[openssh] rebase to openssh-6.2p1 (#924727) ACSS was removed from upstream sources
plautrba
plautrba at fedoraproject.org
Thu Apr 4 14:52:37 UTC 2013
commit 8a29dedfa7c64bd7fc5ffb0bc25144cd9e23432d
Author: Petr Lautrbach <plautrba at redhat.com>
Date: Thu Apr 4 16:42:32 2013 +0200
rebase to openssh-6.2p1 (#924727)
ACSS was removed from upstream sources
.gitignore | 1 +
....0p1-audit1.patch => openssh-6.2p1-audit1.patch | 111 ++++----
....9p1-audit3.patch => openssh-6.2p1-audit3.patch | 310 ++++++++++----------
....1p1-audit4.patch => openssh-6.2p1-audit4.patch | 182 ++++++------
....0p1-audit5.patch => openssh-6.2p1-audit5.patch | 118 ++++----
...-coverity.patch => openssh-6.2p1-coverity.patch | 194 ++++++------
...stest.patch => openssh-6.2p1-ctr-cavstest.patch | 24 +-
...p1-entropy.patch => openssh-6.2p1-entropy.patch | 117 ++++----
...rprint.patch => openssh-6.2p1-fingerprint.patch | 116 ++++----
...sh-5.9p1-fips.patch => openssh-6.2p1-fips.patch | 206 +++++++-------
...orce_krb.patch => openssh-6.2p1-force_krb.patch | 34 +-
....1p1-gsskex.patch => openssh-6.2p1-gsskex.patch | 280 +++++++++---------
....9p1-keycat.patch => openssh-6.2p1-keycat.patch | 42 ++--
...p1-kuserok.patch => openssh-6.2p1-kuserok.patch | 60 ++--
...sh-6.0p1-ldap.patch => openssh-6.2p1-ldap.patch | 132 ++++----
...-role-mls.patch => openssh-6.2p1-role-mls.patch | 198 +++++++-------
....1p1-vendor.patch => openssh-6.2p1-vendor.patch | 78 +++---
openssh-nukeacss.sh | 21 --
openssh.spec | 59 ++--
sources | 3 +-
20 files changed, 1138 insertions(+), 1148 deletions(-)
---
diff --git a/.gitignore b/.gitignore
index 02a374d..cc44a91 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,3 +8,4 @@ pam_ssh_agent_auth-0.9.2.tar.bz2
/pam_ssh_agent_auth-0.9.3.tar.bz2
/openssh-6.0p1-noacss.tar.bz2
/openssh-6.1p1-noacss.tar.bz2
+/openssh-6.2p1.tar.gz
diff --git a/openssh-6.0p1-audit1.patch b/openssh-6.2p1-audit1.patch
similarity index 82%
rename from openssh-6.0p1-audit1.patch
rename to openssh-6.2p1-audit1.patch
index 9c927b0..ae06ba1 100644
--- a/openssh-6.0p1-audit1.patch
+++ b/openssh-6.2p1-audit1.patch
@@ -1,6 +1,6 @@
-diff -up openssh-6.0p1/audit-bsm.c.audit1 openssh-6.0p1/audit-bsm.c
---- openssh-6.0p1/audit-bsm.c.audit1 2012-02-24 00:40:43.000000000 +0100
-+++ openssh-6.0p1/audit-bsm.c 2012-08-06 20:33:24.416382804 +0200
+diff -up openssh-6.2p1/audit-bsm.c.audit1 openssh-6.2p1/audit-bsm.c
+--- openssh-6.2p1/audit-bsm.c.audit1 2012-02-24 00:40:43.000000000 +0100
++++ openssh-6.2p1/audit-bsm.c 2013-03-25 17:18:30.934758118 +0100
@@ -375,10 +375,23 @@ audit_connection_from(const char *host,
#endif
}
@@ -26,9 +26,9 @@ diff -up openssh-6.0p1/audit-bsm.c.audit1 openssh-6.0p1/audit-bsm.c
}
void
-diff -up openssh-6.0p1/audit.c.audit1 openssh-6.0p1/audit.c
---- openssh-6.0p1/audit.c.audit1 2011-01-17 11:15:30.000000000 +0100
-+++ openssh-6.0p1/audit.c 2012-08-06 20:33:24.417382801 +0200
+diff -up openssh-6.2p1/audit.c.audit1 openssh-6.2p1/audit.c
+--- openssh-6.2p1/audit.c.audit1 2011-01-17 11:15:30.000000000 +0100
++++ openssh-6.2p1/audit.c 2013-03-25 17:18:30.934758118 +0100
@@ -140,6 +140,17 @@ audit_event(ssh_audit_event_t event)
}
@@ -79,9 +79,9 @@ diff -up openssh-6.0p1/audit.c.audit1 openssh-6.0p1/audit.c
+
# endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */
#endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-6.0p1/audit.h.audit1 openssh-6.0p1/audit.h
---- openssh-6.0p1/audit.h.audit1 2011-01-17 11:15:30.000000000 +0100
-+++ openssh-6.0p1/audit.h 2012-08-06 20:33:24.417382801 +0200
+diff -up openssh-6.2p1/audit.h.audit1 openssh-6.2p1/audit.h
+--- openssh-6.2p1/audit.h.audit1 2011-01-17 11:15:30.000000000 +0100
++++ openssh-6.2p1/audit.h 2013-03-25 17:18:30.934758118 +0100
@@ -49,9 +49,11 @@ typedef enum ssh_audit_event_type ssh_au
void audit_connection_from(const char *, int);
@@ -95,9 +95,9 @@ diff -up openssh-6.0p1/audit.h.audit1 openssh-6.0p1/audit.h
ssh_audit_event_t audit_classify_auth(const char *);
#endif /* _SSH_AUDIT_H */
-diff -up openssh-6.0p1/audit-linux.c.audit1 openssh-6.0p1/audit-linux.c
---- openssh-6.0p1/audit-linux.c.audit1 2011-01-17 11:15:30.000000000 +0100
-+++ openssh-6.0p1/audit-linux.c 2012-08-06 20:33:24.416382804 +0200
+diff -up openssh-6.2p1/audit-linux.c.audit1 openssh-6.2p1/audit-linux.c
+--- openssh-6.2p1/audit-linux.c.audit1 2011-01-17 11:15:30.000000000 +0100
++++ openssh-6.2p1/audit-linux.c 2013-03-25 17:18:30.934758118 +0100
@@ -35,13 +35,20 @@
#include "log.h"
@@ -313,9 +313,9 @@ diff -up openssh-6.0p1/audit-linux.c.audit1 openssh-6.0p1/audit-linux.c
break;
default:
-diff -up openssh-6.0p1/monitor.c.audit1 openssh-6.0p1/monitor.c
---- openssh-6.0p1/monitor.c.audit1 2012-08-06 20:33:24.410382828 +0200
-+++ openssh-6.0p1/monitor.c 2012-08-06 20:33:24.418382797 +0200
+diff -up openssh-6.2p1/monitor.c.audit1 openssh-6.2p1/monitor.c
+--- openssh-6.2p1/monitor.c.audit1 2013-03-25 17:18:30.913757986 +0100
++++ openssh-6.2p1/monitor.c 2013-03-25 17:18:30.935758124 +0100
@@ -185,6 +185,7 @@ int mm_answer_gss_checkmic(int, Buffer *
#ifdef SSH_AUDIT_EVENTS
int mm_answer_audit_event(int, Buffer *);
@@ -340,7 +340,7 @@ diff -up openssh-6.0p1/monitor.c.audit1 openssh-6.0p1/monitor.c
#endif
{0, 0, NULL}
};
-@@ -1427,6 +1430,12 @@ mm_session_close(Session *s)
+@@ -1433,6 +1436,12 @@ mm_session_close(Session *s)
debug3("%s: tty %s ptyfd %d", __func__, s->tty, s->ptyfd);
session_pty_cleanup2(s);
}
@@ -353,7 +353,7 @@ diff -up openssh-6.0p1/monitor.c.audit1 openssh-6.0p1/monitor.c
session_unused(s->self);
}
-@@ -1751,11 +1760,44 @@ mm_answer_audit_command(int socket, Buff
+@@ -1755,11 +1764,44 @@ mm_answer_audit_command(int socket, Buff
{
u_int len;
char *cmd;
@@ -399,21 +399,24 @@ diff -up openssh-6.0p1/monitor.c.audit1 openssh-6.0p1/monitor.c
xfree(cmd);
return (0);
}
-diff -up openssh-6.0p1/monitor.h.audit1 openssh-6.0p1/monitor.h
---- openssh-6.0p1/monitor.h.audit1 2011-06-20 06:42:23.000000000 +0200
-+++ openssh-6.0p1/monitor.h 2012-08-06 20:33:24.418382797 +0200
-@@ -60,6 +60,7 @@ enum monitor_reqtype {
- MONITOR_REQ_PAM_RESPOND, MONITOR_ANS_PAM_RESPOND,
- MONITOR_REQ_PAM_FREE_CTX, MONITOR_ANS_PAM_FREE_CTX,
- MONITOR_REQ_AUDIT_EVENT, MONITOR_REQ_AUDIT_COMMAND,
-+ MONITOR_ANS_AUDIT_COMMAND, MONITOR_REQ_AUDIT_END_COMMAND,
- MONITOR_REQ_TERM,
- MONITOR_REQ_JPAKE_STEP1, MONITOR_ANS_JPAKE_STEP1,
- MONITOR_REQ_JPAKE_GET_PWDATA, MONITOR_ANS_JPAKE_GET_PWDATA,
-diff -up openssh-6.0p1/monitor_wrap.c.audit1 openssh-6.0p1/monitor_wrap.c
---- openssh-6.0p1/monitor_wrap.c.audit1 2012-08-06 20:33:24.384382930 +0200
-+++ openssh-6.0p1/monitor_wrap.c 2012-08-06 20:33:24.419382793 +0200
-@@ -1188,10 +1188,11 @@ mm_audit_event(ssh_audit_event_t event)
+diff -up openssh-6.2p1/monitor.h.audit1 openssh-6.2p1/monitor.h
+--- openssh-6.2p1/monitor.h.audit1 2013-03-25 17:18:30.935758124 +0100
++++ openssh-6.2p1/monitor.h 2013-03-25 17:24:53.474078078 +0100
+@@ -68,7 +68,9 @@ enum monitor_reqtype {
+ MONITOR_REQ_PAM_QUERY = 106, MONITOR_ANS_PAM_QUERY = 107,
+ MONITOR_REQ_PAM_RESPOND = 108, MONITOR_ANS_PAM_RESPOND = 109,
+ MONITOR_REQ_PAM_FREE_CTX = 110, MONITOR_ANS_PAM_FREE_CTX = 111,
+- MONITOR_REQ_AUDIT_EVENT = 112, MONITOR_REQ_AUDIT_COMMAND = 113,
++ MONITOR_REQ_AUDIT_EVENT = 112,
++ MONITOR_REQ_AUDIT_COMMAND = 114, MONITOR_ANS_AUDIT_COMMAND = 115,
++ MONITOR_REQ_AUDIT_END_COMMAND = 116
+
+ };
+
+diff -up openssh-6.2p1/monitor_wrap.c.audit1 openssh-6.2p1/monitor_wrap.c
+--- openssh-6.2p1/monitor_wrap.c.audit1 2013-03-25 17:18:30.913757986 +0100
++++ openssh-6.2p1/monitor_wrap.c 2013-03-25 17:18:30.936758131 +0100
+@@ -1189,10 +1189,11 @@ mm_audit_event(ssh_audit_event_t event)
buffer_free(&m);
}
@@ -426,7 +429,7 @@ diff -up openssh-6.0p1/monitor_wrap.c.audit1 openssh-6.0p1/monitor_wrap.c
debug3("%s entering command %s", __func__, command);
-@@ -1199,6 +1200,26 @@ mm_audit_run_command(const char *command
+@@ -1200,6 +1201,26 @@ mm_audit_run_command(const char *command
buffer_put_cstring(&m, command);
mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_COMMAND, &m);
@@ -453,9 +456,9 @@ diff -up openssh-6.0p1/monitor_wrap.c.audit1 openssh-6.0p1/monitor_wrap.c
buffer_free(&m);
}
#endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-6.0p1/monitor_wrap.h.audit1 openssh-6.0p1/monitor_wrap.h
---- openssh-6.0p1/monitor_wrap.h.audit1 2011-06-20 06:42:23.000000000 +0200
-+++ openssh-6.0p1/monitor_wrap.h 2012-08-06 20:33:24.419382793 +0200
+diff -up openssh-6.2p1/monitor_wrap.h.audit1 openssh-6.2p1/monitor_wrap.h
+--- openssh-6.2p1/monitor_wrap.h.audit1 2011-06-20 06:42:23.000000000 +0200
++++ openssh-6.2p1/monitor_wrap.h 2013-03-25 17:18:30.936758131 +0100
@@ -74,7 +74,8 @@ void mm_sshpam_free_ctx(void *);
#ifdef SSH_AUDIT_EVENTS
#include "audit.h"
@@ -466,10 +469,10 @@ diff -up openssh-6.0p1/monitor_wrap.h.audit1 openssh-6.0p1/monitor_wrap.h
#endif
struct Session;
-diff -up openssh-6.0p1/session.c.audit1 openssh-6.0p1/session.c
---- openssh-6.0p1/session.c.audit1 2011-11-04 00:55:24.000000000 +0100
-+++ openssh-6.0p1/session.c 2012-08-06 20:33:24.420382789 +0200
-@@ -742,6 +742,14 @@ do_exec_pty(Session *s, const char *comm
+diff -up openssh-6.2p1/session.c.audit1 openssh-6.2p1/session.c
+--- openssh-6.2p1/session.c.audit1 2013-03-15 01:22:37.000000000 +0100
++++ openssh-6.2p1/session.c 2013-03-25 17:18:30.937758137 +0100
+@@ -745,6 +745,14 @@ do_exec_pty(Session *s, const char *comm
/* Parent. Close the slave side of the pseudo tty. */
close(ttyfd);
@@ -484,7 +487,7 @@ diff -up openssh-6.0p1/session.c.audit1 openssh-6.0p1/session.c
/* Enter interactive session. */
s->ptymaster = ptymaster;
packet_set_interactive(1,
-@@ -813,15 +821,19 @@ do_exec(Session *s, const char *command)
+@@ -816,15 +824,19 @@ do_exec(Session *s, const char *command)
}
#ifdef SSH_AUDIT_EVENTS
@@ -506,7 +509,7 @@ diff -up openssh-6.0p1/session.c.audit1 openssh-6.0p1/session.c
#endif
if (s->ttyfd != -1)
ret = do_exec_pty(s, command);
-@@ -1848,6 +1860,7 @@ session_unused(int id)
+@@ -1856,6 +1868,7 @@ session_unused(int id)
sessions[id].ttyfd = -1;
sessions[id].ptymaster = -1;
sessions[id].x11_chanids = NULL;
@@ -514,7 +517,7 @@ diff -up openssh-6.0p1/session.c.audit1 openssh-6.0p1/session.c
sessions[id].next_unused = sessions_first_unused;
sessions_first_unused = id;
}
-@@ -1930,6 +1943,19 @@ session_open(Authctxt *authctxt, int cha
+@@ -1938,6 +1951,19 @@ session_open(Authctxt *authctxt, int cha
}
Session *
@@ -534,7 +537,7 @@ diff -up openssh-6.0p1/session.c.audit1 openssh-6.0p1/session.c
session_by_tty(char *tty)
{
int i;
-@@ -2455,6 +2481,30 @@ session_exit_message(Session *s, int sta
+@@ -2463,6 +2489,30 @@ session_exit_message(Session *s, int sta
chan_write_failed(c);
}
@@ -565,7 +568,7 @@ diff -up openssh-6.0p1/session.c.audit1 openssh-6.0p1/session.c
void
session_close(Session *s)
{
-@@ -2463,6 +2513,10 @@ session_close(Session *s)
+@@ -2471,6 +2521,10 @@ session_close(Session *s)
debug("session_close: session %d pid %ld", s->self, (long)s->pid);
if (s->ttyfd != -1)
session_pty_cleanup(s);
@@ -576,7 +579,7 @@ diff -up openssh-6.0p1/session.c.audit1 openssh-6.0p1/session.c
if (s->term)
xfree(s->term);
if (s->display)
-@@ -2682,6 +2736,15 @@ do_authenticated2(Authctxt *authctxt)
+@@ -2690,6 +2744,15 @@ do_authenticated2(Authctxt *authctxt)
server_loop2(authctxt);
}
@@ -592,16 +595,16 @@ diff -up openssh-6.0p1/session.c.audit1 openssh-6.0p1/session.c
void
do_cleanup(Authctxt *authctxt)
{
-@@ -2730,5 +2793,5 @@ do_cleanup(Authctxt *authctxt)
+@@ -2738,5 +2801,5 @@ do_cleanup(Authctxt *authctxt)
* or if running in monitor.
