forked from pool/openssh
Accepting request 737034 from home:hpjansson:branches:network
Version update to 8.1p1:
* ssh-keygen(1): when acting as a CA and signing certificates with
an RSA key, default to using the rsa-sha2-512 signature algorithm.
Certificates signed by RSA keys will therefore be incompatible
with OpenSSH versions prior to 7.2 unless the default is
overridden (using "ssh-keygen -t ssh-rsa -s ...").
* ssh(1): Allow %n to be expanded in ProxyCommand strings
* ssh(1), sshd(8): Allow prepending a list of algorithms to the
default set by starting the list with the '^' character, E.g.
"HostKeyAlgorithms ^ssh-ed25519"
* ssh-keygen(1): add an experimental lightweight signature and
verification ability. Signatures may be made using regular ssh keys
held on disk or stored in a ssh-agent and verified against an
authorized_keys-like list of allowed keys. Signatures embed a
namespace that prevents confusion and attacks between different
usage domains (e.g. files vs email).
* ssh-keygen(1): print key comment when extracting public key from a
private key.
* ssh-keygen(1): accept the verbose flag when searching for host keys
in known hosts (i.e. "ssh-keygen -vF host") to print the matching
host's random-art signature too.
* All: support PKCS8 as an optional format for storage of private
keys to disk. The OpenSSH native key format remains the default,
but PKCS8 is a superior format to PEM if interoperability with
non-OpenSSH software is required, as it may use a less insecure
key derivation function than PEM's.
- Additional changes from 8.0p1 release:
* scp(1): Add "-T" flag to disable client-side filtering of
server file list.
* sshd(8): Remove support for obsolete "host/port" syntax.
OBS-URL: https://build.opensuse.org/request/show/737034
OBS-URL: https://build.opensuse.org/package/show/network/openssh?expand=0&rev=197
This commit is contained in:
Tomáš Chvátal
committed by
Git OBS Bridge
Git OBS Bridge
parent
9a25e259e6
commit
318211936a
@@ -3,25 +3,71 @@
|
||||
# extended support for (re-)seeding the OpenSSL PRNG from /dev/random
|
||||
# bnc#703221, FATE#312172
|
||||
|
||||
Index: openssh-7.8p1/entropy.c
|
||||
===================================================================
|
||||
--- openssh-7.8p1.orig/entropy.c
|
||||
+++ openssh-7.8p1/entropy.c
|
||||
@@ -235,6 +235,9 @@ seed_rng(void)
|
||||
memset(buf, '\0', sizeof(buf));
|
||||
diff --git a/Makefile.in b/Makefile.in
|
||||
index 85818f4..750aada 100644
|
||||
--- a/Makefile.in
|
||||
+++ b/Makefile.in
|
||||
@@ -182,13 +182,13 @@ libssh.a: $(LIBSSH_OBJS)
|
||||
$(RANLIB) $@
|
||||
|
||||
ssh$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHOBJS)
|
||||
- $(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHLIBS) $(LIBS) $(GSSLIBS)
|
||||
+ $(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(SSHLIBS) $(LIBS) $(GSSLIBS)
|
||||
|
||||
sshd$(EXEEXT): libssh.a $(LIBCOMPAT) $(SSHDOBJS)
|
||||
- $(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) $(LIBS) $(GSSLIBS) $(K5LIBS)
|
||||
+ $(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(SSHDLIBS) $(LIBS) $(GSSLIBS) $(K5LIBS)
|
||||
|
||||
scp$(EXEEXT): $(LIBCOMPAT) libssh.a scp.o progressmeter.o
|
||||
- $(LD) -o $@ scp.o progressmeter.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
|
||||
+ $(LD) -o $@ scp.o progressmeter.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
|
||||
|
||||
ssh-add$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-add.o
|
||||
$(LD) -o $@ ssh-add.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
|
||||
@@ -197,10 +197,10 @@ ssh-agent$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-agent.o ssh-pkcs11-client.o
|
||||
$(LD) -o $@ ssh-agent.o ssh-pkcs11-client.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
|
||||
|
||||
ssh-keygen$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keygen.o sshsig.o
|
||||
- $(LD) -o $@ ssh-keygen.o sshsig.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
|
||||
+ $(LD) -o $@ ssh-keygen.o sshsig.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
|
||||
|
||||
ssh-keysign$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keysign.o readconf.o uidswap.o compat.o
|
||||
