Accepting request 922068 from home:hpjansson:branches:network

- Version upgrade to 8.8p1
  * No changes for askpass, see main package changelog for
    details

- Version update to 8.8p1:
  = Security
  * sshd(8) from OpenSSH 6.2 through 8.7 failed to correctly initialise
    supplemental groups when executing an AuthorizedKeysCommand or
    AuthorizedPrincipalsCommand, where a AuthorizedKeysCommandUser or
    AuthorizedPrincipalsCommandUser directive has been set to run the
    command as a different user. Instead these commands would inherit
    the groups that sshd(8) was started with.
    Depending on system configuration, inherited groups may allow
    AuthorizedKeysCommand/AuthorizedPrincipalsCommand helper programs to
    gain unintended privilege.
    Neither AuthorizedKeysCommand nor AuthorizedPrincipalsCommand are
    enabled by default in sshd_config(5).
  = Potentially-incompatible changes
  * This release disables RSA signatures using the SHA-1 hash algorithm
    by default. This change has been made as the SHA-1 hash algorithm is
    cryptographically broken, and it is possible to create chosen-prefix
    hash collisions for <USD$50K.
    For most users, this change should be invisible and there is
    no need to replace ssh-rsa keys. OpenSSH has supported RFC8332
    RSA/SHA-256/512 signatures since release 7.2 and existing ssh-rsa keys
    will automatically use the stronger algorithm where possible.
    Incompatibility is more likely when connecting to older SSH
    implementations that have not been upgraded or have not closely tracked
    improvements in the SSH protocol. For these cases, it may be necessary
    to selectively re-enable RSA/SHA1 to allow connection and/or user
    authentication via the HostkeyAlgorithms and PubkeyAcceptedAlgorithms
    options.
  = New features
  * ssh(1): allow the ssh_config(5) CanonicalizePermittedCNAMEs
    directive to accept a "none" argument to specify the default
    behaviour.
  = Bugfixes
  * scp(1): when using the SFTP protocol, continue transferring files
    after a transfer error occurs, better matching original scp/rcp
    behaviour.
  * ssh(1): fixed a number of memory leaks in multiplexing,
  * ssh-keygen(1): avoid crash when using the -Y find-principals
    command.
  * A number of documentation and manual improvements, including
    bz#3340, PR139, PR215, PR241, PR257
- Additional changes from 8.7p1 release:
  = Potentially-incompatible changes
  * scp(1): this release changes the behaviour of remote to remote
    copies (e.g. "scp host-a:/path host-b:") to transfer through the
    local host by default. This was previously available via the -3
    flag. This mode avoids the need to expose credentials on the
    origin hop, avoids triplicate interpretation of filenames by the
    shell (by the local system, the copy origin and the destination)
    and, in conjunction with the SFTP support for scp(1) mentioned
    below, allows use of all authentication methods to the remote
    hosts (previously, only non-interactive methods could be used).
    A -R flag has been added to select the old behaviour.
  * ssh(1)/sshd(8): both the client and server are now using a
    stricter configuration file parser. The new parser uses more
    shell-like rules for quotes, space and escape characters. It is
    also more strict in rejecting configurations that include options
    lacking arguments. Previously some options (e.g. DenyUsers) could
    appear on a line with no subsequent arguments. This release will
    reject such configurations. The new parser will also reject
    configurations with unterminated quotes and multiple '='
    characters after the option name.
  * ssh(1): when using SSHFP DNS records for host key verification,
    ssh(1) will verify all matching records instead of just those
    with the specific signature type requested. This may cause host
    key verification problems if stale SSHFP records of a different
    or legacy signature type exist alongside other records for a
    particular host. bz#3322
  * ssh-keygen(1): when generating a FIDO key and specifying an
    explicit attestation challenge (using -Ochallenge), the challenge
    will now be hashed by the builtin security key middleware. This
    removes the (undocumented) requirement that challenges be exactly
    32 bytes in length and matches the expectations of libfido2.
  * sshd(8): environment="..." directives in authorized_keys files are
    now first-match-wins and limited to 1024 discrete environment
    variable names.
  = New features
  * scp(1): experimental support for transfers using the SFTP protocol
    as a replacement for the venerable SCP/RCP protocol that it has
    traditionally used. SFTP offers more predictable filename handling
    and does not require expansion of glob(3) patterns via the shell
    on the remote side.
  * sftp-server(8): add a protocol extension to support expansion of
    ~/ and ~user/ prefixed paths. This was added to support these
    paths when used by scp(1) while in SFTP mode.
  * ssh(1): add a ForkAfterAuthentication ssh_config(5) counterpart to
    the ssh(1) -f flag. GHPR231
  * ssh(1): add a StdinNull directive to ssh_config(5) that allows the
    config file to do the same thing as -n does on the ssh(1) command-
    line. GHPR231
  * ssh(1): add a SessionType directive to ssh_config, allowing the
    configuration file to offer equivalent control to the -N (no
    session) and -s (subsystem) command-line flags. GHPR231
  * ssh-keygen(1): allowed signers files used by ssh-keygen(1)
    signatures now support listing key validity intervals alongside
    they key, and ssh-keygen(1) can optionally check during signature
    verification whether a specified time falls inside this interval.
    This feature is intended for use by git to support signing and
    verifying objects using ssh keys.
  * ssh-keygen(8): support printing of the full public key in a sshsig
    signature via a -Oprint-pubkey flag.
  = Bugfixes
  * ssh(1)/sshd(8): start time-based re-keying exactly on schedule in
    the client and server mainloops. Previously the re-key timeout
    could expire but re-keying would not start until a packet was sent
    or received, causing a spin in select() if the connection was
    quiescent.
  * ssh-keygen(1): avoid Y2038 problem in printing certificate
    validity lifetimes. Dates past 2^31-1 seconds since epoch were
    displayed incorrectly on some platforms. bz#3329
  * scp(1): allow spaces to appear in usernames for local to remote
    and scp -3 remote to remote copies. bz#1164
  * ssh(1)/sshd(8): remove references to ChallengeResponseAuthentication
    in favour of KbdInteractiveAuthentication. The former is what was in
    SSHv1, the latter is what is in SSHv2 (RFC4256) and they were
    treated as somewhat but not entirely equivalent. We retain the old
    name as a deprecated alias so configuration files continue to work
    as well as a reference in the man page for people looking for it.
    bz#3303
  * ssh(1)/ssh-add(1)/ssh-keygen(1): fix decoding of X.509 subject name
    when extracting a key from a PKCS#11 certificate. bz#3327
  * ssh(1): restore blocking status on stdio fds before close. ssh(1)
    needs file descriptors in non-blocking mode to operate but it was
    not restoring the original state on exit. This could cause
    problems with fds shared with other programs via the shell,
    bz#3280 and GHPR246
  * ssh(1)/sshd(8): switch both client and server mainloops from
    select(3) to pselect(3). Avoids race conditions where a signal
    may arrive immediately before select(3) and not be processed until
    an event fires. bz#2158
  * ssh(1): sessions started with ControlPersist were incorrectly
    executing a shell when the -N (no shell) option was specified.
    bz#3290
  * ssh(1): check if IPQoS or TunnelDevice are already set before
    overriding. Prevents values in config files from overriding values
    supplied on the command line. bz#3319
  * ssh(1): fix debug message when finding a private key to match a
    certificate being attempted for user authentication. Previously it
    would print the certificate's path, whereas it was supposed to be
    showing the private key's path. GHPR247
  * sshd(8): match host certificates against host public keys, not
    private keys. Allows use of certificates with private keys held in
    a ssh-agent.  bz#3524
  * ssh(1): add a workaround for a bug in OpenSSH 7.4 sshd(8), which
    allows RSA/SHA2 signatures for public key authentication but fails
    to advertise this correctly via SSH2_MSG_EXT_INFO. This causes
    clients of these server to incorrectly match
    PubkeyAcceptedAlgorithmse and potentially refuse to offer valid
    keys. bz#3213
  * sftp(1)/scp(1): degrade gracefully if a sftp-server offers the
    limits@openssh.com extension but fails when the client tries to
    invoke it. bz#3318
  * ssh(1): allow ssh_config SetEnv to override $TERM, which is
    otherwise handled specially by the protocol. Useful in ~/.ssh/config
    to set TERM to something generic (e.g. "xterm" instead of
    "xterm-256color") for destinations that lack terminfo entries.
  * sftp-server(8): the limits@openssh.com extension was incorrectly
    marked as an operation that writes to the filesystem, which made it
    unavailable in sftp-server read-only mode. bz#3318
  * ssh(1): fix SEGV in UpdateHostkeys debug() message, triggered when
    the update removed more host keys than remain present.
  * Many manual page fixes.
- Additional changes from 8.6p1 release:
  = Security
  * sshd(8): OpenSSH 8.5 introduced the LogVerbose keyword. When this
    option was enabled with a set of patterns that activated logging
    in code that runs in the low-privilege sandboxed sshd process, the
    log messages were constructed in such a way that printf(3) format
    strings could effectively be specified the low-privilege code.
  = New features
  * sftp-server(8): add a new limits@openssh.com protocol extension
    that allows a client to discover various server limits, including
    maximum packet size and maximum read/write length.
  * sftp(1): use the new limits@openssh.com extension (when available)
    to select better transfer lengths in the client.
  * sshd(8): Add ModuliFile keyword to sshd_config to specify the
    location of the "moduli" file containing the groups for DH-GEX.
  * unit tests: Add a TEST_SSH_ELAPSED_TIMES environment variable to
    enable printing of the elapsed time in seconds of each test.
  = Bugfixes
  * ssh_config(5), sshd_config(5): sync CASignatureAlgorithms lists in
    manual pages with the current default. GHPR174
  * ssh(1): ensure that pkcs11_del_provider() is called before exit.
    GHPR234
  * ssh(1), sshd(8): fix problems in string->argv conversion. Multiple
    backslashes were not being dequoted correctly and quoted space in
    the middle of a string was being incorrectly split. GHPR223
  * ssh(1): return non-zero exit status when killed by signal; bz#3281
  * sftp-server(8): increase maximum SSH2_FXP_READ to match the maximum
    packet size. Also handle zero-length reads that are not explicitly
    banned by the spec.
- Additional changes from 8.5p1 release:
  = Security
  * ssh-agent(1): fixed a double-free memory corruption that was
    introduced in OpenSSH 8.2 . We treat all such memory faults as
    potentially exploitable. This bug could be reached by an attacker
    with access to the agent socket.
  = Potentially-incompatible changes
  * ssh(1), sshd(8): this release changes the first-preference signature
    algorithm from ECDSA to ED25519.
  * ssh(1), sshd(8): set the TOS/DSCP specified in the configuration
    for interactive use prior to TCP connect. The connection phase of
    the SSH session is time-sensitive and often explicitly interactive.
    The ultimate interactive/bulk TOS/DSCP will be set after
    authentication completes.
  * ssh(1), sshd(8): remove the pre-standardization cipher
    rijndael-cbc@lysator.liu.se. It is an alias for aes256-cbc before
    it was standardized in RFC4253 (2006), has been deprecated and
    disabled by default since OpenSSH 7.2 (2016) and was only briefly
    documented in ssh.1 in 2001.
  * ssh(1), sshd(8): update/replace the experimental post-quantum
    hybrid key exchange method based on Streamlined NTRU Prime coupled
    with X25519. The previous sntrup4591761x25519-sha512@tinyssh.org
    method is replaced with sntrup761x25519-sha512@openssh.com.
  * ssh(1): disable CheckHostIP by default. It provides insignificant
    benefits while making key rotation significantly more difficult,
    especially for hosts behind IP-based load-balancers.
  = New features
  * ssh(1): this release enables UpdateHostkeys by default subject to
    some conservative preconditions:
    - The key was matched in the UserKnownHostsFile (and not in the
      GlobalKnownHostsFile).
    - The same key does not exist under another name.
    - A certificate host key is not in use.
    - known_hosts contains no matching wildcard hostname pattern.
    - VerifyHostKeyDNS is not enabled.
    - The default UserKnownHostsFile is in use.
  * ssh(1), sshd(8): add a new LogVerbose configuration directive for
    that allows forcing maximum debug logging by file/function/line
    pattern-lists.
  * ssh(1): when prompting the user to accept a new hostkey, display
    any other host names/addresses already associated with the key.
  * ssh(1): allow UserKnownHostsFile=none to indicate that no
    known_hosts file should be used to identify host keys.
  * ssh(1): add a ssh_config KnownHostsCommand option that allows the
    client to obtain known_hosts data from a command in addition to
    the usual files.
  * ssh(1): add a ssh_config PermitRemoteOpen option that allows the
    client to restrict the destination when RemoteForward is used
    with SOCKS.
  * ssh(1): for FIDO keys, if a signature operation fails with a
    "incorrect PIN" reason and no PIN was initially requested from the
    user, then request a PIN and retry the operation. This supports
    some biometric devices that fall back to requiring PIN when reading
    of the biometric failed, and devices that require PINs for all
    hosted credentials.
  * sshd(8): implement client address-based rate-limiting via new
    sshd_config(5) PerSourceMaxStartups and PerSourceNetBlockSize
    directives that provide more fine-grained control on a per-origin
    address basis than the global MaxStartups limit.
  = Bugfixes
   * ssh(1): Prefix keyboard interactive prompts with "(user@host)" to
   make it easier to determine which connection they are associated
   with in cases like scp -3, ProxyJump, etc. bz#3224
  * sshd(8): fix sshd_config SetEnv directives located inside Match
    blocks. GHPR201
  * ssh(1): when requesting a FIDO token touch on stderr, inform the
    user once the touch has been recorded.
  * ssh(1): prevent integer overflow when ridiculously large
    ConnectTimeout values are specified, capping the effective value
    (for most platforms) at 24 days. bz#3229
  * ssh(1): consider the ECDSA key subtype when ordering host key
    algorithms in the client.
  * ssh(1), sshd(8): rename the PubkeyAcceptedKeyTypes keyword to
    PubkeyAcceptedAlgorithms. The previous name incorrectly suggested
    that it control allowed key algorithms, when this option actually
    specifies the signature algorithms that are accepted. The previous
    name remains available as an alias. bz#3253
  * ssh(1), sshd(8): similarly, rename HostbasedKeyTypes (ssh) and
    HostbasedAcceptedKeyTypes (sshd) to HostbasedAcceptedAlgorithms.
  * sftp-server(8): add missing lsetstat@openssh.com documentation
    and advertisement in the server's SSH2_FXP_VERSION hello packet.
  * ssh(1), sshd(8): more strictly enforce KEX state-machine by
    banning packet types once they are received. Fixes memleak caused
    by duplicate SSH2_MSG_KEX_DH_GEX_REQUEST (oss-fuzz #30078).
  * sftp(1): allow the full range of UIDs/GIDs for chown/chgrp on 32bit
    platforms instead of being limited by LONG_MAX. bz#3206
  * Minor man page fixes (capitalization, commas, etc.) bz#3223
  * sftp(1): when doing an sftp recursive upload or download of a
    read-only directory, ensure that the directory is created with
    write and execute permissions in the interim so that the transfer
    can actually complete, then set the directory permission as the
    final step. bz#3222
  * ssh-keygen(1): document the -Z, check the validity of its argument
    earlier and provide a better error message if it's not correct.
    bz#2879
  * ssh(1): ignore comments at the end of config lines in ssh_config,
    similar to what we already do for sshd_config. bz#2320
  * sshd_config(5): mention that DisableForwarding is valid in a
    sshd_config Match block. bz3239
  * sftp(1): fix incorrect sorting of "ls -ltr" under some
    circumstances. bz3248.
  * ssh(1), sshd(8): fix potential integer truncation of (unlikely)
    timeout values. bz#3250
  * ssh(1): make hostbased authentication send the signature algorithm
    in its SSH2_MSG_USERAUTH_REQUEST packets instead of the key type.
    This make HostbasedAcceptedAlgorithms do what it is supposed to -
    filter on signature algorithm and not key type.
- Rebased patches:
  * openssh-7.7p1-IPv6_X_forwarding.patch
  * openssh-7.7p1-X11_trusted_forwarding.patch
  * openssh-7.7p1-X_forward_with_disabled_ipv6.patch
  * openssh-7.7p1-cavstest-ctr.patch
  * openssh-7.7p1-cavstest-kdf.patch
  * openssh-7.7p1-disable_openssl_abi_check.patch
  * openssh-7.7p1-eal3.patch
  * openssh-7.7p1-enable_PAM_by_default.patch
  * openssh-7.7p1-fips.patch
  * openssh-7.7p1-fips_checks.patch
  * openssh-7.7p1-host_ident.patch
  * openssh-7.7p1-hostname_changes_when_forwarding_X.patch
  * openssh-7.7p1-ldap.patch
  * openssh-7.7p1-no_fork-no_pid_file.patch
  * openssh-7.7p1-pam_check_locks.patch
  * openssh-7.7p1-pts_names_formatting.patch
  * openssh-7.7p1-remove_xauth_cookies_on_exit.patch
  * openssh-7.7p1-seccomp_ipc_flock.patch
  * openssh-7.7p1-seccomp_stat.patch
  * openssh-7.7p1-send_locale.patch
  * openssh-7.7p1-sftp_force_permissions.patch
  * openssh-7.7p1-sftp_print_diagnostic_messages.patch
  * openssh-7.7p1-systemd-notify.patch
  * openssh-7.9p1-keygen-preserve-perms.patch
  * openssh-7.9p1-revert-new-qos-defaults.patch
  * openssh-8.0p1-gssapi-keyex.patch
  * openssh-8.1p1-audit.patch
  * openssh-8.1p1-seccomp-clock_gettime64.patch
  * openssh-8.1p1-seccomp-clock_nanosleep.patch
  * openssh-8.1p1-seccomp-clock_nanosleep_time64.patch
  * openssh-8.1p1-use-openssl-kdf.patch
  * openssh-8.4p1-vendordir.patch
  * openssh-fips-ensure-approved-moduli.patch
  * openssh-link-with-sk.patch
  * openssh-reenable-dh-group14-sha1-default.patch
  * openssh-whitelist-syscalls.patch
- Removed openssh-fix-ssh-copy-id.patch (fixed upstream).

OBS-URL: https://build.opensuse.org/request/show/922068
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=235
This commit is contained in:
Marcus Meissner 2021-10-07 08:06:58 +00:00 committed by Git OBS Bridge
parent 34c2098366
commit 3fed02069e
45 changed files with 1387 additions and 1195 deletions

View File

@ -5,15 +5,11 @@ Correctly parse DISPLAY variable for cases where it contains an IPv6 address
bnc#847710 - https://bugzilla.novell.com/show_bug.cgi?id=847710
diff --git a/openssh-7.7p1/channels.c b/openssh-7.7p1/channels.c
--- openssh-7.7p1/channels.c
+++ openssh-7.7p1/channels.c
@@ -4590,33 +4590,42 @@ x11_connect_display(struct ssh *ssh)
return -1;
/* OK, we now have a connection to the display. */
return sock;
}
Index: openssh-8.8p1/channels.c
===================================================================
--- openssh-8.8p1.orig/channels.c
+++ openssh-8.8p1/channels.c
@@ -4776,9 +4776,10 @@ x11_connect_display(struct ssh *ssh)
/*
* Connect to an inet socket. The DISPLAY value is supposedly
* hostname:d[.s], where hostname may also be numeric IP address.
@ -25,14 +21,7 @@ diff --git a/openssh-7.7p1/channels.c b/openssh-7.7p1/channels.c
if (!cp) {
error("Could not find ':' in DISPLAY: %.100s", display);
return -1;
}
*cp = 0;
/*
* buf now contains the host name. But first we parse the
* display number.
*/
if (sscanf(cp + 1, "%u", &display_number) != 1) {
error("Could not parse display number from DISPLAY: %.100s",
@@ -4793,6 +4794,14 @@ x11_connect_display(struct ssh *ssh)
display);
return -1;
}
@ -47,8 +36,3 @@ diff --git a/openssh-7.7p1/channels.c b/openssh-7.7p1/channels.c
/* Look up the host address */
memset(&hints, 0, sizeof(hints));
hints.ai_family = ssh->chanctxt->IPv4or6;
hints.ai_socktype = SOCK_STREAM;
snprintf(strport, sizeof strport, "%u", 6000 + display_number);
if ((gaierr = getaddrinfo(buf, strport, &hints, &aitop)) != 0) {
error("%.100s: unknown host. (%s)", buf,

View File

@ -6,10 +6,10 @@
Enable Trusted X11 forwarding by default, since the security benefits of
having it disabled are negligible these days with XI2 being widely used.
Index: openssh-7.8p1/ssh_config
Index: openssh-8.8p1/ssh_config
===================================================================
--- openssh-7.8p1.orig/ssh_config
+++ openssh-7.8p1/ssh_config
--- openssh-8.8p1.orig/ssh_config
+++ openssh-8.8p1/ssh_config
@@ -17,9 +17,20 @@
# list of available options, their meanings and defaults, please see the
# ssh_config(5) man page.
@ -32,10 +32,10 @@ Index: openssh-7.8p1/ssh_config
# PasswordAuthentication yes
# HostbasedAuthentication no
# GSSAPIAuthentication no
Index: openssh-7.8p1/sshd_config
Index: openssh-8.8p1/sshd_config
===================================================================
--- openssh-7.8p1.orig/sshd_config
+++ openssh-7.8p1/sshd_config
--- openssh-8.8p1.orig/sshd_config
+++ openssh-8.8p1/sshd_config
@@ -84,7 +84,7 @@ AuthorizedKeysFile .ssh/authorized_keys
#AllowAgentForwarding yes
#AllowTcpForwarding yes

View File

@ -3,13 +3,13 @@
Do not throw away already open sockets for X11 forwarding if another socket
family is not available for bind()
diff --git a/channels.c b/channels.c
index f51b7e3..95af47e 100644
--- a/channels.c
+++ b/channels.c
@@ -4637,6 +4637,13 @@ x11_create_display_inet(struct ssh *ssh, int x11_display_offset,
debug2("%s: bind port %d: %.100s", __func__,
port, strerror(errno));
Index: openssh-8.8p1/channels.c
===================================================================
--- openssh-8.8p1.orig/channels.c
+++ openssh-8.8p1/channels.c
@@ -4607,6 +4607,13 @@ x11_create_display_inet(struct ssh *ssh,
debug2_f("bind port %d: %.100s", port,
strerror(errno));
close(sock);
+ /* do not remove successfully opened sockets if
+ * the request failed because the protocol

View File

@ -2,11 +2,11 @@
# Parent cc1022edba2c5eeb0facba08468f65afc2466b63
CAVS test for OpenSSH's own CTR encryption mode implementation
Index: openssh-8.4p1/Makefile.in
Index: openssh-8.8p1/Makefile.in
===================================================================
--- openssh-8.4p1.orig/Makefile.in
+++ openssh-8.4p1/Makefile.in
@@ -25,6 +25,7 @@ SFTP_SERVER=$(libexecdir)/sftp-server
--- openssh-8.8p1.orig/Makefile.in
+++ openssh-8.8p1/Makefile.in
@@ -26,6 +26,7 @@ SFTP_SERVER=$(libexecdir)/sftp-server
SSH_KEYSIGN=$(libexecdir)/ssh-keysign
SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper
@ -14,7 +14,7 @@ Index: openssh-8.4p1/Makefile.in
PRIVSEP_PATH=@PRIVSEP_PATH@
SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
STRIP_OPT=@STRIP_OPT@
@@ -68,6 +69,8 @@ MKDIR_P=@MKDIR_P@
@@ -69,6 +70,8 @@ MKDIR_P=@MKDIR_P@
TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT)
@ -23,7 +23,7 @@ Index: openssh-8.4p1/Makefile.in
XMSS_OBJS=\
ssh-xmss.o \
sshkey-xmss.o \
@@ -242,6 +245,10 @@ sftp-server$(EXEEXT): $(LIBCOMPAT) libss
@@ -245,6 +248,10 @@ sftp-server$(EXEEXT): $(LIBCOMPAT) libss
sftp$(EXEEXT): $(LIBCOMPAT) libssh.a $(SFTP_OBJS)
$(LD) -o $@ $(SFTP_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LIBEDIT)
@ -34,7 +34,7 @@ Index: openssh-8.4p1/Makefile.in
# test driver for the loginrec code - not built by default
logintest: logintest.o $(LIBCOMPAT) libssh.a loginrec.o
$(LD) -o $@ logintest.o $(LDFLAGS) loginrec.o -lopenbsd-compat -lssh $(LIBS)
@@ -400,6 +407,7 @@ install-files:
@@ -407,6 +414,7 @@ install-files:
$(INSTALL) -m 0755 $(STRIP_OPT) ssh-sk-helper$(EXEEXT) $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT)
$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
@ -42,10 +42,10 @@ Index: openssh-8.4p1/Makefile.in
$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
$(INSTALL) -m 644 scp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
$(INSTALL) -m 644 ssh-add.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
Index: openssh-8.4p1/cavstest-ctr.c
Index: openssh-8.8p1/cavstest-ctr.c
===================================================================
--- /dev/null
+++ openssh-8.4p1/cavstest-ctr.c
+++ openssh-8.8p1/cavstest-ctr.c
@@ -0,0 +1,214 @@
+/*
+ *
@ -261,10 +261,10 @@ Index: openssh-8.4p1/cavstest-ctr.c
+ printf("\n");
+ return 0;
+}
Index: openssh-8.4p1/cipher.c
Index: openssh-8.8p1/cipher.c
===================================================================
--- openssh-8.4p1.orig/cipher.c
+++ openssh-8.4p1/cipher.c
--- openssh-8.8p1.orig/cipher.c
+++ openssh-8.8p1/cipher.c
@@ -58,15 +58,6 @@
#define EVP_CIPHER_CTX void
#endif
@ -281,10 +281,10 @@ Index: openssh-8.4p1/cipher.c
struct sshcipher {
char *name;
u_int block_size;
Index: openssh-8.4p1/cipher.h
Index: openssh-8.8p1/cipher.h
===================================================================
--- openssh-8.4p1.orig/cipher.h
+++ openssh-8.4p1/cipher.h
--- openssh-8.8p1.orig/cipher.h
+++ openssh-8.8p1/cipher.h
@@ -48,7 +48,15 @@
#define CIPHER_DECRYPT 0

