6 +1060,17 @@ do_gen_all_hostkeys(struct passwd *pw)
{ NULL, NULL, NULL } { NULL, NULL, NULL }
}; };
@ -770,7 +762,7 @@ Index: openssh-8.4p1/ssh-keygen.c
u_int32_t bits = 0; u_int32_t bits = 0;
int first = 0; int first = 0;
struct stat st; struct stat st;
@@ -1062,6 +1077,12 @@ do_gen_all_hostkeys(struct passwd *pw) @@ -1063,6 +1078,12 @@ do_gen_all_hostkeys(struct passwd *pw)
char comment[1024], *prv_tmp, *pub_tmp, *prv_file, *pub_file; char comment[1024], *prv_tmp, *pub_tmp, *prv_file, *pub_file;
int i, type, fd, r; int i, type, fd, r;
@ -783,7 +775,7 @@ Index: openssh-8.4p1/ssh-keygen.c
for (i = 0; key_types[i].key_type; i++) { for (i = 0; key_types[i].key_type; i++) {
public = private = NULL; public = private = NULL;
prv_tmp = pub_tmp = prv_file = pub_file = NULL; prv_tmp = pub_tmp = prv_file = pub_file = NULL;
@@ -3586,6 +3607,15 @@ main(int argc, char **argv) @@ -3620,6 +3641,15 @@ main(int argc, char **argv)
key_type_name = DEFAULT_KEY_TYPE_NAME; key_type_name = DEFAULT_KEY_TYPE_NAME;
type = sshkey_type_from_name(key_type_name); type = sshkey_type_from_name(key_type_name);
@ -799,37 +791,37 @@ Index: openssh-8.4p1/ssh-keygen.c
type_bits_valid(type, key_type_name, &bits); type_bits_valid(type, key_type_name, &bits);
if (!quiet) if (!quiet)
Index: openssh-8.4p1/ssh_config.5 Index: openssh-8.8p1/ssh_config.5
=================================================================== ===================================================================
--- openssh-8.4p1.orig/ssh_config.5 --- openssh-8.8p1.orig/ssh_config.5
+++ openssh-8.4p1/ssh_config.5 +++ openssh-8.8p1/ssh_config.5
@@ -682,6 +682,8 @@ Valid options are: @@ -736,6 +736,8 @@ The argument to this keyword must be
and option) or
.Cm sha256 .Cm no
(the default). (the default).
+.Pp +.Pp
+In the FIPS mode the minimum of SHA-1 is enforced (which means sha256). +In the FIPS mode the minimum of SHA-1 is enforced (which means sha256).
.It Cm ForwardAgent .It Cm ForwardAgent
Specifies whether the connection to the authentication agent (if any) Specifies whether the connection to the authentication agent (if any)
will be forwarded to the remote machine. will be forwarded to the remote machine.
Index: openssh-8.4p1/sshd.c Index: openssh-8.8p1/sshd.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/sshd.c --- openssh-8.8p1.orig/sshd.c
+++ openssh-8.4p1/sshd.c +++ openssh-8.8p1/sshd.c
@@ -124,6 +124,8 @@ @@ -126,6 +126,8 @@
#include "ssherr.h" #include "srclimit.h"
#include "sk-api.h" #include "dh.h"
+#include "fips.h" +#include "fips.h"
+ +
/* Re-exec fds */ /* Re-exec fds */
#define REEXEC_DEVCRYPTO_RESERVED_FD (STDERR_FILENO + 1) #define REEXEC_DEVCRYPTO_RESERVED_FD (STDERR_FILENO + 1)
#define REEXEC_STARTUP_PIPE_FD (STDERR_FILENO + 2) #define REEXEC_STARTUP_PIPE_FD (STDERR_FILENO + 2)
Index: openssh-8.4p1/sshd_config.5 Index: openssh-8.8p1/sshd_config.5
=================================================================== ===================================================================
--- openssh-8.4p1.orig/sshd_config.5 --- openssh-8.8p1.orig/sshd_config.5
+++ openssh-8.4p1/sshd_config.5 +++ openssh-8.8p1/sshd_config.5
@@ -594,6 +594,8 @@ and @@ -600,6 +600,8 @@ and
.Cm sha256 . .Cm sha256 .
The default is The default is
.Cm sha256 . .Cm sha256 .

View File

@ -14,10 +14,10 @@
# file is not found (or the hash matches), proceed in non-FIPS mode and abort # file is not found (or the hash matches), proceed in non-FIPS mode and abort
# otherwise. # otherwise.
Index: openssh-8.4p1/fips-check.c Index: openssh-8.8p1/fips-check.c
=================================================================== ===================================================================
--- /dev/null --- /dev/null
+++ openssh-8.4p1/fips-check.c +++ openssh-8.8p1/fips-check.c
@@ -0,0 +1,34 @@ @@ -0,0 +1,34 @@
+#include "includes.h" +#include "includes.h"
+#include <fcntl.h> +#include <fcntl.h>
@ -53,10 +53,10 @@ Index: openssh-8.4p1/fips-check.c
+ fips_ssh_init(); + fips_ssh_init();
+ return 0; + return 0;
+} +}
Index: openssh-8.4p1/fips.c Index: openssh-8.8p1/fips.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/fips.c --- openssh-8.8p1.orig/fips.c
+++ openssh-8.4p1/fips.c +++ openssh-8.8p1/fips.c
@@ -35,30 +35,293 @@ @@ -35,30 +35,293 @@
#include "log.h" #include "log.h"
#include "xmalloc.h" #include "xmalloc.h"
@ -362,10 +362,10 @@ Index: openssh-8.4p1/fips.c
int int
fips_mode(void) fips_mode(void)
{ {
Index: openssh-8.4p1/fips.h Index: openssh-8.8p1/fips.h
=================================================================== ===================================================================
--- openssh-8.4p1.orig/fips.h --- openssh-8.8p1.orig/fips.h
+++ openssh-8.4p1/fips.h +++ openssh-8.8p1/fips.h
@@ -1,5 +1,5 @@ @@ -1,5 +1,5 @@
/* /*
- * Copyright (c) 2012 Petr Cerny. All rights reserved. - * Copyright (c) 2012 Petr Cerny. All rights reserved.
@ -407,20 +407,20 @@ Index: openssh-8.4p1/fips.h
#endif #endif
- -
Index: openssh-8.4p1/sftp-server.c Index: openssh-8.8p1/sftp-server.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/sftp-server.c --- openssh-8.8p1.orig/sftp-server.c
+++ openssh-8.4p1/sftp-server.c +++ openssh-8.8p1/sftp-server.c
@@ -53,6 +53,8 @@ @@ -57,6 +57,8 @@ char *sftp_realpath(const char *, char *
/* Maximum data read that we are willing to accept */
char *sftp_realpath(const char *, char *); /* sftp-realpath.c */ #define SFTP_MAX_READ_LENGTH (SFTP_MAX_MSG_LENGTH - 1024)
+#include "fips.h" +#include "fips.h"
+ +
/* Our verbosity */ /* Our verbosity */
static LogLevel log_level = SYSLOG_LEVEL_ERROR; static LogLevel log_level = SYSLOG_LEVEL_ERROR;
@@ -1577,6 +1579,9 @@ sftp_server_main(int argc, char **argv, @@ -1717,6 +1719,9 @@ sftp_server_main(int argc, char **argv,
extern char *optarg; extern char *optarg;
extern char *__progname; extern char *__progname;
@ -430,10 +430,10 @@ Index: openssh-8.4p1/sftp-server.c
__progname = ssh_get_progname(argv[0]); __progname = ssh_get_progname(argv[0]);
log_init(__progname, log_level, log_facility, log_stderr); log_init(__progname, log_level, log_facility, log_stderr);
Index: openssh-8.4p1/ssh.c Index: openssh-8.8p1/ssh.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/ssh.c --- openssh-8.8p1.orig/ssh.c
+++ openssh-8.4p1/ssh.c +++ openssh-8.8p1/ssh.c
@@ -113,6 +113,8 @@ @@ -113,6 +113,8 @@
#include "ssh-pkcs11.h" #include "ssh-pkcs11.h"
#endif #endif
@ -443,9 +443,9 @@ Index: openssh-8.4p1/ssh.c
extern char *__progname; extern char *__progname;
/* Saves a copy of argv for setproctitle emulation */ /* Saves a copy of argv for setproctitle emulation */
@@ -658,6 +660,10 @@ main(int ac, char **av) @@ -632,6 +634,10 @@ main(int ac, char **av)
size_t n, len;
u_int j; u_int j;
struct ssh_conn_info *cinfo = NULL;
+ /* initialize fips - can go before ssh_malloc_init(), since that is a + /* initialize fips - can go before ssh_malloc_init(), since that is a
+ * OpenBSD-only thing (as of OpenSSH 7.6p1) */ + * OpenBSD-only thing (as of OpenSSH 7.6p1) */
@ -454,11 +454,11 @@ Index: openssh-8.4p1/ssh.c
/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */ /* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
sanitise_stdfd(); sanitise_stdfd();
Index: openssh-8.4p1/sshd.c Index: openssh-8.8p1/sshd.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/sshd.c --- openssh-8.8p1.orig/sshd.c
+++ openssh-8.4p1/sshd.c +++ openssh-8.8p1/sshd.c
@@ -1545,6 +1545,10 @@ main(int ac, char **av) @@ -1547,6 +1547,10 @@ main(int ac, char **av)
Authctxt *authctxt; Authctxt *authctxt;
struct connection_info *connection_info = NULL; struct connection_info *connection_info = NULL;

View File

@ -2,15 +2,11 @@
# Parent 0f731d0b541b8a919d24ac91098f560a49712822 # Parent 0f731d0b541b8a919d24ac91098f560a49712822
Suggest command line for removal of offending keys from known_hosts file Suggest command line for removal of offending keys from known_hosts file
diff --git a/openssh-7.7p1/sshconnect.c b/openssh-7.7p1/sshconnect.c Index: openssh-8.8p1/sshconnect.c
--- openssh-7.7p1/sshconnect.c ===================================================================
+++ openssh-7.7p1/sshconnect.c --- openssh-8.8p1.orig/sshconnect.c
@@ -1147,16 +1147,21 @@ check_host_key(char *hostname, struct so +++ openssh-8.8p1/sshconnect.c
} @@ -1270,6 +1270,11 @@ check_host_key(char *hostname, const str
/* The host key has changed. */
warn_changed_key(host_key);
error("Add correct host key in %.100s to get rid of this message.",
user_hostfiles[0]);
error("Offending %s key in %s:%lu", error("Offending %s key in %s:%lu",
sshkey_type(host_found->key), sshkey_type(host_found->key),
host_found->file, host_found->line); host_found->file, host_found->line);
@ -22,8 +18,3 @@ diff --git a/openssh-7.7p1/sshconnect.c b/openssh-7.7p1/sshconnect.c
/* /*
* If strict host key checking is in use, the user will have * If strict host key checking is in use, the user will have
* to edit the key manually and we can only abort.
*/
if (options.strict_host_key_checking !=
SSH_STRICT_HOSTKEY_OFF) {
error("%s host key for %.200s has changed and you have "

View File

@ -3,11 +3,11 @@
# -- uset do be called '-xauthlocalhostname' # -- uset do be called '-xauthlocalhostname'
handle hostname changes when forwarding X handle hostname changes when forwarding X
Index: openssh-8.4p1/session.c Index: openssh-8.8p1/session.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/session.c --- openssh-8.8p1.orig/session.c
+++ openssh-8.4p1/session.c +++ openssh-8.8p1/session.c
@@ -985,7 +985,7 @@ copy_environment(char **source, char *** @@ -981,7 +981,7 @@ copy_environment(char **source, char ***
#endif #endif
static char ** static char **
@ -16,7 +16,7 @@ Index: openssh-8.4p1/session.c
{ {
char buf[256]; char buf[256];
size_t n; size_t n;
@@ -1195,6 +1195,8 @@ do_setup_env(struct ssh *ssh, Session *s @@ -1191,6 +1191,8 @@ do_setup_env(struct ssh *ssh, Session *s
for (i = 0; env[i]; i++) for (i = 0; env[i]; i++)
fprintf(stderr, " %.200s\n", env[i]); fprintf(stderr, " %.200s\n", env[i]);
} }
@ -25,7 +25,7 @@ Index: openssh-8.4p1/session.c
return env; return env;
} }
@@ -1203,7 +1205,7 @@ do_setup_env(struct ssh *ssh, Session *s @@ -1199,7 +1201,7 @@ do_setup_env(struct ssh *ssh, Session *s
* first in this order). * first in this order).
*/ */
static void static void
@ -34,8 +34,8 @@ Index: openssh-8.4p1/session.c
{ {
FILE *f = NULL; FILE *f = NULL;
char *cmd = NULL, *user_rc = NULL; char *cmd = NULL, *user_rc = NULL;
@@ -1260,12 +1262,20 @@ do_rc_files(struct ssh *ssh, Session *s, @@ -1256,12 +1258,20 @@ do_rc_files(struct ssh *ssh, Session *s,
fatal("%s: xasprintf: %s", __func__, strerror(errno)); fatal_f("xasprintf: %s", strerror(errno));
f = popen(cmd, "w"); f = popen(cmd, "w");
if (f) { if (f) {
+ char hostname[MAXHOSTNAMELEN]; + char hostname[MAXHOSTNAMELEN];
@ -55,7 +55,7 @@ Index: openssh-8.4p1/session.c
} else { } else {
fprintf(stderr, "Could not run %s\n", fprintf(stderr, "Could not run %s\n",
cmd); cmd);
@@ -1526,6 +1536,7 @@ do_child(struct ssh *ssh, Session *s, co @@ -1518,6 +1528,7 @@ do_child(struct ssh *ssh, Session *s, co
char **env, *argv[ARGV_MAX], remote_id[512]; char **env, *argv[ARGV_MAX], remote_id[512];
const char *shell, *shell0; const char *shell, *shell0;
struct passwd *pw = s->pw; struct passwd *pw = s->pw;
@ -63,7 +63,7 @@ Index: openssh-8.4p1/session.c
int r = 0; int r = 0;
sshpkt_fmt_connection_id(ssh, remote_id, sizeof(remote_id)); sshpkt_fmt_connection_id(ssh, remote_id, sizeof(remote_id));
@@ -1582,7 +1593,7 @@ do_child(struct ssh *ssh, Session *s, co @@ -1574,7 +1585,7 @@ do_child(struct ssh *ssh, Session *s, co
* Make sure $SHELL points to the shell from the password file, * Make sure $SHELL points to the shell from the password file,
* even if shell is overridden from login.conf * even if shell is overridden from login.conf
*/ */
@ -72,7 +72,7 @@ Index: openssh-8.4p1/session.c
#ifdef HAVE_LOGIN_CAP #ifdef HAVE_LOGIN_CAP
shell = login_getcapstr(lc, "shell", (char *)shell, (char *)shell); shell = login_getcapstr(lc, "shell", (char *)shell, (char *)shell);
@@ -1646,7 +1657,7 @@ do_child(struct ssh *ssh, Session *s, co @@ -1638,7 +1649,7 @@ do_child(struct ssh *ssh, Session *s, co
closefrom(STDERR_FILENO + 1); closefrom(STDERR_FILENO + 1);