*/
if (!use_privsep || mm_is_monitor())
- session_destroy_all(session_pty_cleanup2);
+ session_destroy_all(do_cleanup_one_session);
}
-diff -up openssh-6.0p1/session.h.audit1 openssh-6.0p1/session.h
---- openssh-6.0p1/session.h.audit1 2008-05-19 07:34:50.000000000 +0200
-+++ openssh-6.0p1/session.h 2012-08-06 20:33:24.420382789 +0200
+diff -up openssh-6.2p1/session.h.audit1 openssh-6.2p1/session.h
+--- openssh-6.2p1/session.h.audit1 2008-05-19 07:34:50.000000000 +0200
++++ openssh-6.2p1/session.h 2013-03-25 17:18:30.937758137 +0100
@@ -60,6 +60,12 @@ struct Session {
char *name;
char *val;
@@ -626,10 +629,10 @@ diff -up openssh-6.0p1/session.h.audit1 openssh-6.0p1/session.h
Session *session_by_tty(char *);
void session_close(Session *);
void do_setusercontext(struct passwd *);
-diff -up openssh-6.0p1/sshd.c.audit1 openssh-6.0p1/sshd.c
---- openssh-6.0p1/sshd.c.audit1 2012-08-06 20:33:24.392382898 +0200
-+++ openssh-6.0p1/sshd.c 2012-08-06 20:33:24.421382785 +0200
-@@ -2381,7 +2381,8 @@ cleanup_exit(int i)
+diff -up openssh-6.2p1/sshd.c.audit1 openssh-6.2p1/sshd.c
+--- openssh-6.2p1/sshd.c.audit1 2013-03-25 17:18:30.919758024 +0100
++++ openssh-6.2p1/sshd.c 2013-03-25 17:18:30.937758137 +0100
+@@ -2409,7 +2409,8 @@ cleanup_exit(int i)
}
#ifdef SSH_AUDIT_EVENTS
/* done after do_cleanup so it can cancel the PAM auth 'thread' */
diff --git a/openssh-5.9p1-audit3.patch b/openssh-6.2p1-audit3.patch
similarity index 73%
rename from openssh-5.9p1-audit3.patch
rename to openssh-6.2p1-audit3.patch
index da59660..9c8b4f3 100644
--- a/openssh-5.9p1-audit3.patch
+++ b/openssh-6.2p1-audit3.patch
@@ -1,19 +1,7 @@
-diff -up openssh-5.9p1/Makefile.in.audit3 openssh-5.9p1/Makefile.in
---- openssh-5.9p1/Makefile.in.audit3 2011-08-05 22:15:18.000000000 +0200
-+++ openssh-5.9p1/Makefile.in 2011-09-14 07:05:58.337520327 +0200
-@@ -71,7 +71,7 @@ LIBSSH_OBJS=acss.o authfd.o authfile.o b
- monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o \
- kexdh.o kexgex.o kexdhc.o kexgexc.o bufec.o kexecdh.o kexecdhc.o \
- msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o jpake.o \
-- schnorr.o ssh-pkcs11.o
-+ schnorr.o ssh-pkcs11.o auditstub.o
-
- SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
- sshconnect.o sshconnect1.o sshconnect2.o mux.o \
-diff -up openssh-5.9p1/audit-bsm.c.audit3 openssh-5.9p1/audit-bsm.c
---- openssh-5.9p1/audit-bsm.c.audit3 2011-09-14 07:05:56.719459048 +0200
-+++ openssh-5.9p1/audit-bsm.c 2011-09-14 07:05:58.430520147 +0200
-@@ -396,4 +396,16 @@ audit_event(ssh_audit_event_t event)
+diff -up openssh-6.2p1/audit-bsm.c.audit3 openssh-6.2p1/audit-bsm.c
+--- openssh-6.2p1/audit-bsm.c.audit3 2013-03-25 17:30:41.329102631 +0100
++++ openssh-6.2p1/audit-bsm.c 2013-03-25 17:30:41.338102682 +0100
+@@ -473,4 +473,16 @@ audit_event(ssh_audit_event_t event)
debug("%s: unhandled event %d", __func__, event);
}
}
@@ -30,82 +18,9 @@ diff -up openssh-5.9p1/audit-bsm.c.audit3 openssh-5.9p1/audit-bsm.c
+ /* not implemented */
+}
#endif /* BSM */
-diff -up openssh-5.9p1/audit-linux.c.audit3 openssh-5.9p1/audit-linux.c
---- openssh-5.9p1/audit-linux.c.audit3 2011-09-14 07:05:56.820460613 +0200
-+++ openssh-5.9p1/audit-linux.c 2011-09-14 07:07:29.651459660 +0200
-@@ -40,6 +40,8 @@
- #include "auth.h"
- #include "servconf.h"
- #include "canohost.h"
-+#include "packet.h"
-+#include "cipher.h"
-
- #define AUDIT_LOG_SIZE 128
-
-@@ -269,4 +271,60 @@ audit_event(ssh_audit_event_t event)
- }
- }
-
-+void
-+audit_unsupported_body(int what)
-+{
-+#ifdef AUDIT_CRYPTO_SESSION
-+ char buf[AUDIT_LOG_SIZE];
-+ const static char *name[] = { "cipher", "mac", "comp" };
-+ char *s;
-+ int audit_fd;
-+
-+ snprintf(buf, sizeof(buf), "op=unsupported-%s direction=? cipher=? ksize=? rport=%d laddr=%s lport=%d ",
-+ name[what], get_remote_port(), (s = get_local_ipaddr(packet_get_connection_in())),
-+ get_local_port());
-+ xfree(s);
-+ audit_fd = audit_open();
-+ if (audit_fd < 0)
-+ /* no problem, the next instruction will be fatal() */
-+ return;
-+ audit_log_user_message(audit_fd, AUDIT_CRYPTO_SESSION,
-+ buf, NULL, get_remote_ipaddr(), NULL, 0);
-+ audit_close(audit_fd);
-+#endif
-+}
-+
-+void
-+audit_kex_body(int ctos, char *enc, char *mac, char *compress, pid_t pid,
-+ uid_t uid)
-+{
-+#ifdef AUDIT_CRYPTO_SESSION
-+ char buf[AUDIT_LOG_SIZE];
-+ int audit_fd, audit_ok;
-+ const static char *direction[] = { "from-server", "from-client", "both" };
-+ Cipher *cipher = cipher_by_name(enc);
-+ char *s;
-+
-+ snprintf(buf, sizeof(buf), "op=start direction=%s cipher=%s ksize=%d spid=%jd suid=%jd rport=%d laddr=%s lport=%d ",
-+ direction[ctos], enc, cipher ? 8 * cipher->key_len : 0,
-+ (intmax_t)pid, (intmax_t)uid,
-+ get_remote_port(), (s = get_local_ipaddr(packet_get_connection_in())), get_local_port());
-+ xfree(s);
-+ audit_fd = audit_open();
-+ if (audit_fd < 0) {
-+ if (errno == EINVAL || errno == EPROTONOSUPPORT ||
-+ errno == EAFNOSUPPORT)
-+ return; /* No audit support in kernel */
-+ else
-+ fatal("cannot open audit"); /* Must prevent login */
-+ }
-+ audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_SESSION,
-+ buf, NULL, get_remote_ipaddr(), NULL, 1);
-+ audit_close(audit_fd);
-+ /* do not abort if the error is EPERM and sshd is run as non root user */
-+ if ((audit_ok < 0) && ((audit_ok != -1) || (getuid() == 0)))
-+ fatal("cannot write into audit"); /* Must prevent login */
-+#endif
-+}
-+
- #endif /* USE_LINUX_AUDIT */
-diff -up openssh-5.9p1/audit.c.audit3 openssh-5.9p1/audit.c
---- openssh-5.9p1/audit.c.audit3 2011-09-14 07:05:56.937585272 +0200
-+++ openssh-5.9p1/audit.c 2011-09-14 07:05:58.646521393 +0200
+diff -up openssh-6.2p1/audit.c.audit3 openssh-6.2p1/audit.c
+--- openssh-6.2p1/audit.c.audit3 2013-03-25 17:30:41.330102636 +0100
++++ openssh-6.2p1/audit.c 2013-03-25 17:30:41.339102688 +0100
@@ -28,6 +28,7 @@
#include <stdarg.h>
@@ -169,9 +84,9 @@ diff -up openssh-5.9p1/audit.c.audit3 openssh-5.9p1/audit.c
+}
# endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */
#endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-5.9p1/audit.h.audit3 openssh-5.9p1/audit.h
---- openssh-5.9p1/audit.h.audit3 2011-09-14 07:05:57.391522394 +0200
-+++ openssh-5.9p1/audit.h 2011-09-14 07:05:58.766586362 +0200
+diff -up openssh-6.2p1/audit.h.audit3 openssh-6.2p1/audit.h
+--- openssh-6.2p1/audit.h.audit3 2013-03-25 17:30:41.330102636 +0100
++++ openssh-6.2p1/audit.h 2013-03-25 17:30:41.339102688 +0100
@@ -58,5 +58,9 @@ void audit_end_command(int, const char
ssh_audit_event_t audit_classify_auth(const char *);
int audit_keyusage(int, const char *, unsigned, char *, int);
@@ -182,9 +97,82 @@ diff -up openssh-5.9p1/audit.h.audit3 openssh-5.9p1/audit.h
+void audit_kex_body(int, char *, char *, char *, pid_t, uid_t);
#endif /* _SSH_AUDIT_H */
-diff -up openssh-5.9p1/auditstub.c.audit3 openssh-5.9p1/auditstub.c
---- openssh-5.9p1/auditstub.c.audit3 2011-09-14 07:05:58.866461077 +0200
-+++ openssh-5.9p1/auditstub.c 2011-09-14 07:05:58.870569033 +0200
+diff -up openssh-6.2p1/audit-linux.c.audit3 openssh-6.2p1/audit-linux.c
+--- openssh-6.2p1/audit-linux.c.audit3 2013-03-25 17:30:41.331102642 +0100
++++ openssh-6.2p1/audit-linux.c 2013-03-25 17:30:41.339102688 +0100
+@@ -40,6 +40,8 @@
+ #include "auth.h"
+ #include "servconf.h"
+ #include "canohost.h"
++#include "packet.h"
++#include "cipher.h"
+
+ #define AUDIT_LOG_SIZE 128
+
+@@ -269,4 +271,60 @@ audit_event(ssh_audit_event_t event)
+ }
+ }
+
++void
++audit_unsupported_body(int what)
++{
++#ifdef AUDIT_CRYPTO_SESSION
++ char buf[AUDIT_LOG_SIZE];
++ const static char *name[] = { "cipher", "mac", "comp" };
++ char *s;
++ int audit_fd;
++
++ snprintf(buf, sizeof(buf), "op=unsupported-%s direction=? cipher=? ksize=? rport=%d laddr=%s lport=%d ",
++ name[what], get_remote_port(), (s = get_local_ipaddr(packet_get_connection_in())),
++ get_local_port());
++ xfree(s);
++ audit_fd = audit_open();
++ if (audit_fd < 0)
++ /* no problem, the next instruction will be fatal() */
++ return;
++ audit_log_user_message(audit_fd, AUDIT_CRYPTO_SESSION,
++ buf, NULL, get_remote_ipaddr(), NULL, 0);
++ audit_close(audit_fd);
++#endif
++}
++
++void
++audit_kex_body(int ctos, char *enc, char *mac, char *compress, pid_t pid,
++ uid_t uid)
++{
++#ifdef AUDIT_CRYPTO_SESSION
++ char buf[AUDIT_LOG_SIZE];
++ int audit_fd, audit_ok;
++ const static char *direction[] = { "from-server", "from-client", "both" };
++ Cipher *cipher = cipher_by_name(enc);
++ char *s;
++
++ snprintf(buf, sizeof(buf), "op=start direction=%s cipher=%s ksize=%d spid=%jd suid=%jd rport=%d laddr=%s lport=%d ",
++ direction[ctos], enc, cipher ? 8 * cipher->key_len : 0,
++ (intmax_t)pid, (intmax_t)uid,
++ get_remote_port(), (s = get_local_ipaddr(packet_get_connection_in())), get_local_port());
++ xfree(s);
++ audit_fd = audit_open();
++ if (audit_fd < 0) {
++ if (errno == EINVAL || errno == EPROTONOSUPPORT ||
++ errno == EAFNOSUPPORT)
++ return; /* No audit support in kernel */
++ else
++ fatal("cannot open audit"); /* Must prevent login */
++ }
++ audit_ok = audit_log_user_message(audit_fd, AUDIT_CRYPTO_SESSION,
++ buf, NULL, get_remote_ipaddr(), NULL, 1);
++ audit_close(audit_fd);
++ /* do not abort if the error is EPERM and sshd is run as non root user */
++ if ((audit_ok < 0) && ((audit_ok != -1) || (getuid() == 0)))
++ fatal("cannot write into audit"); /* Must prevent login */
++#endif
++}
++
+ #endif /* USE_LINUX_AUDIT */
+diff -up openssh-6.2p1/auditstub.c.audit3 openssh-6.2p1/auditstub.c
+--- openssh-6.2p1/auditstub.c.audit3 2013-03-25 17:30:41.340102694 +0100
++++ openssh-6.2p1/auditstub.c 2013-03-25 17:30:41.340102694 +0100
@@ -0,0 +1,39 @@
+/* $Id: auditstub.c,v 1.1 jfch Exp $ */
+
@@ -225,30 +213,32 @@ diff -up openssh-5.9p1/auditstub.c.audit3 openssh-5.9p1/auditstub.c
+{
+}
+
-diff -up openssh-5.9p1/cipher.c.audit3 openssh-5.9p1/cipher.c
---- openssh-5.9p1/cipher.c.audit3 2011-09-07 15:05:09.000000000 +0200
-+++ openssh-5.9p1/cipher.c 2011-09-14 07:05:58.955582581 +0200
-@@ -60,15 +60,7 @@ extern void ssh1_3des_iv(EVP_CIPHER_CTX
- extern const EVP_CIPHER *evp_aes_128_ctr(void);
- extern void ssh_aes_ctr_iv(EVP_CIPHER_CTX *, int, u_char *, u_int);
+diff -up openssh-6.2p1/cipher.c.audit3 openssh-6.2p1/cipher.c
+--- openssh-6.2p1/cipher.c.audit3 2013-03-25 17:30:41.340102694 +0100
++++ openssh-6.2p1/cipher.c 2013-03-25 17:32:33.117743548 +0100
+@@ -58,17 +58,7 @@ extern const EVP_CIPHER *evp_ssh1_bf(voi
+ extern const EVP_CIPHER *evp_ssh1_3des(void);
+ extern void ssh1_3des_iv(EVP_CIPHER_CTX *, int, u_char *, int);
-struct Cipher {
- char *name;
- int number; /* for ssh1 only */
- u_int block_size;
- u_int key_len;
+- u_int iv_len; /* defaults to block_size */
+- u_int auth_len;
- u_int discard_len;
- u_int cbc_mode;
- const EVP_CIPHER *(*evptype)(void);
-} ciphers[] = {
+struct Cipher ciphers[] = {
- { "none", SSH_CIPHER_NONE, 8, 0, 0, 0, EVP_enc_null },
- { "des", SSH_CIPHER_DES, 8, 8, 0, 1, EVP_des_cbc },
- { "3des", SSH_CIPHER_3DES, 8, 16, 0, 1, evp_ssh1_3des },
-diff -up openssh-5.9p1/cipher.h.audit3 openssh-5.9p1/cipher.h
---- openssh-5.9p1/cipher.h.audit3 2009-01-28 06:38:41.000000000 +0100
-+++ openssh-5.9p1/cipher.h 2011-09-14 07:05:59.063459363 +0200
-@@ -61,7 +61,16 @@
+ { "none", SSH_CIPHER_NONE, 8, 0, 0, 0, 0, 0, EVP_enc_null },
+ { "des", SSH_CIPHER_DES, 8, 8, 0, 0, 0, 1, EVP_des_cbc },
+ { "3des", SSH_CIPHER_3DES, 8, 16, 0, 0, 0, 1, evp_ssh1_3des },
+diff -up openssh-6.2p1/cipher.h.audit3 openssh-6.2p1/cipher.h
+--- openssh-6.2p1/cipher.h.audit3 2013-03-25 17:30:41.341102699 +0100
++++ openssh-6.2p1/cipher.h 2013-03-25 17:32:45.338813408 +0100
+@@ -61,7 +61,18 @@
typedef struct Cipher Cipher;
typedef struct CipherContext CipherContext;
@@ -258,6 +248,8 @@ diff -up openssh-5.9p1/cipher.h.audit3 openssh-5.9p1/cipher.h
+ int number; /* for ssh1 only */
+ u_int block_size;
+ u_int key_len;
++ u_int iv_len; /* defaults to block_size */
++ u_int auth_len;
+ u_int discard_len;
+ u_int cbc_mode;
+ const EVP_CIPHER *(*evptype)(void);
@@ -265,10 +257,10 @@ diff -up openssh-5.9p1/cipher.h.audit3 openssh-5.9p1/cipher.h
+
struct CipherContext {
int plaintext;
- EVP_CIPHER_CTX evp;
-diff -up openssh-5.9p1/kex.c.audit3 openssh-5.9p1/kex.c
---- openssh-5.9p1/kex.c.audit3 2010-09-24 14:11:14.000000000 +0200
-+++ openssh-5.9p1/kex.c 2011-09-14 07:05:59.171457800 +0200
+ int encrypt;
+diff -up openssh-6.2p1/kex.c.audit3 openssh-6.2p1/kex.c
+--- openssh-6.2p1/kex.c.audit3 2013-01-09 06:12:19.000000000 +0100
++++ openssh-6.2p1/kex.c 2013-03-25 17:33:40.352129450 +0100
@@ -49,6 +49,7 @@
#include "dispatch.h"
#include "monitor.h"
@@ -277,7 +269,7 @@ diff -up openssh-5.9p1/kex.c.audit3 openssh-5.9p1/kex.c
#if OPENSSL_VERSION_NUMBER >= 0x00907000L
# if defined(HAVE_EVP_SHA256)
-@@ -286,9 +287,13 @@ static void
+@@ -296,9 +297,13 @@ static void
choose_enc(Enc *enc, char *client, char *server)
{
char *name = match_list(client, server, NULL);
@@ -292,7 +284,7 @@ diff -up openssh-5.9p1/kex.c.audit3 openssh-5.9p1/kex.c
if ((enc->cipher = cipher_by_name(name)) == NULL)
fatal("matching cipher is not supported: %s", name);
enc->name = name;
-@@ -303,9 +308,13 @@ static void
+@@ -314,9 +319,13 @@ static void
choose_mac(Mac *mac, char *client, char *server)
{
char *name = match_list(client, server, NULL);
@@ -307,7 +299,7 @@ diff -up openssh-5.9p1/kex.c.audit3 openssh-5.9p1/kex.c
if (mac_setup(mac, name) < 0)
fatal("unsupported mac %s", name);
/* truncate the key */
-@@ -320,8 +329,12 @@ static void
+@@ -331,8 +340,12 @@ static void
choose_comp(Comp *comp, char *client, char *server)
{
char *name = match_list(client, server, NULL);
@@ -321,9 +313,9 @@ diff -up openssh-5.9p1/kex.c.audit3 openssh-5.9p1/kex.c
if (strcmp(name, "zlib at openssh.com") == 0) {
comp->type = COMP_DELAYED;
} else if (strcmp(name, "zlib") == 0) {
-@@ -446,6 +459,9 @@ kex_choose_conf(Kex *kex)
+@@ -460,6 +473,9 @@ kex_choose_conf(Kex *kex)
newkeys->enc.name,
- newkeys->mac.name,
