commit: 71699a51c170e05dd92e6b79f7dedb2f8b50f0fb Author: Anthony G. Basile <blueness <AT> gentoo <DOT> org> AuthorDate: Fri Jun 15 09:03:59 2018 +0000 Commit: Anthony G. Basile <blueness <AT> gentoo <DOT> org> CommitDate: Fri Jun 15 09:03:59 2018 +0000 URL: https://gitweb.gentoo.org/proj/musl.git/commit/?id=71699a51
net-misc/openssh: sync with tree Package-Manager: Portage-2.3.40, Repoman-2.3.9 RepoMan-Options: --force net-misc/openssh/Manifest | 10 +- .../files/openssh-7.3-mips-seccomp-n32.patch | 21 -- .../openssh/files/openssh-7.3_p1-GSSAPI-dns.patch | 351 --------------------- .../files/openssh-7.3_p1-NEWKEYS_null_deref.patch | 29 -- ...egister-the-KEXINIT-handler-after-receive.patch | 32 -- ...ssh-7.3_p1-fix-ssh1-with-no-ssh1-host-key.patch | 34 -- .../openssh-7.3_p1-hpn-12-x509-9.2-glue.patch | 39 --- ...ssh-7.3_p1-hpn-cipher-ctr-mt-no-deadlocks.patch | 245 -------------- .../files/openssh-7.3_p1-hpn-x509-9.2-glue.patch | 41 --- .../files/openssh-7.3_p1-sctp-x509-glue.patch | 67 ---- .../files/openssh-7.3_p1-x509-9.2-warnings.patch | 109 ------- .../files/openssh-7.5_p1-CVE-2017-15906.patch | 31 -- .../openssh/files/openssh-7.5_p1-cross-cache.patch | 39 --- ...penssh-7.5_p1-disable-conch-interop-tests.patch | 20 ++ .../openssh/files/openssh-7.5_p1-x32-typo.patch | 25 -- ...I-dns.patch => openssh-7.7_p1-GSSAPI-dns.patch} | 224 ++++++------- net-misc/openssh/files/sshd-r1.confd | 33 ++ net-misc/openssh/files/sshd.confd | 21 -- net-misc/openssh/files/sshd.rc6.4 | 84 ----- net-misc/openssh/files/sshd.rc6.5 | 89 ++++++ ...h-7.5_p1-r4.ebuild => openssh-7.7_p1-r4.ebuild} | 309 ++++++++++++------ 21 files changed, 464 insertions(+), 1389 deletions(-) diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest index bda2277..8ec1580 100644 --- a/net-misc/openssh/Manifest +++ b/net-misc/openssh/Manifest @@ -1,5 +1,5 @@ -DIST openssh-7.4_p1-sctp.patch.xz 8220 SHA256 18fa77f79ccae8b9a76bc877e9602113d91953bd487b6cc8284bfd1217438a23 SHA512 0c199e3b26949482125aeaa88216b2458292589e3eac8908d9134d13a1cae891094fcb0f752ed3009b3126cc72277b460205f39140c251792eb1b545271c3bd4 WHIRLPOOL 0f0ea1d36523b35d3be33d22fb84daa05fd14c464d69c19695235f81d26326bc53d6804bf34d0cc0c2584f412bfdac361d2b018032447d1033a4ff4fd9458a09 -DIST openssh-7.5p1+x509-10.2.diff.gz 467040 SHA256 24d5c1949d245b432abf2db6c28554a09bcffdcb4f4247826c0a33bdbee8b92c SHA512 ec760d38771749d09afc8d720120ea2aa065c1c7983898b45dba74a4411f7e61e7705da226864e1e8e62e2261eecc3a4ab654b528c71512a07798824d9fb1a9a WHIRLPOOL 3291a3e39b1a47efe149cdf805de11217fd55c4260477f2a6c6cc0bfa376b98a5dc7f56a49ae184fb57bae6226c73d1794db7b2285e3ea26a8fea4bc9304655b -DIST openssh-7.5p1-hpnssh14v12.tar.xz 23068 SHA256 8a1ed99c121a4ad21d7a26cd32627a8dd51595fd3ee9f95dc70e6b50fe779ce2 SHA512 45c42090a212b9ce898fbaa8284ddf0f0d17236af13c4a780e00bf265b0c7a4286027e90a7ce9ad70066309db722709dd2f0a7914f57e5364ffbaf7c4859cdf9 WHIRLPOOL 6089ad8ae16c112a6f15d168c092e7f057b9e6d815724346b5a6a1cd0de932f779d5f410d48c904d935fcb3bad3f597fa4de075ab1f49cadc9842ce7bd8fdf42 -DIST openssh-7.5p1.tar.gz 1510857 SHA256 9846e3c5fab9f0547400b4d2c017992f914222b3fd1f8eee6c7dc6bc5e59f9f0 SHA512 58c542e8a110fb4316a68db94abb663fa1c810becd0638d45281df8aeca62c1f705090437a80e788e6c29121769b72a505feced537d3118c933fde01b5285c81 WHIRLPOOL 1a42c68d8e350bc4790dd4c1a98dd6571bfa353ad6871b1462c53b6412f752719daabd1a13bb4434d294de966a00428ac66334bab45f371420029b5e34a6914c -DIST openssh-lpk-7.5p1-0.3.14.patch.xz 17040 SHA256 11060be996b291b8d78de698c68a92428430e4ff440553f5045c6de5c0e1dab3 SHA512 9ce5d7e5d831c972f0f866b686bf93a048a03979ab38627973f5491eeeaa45f9faab0520b3a7ed90a13a67213fdc9cd4cf11e423acad441ea91b71037c8b435b WHIRLPOOL 58526777475786bb5efa193f3a3ec0500c4d48b18fef67698f8b1999cb07f04fbca7b7d3ece469f3a1e1ceca5152cdd08d3dbe7cfa4e7494740dc2c233101b93 +DIST openssh-7.7p1-hpnssh14v15-gentoo1.patch.xz 22060 BLAKE2B 81a7f3d1346718c154b39920c126eb0b00ae43f1369d882b8a1bd0b885668805639d869581fb49a8e7c67b61d72a904fde45841e4396af426b136d6d2f0a0dc3 SHA512 7b437bc061677aeabe561ad74bb19bc6f85369119ad8a92fb430fb5c1394c2bb3afd472ee66b285362b2041f871c56633dc94fec33cb062c6b1817d63c1d4a78 +DIST openssh-7.7p1-patches-1.1.tar.xz 16476 BLAKE2B fca2885a9e29faec40700ece37a995ba83e40bd2a6875129a5327770d8ee43663a7c063de33b4653994ed7332adb03730f613c047550d874190b95c66e2e9efa SHA512 aa5e33ce4bb4be16abf27ac1bade1dc85c51d82002be546402e0b8b0685de3ec7029f0f56bf1295ec346eb3960a6bed7cfc882722e57957a19a732f3174b3039 +DIST openssh-7.7p1-sctp-1.0.patch.xz 7380 BLAKE2B 6ad40972ece131ff148ede6ba94d63bffc606e0bcabb959d4c9056196cb6f4fddc285f97d7b49b73fde7ee84e3c981c07bddb058ad88eb7c7c2fe716e657c630 SHA512 bc5f50805ba25415f93f61b6654e5bcbaef673b0af48d339116ca9c94b6152afae294c5a9144adeb40190da97c2fc73b43e3ac7ac34feb4a647628327a7cac0a +DIST openssh-7.7p1-x509-11.3.1.patch.xz 362672 BLAKE2B 55b8b0ef00dc4d962a0db1115406b7b1e84110870c74198e9e4cb081b2ffde8daca67cb281c69d73b4c5cbffde361429d62634be194b57e888a0b434a0f42a37 SHA512 f84744f6d2e5a15017bce37bfa65ebb47dbafeac07ea9aab46bdc780b4062ff70687512d9d512cab81e3b9c701adb6ce17c5474f35cb4b49f57db2e2d45ac9ac +DIST openssh-7.7p1.tar.gz 1536900 BLAKE2B 7aee360f2cea5bfa3f8426fcbd66fde2568f05f9c8e623326b60f03b7c5f8abf223e178aa1d5958015b51627565bf5b1ace35b57f309638c908f5a7bf5500d21 SHA512 597252cb48209a0cb98ca1928a67e8d63e4275252f25bc37269204c108f034baade6ba0634e32ae63422fddd280f73096a6b31ad2f2e7a848dde75ca30e14261 diff --git a/net-misc/openssh/files/openssh-7.3-mips-seccomp-n32.patch b/net-misc/openssh/files/openssh-7.3-mips-seccomp-n32.patch deleted file mode 100644 index 7eaadaf..0000000 --- a/net-misc/openssh/files/openssh-7.3-mips-seccomp-n32.patch +++ /dev/null @@ -1,21 +0,0 @@ -https://bugs.gentoo.org/591392 -https://bugzilla.mindrot.org/show_bug.cgi?id=2590 - -7.3 added seccomp support to MIPS, but failed to handled the N32 -case. This patch is temporary until upstream fixes. - ---- openssh-7.3p1/configure.ac -+++ openssh-7.3p1/configure.ac -@@ -816,10 +816,10 @@ main() { if (NSVersionOfRunTimeLibrary(" - seccomp_audit_arch=AUDIT_ARCH_MIPSEL - ;; - mips64-*) -- seccomp_audit_arch=AUDIT_ARCH_MIPS64 -+ seccomp_audit_arch=AUDIT_ARCH_MIPS64N32 - ;; - mips64el-*) -- seccomp_audit_arch=AUDIT_ARCH_MIPSEL64 -+ seccomp_audit_arch=AUDIT_ARCH_MIPSEL64N32 - ;; - esac - if test "x$seccomp_audit_arch" != "x" ; then diff --git a/net-misc/openssh/files/openssh-7.3_p1-GSSAPI-dns.patch b/net-misc/openssh/files/openssh-7.3_p1-GSSAPI-dns.patch deleted file mode 100644 index 806b36d..0000000 --- a/net-misc/openssh/files/openssh-7.3_p1-GSSAPI-dns.patch +++ /dev/null @@ -1,351 +0,0 @@ -http://bugs.gentoo.org/165444 -https://bugzilla.mindrot.org/show_bug.cgi?id=1008 - ---- a/readconf.c -+++ b/readconf.c -@@ -148,6 +148,7 @@ - oClearAllForwardings, oNoHostAuthenticationForLocalhost, - oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout, - oAddressFamily, oGssAuthentication, oGssDelegateCreds, -+ oGssTrustDns, - oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly, - oSendEnv, oControlPath, oControlMaster, oControlPersist, - oHashKnownHosts, -@@ -194,9 +195,11 @@ - #if defined(GSSAPI) - { "gssapiauthentication", oGssAuthentication }, - { "gssapidelegatecredentials", oGssDelegateCreds }, -+ { "gssapitrustdns", oGssTrustDns }, - #else - { "gssapiauthentication", oUnsupported }, - { "gssapidelegatecredentials", oUnsupported }, -+ { "gssapitrustdns", oUnsupported }, - #endif - { "fallbacktorsh", oDeprecated }, - { "usersh", oDeprecated }, -@@ -930,6 +933,10 @@ - intptr = &options->gss_deleg_creds; - goto parse_flag; - -+ case oGssTrustDns: -+ intptr = &options->gss_trust_dns; -+ goto parse_flag; -+ - case oBatchMode: - intptr = &options->batch_mode; - goto parse_flag; -@@ -1649,6 +1656,7 @@ - options->challenge_response_authentication = -1; - options->gss_authentication = -1; - options->gss_deleg_creds = -1; -+ options->gss_trust_dns = -1; - options->password_authentication = -1; - options->kbd_interactive_authentication = -1; - options->kbd_interactive_devices = NULL; -@@ -1779,6 +1787,8 @@ - options->gss_authentication = 0; - if (options->gss_deleg_creds == -1) - options->gss_deleg_creds = 0; -+ if (options->gss_trust_dns == -1) -+ options->gss_trust_dns = 0; - if (options->password_authentication == -1) - options->password_authentication = 1; - if (options->kbd_interactive_authentication == -1) ---- a/readconf.h -+++ b/readconf.h -@@ -46,6 +46,7 @@ - /* Try S/Key or TIS, authentication. */ - int gss_authentication; /* Try GSS authentication */ - int gss_deleg_creds; /* Delegate GSS credentials */ -+ int gss_trust_dns; /* Trust DNS for GSS canonicalization */ - int password_authentication; /* Try password - * authentication. */ - int kbd_interactive_authentication; /* Try keyboard-interactive auth. */ ---- a/ssh_config.5 -+++ b/ssh_config.5 -@@ -830,6 +830,16 @@ - Forward (delegate) credentials to the server. - The default is - .Dq no . -+Note that this option applies to protocol version 2 connections using GSSAPI. -+.It Cm GSSAPITrustDns -+Set to -+.Dq yes to indicate that the DNS is trusted to securely canonicalize -+the name of the host being connected to. If -+.Dq no, the hostname entered on the -+command line will be passed untouched to the GSSAPI library. -+The default is -+.Dq no . -+This option only applies to protocol version 2 connections using GSSAPI. - .It Cm HashKnownHosts - Indicates that - .Xr ssh 1 ---- a/sshconnect2.c -+++ b/sshconnect2.c -@@ -656,6 +656,13 @@ - static u_int mech = 0; - OM_uint32 min; - int ok = 0; -+ const char *gss_host; -+ -+ if (options.gss_trust_dns) { -+ extern const char *auth_get_canonical_hostname(struct ssh *ssh, int use_dns); -+ gss_host = auth_get_canonical_hostname(active_state, 1); -+ } else -+ gss_host = authctxt->host; - - /* Try one GSSAPI method at a time, rather than sending them all at - * once. */ -@@ -668,7 +674,7 @@ - /* My DER encoding requires length<128 */ - if (gss_supported->elements[mech].length < 128 && - ssh_gssapi_check_mechanism(&gssctxt, -- &gss_supported->elements[mech], authctxt->host)) { -+ &gss_supported->elements[mech], gss_host)) { - ok = 1; /* Mechanism works */ - } else { - mech++; - -need to move these two funcs back to canohost so they're available to clients -and the server. auth.c is only used in the server. - ---- a/auth.c -+++ b/auth.c -@@ -784,117 +784,3 @@ fakepw(void) - - return (&fake); - } -- --/* -- * Returns the remote DNS hostname as a string. The returned string must not -- * be freed. NB. this will usually trigger a DNS query the first time it is -- * called. -- * This function does additional checks on the hostname to mitigate some -- * attacks on legacy rhosts-style authentication. -- * XXX is RhostsRSAAuthentication vulnerable to these? -- * XXX Can we remove these checks? (or if not, remove RhostsRSAAuthentication?) -- */ -- --static char * --remote_hostname(struct ssh *ssh) --{ -- struct sockaddr_storage from; -- socklen_t fromlen; -- struct addrinfo hints, *ai, *aitop; -- char name[NI_MAXHOST], ntop2[NI_MAXHOST]; -- const char *ntop = ssh_remote_ipaddr(ssh); -- -- /* Get IP address of client. */ -- fromlen = sizeof(from); -- memset(&from, 0, sizeof(from)); -- if (getpeername(ssh_packet_get_connection_in(ssh), -- (struct sockaddr *)&from, &fromlen) < 0) { -- debug("getpeername failed: %.100s", strerror(errno)); -- return strdup(ntop); -- } -- -- ipv64_normalise_mapped(&from, &fromlen); -- if (from.ss_family == AF_INET6) -- fromlen = sizeof(struct sockaddr_in6); -- -- debug3("Trying to reverse map address %.100s.", ntop); -- /* Map the IP address to a host name. */ -- if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name), -- NULL, 0, NI_NAMEREQD) != 0) { -- /* Host name not found. Use ip address. */ -- return strdup(ntop); -- } -- -- /* -- * if reverse lookup result looks like a numeric hostname, -- * someone is trying to trick us by PTR record like following: -- * 1.1.1.10.in-addr.arpa. IN PTR 2.3.4.5 -- */ -- memset(&hints, 0, sizeof(hints)); -- hints.ai_socktype = SOCK_DGRAM; /*dummy*/ -- hints.ai_flags = AI_NUMERICHOST; -- if (getaddrinfo(name, NULL, &hints, &ai) == 0) { -- logit("Nasty PTR record \"%s\" is set up for %s, ignoring", -- name, ntop); -- freeaddrinfo(ai); -- return strdup(ntop); -- } -- -- /* Names are stored in lowercase. */ -- lowercase(name); -- -- /* -- * Map it back to an IP address and check that the given -- * address actually is an address of this host. This is -- * necessary because anyone with access to a name server can -- * define arbitrary names for an IP address. Mapping from -- * name to IP address can be trusted better (but can still be -- * fooled if the intruder has access to the name server of -- * the domain). -- */ -- memset(&hints, 0, sizeof(hints)); -- hints.ai_family = from.ss_family; -- hints.ai_socktype = SOCK_STREAM; -- if (getaddrinfo(name, NULL, &hints, &aitop) != 0) { -- logit("reverse mapping checking getaddrinfo for %.700s " -- "[%s] failed.", name, ntop); -- return strdup(ntop); -- } -- /* Look for the address from the list of addresses. */ -- for (ai = aitop; ai; ai = ai->ai_next) { -- if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop2, -- sizeof(ntop2), NULL, 0, NI_NUMERICHOST) == 0 && -- (strcmp(ntop, ntop2) == 0)) -- break; -- } -- freeaddrinfo(aitop); -- /* If we reached the end of the list, the address was not there. */ -- if (ai == NULL) { -- /* Address not found for the host name. */ -- logit("Address %.100s maps to %.600s, but this does not " -- "map back to the address.", ntop, name); -- return strdup(ntop); -- } -- return strdup(name); --} -- --/* -- * Return the canonical name of the host in the other side of the current -- * connection. The host name is cached, so it is efficient to call this -- * several times. -- */ -- --const char * --auth_get_canonical_hostname(struct ssh *ssh, int use_dns) --{ -- static char *dnsname; -- -- if (!use_dns) -- return ssh_remote_ipaddr(ssh); -- else if (dnsname != NULL) -- return dnsname; -- else { -- dnsname = remote_hostname(ssh); -- return dnsname; -- } --} ---- a/canohost.c -+++ b/canohost.c -@@ -202,3 +202,117 @@ get_local_port(int sock) - { - return get_sock_port(sock, 1); - } -+ -+/* -+ * Returns the remote DNS hostname as a string. The returned string must not -+ * be freed. NB. this will usually trigger a DNS query the first time it is -+ * called. -+ * This function does additional checks on the hostname to mitigate some -+ * attacks on legacy rhosts-style authentication. -+ * XXX is RhostsRSAAuthentication vulnerable to these? -+ * XXX Can we remove these checks? (or if not, remove RhostsRSAAuthentication?) -+ */ -+ -+static char * -+remote_hostname(struct ssh *ssh) -+{ -+ struct sockaddr_storage from; -+ socklen_t fromlen; -+ struct addrinfo hints, *ai, *aitop; -+ char name[NI_MAXHOST], ntop2[NI_MAXHOST]; -+ const char *ntop = ssh_remote_ipaddr(ssh); -+ -+ /* Get IP address of client. */ -+ fromlen = sizeof(from); -+ memset(&from, 0, sizeof(from)); -+ if (getpeername(ssh_packet_get_connection_in(ssh), -+ (struct sockaddr *)&from, &fromlen) < 0) { -+ debug("getpeername failed: %.100s", strerror(errno)); -+ return strdup(ntop); -+ } -+ -+ ipv64_normalise_mapped(&from, &fromlen); -+ if (from.ss_family == AF_INET6) -+ fromlen = sizeof(struct sockaddr_in6); -+ -+ debug3("Trying to reverse map address %.100s.", ntop); -+ /* Map the IP address to a host name. */ -+ if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name), -+ NULL, 0, NI_NAMEREQD) != 0) { -+ /* Host name not found. Use ip address. */ -+ return strdup(ntop); -+ } -+ -+ /* -+ * if reverse lookup result looks like a numeric hostname, -+ * someone is trying to trick us by PTR record like following: -+ * 1.1.1.10.in-addr.arpa. IN PTR 2.3.4.5 -+ */ -+ memset(&hints, 0, sizeof(hints)); -+ hints.ai_socktype = SOCK_DGRAM; /*dummy*/ -+ hints.ai_flags = AI_NUMERICHOST; -+ if (getaddrinfo(name, NULL, &hints, &ai) == 0) { -+ logit("Nasty PTR record \"%s\" is set up for %s, ignoring", -+ name, ntop); -+ freeaddrinfo(ai); -+ return strdup(ntop); -+ } -+ -+ /* Names are stored in lowercase. */ -+ lowercase(name); -+ -+ /* -+ * Map it back to an IP address and check that the given -+ * address actually is an address of this host. This is -+ * necessary because anyone with access to a name server can -+ * define arbitrary names for an IP address. Mapping from -+ * name to IP address can be trusted better (but can still be -+ * fooled if the intruder has access to the name server of -+ * the domain). -+ */ -+ memset(&hints, 0, sizeof(hints)); -+ hints.ai_family = from.ss_family; -+ hints.ai_socktype = SOCK_STREAM; -+ if (getaddrinfo(name, NULL, &hints, &aitop) != 0) { -+ logit("reverse mapping checking getaddrinfo for %.700s " -+ "[%s] failed.", name, ntop); -+ return strdup(ntop); -+ } -+ /* Look for the address from the list of addresses. */ -+ for (ai = aitop; ai; ai = ai->ai_next) { -+ if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop2, -+ sizeof(ntop2), NULL, 0, NI_NUMERICHOST) == 0 && -+ (strcmp(ntop, ntop2) == 0)) -+ break; -+ } -+ freeaddrinfo(aitop); -+ /* If we reached the end of the list, the address was not there. */ -+ if (ai == NULL) { -+ /* Address not found for the host name. */ -+ logit("Address %.100s maps to %.600s, but this does not " -+ "map back to the address.", ntop, name); -+ return strdup(ntop); -+ } -+ return strdup(name); -+} -+ -+/* -+ * Return the canonical name of the host in the other side of the current -+ * connection. The host name is cached, so it is efficient to call this -+ * several times. -+ */ -+ -+const char * -+auth_get_canonical_hostname(struct ssh *ssh, int use_dns) -+{ -+ static char *dnsname; -+ -+ if (!use_dns) -+ return ssh_remote_ipaddr(ssh); -+ else if (dnsname != NULL) -+ return dnsname; -+ else { -+ dnsname = remote_hostname(ssh); -+ return dnsname; -+ } -+} diff --git a/net-misc/openssh/files/openssh-7.3_p1-NEWKEYS_null_deref.patch b/net-misc/openssh/files/openssh-7.3_p1-NEWKEYS_null_deref.patch deleted file mode 100644 index 784cd2a..0000000 --- a/net-misc/openssh/files/openssh-7.3_p1-NEWKEYS_null_deref.patch +++ /dev/null @@ -1,29 +0,0 @@ -https://bugs.gentoo.org/595342 - -Backport of -https://anongit.mindrot.org/openssh.git/patch/?id=28652bca29046f62c7045e933e6b931de1d16737 - ---- openssh-7.3p1/kex.c -+++ openssh-7.3p1/kex.c -@@ -419,6 +419,8 @@ - ssh_dispatch_set(ssh, SSH2_MSG_NEWKEYS, &kex_protocol_error); - if ((r = sshpkt_get_end(ssh)) != 0) - return r; -+ if ((r = ssh_set_newkeys(ssh, MODE_IN)) != 0) -+ return r; - kex->done = 1; - sshbuf_reset(kex->peer); - /* sshbuf_reset(kex->my); */ ---- openssh-7.3p1/packet.c -+++ openssh-7.3p1/packet.c -@@ -1919,9 +1919,7 @@ - return r; - return SSH_ERR_PROTOCOL_ERROR; - } -- if (*typep == SSH2_MSG_NEWKEYS) -- r = ssh_set_newkeys(ssh, MODE_IN); -- else if (*typep == SSH2_MSG_USERAUTH_SUCCESS && !state->server_side) -+ if (*typep == SSH2_MSG_USERAUTH_SUCCESS && !state->server_side) - r = ssh_packet_enable_delayed_compress(ssh); - else - r = 0; diff --git a/net-misc/openssh/files/openssh-7.3_p1-Unregister-the-KEXINIT-handler-after-receive.patch b/net-misc/openssh/files/openssh-7.3_p1-Unregister-the-KEXINIT-handler-after-receive.patch deleted file mode 100644 index 8603601..0000000 --- a/net-misc/openssh/files/openssh-7.3_p1-Unregister-the-KEXINIT-handler-after-receive.patch +++ /dev/null @@ -1,32 +0,0 @@ -https://bugs.gentoo.org/597360 - -From ec165c392ca54317dbe3064a8c200de6531e89ad Mon Sep 17 00:00:00 2001 -From: "[email protected]" <[email protected]> -Date: Mon, 10 Oct 2016 19:28:48 +0000 -Subject: [PATCH] upstream commit - -Unregister the KEXINIT handler after message has been -received. Otherwise an unauthenticated peer can repeat the KEXINIT and cause -allocation of up to 128MB -- until the connection is closed. Reported by -shilei-c at 360.cn - -Upstream-ID: 43649ae12a27ef94290db16d1a98294588b75c05 ---- - kex.