View File

@ -10,11 +10,10 @@
# internal versions. ssh-keyconverter consequently fails to link as it lacks # internal versions. ssh-keyconverter consequently fails to link as it lacks
# the proper flags, and libopenbsd-compat doesn't contain the b64_* functions) # the proper flags, and libopenbsd-compat doesn't contain the b64_* functions)
diff --git a/HOWTO.ldap-keys b/HOWTO.ldap-keys Index: openssh-8.8p1/HOWTO.ldap-keys
new file mode 100644 ===================================================================
index 0000000..831d399
--- /dev/null --- /dev/null
+++ b/HOWTO.ldap-keys +++ openssh-8.8p1/HOWTO.ldap-keys
@@ -0,0 +1,108 @@ @@ -0,0 +1,108 @@
+ +
+HOW TO START +HOW TO START
@ -124,11 +123,11 @@ index 0000000..831d399
+ - frederic peters. + - frederic peters.
+ - Finlay dobbie. + - Finlay dobbie.
+ - Stefan Fisher. + - Stefan Fisher.
diff --git a/Makefile.in b/Makefile.in Index: openssh-8.8p1/Makefile.in
index 6010d1c..f54348b 100644 ===================================================================
--- a/Makefile.in --- openssh-8.8p1.orig/Makefile.in
+++ b/Makefile.in +++ openssh-8.8p1/Makefile.in
@@ -25,6 +25,8 @@ SFTP_SERVER=$(libexecdir)/sftp-server @@ -26,6 +26,8 @@ SFTP_SERVER=$(libexecdir)/sftp-server
SSH_KEYSIGN=$(libexecdir)/ssh-keysign SSH_KEYSIGN=$(libexecdir)/ssh-keysign
SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper
@ -137,7 +136,7 @@ index 6010d1c..f54348b 100644
CAVSTEST_CTR=$(libexecdir)/cavstest-ctr CAVSTEST_CTR=$(libexecdir)/cavstest-ctr
CAVSTEST_KDF=$(libexecdir)/cavstest-kdf CAVSTEST_KDF=$(libexecdir)/cavstest-kdf
PRIVSEP_PATH=@PRIVSEP_PATH@ PRIVSEP_PATH=@PRIVSEP_PATH@
@@ -74,6 +76,9 @@ TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keys @@ -73,6 +75,9 @@ TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-a
TARGETS += cavstest-ctr$(EXEEXT) cavstest-kdf$(EXEEXT) TARGETS += cavstest-ctr$(EXEEXT) cavstest-kdf$(EXEEXT)
@ -147,9 +146,9 @@ index 6010d1c..f54348b 100644
XMSS_OBJS=\ XMSS_OBJS=\
ssh-xmss.o \ ssh-xmss.o \
sshkey-xmss.o \ sshkey-xmss.o \
@@ -158,8 +163,8 @@ SFTPSERVER_OBJS=sftp-common.o sftp-server.o sftp-server-main.o @@ -160,8 +165,8 @@ SFTPSERVER_OBJS=sftp-common.o sftp-serve
SFTP_OBJS= sftp.o sftp-client.o sftp-common.o sftp-glob.o progressmeter.o SFTP_OBJS= sftp.o progressmeter.o $(SFTP_CLIENT_OBJS)
-MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out ssh-sk-helper.8.out sshd_config.5.out ssh_config.5.out -MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out ssh-sk-helper.8.out sshd_config.5.out ssh_config.5.out
-MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 ssh-sk-helper.8 sshd_config.5 ssh_config.5 -MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 ssh-sk-helper.8 sshd_config.5 ssh_config.5
@ -158,7 +157,7 @@ index 6010d1c..f54348b 100644
MANTYPE = @MANTYPE@ MANTYPE = @MANTYPE@
CONFIGFILES=sshd_config.out ssh_config.out moduli.out CONFIGFILES=sshd_config.out ssh_config.out moduli.out
@@ -242,6 +247,9 @@ ssh-sk-helper$(EXEEXT): $(LIBCOMPAT) libssh.a $(SKHELPER_OBJS) @@ -244,6 +249,9 @@ ssh-sk-helper$(EXEEXT): $(LIBCOMPAT) lib
ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSCAN_OBJS) ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSCAN_OBJS)
$(LD) -o $@ $(SSHKEYSCAN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS) $(LD) -o $@ $(SSHKEYSCAN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
@ -166,9 +165,9 @@ index 6010d1c..f54348b 100644
+ $(LD) -o $@ ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS) + $(LD) -o $@ ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
+ +
sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a $(SFTPSERVER_OBJS) sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a $(SFTPSERVER_OBJS)
$(LD) -o $@ $(SFTPSERVER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LD) -o $@ $(SFTPSERVER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
@@ -406,6 +414,10 @@ install-files: @@ -416,6 +424,10 @@ install-files:
$(INSTALL) -m 0755 $(STRIP_OPT) sshd$(EXEEXT) $(DESTDIR)$(sbindir)/sshd$(EXEEXT) $(INSTALL) -m 0755 $(STRIP_OPT) sshd$(EXEEXT) $(DESTDIR)$(sbindir)/sshd$(EXEEXT)
$(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign$(EXEEXT) $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT) $(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign$(EXEEXT) $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
$(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT) $(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
@ -179,7 +178,7 @@ index 6010d1c..f54348b 100644
$(INSTALL) -m 0755 $(STRIP_OPT) ssh-sk-helper$(EXEEXT) $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT) $(INSTALL) -m 0755 $(STRIP_OPT) ssh-sk-helper$(EXEEXT) $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT)
$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT) $(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT) $(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
@@ -425,6 +437,10 @@ install-files: @@ -435,6 +447,10 @@ install-files:
$(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8 $(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
$(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8 $(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
$(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8 $(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
@ -190,7 +189,7 @@ index 6010d1c..f54348b 100644
$(INSTALL) -m 644 ssh-sk-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-sk-helper.8 $(INSTALL) -m 644 ssh-sk-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-sk-helper.8
install-sysconf: install-sysconf:
@@ -449,6 +465,13 @@ install-sysconf: @@ -459,6 +475,13 @@ install-sysconf:
else \ else \
echo "$(DESTDIR)$(sysconfdir)/moduli already exists, install will not overwrite"; \ echo "$(DESTDIR)$(sysconfdir)/moduli already exists, install will not overwrite"; \
fi fi
@ -204,7 +203,7 @@ index 6010d1c..f54348b 100644
host-key: ssh-keygen$(EXEEXT) host-key: ssh-keygen$(EXEEXT)
@if [ -z "$(DESTDIR)" ] ; then \ @if [ -z "$(DESTDIR)" ] ; then \
@@ -487,6 +510,8 @@ uninstall: @@ -497,6 +520,8 @@ uninstall:
-rm -f $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT) -rm -f $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
-rm -f $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT) -rm -f $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
-rm -f $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT) -rm -f $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT)
@ -213,7 +212,7 @@ index 6010d1c..f54348b 100644
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1 -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1 -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1 -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
@@ -499,6 +524,7 @@ uninstall: @@ -509,6 +534,7 @@ uninstall:
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8 -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8 -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-sk-helper.8 -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-sk-helper.8
@ -221,11 +220,11 @@ index 6010d1c..f54348b 100644
regress-prep: regress-prep:
$(MKDIR_P) `pwd`/regress/unittests/test_helper $(MKDIR_P) `pwd`/regress/unittests/test_helper
diff --git a/configure.ac b/configure.ac Index: openssh-8.8p1/configure.ac
index 4ddf539..1fd0b17 100644 ===================================================================
--- a/configure.ac --- openssh-8.8p1.orig/configure.ac
+++ b/configure.ac +++ openssh-8.8p1/configure.ac
@@ -1688,6 +1688,106 @@ AC_ARG_WITH([audit], @@ -1758,6 +1758,106 @@ AC_ARG_WITH([audit],
esac ] esac ]
) )
@ -332,11 +331,10 @@ index 4ddf539..1fd0b17 100644
AC_ARG_WITH([pie], AC_ARG_WITH([pie],
[ --with-pie Build Position Independent Executables if possible], [ [ --with-pie Build Position Independent Executables if possible], [
if test "x$withval" = "xno"; then if test "x$withval" = "xno"; then
diff --git a/ldap-helper.c b/ldap-helper.c Index: openssh-8.8p1/ldap-helper.c
new file mode 100644 ===================================================================
index 0000000..0efff1f
--- /dev/null --- /dev/null
+++ b/ldap-helper.c +++ openssh-8.8p1/ldap-helper.c
@@ -0,0 +1,155 @@ @@ -0,0 +1,155 @@
+/* $OpenBSD: ssh-pka-ldap.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */ +/* $OpenBSD: ssh-pka-ldap.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/* +/*
@ -493,11 +491,10 @@ index 0000000..0efff1f
+void *buffer_get_string(struct sshbuf *b, u_int *l) { return NULL; } +void *buffer_get_string(struct sshbuf *b, u_int *l) { return NULL; }
+void buffer_put_string(struct sshbuf *b, const void *f, u_int l) {} +void buffer_put_string(struct sshbuf *b, const void *f, u_int l) {}
+ +
diff --git a/ldap-helper.h b/ldap-helper.h Index: openssh-8.8p1/ldap-helper.h
new file mode 100644 ===================================================================
index 0000000..14cb29a
--- /dev/null --- /dev/null
+++ b/ldap-helper.h +++ openssh-8.8p1/ldap-helper.h
@@ -0,0 +1,32 @@ @@ -0,0 +1,32 @@
+/* $OpenBSD: ldap-helper.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */ +/* $OpenBSD: ldap-helper.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/* +/*
@ -531,11 +528,10 @@ index 0000000..14cb29a
+extern int config_warning_config_file; +extern int config_warning_config_file;
+ +
+#endif /* LDAP_HELPER_H */ +#endif /* LDAP_HELPER_H */
diff --git a/ldap.conf b/ldap.conf Index: openssh-8.8p1/ldap.conf
new file mode 100644 ===================================================================
index 0000000..42e38d3
--- /dev/null --- /dev/null
+++ b/ldap.conf +++ openssh-8.8p1/ldap.conf
@@ -0,0 +1,88 @@ @@ -0,0 +1,88 @@
+# $Id: openssh-5.5p1-ldap.patch,v 1.3 2010/07/07 13:48:36 jfch2222 Exp $ +# $Id: openssh-5.5p1-ldap.patch,v 1.3 2010/07/07 13:48:36 jfch2222 Exp $
+# +#
@ -625,12 +621,11 @@ index 0000000..42e38d3
+#tls_cert +#tls_cert
+#tls_key +#tls_key
+ +
diff --git a/ldapbody.c b/ldapbody.c Index: openssh-8.8p1/ldapbody.c
new file mode 100644 ===================================================================
index 0000000..032cc89
--- /dev/null --- /dev/null
+++ b/ldapbody.c +++ openssh-8.8p1/ldapbody.c
@@ -0,0 +1,494 @@ @@ -0,0 +1,503 @@
+/* $OpenBSD: ldapbody.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */ +/* $OpenBSD: ldapbody.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/* +/*
+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved. + * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
@ -663,8 +658,17 @@ index 0000000..032cc89
+#include "ldapmisc.h" +#include "ldapmisc.h"
+#include "ldapbody.h" +#include "ldapbody.h"
+#include <stdio.h> +#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h> +#include <unistd.h>
+ +
+#ifndef FALSE
+# define FALSE 0
+#endif
+
+#ifndef TRUE
+# define TRUE 1
+#endif
+
+#define LDAPSEARCH_FORMAT "(&(objectclass=posixAccount)(objectclass=ldapPublicKey)(uid=%s)%s)" +#define LDAPSEARCH_FORMAT "(&(objectclass=posixAccount)(objectclass=ldapPublicKey)(uid=%s)%s)"
+#define PUBKEYATTR "sshPublicKey" +#define PUBKEYATTR "sshPublicKey"
+#define LDAP_LOGFILE "%s/ldap.%d" +#define LDAP_LOGFILE "%s/ldap.%d"
@ -1125,11 +1129,10 @@ index 0000000..032cc89
+ return; + return;
+} +}
+ +
diff --git a/ldapbody.h b/ldapbody.h Index: openssh-8.8p1/ldapbody.h
new file mode 100644 ===================================================================
index 0000000..665dca2
--- /dev/null --- /dev/null
+++ b/ldapbody.h +++ openssh-8.8p1/ldapbody.h
@@ -0,0 +1,37 @@ @@ -0,0 +1,37 @@
+/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */ +/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/* +/*
@ -1168,11 +1171,10 @@ index 0000000..665dca2
+ +
+#endif /* LDAPBODY_H */ +#endif /* LDAPBODY_H */
+ +
diff --git a/ldapconf.c b/ldapconf.c Index: openssh-8.8p1/ldapconf.c
new file mode 100644 ===================================================================
index 0000000..2e22438
--- /dev/null --- /dev/null
+++ b/ldapconf.c +++ openssh-8.8p1/ldapconf.c
@@ -0,0 +1,711 @@ @@ -0,0 +1,711 @@
+/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */ +/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/* +/*
@ -1885,11 +1887,10 @@ index 0000000..2e22438
+ dump_cfg_string(lSSH_Filter, options.ssh_filter); + dump_cfg_string(lSSH_Filter, options.ssh_filter);
+} +}
+ +
diff --git a/ldapconf.h b/ldapconf.h Index: openssh-8.8p1/ldapconf.h
new file mode 100644 ===================================================================
index 0000000..c2aa704
--- /dev/null --- /dev/null
+++ b/ldapconf.h +++ openssh-8.8p1/ldapconf.h
@@ -0,0 +1,71 @@ @@ -0,0 +1,71 @@
+/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */ +/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/* +/*
@ -1962,11 +1963,10 @@ index 0000000..c2aa704
+void dump_config(void); +void dump_config(void);
+ +
+#endif /* LDAPCONF_H */ +#endif /* LDAPCONF_H */
diff --git a/ldapincludes.h b/ldapincludes.h Index: openssh-8.8p1/ldapincludes.h
new file mode 100644 ===================================================================
index 0000000..8539bdc
--- /dev/null --- /dev/null
+++ b/ldapincludes.h +++ openssh-8.8p1/ldapincludes.h
@@ -0,0 +1,41 @@ @@ -0,0 +1,41 @@
+/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */ +/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/* +/*
@ -2009,11 +2009,10 @@ index 0000000..8539bdc
+#endif +#endif
+ +
+#endif /* LDAPINCLUDES_H */ +#endif /* LDAPINCLUDES_H */
diff --git a/ldapmisc.c b/ldapmisc.c Index: openssh-8.8p1/ldapmisc.c
new file mode 100644 ===================================================================
index 0000000..de23c0c
--- /dev/null --- /dev/null
+++ b/ldapmisc.c +++ openssh-8.8p1/ldapmisc.c
@@ -0,0 +1,79 @@ @@ -0,0 +1,79 @@
+ +
+#include "ldapincludes.h" +#include "ldapincludes.h"
@ -2094,11 +2093,10 @@ index 0000000..de23c0c
+} +}
+#endif +#endif
+ +
diff --git a/ldapmisc.h b/ldapmisc.h Index: openssh-8.8p1/ldapmisc.h
new file mode 100644 ===================================================================
index 0000000..4c271df
--- /dev/null --- /dev/null
+++ b/ldapmisc.h +++ openssh-8.8p1/ldapmisc.h
@@ -0,0 +1,35 @@ @@ -0,0 +1,35 @@
+/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */ +/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/* +/*
@ -2135,10 +2133,10 @@ index 0000000..4c271df
+ +
+#endif /* LDAPMISC_H */ +#endif /* LDAPMISC_H */
+ +
diff --git a/openbsd-compat/base64.c b/openbsd-compat/base64.c Index: openssh-8.8p1/openbsd-compat/base64.c
index 9e74667..14824be 100644 ===================================================================
--- a/openbsd-compat/base64.c --- openssh-8.8p1.orig/openbsd-compat/base64.c
+++ b/openbsd-compat/base64.c +++ openssh-8.8p1/openbsd-compat/base64.c
@@ -46,7 +46,7 @@ @@ -46,7 +46,7 @@
#include "includes.h" #include "includes.h"
@ -2157,7 +2155,7 @@ index 9e74667..14824be 100644
int int
b64_ntop(u_char const *src, size_t srclength, char *target, size_t targsize) b64_ntop(u_char const *src, size_t srclength, char *target, size_t targsize)
{ {
@@ -185,7 +185,7 @@ b64_ntop(u_char const *src, size_t srclength, char *target, size_t targsize) @@ -185,7 +185,7 @@ b64_ntop(u_char const *src, size_t srcle
} }
#endif /* !defined(HAVE_B64_NTOP) && !defined(HAVE___B64_NTOP) */ #endif /* !defined(HAVE_B64_NTOP) && !defined(HAVE___B64_NTOP) */
@ -2166,10 +2164,10 @@ index 9e74667..14824be 100644
/* skips all whitespace anywhere. /* skips all whitespace anywhere.
converts characters, four at a time, starting at (or after) converts characters, four at a time, starting at (or after)
diff --git a/openbsd-compat/base64.h b/openbsd-compat/base64.h Index: openssh-8.8p1/openbsd-compat/base64.h
index bd77293..e27df9a 100644 ===================================================================
--- a/openbsd-compat/base64.h --- openssh-8.8p1.orig/openbsd-compat/base64.h
+++ b/openbsd-compat/base64.h +++ openssh-8.8p1/openbsd-compat/base64.h
@@ -45,16 +45,16 @@ @@ -45,16 +45,16 @@
#include "includes.h" #include "includes.h"
@ -2191,11 +2189,10 @@ index bd77293..e27df9a 100644
int b64_pton(char const *src, u_char *target, size_t targsize); int b64_pton(char const *src, u_char *target, size_t targsize);
# endif /* !HAVE_B64_PTON */ # endif /* !HAVE_B64_PTON */
# define __b64_pton(a,b,c) b64_pton(a,b,c) # define __b64_pton(a,b,c) b64_pton(a,b,c)
diff --git a/openssh-lpk-openldap.schema b/openssh-lpk-openldap.schema Index: openssh-8.8p1/openssh-lpk-openldap.schema
new file mode 100644 ===================================================================
index 0000000..c84f90f
--- /dev/null --- /dev/null
+++ b/openssh-lpk-openldap.schema +++ openssh-8.8p1/openssh-lpk-openldap.schema
@@ -0,0 +1,21 @@ @@ -0,0 +1,21 @@
+# +#
+# LDAP Public Key Patch schema for use with openssh-ldappubkey +# LDAP Public Key Patch schema for use with openssh-ldappubkey
@ -2218,11 +2215,10 @@ index 0000000..c84f90f
+ DESC 'MANDATORY: OpenSSH LPK objectclass' + DESC 'MANDATORY: OpenSSH LPK objectclass'
+ MUST ( sshPublicKey $ uid ) + MUST ( sshPublicKey $ uid )
+ ) + )
diff --git a/openssh-lpk-sun.schema b/openssh-lpk-sun.schema Index: openssh-8.8p1/openssh-lpk-sun.schema
new file mode 100644 ===================================================================
index 0000000..3136673
--- /dev/null --- /dev/null
+++ b/openssh-lpk-sun.schema +++ openssh-8.8p1/openssh-lpk-sun.schema
@@ -0,0 +1,23 @@ @@ -0,0 +1,23 @@
+# +#
+# LDAP Public Key Patch schema for use with openssh-ldappubkey +# LDAP Public Key Patch schema for use with openssh-ldappubkey
@ -2247,11 +2243,10 @@ index 0000000..3136673
+ DESC 'MANDATORY: OpenSSH LPK objectclass' + DESC 'MANDATORY: OpenSSH LPK objectclass'
+ MUST ( sshPublicKey $ uid ) + MUST ( sshPublicKey $ uid )
+ ) + )
diff --git a/ssh-ldap-helper.8 b/ssh-ldap-helper.8 Index: openssh-8.8p1/ssh-ldap-helper.8
new file mode 100644 ===================================================================
index 0000000..f8440e4
--- /dev/null --- /dev/null
+++ b/ssh-ldap-helper.8 +++ openssh-8.8p1/ssh-ldap-helper.8
@@ -0,0 +1,79 @@ @@ -0,0 +1,79 @@
+.\" $OpenBSD: ssh-ldap-helper.8,v 1.1 2010/02/10 23:20:38 markus Exp $ +.\" $OpenBSD: ssh-ldap-helper.8,v 1.1 2010/02/10 23:20:38 markus Exp $
+.\" +.\"
@ -2332,21 +2327,19 @@ index 0000000..f8440e4
+OpenSSH 5.5 + PKA-LDAP . +OpenSSH 5.5 + PKA-LDAP .
+.Sh AUTHORS +.Sh AUTHORS
+.An Jan F. Chadima Aq jchadima@redhat.com +.An Jan F. Chadima Aq jchadima@redhat.com
diff --git a/ssh-ldap-wrapper b/ssh-ldap-wrapper Index: openssh-8.8p1/ssh-ldap-wrapper
new file mode 100644 ===================================================================
index 0000000..9fdfc37
--- /dev/null --- /dev/null
+++ b/ssh-ldap-wrapper +++ openssh-8.8p1/ssh-ldap-wrapper
@@ -0,0 +1,4 @@ @@ -0,0 +1,4 @@
+#!/bin/sh +#!/bin/sh
+ +
+exec @LIBEXECDIR@/ssh-ldap-helper -s "$1" +exec @LIBEXECDIR@/ssh-ldap-helper -s "$1"
+ +
diff --git a/ssh-ldap.conf.5 b/ssh-ldap.conf.5 Index: openssh-8.8p1/ssh-ldap.conf.5
new file mode 100644 ===================================================================
index 0000000..15eb03d
--- /dev/null --- /dev/null
+++ b/ssh-ldap.conf.5 +++ openssh-8.8p1/ssh-ldap.conf.5
@@ -0,0 +1,376 @@ @@ -0,0 +1,376 @@
+.\" $OpenBSD: ssh-ldap.conf.5,v 1.1 2010/02/10 23:20:38 markus Exp $ +.\" $OpenBSD: ssh-ldap.conf.5,v 1.1 2010/02/10 23:20:38 markus Exp $
+.\" +.\"

View File

@ -2,11 +2,11 @@
# Parent bad0c8b3b8d72abb6960ed85b57ee42352371738 # Parent bad0c8b3b8d72abb6960ed85b57ee42352371738
Do not write a PID file when not daemonizing (e.g. when running from systemd) Do not write a PID file when not daemonizing (e.g. when running from systemd)
diff --git a/sshd.c b/sshd.c Index: openssh-8.8p1/sshd.c
index f3ccc3a..eadc1b3 100644 ===================================================================
--- a/sshd.c --- openssh-8.8p1.orig/sshd.c
+++ b/sshd.c +++ openssh-8.8p1/sshd.c
@@ -2076,7 +2076,7 @@ main(int ac, char **av) @@ -2129,7 +2129,7 @@ main(int ac, char **av)
* Write out the pid file after the sigterm handler * Write out the pid file after the sigterm handler
* is setup and the listen sockets are bound * is setup and the listen sockets are bound
*/ */

View File

@ -5,10 +5,10 @@ UsePAM is used
bnc#708678, FATE#312033 bnc#708678, FATE#312033
Index: openssh-8.4p1/auth.c Index: openssh-8.8p1/auth.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/auth.c --- openssh-8.8p1.orig/auth.c
+++ openssh-8.4p1/auth.c +++ openssh-8.8p1/auth.c
@@ -113,7 +113,7 @@ allowed_user(struct ssh *ssh, struct pas @@ -113,7 +113,7 @@ allowed_user(struct ssh *ssh, struct pas
return 0; return 0;
@ -27,10 +27,10 @@ Index: openssh-8.4p1/auth.c
int locked = 0; int locked = 0;
#ifdef LOCKED_PASSWD_STRING #ifdef LOCKED_PASSWD_STRING
Index: openssh-8.4p1/servconf.c Index: openssh-8.8p1/servconf.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/servconf.c --- openssh-8.8p1.orig/servconf.c
+++ openssh-8.4p1/servconf.c +++ openssh-8.8p1/servconf.c
@@ -92,6 +92,7 @@ initialize_server_options(ServerOptions @@ -92,6 +92,7 @@ initialize_server_options(ServerOptions
/* Portable-specific options */ /* Portable-specific options */
@ -39,7 +39,7 @@ Index: openssh-8.4p1/servconf.c
/* Standard Options */ /* Standard Options */
options->num_ports = 0; options->num_ports = 0;
@@ -300,6 +301,8 @@ fill_default_server_options(ServerOption @@ -278,6 +279,8 @@ fill_default_server_options(ServerOption
/* Portable-specific options */ /* Portable-specific options */
if (options->use_pam == -1) if (options->use_pam == -1)
options->use_pam = 0; options->use_pam = 0;
@ -48,7 +48,7 @@ Index: openssh-8.4p1/servconf.c
/* Standard Options */ /* Standard Options */
if (options->num_host_key_files == 0) { if (options->num_host_key_files == 0) {
@@ -501,7 +504,7 @@ fill_default_server_options(ServerOption @@ -485,7 +488,7 @@ fill_default_server_options(ServerOption
typedef enum { typedef enum {
sBadOption, /* == unknown option */ sBadOption, /* == unknown option */
/* Portable-specific options */ /* Portable-specific options */
@ -56,8 +56,8 @@ Index: openssh-8.4p1/servconf.c
+ sUsePAM, sUsePAMChecklocks, + sUsePAM, sUsePAMChecklocks,
/* Standard Options */ /* Standard Options */
sPort, sHostKeyFile, sLoginGraceTime, sPort, sHostKeyFile, sLoginGraceTime,
sPermitRootLogin, sLogFacility, sLogLevel, sPermitRootLogin, sLogFacility, sLogLevel, sLogVerbose,
@@ -553,8 +556,10 @@ static struct { @@ -535,8 +538,10 @@ static struct {
/* Portable-specific options */ /* Portable-specific options */
#ifdef USE_PAM #ifdef USE_PAM
{ "usepam", sUsePAM, SSHCFG_GLOBAL }, { "usepam", sUsePAM, SSHCFG_GLOBAL },
@ -68,7 +68,7 @@ Index: openssh-8.4p1/servconf.c
#endif #endif
{ "pamauthenticationviakbdint", sDeprecated, SSHCFG_GLOBAL }, { "pamauthenticationviakbdint", sDeprecated, SSHCFG_GLOBAL },
/* Standard Options */ /* Standard Options */
@@ -1318,6 +1323,9 @@ process_server_config_line_depth(ServerO @@ -1331,6 +1336,9 @@ process_server_config_line_depth(ServerO
case sUsePAM: case sUsePAM:
intptr = &options->use_pam; intptr = &options->use_pam;
goto parse_flag; goto parse_flag;
@ -78,11 +78,11 @@ Index: openssh-8.4p1/servconf.c
/* Standard Options */ /* Standard Options */
case sBadOption: case sBadOption:
Index: openssh-8.4p1/servconf.h Index: openssh-8.8p1/servconf.h
=================================================================== ===================================================================
--- openssh-8.4p1.orig/servconf.h --- openssh-8.8p1.orig/servconf.h
+++ openssh-8.4p1/servconf.h +++ openssh-8.8p1/servconf.h
@@ -195,6 +195,7 @@ typedef struct { @@ -200,6 +200,7 @@ typedef struct {
char *adm_forced_command; char *adm_forced_command;
int use_pam; /* Enable auth via PAM */ int use_pam; /* Enable auth via PAM */
@ -90,11 +90,11 @@ Index: openssh-8.4p1/servconf.h
int permit_tun; int permit_tun;
Index: openssh-8.4p1/sshd_config.0 Index: openssh-8.8p1/sshd_config.0
=================================================================== ===================================================================
--- openssh-8.4p1.orig/sshd_config.0 --- openssh-8.8p1.orig/sshd_config.0
+++ openssh-8.4p1/sshd_config.0 +++ openssh-8.8p1/sshd_config.0
@@ -1032,6 +1032,14 @@ DESCRIPTION @@ -1074,6 +1074,14 @@ DESCRIPTION
If UsePAM is enabled, you will not be able to run sshd(8) as a If UsePAM is enabled, you will not be able to run sshd(8) as a
non-root user. The default is no. non-root user. The default is no.
@ -109,11 +109,11 @@ Index: openssh-8.4p1/sshd_config.0
VersionAddendum VersionAddendum
Optionally specifies additional text to append to the SSH Optionally specifies additional text to append to the SSH
protocol banner sent by the server upon connection. The default protocol banner sent by the server upon connection. The default
Index: openssh-8.4p1/sshd_config.5 Index: openssh-8.8p1/sshd_config.5
=================================================================== ===================================================================
--- openssh-8.4p1.orig/sshd_config.5 --- openssh-8.8p1.orig/sshd_config.5
+++ openssh-8.4p1/sshd_config.5 +++ openssh-8.8p1/sshd_config.5
@@ -1718,6 +1718,18 @@ is enabled, you will not be able to run @@ -1775,6 +1775,18 @@ is enabled, you will not be able to run
as a non-root user. as a non-root user.
The default is The default is
.Cm no . .Cm no .