+ authlen == 0 ? newkeys->mac.name : "<implicit>",
newkeys->comp.name);
+#ifdef SSH_AUDIT_EVENTS
+ audit_kex(ctos, newkeys->enc.name, newkeys->mac.name, newkeys->comp.name);
@@ -331,9 +323,21 @@ diff -up openssh-5.9p1/kex.c.audit3 openssh-5.9p1/kex.c
}
choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]);
choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS],
-diff -up openssh-5.9p1/monitor.c.audit3 openssh-5.9p1/monitor.c
---- openssh-5.9p1/monitor.c.audit3 2011-09-14 07:05:57.952459820 +0200
-+++ openssh-5.9p1/monitor.c 2011-09-14 07:05:59.272520466 +0200
+diff -up openssh-6.2p1/Makefile.in.audit3 openssh-6.2p1/Makefile.in
+--- openssh-6.2p1/Makefile.in.audit3 2013-03-25 17:30:41.337102676 +0100
++++ openssh-6.2p1/Makefile.in 2013-03-25 17:33:18.833004685 +0100
+@@ -73,7 +73,7 @@ LIBSSH_OBJS=authfd.o authfile.o bufaux.o
+ monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o \
+ kexdh.o kexgex.o kexdhc.o kexgexc.o bufec.o kexecdh.o kexecdhc.o \
+ msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \
+- jpake.o schnorr.o ssh-pkcs11.o krl.o
++ jpake.o schnorr.o ssh-pkcs11.o krl.o auditstub.o
+
+ SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
+ sshconnect.o sshconnect1.o sshconnect2.o mux.o \
+diff -up openssh-6.2p1/monitor.c.audit3 openssh-6.2p1/monitor.c
+--- openssh-6.2p1/monitor.c.audit3 2013-03-25 17:30:41.333102653 +0100
++++ openssh-6.2p1/monitor.c 2013-03-25 17:30:41.344102717 +0100
@@ -97,6 +97,7 @@
#include "ssh2.h"
#include "jpake.h"
@@ -342,7 +346,7 @@ diff -up openssh-5.9p1/monitor.c.audit3 openssh-5.9p1/monitor.c
#ifdef GSSAPI
static Gssctxt *gsscontext = NULL;
-@@ -187,6 +188,8 @@ int mm_answer_gss_checkmic(int, Buffer *
+@@ -186,6 +187,8 @@ int mm_answer_gss_checkmic(int, Buffer *
int mm_answer_audit_event(int, Buffer *);
int mm_answer_audit_command(int, Buffer *);
int mm_answer_audit_end_command(int, Buffer *);
@@ -360,7 +364,7 @@ diff -up openssh-5.9p1/monitor.c.audit3 openssh-5.9p1/monitor.c
#endif
#ifdef BSD_AUTH
{MONITOR_REQ_BSDAUTHQUERY, MON_ISAUTH, mm_answer_bsdauthquery},
-@@ -275,6 +280,8 @@ struct mon_table mon_dispatch_postauth20
+@@ -274,6 +279,8 @@ struct mon_table mon_dispatch_postauth20
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
{MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT, mm_answer_audit_command},
{MONITOR_REQ_AUDIT_END_COMMAND, MON_PERMIT, mm_answer_audit_end_command},
@@ -369,7 +373,7 @@ diff -up openssh-5.9p1/monitor.c.audit3 openssh-5.9p1/monitor.c
#endif
{0, 0, NULL}
};
-@@ -306,6 +313,8 @@ struct mon_table mon_dispatch_proto15[]
+@@ -305,6 +312,8 @@ struct mon_table mon_dispatch_proto15[]
#endif
#ifdef SSH_AUDIT_EVENTS
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
@@ -378,7 +382,7 @@ diff -up openssh-5.9p1/monitor.c.audit3 openssh-5.9p1/monitor.c
#endif
{0, 0, NULL}
};
-@@ -318,6 +327,8 @@ struct mon_table mon_dispatch_postauth15
+@@ -317,6 +326,8 @@ struct mon_table mon_dispatch_postauth15
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
{MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT|MON_ONCE, mm_answer_audit_command},
{MONITOR_REQ_AUDIT_END_COMMAND, MON_PERMIT, mm_answer_audit_end_command},
@@ -387,7 +391,7 @@ diff -up openssh-5.9p1/monitor.c.audit3 openssh-5.9p1/monitor.c
#endif
{0, 0, NULL}
};
-@@ -2383,3 +2394,47 @@ mm_answer_jpake_check_confirm(int sock,
+@@ -2397,3 +2408,47 @@ mm_answer_jpake_check_confirm(int sock,
}
#endif /* JPAKE */
@@ -435,22 +439,24 @@ diff -up openssh-5.9p1/monitor.c.audit3 openssh-5.9p1/monitor.c
+}
+
+#endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-5.9p1/monitor.h.audit3 openssh-5.9p1/monitor.h
---- openssh-5.9p1/monitor.h.audit3 2011-09-14 07:05:55.510580908 +0200
-+++ openssh-5.9p1/monitor.h 2011-09-14 07:05:59.378647273 +0200
-@@ -61,6 +61,8 @@ enum monitor_reqtype {
- MONITOR_REQ_PAM_FREE_CTX, MONITOR_ANS_PAM_FREE_CTX,
- MONITOR_REQ_AUDIT_EVENT, MONITOR_REQ_AUDIT_COMMAND,
- MONITOR_ANS_AUDIT_COMMAND, MONITOR_REQ_AUDIT_END_COMMAND,
-+ MONITOR_REQ_AUDIT_UNSUPPORTED, MONITOR_ANS_AUDIT_UNSUPPORTED,
-+ MONITOR_REQ_AUDIT_KEX, MONITOR_ANS_AUDIT_KEX,
- MONITOR_REQ_TERM,
- MONITOR_REQ_JPAKE_STEP1, MONITOR_ANS_JPAKE_STEP1,
- MONITOR_REQ_JPAKE_GET_PWDATA, MONITOR_ANS_JPAKE_GET_PWDATA,
-diff -up openssh-5.9p1/monitor_wrap.c.audit3 openssh-5.9p1/monitor_wrap.c
---- openssh-5.9p1/monitor_wrap.c.audit3 2011-09-14 07:05:58.059501118 +0200
-+++ openssh-5.9p1/monitor_wrap.c 2011-09-14 07:05:59.511503364 +0200
-@@ -1505,3 +1505,41 @@ mm_jpake_check_confirm(const BIGNUM *k,
+diff -up openssh-6.2p1/monitor.h.audit3 openssh-6.2p1/monitor.h
+--- openssh-6.2p1/monitor.h.audit3 2013-03-25 17:30:41.345102722 +0100
++++ openssh-6.2p1/monitor.h 2013-03-25 17:31:57.314538661 +0100
+@@ -70,7 +70,9 @@ enum monitor_reqtype {
+ MONITOR_REQ_PAM_FREE_CTX = 110, MONITOR_ANS_PAM_FREE_CTX = 111,
+ MONITOR_REQ_AUDIT_EVENT = 112,
+ MONITOR_REQ_AUDIT_COMMAND = 114, MONITOR_ANS_AUDIT_COMMAND = 115,
+- MONITOR_REQ_AUDIT_END_COMMAND = 116
++ MONITOR_REQ_AUDIT_END_COMMAND = 116,
++ MONITOR_REQ_AUDIT_UNSUPPORTED = 118, MONITOR_ANS_AUDIT_UNSUPPORTED = 119,
++ MONITOR_REQ_AUDIT_KEX = 120, MONITOR_ANS_AUDIT_KEX = 121
+
+ };
+
+diff -up openssh-6.2p1/monitor_wrap.c.audit3 openssh-6.2p1/monitor_wrap.c
+--- openssh-6.2p1/monitor_wrap.c.audit3 2013-03-25 17:30:41.334102659 +0100
++++ openssh-6.2p1/monitor_wrap.c 2013-03-25 17:30:41.346102728 +0100
+@@ -1486,3 +1486,41 @@ mm_jpake_check_confirm(const BIGNUM *k,
return success;
}
#endif /* JPAKE */
@@ -492,10 +498,10 @@ diff -up openssh-5.9p1/monitor_wrap.c.audit3 openssh-5.9p1/monitor_wrap.c
+ buffer_free(&m);
+}
+#endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-5.9p1/monitor_wrap.h.audit3 openssh-5.9p1/monitor_wrap.h
---- openssh-5.9p1/monitor_wrap.h.audit3 2011-09-14 07:05:58.171521245 +0200
-+++ openssh-5.9p1/monitor_wrap.h 2011-09-14 07:05:59.624646515 +0200
-@@ -78,6 +78,8 @@ void mm_sshpam_free_ctx(void *);
+diff -up openssh-6.2p1/monitor_wrap.h.audit3 openssh-6.2p1/monitor_wrap.h
+--- openssh-6.2p1/monitor_wrap.h.audit3 2013-03-25 17:30:41.334102659 +0100
++++ openssh-6.2p1/monitor_wrap.h 2013-03-25 17:30:41.346102728 +0100
+@@ -77,6 +77,8 @@ void mm_sshpam_free_ctx(void *);
void mm_audit_event(ssh_audit_event_t);
int mm_audit_run_command(const char *);
void mm_audit_end_command(int, const char *);
@@ -504,9 +510,9 @@ diff -up openssh-5.9p1/monitor_wrap.h.audit3 openssh-5.9p1/monitor_wrap.h
#endif
struct Session;
-diff -up openssh-5.9p1/sshd.c.audit3 openssh-5.9p1/sshd.c
---- openssh-5.9p1/sshd.c.audit3 2011-09-14 07:05:56.554583874 +0200
-+++ openssh-5.9p1/sshd.c 2011-09-14 07:05:59.828466112 +0200
+diff -up openssh-6.2p1/sshd.c.audit3 openssh-6.2p1/sshd.c
+--- openssh-6.2p1/sshd.c.audit3 2013-03-25 17:30:41.326102613 +0100
++++ openssh-6.2p1/sshd.c 2013-03-25 17:30:41.348102740 +0100
@@ -118,6 +118,7 @@
#endif
#include "monitor_wrap.h"
@@ -515,7 +521,7 @@ diff -up openssh-5.9p1/sshd.c.audit3 openssh-5.9p1/sshd.c
#include "ssh-sandbox.h"
#include "version.h"
-@@ -2209,6 +2210,10 @@ do_ssh1_kex(void)
+@@ -2241,6 +2242,10 @@ do_ssh1_kex(void)
if (cookie[i] != packet_get_char())
packet_disconnect("IP Spoofing check bytes do not match.");
diff --git a/openssh-6.1p1-audit4.patch b/openssh-6.2p1-audit4.patch
similarity index 74%
rename from openssh-6.1p1-audit4.patch
rename to openssh-6.2p1-audit4.patch
index 4f7abac..0469828 100644
--- a/openssh-6.1p1-audit4.patch
+++ b/openssh-6.2p1-audit4.patch
@@ -1,6 +1,6 @@
-diff -up openssh-6.1p1/audit-bsm.c.audit4 openssh-6.1p1/audit-bsm.c
---- openssh-6.1p1/audit-bsm.c.audit4 2012-11-28 14:20:38.990185823 +0100
-+++ openssh-6.1p1/audit-bsm.c 2012-11-28 14:20:38.995185800 +0100
+diff -up openssh-6.2p1/audit-bsm.c.audit4 openssh-6.2p1/audit-bsm.c
+--- openssh-6.2p1/audit-bsm.c.audit4 2013-03-25 17:34:16.034337746 +0100
++++ openssh-6.2p1/audit-bsm.c 2013-03-25 17:34:16.042337793 +0100
@@ -485,4 +485,10 @@ audit_kex_body(int ctos, char *enc, char
{
/* not implemented */
@@ -12,9 +12,9 @@ diff -up openssh-6.1p1/audit-bsm.c.audit4 openssh-6.1p1/audit-bsm.c
+ /* not implemented */
+}
#endif /* BSM */
-diff -up openssh-6.1p1/audit.c.audit4 openssh-6.1p1/audit.c
---- openssh-6.1p1/audit.c.audit4 2012-11-28 14:20:38.990185823 +0100
-+++ openssh-6.1p1/audit.c 2012-11-28 14:20:38.995185800 +0100
+diff -up openssh-6.2p1/audit.c.audit4 openssh-6.2p1/audit.c
+--- openssh-6.2p1/audit.c.audit4 2013-03-25 17:34:16.035337752 +0100
++++ openssh-6.2p1/audit.c 2013-03-25 17:34:16.042337793 +0100
@@ -143,6 +143,12 @@ audit_kex(int ctos, char *enc, char *mac
PRIVSEP(audit_kex_body(ctos, enc, mac, comp, getpid(), getuid()));
}
@@ -44,9 +44,9 @@ diff -up openssh-6.1p1/audit.c.audit4 openssh-6.1p1/audit.c
+}
# endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */
#endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-6.1p1/audit.h.audit4 openssh-6.1p1/audit.h
---- openssh-6.1p1/audit.h.audit4 2012-11-28 14:20:38.990185823 +0100
-+++ openssh-6.1p1/audit.h 2012-11-28 14:20:38.995185800 +0100
+diff -up openssh-6.2p1/audit.h.audit4 openssh-6.2p1/audit.h
+--- openssh-6.2p1/audit.h.audit4 2013-03-25 17:34:16.035337752 +0100
++++ openssh-6.2p1/audit.h 2013-03-25 17:34:16.043337799 +0100
@@ -62,5 +62,7 @@ void audit_unsupported(int);
void audit_kex(int, char *, char *, char *);
void audit_unsupported_body(int);
@@ -55,9 +55,9 @@ diff -up openssh-6.1p1/audit.h.audit4 openssh-6.1p1/audit.h
+void audit_session_key_free_body(int ctos, pid_t, uid_t);
#endif /* _SSH_AUDIT_H */
-diff -up openssh-6.1p1/audit-linux.c.audit4 openssh-6.1p1/audit-linux.c
---- openssh-6.1p1/audit-linux.c.audit4 2012-11-28 14:20:38.990185823 +0100
-+++ openssh-6.1p1/audit-linux.c 2012-11-28 14:20:38.995185800 +0100
+diff -up openssh-6.2p1/audit-linux.c.audit4 openssh-6.2p1/audit-linux.c
+--- openssh-6.2p1/audit-linux.c.audit4 2013-03-25 17:34:16.035337752 +0100
++++ openssh-6.2p1/audit-linux.c 2013-03-25 17:34:16.043337799 +0100
@@ -294,6 +294,8 @@ audit_unsupported_body(int what)
#endif
}
@@ -108,9 +108,9 @@ diff -up openssh-6.1p1/audit-linux.c.audit4 openssh-6.1p1/audit-linux.c
+}
+
#endif /* USE_LINUX_AUDIT */
-diff -up openssh-6.1p1/auditstub.c.audit4 openssh-6.1p1/auditstub.c
---- openssh-6.1p1/auditstub.c.audit4 2012-11-28 14:20:38.990185823 +0100
-+++ openssh-6.1p1/auditstub.c 2012-11-28 14:20:38.995185800 +0100
+diff -up openssh-6.2p1/auditstub.c.audit4 openssh-6.2p1/auditstub.c
+--- openssh-6.2p1/auditstub.c.audit4 2013-03-25 17:34:16.035337752 +0100
++++ openssh-6.2p1/auditstub.c 2013-03-25 17:34:16.043337799 +0100
@@ -27,6 +27,8 @@
* Red Hat author: Jan F. Chadima <jchadima at redhat.com>
*/
@@ -133,10 +133,10 @@ diff -up openssh-6.1p1/auditstub.c.audit4 openssh-6.1p1/auditstub.c
+audit_session_key_free_body(int ctos, pid_t pid, uid_t uid)
+{
+}
-diff -up openssh-6.1p1/kex.c.audit4 openssh-6.1p1/kex.c
---- openssh-6.1p1/kex.c.audit4 2012-11-28 14:20:38.991185818 +0100
-+++ openssh-6.1p1/kex.c 2012-11-28 14:20:38.995185800 +0100
-@@ -624,3 +624,34 @@ dump_digest(char *msg, u_char *digest, i
+diff -up openssh-6.2p1/kex.c.audit4 openssh-6.2p1/kex.c
+--- openssh-6.2p1/kex.c.audit4 2013-03-25 17:34:16.036337758 +0100
++++ openssh-6.2p1/kex.c 2013-03-25 17:34:16.044337804 +0100
+@@ -640,3 +640,34 @@ dump_digest(char *msg, u_char *digest, i
fprintf(stderr, "\n");
}
#endif
@@ -171,10 +171,10 @@ diff -up openssh-6.1p1/kex.c.audit4 openssh-6.1p1/kex.c
+ memset(&newkeys->comp, 0, sizeof(newkeys->comp));
+}
+
-diff -up openssh-6.1p1/kex.h.audit4 openssh-6.1p1/kex.h
---- openssh-6.1p1/kex.h.audit4 2010-09-24 14:11:14.000000000 +0200
-+++ openssh-6.1p1/kex.h 2012-11-28 14:20:38.996185795 +0100
-@@ -156,6 +156,8 @@ void kexgex_server(Kex *);
+diff -up openssh-6.2p1/kex.h.audit4 openssh-6.2p1/kex.h
+--- openssh-6.2p1/kex.h.audit4 2013-01-09 06:12:19.000000000 +0100
++++ openssh-6.2p1/kex.h 2013-03-25 17:34:16.044337804 +0100
+@@ -158,6 +158,8 @@ void kexgex_server(Kex *);
void kexecdh_client(Kex *);
void kexecdh_server(Kex *);
@@ -183,10 +183,10 @@ diff -up openssh-6.1p1/kex.h.audit4 openssh-6.1p1/kex.h
void
kex_dh_hash(char *, char *, char *, int, char *, int, u_char *, int,
BIGNUM *, BIGNUM *, BIGNUM *, u_char **, u_int *);
-diff -up openssh-6.1p1/mac.c.audit4 openssh-6.1p1/mac.c
---- openssh-6.1p1/mac.c.audit4 2012-06-30 00:34:59.000000000 +0200
-+++ openssh-6.1p1/mac.c 2012-11-28 14:20:38.996185795 +0100
-@@ -169,6 +169,20 @@ mac_clear(Mac *mac)
+diff -up openssh-6.2p1/mac.c.audit4 openssh-6.2p1/mac.c
+--- openssh-6.2p1/mac.c.audit4 2012-12-12 01:00:37.000000000 +0100
++++ openssh-6.2p1/mac.c 2013-03-25 17:34:16.044337804 +0100
+@@ -199,6 +199,20 @@ mac_clear(Mac *mac)
mac->umac_ctx = NULL;
}
@@ -207,17 +207,17 @@ diff -up openssh-6.1p1/mac.c.audit4 openssh-6.1p1/mac.c
/* XXX copied from ciphers_valid */
#define MAC_SEP ","
int
-diff -up openssh-6.1p1/mac.h.audit4 openssh-6.1p1/mac.h
---- openssh-6.1p1/mac.h.audit4 2007-06-11 06:01:42.000000000 +0200
-+++ openssh-6.1p1/mac.h 2012-11-28 14:20:38.996185795 +0100
+diff -up openssh-6.2p1/mac.h.audit4 openssh-6.2p1/mac.h
+--- openssh-6.2p1/mac.h.audit4 2007-06-11 06:01:42.000000000 +0200
++++ openssh-6.2p1/mac.h 2013-03-25 17:34:16.045337810 +0100
@@ -28,3 +28,4 @@ int mac_setup(Mac *, char *);
int mac_init(Mac *);
u_char *mac_compute(Mac *, u_int32_t, u_char *, int);
void mac_clear(Mac *);
+void mac_destroy(Mac *);
-diff -up openssh-6.1p1/monitor.c.audit4 openssh-6.1p1/monitor.c
---- openssh-6.1p1/monitor.c.audit4 2012-11-28 14:20:38.992185813 +0100
-+++ openssh-6.1p1/monitor.c 2012-11-28 17:02:17.677045093 +0100
+diff -up openssh-6.2p1/monitor.c.audit4 openssh-6.2p1/monitor.c
+--- openssh-6.2p1/monitor.c.audit4 2013-03-25 17:34:16.037337763 +0100
++++ openssh-6.2p1/monitor.c 2013-03-25 17:34:16.046337816 +0100
@@ -189,6 +189,7 @@ int mm_answer_audit_command(int, Buffer
int mm_answer_audit_end_command(int, Buffer *);
int mm_answer_audit_unsupported_body(int, Buffer *);