View File

@ -2,11 +2,11 @@
# Parent 1e1d5a2ab8bddfc800f570755f9ea1addcc878c1
CAVS test for KDF implementation in OpenSSH
Index: openssh-8.4p1/Makefile.in
Index: openssh-8.8p1/Makefile.in
===================================================================
--- openssh-8.4p1.orig/Makefile.in
+++ openssh-8.4p1/Makefile.in
@@ -26,6 +26,7 @@ SSH_KEYSIGN=$(libexecdir)/ssh-keysign
--- openssh-8.8p1.orig/Makefile.in
+++ openssh-8.8p1/Makefile.in
@@ -27,6 +27,7 @@ SSH_KEYSIGN=$(libexecdir)/ssh-keysign
SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper
CAVSTEST_CTR=$(libexecdir)/cavstest-ctr
@ -14,7 +14,7 @@ Index: openssh-8.4p1/Makefile.in
PRIVSEP_PATH=@PRIVSEP_PATH@
SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
STRIP_OPT=@STRIP_OPT@
@@ -69,7 +70,7 @@ MKDIR_P=@MKDIR_P@
@@ -70,7 +71,7 @@ MKDIR_P=@MKDIR_P@
TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-sk-helper$(EXEEXT)
@ -23,7 +23,7 @@ Index: openssh-8.4p1/Makefile.in
XMSS_OBJS=\
ssh-xmss.o \
@@ -249,6 +250,9 @@ sftp$(EXEEXT): $(LIBCOMPAT) libssh.a $(S
@@ -252,6 +253,9 @@ sftp$(EXEEXT): $(LIBCOMPAT) libssh.a $(S
cavstest-ctr$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-sk.o sk-usbhid.o cavstest-ctr.o
$(LD) -o $@ cavstest-ctr.o ssh-sk.o sk-usbhid.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS) $(LIBFIDO2)
@ -33,7 +33,7 @@ Index: openssh-8.4p1/Makefile.in
# test driver for the loginrec code - not built by default
logintest: logintest.o $(LIBCOMPAT) libssh.a loginrec.o
$(LD) -o $@ logintest.o $(LDFLAGS) loginrec.o -lopenbsd-compat -lssh $(LIBS)
@@ -408,6 +412,7 @@ install-files:
@@ -415,6 +419,7 @@ install-files:
$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
$(INSTALL) -m 0755 $(STRIP_OPT) cavstest-ctr$(EXEEXT) $(DESTDIR)$(libexecdir)/cavstest-ctr$(EXEEXT)
@ -41,10 +41,10 @@ Index: openssh-8.4p1/Makefile.in
$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
$(INSTALL) -m 644 scp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
$(INSTALL) -m 644 ssh-add.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
Index: openssh-8.4p1/cavstest-kdf.c
Index: openssh-8.8p1/cavstest-kdf.c
===================================================================
--- /dev/null
+++ openssh-8.4p1/cavstest-kdf.c
+++ openssh-8.8p1/cavstest-kdf.c
@@ -0,0 +1,402 @@
+/*
+ * Copyright (C) 2015, Stephan Mueller <smueller@chronox.de>
@ -249,8 +249,8 @@ Index: openssh-8.4p1/cavstest-kdf.c
+ goto out;
+ }
+
+ kex.session_id = test->session_id;
+ kex.session_id_len = test->session_id_len;
+ kex.session_id = sshbuf_new();
+ sshbuf_put(kex.session_id, test->session_id, test->session_id_len);
+
+ /* setup kex */
+

View File

@ -4,11 +4,11 @@ disable run-time check for OpenSSL ABI by version number as that is not a
reliable indicator of ABI changes and doesn't make much sense in a
distribution package
diff --git a/configure.ac b/configure.ac
index 42ffd95..20a1884 100644
--- a/configure.ac
+++ b/configure.ac
@@ -4878,6 +4878,19 @@ AC_ARG_WITH([bsd-auth],
Index: openssh-8.8p1/configure.ac
===================================================================
--- openssh-8.8p1.orig/configure.ac
+++ openssh-8.8p1/configure.ac
@@ -5236,6 +5236,19 @@ AC_ARG_WITH([bsd-auth],
]
)
@ -28,11 +28,11 @@ index 42ffd95..20a1884 100644
# Where to place sshd.pid
piddir=/var/run
# make sure the directory exists
diff --git a/entropy.c b/entropy.c
index f8b9f42..4957b23 100644
--- a/entropy.c
+++ b/entropy.c
@@ -223,11 +223,13 @@ seed_rng(void)
Index: openssh-8.8p1/entropy.c
===================================================================
--- openssh-8.8p1.orig/entropy.c
+++ openssh-8.8p1/entropy.c
@@ -100,11 +100,13 @@ seed_rng(void)
/* Initialise libcrypto */
ssh_libcrypto_init();

View File

@ -2,15 +2,11 @@
# Parent 8fd4e445c3a5c823568661a4f71b064cbcb217a9
fix paths and references in sshd man pages
diff --git a/openssh-7.7p1/Makefile.in b/openssh-7.7p1/Makefile.in
--- openssh-7.7p1/Makefile.in
+++ openssh-7.7p1/Makefile.in
@@ -127,17 +127,18 @@ MANTYPE = @MANTYPE@
CONFIGFILES=sshd_config.out ssh_config.out moduli.out
CONFIGFILES_IN=sshd_config ssh_config moduli
PATHSUBS = \
-e 's|/etc/ssh/ssh_config|$(sysconfdir)/ssh_config|g' \
Index: openssh-8.8p1/Makefile.in
===================================================================
--- openssh-8.8p1.orig/Makefile.in
+++ openssh-8.8p1/Makefile.in
@@ -165,7 +165,8 @@ PATHSUBS = \
-e 's|/etc/ssh/ssh_known_hosts|$(sysconfdir)/ssh_known_hosts|g' \
-e 's|/etc/ssh/sshd_config|$(sysconfdir)/sshd_config|g' \
-e 's|/usr/libexec|$(libexecdir)|g' \
@ -20,8 +16,3 @@ diff --git a/openssh-7.7p1/Makefile.in b/openssh-7.7p1/Makefile.in
-e 's|/etc/ssh/ssh_host_key|$(sysconfdir)/ssh_host_key|g' \
-e 's|/etc/ssh/ssh_host_ecdsa_key|$(sysconfdir)/ssh_host_ecdsa_key|g' \
-e 's|/etc/ssh/ssh_host_dsa_key|$(sysconfdir)/ssh_host_dsa_key|g' \
-e 's|/etc/ssh/ssh_host_rsa_key|$(sysconfdir)/ssh_host_rsa_key|g' \
-e 's|/etc/ssh/ssh_host_ed25519_key|$(sysconfdir)/ssh_host_ed25519_key|g' \
-e 's|/var/run/sshd.pid|$(piddir)/sshd.pid|g' \
-e 's|/etc/moduli|$(sysconfdir)/moduli|g' \
-e 's|/etc/ssh/moduli|$(sysconfdir)/moduli|g' \

View File

@ -4,25 +4,16 @@
# bnc#46749
# --used to be called '-pam-fix2'
diff --git a/openssh-7.7p1/sshd_config b/openssh-7.7p1/sshd_config
--- openssh-7.7p1/sshd_config
+++ openssh-7.7p1/sshd_config
@@ -74,17 +74,17 @@ AuthorizedKeysFile .ssh/authorized_keys
# and session processing. If this is enabled, PAM authentication will
# be allowed through the ChallengeResponseAuthentication and
# PasswordAuthentication. Depending on your PAM configuration,
# PAM authentication via ChallengeResponseAuthentication may bypass
# the setting of "PermitRootLogin without-password".
Index: openssh-8.8p1/sshd_config
===================================================================
--- openssh-8.8p1.orig/sshd_config
+++ openssh-8.8p1/sshd_config
@@ -79,7 +79,7 @@ AuthorizedKeysFile .ssh/authorized_keys
# If you just want the PAM account and session checks to run without
# PAM authentication, then enable this but set PasswordAuthentication
# and ChallengeResponseAuthentication to 'no'.
# and KbdInteractiveAuthentication to 'no'.
-#UsePAM no
+UsePAM yes
#AllowAgentForwarding yes
#AllowTcpForwarding yes
#GatewayPorts no
X11Forwarding yes
#X11DisplayOffset 10
#X11UseLocalhost yes
#PermitTTY yes

View File

@ -3,11 +3,11 @@
FIPS 140-2 compliance. Perform selftests on start and use only FIPS approved
algorithms.
Index: openssh-8.4p1/Makefile.in
Index: openssh-8.8p1/Makefile.in
===================================================================
--- openssh-8.4p1.orig/Makefile.in
+++ openssh-8.4p1/Makefile.in
@@ -112,6 +112,8 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
--- openssh-8.8p1.orig/Makefile.in
+++ openssh-8.8p1/Makefile.in
@@ -113,6 +113,8 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
SKOBJS= ssh-sk-client.o
@ -16,10 +16,10 @@ Index: openssh-8.4p1/Makefile.in
SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
sshconnect.o sshconnect2.o mux.o $(SKOBJS)
Index: openssh-8.4p1/cipher-ctr.c
Index: openssh-8.8p1/cipher-ctr.c
===================================================================
--- openssh-8.4p1.orig/cipher-ctr.c
+++ openssh-8.4p1/cipher-ctr.c
--- openssh-8.8p1.orig/cipher-ctr.c
+++ openssh-8.8p1/cipher-ctr.c
@@ -27,6 +27,8 @@
#include "xmalloc.h"
#include "log.h"
@ -38,10 +38,10 @@ Index: openssh-8.4p1/cipher-ctr.c
#endif
return (&aes_ctr);
}
Index: openssh-8.4p1/cipher.c
Index: openssh-8.8p1/cipher.c
===================================================================
--- openssh-8.4p1.orig/cipher.c
+++ openssh-8.4p1/cipher.c
--- openssh-8.8p1.orig/cipher.c
+++ openssh-8.8p1/cipher.c
@@ -51,6 +51,9 @@
#include "openbsd-compat/openssl-compat.h"
@ -61,7 +61,7 @@ Index: openssh-8.4p1/cipher.c
#ifdef WITH_OPENSSL
#ifndef OPENSSL_NO_DES
{ "3des-cbc", 8, 24, 0, 0, CFLAG_CBC, EVP_des_ede3_cbc },
@@ -114,8 +117,52 @@ static const struct sshcipher ciphers[]
@@ -112,8 +115,52 @@ static const struct sshcipher ciphers[]
{ NULL, 0, 0, 0, 0, 0, NULL }
};
@ -114,7 +114,7 @@ Index: openssh-8.4p1/cipher.c
/* Returns a comma-separated list of supported ciphers. */
char *
cipher_alg_list(char sep, int auth_only)
@@ -124,7 +171,7 @@ cipher_alg_list(char sep, int auth_only)
@@ -122,7 +169,7 @@ cipher_alg_list(char sep, int auth_only)
size_t nlen, rlen = 0;
const struct sshcipher *c;
@ -123,7 +123,7 @@ Index: openssh-8.4p1/cipher.c
if ((c->flags & CFLAG_INTERNAL) != 0)
continue;
if (auth_only && c->auth_len == 0)
@@ -207,7 +254,7 @@ const struct sshcipher *
@@ -205,7 +252,7 @@ const struct sshcipher *
cipher_by_name(const char *name)
{
const struct sshcipher *c;
@ -132,10 +132,10 @@ Index: openssh-8.4p1/cipher.c
if (strcmp(c->name, name) == 0)
return c;
return NULL;
Index: openssh-8.4p1/fips.c
Index: openssh-8.8p1/fips.c
===================================================================
--- /dev/null
+++ openssh-8.4p1/fips.c
+++ openssh-8.8p1/fips.c
@@ -0,0 +1,212 @@
+/*
+ * Copyright (c) 2012 Petr Cerny. All rights reserved.
@ -349,10 +349,10 @@ Index: openssh-8.4p1/fips.c
+ return dgst;
+}
+
Index: openssh-8.4p1/fips.h
Index: openssh-8.8p1/fips.h
===================================================================
--- /dev/null
+++ openssh-8.4p1/fips.h
+++ openssh-8.8p1/fips.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (c) 2012 Petr Cerny. All rights reserved.
@ -398,10 +398,10 @@ Index: openssh-8.4p1/fips.h
+
+#endif
+
Index: openssh-8.4p1/hmac.c
Index: openssh-8.8p1/hmac.c
===================================================================
--- openssh-8.4p1.orig/hmac.c
+++ openssh-8.4p1/hmac.c
--- openssh-8.8p1.orig/hmac.c
+++ openssh-8.8p1/hmac.c
@@ -145,7 +145,7 @@ hmac_test(void *key, size_t klen, void *
size_t i;
u_char digest[16];
@ -411,10 +411,10 @@ Index: openssh-8.4p1/hmac.c
printf("ssh_hmac_start failed");
if (ssh_hmac_init(ctx, key, klen) < 0 ||
ssh_hmac_update(ctx, m, mlen) < 0 ||
Index: openssh-8.4p1/kex.c
Index: openssh-8.8p1/kex.c
===================================================================
--- openssh-8.4p1.orig/kex.c
+++ openssh-8.4p1/kex.c
--- openssh-8.8p1.orig/kex.c
+++ openssh-8.8p1/kex.c
@@ -62,6 +62,8 @@
#include "sshbuf.h"
#include "digest.h"
@ -433,7 +433,7 @@ Index: openssh-8.4p1/kex.c
#ifdef WITH_OPENSSL
{ KEX_DH1, KEX_DH_GRP1_SHA1, 0, SSH_DIGEST_SHA1 },
{ KEX_DH14_SHA1, KEX_DH_GRP14_SHA1, 0, SSH_DIGEST_SHA1 },
@@ -116,6 +118,47 @@ static const struct kexalg kexalgs[] = {
@@ -118,6 +120,47 @@ static const struct kexalg kexalgs[] = {
{ NULL, 0, -1, -1},
};
@ -481,7 +481,7 @@ Index: openssh-8.4p1/kex.c
char *
kex_alg_list(char sep)
{
@@ -123,7 +166,7 @@ kex_alg_list(char sep)
@@ -125,7 +168,7 @@ kex_alg_list(char sep)
size_t nlen, rlen = 0;
const struct kexalg *k;
@ -490,7 +490,7 @@ Index: openssh-8.4p1/kex.c
if (ret != NULL)
ret[rlen++] = sep;
nlen = strlen(k->name);
@@ -143,7 +186,7 @@ kex_alg_by_name(const char *name)
@@ -145,7 +188,7 @@ kex_alg_by_name(const char *name)
{
const struct kexalg *k;
@ -499,7 +499,7 @@ Index: openssh-8.4p1/kex.c
if (strcmp(k->name, name) == 0)
return k;
}
@@ -163,7 +206,10 @@ kex_names_valid(const char *names)
@@ -165,7 +208,10 @@ kex_names_valid(const char *names)
for ((p = strsep(&cp, ",")); p && *p != '\0';
(p = strsep(&cp, ","))) {
if (kex_alg_by_name(p) == NULL) {
@ -510,10 +510,10 @@ Index: openssh-8.4p1/kex.c
free(s);
return 0;
}
Index: openssh-8.4p1/mac.c
Index: openssh-8.8p1/mac.c
===================================================================
--- openssh-8.4p1.orig/mac.c
+++ openssh-8.4p1/mac.c
--- openssh-8.8p1.orig/mac.c
+++ openssh-8.8p1/mac.c
@@ -41,6 +41,9 @@
#include "openbsd-compat/openssl-compat.h"
@ -593,10 +593,10 @@ Index: openssh-8.4p1/mac.c
if (strcmp(name, m->name) != 0)
continue;
if (mac != NULL)
Index: openssh-8.4p1/readconf.c
Index: openssh-8.8p1/readconf.c
===================================================================
--- openssh-8.4p1.orig/readconf.c
+++ openssh-8.4p1/readconf.c
--- openssh-8.8p1.orig/readconf.c
+++ openssh-8.8p1/readconf.c
@@ -68,6 +68,8 @@
#include "myproposal.h"
#include "digest.h"
@ -606,8 +606,8 @@ Index: openssh-8.4p1/readconf.c
/* Format of the configuration file:
# Configuration data is parsed as follows:
@@ -1949,6 +1951,23 @@ option_clear_or_none(const char *o)
return o == NULL || strcasecmp(o, "none") == 0;
@@ -2307,6 +2309,23 @@ config_has_permitted_cnames(Options *opt
return options->num_permitted_cnames > 0;
}
+/* remove algorithms not approved for use in FIPS mode, when running in FIPS
@ -630,7 +630,7 @@ Index: openssh-8.4p1/readconf.c
/*
* Initializes options to special values that indicate that they have not yet
* been set. Read_config_file will only set options with this value. Options
@@ -2240,6 +2259,9 @@ fill_default_options(Options * options)
@@ -2618,6 +2637,9 @@ fill_default_options(Options * options)
options->canonicalize_hostname = SSH_CANONICALISE_NO;
if (options->fingerprint_hash == -1)
options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
@ -640,28 +640,20 @@ Index: openssh-8.4p1/readconf.c
#ifdef ENABLE_SK_INTERNAL
if (options->sk_provider == NULL)
options->sk_provider = xstrdup("internal");
@@ -2273,6 +2295,7 @@ fill_default_options(Options * options)
ASSEMBLE(pubkey_key_types, def_key, all_key);
@@ -2654,6 +2676,8 @@ fill_default_options(Options * options)
ASSEMBLE(ca_sign_algorithms, def_sig, all_sig);
#undef ASSEMBLE
+
free(all_cipher);
free(all_mac);
free(all_kex);
@@ -2284,6 +2307,8 @@ fill_default_options(Options * options)
kex_default_pk_alg_filtered = def_key; /* save for later use */
free(def_sig);
+ filter_fips_algorithms(options);
+
#define CLEAR_ON_NONE(v) \
do { \
if (option_clear_or_none(v)) { \
Index: openssh-8.4p1/readconf.h
Index: openssh-8.8p1/readconf.h
===================================================================
--- openssh-8.4p1.orig/readconf.h
+++ openssh-8.4p1/readconf.h
@@ -200,6 +200,7 @@ typedef struct {
--- openssh-8.8p1.orig/readconf.h
+++ openssh-8.8p1/readconf.h
@@ -212,6 +212,7 @@ typedef struct {
#define SSH_STRICT_HOSTKEY_YES 2
#define SSH_STRICT_HOSTKEY_ASK 3
@ -669,10 +661,10 @@ Index: openssh-8.4p1/readconf.h
const char *kex_default_pk_alg(void);
char *ssh_connection_hash(const char *thishost, const char *host,
const char *portstr, const char *user);
Index: openssh-8.4p1/servconf.c
Index: openssh-8.8p1/servconf.c
===================================================================
--- openssh-8.4p1.orig/servconf.c
+++ openssh-8.4p1/servconf.c
--- openssh-8.8p1.orig/servconf.c
+++ openssh-8.8p1/servconf.c
@@ -70,6 +70,7 @@
#include "auth.h"
#include "myproposal.h"
@ -681,7 +673,7 @@ Index: openssh-8.4p1/servconf.c
static void add_listen_addr(ServerOptions *, const char *,
const char *, int);
@@ -201,6 +202,23 @@ option_clear_or_none(const char *o)
@@ -205,6 +206,23 @@ option_clear_or_none(const char *o)
return o == NULL || strcasecmp(o, "none") == 0;
}
@ -705,7 +697,7 @@ Index: openssh-8.4p1/servconf.c
static void
assemble_algorithms(ServerOptions *o)
{
@@ -242,6 +260,8 @@ assemble_algorithms(ServerOptions *o)
@@ -246,6 +264,8 @@ assemble_algorithms(ServerOptions *o)
free(def_kex);
free(def_key);
free(def_sig);
@ -713,8 +705,8 @@ Index: openssh-8.4p1/servconf.c
+ filter_fips_algorithms_s(o);
}
static void
@@ -454,6 +474,8 @@ fill_default_server_options(ServerOption
void
@@ -438,6 +458,8 @@ fill_default_server_options(ServerOption
options->fwd_opts.streamlocal_bind_unlink = 0;
if (options->fingerprint_hash == -1)
options->fingerprint_hash = SSH_FP_HASH_DEFAULT;
@ -723,20 +715,20 @@ Index: openssh-8.4p1/servconf.c
if (options->disable_forwarding == -1)
options->disable_forwarding = 0;
if (options->expose_userauth_info == -1)
Index: openssh-8.4p1/ssh-keygen.c
Index: openssh-8.8p1/ssh-keygen.c
===================================================================
--- openssh-8.4p1.orig/ssh-keygen.c
+++ openssh-8.4p1/ssh-keygen.c
@@ -66,6 +66,8 @@
#include "ssh-sk.h"
--- openssh-8.8p1.orig/ssh-keygen.c
+++ openssh-8.8p1/ssh-keygen.c
@@ -67,6 +67,8 @@
#include "sk-api.h" /* XXX for SSH_SK_USER_PRESENCE_REQD; remove */
#include "cipher.h"
+#include "fips.h"
+
#ifdef WITH_OPENSSL
# define DEFAULT_KEY_TYPE_NAME "rsa"
#else
@@ -1036,11 +1038,13 @@ do_fingerprint(struct passwd *pw)
@@ -1037,11 +1039,13 @@ do_fingerprint(struct passwd *pw)
static void
do_gen_all_hostkeys(struct passwd *pw)
{
@ -752,7 +744,7 @@ Index: openssh-8.4p1/ssh-keygen.c
#ifdef WITH_OPENSSL
{ "rsa", "RSA" ,_PATH_HOST_RSA_KEY_FILE },
{ "dsa", "DSA", _PATH_HOST_DSA_KEY_FILE },
@@ -1055,6 +1059,17 @@ do_gen_all_hostkeys(struct passwd *pw)
@@ -1056,6 +1060,17 @@ do_gen_all_hostkeys(struct passwd *pw)
{ NULL, NULL, NULL }
};
@ -770,7 +762,7 @@ Index: openssh-8.4p1/ssh-keygen.c
u_int32_t bits = 0;
int first = 0;
struct stat st;
@@ -1062,6 +1077,12 @@ do_gen_all_hostkeys(struct passwd *pw)
@@ -1063,6 +1078,12 @@ do_gen_all_hostkeys(struct passwd *pw)
char comment[1024], *prv_tmp, *pub_tmp, *prv_file, *pub_file;
int i, type, fd, r;
@ -783,7 +775,7 @@ Index: openssh-8.4p1/ssh-keygen.c
for (i = 0; key_types[i].key_type; i++) {
public = private = NULL;
prv_tmp = pub_tmp = prv_file = pub_file = NULL;
@@ -3586,6 +3607,15 @@ main(int argc, char **argv)
@@ -3620,6 +3641,15 @@ main(int argc, char **argv)
key_type_name = DEFAULT_KEY_TYPE_NAME;
type = sshkey_type_from_name(key_type_name);
@ -799,37 +791,37 @@ Index: openssh-8.4p1/ssh-keygen.c
type_bits_valid(type, key_type_name, &bits);
if (!quiet)
Index: openssh-8.4p1/ssh_config.5
Index: openssh-8.8p1/ssh_config.5
===================================================================
--- openssh-8.4p1.orig/ssh_config.5
+++ openssh-8.4p1/ssh_config.5
@@ -682,6 +682,8 @@ Valid options are:
and
.Cm sha256
--- openssh-8.8p1.orig/ssh_config.5
+++ openssh-8.8p1/ssh_config.5
@@ -736,6 +736,8 @@ The argument to this keyword must be
option) or
.Cm no
(the default).
+.Pp
+In the FIPS mode the minimum of SHA-1 is enforced (which means sha256).
.It Cm ForwardAgent
Specifies whether the connection to the authentication agent (if any)
will be forwarded to the remote machine.
Index: openssh-8.4p1/sshd.c
Index: openssh-8.8p1/sshd.c
===================================================================
--- openssh-8.4p1.orig/sshd.c
+++ openssh-8.4p1/sshd.c
@@ -124,6 +124,8 @@
#include "ssherr.h"
#include "sk-api.h"
--- openssh-8.8p1.orig/sshd.c
+++ openssh-8.8p1/sshd.c
@@ -126,6 +126,8 @@
#include "srclimit.h"
#include "dh.h"
+#include "fips.h"
+
/* Re-exec fds */
#define REEXEC_DEVCRYPTO_RESERVED_FD (STDERR_FILENO + 1)
#define REEXEC_STARTUP_PIPE_FD (STDERR_FILENO + 2)
Index: openssh-8.4p1/sshd_config.5
Index: openssh-8.8p1/sshd_config.5
===================================================================
--- openssh-8.4p1.orig/sshd_config.5
+++ openssh-8.4p1/sshd_config.5
@@ -594,6 +594,8 @@ and
--- openssh-8.8p1.orig/sshd_config.5
+++ openssh-8.8p1/sshd_config.5
@@ -600,6 +600,8 @@ and
.Cm sha256 .
The default is
.Cm sha256 .