- $(LD) -o $@ ssh-keysign.o readconf.o uidswap.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
|
||||
+ $(LD) -o $@ ssh-keysign.o readconf.o uidswap.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
|
||||
|
||||
ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-pkcs11-helper.o ssh-pkcs11.o
|
||||
$(LD) -o $@ ssh-pkcs11-helper.o ssh-pkcs11.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
|
||||
@@ -209,10 +209,10 @@ ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o
|
||||
$(LD) -o $@ ssh-keyscan.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
|
||||
|
||||
sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-common.o sftp-server.o sftp-realpath.o sftp-server-main.o
|
||||
- $(LD) -o $@ sftp-server.o sftp-common.o sftp-realpath.o sftp-server-main.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
|
||||
+ $(LD) -o $@ sftp-server.o sftp-common.o sftp-realpath.o sftp-server-main.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
|
||||
|
||||
sftp$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-client.o sftp-common.o sftp-glob.o progressmeter.o
|
||||
- $(LD) -o $@ progressmeter.o sftp.o sftp-client.o sftp-common.o sftp-glob.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) $(LIBEDIT)
|
||||
+ $(LD) -o $@ progressmeter.o sftp.o sftp-client.o sftp-common.o sftp-glob.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS) $(LIBEDIT)
|
||||
|
||||
# FIPS tests
|
||||
cavstest-ctr$(EXEEXT): $(LIBCOMPAT) libssh.a cavstest-ctr.o
|
||||
diff --git a/entropy.c b/entropy.c
|
||||
index 5de6801..f8b9f42 100644
|
||||
--- a/entropy.c
|
||||
+++ b/entropy.c
|
||||
@@ -239,6 +239,8 @@ seed_rng(void)
|
||||
}
|
||||
#endif /* OPENSSL_PRNG_ONLY */
|
||||
+
|
||||
|
||||
+ linux_seed();
|
||||
+
|
||||
if (RAND_status() != 1)
|
||||
fatal("PRNG is not seeded");
|
||||
}
|
||||
Index: openssh-7.8p1/openbsd-compat/Makefile.in
|
||||
===================================================================
|
||||
--- openssh-7.8p1.orig/openbsd-compat/Makefile.in
|
||||
+++ openssh-7.8p1/openbsd-compat/Makefile.in
|
||||
@@ -90,6 +90,7 @@ COMPAT= arc4random.o \
|
||||
|
||||
diff --git a/openbsd-compat/Makefile.in b/openbsd-compat/Makefile.in
|
||||
index 1162dc5..80fd688 100644
|
||||
--- a/openbsd-compat/Makefile.in
|
||||
+++ b/openbsd-compat/Makefile.in
|
||||
@@ -91,6 +91,7 @@ COMPAT= arc4random.o \
|
||||
PORTS= port-aix.o \
|
||||
port-irix.o \
|
||||
port-linux.o \
|
||||
@@ -29,10 +75,11 @@ Index: openssh-7.8p1/openbsd-compat/Makefile.in
|
||||
port-solaris.o \
|
||||
port-net.o \
|
||||
port-uw.o
|
||||
Index: openssh-7.8p1/openbsd-compat/port-linux-prng.c
|
||||
===================================================================
|
||||
diff --git a/openbsd-compat/port-linux-prng.c b/openbsd-compat/port-linux-prng.c
|
||||
new file mode 100644
|
||||
index 0000000..dfc4bdb
|
||||
--- /dev/null
|
||||
+++ openssh-7.8p1/openbsd-compat/port-linux-prng.c
|
||||
+++ b/openbsd-compat/port-linux-prng.c
|
||||
@@ -0,0 +1,81 @@
|
||||
+/*
|
||||
+ * Copyright (c) 2011 Jan F. Chadima <jchadima@redhat.com>
|
||||
@@ -115,10 +162,10 @@ Index: openssh-7.8p1/openbsd-compat/port-linux-prng.c
|
||||
+ fatal ("EOF reading %s", rand_file);
|
||||
+ }
|
||||
+}
|
||||
Index: openssh-7.8p1/openbsd-compat/port-linux.h
|
||||
===================================================================
|
||||
--- openssh-7.8p1.orig/openbsd-compat/port-linux.h
|
||||
+++ openssh-7.8p1/openbsd-compat/port-linux.h
|
||||
diff --git a/openbsd-compat/port-linux.h b/openbsd-compat/port-linux.h
|
||||
index 3c22a85..2dc1fd0 100644
|
||||
--- a/openbsd-compat/port-linux.h
|
||||
+++ b/openbsd-compat/port-linux.h
|
||||
@@ -17,6 +17,10 @@
|
||||
#ifndef _PORT_LINUX_H
|
||||
#define _PORT_LINUX_H
|
||||
@@ -130,11 +177,11 @@ Index: openssh-7.8p1/openbsd-compat/port-linux.h
|
||||
#ifdef WITH_SELINUX
|
||||
int ssh_selinux_enabled(void);
|
||||
void ssh_selinux_setup_pty(char *, const char *);
|
||||
Index: openssh-7.8p1/ssh-add.1
|
||||
===================================================================
|
||||
--- openssh-7.8p1.orig/ssh-add.1
|
||||
+++ openssh-7.8p1/ssh-add.1
|
||||
@@ -172,6 +172,20 @@ to make this work.)