@@ -226,7 +226,7 @@ diff -up openssh-6.1p1/monitor.c.audit4 openssh-6.1p1/monitor.c
#endif
static int monitor_read_log(struct monitor *);
-@@ -241,6 +242,7 @@ struct mon_table mon_dispatch_proto20[]
+@@ -242,6 +243,7 @@ struct mon_table mon_dispatch_proto20[]
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
{MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},
{MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},
@@ -234,7 +234,7 @@ diff -up openssh-6.1p1/monitor.c.audit4 openssh-6.1p1/monitor.c
#endif
#ifdef BSD_AUTH
{MONITOR_REQ_BSDAUTHQUERY, MON_ISAUTH, mm_answer_bsdauthquery},
-@@ -280,6 +282,7 @@ struct mon_table mon_dispatch_postauth20
+@@ -281,6 +283,7 @@ struct mon_table mon_dispatch_postauth20
{MONITOR_REQ_AUDIT_END_COMMAND, MON_PERMIT, mm_answer_audit_end_command},
{MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},
{MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},
@@ -242,7 +242,7 @@ diff -up openssh-6.1p1/monitor.c.audit4 openssh-6.1p1/monitor.c
#endif
{0, 0, NULL}
};
-@@ -313,6 +316,7 @@ struct mon_table mon_dispatch_proto15[]
+@@ -314,6 +317,7 @@ struct mon_table mon_dispatch_proto15[]
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
{MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},
{MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},
@@ -250,7 +250,7 @@ diff -up openssh-6.1p1/monitor.c.audit4 openssh-6.1p1/monitor.c
#endif
{0, 0, NULL}
};
-@@ -327,6 +331,7 @@ struct mon_table mon_dispatch_postauth15
+@@ -328,6 +332,7 @@ struct mon_table mon_dispatch_postauth15
{MONITOR_REQ_AUDIT_END_COMMAND, MON_PERMIT, mm_answer_audit_end_command},
{MONITOR_REQ_AUDIT_UNSUPPORTED, MON_PERMIT, mm_answer_audit_unsupported_body},
{MONITOR_REQ_AUDIT_KEX, MON_PERMIT, mm_answer_audit_kex_body},
@@ -258,18 +258,7 @@ diff -up openssh-6.1p1/monitor.c.audit4 openssh-6.1p1/monitor.c
#endif
{0, 0, NULL}
};
-@@ -448,10 +453,6 @@ monitor_child_preauth(Authctxt *_authctx
- #endif
- }
-
-- /* Drain any buffered messages from the child */
-- while (pmonitor->m_log_recvfd >= 0 && monitor_read_log(pmonitor) == 0)
-- ;
--
- if (!authctxt->valid)
- fatal("%s: authenticated invalid user", __func__);
- if (strcmp(auth_method, "unknown") == 0)
-@@ -1950,11 +1951,13 @@ mm_get_keystate(struct monitor *pmonitor
+@@ -1957,11 +1962,13 @@ mm_get_keystate(struct monitor *pmonitor
blob = buffer_get_string(&m, &bloblen);
current_keys[MODE_OUT] = mm_newkeys_from_blob(blob, bloblen);
@@ -283,7 +272,7 @@ diff -up openssh-6.1p1/monitor.c.audit4 openssh-6.1p1/monitor.c
xfree(blob);
/* Now get sequence numbers for the packets */
-@@ -2000,6 +2003,21 @@ mm_get_keystate(struct monitor *pmonitor
+@@ -2007,6 +2014,21 @@ mm_get_keystate(struct monitor *pmonitor
}
buffer_free(&m);
@@ -305,7 +294,7 @@ diff -up openssh-6.1p1/monitor.c.audit4 openssh-6.1p1/monitor.c
}
-@@ -2444,4 +2462,22 @@ mm_answer_audit_kex_body(int sock, Buffe
+@@ -2451,4 +2473,22 @@ mm_answer_audit_kex_body(int sock, Buffe
return 0;
}
@@ -328,21 +317,23 @@ diff -up openssh-6.1p1/monitor.c.audit4 openssh-6.1p1/monitor.c
+ return 0;
+}
#endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-6.1p1/monitor.h.audit4 openssh-6.1p1/monitor.h
---- openssh-6.1p1/monitor.h.audit4 2012-11-28 14:20:38.992185813 +0100
-+++ openssh-6.1p1/monitor.h 2012-11-28 14:20:38.997185790 +0100
-@@ -63,6 +63,7 @@ enum monitor_reqtype {
- MONITOR_ANS_AUDIT_COMMAND, MONITOR_REQ_AUDIT_END_COMMAND,
- MONITOR_REQ_AUDIT_UNSUPPORTED, MONITOR_ANS_AUDIT_UNSUPPORTED,
- MONITOR_REQ_AUDIT_KEX, MONITOR_ANS_AUDIT_KEX,
-+ MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MONITOR_ANS_AUDIT_SESSION_KEY_FREE,
- MONITOR_REQ_TERM,
- MONITOR_REQ_JPAKE_STEP1, MONITOR_ANS_JPAKE_STEP1,
- MONITOR_REQ_JPAKE_GET_PWDATA, MONITOR_ANS_JPAKE_GET_PWDATA,
-diff -up openssh-6.1p1/monitor_wrap.c.audit4 openssh-6.1p1/monitor_wrap.c
---- openssh-6.1p1/monitor_wrap.c.audit4 2012-11-28 14:20:38.992185813 +0100
-+++ openssh-6.1p1/monitor_wrap.c 2012-11-28 14:20:38.997185790 +0100
-@@ -653,12 +653,14 @@ mm_send_keystate(struct monitor *monitor
+diff -up openssh-6.2p1/monitor.h.audit4 openssh-6.2p1/monitor.h
+--- openssh-6.2p1/monitor.h.audit4 2013-03-25 17:34:16.046337816 +0100
++++ openssh-6.2p1/monitor.h 2013-03-25 17:35:01.408602217 +0100
+@@ -72,7 +72,8 @@ enum monitor_reqtype {
+ MONITOR_REQ_AUDIT_COMMAND = 114, MONITOR_ANS_AUDIT_COMMAND = 115,
+ MONITOR_REQ_AUDIT_END_COMMAND = 116,
+ MONITOR_REQ_AUDIT_UNSUPPORTED = 118, MONITOR_ANS_AUDIT_UNSUPPORTED = 119,
+- MONITOR_REQ_AUDIT_KEX = 120, MONITOR_ANS_AUDIT_KEX = 121
++ MONITOR_REQ_AUDIT_KEX = 120, MONITOR_ANS_AUDIT_KEX = 121,
++ MONITOR_REQ_AUDIT_SESSION_KEY_FREE = 122, MONITOR_ANS_AUDIT_SESSION_KEY_FREE = 123
+
+ };
+
+diff -up openssh-6.2p1/monitor_wrap.c.audit4 openssh-6.2p1/monitor_wrap.c
+--- openssh-6.2p1/monitor_wrap.c.audit4 2013-03-25 17:34:16.038337769 +0100
++++ openssh-6.2p1/monitor_wrap.c 2013-03-25 17:34:16.047337822 +0100
+@@ -654,12 +654,14 @@ mm_send_keystate(struct monitor *monitor
fatal("%s: conversion of newkeys failed", __func__);
buffer_put_string(&m, blob, bloblen);
@@ -357,7 +348,7 @@ diff -up openssh-6.1p1/monitor_wrap.c.audit4 openssh-6.1p1/monitor_wrap.c
xfree(blob);
packet_get_state(MODE_OUT, &seqnr, &blocks, &packets, &bytes);
-@@ -1522,4 +1524,19 @@ mm_audit_kex_body(int ctos, char *cipher
+@@ -1523,4 +1525,19 @@ mm_audit_kex_body(int ctos, char *cipher
buffer_free(&m);
}
@@ -377,9 +368,9 @@ diff -up openssh-6.1p1/monitor_wrap.c.audit4 openssh-6.1p1/monitor_wrap.c
+ buffer_free(&m);
+}
#endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-6.1p1/monitor_wrap.h.audit4 openssh-6.1p1/monitor_wrap.h
---- openssh-6.1p1/monitor_wrap.h.audit4 2012-11-28 14:20:38.992185813 +0100
-+++ openssh-6.1p1/monitor_wrap.h 2012-11-28 14:20:38.997185790 +0100
+diff -up openssh-6.2p1/monitor_wrap.h.audit4 openssh-6.2p1/monitor_wrap.h
+--- openssh-6.2p1/monitor_wrap.h.audit4 2013-03-25 17:34:16.039337775 +0100
++++ openssh-6.2p1/monitor_wrap.h 2013-03-25 17:34:16.047337822 +0100
@@ -79,6 +79,7 @@ int mm_audit_run_command(const char *);
void mm_audit_end_command(int, const char *);
void mm_audit_unsupported_body(int);
@@ -388,9 +379,9 @@ diff -up openssh-6.1p1/monitor_wrap.h.audit4 openssh-6.1p1/monitor_wrap.h
#endif
struct Session;
-diff -up openssh-6.1p1/packet.c.audit4 openssh-6.1p1/packet.c
---- openssh-6.1p1/packet.c.audit4 2012-11-28 14:20:38.973185902 +0100
-+++ openssh-6.1p1/packet.c 2012-11-28 14:20:38.998185785 +0100
+diff -up openssh-6.2p1/packet.c.audit4 openssh-6.2p1/packet.c
+--- openssh-6.2p1/packet.c.audit4 2013-03-25 17:34:16.014337629 +0100
++++ openssh-6.2p1/packet.c 2013-03-25 17:42:26.519176337 +0100
@@ -60,6 +60,7 @@
#include <signal.h>
@@ -472,7 +463,7 @@ diff -up openssh-6.1p1/packet.c.audit4 openssh-6.1p1/packet.c
void
set_newkeys(int mode)
{
-@@ -754,18 +782,9 @@ set_newkeys(int mode)
+@@ -754,21 +782,9 @@ set_newkeys(int mode)
}
if (active_state->newkeys[mode] != NULL) {
debug("set_newkeys: rekeying");
@@ -482,6 +473,9 @@ diff -up openssh-6.1p1/packet.c.audit4 openssh-6.1p1/packet.c
- mac = &active_state->newkeys[mode]->mac;
- comp = &active_state->newkeys[mode]->comp;
- mac_clear(mac);
+- memset(enc->iv, 0, enc->iv_len);
+- memset(enc->key, 0, enc->key_len);
+- memset(mac->key, 0, mac->key_len);
- xfree(enc->name);
- xfree(enc->iv);
- xfree(enc->key);
@@ -493,7 +487,7 @@ diff -up openssh-6.1p1/packet.c.audit4 openssh-6.1p1/packet.c
}
active_state->newkeys[mode] = kex_get_newkeys(mode);
if (active_state->newkeys[mode] == NULL)
-@@ -1921,6 +1940,47 @@ packet_get_newkeys(int mode)
+@@ -1971,6 +1987,47 @@ packet_get_newkeys(int mode)
return (void *)active_state->newkeys[mode];
}
@@ -541,7 +535,7 @@ diff -up openssh-6.1p1/packet.c.audit4 openssh-6.1p1/packet.c
/*
* Save the state for the real connection, and use a separate state when
* resuming a suspended connection.
-@@ -1928,18 +1988,12 @@ packet_get_newkeys(int mode)
+@@ -1978,18 +2035,12 @@ packet_get_newkeys(int mode)
void
packet_backup_state(void)
{
@@ -561,7 +555,7 @@ diff -up openssh-6.1p1/packet.c.audit4 openssh-6.1p1/packet.c
}
/*
-@@ -1956,9 +2010,7 @@ packet_restore_state(void)
+@@ -2006,9 +2057,7 @@ packet_restore_state(void)
backup_state = active_state;
active_state = tmp;
active_state->connection_in = backup_state->connection_in;
@@ -571,7 +565,7 @@ diff -up openssh-6.1p1/packet.c.audit4 openssh-6.1p1/packet.c
len = buffer_len(&backup_state->input);
if (len > 0) {
buf = buffer_ptr(&backup_state->input);
-@@ -1966,4 +2018,10 @@ packet_restore_state(void)
+@@ -2016,4 +2065,10 @@ packet_restore_state(void)
buffer_clear(&backup_state->input);
add_recv_bytes(len);
}
@@ -582,19 +576,19 @@ diff -up openssh-6.1p1/packet.c.audit4 openssh-6.1p1/packet.c
+ backup_state = NULL;
}
+
-diff -up openssh-6.1p1/packet.h.audit4 openssh-6.1p1/packet.h
---- openssh-6.1p1/packet.h.audit4 2012-02-10 22:19:21.000000000 +0100
-+++ openssh-6.1p1/packet.h 2012-11-28 14:20:38.998185785 +0100
+diff -up openssh-6.2p1/packet.h.audit4 openssh-6.2p1/packet.h
+--- openssh-6.2p1/packet.h.audit4 2012-02-10 22:19:21.000000000 +0100
++++ openssh-6.2p1/packet.h 2013-03-25 17:34:16.049337834 +0100
@@ -123,4 +123,5 @@ void packet_restore_state(void);
void *packet_get_input(void);
void *packet_get_output(void);
+void packet_destroy_all(int, int);
#endif /* PACKET_H */
-diff -up openssh-6.1p1/session.c.audit4 openssh-6.1p1/session.c
---- openssh-6.1p1/session.c.audit4 2012-11-28 14:20:38.983185855 +0100
-+++ openssh-6.1p1/session.c 2012-11-28 14:20:38.998185785 +0100
-@@ -1634,6 +1634,9 @@ do_child(Session *s, const char *command
+diff -up openssh-6.2p1/session.c.audit4 openssh-6.2p1/session.c
+--- openssh-6.2p1/session.c.audit4 2013-03-25 17:34:16.023337682 +0100
++++ openssh-6.2p1/session.c 2013-03-25 17:34:16.050337839 +0100
+@@ -1642,6 +1642,9 @@ do_child(Session *s, const char *command
/* remove hostkey from the child's memory */
destroy_sensitive_data();
@@ -604,10 +598,10 @@ diff -up openssh-6.1p1/session.c.audit4 openssh-6.1p1/session.c
/* Force a password change */
if (s->authctxt->force_pwchange) {
-diff -up openssh-6.1p1/sshd.c.audit4 openssh-6.1p1/sshd.c
---- openssh-6.1p1/sshd.c.audit4 2012-11-28 14:20:38.993185808 +0100
-+++ openssh-6.1p1/sshd.c 2012-11-28 14:20:38.999185780 +0100
-@@ -692,6 +692,8 @@ privsep_preauth(Authctxt *authctxt)
+diff -up openssh-6.2p1/sshd.c.audit4 openssh-6.2p1/sshd.c
+--- openssh-6.2p1/sshd.c.audit4 2013-03-25 17:34:16.039337775 +0100
++++ openssh-6.2p1/sshd.c 2013-03-25 17:34:16.050337839 +0100
+@@ -701,6 +701,8 @@ privsep_preauth(Authctxt *authctxt)
}
}
@@ -616,7 +610,7 @@ diff -up openssh-6.1p1/sshd.c.audit4 openssh-6.1p1/sshd.c
static void
privsep_postauth(Authctxt *authctxt)
{
-@@ -716,6 +718,10 @@ privsep_postauth(Authctxt *authctxt)
+@@ -725,6 +727,10 @@ privsep_postauth(Authctxt *authctxt)
else if (pmonitor->m_pid != 0) {
verbose("User child is on pid %ld", (long)pmonitor->m_pid);
buffer_clear(&loginmsg);
@@ -627,7 +621,7 @@ diff -up openssh-6.1p1/sshd.c.audit4 openssh-6.1p1/sshd.c
monitor_child_postauth(pmonitor);
/* NEVERREACHED */
-@@ -2016,6 +2022,7 @@ main(int ac, char **av)
+@@ -2033,6 +2039,7 @@ main(int ac, char **av)
*/
if (use_privsep) {
mm_send_keystate(pmonitor);
@@ -635,7 +629,7 @@ diff -up openssh-6.1p1/sshd.c.audit4 openssh-6.1p1/sshd.c
exit(0);
}
-@@ -2068,6 +2075,8 @@ main(int ac, char **av)
+@@ -2085,6 +2092,8 @@ main(int ac, char **av)
do_authenticated(authctxt);
/* The connection has been terminated. */
@@ -644,7 +638,7 @@ diff -up openssh-6.1p1/sshd.c.audit4 openssh-6.1p1/sshd.c
packet_get_state(MODE_IN, NULL, NULL, NULL, &ibytes);
packet_get_state(MODE_OUT, NULL, NULL, NULL, &obytes);
verbose("Transferred: sent %llu, received %llu bytes",
-@@ -2385,6 +2394,16 @@ do_ssh2_kex(void)
+@@ -2402,6 +2411,16 @@ do_ssh2_kex(void)
void
cleanup_exit(int i)
{
@@ -661,7 +655,7 @@ diff -up openssh-6.1p1/sshd.c.audit4 openssh-6.1p1/sshd.c
if (the_authctxt) {
do_cleanup(the_authctxt);
if (use_privsep && privsep_is_preauth && pmonitor->m_pid > 1) {
-@@ -2395,6 +2414,8 @@ cleanup_exit(int i)
+@@ -2412,6 +2431,8 @@ cleanup_exit(int i)
pmonitor->m_pid, strerror(errno));
}
}
diff --git a/openssh-6.0p1-audit5.patch b/openssh-6.2p1-audit5.patch
similarity index 77%
rename from openssh-6.0p1-audit5.patch
rename to openssh-6.2p1-audit5.patch
index 70aa3ff..6f212df 100644
--- a/openssh-6.0p1-audit5.patch
+++ b/openssh-6.2p1-audit5.patch
@@ -1,6 +1,6 @@
-diff -up openssh-6.0p1/audit-bsm.c.audit5 openssh-6.0p1/audit-bsm.c
---- openssh-6.0p1/audit-bsm.c.audit5 2012-08-06 20:37:50.036345216 +0200
-+++ openssh-6.0p1/audit-bsm.c 2012-08-06 20:37:50.046345177 +0200
+diff -up openssh-6.2p1/audit-bsm.c.audit5 openssh-6.2p1/audit-bsm.c
+--- openssh-6.2p1/audit-bsm.c.audit5 2013-03-25 17:43:27.495526587 +0100
++++ openssh-6.2p1/audit-bsm.c 2013-03-25 17:43:27.502526627 +0100
@@ -491,4 +491,22 @@ audit_session_key_free_body(int ctos, pi
{
/* not implemented */
@@ -24,9 +24,9 @@ diff -up openssh-6.0p1/audit-bsm.c.audit5 openssh-6.0p1/audit-bsm.c
+ /* not implemented */
+}
#endif /* BSM */
-diff -up openssh-6.0p1/audit.c.audit5 openssh-6.0p1/audit.c
---- openssh-6.0p1/audit.c.audit5 2012-08-06 20:37:50.036345216 +0200
-+++ openssh-6.0p1/audit.c 2012-08-06 20:37:50.047345173 +0200
+diff -up openssh-6.2p1/audit.c.audit5 openssh-6.2p1/audit.c
+--- openssh-6.2p1/audit.c.audit5 2013-03-25 17:43:27.495526587 +0100
++++ openssh-6.2p1/audit.c 2013-03-25 17:43:27.502526627 +0100
@@ -290,5 +290,24 @@ audit_session_key_free_body(int ctos, pi
debug("audit session key discard euid %u direction %d from pid %ld uid %u",
(unsigned)geteuid(), ctos, (long)pid, (unsigned)uid);
@@ -52,9 +52,9 @@ diff -up openssh-6.0p1/audit.c.audit5 openssh-6.0p1/audit.c
+}
# endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */
#endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-6.0p1/audit.h.audit5 openssh-6.0p1/audit.h
---- openssh-6.0p1/audit.h.audit5 2012-08-06 20:37:50.037345212 +0200