View File

@ -14,10 +14,10 @@
# file is not found (or the hash matches), proceed in non-FIPS mode and abort
# otherwise.
Index: openssh-8.4p1/fips-check.c
Index: openssh-8.8p1/fips-check.c
===================================================================
--- /dev/null
+++ openssh-8.4p1/fips-check.c
+++ openssh-8.8p1/fips-check.c
@@ -0,0 +1,34 @@
+#include "includes.h"
+#include <fcntl.h>
@ -53,10 +53,10 @@ Index: openssh-8.4p1/fips-check.c
+ fips_ssh_init();
+ return 0;
+}
Index: openssh-8.4p1/fips.c
Index: openssh-8.8p1/fips.c
===================================================================
--- openssh-8.4p1.orig/fips.c
+++ openssh-8.4p1/fips.c
--- openssh-8.8p1.orig/fips.c
+++ openssh-8.8p1/fips.c
@@ -35,30 +35,293 @@
#include "log.h"
#include "xmalloc.h"
@ -362,10 +362,10 @@ Index: openssh-8.4p1/fips.c
int
fips_mode(void)
{
Index: openssh-8.4p1/fips.h
Index: openssh-8.8p1/fips.h
===================================================================
--- openssh-8.4p1.orig/fips.h
+++ openssh-8.4p1/fips.h
--- openssh-8.8p1.orig/fips.h
+++ openssh-8.8p1/fips.h
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2012 Petr Cerny. All rights reserved.
@ -407,20 +407,20 @@ Index: openssh-8.4p1/fips.h
#endif
-
Index: openssh-8.4p1/sftp-server.c
Index: openssh-8.8p1/sftp-server.c
===================================================================
--- openssh-8.4p1.orig/sftp-server.c
+++ openssh-8.4p1/sftp-server.c
@@ -53,6 +53,8 @@
char *sftp_realpath(const char *, char *); /* sftp-realpath.c */
--- openssh-8.8p1.orig/sftp-server.c
+++ openssh-8.8p1/sftp-server.c
@@ -57,6 +57,8 @@ char *sftp_realpath(const char *, char *
/* Maximum data read that we are willing to accept */
#define SFTP_MAX_READ_LENGTH (SFTP_MAX_MSG_LENGTH - 1024)
+#include "fips.h"
+
/* Our verbosity */
static LogLevel log_level = SYSLOG_LEVEL_ERROR;
@@ -1577,6 +1579,9 @@ sftp_server_main(int argc, char **argv,
@@ -1717,6 +1719,9 @@ sftp_server_main(int argc, char **argv,
extern char *optarg;
extern char *__progname;
@ -430,10 +430,10 @@ Index: openssh-8.4p1/sftp-server.c
__progname = ssh_get_progname(argv[0]);
log_init(__progname, log_level, log_facility, log_stderr);
Index: openssh-8.4p1/ssh.c
Index: openssh-8.8p1/ssh.c
===================================================================
--- openssh-8.4p1.orig/ssh.c
+++ openssh-8.4p1/ssh.c
--- openssh-8.8p1.orig/ssh.c
+++ openssh-8.8p1/ssh.c
@@ -113,6 +113,8 @@
#include "ssh-pkcs11.h"
#endif
@ -443,9 +443,9 @@ Index: openssh-8.4p1/ssh.c
extern char *__progname;
/* Saves a copy of argv for setproctitle emulation */
@@ -658,6 +660,10 @@ main(int ac, char **av)
size_t n, len;
@@ -632,6 +634,10 @@ main(int ac, char **av)
u_int j;
struct ssh_conn_info *cinfo = NULL;
+ /* initialize fips - can go before ssh_malloc_init(), since that is a
+ * OpenBSD-only thing (as of OpenSSH 7.6p1) */
@ -454,11 +454,11 @@ Index: openssh-8.4p1/ssh.c
/* Ensure that fds 0, 1 and 2 are open or directed to /dev/null */
sanitise_stdfd();
Index: openssh-8.4p1/sshd.c
Index: openssh-8.8p1/sshd.c
===================================================================
--- openssh-8.4p1.orig/sshd.c
+++ openssh-8.4p1/sshd.c
@@ -1545,6 +1545,10 @@ main(int ac, char **av)
--- openssh-8.8p1.orig/sshd.c
+++ openssh-8.8p1/sshd.c
@@ -1547,6 +1547,10 @@ main(int ac, char **av)
Authctxt *authctxt;
struct connection_info *connection_info = NULL;

View File

@ -2,15 +2,11 @@
# Parent 0f731d0b541b8a919d24ac91098f560a49712822
Suggest command line for removal of offending keys from known_hosts file
diff --git a/openssh-7.7p1/sshconnect.c b/openssh-7.7p1/sshconnect.c
--- openssh-7.7p1/sshconnect.c
+++ openssh-7.7p1/sshconnect.c
@@ -1147,16 +1147,21 @@ check_host_key(char *hostname, struct so
}
/* The host key has changed. */
warn_changed_key(host_key);
error("Add correct host key in %.100s to get rid of this message.",
user_hostfiles[0]);
Index: openssh-8.8p1/sshconnect.c
===================================================================
--- openssh-8.8p1.orig/sshconnect.c
+++ openssh-8.8p1/sshconnect.c
@@ -1270,6 +1270,11 @@ check_host_key(char *hostname, const str
error("Offending %s key in %s:%lu",
sshkey_type(host_found->key),
host_found->file, host_found->line);
@ -22,8 +18,3 @@ diff --git a/openssh-7.7p1/sshconnect.c b/openssh-7.7p1/sshconnect.c
/*
* If strict host key checking is in use, the user will have
* to edit the key manually and we can only abort.
*/
if (options.strict_host_key_checking !=
SSH_STRICT_HOSTKEY_OFF) {
error("%s host key for %.200s has changed and you have "

View File

@ -3,11 +3,11 @@
# -- uset do be called '-xauthlocalhostname'
handle hostname changes when forwarding X
Index: openssh-8.4p1/session.c
Index: openssh-8.8p1/session.c
===================================================================
--- openssh-8.4p1.orig/session.c
+++ openssh-8.4p1/session.c
@@ -985,7 +985,7 @@ copy_environment(char **source, char ***
--- openssh-8.8p1.orig/session.c
+++ openssh-8.8p1/session.c
@@ -981,7 +981,7 @@ copy_environment(char **source, char ***
#endif
static char **
@ -16,7 +16,7 @@ Index: openssh-8.4p1/session.c
{
char buf[256];
size_t n;
@@ -1195,6 +1195,8 @@ do_setup_env(struct ssh *ssh, Session *s
@@ -1191,6 +1191,8 @@ do_setup_env(struct ssh *ssh, Session *s
for (i = 0; env[i]; i++)
fprintf(stderr, " %.200s\n", env[i]);
}
@ -25,7 +25,7 @@ Index: openssh-8.4p1/session.c
return env;
}
@@ -1203,7 +1205,7 @@ do_setup_env(struct ssh *ssh, Session *s
@@ -1199,7 +1201,7 @@ do_setup_env(struct ssh *ssh, Session *s
* first in this order).
*/
static void
@ -34,8 +34,8 @@ Index: openssh-8.4p1/session.c
{
FILE *f = NULL;
char *cmd = NULL, *user_rc = NULL;
@@ -1260,12 +1262,20 @@ do_rc_files(struct ssh *ssh, Session *s,
fatal("%s: xasprintf: %s", __func__, strerror(errno));
@@ -1256,12 +1258,20 @@ do_rc_files(struct ssh *ssh, Session *s,
fatal_f("xasprintf: %s", strerror(errno));
f = popen(cmd, "w");
if (f) {
+ char hostname[MAXHOSTNAMELEN];
@ -55,7 +55,7 @@ Index: openssh-8.4p1/session.c
} else {
fprintf(stderr, "Could not run %s\n",
cmd);
@@ -1526,6 +1536,7 @@ do_child(struct ssh *ssh, Session *s, co
@@ -1518,6 +1528,7 @@ do_child(struct ssh *ssh, Session *s, co
char **env, *argv[ARGV_MAX], remote_id[512];
const char *shell, *shell0;
struct passwd *pw = s->pw;
@ -63,7 +63,7 @@ Index: openssh-8.4p1/session.c
int r = 0;
sshpkt_fmt_connection_id(ssh, remote_id, sizeof(remote_id));
@@ -1582,7 +1593,7 @@ do_child(struct ssh *ssh, Session *s, co
@@ -1574,7 +1585,7 @@ do_child(struct ssh *ssh, Session *s, co
* Make sure $SHELL points to the shell from the password file,
* even if shell is overridden from login.conf
*/
@ -72,7 +72,7 @@ Index: openssh-8.4p1/session.c
#ifdef HAVE_LOGIN_CAP
shell = login_getcapstr(lc, "shell", (char *)shell, (char *)shell);
@@ -1646,7 +1657,7 @@ do_child(struct ssh *ssh, Session *s, co
@@ -1638,7 +1649,7 @@ do_child(struct ssh *ssh, Session *s, co
closefrom(STDERR_FILENO + 1);

View File

@ -10,11 +10,10 @@
# internal versions. ssh-keyconverter consequently fails to link as it lacks
# the proper flags, and libopenbsd-compat doesn't contain the b64_* functions)
diff --git a/HOWTO.ldap-keys b/HOWTO.ldap-keys
new file mode 100644
index 0000000..831d399
Index: openssh-8.8p1/HOWTO.ldap-keys
===================================================================
--- /dev/null
+++ b/HOWTO.ldap-keys
+++ openssh-8.8p1/HOWTO.ldap-keys
@@ -0,0 +1,108 @@
+
+HOW TO START
@ -124,11 +123,11 @@ index 0000000..831d399
+ - frederic peters.
+ - Finlay dobbie.
+ - Stefan Fisher.
diff --git a/Makefile.in b/Makefile.in
index 6010d1c..f54348b 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -25,6 +25,8 @@ SFTP_SERVER=$(libexecdir)/sftp-server
Index: openssh-8.8p1/Makefile.in
===================================================================
--- openssh-8.8p1.orig/Makefile.in
+++ openssh-8.8p1/Makefile.in
@@ -26,6 +26,8 @@ SFTP_SERVER=$(libexecdir)/sftp-server
SSH_KEYSIGN=$(libexecdir)/ssh-keysign
SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
SSH_SK_HELPER=$(libexecdir)/ssh-sk-helper
@ -137,7 +136,7 @@ index 6010d1c..f54348b 100644
CAVSTEST_CTR=$(libexecdir)/cavstest-ctr
CAVSTEST_KDF=$(libexecdir)/cavstest-kdf
PRIVSEP_PATH=@PRIVSEP_PATH@
@@ -74,6 +76,9 @@ TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keys
@@ -73,6 +75,9 @@ TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-a
TARGETS += cavstest-ctr$(EXEEXT) cavstest-kdf$(EXEEXT)
@ -147,9 +146,9 @@ index 6010d1c..f54348b 100644
XMSS_OBJS=\
ssh-xmss.o \
sshkey-xmss.o \
@@ -158,8 +163,8 @@ SFTPSERVER_OBJS=sftp-common.o sftp-server.o sftp-server-main.o
@@ -160,8 +165,8 @@ SFTPSERVER_OBJS=sftp-common.o sftp-serve
SFTP_OBJS= sftp.o sftp-client.o sftp-common.o sftp-glob.o progressmeter.o
SFTP_OBJS= sftp.o progressmeter.o $(SFTP_CLIENT_OBJS)
-MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-keysign.8.out ssh-pkcs11-helper.8.out ssh-sk-helper.8.out sshd_config.5.out ssh_config.5.out
-MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-keysign.8 ssh-pkcs11-helper.8 ssh-sk-helper.8 sshd_config.5 ssh_config.5
@ -158,7 +157,7 @@ index 6010d1c..f54348b 100644
MANTYPE = @MANTYPE@
CONFIGFILES=sshd_config.out ssh_config.out moduli.out
@@ -242,6 +247,9 @@ ssh-sk-helper$(EXEEXT): $(LIBCOMPAT) libssh.a $(SKHELPER_OBJS)
@@ -244,6 +249,9 @@ ssh-sk-helper$(EXEEXT): $(LIBCOMPAT) lib
ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSCAN_OBJS)
$(LD) -o $@ $(SSHKEYSCAN_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
@ -166,9 +165,9 @@ index 6010d1c..f54348b 100644
+ $(LD) -o $@ ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
+
sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a $(SFTPSERVER_OBJS)
$(LD) -o $@ $(SFTPSERVER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
$(LD) -o $@ $(SFTPSERVER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
@@ -406,6 +414,10 @@ install-files:
@@ -416,6 +424,10 @@ install-files:
$(INSTALL) -m 0755 $(STRIP_OPT) sshd$(EXEEXT) $(DESTDIR)$(sbindir)/sshd$(EXEEXT)
$(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign$(EXEEXT) $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
$(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
@ -179,7 +178,7 @@ index 6010d1c..f54348b 100644
$(INSTALL) -m 0755 $(STRIP_OPT) ssh-sk-helper$(EXEEXT) $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT)
$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
@@ -425,6 +437,10 @@ install-files:
@@ -435,6 +447,10 @@ install-files:
$(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
$(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
$(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
@ -190,7 +189,7 @@ index 6010d1c..f54348b 100644
$(INSTALL) -m 644 ssh-sk-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-sk-helper.8
install-sysconf:
@@ -449,6 +465,13 @@ install-sysconf:
@@ -459,6 +475,13 @@ install-sysconf:
else \
echo "$(DESTDIR)$(sysconfdir)/moduli already exists, install will not overwrite"; \
fi
@ -204,7 +203,7 @@ index 6010d1c..f54348b 100644
host-key: ssh-keygen$(EXEEXT)
@if [ -z "$(DESTDIR)" ] ; then \
@@ -487,6 +510,8 @@ uninstall:
@@ -497,6 +520,8 @@ uninstall:
-rm -f $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
-rm -f $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
-rm -f $(DESTDIR)$(SSH_SK_HELPER)$(EXEEXT)
@ -213,7 +212,7 @@ index 6010d1c..f54348b 100644
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
@@ -499,6 +524,7 @@ uninstall:
@@ -509,6 +534,7 @@ uninstall:
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-sk-helper.8
@ -221,11 +220,11 @@ index 6010d1c..f54348b 100644
regress-prep:
$(MKDIR_P) `pwd`/regress/unittests/test_helper
diff --git a/configure.ac b/configure.ac
index 4ddf539..1fd0b17 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1688,6 +1688,106 @@ AC_ARG_WITH([audit],
Index: openssh-8.8p1/configure.ac
===================================================================
--- openssh-8.8p1.orig/configure.ac
+++ openssh-8.8p1/configure.ac
@@ -1758,6 +1758,106 @@ AC_ARG_WITH([audit],
esac ]
)
@ -332,11 +331,10 @@ index 4ddf539..1fd0b17 100644
AC_ARG_WITH([pie],
[ --with-pie Build Position Independent Executables if possible], [
if test "x$withval" = "xno"; then
diff --git a/ldap-helper.c b/ldap-helper.c
new file mode 100644
index 0000000..0efff1f
Index: openssh-8.8p1/ldap-helper.c
===================================================================
--- /dev/null
+++ b/ldap-helper.c
+++ openssh-8.8p1/ldap-helper.c
@@ -0,0 +1,155 @@
+/* $OpenBSD: ssh-pka-ldap.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/*
@ -493,11 +491,10 @@ index 0000000..0efff1f
+void *buffer_get_string(struct sshbuf *b, u_int *l) { return NULL; }
+void buffer_put_string(struct sshbuf *b, const void *f, u_int l) {}
+
diff --git a/ldap-helper.h b/ldap-helper.h
new file mode 100644
index 0000000..14cb29a
Index: openssh-8.8p1/ldap-helper.h
===================================================================
--- /dev/null
+++ b/ldap-helper.h
+++ openssh-8.8p1/ldap-helper.h
@@ -0,0 +1,32 @@
+/* $OpenBSD: ldap-helper.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/*
@ -531,11 +528,10 @@ index 0000000..14cb29a
+extern int config_warning_config_file;
+
+#endif /* LDAP_HELPER_H */
diff --git a/ldap.conf b/ldap.conf
new file mode 100644
index 0000000..42e38d3
Index: openssh-8.8p1/ldap.conf
===================================================================
--- /dev/null
+++ b/ldap.conf
+++ openssh-8.8p1/ldap.conf
@@ -0,0 +1,88 @@
+# $Id: openssh-5.5p1-ldap.patch,v 1.3 2010/07/07 13:48:36 jfch2222 Exp $
+#
@ -625,12 +621,11 @@ index 0000000..42e38d3
+#tls_cert
+#tls_key
+
diff --git a/ldapbody.c b/ldapbody.c
new file mode 100644
index 0000000..032cc89
Index: openssh-8.8p1/ldapbody.c
===================================================================
--- /dev/null
+++ b/ldapbody.c
@@ -0,0 +1,494 @@
+++ openssh-8.8p1/ldapbody.c
@@ -0,0 +1,503 @@
+/* $OpenBSD: ldapbody.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/*
+ * Copyright (c) 2009 Jan F. Chadima. All rights reserved.
@ -663,8 +658,17 @@ index 0000000..032cc89
+#include "ldapmisc.h"
+#include "ldapbody.h"
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+#ifndef FALSE
+# define FALSE 0
+#endif
+
+#ifndef TRUE
+# define TRUE 1
+#endif
+
+#define LDAPSEARCH_FORMAT "(&(objectclass=posixAccount)(objectclass=ldapPublicKey)(uid=%s)%s)"
+#define PUBKEYATTR "sshPublicKey"
+#define LDAP_LOGFILE "%s/ldap.%d"
@ -1125,11 +1129,10 @@ index 0000000..032cc89
+ return;
+}
+
diff --git a/ldapbody.h b/ldapbody.h
new file mode 100644
index 0000000..665dca2
Index: openssh-8.8p1/ldapbody.h
===================================================================
--- /dev/null
+++ b/ldapbody.h
+++ openssh-8.8p1/ldapbody.h
@@ -0,0 +1,37 @@
+/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/*
@ -1168,11 +1171,10 @@ index 0000000..665dca2
+
+#endif /* LDAPBODY_H */
+
diff --git a/ldapconf.c b/ldapconf.c
new file mode 100644
index 0000000..2e22438
Index: openssh-8.8p1/ldapconf.c
===================================================================
--- /dev/null
+++ b/ldapconf.c
+++ openssh-8.8p1/ldapconf.c
@@ -0,0 +1,711 @@
+/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/*
@ -1885,11 +1887,10 @@ index 0000000..2e22438
+ dump_cfg_string(lSSH_Filter, options.ssh_filter);
+}
+
diff --git a/ldapconf.h b/ldapconf.h
new file mode 100644
index 0000000..c2aa704
Index: openssh-8.8p1/ldapconf.h
===================================================================
--- /dev/null
+++ b/ldapconf.h
+++ openssh-8.8p1/ldapconf.h
@@ -0,0 +1,71 @@
+/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/*
@ -1962,11 +1963,10 @@ index 0000000..c2aa704
+void dump_config(void);
+
+#endif /* LDAPCONF_H */
diff --git a/ldapincludes.h b/ldapincludes.h
new file mode 100644
index 0000000..8539bdc
Index: openssh-8.8p1/ldapincludes.h
===================================================================
--- /dev/null
+++ b/ldapincludes.h
+++ openssh-8.8p1/ldapincludes.h
@@ -0,0 +1,41 @@
+/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/*
@ -2009,11 +2009,10 @@ index 0000000..8539bdc
+#endif
+
+#endif /* LDAPINCLUDES_H */
diff --git a/ldapmisc.c b/ldapmisc.c
new file mode 100644
index 0000000..de23c0c
Index: openssh-8.8p1/ldapmisc.c
===================================================================
--- /dev/null
+++ b/ldapmisc.c
+++ openssh-8.8p1/ldapmisc.c
@@ -0,0 +1,79 @@
+
+#include "ldapincludes.h"
@ -2094,11 +2093,10 @@ index 0000000..de23c0c
+}
+#endif
+
diff --git a/ldapmisc.h b/ldapmisc.h
new file mode 100644
index 0000000..4c271df
Index: openssh-8.8p1/ldapmisc.h
===================================================================
--- /dev/null
+++ b/ldapmisc.h
+++ openssh-8.8p1/ldapmisc.h
@@ -0,0 +1,35 @@
+/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/*
@ -2135,10 +2133,10 @@ index 0000000..4c271df
+
+#endif /* LDAPMISC_H */
+
diff --git a/openbsd-compat/base64.c b/openbsd-compat/base64.c
index 9e74667..14824be 100644
--- a/openbsd-compat/base64.c
+++ b/openbsd-compat/base64.c
Index: openssh-8.8p1/openbsd-compat/base64.c
===================================================================
--- openssh-8.8p1.orig/openbsd-compat/base64.c
+++ openssh-8.8p1/openbsd-compat/base64.c
@@ -46,7 +46,7 @@
#include "includes.h"
@ -2157,7 +2155,7 @@ index 9e74667..14824be 100644
int
b64_ntop(u_char const *src, size_t srclength, char *target, size_t targsize)
{
@@ -185,7 +185,7 @@ b64_ntop(u_char const *src, size_t srclength, char *target, size_t targsize)
@@ -185,7 +185,7 @@ b64_ntop(u_char const *src, size_t srcle
}
#endif /* !defined(HAVE_B64_NTOP) && !defined(HAVE___B64_NTOP) */
@ -2166,10 +2164,10 @@ index 9e74667..14824be 100644
/* skips all whitespace anywhere.
converts characters, four at a time, starting at (or after)
diff --git a/openbsd-compat/base64.h b/openbsd-compat/base64.h
index bd77293..e27df9a 100644
--- a/openbsd-compat/base64.h
+++ b/openbsd-compat/base64.h
Index: openssh-8.8p1/openbsd-compat/base64.h
===================================================================
--- openssh-8.8p1.orig/openbsd-compat/base64.h
+++ openssh-8.8p1/openbsd-compat/base64.h
@@ -45,16 +45,16 @@
#include "includes.h"
@ -2191,11 +2189,10 @@ index bd77293..e27df9a 100644
int b64_pton(char const *src, u_char *target, size_t targsize);
# endif /* !HAVE_B64_PTON */
# define __b64_pton(a,b,c) b64_pton(a,b,c)
diff --git a/openssh-lpk-openldap.schema b/openssh-lpk-openldap.schema
new file mode 100644
index 0000000..c84f90f
Index: openssh-8.8p1/openssh-lpk-openldap.schema
===================================================================
--- /dev/null
+++ b/openssh-lpk-openldap.schema
+++ openssh-8.8p1/openssh-lpk-openldap.schema
@@ -0,0 +1,21 @@
+#
+# LDAP Public Key Patch schema for use with openssh-ldappubkey
@ -2218,11 +2215,10 @@ index 0000000..c84f90f
+ DESC 'MANDATORY: OpenSSH LPK objectclass'
+ MUST ( sshPublicKey $ uid )
+ )
diff --git a/openssh-lpk-sun.schema b/openssh-lpk-sun.schema
new file mode 100644
index 0000000..3136673
Index: openssh-8.8p1/openssh-lpk-sun.schema
===================================================================
--- /dev/null
+++ b/openssh-lpk-sun.schema
+++ openssh-8.8p1/openssh-lpk-sun.schema
@@ -0,0 +1,23 @@
+#
+# LDAP Public Key Patch schema for use with openssh-ldappubkey
@ -2247,11 +2243,10 @@ index 0000000..3136673
+ DESC 'MANDATORY: OpenSSH LPK objectclass'
+ MUST ( sshPublicKey $ uid )
+ )
diff --git a/ssh-ldap-helper.8 b/ssh-ldap-helper.8
new file mode 100644
index 0000000..f8440e4
Index: openssh-8.8p1/ssh-ldap-helper.8
===================================================================
--- /dev/null
+++ b/ssh-ldap-helper.8
+++ openssh-8.8p1/ssh-ldap-helper.8
@@ -0,0 +1,79 @@
+.\" $OpenBSD: ssh-ldap-helper.8,v 1.1 2010/02/10 23:20:38 markus Exp $
+.\"
@ -2332,21 +2327,19 @@ index 0000000..f8440e4
+OpenSSH 5.5 + PKA-LDAP .
+.Sh AUTHORS
+.An Jan F. Chadima Aq jchadima@redhat.com
diff --git a/ssh-ldap-wrapper b/ssh-ldap-wrapper
new file mode 100644
index 0000000..9fdfc37
Index: openssh-8.8p1/ssh-ldap-wrapper
===================================================================
--- /dev/null
+++ b/ssh-ldap-wrapper
+++ openssh-8.8p1/ssh-ldap-wrapper
@@ -0,0 +1,4 @@
+#!/bin/sh
+
+exec @LIBEXECDIR@/ssh-ldap-helper -s "$1"
+
diff --git a/ssh-ldap.conf.5 b/ssh-ldap.conf.5
new file mode 100644
index 0000000..15eb03d
Index: openssh-8.8p1/ssh-ldap.conf.5
===================================================================
--- /dev/null
+++ b/ssh-ldap.conf.5
+++ openssh-8.8p1/ssh-ldap.conf.5
@@ -0,0 +1,376 @@
+.\" $OpenBSD: ssh-ldap.conf.5,v 1.1 2010/02/10 23:20:38 markus Exp $
+.\"