|
||||
diff --git a/ssh-add.1 b/ssh-add.1
|
||||
index d4e1c60..6f76900 100644
|
||||
--- a/ssh-add.1
|
||||
+++ b/ssh-add.1
|
||||
@@ -189,6 +189,20 @@ to make this work.)
|
||||
Identifies the path of a
|
||||
.Ux Ns -domain
|
||||
socket used to communicate with the agent.
|
||||
@@ -155,11 +202,11 @@ Index: openssh-7.8p1/ssh-add.1
|
||||
.El
|
||||
.Sh FILES
|
||||
.Bl -tag -width Ds
|
||||
Index: openssh-7.8p1/ssh-agent.1
|
||||
===================================================================
|
||||
--- openssh-7.8p1.orig/ssh-agent.1
|
||||
+++ openssh-7.8p1/ssh-agent.1
|
||||
@@ -214,6 +214,23 @@ sockets used to contain the connection t
|
||||
diff --git a/ssh-agent.1 b/ssh-agent.1
|
||||
index 83b2b41..9e187f2 100644
|
||||
--- a/ssh-agent.1
|
||||
+++ b/ssh-agent.1
|
||||
@@ -214,6 +214,23 @@ sockets used to contain the connection to the authentication agent.
|
||||
These sockets should only be readable by the owner.
|
||||
The sockets should get automatically removed when the agent exits.
|
||||
.El
|
||||
@@ -183,11 +230,11 @@ Index: openssh-7.8p1/ssh-agent.1
|
||||
.Sh SEE ALSO
|
||||
.Xr ssh 1 ,
|
||||
.Xr ssh-add 1 ,
|
||||
Index: openssh-7.8p1/ssh-keygen.1
|
||||
===================================================================
|
||||
--- openssh-7.8p1.orig/ssh-keygen.1
|
||||
+++ openssh-7.8p1/ssh-keygen.1
|
||||
@@ -869,6 +869,23 @@ Contains Diffie-Hellman groups used for
|
||||
diff --git a/ssh-keygen.1 b/ssh-keygen.1
|
||||
index 957d2f0..70c4a28 100644
|
||||
--- a/ssh-keygen.1
|
||||
+++ b/ssh-keygen.1
|
||||
@@ -1054,6 +1054,23 @@ Contains Diffie-Hellman groups used for DH-GEX.
|
||||
The file format is described in
|
||||
.Xr moduli 5 .
|
||||
.El
|
||||
@@ -211,11 +258,11 @@ Index: openssh-7.8p1/ssh-keygen.1
|
||||
.Sh SEE ALSO
|
||||
.Xr ssh 1 ,
|
||||
.Xr ssh-add 1 ,
|
||||
Index: openssh-7.8p1/ssh-keysign.8
|
||||
===================================================================
|
||||
--- openssh-7.8p1.orig/ssh-keysign.8
|
||||
+++ openssh-7.8p1/ssh-keysign.8
|
||||
@@ -80,6 +80,23 @@ must be set-uid root if host-based authe
|
||||
diff --git a/ssh-keysign.8 b/ssh-keysign.8
|
||||
index 19b0dbc..639b56e 100644
|
||||
--- a/ssh-keysign.8
|
||||
+++ b/ssh-keysign.8
|
||||
@@ -80,6 +80,23 @@ must be set-uid root if host-based authentication is used.