-+++ openssh-6.0p1/audit.h 2012-08-06 20:37:50.047345173 +0200
+diff -up openssh-6.2p1/audit.h.audit5 openssh-6.2p1/audit.h
+--- openssh-6.2p1/audit.h.audit5 2013-03-25 17:43:27.496526593 +0100
++++ openssh-6.2p1/audit.h 2013-03-25 17:43:27.502526627 +0100
@@ -48,6 +48,8 @@ enum ssh_audit_event_type {
};
typedef enum ssh_audit_event_type ssh_audit_event_t;
@@ -72,9 +72,9 @@ diff -up openssh-6.0p1/audit.h.audit5 openssh-6.0p1/audit.h
+void audit_generate_ephemeral_server_key(const char *);
#endif /* _SSH_AUDIT_H */
-diff -up openssh-6.0p1/audit-linux.c.audit5 openssh-6.0p1/audit-linux.c
---- openssh-6.0p1/audit-linux.c.audit5 2012-08-06 20:37:50.037345212 +0200
-+++ openssh-6.0p1/audit-linux.c 2012-08-06 20:37:50.046345177 +0200
+diff -up openssh-6.2p1/audit-linux.c.audit5 openssh-6.2p1/audit-linux.c
+--- openssh-6.2p1/audit-linux.c.audit5 2013-03-25 17:43:27.496526593 +0100
++++ openssh-6.2p1/audit-linux.c 2013-03-25 17:43:27.503526633 +0100
@@ -356,4 +356,50 @@ audit_session_key_free_body(int ctos, pi
error("cannot write into audit");
}
@@ -126,10 +126,10 @@ diff -up openssh-6.0p1/audit-linux.c.audit5 openssh-6.0p1/audit-linux.c
+ error("cannot write into audit");
+}
#endif /* USE_LINUX_AUDIT */
-diff -up openssh-6.0p1/key.c.audit5 openssh-6.0p1/key.c
---- openssh-6.0p1/key.c.audit5 2012-08-06 20:37:49.992345388 +0200
-+++ openssh-6.0p1/key.c 2012-08-06 20:37:50.048345169 +0200
-@@ -1794,6 +1794,30 @@ key_demote(const Key *k)
+diff -up openssh-6.2p1/key.c.audit5 openssh-6.2p1/key.c
+--- openssh-6.2p1/key.c.audit5 2013-03-25 17:43:27.465526415 +0100
++++ openssh-6.2p1/key.c 2013-03-25 17:43:27.503526633 +0100
+@@ -1809,6 +1809,30 @@ key_demote(const Key *k)
}
int
@@ -160,10 +160,10 @@ diff -up openssh-6.0p1/key.c.audit5 openssh-6.0p1/key.c
key_is_cert(const Key *k)
{
if (k == NULL)
-diff -up openssh-6.0p1/key.h.audit5 openssh-6.0p1/key.h
---- openssh-6.0p1/key.h.audit5 2012-08-06 20:37:49.993345384 +0200
-+++ openssh-6.0p1/key.h 2012-08-06 20:37:50.049345165 +0200
-@@ -109,6 +109,7 @@ Key *key_generate(int, u_int);
+diff -up openssh-6.2p1/key.h.audit5 openssh-6.2p1/key.h
+--- openssh-6.2p1/key.h.audit5 2013-03-25 17:43:27.465526415 +0100
++++ openssh-6.2p1/key.h 2013-03-25 17:43:27.503526633 +0100
+@@ -110,6 +110,7 @@ Key *key_generate(int, u_int);
Key *key_from_private(const Key *);
int key_type_from_name(char *);
int key_is_cert(const Key *);
@@ -171,9 +171,9 @@ diff -up openssh-6.0p1/key.h.audit5 openssh-6.0p1/key.h
int key_type_plain(int);
int key_to_certified(Key *, int);
int key_drop_cert(Key *);
-diff -up openssh-6.0p1/monitor.c.audit5 openssh-6.0p1/monitor.c
---- openssh-6.0p1/monitor.c.audit5 2012-08-06 20:37:50.040345200 +0200
-+++ openssh-6.0p1/monitor.c 2012-08-06 20:37:50.049345165 +0200
+diff -up openssh-6.2p1/monitor.c.audit5 openssh-6.2p1/monitor.c
+--- openssh-6.2p1/monitor.c.audit5 2013-03-25 17:43:27.497526599 +0100
++++ openssh-6.2p1/monitor.c 2013-03-25 17:43:27.504526639 +0100
@@ -114,6 +114,8 @@ extern Buffer auth_debug;
extern int auth_debug_init;
extern Buffer loginmsg;
@@ -223,7 +223,7 @@ diff -up openssh-6.0p1/monitor.c.audit5 openssh-6.0p1/monitor.c
#endif
{0, 0, NULL}
};
-@@ -1744,6 +1751,8 @@ mm_answer_term(int sock, Buffer *req)
+@@ -1752,6 +1759,8 @@ mm_answer_term(int sock, Buffer *req)
sshpam_cleanup();
#endif
@@ -232,7 +232,7 @@ diff -up openssh-6.0p1/monitor.c.audit5 openssh-6.0p1/monitor.c
while (waitpid(pmonitor->m_pid, &status, 0) == -1)
if (errno != EINTR)
exit(1);
-@@ -2485,4 +2494,25 @@ mm_answer_audit_session_key_free_body(in
+@@ -2491,4 +2500,25 @@ mm_answer_audit_session_key_free_body(in
mm_request_send(sock, MONITOR_ANS_AUDIT_SESSION_KEY_FREE, m);
return 0;
}
@@ -258,21 +258,23 @@ diff -up openssh-6.0p1/monitor.c.audit5 openssh-6.0p1/monitor.c
+ return 0;
+}
#endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-6.0p1/monitor.h.audit5 openssh-6.0p1/monitor.h
---- openssh-6.0p1/monitor.h.audit5 2012-08-06 20:37:50.040345200 +0200
-+++ openssh-6.0p1/monitor.h 2012-08-06 20:37:50.050345161 +0200
-@@ -64,6 +64,7 @@ enum monitor_reqtype {
- MONITOR_REQ_AUDIT_UNSUPPORTED, MONITOR_ANS_AUDIT_UNSUPPORTED,
- MONITOR_REQ_AUDIT_KEX, MONITOR_ANS_AUDIT_KEX,
- MONITOR_REQ_AUDIT_SESSION_KEY_FREE, MONITOR_ANS_AUDIT_SESSION_KEY_FREE,
-+ MONITOR_REQ_AUDIT_SERVER_KEY_FREE, MONITOR_ANS_AUDIT_SERVER_KEY_FREE,
- MONITOR_REQ_TERM,
- MONITOR_REQ_JPAKE_STEP1, MONITOR_ANS_JPAKE_STEP1,
- MONITOR_REQ_JPAKE_GET_PWDATA, MONITOR_ANS_JPAKE_GET_PWDATA,
-diff -up openssh-6.0p1/monitor_wrap.c.audit5 openssh-6.0p1/monitor_wrap.c
---- openssh-6.0p1/monitor_wrap.c.audit5 2012-08-06 20:37:50.041345196 +0200
-+++ openssh-6.0p1/monitor_wrap.c 2012-08-06 20:37:50.050345161 +0200
-@@ -1539,4 +1539,20 @@ mm_audit_session_key_free_body(int ctos,
+diff -up openssh-6.2p1/monitor.h.audit5 openssh-6.2p1/monitor.h
+--- openssh-6.2p1/monitor.h.audit5 2013-03-25 17:43:27.504526639 +0100
++++ openssh-6.2p1/monitor.h 2013-03-25 17:44:08.717763090 +0100
+@@ -73,7 +73,8 @@ enum monitor_reqtype {
+ MONITOR_REQ_AUDIT_END_COMMAND = 116,
+ MONITOR_REQ_AUDIT_UNSUPPORTED = 118, MONITOR_ANS_AUDIT_UNSUPPORTED = 119,
+ MONITOR_REQ_AUDIT_KEX = 120, MONITOR_ANS_AUDIT_KEX = 121,
+- MONITOR_REQ_AUDIT_SESSION_KEY_FREE = 122, MONITOR_ANS_AUDIT_SESSION_KEY_FREE = 123
++ MONITOR_REQ_AUDIT_SESSION_KEY_FREE = 122, MONITOR_ANS_AUDIT_SESSION_KEY_FREE = 123,
++ MONITOR_REQ_AUDIT_SERVER_KEY_FREE = 124, MONITOR_ANS_AUDIT_SERVER_KEY_FREE = 125
+
+ };
+
+diff -up openssh-6.2p1/monitor_wrap.c.audit5 openssh-6.2p1/monitor_wrap.c
+--- openssh-6.2p1/monitor_wrap.c.audit5 2013-03-25 17:43:27.498526604 +0100
++++ openssh-6.2p1/monitor_wrap.c 2013-03-25 17:43:27.505526645 +0100
+@@ -1540,4 +1540,20 @@ mm_audit_session_key_free_body(int ctos,
&m);
buffer_free(&m);
}
@@ -293,9 +295,9 @@ diff -up openssh-6.0p1/monitor_wrap.c.audit5 openssh-6.0p1/monitor_wrap.c
+ buffer_free(&m);
+}
#endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-6.0p1/monitor_wrap.h.audit5 openssh-6.0p1/monitor_wrap.h
---- openssh-6.0p1/monitor_wrap.h.audit5 2012-08-06 20:37:50.041345196 +0200
-+++ openssh-6.0p1/monitor_wrap.h 2012-08-06 20:37:50.051345157 +0200
+diff -up openssh-6.2p1/monitor_wrap.h.audit5 openssh-6.2p1/monitor_wrap.h
+--- openssh-6.2p1/monitor_wrap.h.audit5 2013-03-25 17:43:27.498526604 +0100
++++ openssh-6.2p1/monitor_wrap.h 2013-03-25 17:43:27.505526645 +0100
@@ -80,6 +80,7 @@ void mm_audit_end_command(int, const cha
void mm_audit_unsupported_body(int);
void mm_audit_kex_body(int, char *, char *, char *, pid_t, uid_t);
@@ -304,9 +306,9 @@ diff -up openssh-6.0p1/monitor_wrap.h.audit5 openssh-6.0p1/monitor_wrap.h
#endif
struct Session;
-diff -up openssh-6.0p1/session.c.audit5 openssh-6.0p1/session.c
---- openssh-6.0p1/session.c.audit5 2012-08-06 20:37:50.043345189 +0200
-+++ openssh-6.0p1/session.c 2012-08-06 20:37:50.052345153 +0200
+diff -up openssh-6.2p1/session.c.audit5 openssh-6.2p1/session.c
+--- openssh-6.2p1/session.c.audit5 2013-03-25 17:43:27.499526610 +0100
++++ openssh-6.2p1/session.c 2013-03-25 17:43:27.506526650 +0100
@@ -136,7 +136,7 @@ extern int log_stderr;
extern int debug_flag;
extern u_int utmp_len;
@@ -316,7 +318,7 @@ diff -up openssh-6.0p1/session.c.audit5 openssh-6.0p1/session.c
extern Buffer loginmsg;
/* original command from peer. */
-@@ -1633,7 +1633,7 @@ do_child(Session *s, const char *command
+@@ -1641,7 +1641,7 @@ do_child(Session *s, const char *command
int r = 0;
/* remove hostkey from the child's memory */
@@ -325,9 +327,9 @@ diff -up openssh-6.0p1/session.c.audit5 openssh-6.0p1/session.c
/* Don't audit this - both us and the parent would be talking to the
monitor over a single socket, with no synchronization. */
packet_destroy_all(0, 1);
-diff -up openssh-6.0p1/sshd.c.audit5 openssh-6.0p1/sshd.c
---- openssh-6.0p1/sshd.c.audit5 2012-08-06 20:37:50.044345185 +0200
-+++ openssh-6.0p1/sshd.c 2012-08-06 20:37:50.053345149 +0200
+diff -up openssh-6.2p1/sshd.c.audit5 openssh-6.2p1/sshd.c
+--- openssh-6.2p1/sshd.c.audit5 2013-03-25 17:43:27.500526616 +0100
++++ openssh-6.2p1/sshd.c 2013-03-25 17:43:27.506526650 +0100
@@ -255,7 +255,7 @@ Buffer loginmsg;
struct passwd *privsep_pw = NULL;
@@ -353,7 +355,7 @@ diff -up openssh-6.0p1/sshd.c.audit5 openssh-6.0p1/sshd.c
static void
close_startup_pipes(void)
{
-@@ -534,22 +543,47 @@ sshd_exchange_identification(int sock_in
+@@ -545,22 +554,47 @@ sshd_exchange_identification(int sock_in
}
}
@@ -404,7 +406,7 @@ diff -up openssh-6.0p1/sshd.c.audit5 openssh-6.0p1/sshd.c
key_free(sensitive_data.host_certificates[i]);
sensitive_data.host_certificates[i] = NULL;
}
-@@ -563,6 +597,8 @@ void
+@@ -574,6 +608,8 @@ void
demote_sensitive_data(void)
{
Key *tmp;
@@ -413,7 +415,7 @@ diff -up openssh-6.0p1/sshd.c.audit5 openssh-6.0p1/sshd.c
int i;
if (sensitive_data.server_key) {
-@@ -571,13 +607,27 @@ demote_sensitive_data(void)
+@@ -582,13 +618,27 @@ demote_sensitive_data(void)
sensitive_data.server_key = tmp;
}
@@ -441,7 +443,7 @@ diff -up openssh-6.0p1/sshd.c.audit5 openssh-6.0p1/sshd.c
}
/* Certs do not need demotion */
}
-@@ -1149,6 +1199,7 @@ server_accept_loop(int *sock_in, int *so
+@@ -1160,6 +1210,7 @@ server_accept_loop(int *sock_in, int *so
if (received_sigterm) {
logit("Received signal %d; terminating.",
(int) received_sigterm);
@@ -449,7 +451,7 @@ diff -up openssh-6.0p1/sshd.c.audit5 openssh-6.0p1/sshd.c
close_listen_socks();
unlink(options.pid_file);
exit(received_sigterm == SIGTERM ? 0 : 255);
-@@ -2054,7 +2105,7 @@ main(int ac, char **av)
+@@ -2082,7 +2133,7 @@ main(int ac, char **av)
privsep_postauth(authctxt);
/* the monitor process [priv] will not return */
if (!compat20)
@@ -458,7 +460,7 @@ diff -up openssh-6.0p1/sshd.c.audit5 openssh-6.0p1/sshd.c
}
packet_set_timeout(options.client_alive_interval,
-@@ -2065,6 +2116,7 @@ main(int ac, char **av)
+@@ -2093,6 +2144,7 @@ main(int ac, char **av)
/* The connection has been terminated. */
packet_destroy_all(1, 1);
@@ -466,7 +468,7 @@ diff -up openssh-6.0p1/sshd.c.audit5 openssh-6.0p1/sshd.c
packet_get_state(MODE_IN, NULL, NULL, NULL, &ibytes);
packet_get_state(MODE_OUT, NULL, NULL, NULL, &obytes);
-@@ -2293,7 +2345,7 @@ do_ssh1_kex(void)
+@@ -2321,7 +2373,7 @@ do_ssh1_kex(void)
session_id[i] = session_key[i] ^ session_key[i + 16];
}
/* Destroy the private and public keys. No longer. */
@@ -475,7 +477,7 @@ diff -up openssh-6.0p1/sshd.c.audit5 openssh-6.0p1/sshd.c
if (use_privsep)
mm_ssh1_session_id(session_id);
-@@ -2404,6 +2456,8 @@ cleanup_exit(int i)
+@@ -2432,6 +2484,8 @@ cleanup_exit(int i)
}
}
is_privsep_child = use_privsep && pmonitor != NULL && !mm_is_monitor();
diff --git a/openssh-6.1p1-coverity.patch b/openssh-6.2p1-coverity.patch
similarity index 80%
rename from openssh-6.1p1-coverity.patch
rename to openssh-6.2p1-coverity.patch
index 0c8fb23..98e70d3 100644
--- a/openssh-6.1p1-coverity.patch
+++ b/openssh-6.2p1-coverity.patch
@@ -1,6 +1,6 @@
-diff -up openssh-6.1p1/auth-pam.c.coverity openssh-6.1p1/auth-pam.c
---- openssh-6.1p1/auth-pam.c.coverity 2009-07-12 14:07:21.000000000 +0200
-+++ openssh-6.1p1/auth-pam.c 2012-09-14 21:16:41.264906486 +0200
+diff -up openssh-6.2p1/auth-pam.c.coverity openssh-6.2p1/auth-pam.c
+--- openssh-6.2p1/auth-pam.c.coverity 2009-07-12 14:07:21.000000000 +0200
++++ openssh-6.2p1/auth-pam.c 2013-03-22 09:49:37.341595458 +0100
@@ -216,7 +216,12 @@ pthread_join(sp_pthread_t thread, void *
if (sshpam_thread_status != -1)
return (sshpam_thread_status);
@@ -15,30 +15,9 @@ diff -up openssh-6.1p1/auth-pam.c.coverity openssh-6.1p1/auth-pam.c
return (status);
}
#endif
-diff -up openssh-6.1p1/clientloop.c.coverity openssh-6.1p1/clientloop.c
---- openssh-6.1p1/clientloop.c.coverity 2012-06-20 14:31:27.000000000 +0200
-+++ openssh-6.1p1/clientloop.c 2012-09-14 21:16:41.267906501 +0200
-@@ -2006,14 +2006,15 @@ client_input_global_request(int type, u_
- char *rtype;
- int want_reply;
- int success = 0;
-+/* success is still 0 the packet is allways SSH2_MSG_REQUEST_FAILURE, isn't it? */
-
- rtype = packet_get_string(NULL);
- want_reply = packet_get_char();
- debug("client_input_global_request: rtype %s want_reply %d",
- rtype, want_reply);
- if (want_reply) {
-- packet_start(success ?
-- SSH2_MSG_REQUEST_SUCCESS : SSH2_MSG_REQUEST_FAILURE);
-+ packet_start(/*success ?
-+ SSH2_MSG_REQUEST_SUCCESS :*/ SSH2_MSG_REQUEST_FAILURE);
- packet_send();
- packet_write_wait();
- }
-diff -up openssh-6.1p1/channels.c.coverity openssh-6.1p1/channels.c
---- openssh-6.1p1/channels.c.coverity 2012-04-23 10:21:05.000000000 +0200
-+++ openssh-6.1p1/channels.c 2012-09-14 21:16:41.272906528 +0200
+diff -up openssh-6.2p1/channels.c.coverity openssh-6.2p1/channels.c
+--- openssh-6.2p1/channels.c.coverity 2012-12-02 23:50:55.000000000 +0100
++++ openssh-6.2p1/channels.c 2013-03-22 09:49:37.344595444 +0100
@@ -232,11 +232,11 @@ channel_register_fds(Channel *c, int rfd
channel_max_fd = MAX(channel_max_fd, wfd);
channel_max_fd = MAX(channel_max_fd, efd);
@@ -69,9 +48,30 @@ diff -up openssh-6.1p1/channels.c.coverity openssh-6.1p1/channels.c
set_nonblock(efd);
}
}
-diff -up openssh-6.1p1/key.c.coverity openssh-6.1p1/key.c
---- openssh-6.1p1/key.c.coverity 2012-06-30 12:05:02.000000000 +0200
-+++ openssh-6.1p1/key.c 2012-09-14 21:16:41.274906537 +0200
+diff -up openssh-6.2p1/clientloop.c.coverity openssh-6.2p1/clientloop.c
+--- openssh-6.2p1/clientloop.c.coverity 2013-01-09 05:55:51.000000000 +0100
++++ openssh-6.2p1/clientloop.c 2013-03-22 09:49:37.342595453 +0100
+@@ -2061,14 +2061,15 @@ client_input_global_request(int type, u_
+ char *rtype;
+ int want_reply;
+ int success = 0;
++/* success is still 0 the packet is allways SSH2_MSG_REQUEST_FAILURE, isn't it? */
+
+ rtype = packet_get_string(NULL);
+ want_reply = packet_get_char();
+ debug("client_input_global_request: rtype %s want_reply %d",
+ rtype, want_reply);
+ if (want_reply) {
+- packet_start(success ?
+- SSH2_MSG_REQUEST_SUCCESS : SSH2_MSG_REQUEST_FAILURE);
++ packet_start(/*success ?