View File

@ -2,11 +2,11 @@
# Parent bad0c8b3b8d72abb6960ed85b57ee42352371738
Do not write a PID file when not daemonizing (e.g. when running from systemd)
diff --git a/sshd.c b/sshd.c
index f3ccc3a..eadc1b3 100644
--- a/sshd.c
+++ b/sshd.c
@@ -2076,7 +2076,7 @@ main(int ac, char **av)
Index: openssh-8.8p1/sshd.c
===================================================================
--- openssh-8.8p1.orig/sshd.c
+++ openssh-8.8p1/sshd.c
@@ -2129,7 +2129,7 @@ main(int ac, char **av)
* Write out the pid file after the sigterm handler
* is setup and the listen sockets are bound
*/

View File

@ -5,10 +5,10 @@ UsePAM is used
bnc#708678, FATE#312033
Index: openssh-8.4p1/auth.c
Index: openssh-8.8p1/auth.c
===================================================================
--- openssh-8.4p1.orig/auth.c
+++ openssh-8.4p1/auth.c
--- openssh-8.8p1.orig/auth.c
+++ openssh-8.8p1/auth.c
@@ -113,7 +113,7 @@ allowed_user(struct ssh *ssh, struct pas
return 0;
@ -27,10 +27,10 @@ Index: openssh-8.4p1/auth.c
int locked = 0;
#ifdef LOCKED_PASSWD_STRING
Index: openssh-8.4p1/servconf.c
Index: openssh-8.8p1/servconf.c
===================================================================
--- openssh-8.4p1.orig/servconf.c
+++ openssh-8.4p1/servconf.c
--- openssh-8.8p1.orig/servconf.c
+++ openssh-8.8p1/servconf.c
@@ -92,6 +92,7 @@ initialize_server_options(ServerOptions
/* Portable-specific options */
@ -39,7 +39,7 @@ Index: openssh-8.4p1/servconf.c
/* Standard Options */
options->num_ports = 0;
@@ -300,6 +301,8 @@ fill_default_server_options(ServerOption
@@ -278,6 +279,8 @@ fill_default_server_options(ServerOption
/* Portable-specific options */
if (options->use_pam == -1)
options->use_pam = 0;
@ -48,7 +48,7 @@ Index: openssh-8.4p1/servconf.c
/* Standard Options */
if (options->num_host_key_files == 0) {
@@ -501,7 +504,7 @@ fill_default_server_options(ServerOption
@@ -485,7 +488,7 @@ fill_default_server_options(ServerOption
typedef enum {
sBadOption, /* == unknown option */
/* Portable-specific options */
@ -56,8 +56,8 @@ Index: openssh-8.4p1/servconf.c
+ sUsePAM, sUsePAMChecklocks,
/* Standard Options */
sPort, sHostKeyFile, sLoginGraceTime,
sPermitRootLogin, sLogFacility, sLogLevel,
@@ -553,8 +556,10 @@ static struct {
sPermitRootLogin, sLogFacility, sLogLevel, sLogVerbose,
@@ -535,8 +538,10 @@ static struct {
/* Portable-specific options */
#ifdef USE_PAM
{ "usepam", sUsePAM, SSHCFG_GLOBAL },
@ -68,7 +68,7 @@ Index: openssh-8.4p1/servconf.c
#endif
{ "pamauthenticationviakbdint", sDeprecated, SSHCFG_GLOBAL },
/* Standard Options */
@@ -1318,6 +1323,9 @@ process_server_config_line_depth(ServerO
@@ -1331,6 +1336,9 @@ process_server_config_line_depth(ServerO
case sUsePAM:
intptr = &options->use_pam;
goto parse_flag;
@ -78,11 +78,11 @@ Index: openssh-8.4p1/servconf.c
/* Standard Options */
case sBadOption:
Index: openssh-8.4p1/servconf.h
Index: openssh-8.8p1/servconf.h
===================================================================
--- openssh-8.4p1.orig/servconf.h
+++ openssh-8.4p1/servconf.h
@@ -195,6 +195,7 @@ typedef struct {
--- openssh-8.8p1.orig/servconf.h
+++ openssh-8.8p1/servconf.h
@@ -200,6 +200,7 @@ typedef struct {
char *adm_forced_command;
int use_pam; /* Enable auth via PAM */
@ -90,11 +90,11 @@ Index: openssh-8.4p1/servconf.h
int permit_tun;
Index: openssh-8.4p1/sshd_config.0
Index: openssh-8.8p1/sshd_config.0
===================================================================
--- openssh-8.4p1.orig/sshd_config.0
+++ openssh-8.4p1/sshd_config.0
@@ -1032,6 +1032,14 @@ DESCRIPTION
--- openssh-8.8p1.orig/sshd_config.0
+++ openssh-8.8p1/sshd_config.0
@@ -1074,6 +1074,14 @@ DESCRIPTION
If UsePAM is enabled, you will not be able to run sshd(8) as a
non-root user. The default is no.
@ -109,11 +109,11 @@ Index: openssh-8.4p1/sshd_config.0
VersionAddendum
Optionally specifies additional text to append to the SSH
protocol banner sent by the server upon connection. The default
Index: openssh-8.4p1/sshd_config.5
Index: openssh-8.8p1/sshd_config.5
===================================================================
--- openssh-8.4p1.orig/sshd_config.5
+++ openssh-8.4p1/sshd_config.5
@@ -1718,6 +1718,18 @@ is enabled, you will not be able to run
--- openssh-8.8p1.orig/sshd_config.5
+++ openssh-8.8p1/sshd_config.5
@@ -1775,6 +1775,18 @@ is enabled, you will not be able to run
as a non-root user.
The default is
.Cm no .

View File

@ -4,15 +4,11 @@
# formats in ?tmp? files)
# --used to be called '-pts'
diff --git a/openssh-7.7p1/loginrec.c b/openssh-7.7p1/loginrec.c
--- openssh-7.7p1/loginrec.c
+++ openssh-7.7p1/loginrec.c
@@ -541,17 +541,17 @@ getlast_entry(struct logininfo *li)
/*
* 'line' string utility functions
*
* These functions process the 'line' string into one of three forms:
*
Index: openssh-8.8p1/loginrec.c
===================================================================
--- openssh-8.8p1.orig/loginrec.c
+++ openssh-8.8p1/loginrec.c
@@ -549,7 +549,7 @@ getlast_entry(struct logininfo *li)
* 1. The full filename (including '/dev')
* 2. The stripped name (excluding '/dev')
* 3. The abbreviated name (e.g. /dev/ttyp00 -> yp00
@ -21,17 +17,7 @@ diff --git a/openssh-7.7p1/loginrec.c b/openssh-7.7p1/loginrec.c
*
* Form 3 is used on some systems to identify a .tmp.? entry when
* attempting to remove it. Typically both addition and removal is
* performed by one application - say, sshd - so as long as the choice
* uniquely identifies a terminal it's ok.
*/
@@ -602,16 +602,20 @@ line_abbrevname(char *dst, const char *s
/* Always skip prefix if present */
if (strncmp(src, "/dev/", 5) == 0)
src += 5;
#ifdef WITH_ABBREV_NO_TTY
@@ -610,6 +610,10 @@ line_abbrevname(char *dst, const char *s
if (strncmp(src, "tty", 3) == 0)
src += 3;
#endif
@ -42,8 +28,3 @@ diff --git a/openssh-7.7p1/loginrec.c b/openssh-7.7p1/loginrec.c
len = strlen(src);
if (len > 0) {
if (((int)len - dstsize) > 0)
src += ((int)len - dstsize);
/* note: _don't_ change this to strlcpy */

View File

@ -5,15 +5,11 @@ try to remove xauth cookies on logout
bnc#98815
diff --git a/openssh-7.7p1/session.c b/openssh-7.7p1/session.c
--- openssh-7.7p1/session.c
+++ openssh-7.7p1/session.c
@@ -2302,16 +2302,44 @@ session_close(struct ssh *ssh, Session *
u_int i;
verbose("Close session: user %s from %.200s port %d id %d",
s->pw->pw_name,
ssh_remote_ipaddr(ssh),
Index: openssh-8.8p1/session.c
===================================================================
--- openssh-8.8p1.orig/session.c
+++ openssh-8.8p1/session.c
@@ -2441,6 +2441,34 @@ session_close(struct ssh *ssh, Session *
ssh_remote_port(ssh),
s->self);
@ -48,8 +44,3 @@ diff --git a/openssh-7.7p1/session.c b/openssh-7.7p1/session.c
if (s->ttyfd != -1)
session_pty_cleanup(s);
free(s->term);
free(s->display);
free(s->x11_chanids);
free(s->auth_display);
free(s->auth_data);
free(s->auth_proto);

View File

@ -15,11 +15,11 @@ this is only need on s390 architecture.
Signed-off-by: Eduardo Barretto <ebarretto@linux.vnet.ibm.com>
Index: openssh-7.9p1/sandbox-seccomp-filter.c
Index: openssh-8.8p1/sandbox-seccomp-filter.c
===================================================================
--- openssh-7.9p1.orig/sandbox-seccomp-filter.c
+++ openssh-7.9p1/sandbox-seccomp-filter.c
@@ -175,6 +175,9 @@ static const struct sock_filter preauth_
--- openssh-8.8p1.orig/sandbox-seccomp-filter.c
+++ openssh-8.8p1/sandbox-seccomp-filter.c
@@ -219,6 +219,9 @@ static const struct sock_filter preauth_
#ifdef __NR_geteuid32
SC_ALLOW(__NR_geteuid32),
#endif
@ -29,7 +29,7 @@ Index: openssh-7.9p1/sandbox-seccomp-filter.c
#ifdef __NR_getpgid
SC_ALLOW(__NR_getpgid),
#endif
@@ -193,6 +196,9 @@ static const struct sock_filter preauth_
@@ -237,6 +240,9 @@ static const struct sock_filter preauth_
#ifdef __NR_getuid32
SC_ALLOW(__NR_getuid32),
#endif

View File

@ -5,15 +5,11 @@ Allow the stat() syscall for OpenSSL re-seed patch
bnc#912436
diff --git a/openssh-7.7p1/sandbox-seccomp-filter.c b/openssh-7.7p1/sandbox-seccomp-filter.c
--- openssh-7.7p1/sandbox-seccomp-filter.c
+++ openssh-7.7p1/sandbox-seccomp-filter.c
@@ -224,16 +224,19 @@ static const struct sock_filter preauth_
SC_ALLOW(__NR_select),
#endif
#ifdef __NR_shutdown
SC_ALLOW(__NR_shutdown),
#endif
Index: openssh-8.8p1/sandbox-seccomp-filter.c
===================================================================
--- openssh-8.8p1.orig/sandbox-seccomp-filter.c
+++ openssh-8.8p1/sandbox-seccomp-filter.c
@@ -294,6 +294,9 @@ static const struct sock_filter preauth_
#ifdef __NR_sigprocmask
SC_ALLOW(__NR_sigprocmask),
#endif
@ -23,8 +19,3 @@ diff --git a/openssh-7.7p1/sandbox-seccomp-filter.c b/openssh-7.7p1/sandbox-secc
#ifdef __NR_time
SC_ALLOW(__NR_time),
#endif
#ifdef __NR_write
SC_ALLOW(__NR_write),
#endif
#ifdef __NR_socketcall
SC_ALLOW_ARG(__NR_socketcall, 0, SYS_SHUTDOWN),

View File

@ -3,15 +3,11 @@
send locales in default configuration
bnc#65747
diff --git a/openssh-7.7p1/ssh_config b/openssh-7.7p1/ssh_config
--- openssh-7.7p1/ssh_config
+++ openssh-7.7p1/ssh_config
@@ -26,16 +26,21 @@ Host *
# security reasons: Someone stealing the authentification data on the
# remote side (the "spoofed" X-server by the remote sshd) can read your
# keystrokes as you type, just like any other X11 client could do.
# Set this to "no" here for global effect or in your own ~/.ssh/config
# file if you want to have the remote X11 authentification data to
Index: openssh-8.8p1/ssh_config
===================================================================
--- openssh-8.8p1.orig/ssh_config
+++ openssh-8.8p1/ssh_config
@@ -31,6 +31,11 @@ Host *
# expire after twenty minutes after remote login.
ForwardX11Trusted yes
@ -23,20 +19,11 @@ diff --git a/openssh-7.7p1/ssh_config b/openssh-7.7p1/ssh_config
# PasswordAuthentication yes
# HostbasedAuthentication no
# GSSAPIAuthentication no
# GSSAPIDelegateCredentials no
# BatchMode no
# CheckHostIP yes
# AddressFamily any
# ConnectTimeout 0
diff --git a/openssh-7.7p1/sshd_config b/openssh-7.7p1/sshd_config
--- openssh-7.7p1/sshd_config
+++ openssh-7.7p1/sshd_config
@@ -104,14 +104,19 @@ X11Forwarding yes
#VersionAddendum none
# no default banner path
#Banner none
Index: openssh-8.8p1/sshd_config
===================================================================
--- openssh-8.8p1.orig/sshd_config
+++ openssh-8.8p1/sshd_config
@@ -108,6 +108,11 @@ X11Forwarding yes
# override default of no subsystems
Subsystem sftp /usr/libexec/sftp-server
@ -48,6 +35,3 @@ diff --git a/openssh-7.7p1/sshd_config b/openssh-7.7p1/sshd_config
# Example of overriding settings on a per-user basis
#Match User anoncvs
# X11Forwarding no
# AllowTcpForwarding no
# PermitTTY no
# ForceCommand cvs server

View File

@ -1,7 +1,7 @@
Index: openssh-8.4p1/sftp-server.8
Index: openssh-8.8p1/sftp-server.8
===================================================================
--- openssh-8.4p1.orig/sftp-server.8
+++ openssh-8.4p1/sftp-server.8
--- openssh-8.8p1.orig/sftp-server.8
+++ openssh-8.8p1/sftp-server.8
@@ -38,6 +38,7 @@
.Op Fl P Ar denied_requests
.Op Fl p Ar allowed_requests
@ -21,11 +21,11 @@ Index: openssh-8.4p1/sftp-server.8
.El
.Pp
On some systems,
Index: openssh-8.4p1/sftp-server.c
Index: openssh-8.8p1/sftp-server.c
===================================================================
--- openssh-8.4p1.orig/sftp-server.c
+++ openssh-8.4p1/sftp-server.c
@@ -69,6 +69,10 @@ struct sshbuf *oqueue;
--- openssh-8.8p1.orig/sftp-server.c
+++ openssh-8.8p1/sftp-server.c
@@ -73,6 +73,10 @@ struct sshbuf *oqueue;
/* Version of client */
static u_int version;
@ -36,7 +36,7 @@ Index: openssh-8.4p1/sftp-server.c
/* SSH2_FXP_INIT received */
static int init_done;
@@ -687,6 +691,7 @@ process_open(u_int32_t id)
@@ -724,6 +728,7 @@ process_open(u_int32_t id)
Attrib a;
char *name;
int r, handle, fd, flags, mode, status = SSH2_FX_FAILURE;
@ -44,7 +44,7 @@ Index: openssh-8.4p1/sftp-server.c
if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 ||
(r = sshbuf_get_u32(iqueue, &pflags)) != 0 || /* portable flags */
@@ -696,6 +701,10 @@ process_open(u_int32_t id)
@@ -733,6 +738,10 @@ process_open(u_int32_t id)
debug3("request %u: open flags %d", id, pflags);
flags = flags_from_portable(pflags);
mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ? a.perm : 0666;
@ -55,7 +55,7 @@ Index: openssh-8.4p1/sftp-server.c
logit("open \"%s\" flags %s mode 0%o",
name, string_from_portable(pflags), mode);
if (readonly &&
@@ -717,6 +726,8 @@ process_open(u_int32_t id)
@@ -754,6 +763,8 @@ process_open(u_int32_t id)
}
}
}
@ -64,7 +64,7 @@ Index: openssh-8.4p1/sftp-server.c
if (status != SSH2_FX_OK)
send_status(id, status);
free(name);
@@ -1131,6 +1142,7 @@ process_mkdir(u_int32_t id)
@@ -1183,6 +1194,7 @@ process_mkdir(u_int32_t id)
Attrib a;
char *name;
int r, mode, status = SSH2_FX_FAILURE;
@ -72,7 +72,7 @@ Index: openssh-8.4p1/sftp-server.c
if ((r = sshbuf_get_cstring(iqueue, &name, NULL)) != 0 ||
(r = decode_attrib(iqueue, &a)) != 0)
@@ -1138,9 +1150,16 @@ process_mkdir(u_int32_t id)
@@ -1190,9 +1202,16 @@ process_mkdir(u_int32_t id)
mode = (a.flags & SSH2_FILEXFER_ATTR_PERMISSIONS) ?
a.perm & 07777 : 0777;
@ -89,7 +89,7 @@ Index: openssh-8.4p1/sftp-server.c
status = (r == -1) ? errno_to_portable(errno) : SSH2_FX_OK;
send_status(id, status);
free(name);
@@ -1560,7 +1579,7 @@ sftp_server_usage(void)
@@ -1700,7 +1719,7 @@ sftp_server_usage(void)
fprintf(stderr,
"usage: %s [-ehR] [-d start_directory] [-f log_facility] "
"[-l log_level]\n\t[-P denied_requests] "
@ -98,7 +98,7 @@ Index: openssh-8.4p1/sftp-server.c
" %s -Q protocol_feature\n",
__progname, __progname);
exit(1);
@@ -1588,7 +1607,7 @@ sftp_server_main(int argc, char **argv,
@@ -1728,7 +1747,7 @@ sftp_server_main(int argc, char **argv,
pw = pwcopy(user_pw);
while (!skipargs && (ch = getopt(argc, argv,
@ -107,7 +107,7 @@ Index: openssh-8.4p1/sftp-server.c
switch (ch) {
case 'Q':
if (strcasecmp(optarg, "requests") != 0) {
@@ -1650,6 +1669,15 @@ sftp_server_main(int argc, char **argv,
@@ -1790,6 +1809,15 @@ sftp_server_main(int argc, char **argv,
fatal("Invalid umask \"%s\"", optarg);
(void)umask((mode_t)mask);
break;

View File

@ -2,10 +2,10 @@
# Parent 60bdbe6dd8d6bc011883472363d56e1d97f68835
Put back sftp client diagnostic messages in batch mode
Index: openssh-8.4p1/sftp.1
Index: openssh-8.8p1/sftp.1
===================================================================
--- openssh-8.4p1.orig/sftp.1
+++ openssh-8.4p1/sftp.1
--- openssh-8.8p1.orig/sftp.1
+++ openssh-8.8p1/sftp.1
@@ -287,6 +287,9 @@ Specifies the port to connect to on the
.It Fl p
Preserves modification times, access times, and modes from the
@ -16,12 +16,12 @@ Index: openssh-8.4p1/sftp.1
.It Fl q
Quiet mode: disables the progress meter as well as warning and
diagnostic messages from
Index: openssh-8.4p1/sftp.c
Index: openssh-8.8p1/sftp.c
===================================================================
--- openssh-8.4p1.orig/sftp.c
+++ openssh-8.4p1/sftp.c
@@ -85,6 +85,9 @@ static volatile pid_t sshpid = -1;
/* Suppress diagnositic messages */
--- openssh-8.8p1.orig/sftp.c
+++ openssh-8.8p1/sftp.c
@@ -82,6 +82,9 @@ static volatile pid_t sshpid = -1;
/* Suppress diagnostic messages */
int quiet = 0;
+/* Force diagnositic messages in batch mode */
@ -30,7 +30,7 @@ Index: openssh-8.4p1/sftp.c
/* This is set to 0 if the progressmeter is not desired. */
int showprogress = 1;
@@ -2408,7 +2411,7 @@ main(int argc, char **argv)
@@ -2381,7 +2384,7 @@ main(int argc, char **argv)
infile = stdin;
while ((ch = getopt(argc, argv,
@ -39,7 +39,7 @@ Index: openssh-8.4p1/sftp.c
switch (ch) {
/* Passed through to ssh(1) */
case 'A':
@@ -2426,6 +2429,9 @@ main(int argc, char **argv)
@@ -2399,6 +2402,9 @@ main(int argc, char **argv)
addargs(&args, "-%c", ch);
addargs(&args, "%s", optarg);
break;
@ -49,7 +49,7 @@ Index: openssh-8.4p1/sftp.c
case 'q':
ll = SYSLOG_LEVEL_ERROR;
quiet = 1;
@@ -2510,6 +2516,8 @@ main(int argc, char **argv)
@@ -2483,6 +2489,8 @@ main(int argc, char **argv)
usage();
}
}

View File

@ -3,11 +3,11 @@
Send signals to systemd to prevent various race conditions
bsc#1048367
Index: openssh-7.8p1/configure.ac
Index: openssh-8.8p1/configure.ac
===================================================================
--- openssh-7.8p1.orig/configure.ac
+++ openssh-7.8p1/configure.ac
@@ -4378,6 +4378,30 @@ AC_ARG_WITH([kerberos5],
--- openssh-8.8p1.orig/configure.ac
+++ openssh-8.8p1/configure.ac
@@ -4751,6 +4751,30 @@ AC_ARG_WITH([kerberos5],
AC_SUBST([GSSLIBS])
AC_SUBST([K5LIBS])
@ -38,7 +38,7 @@ Index: openssh-7.8p1/configure.ac
# Looking for programs, paths and files
PRIVSEP_PATH=/var/empty
@@ -5183,6 +5207,7 @@ echo " libldns support
@@ -5564,6 +5588,7 @@ echo " libldns support
echo " Solaris process contract support: $SPC_MSG"
echo " Solaris project support: $SP_MSG"
echo " Solaris privilege support: $SPP_MSG"
@ -46,11 +46,11 @@ Index: openssh-7.8p1/configure.ac
echo " IP address in \$DISPLAY hack: $DISPLAY_HACK_MSG"
echo " Translate v4 in v6 hack: $IPV4_IN6_HACK_MSG"
echo " BSD Auth support: $BSD_AUTH_MSG"
Index: openssh-7.8p1/sshd.c
Index: openssh-8.8p1/sshd.c
===================================================================
--- openssh-7.8p1.orig/sshd.c
+++ openssh-7.8p1/sshd.c
@@ -87,6 +87,10 @@
--- openssh-8.8p1.orig/sshd.c
+++ openssh-8.8p1/sshd.c
@@ -85,6 +85,10 @@
#include <prot.h>
#endif
@ -72,7 +72,7 @@ Index: openssh-7.8p1/sshd.c
logit("Received SIGHUP; restarting.");
if (options.pid_file != NULL)
unlink(options.pid_file);
@@ -1995,6 +2003,11 @@ main(int ac, char **av)
@@ -2076,6 +2084,11 @@ main(int ac, char **av)
}
}