View File

@ -4,15 +4,11 @@
# formats in ?tmp? files) # formats in ?tmp? files)
# --used to be called '-pts' # --used to be called '-pts'
diff --git a/openssh-7.7p1/loginrec.c b/openssh-7.7p1/loginrec.c Index: openssh-8.8p1/loginrec.c
--- openssh-7.7p1/loginrec.c ===================================================================
+++ openssh-7.7p1/loginrec.c --- openssh-8.8p1.orig/loginrec.c
@@ -541,17 +541,17 @@ getlast_entry(struct logininfo *li) +++ openssh-8.8p1/loginrec.c
/* @@ -549,7 +549,7 @@ getlast_entry(struct logininfo *li)
* 'line' string utility functions
*
* These functions process the 'line' string into one of three forms:
*
* 1. The full filename (including '/dev') * 1. The full filename (including '/dev')
* 2. The stripped name (excluding '/dev') * 2. The stripped name (excluding '/dev')
* 3. The abbreviated name (e.g. /dev/ttyp00 -> yp00 * 3. The abbreviated name (e.g. /dev/ttyp00 -> yp00
@ -21,17 +17,7 @@ diff --git a/openssh-7.7p1/loginrec.c b/openssh-7.7p1/loginrec.c
* *
* Form 3 is used on some systems to identify a .tmp.? entry when * Form 3 is used on some systems to identify a .tmp.? entry when
* attempting to remove it. Typically both addition and removal is * attempting to remove it. Typically both addition and removal is
* performed by one application - say, sshd - so as long as the choice @@ -610,6 +610,10 @@ line_abbrevname(char *dst, const char *s
* uniquely identifies a terminal it's ok.
*/
@@ -602,16 +602,20 @@ line_abbrevname(char *dst, const char *s
/* Always skip prefix if present */
if (strncmp(src, "/dev/", 5) == 0)
src += 5;
#ifdef WITH_ABBREV_NO_TTY
if (strncmp(src, "tty", 3) == 0) if (strncmp(src, "tty", 3) == 0)
src += 3; src += 3;
#endif #endif
@ -42,8 +28,3 @@ diff --git a/openssh-7.7p1/loginrec.c b/openssh-7.7p1/loginrec.c
len = strlen(src); len = strlen(src);
if (len > 0) {
if (((int)len - dstsize) > 0)
src += ((int)len - dstsize);
/* note: _don't_ change this to strlcpy */

View File

@ -5,15 +5,11 @@ try to remove xauth cookies on logout
bnc#98815 bnc#98815
diff --git a/openssh-7.7p1/session.c b/openssh-7.7p1/session.c Index: openssh-8.8p1/session.c
--- openssh-7.7p1/session.c ===================================================================
+++ openssh-7.7p1/session.c --- openssh-8.8p1.orig/session.c
@@ -2302,16 +2302,44 @@ session_close(struct ssh *ssh, Session * +++ openssh-8.8p1/session.c
u_int i; @@ -2441,6 +2441,34 @@ session_close(struct ssh *ssh, Session *
verbose("Close session: user %s from %.200s port %d id %d",
s->pw->pw_name,
ssh_remote_ipaddr(ssh),
ssh_remote_port(ssh), ssh_remote_port(ssh),
s->self); s->self);
@ -48,8 +44,3 @@ diff --git a/openssh-7.7p1/session.c b/openssh-7.7p1/session.c
if (s->ttyfd != -1) if (s->ttyfd != -1)
session_pty_cleanup(s); session_pty_cleanup(s);
free(s->term); free(s->term);
free(s->display);
free(s->x11_chanids);
free(s->auth_display);
free(s->auth_data);
free(s->auth_proto);

View File

@ -15,11 +15,11 @@ this is only need on s390 architecture.
Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com> Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
Index: openssh-7.9p1/sandbox-seccomp-filter.c Index: openssh-8.8p1/sandbox-seccomp-filter.c
=================================================================== ===================================================================
--- openssh-7.9p1.orig/sandbox-seccomp-filter.c --- openssh-8.8p1.orig/sandbox-seccomp-filter.c
+++ openssh-7.9p1/sandbox-seccomp-filter.c +++ openssh-8.8p1/sandbox-seccomp-filter.c
@@ -175,6 +175,9 @@ static const struct sock_filter preauth_ @@ -219,6 +219,9 @@ static const struct sock_filter preauth_
#ifdef __NR_geteuid32 #ifdef __NR_geteuid32
SC_ALLOW(__NR_geteuid32), SC_ALLOW(__NR_geteuid32),
#endif #endif
@ -29,7 +29,7 @@ Index: openssh-7.9p1/sandbox-seccomp-filter.c
#ifdef __NR_getpgid #ifdef __NR_getpgid
SC_ALLOW(__NR_getpgid), SC_ALLOW(__NR_getpgid),
#endif #endif
@@ -193,6 +196,9 @@ static const struct sock_filter preauth_ @@ -237,6 +240,9 @@ static const struct sock_filter preauth_
#ifdef __NR_getuid32 #ifdef __NR_getuid32
SC_ALLOW(__NR_getuid32), SC_ALLOW(__NR_getuid32),
#endif #endif

View File

@ -5,15 +5,11 @@ Allow the stat() syscall for OpenSSL re-seed patch
bnc#912436 bnc#912436
diff --git a/openssh-7.7p1/sandbox-seccomp-filter.c b/openssh-7.7p1/sandbox-seccomp-filter.c Index: openssh-8.8p1/sandbox-seccomp-filter.c
--- openssh-7.7p1/sandbox-seccomp-filter.c ===================================================================
+++ openssh-7.7p1/sandbox-seccomp-filter.c --- openssh-8.8p1.orig/sandbox-seccomp-filter.c
@@ -224,16 +224,19 @@ static const struct sock_filter preauth_ +++ openssh-8.8p1/sandbox-seccomp-filter.c
SC_ALLOW(__NR_select), @@ -294,6 +294,9 @@ static const struct sock_filter preauth_
#endif
#ifdef __NR_shutdown
SC_ALLOW(__NR_shutdown),
#endif
#ifdef __NR_sigprocmask #ifdef __NR_sigprocmask
SC_ALLOW(__NR_sigprocmask), SC_ALLOW(__NR_sigprocmask),
#endif #endif
@ -23,8 +19,3 @@ diff --git a/openssh-7.7p1/sandbox-seccomp-filter.c b/openssh-7.7p1/sandbox-secc
#ifdef __NR_time #ifdef __NR_time
SC_ALLOW(__NR_time), SC_ALLOW(__NR_time),
#endif #endif
#ifdef __NR_write
SC_ALLOW(__NR_write),
#endif
#ifdef __NR_socketcall
SC_ALLOW_ARG(__NR_socketcall, 0, SYS_SHUTDOWN),

View File

@ -3,15 +3,11 @@
send locales in default configuration send locales in default configuration
bnc#65747 bnc#65747
diff --git a/openssh-7.7p1/ssh_config b/openssh-7.7p1/ssh_config Index: openssh-8.8p1/ssh_config
--- openssh-7.7p1/ssh_config ===================================================================
+++ openssh-7.7p1/ssh_config --- openssh-8.8p1.orig/ssh_config
@@ -26,16 +26,21 @@ Host * +++ openssh-8.8p1/ssh_config
# security reasons: Someone stealing the authentification data on the @@ -31,6 +31,11 @@ Host *
# remote side (the "spoofed" X-server by the remote sshd) can read your
# keystrokes as you type, just like any other X11 client could do.
# Set this to "no" here for global effect or in your own ~/.ssh/config
# file if you want to have the remote X11 authentification data to
# expire after twenty minutes after remote login. # expire after twenty minutes after remote login.
ForwardX11Trusted yes ForwardX11Trusted yes
@ -23,20 +19,11 @@ diff --git a/openssh-7.7p1/ssh_config b/openssh-7.7p1/ssh_config
# PasswordAuthentication yes # PasswordAuthentication yes
# HostbasedAuthentication no # HostbasedAuthentication no
# GSSAPIAuthentication no # GSSAPIAuthentication no
# GSSAPIDelegateCredentials no Index: openssh-8.8p1/sshd_config
# BatchMode no ===================================================================
# CheckHostIP yes --- openssh-8.8p1.orig/sshd_config
# AddressFamily any +++ openssh-8.8p1/sshd_config
# ConnectTimeout 0 @@ -108,6 +108,11 @@ X11Forwarding yes
diff --git a/openssh-7.7p1/sshd_config b/openssh-7.7p1/sshd_config
--- openssh-7.7p1/sshd_config
+++ openssh-7.7p1/sshd_config
@@ -104,14 +104,19 @@ X11Forwarding yes
#VersionAddendum none
# no default banner path
#Banner none
# override default of no subsystems # override default of no subsystems
Subsystem sftp /usr/libexec/sftp-server Subsystem sftp /usr/libexec/sftp-server
@ -48,6 +35,3 @@ diff --git a/openssh-7.7p1/sshd_config b/openssh-7.7p1/sshd_config
# Example of overriding settings on a per-user basis # Example of overriding settings on a per-user basis
#Match User anoncvs #Match User anoncvs
# X11Forwarding no # X11Forwarding no
# AllowTcpForwarding no
# PermitTTY no
# ForceCommand cvs server

View File

@ -1,7 +1,7 @@
Index: openssh-8.4p1/sftp-server.8 Index: openssh-8.8p1/sftp-server.8
=================================================================== ===================================================================
--- openssh-8.4p1.orig/sftp-server.8 --- openssh-8.8p1.orig/sftp-server.8
+++ openssh-8.4p1/sftp-server.8 +++ openssh-8.8p1/sftp-server.8
@@ -38,6 +38,7 @@ @@ -38,6 +38,7 @@
.Op Fl P Ar denied_requests .Op Fl P Ar denied_requests
.Op Fl p Ar allowed_requests .Op Fl p Ar allowed_requests
@ -21,11 +21,11 @@ Index: openssh-8.4p1/sftp-server.8
.El .El
.Pp .Pp
On some systems, On some systems,
Index: openssh-8.4p1/sftp-server.c Index: openssh-8.8p1/sftp-server.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/sftp-server.c --- openssh-8.8p1.orig/sftp-server.c
+++ openssh-8.4p1/sftp-server.c +++ openssh-8.8p1/sftp-server.c
@@ -69,6 +69,10 @@ struct sshbuf *oqueue; @@ -73,6 +73,10 @@ struct sshbuf *oqueue;
/* Version of client */ /* Version of client */
static u_int version; static u_int version;
@ -36,7 +36,7 @@ Index: openssh-8.4p1/sftp-server.c
/* SSH2_FXP_INIT received */ /* SSH2_FXP_INIT received */
static int init_done; static int init_done;
@@ -687,6 +691,7 @@ process_open(u_int32_t id) @@ -724,6 +728,7 @@ process_open(u_int32_t id)
Attrib a; Attrib a;
char *name; char *name;
int r, handle, fd, flags, mode, status = SSH2_FX_FAILURE; int r, handle, fd, flags, mode, status = SSH2_FX_FAILURE;
@ -44,7 +44,7 @@ Index: openssh-8.4p1/sftp-server.c
if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 || if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 ||
(r = sshbuf_get_u32(iqueue, &pflags)) != 0 || /* portable flags */ (r = sshbuf_get_u32(iqueue, &pflags)) != 0 || /* portable flags */
@@ -696,6 +701,10 @@ process_open(u_int32_t id) @@ -733,6 +738,10 @@ process_open(u_int32_t id)
debug3("request %u: open flags %d", id, pflags); debug3("request %u: open flags %d", id, pflags);
flags = flags_from_portable(pflags); flags = flags_from_portable(pflags);
mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? a.perm : 0666; mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? a.perm : 0666;
@ -55,7 +55,7 @@ Index: openssh-8.4p1/sftp-server.c
logit("open \"%s\" flags %s mode 0%o", logit("open \"%s\" flags %s mode 0%o",
name, string_from_portable(pflags), mode); name, string_from_portable(pflags), mode);
if (readonly && if (readonly &&
@@ -717,6 +726,8 @@ process_open(u_int32_t id) @@ -754,6 +763,8 @@ process_open(u_int32_t id)
} }
} }
} }
@ -64,7 +64,7 @@ Index: openssh-8.4p1/sftp-server.c
if (status != SSH2_FX_OK) if (status != SSH2_FX_OK)
send_status(id, status); send_status(id, status);
free(name); free(name);
@@ -1131,6 +1142,7 @@ process_mkdir(u_int32_t id) @@ -1183,6 +1194,7 @@ process_mkdir(u_int32_t id)
Attrib a; Attrib a;
char *name; char *name;
int r, mode, status = SSH2_FX_FAILURE; int r, mode, status = SSH2_FX_FAILURE;
@ -72,7 +72,7 @@ Index: openssh-8.4p1/sftp-server.c
if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 || if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 ||
(r = decode_attrib(iqueue, &a)) != 0) (r = decode_attrib(iqueue, &a)) != 0)
@@ -1138,9 +1150,16 @@ process_mkdir(u_int32_t id) @@ -1190,9 +1202,16 @@ process_mkdir(u_int32_t id)
mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ?
a.perm & 07777 : 0777; a.perm & 07777 : 0777;
@ -89,7 +89,7 @@ Index: openssh-8.4p1/sftp-server.c
status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK; status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
send_status(id, status); send_status(id, status);
free(name); free(name);
@@ -1560,7 +1579,7 @@ sftp_server_usage(void) @@ -1700,7 +1719,7 @@ sftp_server_usage(void)
fprintf(stderr, fprintf(stderr,
"usage: %s [-ehR] [-d start_directory] [-f log_facility] " "usage: %s [-ehR] [-d start_directory] [-f log_facility] "
"[-l log_level]\n\t[-P denied_requests] " "[-l log_level]\n\t[-P denied_requests] "
@ -98,7 +98,7 @@ Index: openssh-8.4p1/sftp-server.c
" %s -Q protocol_feature\n", " %s -Q protocol_feature\n",
__progname, __progname); __progname, __progname);
exit(1); exit(1);
@@ -1588,7 +1607,7 @@ sftp_server_main(int argc, char **argv, @@ -1728,7 +1747,7 @@ sftp_server_main(int argc, char **argv,
pw = pwcopy(user_pw); pw = pwcopy(user_pw);
while (!skipargs && (ch = getopt(argc, argv, while (!skipargs && (ch = getopt(argc, argv,
@ -107,7 +107,7 @@ Index: openssh-8.4p1/sftp-server.c
switch (ch) { switch (ch) {
case 'Q': case 'Q':
if (strcasecmp(optarg, "requests") != 0) { if (strcasecmp(optarg, "requests") != 0) {
@@ -1650,6 +1669,15 @@ sftp_server_main(int argc, char **argv, @@ -1790,6 +1809,15 @@ sftp_server_main(int argc, char **argv,
fatal("Invalid umask \"%s\"", optarg); fatal("Invalid umask \"%s\"", optarg);
(void)umask((mode_t)mask); (void)umask((mode_t)mask);
break; break;

View File

@ -2,10 +2,10 @@
# Parent 60bdbe6dd8d6bc011883472363d56e1d97f68835 # Parent 60bdbe6dd8d6bc011883472363d56e1d97f68835
Put back sftp client diagnostic messages in batch mode Put back sftp client diagnostic messages in batch mode
Index: openssh-8.4p1/sftp.1 Index: openssh-8.8p1/sftp.1
=================================================================== ===================================================================
--- openssh-8.4p1.orig/sftp.1 --- openssh-8.8p1.orig/sftp.1
+++ openssh-8.4p1/sftp.1 +++ openssh-8.8p1/sftp.1
@@ -287,6 +287,9 @@ Specifies the port to connect to on the @@ -287,6 +287,9 @@ Specifies the port to connect to on the
.It Fl p .It Fl p
Preserves modification times, access times, and modes from the Preserves modification times, access times, and modes from the
@ -16,12 +16,12 @@ Index: openssh-8.4p1/sftp.1
.It Fl q .It Fl q
Quiet mode: disables the progress meter as well as warning and Quiet mode: disables the progress meter as well as warning and
diagnostic messages from diagnostic messages from
Index: openssh-8.4p1/sftp.c Index: openssh-8.8p1/sftp.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/sftp.c --- openssh-8.8p1.orig/sftp.c
+++ openssh-8.4p1/sftp.c +++ openssh-8.8p1/sftp.c
@@ -85,6 +85,9 @@ static volatile pid_t sshpid = -1; @@ -82,6 +82,9 @@ static volatile pid_t sshpid = -1;
/* Suppress diagnositic messages */ /* Suppress diagnostic messages */
int quiet = 0; int quiet = 0;
+/* Force diagnositic messages in batch mode */ +/* Force diagnositic messages in batch mode */
@ -30,7 +30,7 @@ Index: openssh-8.4p1/sftp.c
/* This is set to 0 if the progressmeter is not desired. */ /* This is set to 0 if the progressmeter is not desired. */
int showprogress = 1; int showprogress = 1;
@@ -2408,7 +2411,7 @@ main(int argc, char **argv) @@ -2381,7 +2384,7 @@ main(int argc, char **argv)
infile = stdin; infile = stdin;
while ((ch = getopt(argc, argv, while ((ch = getopt(argc, argv,
@ -39,7 +39,7 @@ Index: openssh-8.4p1/sftp.c
switch (ch) { switch (ch) {
/* Passed through to ssh(1) */ /* Passed through to ssh(1) */
case 'A': case 'A':
@@ -2426,6 +2429,9 @@ main(int argc, char **argv) @@ -2399,6 +2402,9 @@ main(int argc, char **argv)
addargs(&args, "-%c", ch); addargs(&args, "-%c", ch);
addargs(&args, "%s", optarg); addargs(&args, "%s", optarg);
break; break;
@ -49,7 +49,7 @@ Index: openssh-8.4p1/sftp.c
case 'q': case 'q':
ll = SYSLOG_LEVEL_ERROR; ll = SYSLOG_LEVEL_ERROR;
quiet = 1; quiet = 1;
@@ -2510,6 +2516,8 @@ main(int argc, char **argv) @@ -2483,6 +2489,8 @@ main(int argc, char **argv)
usage(); usage();
} }
} }

View File

@ -3,11 +3,11 @@
Send signals to systemd to prevent various race conditions Send signals to systemd to prevent various race conditions
bsc#1048367 bsc#1048367
Index: openssh-7.8p1/configure.ac Index: openssh-8.8p1/configure.ac
=================================================================== ===================================================================
--- openssh-7.8p1.orig/configure.ac --- openssh-8.8p1.orig/configure.ac
+++ openssh-7.8p1/configure.ac +++ openssh-8.8p1/configure.ac
@@ -4378,6 +4378,30 @@ AC_ARG_WITH([kerberos5], @@ -4751,6 +4751,30 @@ AC_ARG_WITH([kerberos5],
AC_SUBST([GSSLIBS]) AC_SUBST([GSSLIBS])
AC_SUBST([K5LIBS]) AC_SUBST([K5LIBS])
@ -38,7 +38,7 @@ Index: openssh-7.8p1/configure.ac
# Looking for programs, paths and files # Looking for programs, paths and files
PRIVSEP_PATH=/var/empty PRIVSEP_PATH=/var/empty
@@ -5183,6 +5207,7 @@ echo " libldns support @@ -5564,6 +5588,7 @@ echo " libldns support
echo " Solaris process contract support: $SPC_MSG" echo " Solaris process contract support: $SPC_MSG"
echo " Solaris project support: $SP_MSG" echo " Solaris project support: $SP_MSG"
echo " Solaris privilege support: $SPP_MSG" echo " Solaris privilege support: $SPP_MSG"
@ -46,11 +46,11 @@ Index: openssh-7.8p1/configure.ac
echo " IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG" echo " IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
echo " Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG" echo " Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
echo " BSD Auth support: $BSD_AUTH_MSG" echo " BSD Auth support: $BSD_AUTH_MSG"
Index: openssh-7.8p1/sshd.c Index: openssh-8.8p1/sshd.c
=================================================================== ===================================================================
--- openssh-7.8p1.orig/sshd.c --- openssh-8.8p1.orig/sshd.c
+++ openssh-7.8p1/sshd.c +++ openssh-8.8p1/sshd.c
@@ -87,6 +87,10 @@ @@ -85,6 +85,10 @@
#include <prot.h> #include <prot.h>
#endif #endif
@ -72,7 +72,7 @@ Index: openssh-7.8p1/sshd.c
logit("Received SIGHUP; restarting."); logit("Received SIGHUP; restarting.");
if (options.pid_file != NULL) if (options.pid_file != NULL)
unlink(options.pid_file); unlink(options.pid_file);
@@ -1995,6 +2003,11 @@ main(int ac, char **av) @@ -2076,6 +2084,11 @@ main(int ac, char **av)
} }
} }

View File

@ -8,11 +8,11 @@ Date: Fri Sep 27 01:57:16 2019 +0200
just going with what mkstemp() gives us. This is useful in corner just going with what mkstemp() gives us. This is useful in corner
cases where known_hosts is shared between users. cases where known_hosts is shared between users.
diff --git a/ssh-keygen.c b/ssh-keygen.c Index: openssh-8.8p1/ssh-keygen.c
index 03a7fe5..ca8a309 100644 ===================================================================
--- a/ssh-keygen.c --- openssh-8.8p1.orig/ssh-keygen.c
+++ b/ssh-keygen.c +++ openssh-8.8p1/ssh-keygen.c
@@ -1338,6 +1338,11 @@ do_known_hosts(struct passwd *pw, const char *name) @@ -1384,6 +1384,11 @@ do_known_hosts(struct passwd *pw, const
if (inplace) if (inplace)
unlink(tmp); unlink(tmp);
} else if (inplace) { } else if (inplace) {
@ -24,7 +24,7 @@ index 03a7fe5..ca8a309 100644
/* Backup existing file */ /* Backup existing file */
if (unlink(old) == -1 && errno != ENOENT) if (unlink(old) == -1 && errno != ENOENT)
fatal("unlink %.100s: %s", old, strerror(errno)); fatal("unlink %.100s: %s", old, strerror(errno));
@@ -1352,6 +1357,12 @@ do_known_hosts(struct passwd *pw, const char *name) @@ -1398,6 +1403,12 @@ do_known_hosts(struct passwd *pw, const
unlink(old); unlink(old);
exit(1); exit(1);
} }

View File

@ -6,11 +6,11 @@ Date: Thu Jun 20 23:54:11 2019 +0200
Reverts OpenBSD-Commit-ID: d11d2a4484f461524ef0c20870523dfcdeb52181 Reverts OpenBSD-Commit-ID: d11d2a4484f461524ef0c20870523dfcdeb52181
diff --git a/readconf.c b/readconf.c Index: openssh-8.8p1/readconf.c
index 24f2cb1..bbdea0d 100644 ===================================================================
--- a/readconf.c --- openssh-8.8p1.orig/readconf.c
+++ b/readconf.c +++ openssh-8.8p1/readconf.c
@@ -2183,9 +2183,9 @@ fill_default_options(Options * options) @@ -2679,9 +2679,9 @@ fill_default_options(Options * options)
if (options->visual_host_key == -1) if (options->visual_host_key == -1)
options->visual_host_key = 0; options->visual_host_key = 0;
if (options->ip_qos_interactive == -1) if (options->ip_qos_interactive == -1)
@ -21,12 +21,12 @@ index 24f2cb1..bbdea0d 100644
+ options->ip_qos_bulk = IPTOS_THROUGHPUT; + options->ip_qos_bulk = IPTOS_THROUGHPUT;
if (options->request_tty == -1) if (options->request_tty == -1)
options->request_tty = REQUEST_TTY_AUTO; options->request_tty = REQUEST_TTY_AUTO;
if (options->proxy_use_fdpass == -1) if (options->session_type == -1)
diff --git a/servconf.c b/servconf.c Index: openssh-8.8p1/servconf.c
index 13cf154..766ac6b 100644 ===================================================================
--- a/servconf.c --- openssh-8.8p1.orig/servconf.c
+++ b/servconf.c +++ openssh-8.8p1/servconf.c
@@ -445,9 +445,9 @@ fill_default_server_options(ServerOptions *options) @@ -459,9 +459,9 @@ fill_default_server_options(ServerOption
if (options->permit_tun == -1) if (options->permit_tun == -1)
options->permit_tun = SSH_TUNMODE_NO; options->permit_tun = SSH_TUNMODE_NO;
if (options->ip_qos_interactive == -1) if (options->ip_qos_interactive == -1)
@ -38,11 +38,11 @@ index 13cf154..766ac6b 100644
if (options->version_addendum == NULL) if (options->version_addendum == NULL)
options->version_addendum = xstrdup(""); options->version_addendum = xstrdup("");
if (options->fwd_opts.streamlocal_bind_mask == (mode_t)-1) if (options->fwd_opts.streamlocal_bind_mask == (mode_t)-1)
diff --git a/ssh_config.5 b/ssh_config.5 Index: openssh-8.8p1/ssh_config.5
index 3bf0502..10246f8 100644 ===================================================================
--- a/ssh_config.5 --- openssh-8.8p1.orig/ssh_config.5
+++ b/ssh_config.5 +++ openssh-8.8p1/ssh_config.5
@@ -1088,11 +1088,9 @@ If one argument is specified, it is used as the packet class unconditionally. @@ -1182,11 +1182,9 @@ If one argument is specified, it is used
If two values are specified, the first is automatically selected for If two values are specified, the first is automatically selected for
interactive sessions and the second for non-interactive sessions. interactive sessions and the second for non-interactive sessions.
The default is The default is
@ -56,11 +56,11 @@ index 3bf0502..10246f8 100644
for non-interactive sessions. for non-interactive sessions.
.It Cm KbdInteractiveAuthentication .It Cm KbdInteractiveAuthentication
Specifies whether to use keyboard-interactive authentication. Specifies whether to use keyboard-interactive authentication.
diff --git a/sshd_config.5 b/sshd_config.5 Index: openssh-8.8p1/sshd_config.5
index 50a4917..a276fcb 100644 ===================================================================
--- a/sshd_config.5 --- openssh-8.8p1.orig/sshd_config.5
+++ b/sshd_config.5 +++ openssh-8.8p1/sshd_config.5
@@ -868,11 +868,9 @@ If one argument is specified, it is used as the packet class unconditionally. @@ -903,11 +903,9 @@ If one argument is specified, it is used
If two values are specified, the first is automatically selected for If two values are specified, the first is automatically selected for
interactive sessions and the second for non-interactive sessions. interactive sessions and the second for non-interactive sessions.
The default is The default is