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/kex.c b/kex.c -index 3f97f8c00919..6a94bc535bd7 100644 ---- a/kex.c -+++ b/kex.c -@@ -481,6 +481,7 @@ kex_input_kexinit(int type, u_int32_t seq, void *ctxt) - if (kex == NULL) - return SSH_ERR_INVALID_ARGUMENT; - -+ ssh_dispatch_set(ssh, SSH2_MSG_KEXINIT, NULL); - ptr = sshpkt_ptr(ssh, &dlen); - if ((r = sshbuf_put(kex->peer, ptr, dlen)) != 0) - return r; --- -2.11.0.rc2 - diff --git a/net-misc/openssh/files/openssh-7.3_p1-fix-ssh1-with-no-ssh1-host-key.patch b/net-misc/openssh/files/openssh-7.3_p1-fix-ssh1-with-no-ssh1-host-key.patch deleted file mode 100644 index 7fb0d80..0000000 --- a/net-misc/openssh/files/openssh-7.3_p1-fix-ssh1-with-no-ssh1-host-key.patch +++ /dev/null @@ -1,34 +0,0 @@ -https://bugs.gentoo.org/592122 - -From e600348a7afd6325cc5cd783cb424065cbc20434 Mon Sep 17 00:00:00 2001 -From: "[email protected]" <[email protected]> -Date: Wed, 3 Aug 2016 04:23:55 +0000 -Subject: [PATCH] upstream commit - -Fix bug introduced in rev 1.467 which causes -"buffer_get_bignum_ret: incomplete message" errors when built with WITH_SSH1 -and run such that no Protocol 1 ephemeral host key is generated (eg "Protocol -2", no SSH1 host key supplied). Reported by rainer.laatsch at t-online.de, -ok deraadt@ - -Upstream-ID: aa6b132da5c325523aed7989cc5a320497c919dc ---- - sshd.c | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/sshd.c b/sshd.c -index 799c7711f49c..9fc829a91bc8 100644 ---- a/sshd.c -+++ b/sshd.c -@@ -1071,7 +1071,7 @@ send_rexec_state(int fd, struct sshbuf *conf) - fatal("%s: buffer error: %s", __func__, ssh_err(r)); - } else - #endif -- if ((r = sshbuf_put_u32(m, 1)) != 0) -+ if ((r = sshbuf_put_u32(m, 0)) != 0) - fatal("%s: buffer error: %s", __func__, ssh_err(r)); - - #if defined(WITH_OPENSSL) && !defined(OPENSSL_PRNG_ONLY) --- -2.11.0.rc2 - diff --git a/net-misc/openssh/files/openssh-7.3_p1-hpn-12-x509-9.2-glue.patch b/net-misc/openssh/files/openssh-7.3_p1-hpn-12-x509-9.2-glue.patch deleted file mode 100644 index 0602307..0000000 --- a/net-misc/openssh/files/openssh-7.3_p1-hpn-12-x509-9.2-glue.patch +++ /dev/null @@ -1,39 +0,0 @@ ---- a/0003-Add-support-for-the-multi-threaded-AES-CTR-cipher.patch -+++ b/0003-Add-support-for-the-multi-threaded-AES-CTR-cipher.patch -@@ -1155,7 +1155,7 @@ - @@ -44,7 +44,7 @@ - LD=@LD@ - CFLAGS=@CFLAGS@ -- CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ $(PATHS) @DEFS@ -+ CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ @LDAP_CPPFLAGS@ $(PATHS) @DEFS@ - -LIBS=@LIBS@ - +LIBS=@LIBS@ -lpthread - K5LIBS=@K5LIBS@ ---- a/0004-support-dynamically-sized-receive-buffers.patch -+++ b/0004-support-dynamically-sized-receive-buffers.patch -@@ -2144,9 +2144,9 @@ - @@ -527,10 +555,10 @@ send_client_banner(int connection_out, int minor1) - /* Send our own protocol version identification. */ - if (compat20) { -- xasprintf(&client_version_string, "SSH-%d.%d-%.100s\r\n", --- PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION); --+ PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE); -+ xasprintf(&client_version_string, "SSH-%d.%d-%.100s PKIX[%s]\r\n", -+- PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION, SSH_X509); -++ PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE, SSH_X509); - } else { - xasprintf(&client_version_string, "SSH-%d.%d-%.100s\n", - - PROTOCOL_MAJOR_1, minor1, SSH_VERSION); -@@ -2163,9 +2163,9 @@ - @@ -432,7 +432,7 @@ - } - -- xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s", --- major, minor, SSH_VERSION, --+ major, minor, SSH_RELEASE, -+ xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s%s", -+- major, minor, SSH_VERSION, comment, -++ major, minor, SSH_RELEASE, comment, - *options.version_addendum == '\0' ? "" : " ", - options.version_addendum, newline); - diff --git a/net-misc/openssh/files/openssh-7.3_p1-hpn-cipher-ctr-mt-no-deadlocks.patch b/net-misc/openssh/files/openssh-7.3_p1-hpn-cipher-ctr-mt-no-deadlocks.patch deleted file mode 100644 index 9cc7b61..0000000 --- a/net-misc/openssh/files/openssh-7.3_p1-hpn-cipher-ctr-mt-no-deadlocks.patch +++ /dev/null @@ -1,245 +0,0 @@ -diff --git a/cipher-ctr-mt.c b/cipher-ctr-mt.c -index fdc9b2f..300cd90 100644 ---- a/cipher-ctr-mt.c -+++ b/cipher-ctr-mt.c -@@ -127,7 +127,7 @@ struct kq { - u_char keys[KQLEN][AES_BLOCK_SIZE]; - u_char ctr[AES_BLOCK_SIZE]; - u_char pad0[CACHELINE_LEN]; -- volatile int qstate; -+ int qstate; - pthread_mutex_t lock; - pthread_cond_t cond; - u_char pad1[CACHELINE_LEN]; -@@ -141,6 +141,11 @@ struct ssh_aes_ctr_ctx - STATS_STRUCT(stats); - u_char aes_counter[AES_BLOCK_SIZE]; - pthread_t tid[CIPHER_THREADS]; -+ pthread_rwlock_t tid_lock; -+#ifdef __APPLE__ -+ pthread_rwlock_t stop_lock; -+ int exit_flag; -+#endif /* __APPLE__ */ - int state; - int qidx; - int ridx; -@@ -187,6 +192,57 @@ thread_loop_cleanup(void *x) - pthread_mutex_unlock((pthread_mutex_t *)x); - } - -+#ifdef __APPLE__ -+/* Check if we should exit, we are doing both cancel and exit condition -+ * since on OSX threads seem to occasionally fail to notice when they have -+ * been cancelled. We want to have a backup to make sure that we won't hang -+ * when the main process join()-s the cancelled thread. -+ */ -+static void -+thread_loop_check_exit(struct ssh_aes_ctr_ctx *c) -+{ -+ int exit_flag; -+ -+ pthread_rwlock_rdlock(&c->stop_lock); -+ exit_flag = c->exit_flag; -+ pthread_rwlock_unlock(&c->stop_lock); -+ -+ if (exit_flag) -+ pthread_exit(NULL); -+} -+#else -+# define thread_loop_check_exit(s) -+#endif /* __APPLE__ */ -+ -+/* -+ * Helper function to terminate the helper threads -+ */ -+static void -+stop_and_join_pregen_threads(struct ssh_aes_ctr_ctx *c) -+{ -+ int i; -+ -+#ifdef __APPLE__ -+ /* notify threads that they should exit */ -+ pthread_rwlock_wrlock(&c->stop_lock); -+ c->exit_flag = TRUE; -+ pthread_rwlock_unlock(&c->stop_lock); -+#endif /* __APPLE__ */ -+ -+ /* Cancel pregen threads */ -+ for (i = 0; i < CIPHER_THREADS; i++) { -+ pthread_cancel(c->tid[i]); -+ } -+ for (i = 0; i < NUMKQ; i++) { -+ pthread_mutex_lock(&c->q[i].lock); -+ pthread_cond_broadcast(&c->q[i].cond); -+ pthread_mutex_unlock(&c->q[i].lock); -+ } -+ for (i = 0; i < CIPHER_THREADS; i++) { -+ pthread_join(c->tid[i], NULL); -+ } -+} -+ - /* - * The life of a pregen thread: - * Find empty keystream queues and fill them using their counter. -@@ -201,6 +257,7 @@ thread_loop(void *x) - struct kq *q; - int i; - int qidx; -+ pthread_t first_tid; - - /* Threads stats on cancellation */ - STATS_INIT(stats); -@@ -211,11 +268,15 @@ thread_loop(void *x) - /* Thread local copy of AES key */ - memcpy(&key, &c->aes_ctx, sizeof(key)); - -+ pthread_rwlock_rdlock(&c->tid_lock); -+ first_tid = c->tid[0]; -+ pthread_rwlock_unlock(&c->tid_lock); -+ - /* - * Handle the special case of startup, one thread must fill - * the first KQ then mark it as draining. Lock held throughout. - */ -- if (pthread_equal(pthread_self(), c->tid[0])) { -+ if (pthread_equal(pthread_self(), first_tid)) { - q = &c->q[0]; - pthread_mutex_lock(&q->lock); - if (q->qstate == KQINIT) { -@@ -245,12 +306,16 @@ thread_loop(void *x) - /* Check if I was cancelled, also checked in cond_wait */ - pthread_testcancel(); - -+ /* Check if we should exit as well */ -+ thread_loop_check_exit(c); -+ - /* Lock queue and block if its draining */ - q = &c->q[qidx]; - pthread_mutex_lock(&q->lock); - pthread_cleanup_push(thread_loop_cleanup, &q->lock); - while (q->qstate == KQDRAINING || q->qstate == KQINIT) { - STATS_WAIT(stats); -+ thread_loop_check_exit(c); - pthread_cond_wait(&q->cond, &q->lock); - } - pthread_cleanup_pop(0); -@@ -268,6 +333,7 @@ thread_loop(void *x) - * can see that it's being filled. - */ - q->qstate = KQFILLING; -+ pthread_cond_broadcast(&q->cond); - pthread_mutex_unlock(&q->lock); - for (i = 0; i < KQLEN; i++) { - AES_encrypt(q->ctr, q->keys[i], &key); -@@ -279,7 +345,7 @@ thread_loop(void *x) - ssh_ctr_add(q->ctr, KQLEN * (NUMKQ - 1), AES_BLOCK_SIZE); - q->qstate = KQFULL; - STATS_FILL(stats); -- pthread_cond_signal(&q->cond); -+ pthread_cond_broadcast(&q->cond); - pthread_mutex_unlock(&q->lock); - } - -@@ -371,6 +437,7 @@ ssh_aes_ctr(EVP_CIPHER_CTX *ctx, u_char *dest, const u_char *src, - pthread_cond_wait(&q->cond, &q->lock); - } - q->qstate = KQDRAINING; -+ pthread_cond_broadcast(&q->cond); - pthread_mutex_unlock(&q->lock); - - /* Mark consumed queue empty and signal producers */ -@@ -397,6 +464,11 @@ ssh_aes_ctr_init(EVP_CIPHER_CTX *ctx, const u_char *key, const u_char *iv, - - if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) == NULL) { - c = xmalloc(sizeof(*c)); -+ pthread_rwlock_init(&c->tid_lock, NULL); -+#ifdef __APPLE__ -+ pthread_rwlock_init(&c->stop_lock, NULL); -+ c->exit_flag = FALSE; -+#endif /* __APPLE__ */ - - c->state = HAVE_NONE; - for (i = 0; i < NUMKQ; i++) { -@@ -409,11 +481,14 @@ ssh_aes_ctr_init(EVP_CIPHER_CTX *ctx, const u_char *key, const u_char *iv, - } - - if (c->state == (HAVE_KEY | HAVE_IV)) { -- /* Cancel pregen threads */ -- for (i = 0; i < CIPHER_THREADS; i++) -- pthread_cancel(c->tid[i]); -- for (i = 0; i < CIPHER_THREADS; i++) -- pthread_join(c->tid[i], NULL); -+ /* tell the pregen threads to exit */ -+ stop_and_join_pregen_threads(c); -+ -+#ifdef __APPLE__ -+ /* reset the exit flag */ -+ c->exit_flag = FALSE; -+#endif /* __APPLE__ */ -+ - /* Start over getting key & iv */ - c->state = HAVE_NONE; - } -@@ -444,10 +519,12 @@ ssh_aes_ctr_init(EVP_CIPHER_CTX *ctx, const u_char *key, const u_char *iv, - /* Start threads */ - for (i = 0; i < CIPHER_THREADS; i++) { - debug("spawned a thread"); -+ pthread_rwlock_wrlock(&c->tid_lock); - pthread_create(&c->tid[i], NULL, thread_loop, c); -+ pthread_rwlock_unlock(&c->tid_lock); - } - pthread_mutex_lock(&c->q[0].lock); -- while (c->q[0].qstate != KQDRAINING) -+ while (c->q[0].qstate == KQINIT) - pthread_cond_wait(&c->q[0].cond, &c->q[0].lock); - pthread_mutex_unlock(&c->q[0].lock); - } -@@ -461,15 +538,10 @@ void - ssh_aes_ctr_thread_destroy(EVP_CIPHER_CTX *ctx) - { - struct ssh_aes_ctr_ctx *c; -- int i; -+ - c = EVP_CIPHER_CTX_get_app_data(ctx); -- /* destroy threads */ -- for (i = 0; i < CIPHER_THREADS; i++) { -- pthread_cancel(c->tid[i]); -- } -- for (i = 0; i < CIPHER_THREADS; i++) { -- pthread_join(c->tid[i], NULL); -- } -+ -+ stop_and_join_pregen_threads(c); - } - - void -@@ -481,7 +553,9 @@ ssh_aes_ctr_thread_reconstruction(EVP_CIPHER_CTX *ctx) - /* reconstruct threads */ - for (i = 0; i < CIPHER_THREADS; i++) { - debug("spawned a thread"); -+ pthread_rwlock_wrlock(&c->tid_lock); - pthread_create(&c->tid[i], NULL, thread_loop, c); -+ pthread_rwlock_unlock(&c->tid_lock); - } - } - -@@ -489,18 +563,13 @@ static int - ssh_aes_ctr_cleanup(EVP_CIPHER_CTX *ctx) - { - struct ssh_aes_ctr_ctx *c; -- int i; - - if ((c = EVP_CIPHER_CTX_get_app_data(ctx)) != NULL) { - #ifdef CIPHER_THREAD_STATS - debug("main thread: %u drains, %u waits", c->stats.drains, - c->stats.waits); - #endif -- /* Cancel pregen threads */ -- for (i = 0; i < CIPHER_THREADS; i++) -- pthread_cancel(c->tid[i]); -- for (i = 0; i < CIPHER_THREADS; i++) -- pthread_join(c->tid[i], NULL); -+ stop_and_join_pregen_threads(c); - - memset(c, 0, sizeof(*c)); - free(c); diff --git a/net-misc/openssh/files/openssh-7.3_p1-hpn-x509-9.2-glue.patch b/net-misc/openssh/files/openssh-7.3_p1-hpn-x509-9.2-glue.patch deleted file mode 100644 index f077c05..0000000 --- a/net-misc/openssh/files/openssh-7.3_p1-hpn-x509-9.2-glue.patch +++ /dev/null @@ -1,41 +0,0 @@ ---- a/openssh-7.3_p1-hpn-14.10-r1.patch 2016-09-19 15:00:21.561121417 -0700 -+++ b/openssh-7.3_p1-hpn-14.10-r1.patch 2016-09-19 15:22:51.337118439 -0700 -@@ -1155,7 +1155,7 @@ - @@ -44,7 +44,7 @@ - LD=@LD@ - CFLAGS=@CFLAGS@ -- CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ $(PATHS) @DEFS@ -+ CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ @LDAP_CPPFLAGS@ $(PATHS) @DEFS@ - -LIBS=@LIBS@ - +LIBS=@LIBS@ -lpthread - K5LIBS=@K5LIBS@ -@@ -2144,12 +2144,12 @@ - /* Bind the socket to an alternative local IP address */ - if (options.bind_address == NULL && !privileged) - return sock; --@@ -527,10 +555,10 @@ -+@@ -555,10 +583,10 @@ - /* Send our own protocol version identification. */ - if (compat20) { -- xasprintf(&client_version_string, "SSH-%d.%d-%.100s\r\n", --- PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION); --+ PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE); -+ xasprintf(&client_version_string, "SSH-%d.%d-%.100s PKIX[%s]\r\n", -+- PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION, SSH_X509); -++ PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE, SSH_X509); - } else { - xasprintf(&client_version_string, "SSH-%d.%d-%.100s\n", - - PROTOCOL_MAJOR_1, minor1, SSH_VERSION); -@@ -2163,9 +2163,9 @@ - @@ -432,7 +432,7 @@ - } - -- xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s", --- major, minor, SSH_VERSION, --+ major, minor, SSH_RELEASE, -+ xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s%s", -+- major, minor, SSH_VERSION, comment, -++ major, minor, SSH_RELEASE, comment, - *options.version_addendum == '\0' ? "" : " ", - options.version_addendum, newline); - diff --git a/net-misc/openssh/files/openssh-7.3_p1-sctp-x509-glue.patch b/net-misc/openssh/files/openssh-7.3_p1-sctp-x509-glue.patch deleted file mode 100644 index 2def699..0000000 --- a/net-misc/openssh/files/openssh-7.3_p1-sctp-x509-glue.patch +++ /dev/null @@ -1,67 +0,0 @@ ---- a/openssh-7.3_p1-sctp.patch 2016-08-03 13:10:15.733228732 -0700 -+++ b/openssh-7.3_p1-sctp.patch 2016-08-03 13:25:53.274630002 -0700 -@@ -226,14 +226,6 @@ - .Op Fl c Ar cipher - .Op Fl F Ar ssh_config - .Op Fl i Ar identity_file --@@ -183,6 +183,7 @@ For full details of the options listed below, and their possible values, see -- .It ServerAliveCountMax -- .It StrictHostKeyChecking -- .It TCPKeepAlive --+.It Transport -- .It UpdateHostKeys -- .It UsePrivilegedPort -- .It User - @@ -224,6 +225,8 @@ and - to print debugging messages about their progress. - This is helpful in -@@ -493,19 +485,11 @@ - .Sh SYNOPSIS - .Nm ssh - .Bk -words ---.Op Fl 1246AaCfGgKkMNnqsTtVvXxYy --+.Op Fl 1246AaCfGgKkMNnqsTtVvXxYyz -+-.Op Fl 1246AaCdfgKkMNnqsTtVvXxYy -++.Op Fl 1246AaCdfgKkMNnqsTtVvXxYyz - .Op Fl b Ar bind_address - .Op Fl c Ar cipher_spec - .Op Fl D Oo Ar bind_address : Oc Ns Ar port --@@ -558,6 +558,7 @@ For full details of the options listed below, and their possible values, see -- .It StreamLocalBindUnlink -- .It StrictHostKeyChecking -- .It TCPKeepAlive --+.It Transport -- .It Tunnel -- .It TunnelDevice -- .It UpdateHostKeys - @@ -795,6 +796,8 @@ controls. - .Pp - .It Fl y -@@ -533,18 +517,18 @@ - usage(void) - { - fprintf(stderr, ---"usage: ssh [-1246AaCfGgKkMNnqsTtVvXxYy] [-b bind_address] [-c cipher_spec]\n" --+"usage: ssh [-1246AaCfGgKkMNnqsTtVvXxYy" SCTP_OPT "] [-b bind_address] [-c cipher_spec]\n" -+-"usage: ssh [-1246AaCdfgKkMNnqsTtVvXxYy] [-b bind_address] [-c cipher_spec]\n" -++"usage: ssh [-1246AaCdfgKkMNnqsTtVvXxYy" SCTP_OPT "] [-b bind_address] [-c cipher_spec]\n" - " [-D [bind_address:]port] [-E log_file] [-e escape_char]\n" -- " [-F configfile] [-I pkcs11] [-i identity_file]\n" -- " [-J [user@]host[:port]] [-L address] [-l login_name] [-m mac_spec]\n" -+ " [-F configfile]\n" -+ #ifdef USE_OPENSSL_ENGINE - @@ -608,7 +613,7 @@ main(int ac, char **av) -- argv0 = av[0]; -+ # define ENGCONFIG "" -+ #endif - -- again: --- while ((opt = getopt(ac, av, "1246ab:c:e:fgi:kl:m:no:p:qstvx" --+ while ((opt = getopt(ac, av, "1246ab:c:e:fgi:kl:m:no:p:qstvx" SCTP_OPT -- "ACD:E:F:GI:J:KL:MNO:PQ:R:S:TVw:W:XYy")) != -1) { -+- while ((opt = getopt(ac, av, "1246ab:c:de:fgi:kl:m:no:p:qstvx" -++ while ((opt = getopt(ac, av, "1246ab:c:de:fgi:kl:m:no:p:qstvx" SCTP_OPT -+ "ACD:E:F:" ENGCONFIG "I:J:KL:MNO:PQ:R:S:TVw:W:XYy")) != -1) { - switch (opt) { - case '1': - @@ -857,6 +862,11 @@ main(int ac, char **av) diff --git a/net-misc/openssh/files/openssh-7.3_p1-x509-9.2-warnings.patch b/net-misc/openssh/files/openssh-7.3_p1-x509-9.2-warnings.patch deleted file mode 100644 index 528dc6f..0000000 --- a/net-misc/openssh/files/openssh-7.3_p1-x509-9.2-warnings.patch +++ /dev/null @@ -1,109 +0,0 @@ -diff --git a/kex.c b/kex.c -index 143227a..c9b84c2 100644 ---- a/kex.c -+++ b/kex.c -@@ -345,9 +345,9 @@ kex_reset_dispatch(struct ssh *ssh) - static int - kex_send_ext_info(struct ssh *ssh) - { -+#ifdef EXPERIMENTAL_RSA_SHA2_256 - int r; - --#ifdef EXPERIMENTAL_RSA_SHA2_256 - /* IMPORTANT NOTE: - * Do not offer rsa-sha2-* until is resolved misconfiguration issue - * with allowed public key algorithms! -diff --git a/key-eng.c b/key-eng.c -index 9bc50fd..bc0d03d 100644 ---- a/key-eng.c -+++ b/key-eng.c -@@ -786,7 +786,6 @@ ssh_engines_shutdown() { - while (buffer_len(&eng_list) > 0) { - u_int k = 0; - char *s; -- ENGINE *e; - - s = buffer_get_cstring_ret(&eng_list, &k); - ssh_engine_reset(s); -diff --git a/monitor.c b/monitor.c -index 345d3df..0de30ad 100644 ---- a/monitor.c -+++ b/monitor.c -@@ -707,7 +707,7 @@ mm_answer_sign(int sock, Buffer *m) - (r = sshbuf_get_string(m, &p, &datlen)) != 0 || - (r = sshbuf_get_cstring(m, &alg, &alglen)) != 0) - fatal("%s: buffer error: %s", __func__, ssh_err(r)); -- if (keyid > INT_MAX) -+ if (keyid32 > INT_MAX) - fatal("%s: invalid key ID", __func__); - - keyid = keyid32; /*save cast*/ -diff --git a/readconf.c b/readconf.c -index beb38a0..1cbda7e 100644 ---- a/readconf.c -+++ b/readconf.c -@@ -1459,7 +1459,9 @@ parse_int: - - case oHostKeyAlgorithms: - charptr = &options->hostkeyalgorithms; -+# if 0 - parse_keytypes: -+# endif - arg = strdelim(&s); - if (!arg || *arg == '\0') - fatal("%.200s line %d: Missing argument.", -diff --git a/servconf.c b/servconf.c -index a540138..e77a344 100644 ---- a/servconf.c -+++ b/servconf.c -@@ -1574,7 +1573,9 @@ parse_string: - - case sHostKeyAlgorithms: - charptr = &options->hostkeyalgorithms; -+# if 0 - parse_keytypes: -+#endif - arg = strdelim(&cp); - if (!arg || *arg == '\0') - fatal("%s line %d: Missing argument.", -diff --git a/ssh-pkcs11.c b/ssh-pkcs11.c -index 50f04b7..3f9a7bf 100644 ---- a/ssh-pkcs11.c -+++ b/ssh-pkcs11.c -@@ -273,21 +273,18 @@ pkcs11_dsa_finish(DSA *dsa) - } - - #ifdef OPENSSL_HAS_ECC -+#ifdef HAVE_EC_KEY_METHOD_NEW - /* openssl callback for freeing an EC key */ - static void - pkcs11_ec_finish(EC_KEY *ec) - { - struct pkcs11_key *k11; - --#ifdef HAVE_EC_KEY_METHOD_NEW - k11 = EC_KEY_get_ex_data(ec, ssh_pkcs11_ec_ctx_index); - EC_KEY_set_ex_data(ec, ssh_pkcs11_ec_ctx_index, NULL); --#else -- k11 = ECDSA_get_ex_data(ec, ssh_pkcs11_ec_ctx_index); -- ECDSA_set_ex_data(ec, ssh_pkcs11_ec_ctx_index, NULL); --#endif - pkcs11_key_free(k11); - } -+#endif /*def HAVE_EC_KEY_METHOD_NEW*/ - #endif /*def OPENSSL_HAS_ECC*/ - - -diff --git a/sshconnect.c b/sshconnect.c -index fd2a70e..0960be1 100644 ---- a/sshconnect.c -+++ b/sshconnect.c -@@ -605,7 +605,7 @@ send_client_banner(int connection_out, int minor1) - { - /* Send our own protocol version identification. */ - if (compat20) { -- xasprintf(&client_version_string, "SSH-%d.