View File

@ -8,11 +8,11 @@ Date: Fri Sep 27 01:57:16 2019 +0200
just going with what mkstemp() gives us. This is useful in corner
cases where known_hosts is shared between users.
diff --git a/ssh-keygen.c b/ssh-keygen.c
index 03a7fe5..ca8a309 100644
--- a/ssh-keygen.c
+++ b/ssh-keygen.c
@@ -1338,6 +1338,11 @@ do_known_hosts(struct passwd *pw, const char *name)
Index: openssh-8.8p1/ssh-keygen.c
===================================================================
--- openssh-8.8p1.orig/ssh-keygen.c
+++ openssh-8.8p1/ssh-keygen.c
@@ -1384,6 +1384,11 @@ do_known_hosts(struct passwd *pw, const
if (inplace)
unlink(tmp);
} else if (inplace) {
@ -24,7 +24,7 @@ index 03a7fe5..ca8a309 100644
/* Backup existing file */
if (unlink(old) == -1 && errno != ENOENT)
fatal("unlink %.100s: %s", old, strerror(errno));
@@ -1352,6 +1357,12 @@ do_known_hosts(struct passwd *pw, const char *name)
@@ -1398,6 +1403,12 @@ do_known_hosts(struct passwd *pw, const
unlink(old);
exit(1);
}

View File

@ -6,11 +6,11 @@ Date: Thu Jun 20 23:54:11 2019 +0200
Reverts OpenBSD-Commit-ID: d11d2a4484f461524ef0c20870523dfcdeb52181
diff --git a/readconf.c b/readconf.c
index 24f2cb1..bbdea0d 100644
--- a/readconf.c
+++ b/readconf.c
@@ -2183,9 +2183,9 @@ fill_default_options(Options * options)
Index: openssh-8.8p1/readconf.c
===================================================================
--- openssh-8.8p1.orig/readconf.c
+++ openssh-8.8p1/readconf.c
@@ -2679,9 +2679,9 @@ fill_default_options(Options * options)
if (options->visual_host_key == -1)
options->visual_host_key = 0;
if (options->ip_qos_interactive == -1)
@ -21,12 +21,12 @@ index 24f2cb1..bbdea0d 100644
+ options->ip_qos_bulk = IPTOS_THROUGHPUT;
if (options->request_tty == -1)
options->request_tty = REQUEST_TTY_AUTO;
if (options->proxy_use_fdpass == -1)
diff --git a/servconf.c b/servconf.c
index 13cf154..766ac6b 100644
--- a/servconf.c
+++ b/servconf.c
@@ -445,9 +445,9 @@ fill_default_server_options(ServerOptions *options)
if (options->session_type == -1)
Index: openssh-8.8p1/servconf.c
===================================================================
--- openssh-8.8p1.orig/servconf.c
+++ openssh-8.8p1/servconf.c
@@ -459,9 +459,9 @@ fill_default_server_options(ServerOption
if (options->permit_tun == -1)
options->permit_tun = SSH_TUNMODE_NO;
if (options->ip_qos_interactive == -1)
@ -38,11 +38,11 @@ index 13cf154..766ac6b 100644
if (options->version_addendum == NULL)
options->version_addendum = xstrdup("");
if (options->fwd_opts.streamlocal_bind_mask == (mode_t)-1)
diff --git a/ssh_config.5 b/ssh_config.5
index 3bf0502..10246f8 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -1088,11 +1088,9 @@ If one argument is specified, it is used as the packet class unconditionally.
Index: openssh-8.8p1/ssh_config.5
===================================================================
--- openssh-8.8p1.orig/ssh_config.5
+++ openssh-8.8p1/ssh_config.5
@@ -1182,11 +1182,9 @@ If one argument is specified, it is used
If two values are specified, the first is automatically selected for
interactive sessions and the second for non-interactive sessions.
The default is
@ -56,11 +56,11 @@ index 3bf0502..10246f8 100644
for non-interactive sessions.
.It Cm KbdInteractiveAuthentication
Specifies whether to use keyboard-interactive authentication.
diff --git a/sshd_config.5 b/sshd_config.5
index 50a4917..a276fcb 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -868,11 +868,9 @@ If one argument is specified, it is used as the packet class unconditionally.
Index: openssh-8.8p1/sshd_config.5
===================================================================
--- openssh-8.8p1.orig/sshd_config.5
+++ openssh-8.8p1/sshd_config.5
@@ -903,11 +903,9 @@ If one argument is specified, it is used
If two values are specified, the first is automatically selected for
interactive sessions and the second for non-interactive sessions.
The default is