File diff suppressed because it is too large Load Diff

View File

@ -1,9 +1,9 @@
Index: openssh-8.4p1/Makefile.in Index: openssh-8.8p1/Makefile.in
=================================================================== ===================================================================
--- openssh-8.4p1.orig/Makefile.in --- openssh-8.8p1.orig/Makefile.in
+++ openssh-8.4p1/Makefile.in +++ openssh-8.8p1/Makefile.in
@@ -113,7 +113,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \ @@ -114,7 +114,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
sntrup4591761.o kexsntrup4591761x25519.o kexgen.o \ kexsntrup761x25519.o sntrup761.o kexgen.o \
kexgssc.o \ kexgssc.o \
sftp-realpath.o platform-pledge.o platform-tracing.o platform-misc.o \ sftp-realpath.o platform-pledge.o platform-tracing.o platform-misc.o \
- sshbuf-io.o - sshbuf-io.o
@ -11,11 +11,11 @@ Index: openssh-8.4p1/Makefile.in
SKOBJS= ssh-sk-client.o SKOBJS= ssh-sk-client.o
Index: openssh-8.4p1/audit-bsm.c Index: openssh-8.8p1/audit-bsm.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/audit-bsm.c --- openssh-8.8p1.orig/audit-bsm.c
+++ openssh-8.4p1/audit-bsm.c +++ openssh-8.8p1/audit-bsm.c
@@ -372,13 +372,26 @@ audit_connection_from(const char *host, @@ -373,13 +373,26 @@ audit_connection_from(const char *host,
#endif #endif
} }
@ -43,7 +43,7 @@ Index: openssh-8.4p1/audit-bsm.c
audit_session_open(struct logininfo *li) audit_session_open(struct logininfo *li)
{ {
/* not implemented */ /* not implemented */
@@ -390,6 +403,12 @@ audit_session_close(struct logininfo *li @@ -391,6 +404,12 @@ audit_session_close(struct logininfo *li
/* not implemented */ /* not implemented */
} }
@ -56,7 +56,7 @@ Index: openssh-8.4p1/audit-bsm.c
void void
audit_event(struct ssh *ssh, ssh_audit_event_t event) audit_event(struct ssh *ssh, ssh_audit_event_t event)
{ {
@@ -451,4 +470,28 @@ audit_event(struct ssh *ssh, ssh_audit_e @@ -452,4 +471,28 @@ audit_event(struct ssh *ssh, ssh_audit_e
debug("%s: unhandled event %d", __func__, event); debug("%s: unhandled event %d", __func__, event);
} }
} }
@ -85,10 +85,10 @@ Index: openssh-8.4p1/audit-bsm.c
+ /* not implemented */ + /* not implemented */
+} +}
#endif /* BSM */ #endif /* BSM */
Index: openssh-8.4p1/audit-linux.c Index: openssh-8.8p1/audit-linux.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/audit-linux.c --- openssh-8.8p1.orig/audit-linux.c
+++ openssh-8.4p1/audit-linux.c +++ openssh-8.8p1/audit-linux.c
@@ -33,27 +33,40 @@ @@ -33,27 +33,40 @@
#include "log.h" #include "log.h"
@ -459,10 +459,10 @@ Index: openssh-8.4p1/audit-linux.c
+ error("cannot write into audit"); + error("cannot write into audit");
+} +}
#endif /* USE_LINUX_AUDIT */ #endif /* USE_LINUX_AUDIT */
Index: openssh-8.4p1/audit.c Index: openssh-8.8p1/audit.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/audit.c --- openssh-8.8p1.orig/audit.c
+++ openssh-8.4p1/audit.c +++ openssh-8.8p1/audit.c
@@ -34,6 +34,12 @@ @@ -34,6 +34,12 @@
#include "log.h" #include "log.h"
#include "hostfile.h" #include "hostfile.h"
@ -640,10 +640,10 @@ Index: openssh-8.4p1/audit.c
} }
# endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */ # endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */
#endif /* SSH_AUDIT_EVENTS */ #endif /* SSH_AUDIT_EVENTS */
Index: openssh-8.4p1/audit.h Index: openssh-8.8p1/audit.h
=================================================================== ===================================================================
--- openssh-8.4p1.orig/audit.h --- openssh-8.8p1.orig/audit.h
+++ openssh-8.4p1/audit.h +++ openssh-8.8p1/audit.h
@@ -26,6 +26,7 @@ @@ -26,6 +26,7 @@
# define _SSH_AUDIT_H # define _SSH_AUDIT_H
@ -686,10 +686,10 @@ Index: openssh-8.4p1/audit.h
+void audit_destroy_sensitive_data(struct ssh *, const char *, pid_t, uid_t); +void audit_destroy_sensitive_data(struct ssh *, const char *, pid_t, uid_t);
#endif /* _SSH_AUDIT_H */ #endif /* _SSH_AUDIT_H */
Index: openssh-8.4p1/auditstub.c Index: openssh-8.8p1/auditstub.c
=================================================================== ===================================================================
--- /dev/null --- /dev/null
+++ openssh-8.4p1/auditstub.c +++ openssh-8.8p1/auditstub.c
@@ -0,0 +1,52 @@ @@ -0,0 +1,52 @@
+/* $Id: auditstub.c,v 1.1 jfch Exp $ */ +/* $Id: auditstub.c,v 1.1 jfch Exp $ */
+ +
@ -743,20 +743,11 @@ Index: openssh-8.4p1/auditstub.c
+audit_session_key_free_body(struct ssh *ssh, int ctos, pid_t pid, uid_t uid) +audit_session_key_free_body(struct ssh *ssh, int ctos, pid_t pid, uid_t uid)
+{ +{
+} +}
Index: openssh-8.4p1/auth.c Index: openssh-8.8p1/auth.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/auth.c --- openssh-8.8p1.orig/auth.c
+++ openssh-8.4p1/auth.c +++ openssh-8.8p1/auth.c
@@ -367,7 +367,7 @@ auth_log(struct ssh *ssh, int authentica @@ -599,9 +599,6 @@ getpwnamallow(struct ssh *ssh, const cha
# endif
#endif
#ifdef SSH_AUDIT_EVENTS
- if (authenticated == 0 && !authctxt->postponed)
+ if (authenticated == 0 && !authctxt->postponed && !partial)
audit_event(ssh, audit_classify_auth(method));
#endif
}
@@ -593,9 +593,6 @@ getpwnamallow(struct ssh *ssh, const cha
record_failed_login(ssh, user, record_failed_login(ssh, user,
auth_get_canonical_hostname(ssh, options.use_dns), "ssh"); auth_get_canonical_hostname(ssh, options.use_dns), "ssh");
#endif #endif
@ -766,10 +757,10 @@ Index: openssh-8.4p1/auth.c
return (NULL); return (NULL);
} }
if (!allowed_user(ssh, pw)) if (!allowed_user(ssh, pw))
Index: openssh-8.4p1/auth.h Index: openssh-8.8p1/auth.h
=================================================================== ===================================================================
--- openssh-8.4p1.orig/auth.h --- openssh-8.8p1.orig/auth.h
+++ openssh-8.4p1/auth.h +++ openssh-8.8p1/auth.h
@@ -189,6 +189,8 @@ struct passwd * getpwnamallow(struct ssh @@ -189,6 +189,8 @@ struct passwd * getpwnamallow(struct ssh
char *expand_authorized_keys(const char *, struct passwd *pw); char *expand_authorized_keys(const char *, struct passwd *pw);
@ -788,11 +779,11 @@ Index: openssh-8.4p1/auth.h
/* Key / cert options linkage to auth layer */ /* Key / cert options linkage to auth layer */
const struct sshauthopt *auth_options(struct ssh *); const struct sshauthopt *auth_options(struct ssh *);
Index: openssh-8.4p1/auth2-hostbased.c Index: openssh-8.8p1/auth2-hostbased.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/auth2-hostbased.c --- openssh-8.8p1.orig/auth2-hostbased.c
+++ openssh-8.4p1/auth2-hostbased.c +++ openssh-8.8p1/auth2-hostbased.c
@@ -150,7 +150,7 @@ userauth_hostbased(struct ssh *ssh) @@ -149,7 +149,7 @@ userauth_hostbased(struct ssh *ssh)
authenticated = 0; authenticated = 0;
if (PRIVSEP(hostbased_key_allowed(ssh, authctxt->pw, cuser, if (PRIVSEP(hostbased_key_allowed(ssh, authctxt->pw, cuser,
chost, key)) && chost, key)) &&
@ -801,7 +792,7 @@ Index: openssh-8.4p1/auth2-hostbased.c
sshbuf_ptr(b), sshbuf_len(b), pkalg, ssh->compat, NULL)) == 0) sshbuf_ptr(b), sshbuf_len(b), pkalg, ssh->compat, NULL)) == 0)
authenticated = 1; authenticated = 1;
@@ -167,6 +167,19 @@ done: @@ -166,6 +166,19 @@ done:
return authenticated; return authenticated;
} }
@ -821,11 +812,11 @@ Index: openssh-8.4p1/auth2-hostbased.c
/* return 1 if given hostkey is allowed */ /* return 1 if given hostkey is allowed */
int int
hostbased_key_allowed(struct ssh *ssh, struct passwd *pw, hostbased_key_allowed(struct ssh *ssh, struct passwd *pw,
Index: openssh-8.4p1/auth2-pubkey.c Index: openssh-8.8p1/auth2-pubkey.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/auth2-pubkey.c --- openssh-8.8p1.orig/auth2-pubkey.c
+++ openssh-8.4p1/auth2-pubkey.c +++ openssh-8.8p1/auth2-pubkey.c
@@ -212,7 +212,7 @@ userauth_pubkey(struct ssh *ssh) @@ -203,7 +203,7 @@ userauth_pubkey(struct ssh *ssh)
/* test for correct signature */ /* test for correct signature */
authenticated = 0; authenticated = 0;
if (PRIVSEP(user_key_allowed(ssh, pw, key, 1, &authopts)) && if (PRIVSEP(user_key_allowed(ssh, pw, key, 1, &authopts)) &&
@ -834,7 +825,7 @@ Index: openssh-8.4p1/auth2-pubkey.c
sshbuf_ptr(b), sshbuf_len(b), sshbuf_ptr(b), sshbuf_len(b),
(ssh->compat & SSH_BUG_SIGTYPE) == 0 ? pkalg : NULL, (ssh->compat & SSH_BUG_SIGTYPE) == 0 ? pkalg : NULL,
ssh->compat, &sig_details)) == 0) { ssh->compat, &sig_details)) == 0) {
@@ -308,6 +308,19 @@ done: @@ -295,6 +295,19 @@ done:
return authenticated; return authenticated;
} }
@ -854,11 +845,11 @@ Index: openssh-8.4p1/auth2-pubkey.c
static int static int
match_principals_option(const char *principal_list, struct sshkey_cert *cert) match_principals_option(const char *principal_list, struct sshkey_cert *cert)
{ {
Index: openssh-8.4p1/auth2.c Index: openssh-8.8p1/auth2.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/auth2.c --- openssh-8.8p1.orig/auth2.c
+++ openssh-8.4p1/auth2.c +++ openssh-8.8p1/auth2.c
@@ -293,9 +293,6 @@ input_userauth_request(int type, u_int32 @@ -290,9 +290,6 @@ input_userauth_request(int type, u_int32
} else { } else {
/* Invalid user, fake password information */ /* Invalid user, fake password information */
authctxt->pw = fakepw(); authctxt->pw = fakepw();
@ -868,10 +859,10 @@ Index: openssh-8.4p1/auth2.c
} }
#ifdef USE_PAM #ifdef USE_PAM
if (options.use_pam) if (options.use_pam)
Index: openssh-8.4p1/cipher.c Index: openssh-8.8p1/cipher.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/cipher.c --- openssh-8.8p1.orig/cipher.c
+++ openssh-8.4p1/cipher.c +++ openssh-8.8p1/cipher.c
@@ -58,25 +58,6 @@ @@ -58,25 +58,6 @@
#define EVP_CIPHER_CTX void #define EVP_CIPHER_CTX void
#endif #endif
@ -898,7 +889,7 @@ Index: openssh-8.4p1/cipher.c
static const struct sshcipher ciphers_all[] = { static const struct sshcipher ciphers_all[] = {
#ifdef WITH_OPENSSL #ifdef WITH_OPENSSL
#ifndef OPENSSL_NO_DES #ifndef OPENSSL_NO_DES
@@ -462,7 +443,7 @@ cipher_get_length(struct sshcipher_ctx * @@ -460,7 +441,7 @@ cipher_get_length(struct sshcipher_ctx *
void void
cipher_free(struct sshcipher_ctx *cc) cipher_free(struct sshcipher_ctx *cc)
{ {
@ -907,10 +898,10 @@ Index: openssh-8.4p1/cipher.c
return; return;
if ((cc->cipher->flags & CFLAG_CHACHAPOLY) != 0) { if ((cc->cipher->flags & CFLAG_CHACHAPOLY) != 0) {
chachapoly_free(cc->cp_ctx); chachapoly_free(cc->cp_ctx);
Index: openssh-8.4p1/cipher.h Index: openssh-8.8p1/cipher.h
=================================================================== ===================================================================
--- openssh-8.4p1.orig/cipher.h --- openssh-8.8p1.orig/cipher.h
+++ openssh-8.4p1/cipher.h +++ openssh-8.8p1/cipher.h
@@ -47,7 +47,25 @@ @@ -47,7 +47,25 @@
#define CIPHER_ENCRYPT 1 #define CIPHER_ENCRYPT 1
#define CIPHER_DECRYPT 0 #define CIPHER_DECRYPT 0
@ -938,10 +929,10 @@ Index: openssh-8.4p1/cipher.h
struct sshcipher_ctx { struct sshcipher_ctx {
int plaintext; int plaintext;
int encrypt; int encrypt;
Index: openssh-8.4p1/kex.c Index: openssh-8.8p1/kex.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/kex.c --- openssh-8.8p1.orig/kex.c
+++ openssh-8.4p1/kex.c +++ openssh-8.8p1/kex.c
@@ -62,6 +62,7 @@ @@ -62,6 +62,7 @@
#include "ssherr.h" #include "ssherr.h"
#include "sshbuf.h" #include "sshbuf.h"
@ -950,7 +941,7 @@ Index: openssh-8.4p1/kex.c
#ifdef GSSAPI #ifdef GSSAPI
#include "ssh-gss.h" #include "ssh-gss.h"
@@ -857,12 +858,16 @@ kex_start_rekex(struct ssh *ssh) @@ -859,12 +860,16 @@ kex_start_rekex(struct ssh *ssh)
} }
static int static int
@ -967,9 +958,9 @@ Index: openssh-8.4p1/kex.c
return SSH_ERR_NO_CIPHER_ALG_MATCH; return SSH_ERR_NO_CIPHER_ALG_MATCH;
+ } + }
if ((enc->cipher = cipher_by_name(name)) == NULL) { if ((enc->cipher = cipher_by_name(name)) == NULL) {
error("%s: unsupported cipher %s", __func__, name); error_f("unsupported cipher %s", name);
free(name); free(name);
@@ -883,8 +888,12 @@ choose_mac(struct ssh *ssh, struct sshma @@ -885,8 +890,12 @@ choose_mac(struct ssh *ssh, struct sshma
{ {
char *name = match_list(client, server, NULL); char *name = match_list(client, server, NULL);
@ -981,9 +972,9 @@ Index: openssh-8.4p1/kex.c
return SSH_ERR_NO_MAC_ALG_MATCH; return SSH_ERR_NO_MAC_ALG_MATCH;
+ } + }
if (mac_setup(mac, name) < 0) { if (mac_setup(mac, name) < 0) {
error("%s: unsupported MAC %s", __func__, name); error_f("unsupported MAC %s", name);
free(name); free(name);
@@ -897,12 +906,16 @@ choose_mac(struct ssh *ssh, struct sshma @@ -899,12 +908,16 @@ choose_mac(struct ssh *ssh, struct sshma
} }
static int static int
@ -1002,7 +993,7 @@ Index: openssh-8.4p1/kex.c
#ifdef WITH_ZLIB #ifdef WITH_ZLIB
if (strcmp(name, "zlib@openssh.com") == 0) { if (strcmp(name, "zlib@openssh.com") == 0) {
comp->type = COMP_DELAYED; comp->type = COMP_DELAYED;
@@ -1043,7 +1056,7 @@ kex_choose_conf(struct ssh *ssh) @@ -1045,7 +1058,7 @@ kex_choose_conf(struct ssh *ssh)
nenc = ctos ? PROPOSAL_ENC_ALGS_CTOS : PROPOSAL_ENC_ALGS_STOC; nenc = ctos ? PROPOSAL_ENC_ALGS_CTOS : PROPOSAL_ENC_ALGS_STOC;
nmac = ctos ? PROPOSAL_MAC_ALGS_CTOS : PROPOSAL_MAC_ALGS_STOC; nmac = ctos ? PROPOSAL_MAC_ALGS_CTOS : PROPOSAL_MAC_ALGS_STOC;
ncomp = ctos ? PROPOSAL_COMP_ALGS_CTOS : PROPOSAL_COMP_ALGS_STOC; ncomp = ctos ? PROPOSAL_COMP_ALGS_CTOS : PROPOSAL_COMP_ALGS_STOC;
@ -1011,7 +1002,7 @@ Index: openssh-8.4p1/kex.c
sprop[nenc])) != 0) { sprop[nenc])) != 0) {
kex->failed_choice = peer[nenc]; kex->failed_choice = peer[nenc];
peer[nenc] = NULL; peer[nenc] = NULL;
@@ -1058,7 +1071,7 @@ kex_choose_conf(struct ssh *ssh) @@ -1060,7 +1073,7 @@ kex_choose_conf(struct ssh *ssh)
peer[nmac] = NULL; peer[nmac] = NULL;
goto out; goto out;
} }
@ -1020,7 +1011,7 @@ Index: openssh-8.4p1/kex.c
sprop[ncomp])) != 0) { sprop[ncomp])) != 0) {
kex->failed_choice = peer[ncomp]; kex->failed_choice = peer[ncomp];
peer[ncomp] = NULL; peer[ncomp] = NULL;
@@ -1081,6 +1094,10 @@ kex_choose_conf(struct ssh *ssh) @@ -1083,6 +1096,10 @@ kex_choose_conf(struct ssh *ssh)
dh_need = MAXIMUM(dh_need, newkeys->enc.block_size); dh_need = MAXIMUM(dh_need, newkeys->enc.block_size);
dh_need = MAXIMUM(dh_need, newkeys->enc.iv_len); dh_need = MAXIMUM(dh_need, newkeys->enc.iv_len);
dh_need = MAXIMUM(dh_need, newkeys->mac.key_len); dh_need = MAXIMUM(dh_need, newkeys->mac.key_len);
@ -1031,7 +1022,7 @@ Index: openssh-8.4p1/kex.c
} }
/* XXX need runden? */ /* XXX need runden? */
kex->we_need = need; kex->we_need = need;
@@ -1245,6 +1262,36 @@ dump_digest(const char *msg, const u_cha @@ -1250,6 +1267,36 @@ dump_digest(const char *msg, const u_cha
} }
#endif #endif
@ -1068,10 +1059,10 @@ Index: openssh-8.4p1/kex.c
/* /*
* Send a plaintext error message to the peer, suffixed by \r\n. * Send a plaintext error message to the peer, suffixed by \r\n.
* Only used during banner exchange, and there only for the server. * Only used during banner exchange, and there only for the server.
Index: openssh-8.4p1/kex.h Index: openssh-8.8p1/kex.h
=================================================================== ===================================================================
--- openssh-8.4p1.orig/kex.h --- openssh-8.8p1.orig/kex.h
+++ openssh-8.4p1/kex.h +++ openssh-8.8p1/kex.h
@@ -226,6 +226,8 @@ int kexgss_client(struct ssh *); @@ -226,6 +226,8 @@ int kexgss_client(struct ssh *);
int kexgss_server(struct ssh *); int kexgss_server(struct ssh *);
#endif #endif
@ -1081,10 +1072,10 @@ Index: openssh-8.4p1/kex.h
int kex_dh_keypair(struct kex *); int kex_dh_keypair(struct kex *);
int kex_dh_enc(struct kex *, const struct sshbuf *, struct sshbuf **, int kex_dh_enc(struct kex *, const struct sshbuf *, struct sshbuf **,
struct sshbuf **); struct sshbuf **);
Index: openssh-8.4p1/mac.c Index: openssh-8.8p1/mac.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/mac.c --- openssh-8.8p1.orig/mac.c
+++ openssh-8.4p1/mac.c +++ openssh-8.8p1/mac.c
@@ -277,6 +277,20 @@ mac_clear(struct sshmac *mac) @@ -277,6 +277,20 @@ mac_clear(struct sshmac *mac)
mac->umac_ctx = NULL; mac->umac_ctx = NULL;
} }
@ -1106,10 +1097,10 @@ Index: openssh-8.4p1/mac.c
/* XXX copied from ciphers_valid */ /* XXX copied from ciphers_valid */
#define MAC_SEP "," #define MAC_SEP ","
int int
Index: openssh-8.4p1/mac.h Index: openssh-8.8p1/mac.h
=================================================================== ===================================================================
--- openssh-8.4p1.orig/mac.h --- openssh-8.8p1.orig/mac.h
+++ openssh-8.4p1/mac.h +++ openssh-8.8p1/mac.h
@@ -49,5 +49,6 @@ int mac_compute(struct sshmac *, u_int3 @@ -49,5 +49,6 @@ int mac_compute(struct sshmac *, u_int3
int mac_check(struct sshmac *, u_int32_t, const u_char *, size_t, int mac_check(struct sshmac *, u_int32_t, const u_char *, size_t,
const u_char *, size_t); const u_char *, size_t);
@ -1117,10 +1108,10 @@ Index: openssh-8.4p1/mac.h
+void mac_destroy(struct sshmac *); +void mac_destroy(struct sshmac *);
#endif /* SSHMAC_H */ #endif /* SSHMAC_H */
Index: openssh-8.4p1/monitor.c Index: openssh-8.8p1/monitor.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/monitor.c --- openssh-8.8p1.orig/monitor.c
+++ openssh-8.4p1/monitor.c +++ openssh-8.8p1/monitor.c
@@ -93,6 +93,7 @@ @@ -93,6 +93,7 @@
#include "compat.h" #include "compat.h"
#include "ssh2.h" #include "ssh2.h"
@ -1129,7 +1120,7 @@ Index: openssh-8.4p1/monitor.c
#include "match.h" #include "match.h"
#include "ssherr.h" #include "ssherr.h"
#include "sk-api.h" #include "sk-api.h"
@@ -108,6 +109,8 @@ extern u_char session_id[]; @@ -107,6 +108,8 @@ extern u_int utmp_len;
extern struct sshbuf *loginmsg; extern struct sshbuf *loginmsg;
extern struct sshauthopt *auth_opts; /* XXX move to permanent ssh->authctxt? */ extern struct sshauthopt *auth_opts; /* XXX move to permanent ssh->authctxt? */
@ -1138,7 +1129,7 @@ Index: openssh-8.4p1/monitor.c
/* State exported from the child */ /* State exported from the child */
static struct sshbuf *child_state; static struct sshbuf *child_state;
@@ -155,6 +158,11 @@ int mm_answer_gss_updatecreds(struct ssh @@ -152,6 +155,11 @@ int mm_answer_gss_updatecreds(struct ssh
#ifdef SSH_AUDIT_EVENTS #ifdef SSH_AUDIT_EVENTS
int mm_answer_audit_event(struct ssh *, int, struct sshbuf *); int mm_answer_audit_event(struct ssh *, int, struct sshbuf *);
int mm_answer_audit_command(struct ssh *, int, struct sshbuf *); int mm_answer_audit_command(struct ssh *, int, struct sshbuf *);
@ -1150,7 +1141,7 @@ Index: openssh-8.4p1/monitor.c
#endif #endif
static Authctxt *authctxt; static Authctxt *authctxt;
@@ -210,6 +218,10 @@ struct mon_table mon_dispatch_proto20[] @@ -207,6 +215,10 @@ struct mon_table mon_dispatch_proto20[]
#endif #endif
#ifdef SSH_AUDIT_EVENTS #ifdef SSH_AUDIT_EVENTS
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event}, {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
@ -1161,7 +1152,7 @@ Index: openssh-8.4p1/monitor.c
#endif #endif
#ifdef BSD_AUTH #ifdef BSD_AUTH
{MONITOR_REQ_BSDAUTHQUERY, MON_ISAUTH, mm_answer_bsdauthquery}, {MONITOR_REQ_BSDAUTHQUERY, MON_ISAUTH, mm_answer_bsdauthquery},
@@ -244,6 +256,11 @@ struct mon_table mon_dispatch_postauth20 @@ -241,6 +253,11 @@ struct mon_table mon_dispatch_postauth20
#ifdef SSH_AUDIT_EVENTS #ifdef SSH_AUDIT_EVENTS
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event}, {MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
{MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT, mm_answer_audit_command}, {MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT, mm_answer_audit_command},
@ -1173,7 +1164,7 @@ Index: openssh-8.4p1/monitor.c
#endif #endif
{0, 0, NULL} {0, 0, NULL}
}; };
@@ -1407,8 +1424,10 @@ mm_answer_keyverify(struct ssh *ssh, int @@ -1403,8 +1420,10 @@ mm_answer_keyverify(struct ssh *ssh, int
int r, ret, req_presence = 0, req_verify = 0, valid_data = 0; int r, ret, req_presence = 0, req_verify = 0, valid_data = 0;
int encoded_ret; int encoded_ret;
struct sshkey_sig_details *sig_details = NULL; struct sshkey_sig_details *sig_details = NULL;
@ -1185,18 +1176,18 @@ Index: openssh-8.4p1/monitor.c
(r = sshbuf_get_string_direct(m, &signature, &signaturelen)) != 0 || (r = sshbuf_get_string_direct(m, &signature, &signaturelen)) != 0 ||
(r = sshbuf_get_string_direct(m, &data, &datalen)) != 0 || (r = sshbuf_get_string_direct(m, &data, &datalen)) != 0 ||
(r = sshbuf_get_cstring(m, &sigalg, NULL)) != 0) (r = sshbuf_get_cstring(m, &sigalg, NULL)) != 0)
@@ -1417,6 +1436,8 @@ mm_answer_keyverify(struct ssh *ssh, int @@ -1413,6 +1432,8 @@ mm_answer_keyverify(struct ssh *ssh, int
if (hostbased_cuser == NULL || hostbased_chost == NULL || if (hostbased_cuser == NULL || hostbased_chost == NULL ||
!monitor_allowed_key(blob, bloblen)) !monitor_allowed_key(blob, bloblen))
fatal("%s: bad key, not previously allowed", __func__); fatal_f("bad key, not previously allowed");
+ if (type != key_blobtype) + if (type != key_blobtype)
+ fatal("%s: bad key type", __func__); + fatal_f("bad key type");
/* Empty signature algorithm means NULL. */ /* Empty signature algorithm means NULL. */
if (*sigalg == '\0') { if (*sigalg == '\0') {
@@ -1432,14 +1453,19 @@ mm_answer_keyverify(struct ssh *ssh, int @@ -1428,14 +1449,19 @@ mm_answer_keyverify(struct ssh *ssh, int
case MM_USERKEY: case MM_USERKEY:
valid_data = monitor_valid_userblob(data, datalen); valid_data = monitor_valid_userblob(ssh, data, datalen);
auth_method = "publickey"; auth_method = "publickey";
+ ret = user_key_verify(ssh, key, signature, signaturelen, data, + ret = user_key_verify(ssh, key, signature, signaturelen, data,
+ datalen, sigalg, ssh->compat, &sig_details); + datalen, sigalg, ssh->compat, &sig_details);
@ -1214,55 +1205,55 @@ Index: openssh-8.4p1/monitor.c
break; break;
} }
if (!valid_data) if (!valid_data)
@@ -1449,8 +1475,6 @@ mm_answer_keyverify(struct ssh *ssh, int @@ -1447,8 +1473,6 @@ mm_answer_keyverify(struct ssh *ssh, int
SSH_FP_DEFAULT)) == NULL) SSH_FP_DEFAULT)) == NULL)
fatal("%s: sshkey_fingerprint failed", __func__); fatal_f("sshkey_fingerprint failed");
- ret = sshkey_verify(key, signature, signaturelen, data, datalen, - ret = sshkey_verify(key, signature, signaturelen, data, datalen,
- sigalg, ssh->compat, &sig_details); - sigalg, ssh->compat, &sig_details);
debug3("%s: %s %p signature %s%s%s", __func__, auth_method, key, debug3_f("%s %s signature %s%s%s", auth_method, sshkey_type(key),
(ret == 0) ? "verified" : "unverified", (ret == 0) ? "verified" : "unverified",
(ret != 0) ? ": " : "", (ret != 0) ? ssh_err(ret) : ""); (ret != 0) ? ": " : "", (ret != 0) ? ssh_err(ret) : "");
@@ -1537,13 +1561,19 @@ mm_record_login(struct ssh *ssh, Session @@ -1535,13 +1559,19 @@ mm_record_login(struct ssh *ssh, Session
} }
static void static void
-mm_session_close(Session *s) -mm_session_close(Session *s)
+mm_session_close(struct ssh *ssh, Session *s) +mm_session_close(struct ssh *ssh, Session *s)
{ {
debug3("%s: session %d pid %ld", __func__, s->self, (long)s->pid); debug3_f("session %d pid %ld", s->self, (long)s->pid);
if (s->ttyfd != -1) { if (s->ttyfd != -1) {
debug3("%s: tty %s ptyfd %d", __func__, s->tty, s->ptyfd); debug3_f("tty %s ptyfd %d", s->tty, s->ptyfd);
session_pty_cleanup2(s); session_pty_cleanup2(s);
} }
+#ifdef SSH_AUDIT_EVENTS +#ifdef SSH_AUDIT_EVENTS
+ if (s->command != NULL) { + if (s->command != NULL) {
+ debug3("%s: command %d", __func__, s->command_handle); + debug3_f("command %d", s->command_handle);
+ session_end_command2(ssh, s); + session_end_command2(ssh, s);
+ } + }
+#endif +#endif
session_unused(s->self); session_unused(s->self);
} }
@@ -1610,7 +1640,7 @@ mm_answer_pty(struct ssh *ssh, int sock, @@ -1608,7 +1638,7 @@ mm_answer_pty(struct ssh *ssh, int sock,
error: error:
if (s != NULL) if (s != NULL)
- mm_session_close(s); - mm_session_close(s);
+ mm_session_close(ssh, s); + mm_session_close(ssh, s);
if ((r = sshbuf_put_u32(m, 0)) != 0) if ((r = sshbuf_put_u32(m, 0)) != 0)
fatal("%s: buffer error: %s", __func__, ssh_err(r)); fatal_fr(r, "assemble 0");
mm_request_send(sock, MONITOR_ANS_PTY, m); mm_request_send(sock, MONITOR_ANS_PTY, m);
@@ -1629,7 +1659,7 @@ mm_answer_pty_cleanup(struct ssh *ssh, i @@ -1627,7 +1657,7 @@ mm_answer_pty_cleanup(struct ssh *ssh, i
if ((r = sshbuf_get_cstring(m, &tty, NULL)) != 0) if ((r = sshbuf_get_cstring(m, &tty, NULL)) != 0)
fatal("%s: buffer error: %s", __func__, ssh_err(r)); fatal_fr(r, "parse tty");
if ((s = session_by_tty(tty)) != NULL) if ((s = session_by_tty(tty)) != NULL)
- mm_session_close(s); - mm_session_close(s);
+ mm_session_close(ssh, s); + mm_session_close(ssh, s);
sshbuf_reset(m); sshbuf_reset(m);
free(tty); free(tty);
return (0); return (0);