%d-%.100s PKIX[%d]\r\n", -+ xasprintf(&client_version_string, "SSH-%d.%d-%.100s PKIX[%s]\r\n", - PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION, SSH_X509); - } else { - xasprintf(&client_version_string, "SSH-%d.%d-%.100s\n", diff --git a/net-misc/openssh/files/openssh-7.5_p1-CVE-2017-15906.patch b/net-misc/openssh/files/openssh-7.5_p1-CVE-2017-15906.patch deleted file mode 100644 index b97ceb4..0000000 --- a/net-misc/openssh/files/openssh-7.5_p1-CVE-2017-15906.patch +++ /dev/null @@ -1,31 +0,0 @@ -From a6981567e8e215acc1ef690c8dbb30f2d9b00a19 Mon Sep 17 00:00:00 2001 -From: djm <[email protected]> -Date: Tue, 4 Apr 2017 00:24:56 +0000 -Subject: [PATCH] disallow creation (of empty files) in read-only mode; - reported by Michal Zalewski, feedback & ok deraadt@ - ---- - usr.bin/ssh/sftp-server.c | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/usr.bin/ssh/sftp-server.c b/usr.bin/ssh/sftp-server.c -index 2510d234a3a..42249ebd60d 100644 ---- a/usr.bin/ssh/sftp-server.c -+++ b/usr.bin/ssh/sftp-server.c -@@ -1,4 +1,4 @@ --/* $OpenBSD: sftp-server.c,v 1.110 2016/09/12 01:22:38 deraadt Exp $ */ -+/* $OpenBSD: sftp-server.c,v 1.111 2017/04/04 00:24:56 djm Exp $ */ - /* - * Copyright (c) 2000-2004 Markus Friedl. All rights reserved. - * -@@ -683,8 +683,8 @@ process_open(u_int32_t id) - logit("open \"%s\" flags %s mode 0%o", - name, string_from_portable(pflags), mode); - if (readonly && -- ((flags & O_ACCMODE) == O_WRONLY || -- (flags & O_ACCMODE) == O_RDWR)) { -+ ((flags & O_ACCMODE) != O_RDONLY || -+ (flags & (O_CREAT|O_TRUNC)) != 0)) { - verbose("Refusing open request in read-only mode"); - status = SSH2_FX_PERMISSION_DENIED; - } else { diff --git a/net-misc/openssh/files/openssh-7.5_p1-cross-cache.patch b/net-misc/openssh/files/openssh-7.5_p1-cross-cache.patch deleted file mode 100644 index 1c2b7b8..0000000 --- a/net-misc/openssh/files/openssh-7.5_p1-cross-cache.patch +++ /dev/null @@ -1,39 +0,0 @@ -From d588d6f83e9a3d48286929b4a705b43e74414241 Mon Sep 17 00:00:00 2001 -From: Mike Frysinger <[email protected]> -Date: Wed, 24 May 2017 23:18:41 -0400 -Subject: [PATCH] configure: actually set cache vars when cross-compiling - -The cross-compiling fallback message says it's assuming the test -passed, but it didn't actually set the cache var which causes -later tests to fail. ---- - configure.ac | 6 ++++-- - 1 file changed, 4 insertions(+), 2 deletions(-) - -diff --git a/configure.ac b/configure.ac -index 5cfea38c0a6c..895c5211ea93 100644 ---- a/configure.ac -+++ b/configure.ac -@@ -3162,7 +3162,8 @@ AC_RUN_IFELSE( - select_works_with_rlimit=yes], - [AC_MSG_RESULT([no]) - select_works_with_rlimit=no], -- [AC_MSG_WARN([cross compiling: assuming yes])] -+ [AC_MSG_WARN([cross compiling: assuming yes]) -+ select_works_with_rlimit=yes] - ) - - AC_MSG_CHECKING([if setrlimit(RLIMIT_NOFILE,{0,0}) works]) -@@ -3188,7 +3189,8 @@ AC_RUN_IFELSE( - rlimit_nofile_zero_works=yes], - [AC_MSG_RESULT([no]) - rlimit_nofile_zero_works=no], -- [AC_MSG_WARN([cross compiling: assuming yes])] -+ [AC_MSG_WARN([cross compiling: assuming yes]) -+ rlimit_nofile_zero_works=yes] - ) - - AC_MSG_CHECKING([if setrlimit RLIMIT_FSIZE works]) --- -2.12.0 - diff --git a/net-misc/openssh/files/openssh-7.5_p1-disable-conch-interop-tests.patch b/net-misc/openssh/files/openssh-7.5_p1-disable-conch-interop-tests.patch new file mode 100644 index 0000000..a5647ce --- /dev/null +++ b/net-misc/openssh/files/openssh-7.5_p1-disable-conch-interop-tests.patch @@ -0,0 +1,20 @@ +Disable conch interop tests which are failing when called +via portage for yet unknown reason and because using conch +seems to be flaky (test is failing when using Python2 but +passing when using Python3). + +Bug: https://bugs.gentoo.org/605446 + +--- a/regress/conch-ciphers.sh ++++ b/regress/conch-ciphers.sh +@@ -3,6 +3,10 @@ + + tid="conch ciphers" + ++# https://bugs.gentoo.org/605446 ++echo "conch interop tests skipped due to Gentoo bug #605446" ++exit 0 ++ + if test "x$REGRESS_INTEROP_CONCH" != "xyes" ; then + echo "conch interop tests not enabled" + exit 0 diff --git a/net-misc/openssh/files/openssh-7.5_p1-x32-typo.patch b/net-misc/openssh/files/openssh-7.5_p1-x32-typo.patch deleted file mode 100644 index 5dca1b0..0000000 --- a/net-misc/openssh/files/openssh-7.5_p1-x32-typo.patch +++ /dev/null @@ -1,25 +0,0 @@ -From 596c432181e1c4a9da354388394f640afd29f44b Mon Sep 17 00:00:00 2001 -From: Mike Frysinger <[email protected]> -Date: Mon, 20 Mar 2017 14:57:40 -0400 -Subject: [PATCH] seccomp sandbox: fix typo w/x32 check - ---- - sandbox-seccomp-filter.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c -index 3a1aedce72c2..a8d472a63ccb 100644 ---- a/sandbox-seccomp-filter.c -+++ b/sandbox-seccomp-filter.c -@@ -235,7 +235,7 @@ static const struct sock_filter preauth_insns[] = { - * x86-64 syscall under some circumstances, e.g. - * https://bugs.debian.org/849923 - */ -- SC_ALLOW(__NR_clock_gettime & ~__X32_SYSCALL_BIT); -+ SC_ALLOW(__NR_clock_gettime & ~__X32_SYSCALL_BIT), - #endif - - /* Default deny */ --- -2.12.0 - diff --git a/net-misc/openssh/files/openssh-7.5_p1-GSSAPI-dns.patch b/net-misc/openssh/files/openssh-7.7_p1-GSSAPI-dns.patch similarity index 94% rename from net-misc/openssh/files/openssh-7.5_p1-GSSAPI-dns.patch rename to net-misc/openssh/files/openssh-7.7_p1-GSSAPI-dns.patch index 6b1e6dd..2840652 100644 --- a/net-misc/openssh/files/openssh-7.5_p1-GSSAPI-dns.patch +++ b/net-misc/openssh/files/openssh-7.7_p1-GSSAPI-dns.patch @@ -1,121 +1,12 @@ -http://bugs.gentoo.org/165444 +https://bugs.gentoo.org/165444 https://bugzilla.mindrot.org/show_bug.cgi?id=1008 ---- a/readconf.c -+++ b/readconf.c -@@ -148,6 +148,7 @@ - oClearAllForwardings, oNoHostAuthenticationForLocalhost, - oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout, - oAddressFamily, oGssAuthentication, oGssDelegateCreds, -+ oGssTrustDns, - oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly, - oSendEnv, oControlPath, oControlMaster, oControlPersist, - oHashKnownHosts, -@@ -194,9 +195,11 @@ - #if defined(GSSAPI) - { "gssapiauthentication", oGssAuthentication }, - { "gssapidelegatecredentials", oGssDelegateCreds }, -+ { "gssapitrustdns", oGssTrustDns }, - # else - { "gssapiauthentication", oUnsupported }, - { "gssapidelegatecredentials", oUnsupported }, -+ { "gssapitrustdns", oUnsupported }, - #endif - #ifdef ENABLE_PKCS11 - { "smartcarddevice", oPKCS11Provider }, -@@ -930,6 +933,10 @@ - intptr = &options->gss_deleg_creds; - goto parse_flag; - -+ case oGssTrustDns: -+ intptr = &options->gss_trust_dns; -+ goto parse_flag; -+ - case oBatchMode: - intptr = &options->batch_mode; - goto parse_flag; -@@ -1649,6 +1656,7 @@ - options->challenge_response_authentication = -1; - options->gss_authentication = -1; - options->gss_deleg_creds = -1; -+ options->gss_trust_dns = -1; - options->password_authentication = -1; - options->kbd_interactive_authentication = -1; - options->kbd_interactive_devices = NULL; -@@ -1779,6 +1787,8 @@ - options->gss_authentication = 0; - if (options->gss_deleg_creds == -1) - options->gss_deleg_creds = 0; -+ if (options->gss_trust_dns == -1) -+ options->gss_trust_dns = 0; - if (options->password_authentication == -1) - options->password_authentication = 1; - if (options->kbd_interactive_authentication == -1) ---- a/readconf.h -+++ b/readconf.h -@@ -46,6 +46,7 @@ - /* Try S/Key or TIS, authentication. */ - int gss_authentication; /* Try GSS authentication */ - int gss_deleg_creds; /* Delegate GSS credentials */ -+ int gss_trust_dns; /* Trust DNS for GSS canonicalization */ - int password_authentication; /* Try password - * authentication. */ - int kbd_interactive_authentication; /* Try keyboard-interactive auth. */ ---- a/ssh_config.5 -+++ b/ssh_config.5 -@@ -830,6 +830,16 @@ - Forward (delegate) credentials to the server. - The default is - .Cm no . -+Note that this option applies to protocol version 2 connections using GSSAPI. -+.It Cm GSSAPITrustDns -+Set to -+.Dq yes to indicate that the DNS is trusted to securely canonicalize -+the name of the host being connected to. If -+.Dq no, the hostname entered on the -+command line will be passed untouched to the GSSAPI library. -+The default is -+.Dq no . -+This option only applies to protocol version 2 connections using GSSAPI. - .It Cm HashKnownHosts - Indicates that - .Xr ssh 1 ---- a/sshconnect2.c -+++ b/sshconnect2.c -@@ -656,6 +656,13 @@ - static u_int mech = 0; - OM_uint32 min; - int ok = 0; -+ const char *gss_host; -+ -+ if (options.gss_trust_dns) { -+ extern const char *auth_get_canonical_hostname(struct ssh *ssh, int use_dns); -+ gss_host = auth_get_canonical_hostname(active_state, 1); -+ } else -+ gss_host = authctxt->host; - - /* Try one