File diff suppressed because it is too large Load Diff

View File

@ -1,9 +1,9 @@
Index: openssh-8.4p1/Makefile.in
Index: openssh-8.8p1/Makefile.in
===================================================================
--- openssh-8.4p1.orig/Makefile.in
+++ openssh-8.4p1/Makefile.in
@@ -113,7 +113,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
sntrup4591761.o kexsntrup4591761x25519.o kexgen.o \
--- openssh-8.8p1.orig/Makefile.in
+++ openssh-8.8p1/Makefile.in
@@ -114,7 +114,7 @@ LIBSSH_OBJS=${LIBOPENSSH_OBJS} \
kexsntrup761x25519.o sntrup761.o kexgen.o \
kexgssc.o \
sftp-realpath.o platform-pledge.o platform-tracing.o platform-misc.o \
- sshbuf-io.o
@ -11,11 +11,11 @@ Index: openssh-8.4p1/Makefile.in
SKOBJS= ssh-sk-client.o
Index: openssh-8.4p1/audit-bsm.c
Index: openssh-8.8p1/audit-bsm.c
===================================================================
--- openssh-8.4p1.orig/audit-bsm.c
+++ openssh-8.4p1/audit-bsm.c
@@ -372,13 +372,26 @@ audit_connection_from(const char *host,
--- openssh-8.8p1.orig/audit-bsm.c
+++ openssh-8.8p1/audit-bsm.c
@@ -373,13 +373,26 @@ audit_connection_from(const char *host,
#endif
}
@ -43,7 +43,7 @@ Index: openssh-8.4p1/audit-bsm.c
audit_session_open(struct logininfo *li)
{
/* not implemented */
@@ -390,6 +403,12 @@ audit_session_close(struct logininfo *li
@@ -391,6 +404,12 @@ audit_session_close(struct logininfo *li
/* not implemented */
}
@ -56,7 +56,7 @@ Index: openssh-8.4p1/audit-bsm.c
void
audit_event(struct ssh *ssh, ssh_audit_event_t event)
{
@@ -451,4 +470,28 @@ audit_event(struct ssh *ssh, ssh_audit_e
@@ -452,4 +471,28 @@ audit_event(struct ssh *ssh, ssh_audit_e
debug("%s: unhandled event %d", __func__, event);
}
}
@ -85,10 +85,10 @@ Index: openssh-8.4p1/audit-bsm.c
+ /* not implemented */
+}
#endif /* BSM */
Index: openssh-8.4p1/audit-linux.c
Index: openssh-8.8p1/audit-linux.c
===================================================================
--- openssh-8.4p1.orig/audit-linux.c
+++ openssh-8.4p1/audit-linux.c
--- openssh-8.8p1.orig/audit-linux.c
+++ openssh-8.8p1/audit-linux.c
@@ -33,27 +33,40 @@
#include "log.h"
@ -459,10 +459,10 @@ Index: openssh-8.4p1/audit-linux.c
+ error("cannot write into audit");
+}
#endif /* USE_LINUX_AUDIT */
Index: openssh-8.4p1/audit.c
Index: openssh-8.8p1/audit.c
===================================================================
--- openssh-8.4p1.orig/audit.c
+++ openssh-8.4p1/audit.c
--- openssh-8.8p1.orig/audit.c
+++ openssh-8.8p1/audit.c
@@ -34,6 +34,12 @@
#include "log.h"
#include "hostfile.h"
@ -640,10 +640,10 @@ Index: openssh-8.4p1/audit.c
}
# endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */
#endif /* SSH_AUDIT_EVENTS */
Index: openssh-8.4p1/audit.h
Index: openssh-8.8p1/audit.h
===================================================================
--- openssh-8.4p1.orig/audit.h
+++ openssh-8.4p1/audit.h
--- openssh-8.8p1.orig/audit.h
+++ openssh-8.8p1/audit.h
@@ -26,6 +26,7 @@
# define _SSH_AUDIT_H
@ -686,10 +686,10 @@ Index: openssh-8.4p1/audit.h
+void audit_destroy_sensitive_data(struct ssh *, const char *, pid_t, uid_t);
#endif /* _SSH_AUDIT_H */
Index: openssh-8.4p1/auditstub.c
Index: openssh-8.8p1/auditstub.c
===================================================================
--- /dev/null
+++ openssh-8.4p1/auditstub.c
+++ openssh-8.8p1/auditstub.c
@@ -0,0 +1,52 @@
+/* $Id: auditstub.c,v 1.1 jfch Exp $ */
+
@ -743,20 +743,11 @@ Index: openssh-8.4p1/auditstub.c
+audit_session_key_free_body(struct ssh *ssh, int ctos, pid_t pid, uid_t uid)
+{
+}
Index: openssh-8.4p1/auth.c
Index: openssh-8.8p1/auth.c
===================================================================
--- openssh-8.4p1.orig/auth.c
+++ openssh-8.4p1/auth.c
@@ -367,7 +367,7 @@ auth_log(struct ssh *ssh, int authentica
# endif
#endif
#ifdef SSH_AUDIT_EVENTS
- if (authenticated == 0 && !authctxt->postponed)
+ if (authenticated == 0 && !authctxt->postponed && !partial)
audit_event(ssh, audit_classify_auth(method));
#endif
}
@@ -593,9 +593,6 @@ getpwnamallow(struct ssh *ssh, const cha
--- openssh-8.8p1.orig/auth.c
+++ openssh-8.8p1/auth.c
@@ -599,9 +599,6 @@ getpwnamallow(struct ssh *ssh, const cha
record_failed_login(ssh, user,
auth_get_canonical_hostname(ssh, options.use_dns), "ssh");
#endif
@ -766,10 +757,10 @@ Index: openssh-8.4p1/auth.c
return (NULL);
}
if (!allowed_user(ssh, pw))
Index: openssh-8.4p1/auth.h
Index: openssh-8.8p1/auth.h
===================================================================
--- openssh-8.4p1.orig/auth.h
+++ openssh-8.4p1/auth.h
--- openssh-8.8p1.orig/auth.h
+++ openssh-8.8p1/auth.h
@@ -189,6 +189,8 @@ struct passwd * getpwnamallow(struct ssh
char *expand_authorized_keys(const char *, struct passwd *pw);
@ -788,11 +779,11 @@ Index: openssh-8.4p1/auth.h
/* Key / cert options linkage to auth layer */
const struct sshauthopt *auth_options(struct ssh *);
Index: openssh-8.4p1/auth2-hostbased.c
Index: openssh-8.8p1/auth2-hostbased.c
===================================================================
--- openssh-8.4p1.orig/auth2-hostbased.c
+++ openssh-8.4p1/auth2-hostbased.c
@@ -150,7 +150,7 @@ userauth_hostbased(struct ssh *ssh)
--- openssh-8.8p1.orig/auth2-hostbased.c
+++ openssh-8.8p1/auth2-hostbased.c
@@ -149,7 +149,7 @@ userauth_hostbased(struct ssh *ssh)
authenticated = 0;
if (PRIVSEP(hostbased_key_allowed(ssh, authctxt->pw, cuser,
chost, key)) &&
@ -801,7 +792,7 @@ Index: openssh-8.4p1/auth2-hostbased.c
sshbuf_ptr(b), sshbuf_len(b), pkalg, ssh->compat, NULL)) == 0)
authenticated = 1;
@@ -167,6 +167,19 @@ done:
@@ -166,6 +166,19 @@ done:
return authenticated;
}
@ -821,11 +812,11 @@ Index: openssh-8.4p1/auth2-hostbased.c
/* return 1 if given hostkey is allowed */
int
hostbased_key_allowed(struct ssh *ssh, struct passwd *pw,
Index: openssh-8.4p1/auth2-pubkey.c
Index: openssh-8.8p1/auth2-pubkey.c
===================================================================
--- openssh-8.4p1.orig/auth2-pubkey.c
+++ openssh-8.4p1/auth2-pubkey.c
@@ -212,7 +212,7 @@ userauth_pubkey(struct ssh *ssh)
--- openssh-8.8p1.orig/auth2-pubkey.c
+++ openssh-8.8p1/auth2-pubkey.c
@@ -203,7 +203,7 @@ userauth_pubkey(struct ssh *ssh)
/* test for correct signature */
authenticated = 0;
if (PRIVSEP(user_key_allowed(ssh, pw, key, 1, &authopts)) &&
@ -834,7 +825,7 @@ Index: openssh-8.4p1/auth2-pubkey.c
sshbuf_ptr(b), sshbuf_len(b),
(ssh->compat & SSH_BUG_SIGTYPE) == 0 ? pkalg : NULL,
ssh->compat, &sig_details)) == 0) {
@@ -308,6 +308,19 @@ done:
@@ -295,6 +295,19 @@ done:
return authenticated;
}
@ -854,11 +845,11 @@ Index: openssh-8.4p1/auth2-pubkey.c
static int
match_principals_option(const char *principal_list, struct sshkey_cert *cert)
{
Index: openssh-8.4p1/auth2.c
Index: openssh-8.8p1/auth2.c
===================================================================
--- openssh-8.4p1.orig/auth2.c
+++ openssh-8.4p1/auth2.c
@@ -293,9 +293,6 @@ input_userauth_request(int type, u_int32
--- openssh-8.8p1.orig/auth2.c
+++ openssh-8.8p1/auth2.c
@@ -290,9 +290,6 @@ input_userauth_request(int type, u_int32
} else {
/* Invalid user, fake password information */
authctxt->pw = fakepw();
@ -868,10 +859,10 @@ Index: openssh-8.4p1/auth2.c
}
#ifdef USE_PAM
if (options.use_pam)
Index: openssh-8.4p1/cipher.c
Index: openssh-8.8p1/cipher.c
===================================================================
--- openssh-8.4p1.orig/cipher.c
+++ openssh-8.4p1/cipher.c
--- openssh-8.8p1.orig/cipher.c
+++ openssh-8.8p1/cipher.c
@@ -58,25 +58,6 @@
#define EVP_CIPHER_CTX void
#endif
@ -898,7 +889,7 @@ Index: openssh-8.4p1/cipher.c
static const struct sshcipher ciphers_all[] = {
#ifdef WITH_OPENSSL
#ifndef OPENSSL_NO_DES
@@ -462,7 +443,7 @@ cipher_get_length(struct sshcipher_ctx *
@@ -460,7 +441,7 @@ cipher_get_length(struct sshcipher_ctx *
void
cipher_free(struct sshcipher_ctx *cc)
{
@ -907,10 +898,10 @@ Index: openssh-8.4p1/cipher.c
return;
if ((cc->cipher->flags & CFLAG_CHACHAPOLY) != 0) {
chachapoly_free(cc->cp_ctx);
Index: openssh-8.4p1/cipher.h
Index: openssh-8.8p1/cipher.h
===================================================================
--- openssh-8.4p1.orig/cipher.h
+++ openssh-8.4p1/cipher.h
--- openssh-8.8p1.orig/cipher.h
+++ openssh-8.8p1/cipher.h
@@ -47,7 +47,25 @@
#define CIPHER_ENCRYPT 1
#define CIPHER_DECRYPT 0
@ -938,10 +929,10 @@ Index: openssh-8.4p1/cipher.h
struct sshcipher_ctx {
int plaintext;
int encrypt;
Index: openssh-8.4p1/kex.c
Index: openssh-8.8p1/kex.c
===================================================================
--- openssh-8.4p1.orig/kex.c
+++ openssh-8.4p1/kex.c
--- openssh-8.8p1.orig/kex.c
+++ openssh-8.8p1/kex.c
@@ -62,6 +62,7 @@
#include "ssherr.h"
#include "sshbuf.h"
@ -950,7 +941,7 @@ Index: openssh-8.4p1/kex.c
#ifdef GSSAPI
#include "ssh-gss.h"
@@ -857,12 +858,16 @@ kex_start_rekex(struct ssh *ssh)
@@ -859,12 +860,16 @@ kex_start_rekex(struct ssh *ssh)
}
static int
@ -967,9 +958,9 @@ Index: openssh-8.4p1/kex.c
return SSH_ERR_NO_CIPHER_ALG_MATCH;
+ }
if ((enc->cipher = cipher_by_name(name)) == NULL) {
error("%s: unsupported cipher %s", __func__, name);
error_f("unsupported cipher %s", name);
free(name);
@@ -883,8 +888,12 @@ choose_mac(struct ssh *ssh, struct sshma
@@ -885,8 +890,12 @@ choose_mac(struct ssh *ssh, struct sshma
{
char *name = match_list(client, server, NULL);
@ -981,9 +972,9 @@ Index: openssh-8.4p1/kex.c
return SSH_ERR_NO_MAC_ALG_MATCH;
+ }
if (mac_setup(mac, name) < 0) {
error("%s: unsupported MAC %s", __func__, name);
error_f("unsupported MAC %s", name);
free(name);
@@ -897,12 +906,16 @@ choose_mac(struct ssh *ssh, struct sshma
@@ -899,12 +908,16 @@ choose_mac(struct ssh *ssh, struct sshma
}
static int
@ -1002,7 +993,7 @@ Index: openssh-8.4p1/kex.c
#ifdef WITH_ZLIB
if (strcmp(name, "zlib@openssh.com") == 0) {
comp->type = COMP_DELAYED;
@@ -1043,7 +1056,7 @@ kex_choose_conf(struct ssh *ssh)
@@ -1045,7 +1058,7 @@ kex_choose_conf(struct ssh *ssh)
nenc = ctos ? PROPOSAL_ENC_ALGS_CTOS : PROPOSAL_ENC_ALGS_STOC;
nmac = ctos ? PROPOSAL_MAC_ALGS_CTOS : PROPOSAL_MAC_ALGS_STOC;
ncomp = ctos ? PROPOSAL_COMP_ALGS_CTOS : PROPOSAL_COMP_ALGS_STOC;
@ -1011,7 +1002,7 @@ Index: openssh-8.4p1/kex.c
sprop[nenc])) != 0) {
kex->failed_choice = peer[nenc];
peer[nenc] = NULL;
@@ -1058,7 +1071,7 @@ kex_choose_conf(struct ssh *ssh)
@@ -1060,7 +1073,7 @@ kex_choose_conf(struct ssh *ssh)
peer[nmac] = NULL;
goto out;
}
@ -1020,7 +1011,7 @@ Index: openssh-8.4p1/kex.c
sprop[ncomp])) != 0) {
kex->failed_choice = peer[ncomp];
peer[ncomp] = NULL;
@@ -1081,6 +1094,10 @@ kex_choose_conf(struct ssh *ssh)
@@ -1083,6 +1096,10 @@ kex_choose_conf(struct ssh *ssh)
dh_need = MAXIMUM(dh_need, newkeys->enc.block_size);
dh_need = MAXIMUM(dh_need, newkeys->enc.iv_len);
dh_need = MAXIMUM(dh_need, newkeys->mac.key_len);
@ -1031,7 +1022,7 @@ Index: openssh-8.4p1/kex.c
}
/* XXX need runden? */
kex->we_need = need;
@@ -1245,6 +1262,36 @@ dump_digest(const char *msg, const u_cha
@@ -1250,6 +1267,36 @@ dump_digest(const char *msg, const u_cha
}
#endif
@ -1068,10 +1059,10 @@ Index: openssh-8.4p1/kex.c
/*
* Send a plaintext error message to the peer, suffixed by \r\n.
* Only used during banner exchange, and there only for the server.
Index: openssh-8.4p1/kex.h
Index: openssh-8.8p1/kex.h
===================================================================
--- openssh-8.4p1.orig/kex.h
+++ openssh-8.4p1/kex.h
--- openssh-8.8p1.orig/kex.h
+++ openssh-8.8p1/kex.h
@@ -226,6 +226,8 @@ int kexgss_client(struct ssh *);
int kexgss_server(struct ssh *);
#endif
@ -1081,10 +1072,10 @@ Index: openssh-8.4p1/kex.h
int kex_dh_keypair(struct kex *);
int kex_dh_enc(struct kex *, const struct sshbuf *, struct sshbuf **,
struct sshbuf **);
Index: openssh-8.4p1/mac.c
Index: openssh-8.8p1/mac.c
===================================================================
--- openssh-8.4p1.orig/mac.c
+++ openssh-8.4p1/mac.c
--- openssh-8.8p1.orig/mac.c
+++ openssh-8.8p1/mac.c
@@ -277,6 +277,20 @@ mac_clear(struct sshmac *mac)
mac->umac_ctx = NULL;
}
@ -1106,10 +1097,10 @@ Index: openssh-8.4p1/mac.c
/* XXX copied from ciphers_valid */
#define MAC_SEP ","
int
Index: openssh-8.4p1/mac.h
Index: openssh-8.8p1/mac.h
===================================================================
--- openssh-8.4p1.orig/mac.h
+++ openssh-8.4p1/mac.h
--- openssh-8.8p1.orig/mac.h
+++ openssh-8.8p1/mac.h
@@ -49,5 +49,6 @@ int mac_compute(struct sshmac *, u_int3
int mac_check(struct sshmac *, u_int32_t, const u_char *, size_t,
const u_char *, size_t);
@ -1117,10 +1108,10 @@ Index: openssh-8.4p1/mac.h
+void mac_destroy(struct sshmac *);
#endif /* SSHMAC_H */
Index: openssh-8.4p1/monitor.c
Index: openssh-8.8p1/monitor.c
===================================================================
--- openssh-8.4p1.orig/monitor.c
+++ openssh-8.4p1/monitor.c
--- openssh-8.8p1.orig/monitor.c
+++ openssh-8.8p1/monitor.c
@@ -93,6 +93,7 @@
#include "compat.h"
#include "ssh2.h"
@ -1129,7 +1120,7 @@ Index: openssh-8.4p1/monitor.c
#include "match.h"
#include "ssherr.h"
#include "sk-api.h"
@@ -108,6 +109,8 @@ extern u_char session_id[];
@@ -107,6 +108,8 @@ extern u_int utmp_len;
extern struct sshbuf *loginmsg;
extern struct sshauthopt *auth_opts; /* XXX move to permanent ssh->authctxt? */
@ -1138,7 +1129,7 @@ Index: openssh-8.4p1/monitor.c
/* State exported from the child */
static struct sshbuf *child_state;
@@ -155,6 +158,11 @@ int mm_answer_gss_updatecreds(struct ssh
@@ -152,6 +155,11 @@ int mm_answer_gss_updatecreds(struct ssh
#ifdef SSH_AUDIT_EVENTS
int mm_answer_audit_event(struct ssh *, int, struct sshbuf *);
int mm_answer_audit_command(struct ssh *, int, struct sshbuf *);
@ -1150,7 +1141,7 @@ Index: openssh-8.4p1/monitor.c
#endif
static Authctxt *authctxt;
@@ -210,6 +218,10 @@ struct mon_table mon_dispatch_proto20[]
@@ -207,6 +215,10 @@ struct mon_table mon_dispatch_proto20[]
#endif
#ifdef SSH_AUDIT_EVENTS
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
@ -1161,7 +1152,7 @@ Index: openssh-8.4p1/monitor.c
#endif
#ifdef BSD_AUTH
{MONITOR_REQ_BSDAUTHQUERY, MON_ISAUTH, mm_answer_bsdauthquery},
@@ -244,6 +256,11 @@ struct mon_table mon_dispatch_postauth20
@@ -241,6 +253,11 @@ struct mon_table mon_dispatch_postauth20
#ifdef SSH_AUDIT_EVENTS
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
{MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT, mm_answer_audit_command},
@ -1173,7 +1164,7 @@ Index: openssh-8.4p1/monitor.c
#endif
{0, 0, NULL}
};
@@ -1407,8 +1424,10 @@ mm_answer_keyverify(struct ssh *ssh, int
@@ -1403,8 +1420,10 @@ mm_answer_keyverify(struct ssh *ssh, int
int r, ret, req_presence = 0, req_verify = 0, valid_data = 0;
int encoded_ret;
struct sshkey_sig_details *sig_details = NULL;
@ -1185,18 +1176,18 @@ Index: openssh-8.4p1/monitor.c
(r = sshbuf_get_string_direct(m, &signature, &signaturelen)) != 0 ||
(r = sshbuf_get_string_direct(m, &data, &datalen)) != 0 ||
(r = sshbuf_get_cstring(m, &sigalg, NULL)) != 0)
@@ -1417,6 +1436,8 @@ mm_answer_keyverify(struct ssh *ssh, int
@@ -1413,6 +1432,8 @@ mm_answer_keyverify(struct ssh *ssh, int
if (hostbased_cuser == NULL || hostbased_chost == NULL ||
!monitor_allowed_key(blob, bloblen))
fatal("%s: bad key, not previously allowed", __func__);
fatal_f("bad key, not previously allowed");
+ if (type != key_blobtype)
+ fatal("%s: bad key type", __func__);
+ fatal_f("bad key type");
/* Empty signature algorithm means NULL. */
if (*sigalg == '\0') {
@@ -1432,14 +1453,19 @@ mm_answer_keyverify(struct ssh *ssh, int
@@ -1428,14 +1449,19 @@ mm_answer_keyverify(struct ssh *ssh, int
case MM_USERKEY:
valid_data = monitor_valid_userblob(data, datalen);
valid_data = monitor_valid_userblob(ssh, data, datalen);
auth_method = "publickey";
+ ret = user_key_verify(ssh, key, signature, signaturelen, data,
+ datalen, sigalg, ssh->compat, &sig_details);
@ -1214,55 +1205,55 @@ Index: openssh-8.4p1/monitor.c
break;
}
if (!valid_data)
@@ -1449,8 +1475,6 @@ mm_answer_keyverify(struct ssh *ssh, int
@@ -1447,8 +1473,6 @@ mm_answer_keyverify(struct ssh *ssh, int
SSH_FP_DEFAULT)) == NULL)
fatal("%s: sshkey_fingerprint failed", __func__);
fatal_f("sshkey_fingerprint failed");
- ret = sshkey_verify(key, signature, signaturelen, data, datalen,
- sigalg, ssh->compat, &sig_details);
debug3("%s: %s %p signature %s%s%s", __func__, auth_method, key,
debug3_f("%s %s signature %s%s%s", auth_method, sshkey_type(key),
(ret == 0) ? "verified" : "unverified",
(ret != 0) ? ": " : "", (ret != 0) ? ssh_err(ret) : "");
@@ -1537,13 +1561,19 @@ mm_record_login(struct ssh *ssh, Session
@@ -1535,13 +1559,19 @@ mm_record_login(struct ssh *ssh, Session
}
static void
-mm_session_close(Session *s)
+mm_session_close(struct ssh *ssh, Session *s)
{
debug3("%s: session %d pid %ld", __func__, s->self, (long)s->pid);
debug3_f("session %d pid %ld", s->self, (long)s->pid);
if (s->ttyfd != -1) {
debug3("%s: tty %s ptyfd %d", __func__, s->tty, s->ptyfd);
debug3_f("tty %s ptyfd %d", s->tty, s->ptyfd);
session_pty_cleanup2(s);
}
+#ifdef SSH_AUDIT_EVENTS
+ if (s->command != NULL) {
+ debug3("%s: command %d", __func__, s->command_handle);
+ debug3_f("command %d", s->command_handle);
+ session_end_command2(ssh, s);
+ }
+#endif
session_unused(s->self);
}
@@ -1610,7 +1640,7 @@ mm_answer_pty(struct ssh *ssh, int sock,
@@ -1608,7 +1638,7 @@ mm_answer_pty(struct ssh *ssh, int sock,
error:
if (s != NULL)
- mm_session_close(s);
+ mm_session_close(ssh, s);
if ((r = sshbuf_put_u32(m, 0)) != 0)
fatal("%s: buffer error: %s", __func__, ssh_err(r));
fatal_fr(r, "assemble 0");
mm_request_send(sock, MONITOR_ANS_PTY, m);
@@ -1629,7 +1659,7 @@ mm_answer_pty_cleanup(struct ssh *ssh, i
@@ -1627,7 +1657,7 @@ mm_answer_pty_cleanup(struct ssh *ssh, i
if ((r = sshbuf_get_cstring(m, &tty, NULL)) != 0)
fatal("%s: buffer error: %s", __func__, ssh_err(r));
fatal_fr(r, "parse tty");
if ((s = session_by_tty(tty)) != NULL)
- mm_session_close(s);
+ mm_session_close(ssh, s);
sshbuf_reset(m);
free(tty);
return (0);
@@ -1651,6 +1681,8 @@ mm_answer_term(struct ssh *ssh, int sock
@@ -1649,6 +1679,8 @@ mm_answer_term(struct ssh *ssh, int sock
sshpam_cleanup();
#endif
@ -1271,7 +1262,7 @@ Index: openssh-8.4p1/monitor.c
while (waitpid(pmonitor->m_pid, &status, 0) == -1)
if (errno != EINTR)
exit(1);
@@ -1697,12 +1729,47 @@ mm_answer_audit_command(struct ssh *ssh,
@@ -1695,12 +1727,47 @@ mm_answer_audit_command(struct ssh *ssh,
{
char *cmd;
int r;
@ -1320,18 +1311,18 @@ Index: openssh-8.4p1/monitor.c
free(cmd);
return (0);
}
@@ -1768,6 +1835,7 @@ monitor_apply_keystate(struct ssh *ssh,
@@ -1772,6 +1839,7 @@ monitor_apply_keystate(struct ssh *ssh,
void
mm_get_keystate(struct ssh *ssh, struct monitor *pmonitor)
{
+ struct sshbuf *m;
debug3("%s: Waiting for new keys", __func__);
debug3_f("Waiting for new keys");
if ((child_state = sshbuf_new()) == NULL)
@@ -1775,6 +1843,19 @@ mm_get_keystate(struct ssh *ssh, struct
@@ -1779,6 +1847,18 @@ mm_get_keystate(struct ssh *ssh, struct
mm_request_receive_expect(pmonitor->m_sendfd, MONITOR_REQ_KEYEXPORT,
child_state);
debug3("%s: GOT new keys", __func__);
debug3_f("GOT new keys");
+
+#ifdef SSH_AUDIT_EVENTS
+ m = sshbuf_new();
@ -1344,11 +1335,10 @@ Index: openssh-8.4p1/monitor.c
+ /* Drain any buffered messages from the child */
+ while (pmonitor->m_log_recvfd >= 0 && monitor_read_log(pmonitor) == 0)
+ ;
+
}
@@ -2052,3 +2133,102 @@ mm_answer_gss_updatecreds(struct ssh *ss
@@ -2056,3 +2136,102 @@ mm_answer_gss_updatecreds(struct ssh *ss
#endif /* GSSAPI */
@ -1451,10 +1441,10 @@ Index: openssh-8.4p1/monitor.c
+ return 0;
+}
+#endif /* SSH_AUDIT_EVENTS */
Index: openssh-8.4p1/monitor.h
Index: openssh-8.8p1/monitor.h
===================================================================
--- openssh-8.4p1.orig/monitor.h
+++ openssh-8.4p1/monitor.h
--- openssh-8.8p1.orig/monitor.h
+++ openssh-8.8p1/monitor.h
@@ -61,7 +61,13 @@ enum monitor_reqtype {
MONITOR_REQ_PAM_QUERY = 106, MONITOR_ANS_PAM_QUERY = 107,
MONITOR_REQ_PAM_RESPOND = 108, MONITOR_ANS_PAM_RESPOND = 109,
@ -1470,11 +1460,11 @@ Index: openssh-8.4p1/monitor.h
MONITOR_REQ_GSSSIGN = 150, MONITOR_ANS_GSSSIGN = 151,
MONITOR_REQ_GSSUPCREDS = 152, MONITOR_ANS_GSSUPCREDS = 153,
Index: openssh-8.4p1/monitor_wrap.c
Index: openssh-8.8p1/monitor_wrap.c
===================================================================
--- openssh-8.4p1.orig/monitor_wrap.c
+++ openssh-8.4p1/monitor_wrap.c
@@ -492,7 +492,7 @@ mm_key_allowed(enum mm_keytype type, con
--- openssh-8.8p1.orig/monitor_wrap.c
+++ openssh-8.8p1/monitor_wrap.c
@@ -499,7 +499,7 @@ mm_key_allowed(enum mm_keytype type, con
*/
int
@ -1483,17 +1473,17 @@ Index: openssh-8.4p1/monitor_wrap.c
const u_char *data, size_t datalen, const char *sigalg, u_int compat,
struct sshkey_sig_details **sig_detailsp)
{
@@ -508,7 +508,8 @@ mm_sshkey_verify(const struct sshkey *ke
@@ -515,7 +515,8 @@ mm_sshkey_verify(const struct sshkey *ke
*sig_detailsp = NULL;
if ((m = sshbuf_new()) == NULL)
fatal("%s: sshbuf_new failed", __func__);
fatal_f("sshbuf_new failed");
- if ((r = sshkey_puts(key, m)) != 0 ||
+ if ((r = sshbuf_put_u32(m, type)) != 0 ||
+ (r = sshkey_puts(key, m)) != 0 ||
(r = sshbuf_put_string(m, sig, siglen)) != 0 ||
(r = sshbuf_put_string(m, data, datalen)) != 0 ||
(r = sshbuf_put_cstring(m, sigalg == NULL ? "" : sigalg)) != 0)
@@ -541,6 +542,20 @@ mm_sshkey_verify(const struct sshkey *ke
@@ -548,6 +549,20 @@ mm_sshkey_verify(const struct sshkey *ke
return 0;
}
@ -1514,7 +1504,7 @@ Index: openssh-8.4p1/monitor_wrap.c
void
mm_send_keystate(struct ssh *ssh, struct monitor *monitor)
{
@@ -894,11 +909,12 @@ mm_audit_event(struct ssh *ssh, ssh_audi
@@ -900,11 +915,12 @@ mm_audit_event(struct ssh *ssh, ssh_audi
sshbuf_free(m);
}
@ -1529,7 +1519,7 @@ Index: openssh-8.4p1/monitor_wrap.c
debug3("%s entering command %s", __func__, command);
@@ -908,6 +924,30 @@ mm_audit_run_command(const char *command
@@ -914,6 +930,30 @@ mm_audit_run_command(const char *command
fatal("%s: buffer error: %s", __func__, ssh_err(r));
mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_COMMAND, m);
@ -1560,7 +1550,7 @@ Index: openssh-8.4p1/monitor_wrap.c
sshbuf_free(m);
}
#endif /* SSH_AUDIT_EVENTS */
@@ -1068,3 +1108,83 @@ mm_ssh_gssapi_update_creds(ssh_gssapi_cc
@@ -1074,3 +1114,83 @@ mm_ssh_gssapi_update_creds(ssh_gssapi_cc
}
#endif /* GSSAPI */
@ -1644,10 +1634,10 @@ Index: openssh-8.4p1/monitor_wrap.c
+ sshbuf_free(m);
+}
+#endif /* SSH_AUDIT_EVENTS */
Index: openssh-8.4p1/monitor_wrap.h
Index: openssh-8.8p1/monitor_wrap.h
===================================================================
--- openssh-8.4p1.orig/monitor_wrap.h
+++ openssh-8.4p1/monitor_wrap.h
--- openssh-8.8p1.orig/monitor_wrap.h
+++ openssh-8.8p1/monitor_wrap.h
@@ -58,7 +58,9 @@ int mm_user_key_allowed(struct ssh *, st
struct sshauthopt **);
int mm_hostbased_key_allowed(struct ssh *, struct passwd *, const char *,
@ -1673,10 +1663,10 @@ Index: openssh-8.4p1/monitor_wrap.h
#endif
struct Session;
Index: openssh-8.4p1/packet.c
Index: openssh-8.8p1/packet.c
===================================================================
--- openssh-8.4p1.orig/packet.c
+++ openssh-8.4p1/packet.c
--- openssh-8.8p1.orig/packet.c
+++ openssh-8.8p1/packet.c
@@ -81,6 +81,7 @@
#endif
@ -1685,7 +1675,7 @@ Index: openssh-8.4p1/packet.c
#include "compat.h"
#include "ssh2.h"
#include "cipher.h"
@@ -518,6 +519,13 @@ ssh_packet_get_connection_out(struct ssh
@@ -506,6 +507,13 @@ ssh_packet_get_connection_out(struct ssh
return ssh->state->connection_out;
}
@ -1699,7 +1689,7 @@ Index: openssh-8.4p1/packet.c
/*
* Returns the IP-address of the remote host as a string. The returned
* string must not be freed.
@@ -595,22 +603,19 @@ ssh_packet_close_internal(struct ssh *ss
@@ -583,22 +591,19 @@ ssh_packet_close_internal(struct ssh *ss
{
struct session_state *state = ssh->state;
u_int mode;
@ -1727,7 +1717,7 @@ Index: openssh-8.4p1/packet.c
for (mode = 0; mode < MODE_MAX; mode++) {
kex_free_newkeys(state->newkeys[mode]); /* current keys */
state->newkeys[mode] = NULL;
@@ -646,8 +651,18 @@ ssh_packet_close_internal(struct ssh *ss
@@ -634,8 +639,18 @@ ssh_packet_close_internal(struct ssh *ss
#endif /* WITH_ZLIB */
cipher_free(state->send_context);
cipher_free(state->receive_context);
@ -1746,7 +1736,7 @@ Index: openssh-8.4p1/packet.c
free(ssh->local_ipaddr);
ssh->local_ipaddr = NULL;
free(ssh->remote_ipaddr);
@@ -904,6 +919,7 @@ ssh_set_newkeys(struct ssh *ssh, int mod
@@ -892,6 +907,7 @@ ssh_set_newkeys(struct ssh *ssh, int mod
(unsigned long long)state->p_send.bytes,
(unsigned long long)state->p_send.blocks);
kex_free_newkeys(state->newkeys[mode]);
@ -1754,7 +1744,7 @@ Index: openssh-8.4p1/packet.c
state->newkeys[mode] = NULL;
}
/* note that both bytes and the seqnr are not reset */
@@ -2210,6 +2226,73 @@ ssh_packet_get_output(struct ssh *ssh)
@@ -2178,6 +2194,73 @@ ssh_packet_get_output(struct ssh *ssh)
return (void *)ssh->state->output;
}
@ -1828,20 +1818,20 @@ Index: openssh-8.4p1/packet.c
/* Reset after_authentication and reset compression in post-auth privsep */
static int
ssh_packet_set_postauth(struct ssh *ssh)
Index: openssh-8.4p1/packet.h
Index: openssh-8.8p1/packet.h
===================================================================
--- openssh-8.4p1.orig/packet.h
+++ openssh-8.4p1/packet.h
@@ -218,4 +218,5 @@ const u_char *sshpkt_ptr(struct ssh *, s
--- openssh-8.8p1.orig/packet.h
+++ openssh-8.8p1/packet.h
@@ -219,4 +219,5 @@ const u_char *sshpkt_ptr(struct ssh *, s
# undef EC_POINT
#endif
+void packet_destroy_all(struct ssh *, int, int);
#endif /* PACKET_H */
Index: openssh-8.4p1/session.c
Index: openssh-8.8p1/session.c
===================================================================
--- openssh-8.4p1.orig/session.c
+++ openssh-8.4p1/session.c
--- openssh-8.8p1.orig/session.c
+++ openssh-8.8p1/session.c
@@ -136,7 +136,7 @@ extern char *__progname;
extern int debug_flag;
extern u_int utmp_len;
@ -1851,7 +1841,7 @@ Index: openssh-8.4p1/session.c
extern struct sshbuf *loginmsg;
extern struct sshauthopt *auth_opts;
extern char *tun_fwd_ifnames; /* serverloop.c */
@@ -647,6 +647,14 @@ do_exec_pty(struct ssh *ssh, Session *s,
@@ -643,6 +643,14 @@ do_exec_pty(struct ssh *ssh, Session *s,
/* Parent. Close the slave side of the pseudo tty. */
close(ttyfd);
@ -1866,7 +1856,7 @@ Index: openssh-8.4p1/session.c
/* Enter interactive session. */
s->ptymaster = ptymaster;
ssh_packet_set_interactive(ssh, 1,
@@ -711,15 +719,19 @@ do_exec(struct ssh *ssh, Session *s, con
@@ -707,15 +715,19 @@ do_exec(struct ssh *ssh, Session *s, con
s->self);
#ifdef SSH_AUDIT_EVENTS
@ -1888,7 +1878,7 @@ Index: openssh-8.4p1/session.c
#endif
if (s->ttyfd != -1)
ret = do_exec_pty(ssh, s, command);
@@ -1542,8 +1554,11 @@ do_child(struct ssh *ssh, Session *s, co
@@ -1534,8 +1546,11 @@ do_child(struct ssh *ssh, Session *s, co
sshpkt_fmt_connection_id(ssh, remote_id, sizeof(remote_id));
/* remove hostkey from the child's memory */
@ -1901,7 +1891,7 @@ Index: openssh-8.4p1/session.c
/* Force a password change */
if (s->authctxt->force_pwchange) {
@@ -1752,6 +1767,9 @@ session_unused(int id)
@@ -1744,6 +1759,9 @@ session_unused(int id)
sessions[id].ttyfd = -1;
sessions[id].ptymaster = -1;
sessions[id].x11_chanids = NULL;
@ -1911,7 +1901,7 @@ Index: openssh-8.4p1/session.c
sessions[id].next_unused = sessions_first_unused;
sessions_first_unused = id;
}
@@ -1834,6 +1852,19 @@ session_open(Authctxt *authctxt, int cha
@@ -1823,6 +1841,19 @@ session_open(Authctxt *authctxt, int cha
}
Session *
@ -1931,7 +1921,7 @@ Index: openssh-8.4p1/session.c
session_by_tty(char *tty)
{
int i;
@@ -2444,6 +2475,32 @@ session_exit_message(struct ssh *ssh, Se
@@ -2430,6 +2461,32 @@ session_exit_message(struct ssh *ssh, Se
chan_write_failed(ssh, c);
}
@ -1964,7 +1954,7 @@ Index: openssh-8.4p1/session.c
void
session_close(struct ssh *ssh, Session *s)
{
@@ -2485,6 +2542,10 @@ session_close(struct ssh *ssh, Session *
@@ -2471,6 +2528,10 @@ session_close(struct ssh *ssh, Session *
if (s->ttyfd != -1)
session_pty_cleanup(s);
@ -1975,7 +1965,7 @@ Index: openssh-8.4p1/session.c
free(s->term);
free(s->display);
free(s->x11_chanids);
@@ -2560,14 +2621,14 @@ session_close_by_channel(struct ssh *ssh
@@ -2545,14 +2606,14 @@ session_close_by_channel(struct ssh *ssh
}
void
@ -1992,7 +1982,7 @@ Index: openssh-8.4p1/session.c
else
session_close(ssh, s);
}
@@ -2693,6 +2754,15 @@ do_authenticated2(struct ssh *ssh, Authc
@@ -2678,6 +2739,15 @@ do_authenticated2(struct ssh *ssh, Authc
server_loop2(ssh, authctxt);
}
@ -2008,7 +1998,7 @@ Index: openssh-8.4p1/session.c
void
do_cleanup(struct ssh *ssh, Authctxt *authctxt)
{
@@ -2756,7 +2826,7 @@ do_cleanup(struct ssh *ssh, Authctxt *au
@@ -2741,7 +2811,7 @@ do_cleanup(struct ssh *ssh, Authctxt *au
* or if running in monitor.
*/
if (!use_privsep || mm_is_monitor())
@ -2017,10 +2007,10 @@ Index: openssh-8.4p1/session.c
}
/* Return a name for the remote host that fits inside utmp_size */
Index: openssh-8.4p1/session.h
Index: openssh-8.8p1/session.h
===================================================================
--- openssh-8.4p1.orig/session.h
+++ openssh-8.4p1/session.h
--- openssh-8.8p1.orig/session.h
+++ openssh-8.8p1/session.h
@@ -61,6 +61,12 @@ struct Session {
char *name;
char *val;
@ -2048,10 +2038,10 @@ Index: openssh-8.4p1/session.h
Session *session_by_tty(char *);
void session_close(struct ssh *, Session *);
void do_setusercontext(struct passwd *);
Index: openssh-8.4p1/sshd.c
Index: openssh-8.8p1/sshd.c
===================================================================
--- openssh-8.4p1.orig/sshd.c
+++ openssh-8.4p1/sshd.c
--- openssh-8.8p1.orig/sshd.c
+++ openssh-8.8p1/sshd.c
@@ -122,6 +122,7 @@
#include "ssh-gss.h"
#endif
@ -2060,7 +2050,7 @@ Index: openssh-8.4p1/sshd.c
#include "ssh-sandbox.h"
#include "auth-options.h"
#include "version.h"
@@ -267,8 +268,8 @@ struct sshbuf *loginmsg;
@@ -262,8 +263,8 @@ struct sshbuf *loginmsg;
struct passwd *privsep_pw = NULL;
/* Prototypes for various functions defined later in this file. */
@ -2071,7 +2061,7 @@ Index: openssh-8.4p1/sshd.c
static void do_ssh2_kex(struct ssh *);
static char *listener_proctitle;
@@ -286,6 +287,15 @@ close_listen_socks(void)
@@ -281,6 +282,15 @@ close_listen_socks(void)
num_listen_socks = -1;
}
@ -2087,8 +2077,8 @@ Index: openssh-8.4p1/sshd.c
static void
close_startup_pipes(void)
{
@@ -390,18 +400,45 @@ grace_alarm_handler(int sig)
ssh_remote_port(the_active_state));
@@ -386,18 +396,45 @@ grace_alarm_handler(int sig)
}
}
-/* Destroy the host and server keys. They will no longer be needed. */
@ -2136,7 +2126,7 @@ Index: openssh-8.4p1/sshd.c
sshkey_free(sensitive_data.host_certificates[i]);
sensitive_data.host_certificates[i] = NULL;
}
@@ -410,14 +447,26 @@ destroy_sensitive_data(void)
@@ -406,20 +443,38 @@ destroy_sensitive_data(void)
/* Demote private to public keys for network child */
void
@ -2163,9 +2153,8 @@ Index: openssh-8.4p1/sshd.c
+ fp = NULL;
if ((r = sshkey_from_private(
sensitive_data.host_keys[i], &tmp)) != 0)
fatal("could not demote host %s key: %s",
@@ -425,6 +474,12 @@ demote_sensitive_data(void)
ssh_err(r));
fatal_r(r, "could not demote host %s key",
sshkey_type(sensitive_data.host_keys[i]));
sshkey_free(sensitive_data.host_keys[i]);
sensitive_data.host_keys[i] = tmp;
+ if (fp != NULL) {
@ -2177,7 +2166,7 @@ Index: openssh-8.4p1/sshd.c
}
/* Certs do not need demotion */
}
@@ -452,7 +507,7 @@ reseed_prngs(void)
@@ -447,7 +502,7 @@ reseed_prngs(void)
}
static void
@ -2186,7 +2175,7 @@ Index: openssh-8.4p1/sshd.c
{
gid_t gidset[1];
@@ -467,7 +522,7 @@ privsep_preauth_child(void)
@@ -462,7 +517,7 @@ privsep_preauth_child(void)
reseed_prngs();
/* Demote the private keys to public keys. */
@ -2195,7 +2184,7 @@ Index: openssh-8.4p1/sshd.c
/* Demote the child */
if (privsep_chroot) {
@@ -502,7 +557,7 @@ privsep_preauth(struct ssh *ssh)
@@ -497,7 +552,7 @@ privsep_preauth(struct ssh *ssh)
if (use_privsep == PRIVSEP_ON)
box = ssh_sandbox_init(pmonitor);
@ -2204,7 +2193,7 @@ Index: openssh-8.4p1/sshd.c
if (pid == -1) {
fatal("fork of unprivileged child failed");
} else if (pid != 0) {
@@ -548,7 +603,7 @@ privsep_preauth(struct ssh *ssh)
@@ -542,7 +597,7 @@ privsep_preauth(struct ssh *ssh)
/* Arrange for logging to be sent to the monitor */
set_log_handler(mm_log_handler, pmonitor);
@ -2213,7 +2202,7 @@ Index: openssh-8.4p1/sshd.c
setproctitle("%s", "[net]");
if (box != NULL)
ssh_sandbox_child(box);
@@ -592,7 +647,7 @@ privsep_postauth(struct ssh *ssh, Authct
@@ -586,7 +641,7 @@ privsep_postauth(struct ssh *ssh, Authct
pmonitor->m_sendfd = -1;
/* Demote the private keys to public keys. */
@ -2222,7 +2211,7 @@ Index: openssh-8.4p1/sshd.c
reseed_prngs();
@@ -1159,7 +1214,7 @@ server_listen(void)
@@ -1140,7 +1195,7 @@ server_listen(void)
* from this function are in a forked subprocess.
*/
static void
@ -2231,7 +2220,7 @@ Index: openssh-8.4p1/sshd.c
{
fd_set *fdset;
int i, j, ret, maxfd;
@@ -1220,6 +1275,7 @@ server_accept_loop(int *sock_in, int *so
@@ -1186,6 +1241,7 @@ server_accept_loop(int *sock_in, int *so
if (received_sigterm) {
logit("Received signal %d; terminating.",
(int) received_sigterm);
@ -2239,7 +2228,7 @@ Index: openssh-8.4p1/sshd.c
close_listen_socks();
if (options.pid_file != NULL)
unlink(options.pid_file);
@@ -2089,7 +2145,7 @@ main(int ac, char **av)
@@ -2091,7 +2147,7 @@ main(int ac, char **av)
#endif
/* Accept a connection and return in a forked child */
@ -2248,7 +2237,7 @@ Index: openssh-8.4p1/sshd.c
&newsock, config_s);
}
@@ -2325,6 +2381,9 @@ main(int ac, char **av)
@@ -2321,6 +2377,9 @@ main(int ac, char **av)
do_authenticated(ssh, authctxt);
/* The connection has been terminated. */
@ -2258,7 +2247,7 @@ Index: openssh-8.4p1/sshd.c
ssh_packet_get_bytes(ssh, &ibytes, &obytes);
verbose("Transferred: sent %llu, received %llu bytes",
(unsigned long long)obytes, (unsigned long long)ibytes);
@@ -2509,6 +2568,15 @@ do_ssh2_kex(struct ssh *ssh)
@@ -2501,6 +2560,15 @@ do_ssh2_kex(struct ssh *ssh)
void
cleanup_exit(int i)
{
@ -2274,8 +2263,8 @@ Index: openssh-8.4p1/sshd.c
if (the_active_state != NULL && the_authctxt != NULL) {
do_cleanup(the_active_state, the_authctxt);
if (use_privsep && privsep_is_preauth &&
@@ -2520,9 +2588,16 @@ cleanup_exit(int i)
pmonitor->m_pid, strerror(errno));
@@ -2513,9 +2581,16 @@ cleanup_exit(int i)
}
}
}
+ is_privsep_child = use_privsep && pmonitor != NULL && pmonitor->m_pid == 0;
@ -2292,10 +2281,10 @@ Index: openssh-8.4p1/sshd.c
audit_event(the_active_state, SSH_CONNECTION_ABANDON);
#endif
_exit(i);
Index: openssh-8.4p1/sshkey.c
Index: openssh-8.8p1/sshkey.c
===================================================================
--- openssh-8.4p1.orig/sshkey.c
+++ openssh-8.4p1/sshkey.c
--- openssh-8.8p1.orig/sshkey.c
+++ openssh-8.8p1/sshkey.c
@@ -371,6 +371,38 @@ sshkey_type_is_valid_ca(int type)
}
@ -2335,11 +2324,11 @@ Index: openssh-8.4p1/sshkey.c
sshkey_is_cert(const struct sshkey *k)
{
if (k == NULL)
Index: openssh-8.4p1/sshkey.h
Index: openssh-8.8p1/sshkey.h
===================================================================
--- openssh-8.4p1.orig/sshkey.h
+++ openssh-8.4p1/sshkey.h
@@ -187,6 +187,7 @@ int sshkey_shield_private(struct sshke
--- openssh-8.8p1.orig/sshkey.h
+++ openssh-8.8p1/sshkey.h
@@ -189,6 +189,7 @@ int sshkey_shield_private(struct sshke
int sshkey_unshield_private(struct sshkey *);
int sshkey_type_from_name(const char *);