++ SSH2_MSG_REQUEST_SUCCESS :*/ SSH2_MSG_REQUEST_FAILURE);
+ packet_send();
+ packet_write_wait();
+ }
+diff -up openssh-6.2p1/key.c.coverity openssh-6.2p1/key.c
+--- openssh-6.2p1/key.c.coverity 2013-01-18 01:44:05.000000000 +0100
++++ openssh-6.2p1/key.c 2013-03-22 09:49:37.345595440 +0100
@@ -808,8 +808,10 @@ key_read(Key *ret, char **cpp)
success = 1;
/*XXXX*/
@@ -83,19 +83,19 @@ diff -up openssh-6.1p1/key.c.coverity openssh-6.1p1/key.c
/* advance cp: skip whitespace and data */
while (*cp == ' ' || *cp == '\t')
cp++;
-diff -up openssh-6.1p1/monitor.c.coverity openssh-6.1p1/monitor.c
---- openssh-6.1p1/monitor.c.coverity 2012-06-30 00:33:17.000000000 +0200
-+++ openssh-6.1p1/monitor.c 2012-09-14 21:16:41.277906552 +0200
-@@ -420,7 +420,7 @@ monitor_child_preauth(Authctxt *_authctx
- }
+diff -up openssh-6.2p1/monitor.c.coverity openssh-6.2p1/monitor.c
+--- openssh-6.2p1/monitor.c.coverity 2012-12-12 00:44:39.000000000 +0100
++++ openssh-6.2p1/monitor.c 2013-03-22 12:19:55.189921353 +0100
+@@ -449,7 +449,7 @@ monitor_child_preauth(Authctxt *_authctx
+ mm_get_keystate(pmonitor);
/* Drain any buffered messages from the child */
- while (pmonitor->m_log_recvfd != -1 && monitor_read_log(pmonitor) == 0)
+ while (pmonitor->m_log_recvfd >= 0 && monitor_read_log(pmonitor) == 0)
;
- if (!authctxt->valid)
-@@ -1159,6 +1159,10 @@ mm_answer_keyallowed(int sock, Buffer *m
+ close(pmonitor->m_sendfd);
+@@ -1194,6 +1194,10 @@ mm_answer_keyallowed(int sock, Buffer *m
break;
}
}
@@ -106,7 +106,7 @@ diff -up openssh-6.1p1/monitor.c.coverity openssh-6.1p1/monitor.c
if (key != NULL)
key_free(key);
-@@ -1180,9 +1184,6 @@ mm_answer_keyallowed(int sock, Buffer *m
+@@ -1216,9 +1220,6 @@ mm_answer_keyallowed(int sock, Buffer *m
xfree(chost);
}
@@ -116,10 +116,10 @@ diff -up openssh-6.1p1/monitor.c.coverity openssh-6.1p1/monitor.c
buffer_clear(m);
buffer_put_int(m, allowed);
buffer_put_int(m, forced_command != NULL);
-diff -up openssh-6.1p1/monitor_wrap.c.coverity openssh-6.1p1/monitor_wrap.c
---- openssh-6.1p1/monitor_wrap.c.coverity 2011-06-20 06:42:23.000000000 +0200
-+++ openssh-6.1p1/monitor_wrap.c 2012-09-14 21:16:41.280906568 +0200
-@@ -707,10 +707,10 @@ mm_pty_allocate(int *ptyfd, int *ttyfd,
+diff -up openssh-6.2p1/monitor_wrap.c.coverity openssh-6.2p1/monitor_wrap.c
+--- openssh-6.2p1/monitor_wrap.c.coverity 2013-01-09 06:12:19.000000000 +0100
++++ openssh-6.2p1/monitor_wrap.c 2013-03-22 09:49:37.347595431 +0100
+@@ -708,10 +708,10 @@ mm_pty_allocate(int *ptyfd, int *ttyfd,
if ((tmp1 = dup(pmonitor->m_recvfd)) == -1 ||
(tmp2 = dup(pmonitor->m_recvfd)) == -1) {
error("%s: cannot allocate fds for pty", __func__);
@@ -133,9 +133,9 @@ diff -up openssh-6.1p1/monitor_wrap.c.coverity openssh-6.1p1/monitor_wrap.c
return 0;
}
close(tmp1);
-diff -up openssh-6.1p1/openbsd-compat/bindresvport.c.coverity openssh-6.1p1/openbsd-compat/bindresvport.c
---- openssh-6.1p1/openbsd-compat/bindresvport.c.coverity 2010-12-03 00:50:26.000000000 +0100
-+++ openssh-6.1p1/openbsd-compat/bindresvport.c 2012-09-14 21:16:41.281906573 +0200
+diff -up openssh-6.2p1/openbsd-compat/bindresvport.c.coverity openssh-6.2p1/openbsd-compat/bindresvport.c
+--- openssh-6.2p1/openbsd-compat/bindresvport.c.coverity 2010-12-03 00:50:26.000000000 +0100
++++ openssh-6.2p1/openbsd-compat/bindresvport.c 2013-03-22 09:49:37.347595431 +0100
@@ -58,7 +58,7 @@ bindresvport_sa(int sd, struct sockaddr
struct sockaddr_in6 *in6;
u_int16_t *portp;
@@ -145,10 +145,10 @@ diff -up openssh-6.1p1/openbsd-compat/bindresvport.c.coverity openssh-6.1p1/open
int i;
if (sa == NULL) {
-diff -up openssh-6.1p1/packet.c.coverity openssh-6.1p1/packet.c
---- openssh-6.1p1/packet.c.coverity 2012-03-09 00:28:07.000000000 +0100
-+++ openssh-6.1p1/packet.c 2012-09-14 21:16:41.284906588 +0200
-@@ -1177,6 +1177,7 @@ packet_read_poll1(void)
+diff -up openssh-6.2p1/packet.c.coverity openssh-6.2p1/packet.c
+--- openssh-6.2p1/packet.c.coverity 2013-02-12 01:03:59.000000000 +0100
++++ openssh-6.2p1/packet.c 2013-03-22 09:49:37.348595426 +0100
+@@ -1192,6 +1192,7 @@ packet_read_poll1(void)
case DEATTACK_DETECTED:
packet_disconnect("crc32 compensation attack: "
"network attack detected");
@@ -156,7 +156,7 @@ diff -up openssh-6.1p1/packet.c.coverity openssh-6.1p1/packet.c
case DEATTACK_DOS_DETECTED:
packet_disconnect("deattack denial of "
"service detected");
-@@ -1678,7 +1679,7 @@ void
+@@ -1728,7 +1729,7 @@ void
packet_write_wait(void)
{
fd_set *setp;
@@ -165,9 +165,9 @@ diff -up openssh-6.1p1/packet.c.coverity openssh-6.1p1/packet.c
struct timeval start, timeout, *timeoutp = NULL;
setp = (fd_set *)xcalloc(howmany(active_state->connection_out + 1,
-diff -up openssh-6.1p1/progressmeter.c.coverity openssh-6.1p1/progressmeter.c
---- openssh-6.1p1/progressmeter.c.coverity 2006-08-05 04:39:40.000000000 +0200
-+++ openssh-6.1p1/progressmeter.c 2012-09-14 21:16:41.285906593 +0200
+diff -up openssh-6.2p1/progressmeter.c.coverity openssh-6.2p1/progressmeter.c
+--- openssh-6.2p1/progressmeter.c.coverity 2006-08-05 04:39:40.000000000 +0200
++++ openssh-6.2p1/progressmeter.c 2013-03-22 09:49:37.349595422 +0100
@@ -65,7 +65,7 @@ static void update_progress_meter(int);
static time_t start; /* start progress */
@@ -186,9 +186,9 @@ diff -up openssh-6.1p1/progressmeter.c.coverity openssh-6.1p1/progressmeter.c
{
start = last_update = time(NULL);
file = f;
-diff -up openssh-6.1p1/progressmeter.h.coverity openssh-6.1p1/progressmeter.h
---- openssh-6.1p1/progressmeter.h.coverity 2006-03-26 05:30:02.000000000 +0200
-+++ openssh-6.1p1/progressmeter.h 2012-09-14 21:16:41.286906598 +0200
+diff -up openssh-6.2p1/progressmeter.h.coverity openssh-6.2p1/progressmeter.h
+--- openssh-6.2p1/progressmeter.h.coverity 2006-03-26 05:30:02.000000000 +0200
++++ openssh-6.2p1/progressmeter.h 2013-03-22 09:49:37.349595422 +0100
@@ -23,5 +23,5 @@
* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
@@ -196,9 +196,9 @@ diff -up openssh-6.1p1/progressmeter.h.coverity openssh-6.1p1/progressmeter.h
-void start_progress_meter(char *, off_t, off_t *);
+void start_progress_meter(const char *, off_t, off_t *);
void stop_progress_meter(void);
-diff -up openssh-6.1p1/scp.c.coverity openssh-6.1p1/scp.c
---- openssh-6.1p1/scp.c.coverity 2011-09-22 13:38:01.000000000 +0200
-+++ openssh-6.1p1/scp.c 2012-09-14 21:16:41.288906608 +0200
+diff -up openssh-6.2p1/scp.c.coverity openssh-6.2p1/scp.c
+--- openssh-6.2p1/scp.c.coverity 2013-03-20 02:55:15.000000000 +0100
++++ openssh-6.2p1/scp.c 2013-03-22 09:49:37.349595422 +0100
@@ -155,7 +155,7 @@ killchild(int signo)
{
if (do_cmd_pid > 1) {
@@ -208,10 +208,10 @@ diff -up openssh-6.1p1/scp.c.coverity openssh-6.1p1/scp.c
}
if (signo)
-diff -up openssh-6.1p1/servconf.c.coverity openssh-6.1p1/servconf.c
---- openssh-6.1p1/servconf.c.coverity 2012-07-31 04:22:38.000000000 +0200
-+++ openssh-6.1p1/servconf.c 2012-09-14 21:16:41.291906623 +0200
-@@ -1249,7 +1249,7 @@ process_server_config_line(ServerOptions
+diff -up openssh-6.2p1/servconf.c.coverity openssh-6.2p1/servconf.c
+--- openssh-6.2p1/servconf.c.coverity 2013-02-12 01:02:08.000000000 +0100
++++ openssh-6.2p1/servconf.c 2013-03-22 09:49:37.350595418 +0100
+@@ -1268,7 +1268,7 @@ process_server_config_line(ServerOptions
fatal("%s line %d: Missing subsystem name.",
filename, linenum);
if (!*activep) {
@@ -220,7 +220,7 @@ diff -up openssh-6.1p1/servconf.c.coverity openssh-6.1p1/servconf.c
break;
}
for (i = 0; i < options->num_subsystems; i++)
-@@ -1340,8 +1340,9 @@ process_server_config_line(ServerOptions
+@@ -1359,8 +1359,9 @@ process_server_config_line(ServerOptions
if (*activep && *charptr == NULL) {
*charptr = tilde_expand_filename(arg, getuid());
/* increase optional counter */
@@ -232,9 +232,9 @@ diff -up openssh-6.1p1/servconf.c.coverity openssh-6.1p1/servconf.c
}
break;
-diff -up openssh-6.1p1/serverloop.c.coverity openssh-6.1p1/serverloop.c
---- openssh-6.1p1/serverloop.c.coverity 2012-06-20 14:31:27.000000000 +0200
-+++ openssh-6.1p1/serverloop.c 2012-09-14 21:16:41.294906638 +0200
+diff -up openssh-6.2p1/serverloop.c.coverity openssh-6.2p1/serverloop.c
+--- openssh-6.2p1/serverloop.c.coverity 2012-12-07 03:07:47.000000000 +0100
++++ openssh-6.2p1/serverloop.c 2013-03-22 09:49:37.351595413 +0100
@@ -147,13 +147,13 @@ notify_setup(void)
static void
notify_parent(void)
@@ -335,7 +335,7 @@ diff -up openssh-6.1p1/serverloop.c.coverity openssh-6.1p1/serverloop.c
pty_change_window_size(fdin, row, col, xpixel, ypixel);
}
-@@ -996,7 +996,7 @@ server_request_tun(void)
+@@ -1003,7 +1003,7 @@ server_request_tun(void)
}
tun = packet_get_int();
@@ -344,10 +344,10 @@ diff -up openssh-6.1p1/serverloop.c.coverity openssh-6.1p1/serverloop.c
if (tun != SSH_TUNID_ANY && forced_tun_device != tun)
goto done;
tun = forced_tun_device;
-diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
---- openssh-6.1p1/sftp.c.coverity 2012-06-30 00:33:32.000000000 +0200
-+++ openssh-6.1p1/sftp.c 2012-09-14 21:16:41.297906653 +0200
-@@ -206,7 +206,7 @@ killchild(int signo)
+diff -up openssh-6.2p1/sftp.c.coverity openssh-6.2p1/sftp.c
+--- openssh-6.2p1/sftp.c.coverity 2013-02-22 23:12:24.000000000 +0100
++++ openssh-6.2p1/sftp.c 2013-03-22 09:49:37.352595409 +0100
+@@ -202,7 +202,7 @@ killchild(int signo)
{
if (sshpid > 1) {
kill(sshpid, SIGTERM);
@@ -356,7 +356,7 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
}
_exit(1);
-@@ -316,7 +316,7 @@ local_do_ls(const char *args)
+@@ -312,7 +312,7 @@ local_do_ls(const char *args)
/* Strip one path (usually the pwd) from the start of another */
static char *
@@ -365,7 +365,7 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
{
size_t len;
-@@ -334,7 +334,7 @@ path_strip(char *path, char *strip)
+@@ -330,7 +330,7 @@ path_strip(char *path, char *strip)
}
static char *
@@ -374,7 +374,7 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
{
char *abs_str;
-@@ -482,7 +482,7 @@ parse_df_flags(const char *cmd, char **a
+@@ -478,7 +478,7 @@ parse_df_flags(const char *cmd, char **a
}
static int
@@ -383,7 +383,7 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
{
struct stat sb;
-@@ -494,7 +494,7 @@ is_dir(char *path)
+@@ -490,7 +490,7 @@ is_dir(char *path)
}
static int
@@ -392,7 +392,7 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
{
Attrib *a;
-@@ -508,7 +508,7 @@ remote_is_dir(struct sftp_conn *conn, ch
+@@ -504,7 +504,7 @@ remote_is_dir(struct sftp_conn *conn, ch
/* Check whether path returned from glob(..., GLOB_MARK, ...) is a directory */
static int
@@ -401,7 +401,7 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
{
size_t l = strlen(pathname);
-@@ -516,7 +516,7 @@ pathname_is_dir(char *pathname)
+@@ -512,7 +512,7 @@ pathname_is_dir(char *pathname)
}
static int
@@ -410,7 +410,7 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
int pflag, int rflag)
{
char *abs_src = NULL;
-@@ -590,7 +590,7 @@ out:
+@@ -586,7 +586,7 @@ out:
}
static int
@@ -419,7 +419,7 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
int pflag, int rflag)
{
char *tmp_dst = NULL;
-@@ -695,7 +695,7 @@ sdirent_comp(const void *aa, const void
+@@ -691,7 +691,7 @@ sdirent_comp(const void *aa, const void
/* sftp ls.1 replacement for directories */
static int
@@ -428,7 +428,7 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
{
int n;
u_int c = 1, colspace = 0, columns = 1;
-@@ -780,7 +780,7 @@ do_ls_dir(struct sftp_conn *conn, char *
+@@ -776,7 +776,7 @@ do_ls_dir(struct sftp_conn *conn, char *
/* sftp ls.1 replacement which handles path globs */
static int
@@ -437,7 +437,7 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
int lflag)
{
char *fname, *lname;
-@@ -861,7 +861,7 @@ do_globbed_ls(struct sftp_conn *conn, ch
+@@ -857,7 +857,7 @@ do_globbed_ls(struct sftp_conn *conn, ch
}
static int
@@ -446,9 +446,9 @@ diff -up openssh-6.1p1/sftp.c.coverity openssh-6.1p1/sftp.c
{
struct sftp_statvfs st;
char s_used[FMT_SCALED_STRSIZE];
-diff -up openssh-6.1p1/sftp-client.c.coverity openssh-6.1p1/sftp-client.c
---- openssh-6.1p1/sftp-client.c.coverity 2012-07-02 14:15:39.000000000 +0200
-+++ openssh-6.1p1/sftp-client.c 2012-09-14 21:18:16.891332281 +0200
+diff -up openssh-6.2p1/sftp-client.c.coverity openssh-6.2p1/sftp-client.c
+--- openssh-6.2p1/sftp-client.c.coverity 2012-07-02 14:15:39.000000000 +0200
++++ openssh-6.2p1/sftp-client.c 2013-03-22 09:49:37.353595404 +0100
@@ -149,7 +149,7 @@ get_msg(struct sftp_conn *conn, Buffer *
}
@@ -656,9 +656,9 @@ diff -up openssh-6.1p1/sftp-client.c.coverity openssh-6.1p1/sftp-client.c
{
char *ret;
size_t len = strlen(p1) + strlen(p2) + 2;
-diff -up openssh-6.1p1/sftp-client.h.coverity openssh-6.1p1/sftp-client.h
---- openssh-6.1p1/sftp-client.h.coverity 2010-12-04 23:02:48.000000000 +0100
-+++ openssh-6.1p1/sftp-client.h 2012-09-14 21:16:41.301906674 +0200
+diff -up openssh-6.2p1/sftp-client.h.coverity openssh-6.2p1/sftp-client.h
+--- openssh-6.2p1/sftp-client.h.coverity 2010-12-04 23:02:48.000000000 +0100
++++ openssh-6.2p1/sftp-client.h 2013-03-22 09:49:37.353595404 +0100
@@ -56,49 +56,49 @@ struct sftp_conn *do_init(int, int, u_in
u_int sftp_proto_version(struct sftp_conn *);
@@ -756,9 +756,9 @@ diff -up openssh-6.1p1/sftp-client.h.coverity openssh-6.1p1/sftp-client.h
+char *path_append(const char *, const char *);
#endif
-diff -up openssh-6.1p1/ssh-agent.c.coverity openssh-6.1p1/ssh-agent.c
---- openssh-6.1p1/ssh-agent.c.coverity 2011-06-03 06:14:16.000000000 +0200
-+++ openssh-6.1p1/ssh-agent.c 2012-09-14 21:16:41.303906683 +0200
+diff -up openssh-6.2p1/ssh-agent.c.coverity openssh-6.2p1/ssh-agent.c
+--- openssh-6.2p1/ssh-agent.c.coverity 2011-06-03 06:14:16.000000000 +0200
++++ openssh-6.2p1/ssh-agent.c 2013-03-22 09:49:37.354595400 +0100
@@ -1147,8 +1147,8 @@ main(int ac, char **av)
sanitise_stdfd();
@@ -770,10 +770,10 @@ diff -up openssh-6.1p1/ssh-agent.c.coverity openssh-6.1p1/ssh-agent.c
#if defined(HAVE_PRCTL) && defined(PR_SET_DUMPABLE)
/* Disable ptrace on Linux without sgid bit */
-diff -up openssh-6.1p1/sshd.c.coverity openssh-6.1p1/sshd.c
---- openssh-6.1p1/sshd.c.coverity 2012-07-31 04:21:34.000000000 +0200
-+++ openssh-6.1p1/sshd.c 2012-09-14 21:16:41.307906705 +0200
-@@ -682,8 +682,10 @@ privsep_preauth(Authctxt *authctxt)
+diff -up openssh-6.2p1/sshd.c.coverity openssh-6.2p1/sshd.c
+--- openssh-6.2p1/sshd.c.coverity 2013-02-12 01:04:48.000000000 +0100
++++ openssh-6.2p1/sshd.c 2013-03-22 09:49:37.355595396 +0100
+@@ -691,8 +691,10 @@ privsep_preauth(Authctxt *authctxt)
if (getuid() == 0 || geteuid() == 0)
privsep_preauth_child();
setproctitle("%s", "[net]");
@@ -785,7 +785,7 @@ diff -up openssh-6.1p1/sshd.c.coverity openssh-6.1p1/sshd.c
return 0;
}
-@@ -1311,6 +1313,9 @@ server_accept_loop(int *sock_in, int *so
+@@ -1320,6 +1322,9 @@ server_accept_loop(int *sock_in, int *so
if (num_listen_socks < 0)
break;
}
@@ -795,7 +795,7 @@ diff -up openssh-6.1p1/sshd.c.coverity openssh-6.1p1/sshd.c
}
-@@ -1768,7 +1773,7 @@ main(int ac, char **av)
+@@ -1806,7 +1811,7 @@ main(int ac, char **av)
/* Chdir to the root directory so that the current disk can be
unmounted if desired. */
diff --git a/openssh-5.9p1-ctr-cavstest.patch b/openssh-6.2p1-ctr-cavstest.patch
similarity index 91%
rename from openssh-5.9p1-ctr-cavstest.patch
rename to openssh-6.2p1-ctr-cavstest.patch
index c260925..1376a3f 100644
--- a/openssh-5.9p1-ctr-cavstest.patch
+++ b/openssh-6.2p1-ctr-cavstest.patch
@@ -1,6 +1,6 @@
-diff -up openssh-5.9p1/ctr-cavstest.c.ctr-cavs openssh-5.9p1/ctr-cavstest.c
---- openssh-5.9p1/ctr-cavstest.c.ctr-cavs 2012-01-13 15:59:06.584283289 +0100
-+++ openssh-5.9p1/ctr-cavstest.c 2012-01-13 18:21:33.791941027 +0100
+diff -up openssh-6.2p1/ctr-cavstest.c.ctr-cavs openssh-6.2p1/ctr-cavstest.c
+--- openssh-6.2p1/ctr-cavstest.c.ctr-cavs 2013-03-25 21:35:52.512586671 +0100
++++ openssh-6.2p1/ctr-cavstest.c 2013-03-25 21:35:52.512586671 +0100
@@ -0,0 +1,208 @@
+/*
+ *