GSSAPI method at a time, rather than sending them all at - * once. */ -@@ -668,7 +674,7 @@ - /* My DER encoding requires length<128 */ - if (gss_supported->elements[mech].length < 128 && - ssh_gssapi_check_mechanism(&gssctxt, -- &gss_supported->elements[mech], authctxt->host)) { -+ &gss_supported->elements[mech], gss_host)) { - ok = 1; /* Mechanism works */ - } else { - mech++; - -need to move these two funcs back to canohost so they're available to clients -and the server. auth.c is only used in the server. - --- a/auth.c +++ b/auth.c -@@ -784,117 +784,3 @@ fakepw(void) - +@@ -728,120 +728,6 @@ fakepw(void) return (&fake); } -- + -/* - * Returns the remote DNS hostname as a string. The returned string must not - * be freed. NB. this will usually trigger a DNS query the first time it is @@ -229,6 +120,10 @@ and the server. auth.c is only used in the server. - return dnsname; - } -} +- + /* + * Runs command in a subprocess wuth a minimal environment. + * Returns pid on success, 0 on failure. --- a/canohost.c +++ b/canohost.c @@ -202,3 +202,117 @@ get_local_port(int sock) @@ -349,3 +244,108 @@ and the server. auth.c is only used in the server. + return dnsname; + } +} +--- a/readconf.c ++++ b/readconf.c +@@ -160,6 +160,7 @@ typedef enum { + oClearAllForwardings, oNoHostAuthenticationForLocalhost, + oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout, + oAddressFamily, oGssAuthentication, oGssDelegateCreds, ++ oGssTrustDns, + oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly, + oSendEnv, oControlPath, oControlMaster, oControlPersist, + oHashKnownHosts, +@@ -200,9 +201,11 @@ static struct { + #if defined(GSSAPI) + { "gssapiauthentication", oGssAuthentication }, + { "gssapidelegatecredentials", oGssDelegateCreds }, ++ { "gssapitrustdns", oGssTrustDns }, + # else + { "gssapiauthentication", oUnsupported }, + { "gssapidelegatecredentials", oUnsupported }, ++ { "gssapitrustdns", oUnsupported }, + #endif + #ifdef ENABLE_PKCS11 + { "smartcarddevice", oPKCS11Provider }, +@@ -954,6 +957,10 @@ parse_time: + intptr = &options->gss_deleg_creds; + goto parse_flag; + ++ case oGssTrustDns: ++ intptr = &options->gss_trust_dns; ++ goto parse_flag; ++ + case oBatchMode: + intptr = &options->batch_mode; + goto parse_flag; +@@ -1766,6 +1773,7 @@ initialize_options(Options * options) + options->challenge_response_authentication = -1; + options->gss_authentication = -1; + options->gss_deleg_creds = -1; ++ options->gss_trust_dns = -1; + options->password_authentication = -1; + options->kbd_interactive_authentication = -1; + options->kbd_interactive_devices = NULL; +@@ -1908,6 +1916,8 @@ fill_default_options(Options * options) + options->gss_authentication = 0; + if (options->gss_deleg_creds == -1) + options->gss_deleg_creds = 0; ++ if (options->gss_trust_dns == -1) ++ options->gss_trust_dns = 0; + if (options->password_authentication == -1) + options->password_authentication = 1; + if (options->kbd_interactive_authentication == -1) +--- a/readconf.h ++++ b/readconf.h +@@ -43,6 +43,7 @@ typedef struct { + /* Try S/Key or TIS, authentication. */ + int gss_authentication; /* Try GSS authentication */ + int gss_deleg_creds; /* Delegate GSS credentials */ ++ int gss_trust_dns; /* Trust DNS for GSS canonicalization */ + int password_authentication; /* Try password + * authentication. */ + int kbd_interactive_authentication; /* Try keyboard-interactive auth. */ +--- a/ssh_config.5 ++++ b/ssh_config.5 +@@ -731,6 +731,16 @@ The default is + Forward (delegate) credentials to the server. + The default is + .Cm no . ++Note that this option applies to protocol version 2 connections using GSSAPI. ++.It Cm GSSAPITrustDns ++Set to ++.Dq yes to indicate that the DNS is trusted to securely canonicalize ++the name of the host being connected to. If ++.Dq no, the hostname entered on the ++command line will be passed untouched to the GSSAPI library. ++The default is ++.Dq no . ++This option only applies to protocol version 2 connections using GSSAPI. + .It Cm HashKnownHosts + Indicates that + .Xr ssh 1 +--- a/sshconnect2.c ++++ b/sshconnect2.c +@@ -643,6 +643,13 @@ userauth_gssapi(Authctxt *authctxt) + static u_int mech = 0; + OM_uint32 min; + int ok = 0; ++ const char *gss_host; ++ ++ if (options.gss_trust_dns) { ++ extern const char *auth_get_canonical_hostname(struct ssh *ssh, int use_dns); ++ gss_host = auth_get_canonical_hostname(active_state, 1); ++ } else ++ gss_host = authctxt->host; + + /* Try one GSSAPI method at a time, rather than sending them all at + * once. */ +@@ -655,7 +662,7 @@ userauth_gssapi(Authctxt *authctxt) + /* My DER encoding requires length<128 */ + if (gss_supported->elements[mech].length < 128 && + ssh_gssapi_check_mechanism(&gssctxt, +- &gss_supported->elements[mech], authctxt->host)) { ++ &gss_supported->elements[mech], gss_host)) { + ok = 1; /* Mechanism works */ + } else { + mech++; +-- diff --git a/net-misc/openssh/files/sshd-r1.confd b/net-misc/openssh/files/sshd-r1.confd new file mode 100644 index 0000000..cf43037 --- /dev/null +++ b/net-misc/openssh/files/sshd-r1.confd @@ -0,0 +1,33 @@ +# /etc/conf.d/sshd: config file for /etc/init.d/sshd + +# Where is your sshd_config file stored? + +SSHD_CONFDIR="${RC_PREFIX%/}/etc/ssh" + + +# Any random options you want to pass to sshd. +# See the sshd(8) manpage for more info. + +SSHD_OPTS="" + + +# Wait one second (length chosen arbitrarily) to see if sshd actually +# creates a PID file, or if it crashes for some reason like not being +# able to bind to the address in ListenAddress. + +#SSHD_SSD_OPTS="--wait 1000" + + +# Pid file to use (needs to be absolute path). + +#SSHD_PIDFILE="${RC_PREFIX%/}/run/sshd.pid" + + +# Path to the sshd binary (needs to be absolute path). + +#SSHD_BINARY="${RC_PREFIX%/}/usr/sbin/sshd" + + +# Path to the ssh-keygen binary (needs to be absolute path). + +#SSHD_KEYGEN_BINARY="${RC_PREFIX%/}/usr/bin/ssh-keygen" diff --git a/net-misc/openssh/files/sshd.confd b/net-misc/openssh/files/sshd.confd deleted file mode 100644 index 28952b4..0000000 --- a/net-misc/openssh/files/sshd.confd +++ /dev/null @@ -1,21 +0,0 @@ -# /etc/conf.d/sshd: config file for /etc/init.d/sshd - -# Where is your sshd_config file stored? - -SSHD_CONFDIR="/etc/ssh" - - -# Any random options you want to pass to sshd. -# See the sshd(8) manpage for more info. - -SSHD_OPTS="" - - -# Pid file to use (needs to be absolute path). - -#SSHD_PIDFILE="/var/run/sshd.pid" - - -# Path to the sshd binary (needs to be absolute path). - -#SSHD_BINARY="/usr/sbin/sshd" diff --git a/net-misc/openssh/files/sshd.rc6.4 b/net-misc/openssh/files/sshd.rc6.4 deleted file mode 100644 index 5e30142..0000000 --- a/net-misc/openssh/files/sshd.rc6.4 +++ /dev/null @@ -1,84 +0,0 @@ -#!/sbin/openrc-run -# Copyright 1999-2015 Gentoo Foundation -# Distributed under the terms of the GNU General Public License v2 - -extra_commands="checkconfig" -extra_started_commands="reload" - -: ${SSHD_CONFDIR:=/etc/ssh} -: ${SSHD_CONFIG:=${SSHD_CONFDIR}/sshd_config} -: ${SSHD_PIDFILE:=/var/run/${SVCNAME}.pid} -: ${SSHD_BINARY:=/usr/sbin/sshd} - -depend() { - use logger dns - if [ "${rc_need+set}" = "set" ] ; then - : # Do nothing, the user has explicitly set rc_need - else - local x warn_addr - for x in $(awk '/^ListenAddress/{ print $2 }' "$SSHD_CONFIG" 2>/dev/null) ; do - case "${x}" in - 0.0.0.0|0.0.0.0:*) ;; - ::|\[::\]*) ;; - *) warn_addr="${warn_addr} ${x}" ;; - esac - done - if [ -n "${warn_addr}" ] ; then - need net - ewarn "You are binding an interface in ListenAddress statement in your sshd_config!" - ewarn "You must add rc_need=\"net.FOO\" to your /etc/conf.d/sshd" - ewarn "where FOO is the interface(s) providing the following address(es):" - ewarn "${warn_addr}" - fi - fi -} - -checkconfig() { - if [ ! -d /var/empty ] ; then - mkdir -p /var/empty || return 1 - fi - - if [ ! -e "${SSHD_CONFIG}" ] ; then - eerror "You need an ${SSHD_CONFIG} file to run sshd" - eerror "There is a sample file in /usr/share/doc/openssh" - return 1 - fi - - ssh-keygen -A || return 1 - - [ "${SSHD_PIDFILE}" != "/var/run/sshd.pid" ] \ - && SSHD_OPTS="${SSHD_OPTS} -o PidFile=${SSHD_PIDFILE}" - [ "${SSHD_CONFIG}" != "/etc/ssh/sshd_config" ] \ - && SSHD_OPTS="${SSHD_OPTS} -f ${SSHD_CONFIG}" - - "${SSHD_BINARY}" -t ${SSHD_OPTS} || return 1 -} - -start() { - checkconfig || return 1 - - ebegin "Starting ${SVCNAME}" - start-stop-daemon --start --exec "${SSHD_BINARY}" \ - --pidfile "${SSHD_PIDFILE}" \ - -- ${SSHD_OPTS} - eend $? -} - -stop() { - if [ "${RC_CMD}" = "restart" ] ; then - checkconfig || return 1 - fi - - ebegin "Stopping ${SVCNAME}" - start-stop-daemon --stop --exec "${SSHD_BINARY}" \ - --pidfile "${SSHD_PIDFILE}" --quiet - eend $? -} - -reload() { - checkconfig || return 1 - ebegin "Reloading ${SVCNAME}" - start-stop-daemon --signal HUP \ - --exec "${SSHD_BINARY}" --pidfile "${SSHD_PIDFILE}" - eend $? -} diff --git a/net-misc/openssh/files/sshd.rc6.5 b/net-misc/openssh/files/sshd.rc6.5 new file mode 100644 index 0000000..044cbe7 --- /dev/null +++ b/net-misc/openssh/files/sshd.rc6.5 @@ -0,0 +1,89 @@ +#!