@@ -1651,6 +1681,8 @@ mm_answer_term(struct ssh *ssh, int sock @@ -1649,6 +1679,8 @@ mm_answer_term(struct ssh *ssh, int sock
sshpam_cleanup(); sshpam_cleanup();
#endif #endif
@ -1271,7 +1262,7 @@ Index: openssh-8.4p1/monitor.c
while (waitpid(pmonitor->m_pid, &status, 0) == -1) while (waitpid(pmonitor->m_pid, &status, 0) == -1)
if (errno != EINTR) if (errno != EINTR)
exit(1); exit(1);
@@ -1697,12 +1729,47 @@ mm_answer_audit_command(struct ssh *ssh, @@ -1695,12 +1727,47 @@ mm_answer_audit_command(struct ssh *ssh,
{ {
char *cmd; char *cmd;
int r; int r;
@ -1320,18 +1311,18 @@ Index: openssh-8.4p1/monitor.c
free(cmd); free(cmd);
return (0); return (0);
} }
@@ -1768,6 +1835,7 @@ monitor_apply_keystate(struct ssh *ssh, @@ -1772,6 +1839,7 @@ monitor_apply_keystate(struct ssh *ssh,
void void
mm_get_keystate(struct ssh *ssh, struct monitor *pmonitor) mm_get_keystate(struct ssh *ssh, struct monitor *pmonitor)
{ {
+ struct sshbuf *m; + struct sshbuf *m;
debug3("%s: Waiting for new keys", __func__); debug3_f("Waiting for new keys");
if ((child_state = sshbuf_new()) == NULL) if ((child_state = sshbuf_new()) == NULL)
@@ -1775,6 +1843,19 @@ mm_get_keystate(struct ssh *ssh, struct @@ -1779,6 +1847,18 @@ mm_get_keystate(struct ssh *ssh, struct
mm_request_receive_expect(pmonitor->m_sendfd, MONITOR_REQ_KEYEXPORT, mm_request_receive_expect(pmonitor->m_sendfd, MONITOR_REQ_KEYEXPORT,
child_state); child_state);
debug3("%s: GOT new keys", __func__); debug3_f("GOT new keys");
+ +
+#ifdef SSH_AUDIT_EVENTS +#ifdef SSH_AUDIT_EVENTS
+ m = sshbuf_new(); + m = sshbuf_new();
@ -1344,11 +1335,10 @@ Index: openssh-8.4p1/monitor.c
+ /* Drain any buffered messages from the child */ + /* Drain any buffered messages from the child */
+ while (pmonitor->m_log_recvfd >= 0 && monitor_read_log(pmonitor) == 0) + while (pmonitor->m_log_recvfd >= 0 && monitor_read_log(pmonitor) == 0)
+ ; + ;
+
} }
@@ -2052,3 +2133,102 @@ mm_answer_gss_updatecreds(struct ssh *ss @@ -2056,3 +2136,102 @@ mm_answer_gss_updatecreds(struct ssh *ss
#endif /* GSSAPI */ #endif /* GSSAPI */
@ -1451,10 +1441,10 @@ Index: openssh-8.4p1/monitor.c
+ return 0; + return 0;
+} +}
+#endif /* SSH_AUDIT_EVENTS */ +#endif /* SSH_AUDIT_EVENTS */
Index: openssh-8.4p1/monitor.h Index: openssh-8.8p1/monitor.h
=================================================================== ===================================================================
--- openssh-8.4p1.orig/monitor.h --- openssh-8.8p1.orig/monitor.h
+++ openssh-8.4p1/monitor.h +++ openssh-8.8p1/monitor.h
@@ -61,7 +61,13 @@ enum monitor_reqtype { @@ -61,7 +61,13 @@ enum monitor_reqtype {
MONITOR_REQ_PAM_QUERY = 106, MONITOR_ANS_PAM_QUERY = 107, MONITOR_REQ_PAM_QUERY = 106, MONITOR_ANS_PAM_QUERY = 107,
MONITOR_REQ_PAM_RESPOND = 108, MONITOR_ANS_PAM_RESPOND = 109, MONITOR_REQ_PAM_RESPOND = 108, MONITOR_ANS_PAM_RESPOND = 109,
@ -1470,11 +1460,11 @@ Index: openssh-8.4p1/monitor.h
MONITOR_REQ_GSSSIGN = 150, MONITOR_ANS_GSSSIGN = 151, MONITOR_REQ_GSSSIGN = 150, MONITOR_ANS_GSSSIGN = 151,
MONITOR_REQ_GSSUPCREDS = 152, MONITOR_ANS_GSSUPCREDS = 153, MONITOR_REQ_GSSUPCREDS = 152, MONITOR_ANS_GSSUPCREDS = 153,
Index: openssh-8.4p1/monitor_wrap.c Index: openssh-8.8p1/monitor_wrap.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/monitor_wrap.c --- openssh-8.8p1.orig/monitor_wrap.c
+++ openssh-8.4p1/monitor_wrap.c +++ openssh-8.8p1/monitor_wrap.c
@@ -492,7 +492,7 @@ mm_key_allowed(enum mm_keytype type, con @@ -499,7 +499,7 @@ mm_key_allowed(enum mm_keytype type, con
*/ */
int int
@ -1483,17 +1473,17 @@ Index: openssh-8.4p1/monitor_wrap.c
const u_char *data, size_t datalen, const char *sigalg, u_int compat, const u_char *data, size_t datalen, const char *sigalg, u_int compat,
struct sshkey_sig_details **sig_detailsp) struct sshkey_sig_details **sig_detailsp)
{ {
@@ -508,7 +508,8 @@ mm_sshkey_verify(const struct sshkey *ke @@ -515,7 +515,8 @@ mm_sshkey_verify(const struct sshkey *ke
*sig_detailsp = NULL; *sig_detailsp = NULL;
if ((m = sshbuf_new()) == NULL) if ((m = sshbuf_new()) == NULL)
fatal("%s: sshbuf_new failed", __func__); fatal_f("sshbuf_new failed");
- if ((r = sshkey_puts(key, m)) != 0 || - if ((r = sshkey_puts(key, m)) != 0 ||
+ if ((r = sshbuf_put_u32(m, type)) != 0 || + if ((r = sshbuf_put_u32(m, type)) != 0 ||
+ (r = sshkey_puts(key, m)) != 0 || + (r = sshkey_puts(key, m)) != 0 ||
(r = sshbuf_put_string(m, sig, siglen)) != 0 || (r = sshbuf_put_string(m, sig, siglen)) != 0 ||
(r = sshbuf_put_string(m, data, datalen)) != 0 || (r = sshbuf_put_string(m, data, datalen)) != 0 ||
(r = sshbuf_put_cstring(m, sigalg == NULL ? "" : sigalg)) != 0) (r = sshbuf_put_cstring(m, sigalg == NULL ? "" : sigalg)) != 0)
@@ -541,6 +542,20 @@ mm_sshkey_verify(const struct sshkey *ke @@ -548,6 +549,20 @@ mm_sshkey_verify(const struct sshkey *ke
return 0; return 0;
} }
@ -1514,7 +1504,7 @@ Index: openssh-8.4p1/monitor_wrap.c
void void
mm_send_keystate(struct ssh *ssh, struct monitor *monitor) mm_send_keystate(struct ssh *ssh, struct monitor *monitor)
{ {
@@ -894,11 +909,12 @@ mm_audit_event(struct ssh *ssh, ssh_audi @@ -900,11 +915,12 @@ mm_audit_event(struct ssh *ssh, ssh_audi
sshbuf_free(m); sshbuf_free(m);
} }
@ -1529,7 +1519,7 @@ Index: openssh-8.4p1/monitor_wrap.c
debug3("%s entering command %s", __func__, command); debug3("%s entering command %s", __func__, command);
@@ -908,6 +924,30 @@ mm_audit_run_command(const char *command @@ -914,6 +930,30 @@ mm_audit_run_command(const char *command
fatal("%s: buffer error: %s", __func__, ssh_err(r)); fatal("%s: buffer error: %s", __func__, ssh_err(r));
mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_COMMAND, m); mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_COMMAND, m);
@ -1560,7 +1550,7 @@ Index: openssh-8.4p1/monitor_wrap.c
sshbuf_free(m); sshbuf_free(m);
} }
#endif /* SSH_AUDIT_EVENTS */ #endif /* SSH_AUDIT_EVENTS */
@@ -1068,3 +1108,83 @@ mm_ssh_gssapi_update_creds(ssh_gssapi_cc @@ -1074,3 +1114,83 @@ mm_ssh_gssapi_update_creds(ssh_gssapi_cc
} }
#endif /* GSSAPI */ #endif /* GSSAPI */
@ -1644,10 +1634,10 @@ Index: openssh-8.4p1/monitor_wrap.c
+ sshbuf_free(m); + sshbuf_free(m);
+} +}
+#endif /* SSH_AUDIT_EVENTS */ +#endif /* SSH_AUDIT_EVENTS */
Index: openssh-8.4p1/monitor_wrap.h Index: openssh-8.8p1/monitor_wrap.h
=================================================================== ===================================================================
--- openssh-8.4p1.orig/monitor_wrap.h --- openssh-8.8p1.orig/monitor_wrap.h
+++ openssh-8.4p1/monitor_wrap.h +++ openssh-8.8p1/monitor_wrap.h
@@ -58,7 +58,9 @@ int mm_user_key_allowed(struct ssh *, st @@ -58,7 +58,9 @@ int mm_user_key_allowed(struct ssh *, st
struct sshauthopt **); struct sshauthopt **);
int mm_hostbased_key_allowed(struct ssh *, struct passwd *, const char *, int mm_hostbased_key_allowed(struct ssh *, struct passwd *, const char *,
@ -1673,10 +1663,10 @@ Index: openssh-8.4p1/monitor_wrap.h
#endif #endif
struct Session; struct Session;
Index: openssh-8.4p1/packet.c Index: openssh-8.8p1/packet.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/packet.c --- openssh-8.8p1.orig/packet.c
+++ openssh-8.4p1/packet.c +++ openssh-8.8p1/packet.c
@@ -81,6 +81,7 @@ @@ -81,6 +81,7 @@
#endif #endif
@ -1685,7 +1675,7 @@ Index: openssh-8.4p1/packet.c
#include "compat.h" #include "compat.h"
#include "ssh2.h" #include "ssh2.h"
#include "cipher.h" #include "cipher.h"
@@ -518,6 +519,13 @@ ssh_packet_get_connection_out(struct ssh @@ -506,6 +507,13 @@ ssh_packet_get_connection_out(struct ssh
return ssh->state->connection_out; return ssh->state->connection_out;
} }
@ -1699,7 +1689,7 @@ Index: openssh-8.4p1/packet.c
/* /*
* Returns the IP-address of the remote host as a string. The returned * Returns the IP-address of the remote host as a string. The returned
* string must not be freed. * string must not be freed.
@@ -595,22 +603,19 @@ ssh_packet_close_internal(struct ssh *ss @@ -583,22 +591,19 @@ ssh_packet_close_internal(struct ssh *ss
{ {
struct session_state *state = ssh->state; struct session_state *state = ssh->state;
u_int mode; u_int mode;
@ -1727,7 +1717,7 @@ Index: openssh-8.4p1/packet.c
for (mode = 0; mode < MODE_MAX; mode++) { for (mode = 0; mode < MODE_MAX; mode++) {
kex_free_newkeys(state->newkeys[mode]); /* current keys */ kex_free_newkeys(state->newkeys[mode]); /* current keys */
state->newkeys[mode] = NULL; state->newkeys[mode] = NULL;
@@ -646,8 +651,18 @@ ssh_packet_close_internal(struct ssh *ss @@ -634,8 +639,18 @@ ssh_packet_close_internal(struct ssh *ss
#endif /* WITH_ZLIB */ #endif /* WITH_ZLIB */
cipher_free(state->send_context); cipher_free(state->send_context);
cipher_free(state->receive_context); cipher_free(state->receive_context);
@ -1746,7 +1736,7 @@ Index: openssh-8.4p1/packet.c
free(ssh->local_ipaddr); free(ssh->local_ipaddr);
ssh->local_ipaddr = NULL; ssh->local_ipaddr = NULL;
free(ssh->remote_ipaddr); free(ssh->remote_ipaddr);
@@ -904,6 +919,7 @@ ssh_set_newkeys(struct ssh *ssh, int mod @@ -892,6 +907,7 @@ ssh_set_newkeys(struct ssh *ssh, int mod
(unsigned long long)state->p_send.bytes, (unsigned long long)state->p_send.bytes,
(unsigned long long)state->p_send.blocks); (unsigned long long)state->p_send.blocks);
kex_free_newkeys(state->newkeys[mode]); kex_free_newkeys(state->newkeys[mode]);
@ -1754,7 +1744,7 @@ Index: openssh-8.4p1/packet.c
state->newkeys[mode] = NULL; state->newkeys[mode] = NULL;
} }
/* note that both bytes and the seqnr are not reset */ /* note that both bytes and the seqnr are not reset */
@@ -2210,6 +2226,73 @@ ssh_packet_get_output(struct ssh *ssh) @@ -2178,6 +2194,73 @@ ssh_packet_get_output(struct ssh *ssh)
return (void *)ssh->state->output; return (void *)ssh->state->output;
} }
@ -1828,20 +1818,20 @@ Index: openssh-8.4p1/packet.c
/* Reset after_authentication and reset compression in post-auth privsep */ /* Reset after_authentication and reset compression in post-auth privsep */
static int static int
ssh_packet_set_postauth(struct ssh *ssh) ssh_packet_set_postauth(struct ssh *ssh)
Index: openssh-8.4p1/packet.h Index: openssh-8.8p1/packet.h
=================================================================== ===================================================================
--- openssh-8.4p1.orig/packet.h --- openssh-8.8p1.orig/packet.h
+++ openssh-8.4p1/packet.h +++ openssh-8.8p1/packet.h
@@ -218,4 +218,5 @@ const u_char *sshpkt_ptr(struct ssh *, s @@ -219,4 +219,5 @@ const u_char *sshpkt_ptr(struct ssh *, s
# undef EC_POINT # undef EC_POINT
#endif #endif
+void packet_destroy_all(struct ssh *, int, int); +void packet_destroy_all(struct ssh *, int, int);
#endif /* PACKET_H */ #endif /* PACKET_H */
Index: openssh-8.4p1/session.c Index: openssh-8.8p1/session.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/session.c --- openssh-8.8p1.orig/session.c
+++ openssh-8.4p1/session.c +++ openssh-8.8p1/session.c
@@ -136,7 +136,7 @@ extern char *__progname; @@ -136,7 +136,7 @@ extern char *__progname;
extern int debug_flag; extern int debug_flag;
extern u_int utmp_len; extern u_int utmp_len;
@ -1851,7 +1841,7 @@ Index: openssh-8.4p1/session.c
extern struct sshbuf *loginmsg; extern struct sshbuf *loginmsg;
extern struct sshauthopt *auth_opts; extern struct sshauthopt *auth_opts;
extern char *tun_fwd_ifnames; /* serverloop.c */ extern char *tun_fwd_ifnames; /* serverloop.c */
@@ -647,6 +647,14 @@ do_exec_pty(struct ssh *ssh, Session *s, @@ -643,6 +643,14 @@ do_exec_pty(struct ssh *ssh, Session *s,
/* Parent. Close the slave side of the pseudo tty. */ /* Parent. Close the slave side of the pseudo tty. */
close(ttyfd); close(ttyfd);
@ -1866,7 +1856,7 @@ Index: openssh-8.4p1/session.c
/* Enter interactive session. */ /* Enter interactive session. */
s->ptymaster = ptymaster; s->ptymaster = ptymaster;
ssh_packet_set_interactive(ssh, 1, ssh_packet_set_interactive(ssh, 1,
@@ -711,15 +719,19 @@ do_exec(struct ssh *ssh, Session *s, con @@ -707,15 +715,19 @@ do_exec(struct ssh *ssh, Session *s, con
s->self); s->self);
#ifdef SSH_AUDIT_EVENTS #ifdef SSH_AUDIT_EVENTS
@ -1888,7 +1878,7 @@ Index: openssh-8.4p1/session.c
#endif #endif
if (s->ttyfd != -1) if (s->ttyfd != -1)
ret = do_exec_pty(ssh, s, command); ret = do_exec_pty(ssh, s, command);
@@ -1542,8 +1554,11 @@ do_child(struct ssh *ssh, Session *s, co @@ -1534,8 +1546,11 @@ do_child(struct ssh *ssh, Session *s, co
sshpkt_fmt_connection_id(ssh, remote_id, sizeof(remote_id)); sshpkt_fmt_connection_id(ssh, remote_id, sizeof(remote_id));
/* remove hostkey from the child's memory */ /* remove hostkey from the child's memory */
@ -1901,7 +1891,7 @@ Index: openssh-8.4p1/session.c
/* Force a password change */ /* Force a password change */
if (s->authctxt->force_pwchange) { if (s->authctxt->force_pwchange) {
@@ -1752,6 +1767,9 @@ session_unused(int id) @@ -1744,6 +1759,9 @@ session_unused(int id)
sessions[id].ttyfd = -1; sessions[id].ttyfd = -1;
sessions[id].ptymaster = -1; sessions[id].ptymaster = -1;
sessions[id].x11_chanids = NULL; sessions[id].x11_chanids = NULL;
@ -1911,7 +1901,7 @@ Index: openssh-8.4p1/session.c
sessions[id].next_unused = sessions_first_unused; sessions[id].next_unused = sessions_first_unused;
sessions_first_unused = id; sessions_first_unused = id;
} }
@@ -1834,6 +1852,19 @@ session_open(Authctxt *authctxt, int cha @@ -1823,6 +1841,19 @@ session_open(Authctxt *authctxt, int cha
} }
Session * Session *
@ -1931,7 +1921,7 @@ Index: openssh-8.4p1/session.c
session_by_tty(char *tty) session_by_tty(char *tty)
{ {
int i; int i;
@@ -2444,6 +2475,32 @@ session_exit_message(struct ssh *ssh, Se @@ -2430,6 +2461,32 @@ session_exit_message(struct ssh *ssh, Se
chan_write_failed(ssh, c); chan_write_failed(ssh, c);
} }
@ -1964,7 +1954,7 @@ Index: openssh-8.4p1/session.c
void void
session_close(struct ssh *ssh, Session *s) session_close(struct ssh *ssh, Session *s)
{ {
@@ -2485,6 +2542,10 @@ session_close(struct ssh *ssh, Session * @@ -2471,6 +2528,10 @@ session_close(struct ssh *ssh, Session *
if (s->ttyfd != -1) if (s->ttyfd != -1)
session_pty_cleanup(s); session_pty_cleanup(s);
@ -1975,7 +1965,7 @@ Index: openssh-8.4p1/session.c
free(s->term); free(s->term);
free(s->display); free(s->display);
free(s->x11_chanids); free(s->x11_chanids);
@@ -2560,14 +2621,14 @@ session_close_by_channel(struct ssh *ssh @@ -2545,14 +2606,14 @@ session_close_by_channel(struct ssh *ssh
} }
void void
@ -1992,7 +1982,7 @@ Index: openssh-8.4p1/session.c
else else
session_close(ssh, s); session_close(ssh, s);
} }
@@ -2693,6 +2754,15 @@ do_authenticated2(struct ssh *ssh, Authc @@ -2678,6 +2739,15 @@ do_authenticated2(struct ssh *ssh, Authc
server_loop2(ssh, authctxt); server_loop2(ssh, authctxt);
} }
@ -2008,7 +1998,7 @@ Index: openssh-8.4p1/session.c
void void
do_cleanup(struct ssh *ssh, Authctxt *authctxt) do_cleanup(struct ssh *ssh, Authctxt *authctxt)
{ {
@@ -2756,7 +2826,7 @@ do_cleanup(struct ssh *ssh, Authctxt *au @@ -2741,7 +2811,7 @@ do_cleanup(struct ssh *ssh, Authctxt *au
* or if running in monitor. * or if running in monitor.
*/ */
if (!use_privsep || mm_is_monitor()) if (!use_privsep || mm_is_monitor())
@ -2017,10 +2007,10 @@ Index: openssh-8.4p1/session.c
} }
/* Return a name for the remote host that fits inside utmp_size */ /* Return a name for the remote host that fits inside utmp_size */
Index: openssh-8.4p1/session.h Index: openssh-8.8p1/session.h
=================================================================== ===================================================================
--- openssh-8.4p1.orig/session.h --- openssh-8.8p1.orig/session.h
+++ openssh-8.4p1/session.h +++ openssh-8.8p1/session.h
@@ -61,6 +61,12 @@ struct Session { @@ -61,6 +61,12 @@ struct Session {
char *name; char *name;
char *val; char *val;
@ -2048,10 +2038,10 @@ Index: openssh-8.4p1/session.h
Session *session_by_tty(char *); Session *session_by_tty(char *);
void session_close(struct ssh *, Session *); void session_close(struct ssh *, Session *);
void do_setusercontext(struct passwd *); void do_setusercontext(struct passwd *);
Index: openssh-8.4p1/sshd.c Index: openssh-8.8p1/sshd.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/sshd.c --- openssh-8.8p1.orig/sshd.c
+++ openssh-8.4p1/sshd.c +++ openssh-8.8p1/sshd.c
@@ -122,6 +122,7 @@ @@ -122,6 +122,7 @@
#include "ssh-gss.h" #include "ssh-gss.h"
#endif #endif
@ -2060,7 +2050,7 @@ Index: openssh-8.4p1/sshd.c
#include "ssh-sandbox.h" #include "ssh-sandbox.h"
#include "auth-options.h" #include "auth-options.h"
#include "version.h" #include "version.h"
@@ -267,8 +268,8 @@ struct sshbuf *loginmsg; @@ -262,8 +263,8 @@ struct sshbuf *loginmsg;
struct passwd *privsep_pw = NULL; struct passwd *privsep_pw = NULL;
/* Prototypes for various functions defined later in this file. */ /* Prototypes for various functions defined later in this file. */
@ -2071,7 +2061,7 @@ Index: openssh-8.4p1/sshd.c
static void do_ssh2_kex(struct ssh *); static void do_ssh2_kex(struct ssh *);
static char *listener_proctitle; static char *listener_proctitle;
@@ -286,6 +287,15 @@ close_listen_socks(void) @@ -281,6 +282,15 @@ close_listen_socks(void)
num_listen_socks = -1; num_listen_socks = -1;
} }
@ -2087,8 +2077,8 @@ Index: openssh-8.4p1/sshd.c
static void static void
close_startup_pipes(void) close_startup_pipes(void)
{ {
@@ -390,18 +400,45 @@ grace_alarm_handler(int sig) @@ -386,18 +396,45 @@ grace_alarm_handler(int sig)
ssh_remote_port(the_active_state)); }
} }
-/* Destroy the host and server keys. They will no longer be needed. */ -/* Destroy the host and server keys. They will no longer be needed. */
@ -2136,7 +2126,7 @@ Index: openssh-8.4p1/sshd.c
sshkey_free(sensitive_data.host_certificates[i]); sshkey_free(sensitive_data.host_certificates[i]);
sensitive_data.host_certificates[i] = NULL; sensitive_data.host_certificates[i] = NULL;
} }
@@ -410,14 +447,26 @@ destroy_sensitive_data(void) @@ -406,20 +443,38 @@ destroy_sensitive_data(void)
/* Demote private to public keys for network child */ /* Demote private to public keys for network child */
void void
@ -2163,9 +2153,8 @@ Index: openssh-8.4p1/sshd.c
+ fp = NULL; + fp = NULL;
if ((r = sshkey_from_private( if ((r = sshkey_from_private(
sensitive_data.host_keys[i], &tmp)) != 0) sensitive_data.host_keys[i], &tmp)) != 0)
fatal("could not demote host %s key: %s", fatal_r(r, "could not demote host %s key",
@@ -425,6 +474,12 @@ demote_sensitive_data(void) sshkey_type(sensitive_data.host_keys[i]));
ssh_err(r));
sshkey_free(sensitive_data.host_keys[i]); sshkey_free(sensitive_data.host_keys[i]);
sensitive_data.host_keys[i] = tmp; sensitive_data.host_keys[i] = tmp;
+ if (fp != NULL) { + if (fp != NULL) {
@ -2177,7 +2166,7 @@ Index: openssh-8.4p1/sshd.c
} }
/* Certs do not need demotion */ /* Certs do not need demotion */
} }
@@ -452,7 +507,7 @@ reseed_prngs(void) @@ -447,7 +502,7 @@ reseed_prngs(void)
} }
static void static void
@ -2186,7 +2175,7 @@ Index: openssh-8.4p1/sshd.c
{ {
gid_t gidset[1]; gid_t gidset[1];
@@ -467,7 +522,7 @@ privsep_preauth_child(void) @@ -462,7 +517,7 @@ privsep_preauth_child(void)
reseed_prngs(); reseed_prngs();
/* Demote the private keys to public keys. */ /* Demote the private keys to public keys. */
@ -2195,7 +2184,7 @@ Index: openssh-8.4p1/sshd.c
/* Demote the child */ /* Demote the child */
if (privsep_chroot) { if (privsep_chroot) {
@@ -502,7 +557,7 @@ privsep_preauth(struct ssh *ssh) @@ -497,7 +552,7 @@ privsep_preauth(struct ssh *ssh)
if (use_privsep == PRIVSEP_ON) if (use_privsep == PRIVSEP_ON)
box = ssh_sandbox_init(pmonitor); box = ssh_sandbox_init(pmonitor);
@ -2204,7 +2193,7 @@ Index: openssh-8.4p1/sshd.c
if (pid == -1) { if (pid == -1) {
fatal("fork of unprivileged child failed"); fatal("fork of unprivileged child failed");
} else if (pid != 0) { } else if (pid != 0) {
@@ -548,7 +603,7 @@ privsep_preauth(struct ssh *ssh) @@ -542,7 +597,7 @@ privsep_preauth(struct ssh *ssh)
/* Arrange for logging to be sent to the monitor */ /* Arrange for logging to be sent to the monitor */
set_log_handler(mm_log_handler, pmonitor); set_log_handler(mm_log_handler, pmonitor);
@ -2213,7 +2202,7 @@ Index: openssh-8.4p1/sshd.c
setproctitle("%s", "[net]"); setproctitle("%s", "[net]");
if (box != NULL) if (box != NULL)
ssh_sandbox_child(box); ssh_sandbox_child(box);
@@ -592,7 +647,7 @@ privsep_postauth(struct ssh *ssh, Authct @@ -586,7 +641,7 @@ privsep_postauth(struct ssh *ssh, Authct
pmonitor->m_sendfd = -1; pmonitor->m_sendfd = -1;
/* Demote the private keys to public keys. */ /* Demote the private keys to public keys. */
@ -2222,7 +2211,7 @@ Index: openssh-8.4p1/sshd.c
reseed_prngs(); reseed_prngs();
@@ -1159,7 +1214,7 @@ server_listen(void) @@ -1140,7 +1195,7 @@ server_listen(void)
* from this function are in a forked subprocess. * from this function are in a forked subprocess.
*/ */
static void static void
@ -2231,7 +2220,7 @@ Index: openssh-8.4p1/sshd.c
{ {
fd_set *fdset; fd_set *fdset;
int i, j, ret, maxfd; int i, j, ret, maxfd;
@@ -1220,6 +1275,7 @@ server_accept_loop(int *sock_in, int *so @@ -1186,6 +1241,7 @@ server_accept_loop(int *sock_in, int *so
if (received_sigterm) { if (received_sigterm) {
logit("Received signal %d; terminating.", logit("Received signal %d; terminating.",
(int) received_sigterm); (int) received_sigterm);
@ -2239,7 +2228,7 @@ Index: openssh-8.4p1/sshd.c
close_listen_socks(); close_listen_socks();
if (options.pid_file != NULL) if (options.pid_file != NULL)
unlink(options.pid_file); unlink(options.pid_file);
@@ -2089,7 +2145,7 @@ main(int ac, char **av) @@ -2091,7 +2147,7 @@ main(int ac, char **av)
#endif #endif
/* Accept a connection and return in a forked child */ /* Accept a connection and return in a forked child */
@ -2248,7 +2237,7 @@ Index: openssh-8.4p1/sshd.c
&newsock, config_s); &newsock, config_s);
} }
@@ -2325,6 +2381,9 @@ main(int ac, char **av) @@ -2321,6 +2377,9 @@ main(int ac, char **av)
do_authenticated(ssh, authctxt); do_authenticated(ssh, authctxt);
/* The connection has been terminated. */ /* The connection has been terminated. */
@ -2258,7 +2247,7 @@ Index: openssh-8.4p1/sshd.c
ssh_packet_get_bytes(ssh, &ibytes, &obytes); ssh_packet_get_bytes(ssh, &ibytes, &obytes);
verbose("Transferred: sent %llu, received %llu bytes", verbose("Transferred: sent %llu, received %llu bytes",
(unsigned long long)obytes, (unsigned long long)ibytes); (unsigned long long)obytes, (unsigned long long)ibytes);
@@ -2509,6 +2568,15 @@ do_ssh2_kex(struct ssh *ssh) @@ -2501,6 +2560,15 @@ do_ssh2_kex(struct ssh *ssh)
void void
cleanup_exit(int i) cleanup_exit(int i)
{ {
@ -2274,8 +2263,8 @@ Index: openssh-8.4p1/sshd.c
if (the_active_state != NULL && the_authctxt != NULL) { if (the_active_state != NULL && the_authctxt != NULL) {
do_cleanup(the_active_state, the_authctxt); do_cleanup(the_active_state, the_authctxt);
if (use_privsep && privsep_is_preauth && if (use_privsep && privsep_is_preauth &&
@@ -2520,9 +2588,16 @@ cleanup_exit(int i) @@ -2513,9 +2581,16 @@ cleanup_exit(int i)
pmonitor->m_pid, strerror(errno)); }
} }
} }
+ is_privsep_child = use_privsep && pmonitor != NULL && pmonitor->m_pid == 0; + is_privsep_child = use_privsep && pmonitor != NULL && pmonitor->m_pid == 0;
@ -2292,10 +2281,10 @@ Index: openssh-8.4p1/sshd.c
audit_event(the_active_state, SSH_CONNECTION_ABANDON); audit_event(the_active_state, SSH_CONNECTION_ABANDON);
#endif #endif
_exit(i); _exit(i);
Index: openssh-8.4p1/sshkey.c Index: openssh-8.8p1/sshkey.c
=================================================================== ===================================================================
--- openssh-8.4p1.orig/sshkey.c --- openssh-8.8p1.orig/sshkey.c
+++ openssh-8.4p1/sshkey.c +++ openssh-8.8p1/sshkey.c
@@ -371,6 +371,38 @@ sshkey_type_is_valid_ca(int type) @@ -371,6 +371,38 @@ sshkey_type_is_valid_ca(int type)
} }
@ -2335,11 +2324,11 @@ Index: openssh-8.4p1/sshkey.c
sshkey_is_cert(const struct sshkey *k) sshkey_is_cert(const struct sshkey *k)
{ {
if (k == NULL) if (k == NULL)
Index: openssh-8.4p1/sshkey.h Index: openssh-8.8p1/sshkey.h
=================================================================== ===================================================================
--- openssh-8.4p1.orig/sshkey.h --- openssh-8.8p1.orig/sshkey.h
+++ openssh-8.4p1/sshkey.h +++ openssh-8.8p1/sshkey.h
@@ -187,6 +187,7 @@ int sshkey_shield_private(struct sshke @@ -189,6 +189,7 @@ int sshkey_shield_private(struct sshke
int sshkey_unshield_private(struct sshkey *); int sshkey_unshield_private(struct sshkey *);
int sshkey_type_from_name(const char *); int sshkey_type_from_name(const char *);