@@ -194,7 +194,7 @@ diff -up openssh-5.9p1/ctr-cavstest.c.ctr-cavs openssh-5.9p1/ctr-cavstest.c
+ return 2;
+ }
+
-+ cipher_crypt(&cc, outdata, data, datalen);
++ cipher_crypt(&cc, outdata, data, datalen, 0, 0);
+
+ xfree(data);
+
@@ -210,9 +210,9 @@ diff -up openssh-5.9p1/ctr-cavstest.c.ctr-cavs openssh-5.9p1/ctr-cavstest.c
+ return 0;
+}
+
-diff -up openssh-5.9p1/Makefile.in.ctr-cavs openssh-5.9p1/Makefile.in
---- openssh-5.9p1/Makefile.in.ctr-cavs 2012-01-13 15:59:06.539282357 +0100
-+++ openssh-5.9p1/Makefile.in 2012-01-13 15:59:06.588283373 +0100
+diff -up openssh-6.2p1/Makefile.in.ctr-cavs openssh-6.2p1/Makefile.in
+--- openssh-6.2p1/Makefile.in.ctr-cavs 2013-03-25 21:35:52.451586280 +0100
++++ openssh-6.2p1/Makefile.in 2013-03-25 21:37:14.956114584 +0100
@@ -28,6 +28,7 @@ SSH_KEYSIGN=$(libexecdir)/ssh-keysign
SSH_LDAP_HELPER=$(libexecdir)/ssh-ldap-helper
SSH_LDAP_WRAPPER=$(libexecdir)/ssh-ldap-wrapper
@@ -221,16 +221,16 @@ diff -up openssh-5.9p1/Makefile.in.ctr-cavs openssh-5.9p1/Makefile.in
SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
PRIVSEP_PATH=@PRIVSEP_PATH@
SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
-@@ -63,7 +64,7 @@ EXEEXT=@EXEEXT@
+@@ -65,7 +66,7 @@ EXEEXT=@EXEEXT@
MANFMT=@MANFMT@
INSTALL_SSH_LDAP_HELPER=@INSTALL_SSH_LDAP_HELPER@
-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT) ssh-keycat$(EXEEXT)
+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT) ssh-keycat$(EXEEXT) ctr-cavstest$(EXEEXT)
- LIBSSH_OBJS=acss.o authfd.o authfile.o bufaux.o bufbn.o buffer.o \
- canohost.o channels.o cipher.o cipher-acss.o cipher-aes.o \
-@@ -171,6 +172,9 @@ ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) l
+ LIBSSH_OBJS=authfd.o authfile.o bufaux.o bufbn.o buffer.o \
+ canohost.o channels.o cipher.o cipher-aes.o \
+@@ -174,6 +175,9 @@ ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) l
ssh-keycat$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keycat.o
$(LD) -o $@ ssh-keycat.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lfipscheck $(SSHDLIBS)
@@ -240,7 +240,7 @@ diff -up openssh-5.9p1/Makefile.in.ctr-cavs openssh-5.9p1/Makefile.in
ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o roaming_dummy.o
$(LD) -o $@ ssh-keyscan.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lfipscheck $(LIBS)
-@@ -271,6 +275,7 @@ install-files:
+@@ -281,6 +285,7 @@ install-files:
$(INSTALL) -m 0700 ssh-ldap-wrapper $(DESTDIR)$(SSH_LDAP_WRAPPER) ; \
fi
$(INSTALL) -m 0755 $(STRIP_OPT) ssh-keycat$(EXEEXT) $(DESTDIR)$(libexecdir)/ssh-keycat$(EXEEXT)
diff --git a/openssh-6.0p1-entropy.patch b/openssh-6.2p1-entropy.patch
similarity index 76%
rename from openssh-6.0p1-entropy.patch
rename to openssh-6.2p1-entropy.patch
index 79f05f4..7b9faeb 100644
--- a/openssh-6.0p1-entropy.patch
+++ b/openssh-6.2p1-entropy.patch
@@ -1,6 +1,6 @@
-diff -up openssh-6.0p1/entropy.c.entropy openssh-6.0p1/entropy.c
---- openssh-6.0p1/entropy.c.entropy 2012-08-06 20:51:59.131033413 +0200
-+++ openssh-6.0p1/entropy.c 2012-08-06 20:51:59.171033257 +0200
+diff -up openssh-6.2p1/entropy.c.entropy openssh-6.2p1/entropy.c
+--- openssh-6.2p1/entropy.c.entropy 2013-03-25 19:31:42.737611051 +0100
++++ openssh-6.2p1/entropy.c 2013-03-25 19:31:42.797611433 +0100
@@ -237,6 +237,9 @@ seed_rng(void)
memset(buf, '\0', sizeof(buf));
@@ -11,21 +11,21 @@ diff -up openssh-6.0p1/entropy.c.entropy openssh-6.0p1/entropy.c
if (RAND_status() != 1)
fatal("PRNG is not seeded");
}
-diff -up openssh-6.0p1/openbsd-compat/Makefile.in.entropy openssh-6.0p1/openbsd-compat/Makefile.in
---- openssh-6.0p1/openbsd-compat/Makefile.in.entropy 2012-08-06 20:51:59.100033534 +0200
-+++ openssh-6.0p1/openbsd-compat/Makefile.in 2012-08-06 20:51:59.171033257 +0200
+diff -up openssh-6.2p1/openbsd-compat/Makefile.in.entropy openssh-6.2p1/openbsd-compat/Makefile.in
+--- openssh-6.2p1/openbsd-compat/Makefile.in.entropy 2013-03-25 19:31:42.798611440 +0100
++++ openssh-6.2p1/openbsd-compat/Makefile.in 2013-03-25 19:33:02.042116876 +0100
@@ -20,7 +20,7 @@ OPENBSD=base64.o basename.o bindresvport
- COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o getrrsetbyname-ldns.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o
+ COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o getrrsetbyname-ldns.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-setres_id.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o
-PORTS=port-aix.o port-irix.o port-linux.o port-linux_part_2.o port-solaris.o port-tun.o port-uw.o
+PORTS=port-aix.o port-irix.o port-linux.o port-linux_part_2.o port-linux-prng.o port-solaris.o port-tun.o port-uw.o
.c.o:
$(CC) $(CFLAGS) $(CPPFLAGS) -c $<
-diff -up openssh-6.0p1/openbsd-compat/port-linux-prng.c.entropy openssh-6.0p1/openbsd-compat/port-linux-prng.c
---- openssh-6.0p1/openbsd-compat/port-linux-prng.c.entropy 2012-08-06 20:51:59.171033257 +0200
-+++ openssh-6.0p1/openbsd-compat/port-linux-prng.c 2012-08-06 20:51:59.171033257 +0200
+diff -up openssh-6.2p1/openbsd-compat/port-linux-prng.c.entropy openssh-6.2p1/openbsd-compat/port-linux-prng.c
+--- openssh-6.2p1/openbsd-compat/port-linux-prng.c.entropy 2013-03-25 19:31:42.798611440 +0100
++++ openssh-6.2p1/openbsd-compat/port-linux-prng.c 2013-03-25 19:31:42.798611440 +0100
@@ -0,0 +1,59 @@
+/* $Id: port-linux.c,v 1.11.4.2 2011/02/04 00:43:08 djm Exp $ */
+
@@ -86,37 +86,10 @@ diff -up openssh-6.0p1/openbsd-compat/port-linux-prng.c.entropy openssh-6.0p1/op
+ fatal ("EOF reading %s", random);
+ }
+}
-diff -up openssh-6.0p1/ssh.1.entropy openssh-6.0p1/ssh.1
---- openssh-6.0p1/ssh.1.entropy 2012-08-06 20:51:59.139033382 +0200
-+++ openssh-6.0p1/ssh.1 2012-08-06 20:51:59.174033245 +0200
-@@ -1269,6 +1269,23 @@ For more information, see the
- .Cm PermitUserEnvironment
- option in
- .Xr sshd_config 5 .
-+.Sh ENVIRONMENT
-+.Bl -tag -width Ds -compact
-+.It Ev SSH_USE_STRONG_RNG
-+The reseeding of the OpenSSL random generator is usually done from
-+.Cm /dev/urandom .
-+If the
-+.Cm SSH_USE_STRONG_RNG
-+environment variable is set to value other than
-+.Cm 0
-+the OpenSSL random generator is reseeded from
-+.Cm /dev/random .
-+The number of bytes read is defined by the SSH_USE_STRONG_RNG value.
-+Minimum is 6 bytes.
-+This setting is not recommended on the computers without the hardware
-+random generator because insufficient entropy causes the connection to
-+be blocked until enough entropy is available.
-+.El
- .Sh FILES
- .Bl -tag -width Ds -compact
- .It Pa ~/.rhosts
-diff -up openssh-6.1p1/ssh-add.0.entropy openssh-6.1p1/ssh-add.0
---- openssh-6.1p1/ssh-add.0.entropy 2012-11-12 13:11:42.717393364 +0100
-+++ openssh-6.1p1/ssh-add.0 2012-11-12 13:12:46.288108790 +0100
-@@ -81,6 +81,16 @@ ENVIRONMENT
+diff -up openssh-6.2p1/ssh-add.0.entropy openssh-6.2p1/ssh-add.0
+--- openssh-6.2p1/ssh-add.0.entropy 2013-03-22 00:38:29.000000000 +0100
++++ openssh-6.2p1/ssh-add.0 2013-03-25 19:31:42.799611446 +0100
+@@ -82,6 +82,16 @@ ENVIRONMENT
Identifies the path of a UNIX-domain socket used to communicate
with the agent.
@@ -133,9 +106,9 @@ diff -up openssh-6.1p1/ssh-add.0.entropy openssh-6.1p1/ssh-add.0
FILES
~/.ssh/identity
Contains the protocol version 1 RSA authentication identity of
-diff -up openssh-6.1p1/ssh-add.1.entropy openssh-6.1p1/ssh-add.1
---- openssh-6.1p1/ssh-add.1.entropy 2011-10-18 07:06:33.000000000 +0200
-+++ openssh-6.1p1/ssh-add.1 2012-11-12 13:11:24.711476108 +0100
+diff -up openssh-6.2p1/ssh-add.1.entropy openssh-6.2p1/ssh-add.1
+--- openssh-6.2p1/ssh-add.1.entropy 2012-12-07 03:06:13.000000000 +0100
++++ openssh-6.2p1/ssh-add.1 2013-03-25 19:31:42.799611446 +0100
@@ -160,6 +160,20 @@ to make this work.)
Identifies the path of a
.Ux Ns -domain
@@ -157,10 +130,9 @@ diff -up openssh-6.1p1/ssh-add.1.entropy openssh-6.1p1/ssh-add.1
.El
.Sh FILES
.Bl -tag -width Ds
- .It Pa ~/.ssh/identity
-diff -up openssh-6.0p1/ssh-agent.1.entropy openssh-6.0p1/ssh-agent.1
---- openssh-6.0p1/ssh-agent.1.entropy 2010-12-01 01:50:35.000000000 +0100
-+++ openssh-6.0p1/ssh-agent.1 2012-08-06 20:51:59.172033253 +0200
+diff -up openssh-6.2p1/ssh-agent.1.entropy openssh-6.2p1/ssh-agent.1
+--- openssh-6.2p1/ssh-agent.1.entropy 2010-12-01 01:50:35.000000000 +0100
++++ openssh-6.2p1/ssh-agent.1 2013-03-25 19:31:42.800611452 +0100
@@ -198,6 +198,24 @@ sockets used to contain the connection t
These sockets should only be readable by the owner.
The sockets should get automatically removed when the agent exits.
@@ -186,10 +158,10 @@ diff -up openssh-6.0p1/ssh-agent.1.entropy openssh-6.0p1/ssh-agent.1
.Sh SEE ALSO
.Xr ssh 1 ,
.Xr ssh-add 1 ,
-diff -up openssh-6.0p1/sshd.8.entropy openssh-6.0p1/sshd.8
---- openssh-6.0p1/sshd.8.entropy 2012-08-06 20:51:59.139033382 +0200
-+++ openssh-6.0p1/sshd.8 2012-08-06 20:51:59.174033245 +0200
-@@ -943,6 +943,24 @@ concurrently for different ports, this c
+diff -up openssh-6.2p1/sshd.8.entropy openssh-6.2p1/sshd.8
+--- openssh-6.2p1/sshd.8.entropy 2013-03-25 19:31:42.752611146 +0100
++++ openssh-6.2p1/sshd.8 2013-03-25 19:31:42.800611452 +0100
+@@ -945,6 +945,24 @@ concurrently for different ports, this c
started last).
The content of this file is not sensitive; it can be world-readable.
.El
@@ -214,10 +186,10 @@ diff -up openssh-6.0p1/sshd.8.entropy openssh-6.0p1/sshd.8
.Sh IPV6
IPv6 address can be used everywhere where IPv4 address. In all entries must be the IPv6 address enclosed in square brackets. Note: The square brackets are metacharacters for the shell and must be escaped in shell.
.Sh SEE ALSO
-diff -up openssh-6.0p1/ssh-keygen.1.entropy openssh-6.0p1/ssh-keygen.1
---- openssh-6.0p1/ssh-keygen.1.entropy 2011-10-18 07:05:21.000000000 +0200
-+++ openssh-6.0p1/ssh-keygen.1 2012-08-06 20:51:59.173033249 +0200
-@@ -675,6 +675,24 @@ Contains Diffie-Hellman groups used for
+diff -up openssh-6.2p1/ssh-keygen.1.entropy openssh-6.2p1/ssh-keygen.1
+--- openssh-6.2p1/ssh-keygen.1.entropy 2013-01-20 12:35:06.000000000 +0100
++++ openssh-6.2p1/ssh-keygen.1 2013-03-25 19:31:42.801611459 +0100
+@@ -806,6 +806,24 @@ Contains Diffie-Hellman groups used for
The file format is described in
.Xr moduli 5 .
.El
@@ -242,9 +214,9 @@ diff -up openssh-6.0p1/ssh-keygen.1.entropy openssh-6.0p1/ssh-keygen.1
.Sh SEE ALSO
.Xr ssh 1 ,
.Xr ssh-add 1 ,
-diff -up openssh-6.0p1/ssh-keysign.8.entropy openssh-6.0p1/ssh-keysign.8
---- openssh-6.0p1/ssh-keysign.8.entropy 2010-08-31 14:41:14.000000000 +0200
-+++ openssh-6.0p1/ssh-keysign.8 2012-08-06 20:51:59.173033249 +0200
+diff -up openssh-6.2p1/ssh-keysign.8.entropy openssh-6.2p1/ssh-keysign.8
+--- openssh-6.2p1/ssh-keysign.8.entropy 2010-08-31 14:41:14.000000000 +0200
++++ openssh-6.2p1/ssh-keysign.8 2013-03-25 19:31:42.801611459 +0100
@@ -78,6 +78,24 @@ must be set-uid root if host-based authe
If these files exist they are assumed to contain public certificate
information corresponding with the private keys above.
@@ -270,3 +242,30 @@ diff -up openssh-6.0p1/ssh-keysign.8.entropy openssh-6.0p1/ssh-keysign.8
.Sh SEE ALSO
.Xr ssh 1 ,
.Xr ssh-keygen 1 ,
+diff -up openssh-6.2p1/ssh.1.entropy openssh-6.2p1/ssh.1
+--- openssh-6.2p1/ssh.1.entropy 2013-03-25 19:31:42.752611146 +0100
++++ openssh-6.2p1/ssh.1 2013-03-25 19:31:42.799611446 +0100
+@@ -1277,6 +1277,23 @@ For more information, see the
+ .Cm PermitUserEnvironment
+ option in
+ .Xr sshd_config 5 .
++.Sh ENVIRONMENT
++.Bl -tag -width Ds -compact
++.It Ev SSH_USE_STRONG_RNG
++The reseeding of the OpenSSL random generator is usually done from
++.Cm /dev/urandom .
++If the
++.Cm SSH_USE_STRONG_RNG
++environment variable is set to value other than
++.Cm 0
++the OpenSSL random generator is reseeded from
++.Cm /dev/random .
++The number of bytes read is defined by the SSH_USE_STRONG_RNG value.
++Minimum is 6 bytes.
++This setting is not recommended on the computers without the hardware
++random generator because insufficient entropy causes the connection to
++be blocked until enough entropy is available.
++.El
+ .Sh FILES
+ .Bl -tag -width Ds -compact
+ .It Pa ~/.rhosts
diff --git a/openssh-5.8p1-fingerprint.patch b/openssh-6.2p1-fingerprint.patch
similarity index 78%
rename from openssh-5.8p1-fingerprint.patch
rename to openssh-6.2p1-fingerprint.patch
index a0438ff..92f8a4c 100644
--- a/openssh-5.8p1-fingerprint.patch
+++ b/openssh-6.2p1-fingerprint.patch
@@ -1,6 +1,6 @@
-diff -up openssh-5.8p1/auth2-hostbased.c.fingerprint openssh-5.8p1/auth2-hostbased.c
---- openssh-5.8p1/auth2-hostbased.c.fingerprint 2010-08-05 05:04:50.000000000 +0200
-+++ openssh-5.8p1/auth2-hostbased.c 2011-02-25 09:17:18.000000000 +0100
+diff -up openssh-6.2p1/auth2-hostbased.c.fingerprint openssh-6.2p1/auth2-hostbased.c
+--- openssh-6.2p1/auth2-hostbased.c.fingerprint 2010-08-05 05:04:50.000000000 +0200
++++ openssh-6.2p1/auth2-hostbased.c 2013-03-22 12:20:49.009685008 +0100
@@ -196,16 +196,18 @@ hostbased_key_allowed(struct passwd *pw,
if (host_status == HOST_OK) {
@@ -27,10 +27,10 @@ diff -up openssh-5.8p1/auth2-hostbased.c.fingerprint openssh-5.8p1/auth2-hostbas
}
xfree(fp);
}
-diff -up openssh-5.8p1/auth2-pubkey.c.fingerprint openssh-5.8p1/auth2-pubkey.c
---- openssh-5.8p1/auth2-pubkey.c.fingerprint 2010-12-01 01:50:14.000000000 +0100
-+++ openssh-5.8p1/auth2-pubkey.c 2011-02-25 09:17:18.000000000 +0100
-@@ -319,10 +319,10 @@ user_key_allowed2(struct passwd *pw, Key
+diff -up openssh-6.2p1/auth2-pubkey.c.fingerprint openssh-6.2p1/auth2-pubkey.c
+--- openssh-6.2p1/auth2-pubkey.c.fingerprint 2013-02-15 00:28:56.000000000 +0100
++++ openssh-6.2p1/auth2-pubkey.c 2013-03-22 12:20:49.009685008 +0100
+@@ -317,10 +317,10 @@ check_authkeys_file(FILE *f, char *file,
continue;
if (!key_is_cert_authority)
continue;
@@ -45,7 +45,7 @@ diff -up openssh-5.8p1/auth2-pubkey.c.fingerprint openssh-5.8p1/auth2-pubkey.c
/*
* If the user has specified a list of principals as
* a key option, then prefer that list to matching
-@@ -362,9 +362,9 @@ user_key_allowed2(struct passwd *pw, Key
+@@ -360,9 +360,9 @@ check_authkeys_file(FILE *f, char *file,
found_key = 1;
debug("matching key found: file %s, line %lu",
file, linenum);
@@ -58,7 +58,7 @@ diff -up openssh-5.8p1/auth2-pubkey.c.fingerprint openssh-5.8p1/auth2-pubkey.c
xfree(fp);
break;
}
-@@ -388,13 +388,13 @@ user_cert_trusted_ca(struct passwd *pw,
+@@ -384,13 +384,13 @@ user_cert_trusted_ca(struct passwd *pw,
if (!key_is_cert(key) || options.trusted_user_ca_keys == NULL)
return 0;
@@ -76,12 +76,12 @@ diff -up openssh-5.8p1/auth2-pubkey.c.fingerprint openssh-5.8p1/auth2-pubkey.c
options.trusted_user_ca_keys);
goto out;
}
-diff -up openssh-5.8p1/auth.c.fingerprint openssh-5.8p1/auth.c
---- openssh-5.8p1/auth.c.fingerprint 2010-12-01 02:21:51.000000000 +0100
-+++ openssh-5.8p1/auth.c 2011-02-25 09:17:18.000000000 +0100
-@@ -639,9 +639,10 @@ auth_key_is_revoked(Key *key)
- return 1;
+diff -up openssh-6.2p1/auth.c.fingerprint openssh-6.2p1/auth.c
+--- openssh-6.2p1/auth.c.fingerprint 2013-03-12 01:31:05.000000000 +0100
++++ openssh-6.2p1/auth.c 2013-03-22 12:22:32.515230386 +0100
+@@ -663,9 +663,10 @@ auth_key_is_revoked(Key *key)
case 1:
+ revoked:
/* Key revoked */
- key_fp = key_fingerprint(key, SSH_FP_MD5, SSH_FP_HEX);
+ key_fp = key_selected_fingerprint(key, SSH_FP_HEX);
@@ -92,10 +92,10 @@ diff -up openssh-5.8p1/auth.c.fingerprint openssh-5.8p1/auth.c
xfree(key_fp);
return 1;
}
-diff -up openssh-5.8p1/auth-rsa.c.fingerprint openssh-5.8p1/auth-rsa.c
---- openssh-5.8p1/auth-rsa.c.fingerprint 2010-12-04 23:01:47.000000000 +0100
-+++ openssh-5.8p1/auth-rsa.c 2011-02-25 09:17:18.000000000 +0100
-@@ -318,9 +318,9 @@ auth_rsa(Authctxt *authctxt, BIGNUM *cli
+diff -up openssh-6.2p1/auth-rsa.c.fingerprint openssh-6.2p1/auth-rsa.c
+--- openssh-6.2p1/auth-rsa.c.fingerprint 2012-10-30 22:58:59.000000000 +0100
++++ openssh-6.2p1/auth-rsa.c 2013-03-22 12:20:49.011684999 +0100
+@@ -328,9 +328,9 @@ auth_rsa(Authctxt *authctxt, BIGNUM *cli
* options; this will be reset if the options cause the
* authentication to be rejected.