/sbin/openrc-run +# Copyright 1999-2018 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 + +extra_commands="checkconfig" +extra_started_commands="reload" + +: ${SSHD_CONFDIR:=${RC_PREFIX%/}/etc/ssh} +: ${SSHD_CONFIG:=${SSHD_CONFDIR}/sshd_config} +: ${SSHD_PIDFILE:=${RC_PREFIX%/}/run/${SVCNAME}.pid} +: ${SSHD_BINARY:=${RC_PREFIX%/}/usr/sbin/sshd} +: ${SSHD_KEYGEN_BINARY:=${RC_PREFIX%/}/usr/bin/ssh-keygen} + +command="${SSHD_BINARY}" +pidfile="${SSHD_PIDFILE}" +command_args="${SSHD_OPTS} -o PidFile=${pidfile} -f ${SSHD_CONFIG}" + +# Wait one second (length chosen arbitrarily) to see if sshd actually +# creates a PID file, or if it crashes for some reason like not being +# able to bind to the address in ListenAddress (bug 617596). +: ${SSHD_SSD_OPTS:=--wait 1000} +start_stop_daemon_args="${SSHD_SSD_OPTS}" + +depend() { + # Entropy can be used by ssh-keygen, among other things, but + # is not strictly required (bug 470020). + use logger dns entropy + if [ "${rc_need+set}" = "set" ] ; then + : # Do nothing, the user has explicitly set rc_need + else + local x warn_addr + for x in $(awk '/^ListenAddress/{ print $2 }' "$SSHD_CONFIG" 2>/dev/null) ; do + case "${x}" in + 0.0.0.0|0.0.0.0:*) ;; + ::|\[::\]*) ;; + *) warn_addr="${warn_addr} ${x}" ;; + esac + done + if [ -n "${warn_addr}" ] ; then + need net + ewarn "You are binding an interface in ListenAddress statement in your sshd_config!" + ewarn "You must add rc_need=\"net.FOO\" to your ${RC_PREFIX%/}/etc/conf.d/sshd" + ewarn "where FOO is the interface(s) providing the following address(es):" + ewarn "${warn_addr}" + fi + fi +} + +checkconfig() { + checkpath --directory "${RC_PREFIX%/}/var/empty" + + if [ ! -e "${SSHD_CONFIG}" ] ; then + eerror "You need an ${SSHD_CONFIG} file to run sshd" + eerror "There is a sample file in /usr/share/doc/openssh" + return 1 + fi + + ${SSHD_KEYGEN_BINARY} -A || return 2 + + "${command}" -t ${command_args} || return 3 +} + +start_pre() { + # If this isn't a restart, make sure that the user's config isn't + # busted before we try to start the daemon (this will produce + # better error messages than if we just try to start it blindly). + # + # If, on the other hand, this *is* a restart, then the stop_pre + # action will have ensured that the config is usable and we don't + # need to do that again. + if [ "${RC_CMD}" != "restart" ] ; then + checkconfig || return $? + fi +} + +stop_pre() { + # If this is a restart, check to make sure the user's config + # isn't busted before we stop the running daemon. + if [ "${RC_CMD}" = "restart" ] ; then + checkconfig || return $? + fi +} + +reload() { + checkconfig || return $? + ebegin "Reloading ${SVCNAME}" + start-stop-daemon --signal HUP --pidfile "${pidfile}" + eend $? +} diff --git a/net-misc/openssh/openssh-7.5_p1-r4.ebuild b/net-misc/openssh/openssh-7.7_p1-r4.ebuild similarity index 50% rename from net-misc/openssh/openssh-7.5_p1-r4.ebuild rename to net-misc/openssh/openssh-7.7_p1-r4.ebuild index 291e377..e91ac97 100644 --- a/net-misc/openssh/openssh-7.5_p1-r4.ebuild +++ b/net-misc/openssh/openssh-7.7_p1-r4.ebuild @@ -1,36 +1,41 @@ # Copyright 1999-2018 Gentoo Foundation # Distributed under the terms of the GNU General Public License v2 -EAPI="5" +EAPI=6 -inherit eutils user flag-o-matic multilib autotools pam systemd versionator +inherit user flag-o-matic multilib autotools pam systemd versionator # Make it more portable between straight releases # and _p? releases. PARCH=${P/_} -HPN_PATCH="${PARCH}-hpnssh14v12.tar.xz" -SCTP_PATCH="${PN}-7.4_p1-sctp.patch.xz" -LDAP_PATCH="${PN}-lpk-7.5p1-0.3.14.patch.xz" -X509_VER="10.2" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz" +HPN_VER="14v15-gentoo1" HPN_PATCH="${PARCH}-hpnssh${HPN_VER}.patch.xz" +SCTP_VER="1.0" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz" +X509_VER="11.3.1" X509_PATCH="${PARCH}-x509-${X509_VER}.patch.xz" + +# Disable LDAP support until someone will rewrite the patch, +# upstream removed auth_parse_options() via commit 7c856857607112a3dfe6414696bf4c7ab7fb0cb3 +#LDAP_VER="0.3.14" LDAP_PATCH="${PN}-lpk-7.7p1-${LDAP_VER}.patch.xz" + +PATCH_SET="openssh-7.7p1-patches-1.1" DESCRIPTION="Port of OpenBSD's free SSH release" -HOMEPAGE="http://www.openssh.org/"; +HOMEPAGE="https://www.openssh.com/"; SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz - ${SCTP_PATCH:+mirror://gentoo/${SCTP_PATCH}} - ${HPN_PATCH:+hpn? ( mirror://gentoo/${HPN_PATCH} )} - ${LDAP_PATCH:+ldap? ( mirror://gentoo/${LDAP_PATCH} )} - ${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )} + https://dev.gentoo.org/~whissi/dist/${PN}/${PATCH_SET}.tar.xz + ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH} )} + ${HPN_PATCH:+hpn? ( https://dev.gentoo.org/~whissi/dist/openssh/${HPN_PATCH} )} + ${LDAP_PATCH:+ldap? ( https://dev.gentoo.org/~whissi/dist/openssh/${LDAP_PATCH} )} + ${X509_PATCH:+X509? ( https://dev.gentoo.org/~whissi/dist/openssh/${X509_PATCH} )} " LICENSE="BSD GPL-2" SLOT="0" KEYWORDS="amd64 arm ~mips ppc x86" # Probably want to drop ssl defaulting to on in a future version. -IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509" +IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey +ssl static test X X509" REQUIRED_USE="ldns? ( ssl ) pie? ( !static ) - ssh1? ( ssl ) static? ( !kerberos !pam ) X509? ( !ldap !sctp ssl ) test? ( ssl )" @@ -69,16 +74,17 @@ RDEPEND="${RDEPEND} userland_GNU? ( virtual/shadow ) X? ( x11-apps/xauth )" -S=${WORKDIR}/${PARCH} +S="${WORKDIR}/${PARCH}" pkg_pretend() { # this sucks, but i'd rather have people unable to `emerge -u openssh` # than not be able to log in to their server any more maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; } local fail=" - $(use X509 && maybe_fail X509 X509_PATCH) - $(use ldap && maybe_fail ldap LDAP_PATCH) $(use hpn && maybe_fail hpn HPN_PATCH) + $(use ldap && maybe_fail ldap LDAP_PATCH) + $(use sctp && maybe_fail sctp SCTP_PATCH) + $(use X509 && maybe_fail X509 X509_PATCH) " fail=$(echo ${fail}) if [[ -n ${fail} ]] ; then @@ -90,59 +96,148 @@ pkg_pretend() { fi # Make sure people who are using tcp wrappers are notified of its removal. #531156 - if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then + if grep -qs '^ *sshd *:' "${EROOT%/}"/etc/hosts.{allow,deny} ; then ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like" ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please." fi } -save_version() { - # version.h patch conflict avoidence - mv version.h version.h.$1 - cp -f version.h.pristine version.h -} - src_prepare() { sed -i \ - -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \ + -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \ pathnames.h || die - # keep this as we need it to avoid the conflict between LPK and HPN changing - # this file. - cp version.h version.h.pristine # don't break .ssh/authorized_keys2 for fun sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die + eapply "${FILESDIR}"/${PN}-7.7_p1-GSSAPI-dns.patch #165444 integrated into gsskex + eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch + eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch + + local PATCHSET_VERSION_MACROS=() + if use X509 ; then - if use hpn ; then - pushd "${WORKDIR}"/${HPN_PATCH%.*.*} >/dev/null - epatch "${FILESDIR}"/${P}-hpn-x509-${X509_VER}-glue.patch - popd >/dev/null - fi - save_version X509 - epatch "${WORKDIR}"/${X509_PATCH%.*} + eapply "${WORKDIR}"/${X509_PATCH%.*} + + # We need to patch package version or any X.509 sshd will reject our ssh client + # with "userauth_pubkey: could not parse key: string is too large [preauth]" + # error + einfo "Patching package version for X.509 patch set ..." + sed -i \ + -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \ + "${S}"/configure.ac || die "Failed to patch package version for X.509 patch" + + einfo "Patching version.h to expose X.509 patch set ..." + sed -i \ + -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \ + "${S}"/version.h || die "Failed to sed-in X.509 patch version" + PATCHSET_VERSION_MACROS+=( 'SSH_X509' ) + + einfo "Disabling broken X.509 agent test ..." + sed -i \ + -e "/^ agent$/d" \ + "${S}"/tests/CA/config || die "Failed to disable broken X.509 agent test" + + # The following patches don't apply on top of X509 patch + rm "${WORKDIR}"/patch/2002_all_openssh-7.7p1_upstream_bug2840.patch || die + rm "${WORKDIR}"/patch/2009_all_openssh-7.7p1_make-shell-tests-portable.patch || die + rm "${WORKDIR}"/patch/2016_all_openssh-7.7p1_implement-EMFILE-mitigation-for-ssh-agent.patch || die + rm "${WORKDIR}"/patch/2025_all_openssh-7.7p1_prefer-argv0-to-ssh-when-re-executing-ssh-for-proxyjump.patch || die + else + rm "${WORKDIR}"/patch/2016_all_openssh-7.7p1-X509_implement-EMFILE-mitigation-for-ssh-agent.patch || die + rm "${WORKDIR}"/patch/2025_all_openssh-7.7p1-X509_prefer-argv0-to-ssh-when-re-executing-ssh-for-proxyjump.patch || die fi if use ldap ; then - epatch "${WORKDIR}"/${LDAP_PATCH%.*} - save_version LPK + eapply "${WORKDIR}"/${LDAP_PATCH%.*} + + einfo "Patching version.h to expose LDAP patch set ..." + sed -i \ + -e "/^#define SSH_PORTABLE.*/a #define SSH_LDAP \"-ldap-${LDAP_VER}\"" \ + "${S}"/version.h || die "Failed to sed-in LDAP patch version" + PATCHSET_VERSION_MACROS+=( 'SSH_LDAP' ) fi - epatch "${FILESDIR}"/${PN}-7.5_p1-GSSAPI-dns.patch #165444 integrated into gsskex - epatch "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch - epatch "${FILESDIR}"/${PN}-7.5_p1-cross-cache.patch - epatch "${FILESDIR}"/${PN}-7.5_p1-CVE-2017-15906.patch - use X509 || epatch "${WORKDIR}"/${SCTP_PATCH%.*} - use X509 || epatch "${FILESDIR}"/${PN}-7.5_p1-x32-typo.patch - use abi_mips_n32 && epatch "${FILESDIR}"/${PN}-7.3-mips-seccomp-n32.patch + if use sctp ; then + eapply "${WORKDIR}"/${SCTP_PATCH%.