View File

@ -9,11 +9,11 @@ upcoming glibc ( 2.31 )
sandbox-seccomp-filter.c | 3 +++ sandbox-seccomp-filter.c | 3 +++
1 file changed, 3 insertions(+) 1 file changed, 3 insertions(+)
diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c Index: openssh-8.8p1/sandbox-seccomp-filter.c
index 3ef30c9d5..999c46c9f 100644 ===================================================================
--- a/sandbox-seccomp-filter.c --- openssh-8.8p1.orig/sandbox-seccomp-filter.c
+++ b/sandbox-seccomp-filter.c +++ openssh-8.8p1/sandbox-seccomp-filter.c
@@ -248,6 +248,9 @@ static const struct sock_filter preauth_insns[] = { @@ -279,6 +279,9 @@ static const struct sock_filter preauth_
#ifdef __NR_clock_nanosleep_time64 #ifdef __NR_clock_nanosleep_time64
SC_ALLOW(__NR_clock_nanosleep_time64), SC_ALLOW(__NR_clock_nanosleep_time64),
#endif #endif

View File

@ -1,8 +1,8 @@
diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c Index: openssh-8.8p1/sandbox-seccomp-filter.c
index c1e689e..74f69bc 100644 ===================================================================
--- a/sandbox-seccomp-filter.c --- openssh-8.8p1.orig/sandbox-seccomp-filter.c
+++ b/sandbox-seccomp-filter.c +++ openssh-8.8p1/sandbox-seccomp-filter.c
@@ -264,6 +264,9 @@ static const struct sock_filter preauth_insns[] = { @@ -273,6 +273,9 @@ static const struct sock_filter preauth_
#ifdef __NR_clock_gettime64 #ifdef __NR_clock_gettime64
SC_ALLOW(__NR_clock_gettime64), SC_ALLOW(__NR_clock_gettime64),
#endif #endif

View File

@ -8,11 +8,11 @@ Needed on Linux ARM. bz#3100, patch from jjelen@redhat.com.
sandbox-seccomp-filter.c | 3 +++ sandbox-seccomp-filter.c | 3 +++
1 file changed, 3 insertions(+) 1 file changed, 3 insertions(+)
Index: openssh-8.1p1/sandbox-seccomp-filter.c Index: openssh-8.8p1/sandbox-seccomp-filter.c
=================================================================== ===================================================================
--- openssh-8.1p1.orig/sandbox-seccomp-filter.c --- openssh-8.8p1.orig/sandbox-seccomp-filter.c
+++ openssh-8.1p1/sandbox-seccomp-filter.c +++ openssh-8.8p1/sandbox-seccomp-filter.c
@@ -251,6 +251,9 @@ static const struct sock_filter preauth_ @@ -276,6 +276,9 @@ static const struct sock_filter preauth_
#ifdef __NR_clock_nanosleep #ifdef __NR_clock_nanosleep
SC_ALLOW(__NR_clock_nanosleep), SC_ALLOW(__NR_clock_nanosleep),
#endif #endif

View File

@ -1,8 +1,8 @@
diff --git a/kex.c b/kex.c Index: openssh-8.8p1/kex.c
index 96e44a5..7cd37d6 100644 ===================================================================
--- a/kex.c --- openssh-8.8p1.orig/kex.c
+++ b/kex.c +++ openssh-8.8p1/kex.c
@@ -38,6 +38,7 @@ @@ -40,6 +40,7 @@
#ifdef WITH_OPENSSL #ifdef WITH_OPENSSL
#include <openssl/crypto.h> #include <openssl/crypto.h>
#include <openssl/dh.h> #include <openssl/dh.h>
@ -10,7 +10,7 @@ index 96e44a5..7cd37d6 100644
#endif #endif
#include "ssh.h" #include "ssh.h"
@@ -1109,8 +1110,92 @@ kex_choose_conf(struct ssh *ssh) @@ -1115,8 +1116,93 @@ kex_choose_conf(struct ssh *ssh)
return r; return r;
} }
@ -69,7 +69,8 @@ index 96e44a5..7cd37d6 100644
+ || EVP_KDF_ctrl (hashctx, EVP_KDF_CTRL_SET_SSHKDF_XCGHASH, + || EVP_KDF_ctrl (hashctx, EVP_KDF_CTRL_SET_SSHKDF_XCGHASH,
+ hash, (size_t) hashlen) != 1 + hash, (size_t) hashlen) != 1
+ || EVP_KDF_ctrl (hashctx, EVP_KDF_CTRL_SET_SSHKDF_SESSION_ID, + || EVP_KDF_ctrl (hashctx, EVP_KDF_CTRL_SET_SSHKDF_SESSION_ID,
+ kex->session_id, (size_t) kex->session_id_len) != 1) + sshbuf_ptr(kex->session_id),
+ (size_t) sshbuf_len(kex->session_id)) != 1)
+ goto out; + goto out;
+ +
+ digest = calloc (1, need); + digest = calloc (1, need);
@ -104,7 +105,7 @@ index 96e44a5..7cd37d6 100644
const struct sshbuf *shared_secret, u_char **keyp) const struct sshbuf *shared_secret, u_char **keyp)
{ {
struct kex *kex = ssh->kex; struct kex *kex = ssh->kex;
@@ -1174,6 +1259,50 @@ derive_key(struct ssh *ssh, int id, u_int need, u_char *hash, u_int hashlen, @@ -1179,6 +1265,50 @@ derive_key(struct ssh *ssh, int id, u_in
return r; return r;
} }