|
||||
If these files exist they are assumed to contain public certificate
|
||||
information corresponding with the private keys above.
|
||||
.El
|
||||
@@ -239,11 +286,11 @@ Index: openssh-7.8p1/ssh-keysign.8
|
||||
.Sh SEE ALSO
|
||||
.Xr ssh 1 ,
|
||||
.Xr ssh-keygen 1 ,
|
||||
Index: openssh-7.8p1/ssh.1
|
||||
===================================================================
|
||||
--- openssh-7.8p1.orig/ssh.1
|
||||
+++ openssh-7.8p1/ssh.1
|
||||
@@ -1432,6 +1432,20 @@ For more information, see the
|
||||
diff --git a/ssh.1 b/ssh.1
|
||||
index 424d6c3..899a339 100644
|
||||
--- a/ssh.1
|
||||
+++ b/ssh.1
|
||||
@@ -1433,6 +1433,20 @@ For more information, see the
|
||||
.Cm PermitUserEnvironment
|
||||
option in
|
||||
.Xr sshd_config 5 .
|
||||
@@ -264,11 +311,11 @@ Index: openssh-7.8p1/ssh.1
|
||||
.Sh FILES
|
||||
.Bl -tag -width Ds -compact
|
||||
.It Pa ~/.rhosts
|
||||
Index: openssh-7.8p1/sshd.8
|
||||
===================================================================
|
||||
--- openssh-7.8p1.orig/sshd.8
|
||||
+++ openssh-7.8p1/sshd.8
|
||||
@@ -966,6 +966,23 @@ concurrently for different ports, this c
|
||||
diff --git a/sshd.8 b/sshd.8
|
||||
index fb133c1..2f1d3ab 100644
|
||||
--- a/sshd.8
|
||||
+++ b/sshd.8
|
||||
@@ -966,6 +966,23 @@ concurrently for different ports, this contains the process ID of the one
|
||||
started last).
|
||||
The content of this file is not sensitive; it can be world-readable.
|
||||
.El
|
||||
@@ -292,10 +339,10 @@ Index: openssh-7.8p1/sshd.8
|
||||
.Sh SEE ALSO
|
||||
.Xr scp 1 ,
|
||||
.Xr sftp 1 ,
|
||||
Index: openssh-7.8p1/sshd.c
|
||||
===================================================================
|
||||
--- openssh-7.8p1.orig/sshd.c
|
||||
+++ openssh-7.8p1/sshd.c
|
||||
diff --git a/sshd.c b/sshd.c
|
||||
index bb20eec..c562094 100644
|
||||
--- a/sshd.c
|
||||
+++ b/sshd.c
|
||||
@@ -55,6 +55,8 @@
|
||||
#endif
|
||||
#include "openbsd-compat/sys-tree.h"
|
||||
@@ -305,7 +352,7 @@ Index: openssh-7.8p1/sshd.c
|
||||
#include <sys/wait.h>
|
||||
|
||||
#include <errno.h>
|
||||
@@ -208,6 +210,13 @@ struct {
|
||||
@@ -205,6 +207,13 @@ struct {
|
||||
int have_ssh2_key;
|
||||
} sensitive_data;
|
||||
|
||||
@@ -319,8 +366,8 @@ Index: openssh-7.8p1/sshd.c
|
||||
/* This is set to true when a signal is received. */
|
||||
static volatile sig_atomic_t received_sighup = 0;
|
||||
static volatile sig_atomic_t received_sigterm = 0;
|
||||
@@ -1252,6 +1261,10 @@ server_accept_loop(int *sock_in, int *so
|
||||
startups++;
|
||||
@@ -1201,6 +1210,10 @@ server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s)
|
||||
startup_flags[j] = 1;
|
||||
break;
|
||||
}
|
||||
+ if(!(--re_seeding_counter)) {
|
||||
|
||||
Reference in New Issue
Block a user