*} + + einfo "Patching version.h to expose SCTP patch set ..." + sed -i \ + -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \ + "${S}"/version.h || die "Failed to sed-in SCTP patch version" + PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' ) + + einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..." + sed -i \ + -e "/\t\tcfgparse \\\/d" \ + "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch" + fi if use hpn ; then - EPATCH_FORCE="yes" EPATCH_SUFFIX="patch" \ - EPATCH_MULTI_MSG="Applying HPN patchset ..." \ - epatch "${WORKDIR}"/${HPN_PATCH%.*.*} - save_version HPN + eapply "${WORKDIR}"/${HPN_PATCH%.*} + + einfo "Patching Makefile.in for HPN patch set ..." + sed -i \ + -e "/^LIBS=/ s/\$/ -lpthread/" \ + "${S}"/Makefile.in || die "Failed to patch Makefile.in" + + einfo "Patching version.h to expose HPN patch set ..." + sed -i \ + -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER}\"" \ + "${S}"/version.h || die "Failed to sed-in HPN patch version" + PATCHSET_VERSION_MACROS+=( 'SSH_HPN' ) + + if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then + einfo "Disabling known non-working MT AES cipher per default ..." + + cat > "${T}"/disable_mtaes.conf <<- EOF + + # HPN's Multi-Threaded AES CTR cipher is currently known to be broken + # and therefore disabled per default. + DisableMTAES yes + EOF + sed -i \ + -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \ + "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config" + + sed -i \ + -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \ + "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config" + fi + fi + + if use X509 || use hpn ; then + einfo "Patching packet.c for X509 and/or HPN patch set ..." + sed -i \ + -e "s/const struct sshcipher/struct sshcipher/" \ + "${S}"/packet.c || die "Failed to patch ssh_packet_set_connection() (packet.c)" + fi + + if use X509 || use sctp || use ldap || use hpn ; then + einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..." + sed -i \ + -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \ + "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)" + + einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..." + sed -i \ + -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \ + "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)" + + einfo "Patching version.h to add our patch sets to SSH_RELEASE ..." + sed -i \ + -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \ + "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)" fi + sed -i \ + -e "/#UseLogin no/d" \ + "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)" + + eapply "${WORKDIR}"/patch/*.patch + + eapply_user #473004 + tc-export PKG_CONFIG local sed_args=( -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):" @@ -151,6 +246,7 @@ src_prepare() { # Disable fortify flags ... our gcc does this for us -e 's:-D_FORTIFY_SOURCE=2::' ) + # The -ftrapv flag ICEs on hppa #505182 use hppa && sed_args+=( -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:' @@ -162,16 +258,6 @@ src_prepare() { ) sed -i "${sed_args[@]}" configure{.ac,} || die - epatch_user #473004 - - # Now we can build a sane merged version.h - ( - sed '/^#define SSH_RELEASE/d' version.h.* | sort -u - macros=() - for p in HPN LPK X509; do [[ -e version.h.${p} ]] && macros+=( SSH_${p} ) ; done - printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros[*]}" - ) > version.h - eautoreconf } @@ -185,24 +271,23 @@ src_configure() { --with-ldflags="${LDFLAGS}" --disable-strip --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run - --sysconfdir="${EPREFIX}"/etc/ssh - --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc - --datadir="${EPREFIX}"/usr/share/openssh - --with-privsep-path="${EPREFIX}"/var/empty + --sysconfdir="${EPREFIX%/}"/etc/ssh + --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc + --datadir="${EPREFIX%/}"/usr/share/openssh + --with-privsep-path="${EPREFIX%/}"/var/empty --with-privsep-user=sshd $(use_with audit audit linux) - $(use_with kerberos kerberos5 "${EPREFIX}"/usr) - # We apply the ldap patch conditionally, so can't pass --without-ldap + $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr) + # We apply the ldap and sctp patch conditionally, so can't pass --without-{ldap,sctp} # unconditionally else we get unknown flag warnings. $(use ldap && use_with ldap) + $(use sctp && use_with sctp) $(use_with ldns) $(use_with libedit) $(use_with pam) $(use_with pie) - $(use X509 || use_with sctp) $(use_with selinux) $(use_with skey) - $(use_with ssh1) $(use_with ssl openssl) $(use_with ssl md5-passwords) $(use_with ssl ssl-engine) @@ -218,12 +303,41 @@ src_configure() { econf "${myconf[@]}" } +src_test() { + local t skipped=() failed=() passed=() + local tests=( interop-tests compat-tests ) + + local shell=$(egetshell "${UID}") + if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then + elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'" + elog "user, so we will run a subset only." + skipped+=( tests ) + else + tests+=( tests ) + fi + + # It will also attempt to write to the homedir .ssh. + local sshhome=${T}/homedir + mkdir -p "${sshhome}"/.ssh + for t in "${tests[@]}" ; do + # Some tests read from stdin ... + HOMEDIR="${sshhome}" HOME="${sshhome}" \ + emake -k -j1 ${t} </dev/null \ + && passed+=( "${t}" ) \ + || failed+=( "${t}" ) + done + + einfo "Passed tests: ${passed[*]}" + [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}" + [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}" +} + src_install() { emake install-nokeys DESTDIR="${D}" fperms 600 /etc/ssh/sshd_config dobin contrib/ssh-copy-id - newinitd "${FILESDIR}"/sshd.rc6.4 sshd - newconfd "${FILESDIR}"/sshd.confd sshd + newinitd "${FILESDIR}"/sshd.rc6.5 sshd + newconfd "${FILESDIR}"/sshd-r1.confd sshd newpamd "${FILESDIR}"/sshd.pam_include.2 sshd if use pam ; then @@ -232,16 +346,16 @@ src_install() { -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \ -e "/^#PrintMotd /s:.*:PrintMotd no:" \ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \ - "${ED}"/etc/ssh/sshd_config || die + "${ED%/}"/etc/ssh/sshd_config || die fi # Gentoo tweaks to default config files - cat <<-EOF >> "${ED}"/etc/ssh/sshd_config + cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config # Allow client to pass locale environment variables #367017 AcceptEnv LANG LC_* EOF - cat <<-EOF >> "${ED}"/etc/ssh/ssh_config + cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config # Send locale environment variables #367017 SendEnv LANG LC_* @@ -250,54 +364,28 @@ src_install() { if use livecd ; then sed -i \ -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \ - "${ED}"/etc/ssh/sshd_config || die + "${ED%/}"/etc/ssh/sshd_config || die fi - if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then + if use ldap && [[ -n ${LDAP_PATCH} ]] ; then insinto /etc/openldap/schema/ newins openssh-lpk_openldap.schema openssh-lpk.schema fi doman contrib/ssh-copy-id.1 dodoc CREDITS OVERVIEW README* TODO sshd_config + use hpn && dodoc HPN-README use X509 || dodoc ChangeLog diropts -m 0700 dodir /etc/skel/.ssh + keepdir /var/empty + systemd_dounit "${FILESDIR}"/sshd.{service,socket} systemd_newunit "${FILESDIR}"/sshd_at.service '[email protected]' } -src_test() { - local t skipped=() failed=() passed=() - local tests=( interop-tests compat-tests ) - - local shell=$(egetshell "${UID}") - if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then - elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'" - elog "user, so we will run a subset only." - skipped+=( tests ) - else - tests+=( tests ) - fi - - # It will also attempt to write to the homedir .ssh. - local sshhome=${T}/homedir - mkdir -p "${sshhome}"/.ssh - for t in "${tests[@]}" ; do - # Some tests read from stdin ... - HOMEDIR="${sshhome}" HOME="${sshhome}" \ - emake -k -j1 ${t} </dev/null \ - && passed+=( "${t}" ) \ - || failed+=( "${t}" ) - done - - einfo "Passed tests: ${passed[*]}" - [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}" - [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}" -} - pkg_preinst() { enewgroup sshd 22 enewuser sshd 22 -1 /var/empty sshd @@ -309,9 +397,6 @@ pkg_postinst() { elog "algorithm (ECDSA). You are encouraged to manually update your stored" elog "keys list as servers update theirs. See ssh-keyscan(1) for more info." fi - if has_version "<${CATEGORY}/${PN}-6.9_p1" ; then - elog "Starting with openssh-6.9p1, ssh1 support is disabled by default." - fi if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream." elog "Make sure to update any configs that you might have. Note that xinetd might" @@ -328,9 +413,25 @@ pkg_postinst() { elog "to 'prohibit-password'. That means password auth for root users no longer works" elog "out of the box. If you need this, please update your sshd_config explicitly." fi + if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then + elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely." + elog "Furthermore, rsa keys with less than 1024 bits will be refused." + fi if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then elog "Be aware that by disabling openssl support in openssh, the server and clients" elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys" elog "and update all clients/servers that utilize them." fi + + if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then + elog "" + elog "HPN's multi-threaded AES CTR cipher is currently known to be broken" + elog "and therefore disabled at runtime per default." + elog "Make sure your sshd_config is up to date and contains" + elog "" + elog " DisableMTAES yes" + elog "" + elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher." + elog "" + fi }