View File

@ -1,52 +1,31 @@
Gemeinsame Unterverzeichnisse: openssh-8.4p1/contrib und openssh-8.4p1-vendor/contrib. Gemeinsame Unterverzeichnisse: openssh-8.4p1/contrib und openssh-8.4p1-vendor/contrib.
diff -u openssh-8.4p1/dh.c openssh-8.4p1-vendor/dh.c Index: openssh-8.8p1/dh.c
--- openssh-8.4p1/dh.c 2020-09-27 09:25:01.000000000 +0200 ===================================================================
+++ openssh-8.4p1-vendor/dh.c 2021-01-29 11:49:40.968418136 +0100 --- openssh-8.8p1.orig/dh.c
@@ -151,10 +151,18 @@ +++ openssh-8.8p1/dh.c
size_t linesize = 0; @@ -54,7 +54,17 @@ void dh_set_moduli_file(const char *file
int best, bestcount, which, linenum;
struct dhgroup dhg;
+ char *dh_moduli_path;
+ struct stat st;
- if ((f = fopen(_PATH_DH_MODULI, "r")) == NULL) { static const char * get_moduli_filename(void)
{
- return moduli_filename ? moduli_filename : _PATH_DH_MODULI;
+ struct stat st;
+
+ if (moduli_filename)
+ return moduli_filename;
+
+ if (stat(_PATH_VENDOR_DH_MODULI, &st) == 0 && + if (stat(_PATH_VENDOR_DH_MODULI, &st) == 0 &&
+ stat(_PATH_DH_MODULI, &st) == -1) { + stat(_PATH_DH_MODULI, &st) == -1) {
+ dh_moduli_path = _PATH_VENDOR_DH_MODULI; + return _PATH_VENDOR_DH_MODULI;
+ } else {
+ dh_moduli_path = _PATH_DH_MODULI;
+ } + }
+ if ((f = fopen(dh_moduli_path, "r")) == NULL) { +
logit("WARNING: could not open %s (%s), using fixed modulus", + return _PATH_DH_MODULI;
- _PATH_DH_MODULI, strerror(errno));
+ dh_moduli_path, strerror(errno));
return (dh_new_group_fallback(max));
} }
@@ -185,7 +193,7 @@ static int
Index: openssh-8.8p1/pathnames.h
if (bestcount == 0) { ===================================================================
fclose(f); --- openssh-8.8p1.orig/pathnames.h
- logit("WARNING: no suitable primes in %s", _PATH_DH_MODULI); +++ openssh-8.8p1/pathnames.h
+ logit("WARNING: no suitable primes in %s", dh_moduli_path);
return (dh_new_group_fallback(max));
}
which = arc4random_uniform(bestcount);
@@ -210,7 +218,7 @@
fclose(f);
if (bestcount != which + 1) {
logit("WARNING: selected prime disappeared in %s, giving up",
- _PATH_DH_MODULI);
+ dh_moduli_path);
return (dh_new_group_fallback(max));
}
Gemeinsame Unterverzeichnisse: openssh-8.4p1/.github und openssh-8.4p1-vendor/.github.
Gemeinsame Unterverzeichnisse: openssh-8.4p1/m4 und openssh-8.4p1-vendor/m4.
Gemeinsame Unterverzeichnisse: openssh-8.4p1/openbsd-compat und openssh-8.4p1-vendor/openbsd-compat.
diff -u openssh-8.4p1/pathnames.h openssh-8.4p1-vendor/pathnames.h
--- openssh-8.4p1/pathnames.h 2020-09-27 09:25:01.000000000 +0200
+++ openssh-8.4p1-vendor/pathnames.h 2021-01-29 11:35:41.655599046 +0100
@@ -18,6 +18,8 @@ @@ -18,6 +18,8 @@
#define SSHDIR ETCDIR "/ssh" #define SSHDIR ETCDIR "/ssh"
#endif #endif
@ -74,11 +53,11 @@ diff -u openssh-8.4p1/pathnames.h openssh-8.4p1-vendor/pathnames.h
#ifndef _PATH_SSH_PROGRAM #ifndef _PATH_SSH_PROGRAM
#define _PATH_SSH_PROGRAM "/usr/bin/ssh" #define _PATH_SSH_PROGRAM "/usr/bin/ssh"
Gemeinsame Unterverzeichnisse: openssh-8.4p1/regress und openssh-8.4p1-vendor/regress. Index: openssh-8.8p1/ssh.c
diff -u openssh-8.4p1/ssh.c openssh-8.4p1-vendor/ssh.c ===================================================================
--- openssh-8.4p1/ssh.c 2020-09-27 09:25:01.000000000 +0200 --- openssh-8.8p1.orig/ssh.c
+++ openssh-8.4p1-vendor/ssh.c 2021-01-27 18:22:52.322271681 +0100 +++ openssh-8.8p1/ssh.c
@@ -593,6 +593,7 @@ @@ -549,6 +549,7 @@ static void
process_config_files(const char *host_name, struct passwd *pw, int final_pass, process_config_files(const char *host_name, struct passwd *pw, int final_pass,
int *want_final_pass) int *want_final_pass)
{ {
@ -86,7 +65,7 @@ diff -u openssh-8.4p1/ssh.c openssh-8.4p1-vendor/ssh.c
char buf[PATH_MAX]; char buf[PATH_MAX];
int r; int r;
@@ -611,10 +612,23 @@ @@ -567,10 +568,23 @@ process_config_files(const char *host_na
&options, SSHCONF_CHECKPERM | SSHCONF_USERCONF | &options, SSHCONF_CHECKPERM | SSHCONF_USERCONF |
(final_pass ? SSHCONF_FINAL : 0), want_final_pass); (final_pass ? SSHCONF_FINAL : 0), want_final_pass);
@ -114,11 +93,11 @@ diff -u openssh-8.4p1/ssh.c openssh-8.4p1-vendor/ssh.c
} }
} }
Nur in openssh-8.4p1-vendor: #ssh_config.5#. Index: openssh-8.8p1/ssh_config.5
diff -u openssh-8.4p1/ssh_config.5 openssh-8.4p1-vendor/ssh_config.5 ===================================================================
--- openssh-8.4p1/ssh_config.5 2020-09-27 09:25:01.000000000 +0200 --- openssh-8.8p1.orig/ssh_config.5
+++ openssh-8.4p1-vendor/ssh_config.5 2021-02-24 12:02:53.935729753 +0100 +++ openssh-8.8p1/ssh_config.5
@@ -54,6 +54,9 @@ @@ -54,6 +54,9 @@ user's configuration file
.It .It
system-wide configuration file system-wide configuration file
.Pq Pa /etc/ssh/ssh_config .Pq Pa /etc/ssh/ssh_config
@ -128,7 +107,7 @@ diff -u openssh-8.4p1/ssh_config.5 openssh-8.4p1-vendor/ssh_config.5
.El .El
.Pp .Pp
For each parameter, the first obtained value For each parameter, the first obtained value
@@ -1942,6 +1945,11 @@ @@ -2212,6 +2215,11 @@ This file provides defaults for those
values that are not specified in the user's configuration file, and values that are not specified in the user's configuration file, and
for those users who do not have a configuration file. for those users who do not have a configuration file.
This file must be world-readable. This file must be world-readable.
@ -140,11 +119,11 @@ diff -u openssh-8.4p1/ssh_config.5 openssh-8.4p1-vendor/ssh_config.5
.El .El
.Sh SEE ALSO .Sh SEE ALSO
.Xr ssh 1 .Xr ssh 1
Nur in openssh-8.4p1-vendor: ssh_config.5~. Index: openssh-8.8p1/sshd.c
diff -u openssh-8.4p1/sshd.c openssh-8.4p1-vendor/sshd.c ===================================================================
--- openssh-8.4p1/sshd.c 2020-09-27 09:25:01.000000000 +0200 --- openssh-8.8p1.orig/sshd.c
+++ openssh-8.4p1-vendor/sshd.c 2021-01-27 18:25:38.370273280 +0100 +++ openssh-8.8p1/sshd.c
@@ -136,7 +136,7 @@ @@ -145,7 +145,7 @@ extern char *__progname;
ServerOptions options; ServerOptions options;
/* Name of the server configuration file. */ /* Name of the server configuration file. */
@ -153,7 +132,7 @@ diff -u openssh-8.4p1/sshd.c openssh-8.4p1-vendor/sshd.c
/* /*
* Debug mode flag. This can be set on the command line. If debug * Debug mode flag. This can be set on the command line. If debug
@@ -1526,6 +1526,7 @@ @@ -1594,6 +1594,7 @@ prepare_proctitle(int ac, char **av)
int int
main(int ac, char **av) main(int ac, char **av)
{ {
@ -161,7 +140,7 @@ diff -u openssh-8.4p1/sshd.c openssh-8.4p1-vendor/sshd.c
struct ssh *ssh = NULL; struct ssh *ssh = NULL;
extern char *optarg; extern char *optarg;
extern int optind; extern int optind;
@@ -1737,7 +1738,21 @@ @@ -1809,7 +1810,21 @@ main(int ac, char **av)
*/ */
(void)atomicio(vwrite, startup_pipe, "\0", 1); (void)atomicio(vwrite, startup_pipe, "\0", 1);
} }
@ -183,9 +162,10 @@ diff -u openssh-8.4p1/sshd.c openssh-8.4p1-vendor/sshd.c
load_server_config(config_file_name, cfg); load_server_config(config_file_name, cfg);
parse_server_config(&options, rexeced_flag ? "rexec" : config_file_name, parse_server_config(&options, rexeced_flag ? "rexec" : config_file_name,
diff -u openssh-8.4p1/sshd_config.5 openssh-8.4p1-vendor/sshd_config.5 Index: openssh-8.8p1/sshd_config.5
--- openssh-8.4p1/sshd_config.5 2020-09-27 09:25:01.000000000 +0200 ===================================================================
+++ openssh-8.4p1-vendor/sshd_config.5 2021-02-24 14:14:27.912038335 +0100 --- openssh-8.8p1.orig/sshd_config.5
+++ openssh-8.8p1/sshd_config.5
@@ -44,7 +44,9 @@ @@ -44,7 +44,9 @@
.Xr sshd 8 .Xr sshd 8
reads configuration data from reads configuration data from
@ -197,11 +177,11 @@ diff -u openssh-8.4p1/sshd_config.5 openssh-8.4p1-vendor/sshd_config.5
.Fl f .Fl f
on the command line). on the command line).
The file contains keyword-argument pairs, one per line. The file contains keyword-argument pairs, one per line.
Nur in openssh-8.4p1-vendor: sshd_config.5~. Index: openssh-8.8p1/ssh-keysign.c
diff -u openssh-8.4p1/ssh-keysign.c openssh-8.4p1-vendor/ssh-keysign.c ===================================================================
--- openssh-8.4p1/ssh-keysign.c 2020-09-27 09:25:01.000000000 +0200 --- openssh-8.8p1.orig/ssh-keysign.c
+++ openssh-8.4p1-vendor/ssh-keysign.c 2021-02-24 11:34:17.684570215 +0100 +++ openssh-8.8p1/ssh-keysign.c
@@ -172,6 +172,7 @@ @@ -172,6 +172,7 @@ main(int argc, char **argv)
u_char *signature, *data, rver; u_char *signature, *data, rver;
char *host, *fp; char *host, *fp;
size_t slen, dlen; size_t slen, dlen;
@ -209,19 +189,20 @@ diff -u openssh-8.4p1/ssh-keysign.c openssh-8.4p1-vendor/ssh-keysign.c
if (pledge("stdio rpath getpw dns id", NULL) != 0) if (pledge("stdio rpath getpw dns id", NULL) != 0)
fatal("%s: pledge: %s", __progname, strerror(errno)); fatal("%s: pledge: %s", __progname, strerror(errno));
@@ -205,8 +206,12 @@ @@ -205,8 +206,14 @@ main(int argc, char **argv)
/* verify that ssh-keysign is enabled by the admin */ /* verify that ssh-keysign is enabled by the admin */
initialize_options(&options); initialize_options(&options);
- (void)read_config_file(_PATH_HOST_CONFIG_FILE, pw, "", "", - (void)read_config_file(_PATH_HOST_CONFIG_FILE, pw, "", "",
- &options, 0, NULL); - &options, 0, NULL);
+
+ if (stat(_PATH_HOST_CONFIG_FILE, &st) == 0) + if (stat(_PATH_HOST_CONFIG_FILE, &st) == 0)
+ (void)read_config_file(_PATH_HOST_CONFIG_FILE, pw, "", "", + (void)read_config_file(_PATH_HOST_CONFIG_FILE, pw, "", "",
+ &options, 0, NULL); + &options, 0, NULL);
+ else + else
+ (void)read_config_file(_PATH_HOST_VENDOR_CONFIG_FILE, pw, + (void)read_config_file(_PATH_HOST_VENDOR_CONFIG_FILE, pw, "", "",
+ "", "", &options, 0, NULL); + &options, 0, NULL);
fill_default_options(&options); +
(void)fill_default_options(&options);
if (options.enable_ssh_keysign != 1) if (options.enable_ssh_keysign != 1)
fatal("ssh-keysign not enabled in %s", fatal("ssh-keysign not enabled in %s",
Nur in openssh-8.4p1-vendor: ssh-keysign.c~.

View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:5a01d22e407eb1c05ba8a8f7c654d388a13e9f226e4ed33bd38748dafa1d2b24
size 1742201

View File

@ -1,14 +0,0 @@
-----BEGIN PGP SIGNATURE-----
iQHDBAABCgAdFiEEWcIRjtIG2SfmZ+vj0+X1a22SDTAFAl9wQnwACgkQ0+X1a22S
DTAR6wyAjRcvW7Jg9v73AR7TUO4WAD085sYi4ZLsECMZqhVZUBVv0Ofmcz2ISg3I
NU1nr9Kiqf1/i05OUIR64kJEd4wTSwv+4HhyP5MPJqyCkKcFJ9TyRy6pASZtyH6D
hKezJ79iGUg1U46bI6yyxchcAKrz0if97fKd0/1h5yE7T5lcbo+zQPsAg9dDXHBJ
nL5mpBQXU3xbU8bC+E+vZ7VAyxEm6kzuY7MRW2wOhpPQ5DJgEjAUjtvzvd9SJhKl
u/hgKXqIJBQB1pHlAFI1knfTrGUGrzob8QphukrvmbMJC3dO/o3Dplvx6lZkes0c
6hP66rhTRp5Tmw9ae3iUmoDf6SyStlo/4QomCuw0NxHrSOng16VjCR+NRWHvZbXC
JckIqparyOJ2jtHz0+e52sRZCZKauFBDMZboNj7f+htwQRUFOVfeSecpJiYut4bM
YALdayOQwL96J6aMdoMKfMGZUevCPN6OM96E6cMC1fmanBenZQ/vatmskIvvvO/P
rwECYTpGVRezhAvXMEy9x+EVdV6ctA==
=PW3D
-----END PGP SIGNATURE-----

3
openssh-8.8p1.tar.gz Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
size 1815060

16
openssh-8.8p1.tar.gz.asc Normal file
View File

@ -0,0 +1,16 @@
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEcWi5g4FaXu9ZpK39Kj9BTnNgYLoFAmFQfp8ACgkQKj9BTnNg
YLq2SQ/8C3iOHTkyqX82FYt0SKkybebe9b2iBPr91HQOUmx+U3I+vgrSWArXabWJ
uSu0b685RQKlcr7UjEtPk6g0cm45NoJFjju9ljvnOFfZw73V3a5qX15Lx4xRnkRx
v1LJn6Yh12PKLWL4/A1qPQnfAObVwq/BF0BR01FfXLAOt5+lFwYvg79HpE+69b0r
KtcIEpsyTEn2lSKSWD7q4lpe6Z/iR+XzBKfnB6JJXhKyHiDV63hlAJk9Pt3mIvS6
tnE9/7GDawvi+Tsl018kw3wsf6aHVSQ+O+vzcDgfy0vDJVGjD6Ec9it9FvikXJh6
3pSTBYuUJdt+CAQYvmEui73v4nrkfouHXsxqgzEDZaTwIZC4wPrvNYxUaIyirWlc
l4/YSnxSxSiYbvPa5eYRBvXvoWbnQXjPOkuhjETxz/KTcHirQpWE9eldi0jHcKUa
FVu9YqMPAjIUd1Jj4vC5bgH7v5cLeEMm/AetMvKsJs+rhY9NZaKpiqOqU2m6Geb+
sQSXHNTeA8uOlrHim4SmYHtmfglVbH5lIroiUqtRzjbOhMhqUb+yN9+aAxe0bwmN
VcFMSThlbmYokb9bkQryY2I/FfXb997vxgF6v15Z8d9e8HH2zc2Irj1HYXG4Bf3o
WCiSvd8+Tr/FxS2Gn8qj/vgSPWXT0d0Hy4zHW9JeT/jn3RtIYhU=
=EnoG
-----END PGP SIGNATURE-----

View File

@ -1,3 +1,10 @@
-------------------------------------------------------------------
Tue Sep 28 19:05:15 UTC 2021 - Hans Petter Jansson <hpj@suse.com>
- Version upgrade to 8.8p1
* No changes for askpass, see main package changelog for
details
------------------------------------------------------------------- -------------------------------------------------------------------
Thu Sep 17 20:41:39 UTC 2020 - Jan Engelhardt <jengelh@inai.de> Thu Sep 17 20:41:39 UTC 2020 - Jan Engelhardt <jengelh@inai.de>

View File

@ -18,7 +18,7 @@
%define _name openssh %define _name openssh
Name: openssh-askpass-gnome Name: openssh-askpass-gnome
Version: 8.4p1 Version: 8.8p1
Release: 0 Release: 0
Summary: A GNOME-Based Passphrase Dialog for OpenSSH Summary: A GNOME-Based Passphrase Dialog for OpenSSH
License: BSD-2-Clause License: BSD-2-Clause

View File

@ -4,11 +4,11 @@ Date: Mon Oct 26 22:26:46 2020 +0100
Ensure DHGs are approved in FIPS mode using OpenSSL's DH_check_params() Ensure DHGs are approved in FIPS mode using OpenSSL's DH_check_params()
diff --git a/dh.c b/dh.c Index: openssh-8.8p1/dh.c
index 7cb135d..3fe7f75 100644 ===================================================================
--- a/dh.c --- openssh-8.8p1.orig/dh.c
+++ b/dh.c +++ openssh-8.8p1/dh.c
@@ -143,6 +143,28 @@ parse_prime(int linenum, char *line, struct dhgroup *dhg) @@ -155,6 +155,28 @@ parse_prime(int linenum, char *line, str
return 0; return 0;
} }
@ -37,7 +37,7 @@ index 7cb135d..3fe7f75 100644
DH * DH *
choose_dh(int min, int wantbits, int max) choose_dh(int min, int wantbits, int max)
{ {
@@ -161,12 +183,20 @@ choose_dh(int min, int wantbits, int max) @@ -173,12 +195,20 @@ choose_dh(int min, int wantbits, int max
linenum = 0; linenum = 0;
best = bestcount = 0; best = bestcount = 0;
while (getline(&line, &linesize, f) != -1) { while (getline(&line, &linesize, f) != -1) {
@ -58,7 +58,7 @@ index 7cb135d..3fe7f75 100644
if (dhg.size > max || dhg.size < min) if (dhg.size > max || dhg.size < min)
continue; continue;
@@ -193,10 +223,16 @@ choose_dh(int min, int wantbits, int max) @@ -206,10 +236,16 @@ choose_dh(int min, int wantbits, int max
linenum = 0; linenum = 0;
bestcount = 0; bestcount = 0;
while (getline(&line, &linesize, f) != -1) { while (getline(&line, &linesize, f) != -1) {

View File

@ -1,30 +0,0 @@
From 66f16e5425eb881570e82bfef7baeac2e7accc0a Mon Sep 17 00:00:00 2001
From: Oleg <Fallmay@users.noreply.github.com>
Date: Thu, 1 Oct 2020 12:09:08 +0300
Subject: [PATCH] Fix `EOF: command not found` error in ssh-copy-id
---
contrib/ssh-copy-id | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/contrib/ssh-copy-id b/contrib/ssh-copy-id
index 392f64f94..a76907717 100644
--- a/contrib/ssh-copy-id
+++ b/contrib/ssh-copy-id
@@ -247,7 +247,7 @@ installkeys_sh() {
# the -z `tail ...` checks for a trailing newline. The echo adds one if was missing
# the cat adds the keys we're getting via STDIN
# and if available restorecon is used to restore the SELinux context
- INSTALLKEYS_SH=$(tr '\t\n' ' ' <<-EOF)
+ INSTALLKEYS_SH=$(tr '\t\n' ' ' <<-EOF
cd;
umask 077;
mkdir -p $(dirname "${AUTH_KEY_FILE}") &&
@@ -258,6 +258,7 @@ installkeys_sh() {
restorecon -F .ssh ${AUTH_KEY_FILE};
fi
EOF
+ )
# to defend against quirky remote shells: use 'exec sh -c' to get POSIX;
printf "exec sh -c '%s'" "${INSTALLKEYS_SH}"

View File

@ -1,15 +1,15 @@
diff --git a/Makefile.in b/Makefile.in Index: openssh-8.8p1/Makefile.in
index 6dec09c..25e74ac 100644 ===================================================================
--- a/Makefile.in --- openssh-8.8p1.orig/Makefile.in
+++ b/Makefile.in +++ openssh-8.8p1/Makefile.in
@@ -251,8 +251,8 @@ ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSCAN_OBJS) @@ -252,8 +252,8 @@ ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libss
ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o
$(LD) -o $@ ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS) $(LD) -o $@ ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
-sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a $(SFTPSERVER_OBJS) -sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a $(SFTPSERVER_OBJS)
- $(LD) -o $@ $(SFTPSERVER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) - $(LD) -o $@ $(SFTPSERVER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
+sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-sk.o sk-usbhid.o $(SFTPSERVER_OBJS) +sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-sk.o sk-usbhid.o $(SFTPSERVER_OBJS)
+ $(LD) -o $@ $(SFTPSERVER_OBJS) ssh-sk.o sk-usbhid.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LIBFIDO2) + $(LD) -o $@ $(SFTPSERVER_OBJS) ssh-sk.o sk-usbhid.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS) $(LIBFIDO2)
sftp$(EXEEXT): $(LIBCOMPAT) libssh.a $(SFTP_OBJS) sftp$(EXEEXT): $(LIBCOMPAT) libssh.a $(SFTP_OBJS)
$(LD) -o $@ $(SFTP_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LIBEDIT) $(LD) -o $@ $(SFTP_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LIBEDIT)