View File

@ -9,11 +9,11 @@ upcoming glibc ( 2.31 )
sandbox-seccomp-filter.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
index 3ef30c9d5..999c46c9f 100644
--- a/sandbox-seccomp-filter.c
+++ b/sandbox-seccomp-filter.c
@@ -248,6 +248,9 @@ static const struct sock_filter preauth_insns[] = {
Index: openssh-8.8p1/sandbox-seccomp-filter.c
===================================================================
--- openssh-8.8p1.orig/sandbox-seccomp-filter.c
+++ openssh-8.8p1/sandbox-seccomp-filter.c
@@ -279,6 +279,9 @@ static const struct sock_filter preauth_
#ifdef __NR_clock_nanosleep_time64
SC_ALLOW(__NR_clock_nanosleep_time64),
#endif

View File

@ -1,8 +1,8 @@
diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
index c1e689e..74f69bc 100644
--- a/sandbox-seccomp-filter.c
+++ b/sandbox-seccomp-filter.c
@@ -264,6 +264,9 @@ static const struct sock_filter preauth_insns[] = {
Index: openssh-8.8p1/sandbox-seccomp-filter.c
===================================================================
--- openssh-8.8p1.orig/sandbox-seccomp-filter.c
+++ openssh-8.8p1/sandbox-seccomp-filter.c
@@ -273,6 +273,9 @@ static const struct sock_filter preauth_
#ifdef __NR_clock_gettime64
SC_ALLOW(__NR_clock_gettime64),
#endif

View File

@ -8,11 +8,11 @@ Needed on Linux ARM. bz#3100, patch from jjelen@redhat.com.
sandbox-seccomp-filter.c | 3 +++
1 file changed, 3 insertions(+)
Index: openssh-8.1p1/sandbox-seccomp-filter.c
Index: openssh-8.8p1/sandbox-seccomp-filter.c
===================================================================
--- openssh-8.1p1.orig/sandbox-seccomp-filter.c
+++ openssh-8.1p1/sandbox-seccomp-filter.c
@@ -251,6 +251,9 @@ static const struct sock_filter preauth_
--- openssh-8.8p1.orig/sandbox-seccomp-filter.c
+++ openssh-8.8p1/sandbox-seccomp-filter.c
@@ -276,6 +276,9 @@ static const struct sock_filter preauth_
#ifdef __NR_clock_nanosleep
SC_ALLOW(__NR_clock_nanosleep),
#endif

View File

@ -1,8 +1,8 @@
diff --git a/kex.c b/kex.c
index 96e44a5..7cd37d6 100644
--- a/kex.c
+++ b/kex.c
@@ -38,6 +38,7 @@
Index: openssh-8.8p1/kex.c
===================================================================
--- openssh-8.8p1.orig/kex.c
+++ openssh-8.8p1/kex.c
@@ -40,6 +40,7 @@
#ifdef WITH_OPENSSL
#include <openssl/crypto.h>
#include <openssl/dh.h>
@ -10,7 +10,7 @@ index 96e44a5..7cd37d6 100644
#endif
#include "ssh.h"
@@ -1109,8 +1110,92 @@ kex_choose_conf(struct ssh *ssh)
@@ -1115,8 +1116,93 @@ kex_choose_conf(struct ssh *ssh)
return r;
}
@ -69,7 +69,8 @@ index 96e44a5..7cd37d6 100644
+ || EVP_KDF_ctrl (hashctx, EVP_KDF_CTRL_SET_SSHKDF_XCGHASH,
+ hash, (size_t) hashlen) != 1
+ || EVP_KDF_ctrl (hashctx, EVP_KDF_CTRL_SET_SSHKDF_SESSION_ID,
+ kex->session_id, (size_t) kex->session_id_len) != 1)
+ sshbuf_ptr(kex->session_id),
+ (size_t) sshbuf_len(kex->session_id)) != 1)
+ goto out;
+
+ digest = calloc (1, need);
@ -104,7 +105,7 @@ index 96e44a5..7cd37d6 100644
const struct sshbuf *shared_secret, u_char **keyp)
{
struct kex *kex = ssh->kex;
@@ -1174,6 +1259,50 @@ derive_key(struct ssh *ssh, int id, u_int need, u_char *hash, u_int hashlen,
@@ -1179,6 +1265,50 @@ derive_key(struct ssh *ssh, int id, u_in
return r;
}

View File

@ -1,52 +1,31 @@
Gemeinsame Unterverzeichnisse: openssh-8.4p1/contrib und openssh-8.4p1-vendor/contrib.
diff -u openssh-8.4p1/dh.c openssh-8.4p1-vendor/dh.c
--- openssh-8.4p1/dh.c 2020-09-27 09:25:01.000000000 +0200
+++ openssh-8.4p1-vendor/dh.c 2021-01-29 11:49:40.968418136 +0100
@@ -151,10 +151,18 @@
size_t linesize = 0;
int best, bestcount, which, linenum;
struct dhgroup dhg;
+ char *dh_moduli_path;
+ struct stat st;
Index: openssh-8.8p1/dh.c
===================================================================
--- openssh-8.8p1.orig/dh.c
+++ openssh-8.8p1/dh.c
@@ -54,7 +54,17 @@ void dh_set_moduli_file(const char *file
- if ((f = fopen(_PATH_DH_MODULI, "r")) == NULL) {
static const char * get_moduli_filename(void)
{
- return moduli_filename ? moduli_filename : _PATH_DH_MODULI;
+ struct stat st;
+
+ if (moduli_filename)
+ return moduli_filename;
+
+ if (stat(_PATH_VENDOR_DH_MODULI, &st) == 0 &&
+ stat(_PATH_DH_MODULI, &st) == -1) {
+ dh_moduli_path = _PATH_VENDOR_DH_MODULI;
+ } else {
+ dh_moduli_path = _PATH_DH_MODULI;
+ return _PATH_VENDOR_DH_MODULI;
+ }
+ if ((f = fopen(dh_moduli_path, "r")) == NULL) {
logit("WARNING: could not open %s (%s), using fixed modulus",
- _PATH_DH_MODULI, strerror(errno));
+ dh_moduli_path, strerror(errno));
return (dh_new_group_fallback(max));
+
+ return _PATH_DH_MODULI;
}
@@ -185,7 +193,7 @@
if (bestcount == 0) {
fclose(f);
- logit("WARNING: no suitable primes in %s", _PATH_DH_MODULI);
+ logit("WARNING: no suitable primes in %s", dh_moduli_path);
return (dh_new_group_fallback(max));
}
which = arc4random_uniform(bestcount);
@@ -210,7 +218,7 @@
fclose(f);
if (bestcount != which + 1) {
logit("WARNING: selected prime disappeared in %s, giving up",
- _PATH_DH_MODULI);
+ dh_moduli_path);
return (dh_new_group_fallback(max));
}
Gemeinsame Unterverzeichnisse: openssh-8.4p1/.github und openssh-8.4p1-vendor/.github.
Gemeinsame Unterverzeichnisse: openssh-8.4p1/m4 und openssh-8.4p1-vendor/m4.
Gemeinsame Unterverzeichnisse: openssh-8.4p1/openbsd-compat und openssh-8.4p1-vendor/openbsd-compat.
diff -u openssh-8.4p1/pathnames.h openssh-8.4p1-vendor/pathnames.h
--- openssh-8.4p1/pathnames.h 2020-09-27 09:25:01.000000000 +0200
+++ openssh-8.4p1-vendor/pathnames.h 2021-01-29 11:35:41.655599046 +0100
static int
Index: openssh-8.8p1/pathnames.h
===================================================================
--- openssh-8.8p1.orig/pathnames.h
+++ openssh-8.8p1/pathnames.h
@@ -18,6 +18,8 @@
#define SSHDIR ETCDIR "/ssh"
#endif
@ -74,11 +53,11 @@ diff -u openssh-8.4p1/pathnames.h openssh-8.4p1-vendor/pathnames.h
#ifndef _PATH_SSH_PROGRAM
#define _PATH_SSH_PROGRAM "/usr/bin/ssh"
Gemeinsame Unterverzeichnisse: openssh-8.4p1/regress und openssh-8.4p1-vendor/regress.
diff -u openssh-8.4p1/ssh.c openssh-8.4p1-vendor/ssh.c
--- openssh-8.4p1/ssh.c 2020-09-27 09:25:01.000000000 +0200
+++ openssh-8.4p1-vendor/ssh.c 2021-01-27 18:22:52.322271681 +0100
@@ -593,6 +593,7 @@
Index: openssh-8.8p1/ssh.c
===================================================================
--- openssh-8.8p1.orig/ssh.c
+++ openssh-8.8p1/ssh.c
@@ -549,6 +549,7 @@ static void
process_config_files(const char *host_name, struct passwd *pw, int final_pass,
int *want_final_pass)
{
@ -86,7 +65,7 @@ diff -u openssh-8.4p1/ssh.c openssh-8.4p1-vendor/ssh.c
char buf[PATH_MAX];
int r;
@@ -611,10 +612,23 @@
@@ -567,10 +568,23 @@ process_config_files(const char *host_na
&options, SSHCONF_CHECKPERM | SSHCONF_USERCONF |
(final_pass ? SSHCONF_FINAL : 0), want_final_pass);
@ -114,11 +93,11 @@ diff -u openssh-8.4p1/ssh.c openssh-8.4p1-vendor/ssh.c
}
}
Nur in openssh-8.4p1-vendor: #ssh_config.5#.
diff -u openssh-8.4p1/ssh_config.5 openssh-8.4p1-vendor/ssh_config.5
--- openssh-8.4p1/ssh_config.5 2020-09-27 09:25:01.000000000 +0200
+++ openssh-8.4p1-vendor/ssh_config.5 2021-02-24 12:02:53.935729753 +0100
@@ -54,6 +54,9 @@
Index: openssh-8.8p1/ssh_config.5
===================================================================
--- openssh-8.8p1.orig/ssh_config.5
+++ openssh-8.8p1/ssh_config.5
@@ -54,6 +54,9 @@ user's configuration file
.It
system-wide configuration file
.Pq Pa /etc/ssh/ssh_config
@ -128,7 +107,7 @@ diff -u openssh-8.4p1/ssh_config.5 openssh-8.4p1-vendor/ssh_config.5
.El
.Pp
For each parameter, the first obtained value
@@ -1942,6 +1945,11 @@
@@ -2212,6 +2215,11 @@ This file provides defaults for those
values that are not specified in the user's configuration file, and
for those users who do not have a configuration file.
This file must be world-readable.
@ -140,11 +119,11 @@ diff -u openssh-8.4p1/ssh_config.5 openssh-8.4p1-vendor/ssh_config.5
.El
.Sh SEE ALSO
.Xr ssh 1
Nur in openssh-8.4p1-vendor: ssh_config.5~.
diff -u openssh-8.4p1/sshd.c openssh-8.4p1-vendor/sshd.c
--- openssh-8.4p1/sshd.c 2020-09-27 09:25:01.000000000 +0200
+++ openssh-8.4p1-vendor/sshd.c 2021-01-27 18:25:38.370273280 +0100
@@ -136,7 +136,7 @@
Index: openssh-8.8p1/sshd.c
===================================================================
--- openssh-8.8p1.orig/sshd.c
+++ openssh-8.8p1/sshd.c
@@ -145,7 +145,7 @@ extern char *__progname;
ServerOptions options;
/* Name of the server configuration file. */
@ -153,7 +132,7 @@ diff -u openssh-8.4p1/sshd.c openssh-8.4p1-vendor/sshd.c
/*
* Debug mode flag. This can be set on the command line. If debug
@@ -1526,6 +1526,7 @@
@@ -1594,6 +1594,7 @@ prepare_proctitle(int ac, char **av)
int
main(int ac, char **av)
{
@ -161,7 +140,7 @@ diff -u openssh-8.4p1/sshd.c openssh-8.4p1-vendor/sshd.c
struct ssh *ssh = NULL;
extern char *optarg;
extern int optind;
@@ -1737,7 +1738,21 @@
@@ -1809,7 +1810,21 @@ main(int ac, char **av)
*/
(void)atomicio(vwrite, startup_pipe, "\0", 1);
}
@ -183,9 +162,10 @@ diff -u openssh-8.4p1/sshd.c openssh-8.4p1-vendor/sshd.c
load_server_config(config_file_name, cfg);
parse_server_config(&options, rexeced_flag ? "rexec" : config_file_name,
diff -u openssh-8.4p1/sshd_config.5 openssh-8.4p1-vendor/sshd_config.5
--- openssh-8.4p1/sshd_config.5 2020-09-27 09:25:01.000000000 +0200
+++ openssh-8.4p1-vendor/sshd_config.5 2021-02-24 14:14:27.912038335 +0100
Index: openssh-8.8p1/sshd_config.5
===================================================================
--- openssh-8.8p1.orig/sshd_config.5
+++ openssh-8.8p1/sshd_config.5
@@ -44,7 +44,9 @@
.Xr sshd 8
reads configuration data from
@ -197,11 +177,11 @@ diff -u openssh-8.4p1/sshd_config.5 openssh-8.4p1-vendor/sshd_config.5
.Fl f
on the command line).
The file contains keyword-argument pairs, one per line.
Nur in openssh-8.4p1-vendor: sshd_config.5~.
diff -u openssh-8.4p1/ssh-keysign.c openssh-8.4p1-vendor/ssh-keysign.c
--- openssh-8.4p1/ssh-keysign.c 2020-09-27 09:25:01.000000000 +0200
+++ openssh-8.4p1-vendor/ssh-keysign.c 2021-02-24 11:34:17.684570215 +0100
@@ -172,6 +172,7 @@
Index: openssh-8.8p1/ssh-keysign.c
===================================================================
--- openssh-8.8p1.orig/ssh-keysign.c
+++ openssh-8.8p1/ssh-keysign.c
@@ -172,6 +172,7 @@ main(int argc, char **argv)
u_char *signature, *data, rver;
char *host, *fp;
size_t slen, dlen;
@ -209,19 +189,20 @@ diff -u openssh-8.4p1/ssh-keysign.c openssh-8.4p1-vendor/ssh-keysign.c
if (pledge("stdio rpath getpw dns id", NULL) != 0)
fatal("%s: pledge: %s", __progname, strerror(errno));
@@ -205,8 +206,12 @@
@@ -205,8 +206,14 @@ main(int argc, char **argv)
/* verify that ssh-keysign is enabled by the admin */
initialize_options(&options);
- (void)read_config_file(_PATH_HOST_CONFIG_FILE, pw, "", "",
- &options, 0, NULL);
+
+ if (stat(_PATH_HOST_CONFIG_FILE, &st) == 0)
+ (void)read_config_file(_PATH_HOST_CONFIG_FILE, pw, "", "",
+ &options, 0, NULL);
+ else
+ (void)read_config_file(_PATH_HOST_VENDOR_CONFIG_FILE, pw,
+ "", "", &options, 0, NULL);
fill_default_options(&options);
+ (void)read_config_file(_PATH_HOST_VENDOR_CONFIG_FILE, pw, "", "",
+ &options, 0, NULL);
+
(void)fill_default_options(&options);
if (options.enable_ssh_keysign != 1)
fatal("ssh-keysign not enabled in %s",
Nur in openssh-8.4p1-vendor: ssh-keysign.c~.

View File

@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:5a01d22e407eb1c05ba8a8f7c654d388a13e9f226e4ed33bd38748dafa1d2b24
size 1742201

View File

@ -1,14 +0,0 @@
-----BEGIN PGP SIGNATURE-----
iQHDBAABCgAdFiEEWcIRjtIG2SfmZ+vj0+X1a22SDTAFAl9wQnwACgkQ0+X1a22S
DTAR6wyAjRcvW7Jg9v73AR7TUO4WAD085sYi4ZLsECMZqhVZUBVv0Ofmcz2ISg3I
NU1nr9Kiqf1/i05OUIR64kJEd4wTSwv+4HhyP5MPJqyCkKcFJ9TyRy6pASZtyH6D
hKezJ79iGUg1U46bI6yyxchcAKrz0if97fKd0/1h5yE7T5lcbo+zQPsAg9dDXHBJ
nL5mpBQXU3xbU8bC+E+vZ7VAyxEm6kzuY7MRW2wOhpPQ5DJgEjAUjtvzvd9SJhKl
u/hgKXqIJBQB1pHlAFI1knfTrGUGrzob8QphukrvmbMJC3dO/o3Dplvx6lZkes0c
6hP66rhTRp5Tmw9ae3iUmoDf6SyStlo/4QomCuw0NxHrSOng16VjCR+NRWHvZbXC
JckIqparyOJ2jtHz0+e52sRZCZKauFBDMZboNj7f+htwQRUFOVfeSecpJiYut4bM
YALdayOQwL96J6aMdoMKfMGZUevCPN6OM96E6cMC1fmanBenZQ/vatmskIvvvO/P
rwECYTpGVRezhAvXMEy9x+EVdV6ctA==
=PW3D
-----END PGP SIGNATURE-----

3
openssh-8.8p1.tar.gz Normal file
View File

@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:4590890ea9bb9ace4f71ae331785a3a5823232435161960ed5fc86588f331fe9
size 1815060

16
openssh-8.8p1.tar.gz.asc Normal file
View File

@ -0,0 +1,16 @@
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEcWi5g4FaXu9ZpK39Kj9BTnNgYLoFAmFQfp8ACgkQKj9BTnNg
YLq2SQ/8C3iOHTkyqX82FYt0SKkybebe9b2iBPr91HQOUmx+U3I+vgrSWArXabWJ
uSu0b685RQKlcr7UjEtPk6g0cm45NoJFjju9ljvnOFfZw73V3a5qX15Lx4xRnkRx
v1LJn6Yh12PKLWL4/A1qPQnfAObVwq/BF0BR01FfXLAOt5+lFwYvg79HpE+69b0r
KtcIEpsyTEn2lSKSWD7q4lpe6Z/iR+XzBKfnB6JJXhKyHiDV63hlAJk9Pt3mIvS6
tnE9/7GDawvi+Tsl018kw3wsf6aHVSQ+O+vzcDgfy0vDJVGjD6Ec9it9FvikXJh6
3pSTBYuUJdt+CAQYvmEui73v4nrkfouHXsxqgzEDZaTwIZC4wPrvNYxUaIyirWlc
l4/YSnxSxSiYbvPa5eYRBvXvoWbnQXjPOkuhjETxz/KTcHirQpWE9eldi0jHcKUa
FVu9YqMPAjIUd1Jj4vC5bgH7v5cLeEMm/AetMvKsJs+rhY9NZaKpiqOqU2m6Geb+
sQSXHNTeA8uOlrHim4SmYHtmfglVbH5lIroiUqtRzjbOhMhqUb+yN9+aAxe0bwmN
VcFMSThlbmYokb9bkQryY2I/FfXb997vxgF6v15Z8d9e8HH2zc2Irj1HYXG4Bf3o
WCiSvd8+Tr/FxS2Gn8qj/vgSPWXT0d0Hy4zHW9JeT/jn3RtIYhU=
=EnoG
-----END PGP SIGNATURE-----

View File

@ -1,3 +1,10 @@
-------------------------------------------------------------------
Tue Sep 28 19:05:15 UTC 2021 - Hans Petter Jansson <hpj@suse.com>
- Version upgrade to 8.8p1
* No changes for askpass, see main package changelog for
details
-------------------------------------------------------------------
Thu Sep 17 20:41:39 UTC 2020 - Jan Engelhardt <jengelh@inai.de>

View File

@ -18,7 +18,7 @@
%define _name openssh
Name: openssh-askpass-gnome
Version: 8.4p1
Version: 8.8p1
Release: 0
Summary: A GNOME-Based Passphrase Dialog for OpenSSH
License: BSD-2-Clause

View File

@ -4,11 +4,11 @@ Date: Mon Oct 26 22:26:46 2020 +0100
Ensure DHGs are approved in FIPS mode using OpenSSL's DH_check_params()
diff --git a/dh.c b/dh.c
index 7cb135d..3fe7f75 100644
--- a/dh.c
+++ b/dh.c
@@ -143,6 +143,28 @@ parse_prime(int linenum, char *line, struct dhgroup *dhg)
Index: openssh-8.8p1/dh.c
===================================================================
--- openssh-8.8p1.orig/dh.c
+++ openssh-8.8p1/dh.c
@@ -155,6 +155,28 @@ parse_prime(int linenum, char *line, str
return 0;
}
@ -37,7 +37,7 @@ index 7cb135d..3fe7f75 100644
DH *
choose_dh(int min, int wantbits, int max)
{
@@ -161,12 +183,20 @@ choose_dh(int min, int wantbits, int max)
@@ -173,12 +195,20 @@ choose_dh(int min, int wantbits, int max
linenum = 0;
best = bestcount = 0;
while (getline(&line, &linesize, f) != -1) {
@ -58,7 +58,7 @@ index 7cb135d..3fe7f75 100644
if (dhg.size > max || dhg.size < min)
continue;
@@ -193,10 +223,16 @@ choose_dh(int min, int wantbits, int max)
@@ -206,10 +236,16 @@ choose_dh(int min, int wantbits, int max
linenum = 0;
bestcount = 0;
while (getline(&line, &linesize, f) != -1) {