View File

@ -1,7 +1,7 @@
diff --git a/myproposal.h b/myproposal.h Index: openssh-8.8p1/myproposal.h
index 5312e60..83fd62d 100644 ===================================================================
--- a/myproposal.h --- openssh-8.8p1.orig/myproposal.h
+++ b/myproposal.h +++ openssh-8.8p1/myproposal.h
@@ -33,7 +33,8 @@ @@ -33,7 +33,8 @@
"diffie-hellman-group-exchange-sha256," \ "diffie-hellman-group-exchange-sha256," \
"diffie-hellman-group16-sha512," \ "diffie-hellman-group16-sha512," \
@ -12,11 +12,11 @@ index 5312e60..83fd62d 100644
#define KEX_CLIENT_KEX KEX_SERVER_KEX #define KEX_CLIENT_KEX KEX_SERVER_KEX
diff --git a/ssh_config.5 b/ssh_config.5 Index: openssh-8.8p1/ssh_config.5
index d5888f2..100563e 100644 ===================================================================
--- a/ssh_config.5 --- openssh-8.8p1.orig/ssh_config.5
+++ b/ssh_config.5 +++ openssh-8.8p1/ssh_config.5
@@ -1170,7 +1170,8 @@ ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521, @@ -1227,7 +1227,8 @@ ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
diffie-hellman-group-exchange-sha256, diffie-hellman-group-exchange-sha256,
diffie-hellman-group16-sha512, diffie-hellman-group16-sha512,
diffie-hellman-group18-sha512, diffie-hellman-group18-sha512,
@ -26,11 +26,11 @@ index d5888f2..100563e 100644
.Ed .Ed
.Pp .Pp
The list of available key exchange algorithms may also be obtained using The list of available key exchange algorithms may also be obtained using
diff --git a/sshd_config.5 b/sshd_config.5 Index: openssh-8.8p1/sshd_config.5
index 0f5fe53..97364f5 100644 ===================================================================
--- a/sshd_config.5 --- openssh-8.8p1.orig/sshd_config.5
+++ b/sshd_config.5 +++ openssh-8.8p1/sshd_config.5
@@ -986,7 +986,7 @@ curve25519-sha256,curve25519-sha256@libssh.org, @@ -997,7 +997,7 @@ curve25519-sha256,curve25519-sha256@libs
ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521, ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
diffie-hellman-group-exchange-sha256, diffie-hellman-group-exchange-sha256,
diffie-hellman-group16-sha512,diffie-hellman-group18-sha512, diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,

View File

@ -1,6 +1,8 @@
--- a/sandbox-seccomp-filter.c Index: openssh-8.8p1/sandbox-seccomp-filter.c
+++ b/sandbox-seccomp-filter.c ===================================================================
@@ -195,6 +195,9 @@ --- openssh-8.8p1.orig/sandbox-seccomp-filter.c
+++ openssh-8.8p1/sandbox-seccomp-filter.c
@@ -201,6 +201,9 @@ static const struct sock_filter preauth_
#ifdef __NR_close #ifdef __NR_close
SC_ALLOW(__NR_close), SC_ALLOW(__NR_close),
#endif #endif
@ -10,9 +12,9 @@
#ifdef __NR_exit #ifdef __NR_exit
SC_ALLOW(__NR_exit), SC_ALLOW(__NR_exit),
#endif #endif
@@ -204,6 +207,9 @@ @@ -213,6 +216,9 @@ static const struct sock_filter preauth_
#ifdef __NR_futex #ifdef __NR_futex_time64
SC_ALLOW(__NR_futex), SC_ALLOW(__NR_futex_time64),
#endif #endif
+#ifdef __NR_futex_time64 +#ifdef __NR_futex_time64
+ SC_ALLOW(__NR_futex_time64), + SC_ALLOW(__NR_futex_time64),
@ -20,13 +22,13 @@
#ifdef __NR_geteuid #ifdef __NR_geteuid
SC_ALLOW(__NR_geteuid), SC_ALLOW(__NR_geteuid),
#endif #endif
@@ -282,6 +288,9 @@ @@ -293,6 +299,9 @@ static const struct sock_filter preauth_
#ifdef __NR_pselect6
SC_ALLOW(__NR_pselect6),
#endif #endif
#ifdef __NR_pselect6_time64
SC_ALLOW(__NR_pselect6_time64),
+#endif
+#ifdef __NR_pselect6_time64 +#ifdef __NR_pselect6_time64
+ SC_ALLOW(__NR_pselect6_time64), + SC_ALLOW(__NR_pselect6_time64),
+#endif #endif
#ifdef __NR_read #ifdef __NR_read
SC_ALLOW(__NR_read), SC_ALLOW(__NR_read),
#endif

View File

@ -1,3 +1,362 @@
-------------------------------------------------------------------
Tue Sep 28 17:50:57 UTC 2021 - Hans Petter Jansson <hpj@suse.com>
- Version update to 8.8p1:
= Security
* sshd(8) from OpenSSH 6.2 through 8.7 failed to correctly initialise
supplemental groups when executing an AuthorizedKeysCommand or
AuthorizedPrincipalsCommand, where a AuthorizedKeysCommandUser or
AuthorizedPrincipalsCommandUser directive has been set to run the
command as a different user. Instead these commands would inherit
the groups that sshd(8) was started with.
Depending on system configuration, inherited groups may allow
AuthorizedKeysCommand/AuthorizedPrincipalsCommand helper programs to
gain unintended privilege.
Neither AuthorizedKeysCommand nor AuthorizedPrincipalsCommand are
enabled by default in sshd_config(5).
= Potentially-incompatible changes
* This release disables RSA signatures using the SHA-1 hash algorithm
by default. This change has been made as the SHA-1 hash algorithm is
cryptographically broken, and it is possible to create chosen-prefix
hash collisions for <USD$50K.
For most users, this change should be invisible and there is
no need to replace ssh-rsa keys. OpenSSH has supported RFC8332
RSA/SHA-256/512 signatures since release 7.2 and existing ssh-rsa keys
will automatically use the stronger algorithm where possible.
Incompatibility is more likely when connecting to older SSH
implementations that have not been upgraded or have not closely tracked
improvements in the SSH protocol. For these cases, it may be necessary
to selectively re-enable RSA/SHA1 to allow connection and/or user
authentication via the HostkeyAlgorithms and PubkeyAcceptedAlgorithms
options.
= New features
* ssh(1): allow the ssh_config(5) CanonicalizePermittedCNAMEs
directive to accept a "none" argument to specify the default
behaviour.
= Bugfixes
* scp(1): when using the SFTP protocol, continue transferring files
after a transfer error occurs, better matching original scp/rcp
behaviour.
* ssh(1): fixed a number of memory leaks in multiplexing,
* ssh-keygen(1): avoid crash when using the -Y find-principals
command.
* A number of documentation and manual improvements, including
bz#3340, PR139, PR215, PR241, PR257
- Additional changes from 8.7p1 release:
= Potentially-incompatible changes
* scp(1): this release changes the behaviour of remote to remote
copies (e.g. "scp host-a:/path host-b:") to transfer through the
local host by default. This was previously available via the -3
flag. This mode avoids the need to expose credentials on the
origin hop, avoids triplicate interpretation of filenames by the
shell (by the local system, the copy origin and the destination)
and, in conjunction with the SFTP support for scp(1) mentioned
below, allows use of all authentication methods to the remote
hosts (previously, only non-interactive methods could be used).
A -R flag has been added to select the old behaviour.
* ssh(1)/sshd(8): both the client and server are now using a
stricter configuration file parser. The new parser uses more
shell-like rules for quotes, space and escape characters. It is
also more strict in rejecting configurations that include options
lacking arguments. Previously some options (e.g. DenyUsers) could
appear on a line with no subsequent arguments. This release will
reject such configurations. The new parser will also reject
configurations with unterminated quotes and multiple '='
characters after the option name.
* ssh(1): when using SSHFP DNS records for host key verification,
ssh(1) will verify all matching records instead of just those
with the specific signature type requested. This may cause host
key verification problems if stale SSHFP records of a different
or legacy signature type exist alongside other records for a
particular host. bz#3322
* ssh-keygen(1): when generating a FIDO key and specifying an
explicit attestation challenge (using -Ochallenge), the challenge
will now be hashed by the builtin security key middleware. This
removes the (undocumented) requirement that challenges be exactly
32 bytes in length and matches the expectations of libfido2.
* sshd(8): environment="..." directives in authorized_keys files are
now first-match-wins and limited to 1024 discrete environment
variable names.
= New features
* scp(1): experimental support for transfers using the SFTP protocol
as a replacement for the venerable SCP/RCP protocol that it has
traditionally used. SFTP offers more predictable filename handling
and does not require expansion of glob(3) patterns via the shell
on the remote side.
* sftp-server(8): add a protocol extension to support expansion of
~/ and ~user/ prefixed paths. This was added to support these
paths when used by scp(1) while in SFTP mode.
* ssh(1): add a ForkAfterAuthentication ssh_config(5) counterpart to
the ssh(1) -f flag. GHPR231
* ssh(1): add a StdinNull directive to ssh_config(5) that allows the
config file to do the same thing as -n does on the ssh(1) command-
line. GHPR231
* ssh(1): add a SessionType directive to ssh_config, allowing the
configuration file to offer equivalent control to the -N (no
session) and -s (subsystem) command-line flags. GHPR231
* ssh-keygen(1): allowed signers files used by ssh-keygen(1)
signatures now support listing key validity intervals alongside
they key, and ssh-keygen(1) can optionally check during signature
verification whether a specified time falls inside this interval.
This feature is intended for use by git to support signing and
verifying objects using ssh keys.
* ssh-keygen(8): support printing of the full public key in a sshsig
signature via a -Oprint-pubkey flag.
= Bugfixes
* ssh(1)/sshd(8): start time-based re-keying exactly on schedule in
the client and server mainloops. Previously the re-key timeout
could expire but re-keying would not start until a packet was sent
or received, causing a spin in select() if the connection was
quiescent.
* ssh-keygen(1): avoid Y2038 problem in printing certificate
validity lifetimes. Dates past 2^31-1 seconds since epoch were
displayed incorrectly on some platforms. bz#3329
* scp(1): allow spaces to appear in usernames for local to remote
and scp -3 remote to remote copies. bz#1164
* ssh(1)/sshd(8): remove references to ChallengeResponseAuthentication
in favour of KbdInteractiveAuthentication. The former is what was in
SSHv1, the latter is what is in SSHv2 (RFC4256) and they were
treated as somewhat but not entirely equivalent. We retain the old
name as a deprecated alias so configuration files continue to work
as well as a reference in the man page for people looking for it.
bz#3303
* ssh(1)/ssh-add(1)/ssh-keygen(1): fix decoding of X.509 subject name
when extracting a key from a PKCS#11 certificate. bz#3327
* ssh(1): restore blocking status on stdio fds before close. ssh(1)
needs file descriptors in non-blocking mode to operate but it was
not restoring the original state on exit. This could cause
problems with fds shared with other programs via the shell,
bz#3280 and GHPR246
* ssh(1)/sshd(8): switch both client and server mainloops from
select(3) to pselect(3). Avoids race conditions where a signal
may arrive immediately before select(3) and not be processed until
an event fires. bz#2158
* ssh(1): sessions started with ControlPersist were incorrectly
executing a shell when the -N (no shell) option was specified.
bz#3290
* ssh(1): check if IPQoS or TunnelDevice are already set before
overriding. Prevents values in config files from overriding values
supplied on the command line. bz#3319
* ssh(1): fix debug message when finding a private key to match a
certificate being attempted for user authentication. Previously it
would print the certificate's path, whereas it was supposed to be
showing the private key's path. GHPR247
* sshd(8): match host certificates against host public keys, not
private keys. Allows use of certificates with private keys held in
a ssh-agent. bz#3524
* ssh(1): add a workaround for a bug in OpenSSH 7.4 sshd(8), which
allows RSA/SHA2 signatures for public key authentication but fails
to advertise this correctly via SSH2_MSG_EXT_INFO. This causes
clients of these server to incorrectly match
PubkeyAcceptedAlgorithmse and potentially refuse to offer valid
keys. bz#3213
* sftp(1)/scp(1): degrade gracefully if a sftp-server offers the
limits@openssh.com extension but fails when the client tries to
invoke it. bz#3318
* ssh(1): allow ssh_config SetEnv to override $TERM, which is
otherwise handled specially by the protocol. Useful in ~/.ssh/config
to set TERM to something generic (e.g. "xterm" instead of
"xterm-256color") for destinations that lack terminfo entries.
* sftp-server(8): the limits@openssh.com extension was incorrectly
marked as an operation that writes to the filesystem, which made it
unavailable in sftp-server read-only mode. bz#3318
* ssh(1): fix SEGV in UpdateHostkeys debug() message, triggered when
the update removed more host keys than remain present.
* Many manual page fixes.
- Additional changes from 8.6p1 release:
= Security
* sshd(8): OpenSSH 8.5 introduced the LogVerbose keyword. When this
option was enabled with a set of patterns that activated logging
in code that runs in the low-privilege sandboxed sshd process, the
log messages were constructed in such a way that printf(3) format
strings could effectively be specified the low-privilege code.
= New features
* sftp-server(8): add a new limits@openssh.com protocol extension
that allows a client to discover various server limits, including
maximum packet size and maximum read/write length.
* sftp(1): use the new limits@openssh.com extension (when available)
to select better transfer lengths in the client.
* sshd(8): Add ModuliFile keyword to sshd_config to specify the
location of the "moduli" file containing the groups for DH-GEX.
* unit tests: Add a TEST_SSH_ELAPSED_TIMES environment variable to
enable printing of the elapsed time in seconds of each test.
= Bugfixes
* ssh_config(5), sshd_config(5): sync CASignatureAlgorithms lists in
manual pages with the current default. GHPR174
* ssh(1): ensure that pkcs11_del_provider() is called before exit.
GHPR234
* ssh(1), sshd(8): fix problems in string->argv conversion. Multiple
backslashes were not being dequoted correctly and quoted space in
the middle of a string was being incorrectly split. GHPR223
* ssh(1): return non-zero exit status when killed by signal; bz#3281
* sftp-server(8): increase maximum SSH2_FXP_READ to match the maximum
packet size. Also handle zero-length reads that are not explicitly
banned by the spec.
- Additional changes from 8.5p1 release:
= Security
* ssh-agent(1): fixed a double-free memory corruption that was
introduced in OpenSSH 8.2 . We treat all such memory faults as
potentially exploitable. This bug could be reached by an attacker
with access to the agent socket.
= Potentially-incompatible changes
* ssh(1), sshd(8): this release changes the first-preference signature
algorithm from ECDSA to ED25519.
* ssh(1), sshd(8): set the TOS/DSCP specified in the configuration
for interactive use prior to TCP connect. The connection phase of
the SSH session is time-sensitive and often explicitly interactive.
The ultimate interactive/bulk TOS/DSCP will be set after
authentication completes.
* ssh(1), sshd(8): remove the pre-standardization cipher
rijndael-cbc@lysator.liu.se. It is an alias for aes256-cbc before
it was standardized in RFC4253 (2006), has been deprecated and
disabled by default since OpenSSH 7.2 (2016) and was only briefly
documented in ssh.1 in 2001.
* ssh(1), sshd(8): update/replace the experimental post-quantum
hybrid key exchange method based on Streamlined NTRU Prime coupled
with X25519. The previous sntrup4591761x25519-sha512@tinyssh.org
method is replaced with sntrup761x25519-sha512@openssh.com.
* ssh(1): disable CheckHostIP by default. It provides insignificant
benefits while making key rotation significantly more difficult,
especially for hosts behind IP-based load-balancers.
= New features
* ssh(1): this release enables UpdateHostkeys by default subject to
some conservative preconditions:
- The key was matched in the UserKnownHostsFile (and not in the
GlobalKnownHostsFile).
- The same key does not exist under another name.
- A certificate host key is not in use.
- known_hosts contains no matching wildcard hostname pattern.
- VerifyHostKeyDNS is not enabled.
- The default UserKnownHostsFile is in use.
* ssh(1), sshd(8): add a new LogVerbose configuration directive for
that allows forcing maximum debug logging by file/function/line
pattern-lists.
* ssh(1): when prompting the user to accept a new hostkey, display
any other host names/addresses already associated with the key.
* ssh(1): allow UserKnownHostsFile=none to indicate that no
known_hosts file should be used to identify host keys.
* ssh(1): add a ssh_config KnownHostsCommand option that allows the
client to obtain known_hosts data from a command in addition to
the usual files.
* ssh(1): add a ssh_config PermitRemoteOpen option that allows the
client to restrict the destination when RemoteForward is used
with SOCKS.
* ssh(1): for FIDO keys, if a signature operation fails with a
"incorrect PIN" reason and no PIN was initially requested from the
user, then request a PIN and retry the operation. This supports
some biometric devices that fall back to requiring PIN when reading
of the biometric failed, and devices that require PINs for all
hosted credentials.
* sshd(8): implement client address-based rate-limiting via new
sshd_config(5) PerSourceMaxStartups and PerSourceNetBlockSize
directives that provide more fine-grained control on a per-origin
address basis than the global MaxStartups limit.
= Bugfixes
* ssh(1): Prefix keyboard interactive prompts with "(user@host)" to
make it easier to determine which connection they are associated
with in cases like scp -3, ProxyJump, etc. bz#3224
* sshd(8): fix sshd_config SetEnv directives located inside Match
blocks. GHPR201
* ssh(1): when requesting a FIDO token touch on stderr, inform the
user once the touch has been recorded.
* ssh(1): prevent integer overflow when ridiculously large
ConnectTimeout values are specified, capping the effective value
(for most platforms) at 24 days. bz#3229
* ssh(1): consider the ECDSA key subtype when ordering host key
algorithms in the client.
* ssh(1), sshd(8): rename the PubkeyAcceptedKeyTypes keyword to
PubkeyAcceptedAlgorithms. The previous name incorrectly suggested
that it control allowed key algorithms, when this option actually
specifies the signature algorithms that are accepted. The previous
name remains available as an alias. bz#3253
* ssh(1), sshd(8): similarly, rename HostbasedKeyTypes (ssh) and
HostbasedAcceptedKeyTypes (sshd) to HostbasedAcceptedAlgorithms.
* sftp-server(8): add missing lsetstat@openssh.com documentation
and advertisement in the server's SSH2_FXP_VERSION hello packet.
* ssh(1), sshd(8): more strictly enforce KEX state-machine by
banning packet types once they are received. Fixes memleak caused
by duplicate SSH2_MSG_KEX_DH_GEX_REQUEST (oss-fuzz #30078).
* sftp(1): allow the full range of UIDs/GIDs for chown/chgrp on 32bit
platforms instead of being limited by LONG_MAX. bz#3206
* Minor man page fixes (capitalization, commas, etc.) bz#3223
* sftp(1): when doing an sftp recursive upload or download of a
read-only directory, ensure that the directory is created with
write and execute permissions in the interim so that the transfer
can actually complete, then set the directory permission as the
final step. bz#3222
* ssh-keygen(1): document the -Z, check the validity of its argument
earlier and provide a better error message if it's not correct.
bz#2879
* ssh(1): ignore comments at the end of config lines in ssh_config,
similar to what we already do for sshd_config. bz#2320
* sshd_config(5): mention that DisableForwarding is valid in a
sshd_config Match block. bz3239
* sftp(1): fix incorrect sorting of "ls -ltr" under some
circumstances. bz3248.
* ssh(1), sshd(8): fix potential integer truncation of (unlikely)
timeout values. bz#3250
* ssh(1): make hostbased authentication send the signature algorithm
in its SSH2_MSG_USERAUTH_REQUEST packets instead of the key type.
This make HostbasedAcceptedAlgorithms do what it is supposed to -
filter on signature algorithm and not key type.
- Rebased patches:
* openssh-7.7p1-IPv6_X_forwarding.patch
* openssh-7.7p1-X11_trusted_forwarding.patch
* openssh-7.7p1-X_forward_with_disabled_ipv6.patch
* openssh-7.7p1-cavstest-ctr.patch
* openssh-7.7p1-cavstest-kdf.patch
* openssh-7.7p1-disable_openssl_abi_check.patch
* openssh-7.7p1-eal3.patch
* openssh-7.7p1-enable_PAM_by_default.patch
* openssh-7.7p1-fips.patch
* openssh-7.7p1-fips_checks.patch
* openssh-7.7p1-host_ident.patch
* openssh-7.7p1-hostname_changes_when_forwarding_X.patch
* openssh-7.7p1-ldap.patch
* openssh-7.7p1-no_fork-no_pid_file.patch
* openssh-7.7p1-pam_check_locks.patch
* openssh-7.7p1-pts_names_formatting.patch
* openssh-7.7p1-remove_xauth_cookies_on_exit.patch
* openssh-7.7p1-seccomp_ipc_flock.patch
* openssh-7.7p1-seccomp_stat.patch
* openssh-7.7p1-send_locale.patch
* openssh-7.7p1-sftp_force_permissions.patch
* openssh-7.7p1-sftp_print_diagnostic_messages.patch
* openssh-7.7p1-systemd-notify.patch
* openssh-7.9p1-keygen-preserve-perms.patch
* openssh-7.9p1-revert-new-qos-defaults.patch
* openssh-8.0p1-gssapi-keyex.patch
* openssh-8.1p1-audit.patch
* openssh-8.1p1-seccomp-clock_gettime64.patch
* openssh-8.1p1-seccomp-clock_nanosleep.patch
* openssh-8.1p1-seccomp-clock_nanosleep_time64.patch
* openssh-8.1p1-use-openssl-kdf.patch
* openssh-8.4p1-vendordir.patch
* openssh-fips-ensure-approved-moduli.patch
* openssh-link-with-sk.patch
* openssh-reenable-dh-group14-sha1-default.patch
* openssh-whitelist-syscalls.patch
- Removed openssh-fix-ssh-copy-id.patch (fixed upstream).
------------------------------------------------------------------- -------------------------------------------------------------------
Thu Aug 19 10:07:10 UTC 2021 - Thorsten Kukuk <kukuk@suse.com> Thu Aug 19 10:07:10 UTC 2021 - Thorsten Kukuk <kukuk@suse.com>

View File

@ -35,7 +35,7 @@
%define _fillupdir %{_localstatedir}/adm/fillup-templates %define _fillupdir %{_localstatedir}/adm/fillup-templates
%endif %endif
Name: openssh Name: openssh
Version: 8.4p1 Version: 8.8p1
Release: 0 Release: 0
Summary: Secure Shell Client and Server (Remote Login Program) Summary: Secure Shell Client and Server (Remote Login Program)
License: BSD-2-Clause AND MIT License: BSD-2-Clause AND MIT
@ -105,7 +105,6 @@ Patch40: openssh-8.1p1-ed25519-use-openssl-rng.patch
Patch41: openssh-fips-ensure-approved-moduli.patch Patch41: openssh-fips-ensure-approved-moduli.patch
Patch42: openssh-link-with-sk.patch Patch42: openssh-link-with-sk.patch
Patch43: openssh-reenable-dh-group14-sha1-default.patch Patch43: openssh-reenable-dh-group14-sha1-default.patch
Patch44: openssh-fix-ssh-copy-id.patch
Patch45: openssh-8.4p1-ssh_config_d.patch Patch45: openssh-8.4p1-ssh_config_d.patch
Patch46: openssh-whitelist-syscalls.patch Patch46: openssh-whitelist-syscalls.patch
Patch47: openssh-8.4p1-vendordir.patch Patch47: openssh-8.4p1-vendordir.patch