View File

@ -1,30 +0,0 @@
From 66f16e5425eb881570e82bfef7baeac2e7accc0a Mon Sep 17 00:00:00 2001
From: Oleg <Fallmay@users.noreply.github.com>
Date: Thu, 1 Oct 2020 12:09:08 +0300
Subject: [PATCH] Fix `EOF: command not found` error in ssh-copy-id
---
contrib/ssh-copy-id | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/contrib/ssh-copy-id b/contrib/ssh-copy-id
index 392f64f94..a76907717 100644
--- a/contrib/ssh-copy-id
+++ b/contrib/ssh-copy-id
@@ -247,7 +247,7 @@ installkeys_sh() {
# the -z `tail ...` checks for a trailing newline. The echo adds one if was missing
# the cat adds the keys we're getting via STDIN
# and if available restorecon is used to restore the SELinux context
- INSTALLKEYS_SH=$(tr '\t\n' ' ' <<-EOF)
+ INSTALLKEYS_SH=$(tr '\t\n' ' ' <<-EOF
cd;
umask 077;
mkdir -p $(dirname "${AUTH_KEY_FILE}") &&
@@ -258,6 +258,7 @@ installkeys_sh() {
restorecon -F .ssh ${AUTH_KEY_FILE};
fi
EOF
+ )
# to defend against quirky remote shells: use 'exec sh -c' to get POSIX;
printf "exec sh -c '%s'" "${INSTALLKEYS_SH}"

View File

@ -1,15 +1,15 @@
diff --git a/Makefile.in b/Makefile.in
index 6dec09c..25e74ac 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -251,8 +251,8 @@ ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHKEYSCAN_OBJS)
Index: openssh-8.8p1/Makefile.in
===================================================================
--- openssh-8.8p1.orig/Makefile.in
+++ openssh-8.8p1/Makefile.in
@@ -252,8 +252,8 @@ ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libss
ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o
$(LD) -o $@ ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
-sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a $(SFTPSERVER_OBJS)
- $(LD) -o $@ $(SFTPSERVER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
- $(LD) -o $@ $(SFTPSERVER_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
+sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-sk.o sk-usbhid.o $(SFTPSERVER_OBJS)
+ $(LD) -o $@ $(SFTPSERVER_OBJS) ssh-sk.o sk-usbhid.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LIBFIDO2)
+ $(LD) -o $@ $(SFTPSERVER_OBJS) ssh-sk.o sk-usbhid.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS) $(LIBFIDO2)
sftp$(EXEEXT): $(LIBCOMPAT) libssh.a $(SFTP_OBJS)
$(LD) -o $@ $(SFTP_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LIBEDIT)

View File

@ -1,7 +1,7 @@
diff --git a/myproposal.h b/myproposal.h
index 5312e60..83fd62d 100644
--- a/myproposal.h
+++ b/myproposal.h
Index: openssh-8.8p1/myproposal.h
===================================================================
--- openssh-8.8p1.orig/myproposal.h
+++ openssh-8.8p1/myproposal.h
@@ -33,7 +33,8 @@
"diffie-hellman-group-exchange-sha256," \
"diffie-hellman-group16-sha512," \
@ -12,11 +12,11 @@ index 5312e60..83fd62d 100644
#define KEX_CLIENT_KEX KEX_SERVER_KEX
diff --git a/ssh_config.5 b/ssh_config.5
index d5888f2..100563e 100644
--- a/ssh_config.5
+++ b/ssh_config.5
@@ -1170,7 +1170,8 @@ ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
Index: openssh-8.8p1/ssh_config.5
===================================================================
--- openssh-8.8p1.orig/ssh_config.5
+++ openssh-8.8p1/ssh_config.5
@@ -1227,7 +1227,8 @@ ecdh-sha2-nistp256,ecdh-sha2-nistp384,ec
diffie-hellman-group-exchange-sha256,
diffie-hellman-group16-sha512,
diffie-hellman-group18-sha512,
@ -26,11 +26,11 @@ index d5888f2..100563e 100644
.Ed
.Pp
The list of available key exchange algorithms may also be obtained using
diff --git a/sshd_config.5 b/sshd_config.5
index 0f5fe53..97364f5 100644
--- a/sshd_config.5
+++ b/sshd_config.5
@@ -986,7 +986,7 @@ curve25519-sha256,curve25519-sha256@libssh.org,
Index: openssh-8.8p1/sshd_config.5
===================================================================
--- openssh-8.8p1.orig/sshd_config.5
+++ openssh-8.8p1/sshd_config.5
@@ -997,7 +997,7 @@ curve25519-sha256,curve25519-sha256@libs
ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,
diffie-hellman-group-exchange-sha256,
diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,

View File

@ -1,6 +1,8 @@
--- a/sandbox-seccomp-filter.c
+++ b/sandbox-seccomp-filter.c
@@ -195,6 +195,9 @@
Index: openssh-8.8p1/sandbox-seccomp-filter.c
===================================================================
--- openssh-8.8p1.orig/sandbox-seccomp-filter.c
+++ openssh-8.8p1/sandbox-seccomp-filter.c
@@ -201,6 +201,9 @@ static const struct sock_filter preauth_
#ifdef __NR_close
SC_ALLOW(__NR_close),
#endif
@ -10,9 +12,9 @@
#ifdef __NR_exit
SC_ALLOW(__NR_exit),
#endif
@@ -204,6 +207,9 @@
#ifdef __NR_futex
SC_ALLOW(__NR_futex),
@@ -213,6 +216,9 @@ static const struct sock_filter preauth_
#ifdef __NR_futex_time64
SC_ALLOW(__NR_futex_time64),
#endif
+#ifdef __NR_futex_time64
+ SC_ALLOW(__NR_futex_time64),
@ -20,13 +22,13 @@
#ifdef __NR_geteuid
SC_ALLOW(__NR_geteuid),
#endif
@@ -282,6 +288,9 @@
#ifdef __NR_pselect6
SC_ALLOW(__NR_pselect6),
@@ -293,6 +299,9 @@ static const struct sock_filter preauth_
#endif
#ifdef __NR_pselect6_time64
SC_ALLOW(__NR_pselect6_time64),
+#endif
+#ifdef __NR_pselect6_time64
+ SC_ALLOW(__NR_pselect6_time64),
+#endif
#endif
#ifdef __NR_read
SC_ALLOW(__NR_read),
#endif

View File

@ -1,3 +1,362 @@
-------------------------------------------------------------------
Tue Sep 28 17:50:57 UTC 2021 - Hans Petter Jansson <hpj@suse.com>
- Version update to 8.8p1:
= Security
* sshd(8) from OpenSSH 6.2 through 8.7 failed to correctly initialise
supplemental groups when executing an AuthorizedKeysCommand or
AuthorizedPrincipalsCommand, where a AuthorizedKeysCommandUser or
AuthorizedPrincipalsCommandUser directive has been set to run the
command as a different user. Instead these commands would inherit
the groups that sshd(8) was started with.
Depending on system configuration, inherited groups may allow
AuthorizedKeysCommand/AuthorizedPrincipalsCommand helper programs to
gain unintended privilege.
Neither AuthorizedKeysCommand nor AuthorizedPrincipalsCommand are
enabled by default in sshd_config(5).
= Potentially-incompatible changes
* This release disables RSA signatures using the SHA-1 hash algorithm
by default. This change has been made as the SHA-1 hash algorithm is
cryptographically broken, and it is possible to create chosen-prefix
hash collisions for <USD$50K.
For most users, this change should be invisible and there is
no need to replace ssh-rsa keys. OpenSSH has supported RFC8332
RSA/SHA-256/512 signatures since release 7.2 and existing ssh-rsa keys
will automatically use the stronger algorithm where possible.
Incompatibility is more likely when connecting to older SSH
implementations that have not been upgraded or have not closely tracked
improvements in the SSH protocol. For these cases, it may be necessary
to selectively re-enable RSA/SHA1 to allow connection and/or user
authentication via the HostkeyAlgorithms and PubkeyAcceptedAlgorithms
options.
= New features
* ssh(1): allow the ssh_config(5) CanonicalizePermittedCNAMEs
directive to accept a "none" argument to specify the default
behaviour.
= Bugfixes
* scp(1): when using the SFTP protocol, continue transferring files
after a transfer error occurs, better matching original scp/rcp
behaviour.
* ssh(1): fixed a number of memory leaks in multiplexing,
* ssh-keygen(1): avoid crash when using the -Y find-principals
command.
* A number of documentation and manual improvements, including
bz#3340, PR139, PR215, PR241, PR257
- Additional changes from 8.7p1 release:
= Potentially-incompatible changes
* scp(1): this release changes the behaviour of remote to remote
copies (e.g. "scp host-a:/path host-b:") to transfer through the
local host by default. This was previously available via the -3
flag. This mode avoids the need to expose credentials on the
origin hop, avoids triplicate interpretation of filenames by the
shell (by the local system, the copy origin and the destination)
and, in conjunction with the SFTP support for scp(1) mentioned
below, allows use of all authentication methods to the remote
hosts (previously, only non-interactive methods could be used).
A -R flag has been added to select the old behaviour.
* ssh(1)/sshd(8): both the client and server are now using a
stricter configuration file parser. The new parser uses more
shell-like rules for quotes, space and escape characters. It is
also more strict in rejecting configurations that include options
lacking arguments. Previously some options (e.g. DenyUsers) could
appear on a line with no subsequent arguments. This release will
reject such configurations. The new parser will also reject
configurations with unterminated quotes and multiple '='
characters after the option name.
* ssh(1): when using SSHFP DNS records for host key verification,
ssh(1) will verify all matching records instead of just those
with the specific signature type requested. This may cause host
key verification problems if stale SSHFP records of a different
or legacy signature type exist alongside other records for a
particular host. bz#3322
* ssh-keygen(1): when generating a FIDO key and specifying an
explicit attestation challenge (using -Ochallenge), the challenge
will now be hashed by the builtin security key middleware. This
removes the (undocumented) requirement that challenges be exactly
32 bytes in length and matches the expectations of libfido2.
* sshd(8): environment="..." directives in authorized_keys files are
now first-match-wins and limited to 1024 discrete environment
variable names.
= New features
* scp(1): experimental support for transfers using the SFTP protocol
as a replacement for the venerable SCP/RCP protocol that it has
traditionally used. SFTP offers more predictable filename handling
and does not require expansion of glob(3) patterns via the shell
on the remote side.
* sftp-server(8): add a protocol extension to support expansion of
~/ and ~user/ prefixed paths. This was added to support these
paths when used by scp(1) while in SFTP mode.
* ssh(1): add a ForkAfterAuthentication ssh_config(5) counterpart to
the ssh(1) -f flag. GHPR231
* ssh(1): add a StdinNull directive to ssh_config(5) that allows the
config file to do the same thing as -n does on the ssh(1) command-
line. GHPR231
* ssh(1): add a SessionType directive to ssh_config, allowing the
configuration file to offer equivalent control to the -N (no
session) and -s (subsystem) command-line flags. GHPR231
* ssh-keygen(1): allowed signers files used by ssh-keygen(1)
signatures now support listing key validity intervals alongside
they key, and ssh-keygen(1) can optionally check during signature
verification whether a specified time falls inside this interval.
This feature is intended for use by git to support signing and
verifying objects using ssh keys.
* ssh-keygen(8): support printing of the full public key in a sshsig
signature via a -Oprint-pubkey flag.
= Bugfixes
* ssh(1)/sshd(8): start time-based re-keying exactly on schedule in
the client and server mainloops. Previously the re-key timeout
could expire but re-keying would not start until a packet was sent
or received, causing a spin in select() if the connection was
quiescent.
* ssh-keygen(1): avoid Y2038 problem in printing certificate
validity lifetimes. Dates past 2^31-1 seconds since epoch were
displayed incorrectly on some platforms. bz#3329
* scp(1): allow spaces to appear in usernames for local to remote
and scp -3 remote to remote copies. bz#1164
* ssh(1)/sshd(8): remove references to ChallengeResponseAuthentication
in favour of KbdInteractiveAuthentication. The former is what was in
SSHv1, the latter is what is in SSHv2 (RFC4256) and they were
treated as somewhat but not entirely equivalent. We retain the old
name as a deprecated alias so configuration files continue to work
as well as a reference in the man page for people looking for it.
bz#3303
* ssh(1)/ssh-add(1)/ssh-keygen(1): fix decoding of X.509 subject name
when extracting a key from a PKCS#11 certificate. bz#3327
* ssh(1): restore blocking status on stdio fds before close. ssh(1)
needs file descriptors in non-blocking mode to operate but it was
not restoring the original state on exit. This could cause
problems with fds shared with other programs via the shell,
bz#3280 and GHPR246
* ssh(1)/sshd(8): switch both client and server mainloops from
select(3) to pselect(3). Avoids race conditions where a signal
may arrive immediately before select(3) and not be processed until
an event fires. bz#2158
* ssh(1): sessions started with ControlPersist were incorrectly
executing a shell when the -N (no shell) option was specified.
bz#3290
* ssh(1): check if IPQoS or TunnelDevice are already set before
overriding. Prevents values in config files from overriding values
supplied on the command line. bz#3319
* ssh(1): fix debug message when finding a private key to match a
certificate being attempted for user authentication. Previously it
would print the certificate's path, whereas it was supposed to be
showing the private key's path. GHPR247
* sshd(8): match host certificates against host public keys, not
private keys. Allows use of certificates with private keys held in
a ssh-agent. bz#3524
* ssh(1): add a workaround for a bug in OpenSSH 7.4 sshd(8), which
allows RSA/SHA2 signatures for public key authentication but fails
to advertise this correctly via SSH2_MSG_EXT_INFO. This causes
clients of these server to incorrectly match
PubkeyAcceptedAlgorithmse and potentially refuse to offer valid
keys. bz#3213
* sftp(1)/scp(1): degrade gracefully if a sftp-server offers the
limits@openssh.com extension but fails when the client tries to
invoke it. bz#3318
* ssh(1): allow ssh_config SetEnv to override $TERM, which is
otherwise handled specially by the protocol. Useful in ~/.ssh/config
to set TERM to something generic (e.g. "xterm" instead of
"xterm-256color") for destinations that lack terminfo entries.
* sftp-server(8): the limits@openssh.com extension was incorrectly
marked as an operation that writes to the filesystem, which made it
unavailable in sftp-server read-only mode. bz#3318
* ssh(1): fix SEGV in UpdateHostkeys debug() message, triggered when
the update removed more host keys than remain present.
* Many manual page fixes.
- Additional changes from 8.6p1 release:
= Security
* sshd(8): OpenSSH 8.5 introduced the LogVerbose keyword. When this
option was enabled with a set of patterns that activated logging
in code that runs in the low-privilege sandboxed sshd process, the
log messages were constructed in such a way that printf(3) format
strings could effectively be specified the low-privilege code.
= New features
* sftp-server(8): add a new limits@openssh.com protocol extension
that allows a client to discover various server limits, including
maximum packet size and maximum read/write length.
* sftp(1): use the new limits@openssh.com extension (when available)
to select better transfer lengths in the client.
* sshd(8): Add ModuliFile keyword to sshd_config to specify the
location of the "moduli" file containing the groups for DH-GEX.
* unit tests: Add a TEST_SSH_ELAPSED_TIMES environment variable to
enable printing of the elapsed time in seconds of each test.
= Bugfixes
* ssh_config(5), sshd_config(5): sync CASignatureAlgorithms lists in
manual pages with the current default. GHPR174
* ssh(1): ensure that pkcs11_del_provider() is called before exit.
GHPR234
* ssh(1), sshd(8): fix problems in string->argv conversion. Multiple
backslashes were not being dequoted correctly and quoted space in
the middle of a string was being incorrectly split. GHPR223
* ssh(1): return non-zero exit status when killed by signal; bz#3281
* sftp-server(8): increase maximum SSH2_FXP_READ to match the maximum
packet size. Also handle zero-length reads that are not explicitly
banned by the spec.
- Additional changes from 8.5p1 release:
= Security
* ssh-agent(1): fixed a double-free memory corruption that was
introduced in OpenSSH 8.2 . We treat all such memory faults as
potentially exploitable. This bug could be reached by an attacker
with access to the agent socket.
= Potentially-incompatible changes
* ssh(1), sshd(8): this release changes the first-preference signature
algorithm from ECDSA to ED25519.
* ssh(1), sshd(8): set the TOS/DSCP specified in the configuration
for interactive use prior to TCP connect. The connection phase of
the SSH session is time-sensitive and often explicitly interactive.
The ultimate interactive/bulk TOS/DSCP will be set after
authentication completes.
* ssh(1), sshd(8): remove the pre-standardization cipher
rijndael-cbc@lysator.liu.se. It is an alias for aes256-cbc before
it was standardized in RFC4253 (2006), has been deprecated and
disabled by default since OpenSSH 7.2 (2016) and was only briefly
documented in ssh.1 in 2001.
* ssh(1), sshd(8): update/replace the experimental post-quantum
hybrid key exchange method based on Streamlined NTRU Prime coupled
with X25519. The previous sntrup4591761x25519-sha512@tinyssh.org
method is replaced with sntrup761x25519-sha512@openssh.com.
* ssh(1): disable CheckHostIP by default. It provides insignificant
benefits while making key rotation significantly more difficult,
especially for hosts behind IP-based load-balancers.
= New features
* ssh(1): this release enables UpdateHostkeys by default subject to
some conservative preconditions:
- The key was matched in the UserKnownHostsFile (and not in the
GlobalKnownHostsFile).
- The same key does not exist under another name.
- A certificate host key is not in use.
- known_hosts contains no matching wildcard hostname pattern.
- VerifyHostKeyDNS is not enabled.
- The default UserKnownHostsFile is in use.
* ssh(1), sshd(8): add a new LogVerbose configuration directive for
that allows forcing maximum debug logging by file/function/line
pattern-lists.
* ssh(1): when prompting the user to accept a new hostkey, display
any other host names/addresses already associated with the key.
* ssh(1): allow UserKnownHostsFile=none to indicate that no
known_hosts file should be used to identify host keys.
* ssh(1): add a ssh_config KnownHostsCommand option that allows the
client to obtain known_hosts data from a command in addition to
the usual files.
* ssh(1): add a ssh_config PermitRemoteOpen option that allows the
client to restrict the destination when RemoteForward is used
with SOCKS.
* ssh(1): for FIDO keys, if a signature operation fails with a
"incorrect PIN" reason and no PIN was initially requested from the
user, then request a PIN and retry the operation. This supports
some biometric devices that fall back to requiring PIN when reading
of the biometric failed, and devices that require PINs for all
hosted credentials.
* sshd(8): implement client address-based rate-limiting via new
sshd_config(5) PerSourceMaxStartups and PerSourceNetBlockSize
directives that provide more fine-grained control on a per-origin
address basis than the global MaxStartups limit.
= Bugfixes
* ssh(1): Prefix keyboard interactive prompts with "(user@host)" to
make it easier to determine which connection they are associated
with in cases like scp -3, ProxyJump, etc. bz#3224
* sshd(8): fix sshd_config SetEnv directives located inside Match
blocks. GHPR201
* ssh(1): when requesting a FIDO token touch on stderr, inform the
user once the touch has been recorded.
* ssh(1): prevent integer overflow when ridiculously large
ConnectTimeout values are specified, capping the effective value
(for most platforms) at 24 days. bz#3229
* ssh(1): consider the ECDSA key subtype when ordering host key
algorithms in the client.
* ssh(1), sshd(8): rename the PubkeyAcceptedKeyTypes keyword to
PubkeyAcceptedAlgorithms. The previous name incorrectly suggested
that it control allowed key algorithms, when this option actually
specifies the signature algorithms that are accepted. The previous
name remains available as an alias. bz#3253
* ssh(1), sshd(8): similarly, rename HostbasedKeyTypes (ssh) and
HostbasedAcceptedKeyTypes (sshd) to HostbasedAcceptedAlgorithms.
* sftp-server(8): add missing lsetstat@openssh.com documentation
and advertisement in the server's SSH2_FXP_VERSION hello packet.
* ssh(1), sshd(8): more strictly enforce KEX state-machine by
banning packet types once they are received. Fixes memleak caused
by duplicate SSH2_MSG_KEX_DH_GEX_REQUEST (oss-fuzz #30078).
* sftp(1): allow the full range of UIDs/GIDs for chown/chgrp on 32bit
platforms instead of being limited by LONG_MAX. bz#3206
* Minor man page fixes (capitalization, commas, etc.) bz#3223
* sftp(1): when doing an sftp recursive upload or download of a
read-only directory, ensure that the directory is created with
write and execute permissions in the interim so that the transfer
can actually complete, then set the directory permission as the
final step. bz#3222
* ssh-keygen(1): document the -Z, check the validity of its argument
earlier and provide a better error message if it's not correct.
bz#2879
* ssh(1): ignore comments at the end of config lines in ssh_config,
similar to what we already do for sshd_config. bz#2320
* sshd_config(5): mention that DisableForwarding is valid in a
sshd_config Match block. bz3239
* sftp(1): fix incorrect sorting of "ls -ltr" under some
circumstances. bz3248.
* ssh(1), sshd(8): fix potential integer truncation of (unlikely)
timeout values. bz#3250
* ssh(1): make hostbased authentication send the signature algorithm
in its SSH2_MSG_USERAUTH_REQUEST packets instead of the key type.
This make HostbasedAcceptedAlgorithms do what it is supposed to -
filter on signature algorithm and not key type.
- Rebased patches:
* openssh-7.7p1-IPv6_X_forwarding.patch
* openssh-7.7p1-X11_trusted_forwarding.patch
* openssh-7.7p1-X_forward_with_disabled_ipv6.patch
* openssh-7.7p1-cavstest-ctr.patch
* openssh-7.7p1-cavstest-kdf.patch
* openssh-7.7p1-disable_openssl_abi_check.patch
* openssh-7.7p1-eal3.patch
* openssh-7.7p1-enable_PAM_by_default.patch
* openssh-7.7p1-fips.patch
* openssh-7.7p1-fips_checks.patch
* openssh-7.7p1-host_ident.patch
* openssh-7.7p1-hostname_changes_when_forwarding_X.patch
* openssh-7.7p1-ldap.patch
* openssh-7.7p1-no_fork-no_pid_file.patch
* openssh-7.7p1-pam_check_locks.patch
* openssh-7.7p1-pts_names_formatting.patch
* openssh-7.7p1-remove_xauth_cookies_on_exit.patch
* openssh-7.7p1-seccomp_ipc_flock.patch
* openssh-7.7p1-seccomp_stat.patch
* openssh-7.7p1-send_locale.patch
* openssh-7.7p1-sftp_force_permissions.patch
* openssh-7.7p1-sftp_print_diagnostic_messages.patch
* openssh-7.7p1-systemd-notify.patch
* openssh-7.9p1-keygen-preserve-perms.patch
* openssh-7.9p1-revert-new-qos-defaults.patch
* openssh-8.0p1-gssapi-keyex.patch
* openssh-8.1p1-audit.patch
* openssh-8.1p1-seccomp-clock_gettime64.patch
* openssh-8.1p1-seccomp-clock_nanosleep.patch
* openssh-8.1p1-seccomp-clock_nanosleep_time64.patch
* openssh-8.1p1-use-openssl-kdf.patch
* openssh-8.4p1-vendordir.patch
* openssh-fips-ensure-approved-moduli.patch
* openssh-link-with-sk.patch
* openssh-reenable-dh-group14-sha1-default.patch
* openssh-whitelist-syscalls.patch
- Removed openssh-fix-ssh-copy-id.patch (fixed upstream).
-------------------------------------------------------------------
Thu Aug 19 10:07:10 UTC 2021 - Thorsten Kukuk <kukuk@suse.com>

View File

@ -35,7 +35,7 @@
%define _fillupdir %{_localstatedir}/adm/fillup-templates
%endif
Name: openssh
Version: 8.4p1
Version: 8.8p1
Release: 0
Summary: Secure Shell Client and Server (Remote Login Program)
License: BSD-2-Clause AND MIT
@ -105,7 +105,6 @@ Patch40: openssh-8.1p1-ed25519-use-openssl-rng.patch
Patch41: openssh-fips-ensure-approved-moduli.patch
Patch42: openssh-link-with-sk.patch
Patch43: openssh-reenable-dh-group14-sha1-default.patch
Patch44: openssh-fix-ssh-copy-id.patch
Patch45: openssh-8.4p1-ssh_config_d.patch
Patch46: openssh-whitelist-syscalls.patch
Patch47: openssh-8.4p1-vendordir.patch