*/
@@ -108,10 +108,10 @@ diff -up openssh-5.8p1/auth-rsa.c.fingerprint openssh-5.8p1/auth-rsa.c
xfree(fp);
key_free(key);
-diff -up openssh-5.8p1/key.c.fingerprint openssh-5.8p1/key.c
---- openssh-5.8p1/key.c.fingerprint 2011-02-04 01:48:34.000000000 +0100
-+++ openssh-5.8p1/key.c 2011-02-25 09:18:16.000000000 +0100
-@@ -594,6 +594,34 @@ key_fingerprint(Key *k, enum fp_type dgs
+diff -up openssh-6.2p1/key.c.fingerprint openssh-6.2p1/key.c
+--- openssh-6.2p1/key.c.fingerprint 2013-03-22 12:20:48.971685175 +0100
++++ openssh-6.2p1/key.c 2013-03-22 12:20:49.012684995 +0100
+@@ -599,6 +599,34 @@ key_fingerprint(Key *k, enum fp_type dgs
return retval;
}
@@ -146,23 +146,23 @@ diff -up openssh-5.8p1/key.c.fingerprint openssh-5.8p1/key.c
/*
* Reads a multiple-precision integer in decimal from the buffer, and advances
* the pointer. The integer must already be initialized. This function is
-diff -up openssh-5.8p1/key.h.fingerprint openssh-5.8p1/key.h
---- openssh-5.8p1/key.h.fingerprint 2010-11-05 00:19:49.000000000 +0100
-+++ openssh-5.8p1/key.h 2011-02-25 09:17:18.000000000 +0100
-@@ -96,6 +96,9 @@ int key_equal_public(const Key *, cons
+diff -up openssh-6.2p1/key.h.fingerprint openssh-6.2p1/key.h
+--- openssh-6.2p1/key.h.fingerprint 2013-01-18 01:44:05.000000000 +0100
++++ openssh-6.2p1/key.h 2013-03-22 12:23:35.308954528 +0100
+@@ -97,6 +97,9 @@ int key_equal_public(const Key *, cons
int key_equal(const Key *, const Key *);
char *key_fingerprint(Key *, enum fp_type, enum fp_rep);
- u_char *key_fingerprint_raw(Key *, enum fp_type, u_int *);
+ u_char *key_fingerprint_raw(const Key *, enum fp_type, u_int *);
+enum fp_type key_fingerprint_selection(void);
+char *key_selected_fingerprint(Key *, enum fp_rep);
+char *key_fingerprint_prefix(void);
const char *key_type(const Key *);
const char *key_cert_type(const Key *);
int key_write(const Key *, FILE *);
-diff -up openssh-5.8p1/ssh-add.c.fingerprint openssh-5.8p1/ssh-add.c
---- openssh-5.8p1/ssh-add.c.fingerprint 2010-11-11 04:17:02.000000000 +0100
-+++ openssh-5.8p1/ssh-add.c 2011-02-25 09:17:18.000000000 +0100
-@@ -280,10 +280,10 @@ list_identities(AuthenticationConnection
+diff -up openssh-6.2p1/ssh-add.c.fingerprint openssh-6.2p1/ssh-add.c
+--- openssh-6.2p1/ssh-add.c.fingerprint 2012-12-07 03:07:03.000000000 +0100
++++ openssh-6.2p1/ssh-add.c 2013-03-22 12:20:49.029684920 +0100
+@@ -326,10 +326,10 @@ list_identities(AuthenticationConnection
key = ssh_get_next_identity(ac, &comment, version)) {
had_identities = 1;
if (do_fp) {
@@ -177,9 +177,9 @@ diff -up openssh-5.8p1/ssh-add.c.fingerprint openssh-5.8p1/ssh-add.c
xfree(fp);
} else {
if (!key_write(key, stdout))
-diff -up openssh-5.8p1/ssh-agent.c.fingerprint openssh-5.8p1/ssh-agent.c
---- openssh-5.8p1/ssh-agent.c.fingerprint 2010-12-01 01:50:35.000000000 +0100
-+++ openssh-5.8p1/ssh-agent.c 2011-02-25 09:17:18.000000000 +0100
+diff -up openssh-6.2p1/ssh-agent.c.fingerprint openssh-6.2p1/ssh-agent.c
+--- openssh-6.2p1/ssh-agent.c.fingerprint 2013-03-22 12:20:48.979685140 +0100
++++ openssh-6.2p1/ssh-agent.c 2013-03-22 12:20:49.030684916 +0100
@@ -199,9 +199,9 @@ confirm_key(Identity *id)
char *p;
int ret = -1;
@@ -193,10 +193,10 @@ diff -up openssh-5.8p1/ssh-agent.c.fingerprint openssh-5.8p1/ssh-agent.c
ret = 0;
xfree(p);
-diff -up openssh-5.8p1/sshconnect2.c.fingerprint openssh-5.8p1/sshconnect2.c
---- openssh-5.8p1/sshconnect2.c.fingerprint 2010-12-01 02:21:51.000000000 +0100
-+++ openssh-5.8p1/sshconnect2.c 2011-02-25 09:17:18.000000000 +0100
-@@ -590,8 +590,9 @@ input_userauth_pk_ok(int type, u_int32_t
+diff -up openssh-6.2p1/sshconnect2.c.fingerprint openssh-6.2p1/sshconnect2.c
+--- openssh-6.2p1/sshconnect2.c.fingerprint 2013-03-20 02:55:15.000000000 +0100
++++ openssh-6.2p1/sshconnect2.c 2013-03-22 12:20:49.031684912 +0100
+@@ -592,8 +592,9 @@ input_userauth_pk_ok(int type, u_int32_t
key->type, pktype);
goto done;
}
@@ -208,7 +208,7 @@ diff -up openssh-5.8p1/sshconnect2.c.fingerprint openssh-5.8p1/sshconnect2.c
xfree(fp);
/*
-@@ -1203,8 +1204,9 @@ sign_and_send_pubkey(Authctxt *authctxt,
+@@ -1205,8 +1206,9 @@ sign_and_send_pubkey(Authctxt *authctxt,
int have_sig = 1;
char *fp;
@@ -220,10 +220,10 @@ diff -up openssh-5.8p1/sshconnect2.c.fingerprint openssh-5.8p1/sshconnect2.c
xfree(fp);
if (key_to_blob(id->key, &blob, &bloblen) == 0) {
-diff -up openssh-5.8p1/sshconnect.c.fingerprint openssh-5.8p1/sshconnect.c
---- openssh-5.8p1/sshconnect.c.fingerprint 2011-01-16 13:17:59.000000000 +0100
-+++ openssh-5.8p1/sshconnect.c 2011-02-25 09:17:18.000000000 +0100
-@@ -798,10 +798,10 @@ check_host_key(char *hostname, struct so
+diff -up openssh-6.2p1/sshconnect.c.fingerprint openssh-6.2p1/sshconnect.c
+--- openssh-6.2p1/sshconnect.c.fingerprint 2012-09-17 05:25:44.000000000 +0200
++++ openssh-6.2p1/sshconnect.c 2013-03-22 12:20:49.032684907 +0100
+@@ -824,10 +824,10 @@ check_host_key(char *hostname, struct so
"key for IP address '%.128s' to the list "
"of known hosts.", type, ip);
} else if (options.visual_host_key) {
@@ -238,7 +238,7 @@ diff -up openssh-5.8p1/sshconnect.c.fingerprint openssh-5.8p1/sshconnect.c
xfree(ra);
xfree(fp);
}
-@@ -838,9 +838,8 @@ check_host_key(char *hostname, struct so
+@@ -865,9 +865,8 @@ check_host_key(char *hostname, struct so
else
snprintf(msg1, sizeof(msg1), ".");
/* The default */
@@ -250,7 +250,7 @@ diff -up openssh-5.8p1/sshconnect.c.fingerprint openssh-5.8p1/sshconnect.c
msg2[0] = '\0';
if (options.verify_host_key_dns) {
if (matching_host_key_dns)
-@@ -855,10 +854,11 @@ check_host_key(char *hostname, struct so
+@@ -882,10 +881,11 @@ check_host_key(char *hostname, struct so
snprintf(msg, sizeof(msg),
"The authenticity of host '%.200s (%s)' can't be "
"established%s\n"
@@ -264,7 +264,7 @@ diff -up openssh-5.8p1/sshconnect.c.fingerprint openssh-5.8p1/sshconnect.c
options.visual_host_key ? "\n" : "",
options.visual_host_key ? ra : "",
msg2);
-@@ -1104,8 +1104,9 @@ verify_host_key(char *host, struct socka
+@@ -1130,8 +1130,9 @@ verify_host_key(char *host, struct socka
int flags = 0;
char *fp;
@@ -276,7 +276,7 @@ diff -up openssh-5.8p1/sshconnect.c.fingerprint openssh-5.8p1/sshconnect.c
xfree(fp);
/* XXX certs are not yet supported for DNS */
-@@ -1214,14 +1215,15 @@ show_other_keys(struct hostkeys *hostkey
+@@ -1232,14 +1233,15 @@ show_other_keys(struct hostkeys *hostkey
continue;
if (!lookup_key_in_hostkeys_by_type(hostkeys, type[i], &found))
continue;
@@ -296,7 +296,7 @@ diff -up openssh-5.8p1/sshconnect.c.fingerprint openssh-5.8p1/sshconnect.c
if (options.visual_host_key)
logit("%s", ra);
xfree(ra);
-@@ -1236,7 +1238,7 @@ warn_changed_key(Key *host_key)
+@@ -1254,7 +1256,7 @@ warn_changed_key(Key *host_key)
{
char *fp;
@@ -305,7 +305,7 @@ diff -up openssh-5.8p1/sshconnect.c.fingerprint openssh-5.8p1/sshconnect.c
error("@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@");
error("@ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @");
-@@ -1244,8 +1246,8 @@ warn_changed_key(Key *host_key)
+@@ -1262,8 +1264,8 @@ warn_changed_key(Key *host_key)
error("IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!");
error("Someone could be eavesdropping on you right now (man-in-the-middle attack)!");
error("It is also possible that a host key has just been changed.");
@@ -316,10 +316,10 @@ diff -up openssh-5.8p1/sshconnect.c.fingerprint openssh-5.8p1/sshconnect.c
error("Please contact your system administrator.");
xfree(fp);
-diff -up openssh-5.8p1/ssh-keygen.c.fingerprint openssh-5.8p1/ssh-keygen.c
---- openssh-5.8p1/ssh-keygen.c.fingerprint 2011-01-11 07:20:31.000000000 +0100
-+++ openssh-5.8p1/ssh-keygen.c 2011-02-25 09:17:18.000000000 +0100
-@@ -714,13 +714,14 @@ do_fingerprint(struct passwd *pw)
+diff -up openssh-6.2p1/ssh-keygen.c.fingerprint openssh-6.2p1/ssh-keygen.c
+--- openssh-6.2p1/ssh-keygen.c.fingerprint 2013-02-12 01:03:36.000000000 +0100
++++ openssh-6.2p1/ssh-keygen.c 2013-03-22 12:20:49.033684903 +0100
+@@ -767,13 +767,14 @@ do_fingerprint(struct passwd *pw)
{
FILE *f;
Key *public;
@@ -336,7 +336,7 @@ diff -up openssh-5.8p1/ssh-keygen.c.fingerprint openssh-5.8p1/ssh-keygen.c
rep = print_bubblebabble ? SSH_FP_BUBBLEBABBLE : SSH_FP_HEX;
if (!have_identity)
-@@ -732,8 +733,8 @@ do_fingerprint(struct passwd *pw)
+@@ -785,8 +786,8 @@ do_fingerprint(struct passwd *pw)
public = key_load_public(identity_file, &comment);
if (public != NULL) {
fp = key_fingerprint(public, fptype, rep);
@@ -347,7 +347,7 @@ diff -up openssh-5.8p1/ssh-keygen.c.fingerprint openssh-5.8p1/ssh-keygen.c
key_type(public));
if (log_level >= SYSLOG_LEVEL_VERBOSE)
printf("%s\n", ra);
-@@ -798,8 +799,8 @@ do_fingerprint(struct passwd *pw)
+@@ -851,8 +852,8 @@ do_fingerprint(struct passwd *pw)
}
comment = *cp ? cp : comment;
fp = key_fingerprint(public, fptype, rep);
@@ -358,7 +358,7 @@ diff -up openssh-5.8p1/ssh-keygen.c.fingerprint openssh-5.8p1/ssh-keygen.c
comment ? comment : "no comment", key_type(public));
if (log_level >= SYSLOG_LEVEL_VERBOSE)
printf("%s\n", ra);
-@@ -823,13 +824,15 @@ printhost(FILE *f, const char *name, Key
+@@ -970,13 +971,15 @@ printhost(FILE *f, const char *name, Key
if (print_fingerprint) {
enum fp_rep rep;
enum fp_type fptype;
@@ -378,7 +378,7 @@ diff -up openssh-5.8p1/ssh-keygen.c.fingerprint openssh-5.8p1/ssh-keygen.c
key_type(public));
if (log_level >= SYSLOG_LEVEL_VERBOSE)
printf("%s\n", ra);
-@@ -1695,16 +1698,17 @@ do_show_cert(struct passwd *pw)
+@@ -1854,16 +1857,17 @@ do_show_cert(struct passwd *pw)
fatal("%s is not a certificate", identity_file);
v00 = key->type == KEY_RSA_CERT_V00 || key->type == KEY_DSA_CERT_V00;
@@ -402,7 +402,7 @@ diff -up openssh-5.8p1/ssh-keygen.c.fingerprint openssh-5.8p1/ssh-keygen.c
printf(" Key ID: \"%s\"\n", key->cert->key_id);
if (!v00) {
printf(" Serial: %llu\n",
-@@ -2249,13 +2253,12 @@ passphrase_again:
+@@ -2651,13 +2655,12 @@ passphrase_again:
fclose(f);
if (!quiet) {
diff --git a/openssh-5.9p1-fips.patch b/openssh-6.2p1-fips.patch
similarity index 69%
rename from openssh-5.9p1-fips.patch
rename to openssh-6.2p1-fips.patch
index 6918b82..6cbc983 100644
--- a/openssh-5.9p1-fips.patch
+++ b/openssh-6.2p1-fips.patch
@@ -1,6 +1,6 @@
-diff -up openssh-5.9p1/authfile.c.fips openssh-5.9p1/authfile.c
---- openssh-5.9p1/authfile.c.fips 2012-07-17 20:57:35.078155160 +0200
-+++ openssh-5.9p1/authfile.c 2012-07-17 20:57:35.086155338 +0200
+diff -up openssh-6.2p1/authfile.c.fips openssh-6.2p1/authfile.c
+--- openssh-6.2p1/authfile.c.fips 2013-03-27 13:14:49.164683482 +0100
++++ openssh-6.2p1/authfile.c 2013-03-27 13:14:49.177683431 +0100
@@ -148,8 +148,14 @@ key_private_rsa1_to_blob(Key *key, Buffe
/* Allocate space for the private part of the key in the buffer. */
cp = buffer_append_space(&encrypted, buffer_len(&buffer));
@@ -9,14 +9,14 @@ diff -up openssh-5.9p1/authfile.c.fips openssh-5.9p1/authfile.c
- CIPHER_ENCRYPT);
+ if (cipher_set_key_string(&ciphercontext, cipher, passphrase,
+ CIPHER_ENCRYPT) < 0) {
-+ error("cipher_set_key_string failed.");
-+ buffer_free(&encrypted);
-+ buffer_free(&buffer);
-+ return 0;
++ error("cipher_set_key_string failed.");
++ buffer_free(&encrypted);
++ buffer_free(&buffer);
++ return 0;
+ }
+
cipher_crypt(&ciphercontext, cp,
- buffer_ptr(&buffer), buffer_len(&buffer));
+ buffer_ptr(&buffer), buffer_len(&buffer), 0, 0);
cipher_cleanup(&ciphercontext);
@@ -472,8 +478,13 @@ key_parse_private_rsa1(Buffer *blob, con
cp = buffer_append_space(&decrypted, buffer_len(©));
@@ -26,17 +26,17 @@ diff -up openssh-5.9p1/authfile.c.fips openssh-5.9p1/authfile.c
- CIPHER_DECRYPT);
+ if (cipher_set_key_string(&ciphercontext, cipher, passphrase,
+ CIPHER_DECRYPT) < 0) {
-+ error("cipher_set_key_string failed.");
-+ buffer_free(&decrypted);
-+ goto fail;
++ error("cipher_set_key_string failed.");
++ buffer_free(&decrypted);
++ goto fail;
+ }
+
cipher_crypt(&ciphercontext, cp,
- buffer_ptr(©), buffer_len(©));
+ buffer_ptr(©), buffer_len(©), 0, 0);
cipher_cleanup(&ciphercontext);
-diff -up openssh-5.9p1/cipher.c.fips openssh-5.9p1/cipher.c
---- openssh-5.9p1/cipher.c.fips 2012-07-17 20:57:34.988153164 +0200
-+++ openssh-5.9p1/cipher.c 2012-07-17 20:57:35.086155338 +0200
+diff -up openssh-6.2p1/cipher.c.fips openssh-6.2p1/cipher.c
+--- openssh-6.2p1/cipher.c.fips 2013-03-27 13:14:49.087683788 +0100
++++ openssh-6.2p1/cipher.c 2013-03-27 13:14:49.177683431 +0100
@@ -40,6 +40,7 @@
#include <sys/types.h>
@@ -45,30 +45,35 @@ diff -up openssh-5.9p1/cipher.c.fips openssh-5.9p1/cipher.c
#include <string.h>
#include <stdarg.h>
-@@ -86,6 +87,22 @@ struct Cipher ciphers[] = {
- { NULL, SSH_CIPHER_INVALID, 0, 0, 0, 0, NULL }
+@@ -89,6 +90,27 @@ struct Cipher ciphers[] = {
+ { NULL, SSH_CIPHER_INVALID, 0, 0, 0, 0, 0, 0, NULL }
};
+struct Cipher fips_ciphers[] = {
-+ { "none", SSH_CIPHER_NONE, 8, 0, 0, 0, EVP_enc_null },
-+ { "3des", SSH_CIPHER_3DES, 8, 16, 0, 1, evp_ssh1_3des },
++ { "none", SSH_CIPHER_NONE, 8, 0, 0, 0, 0, 0, EVP_enc_null },
++ { "3des", SSH_CIPHER_3DES, 8, 16, 0, 0, 0, 1, evp_ssh1_3des },
+
-+ { "3des-cbc", SSH_CIPHER_SSH2, 8, 24, 0, 1, EVP_des_ede3_cbc },
-+ { "aes128-cbc", SSH_CIPHER_SSH2, 16, 16, 0, 1, EVP_aes_128_cbc },
-+ { "aes192-cbc", SSH_CIPHER_SSH2, 16, 24, 0, 1, EVP_aes_192_cbc },
-+ { "aes256-cbc", SSH_CIPHER_SSH2, 16, 32, 0, 1, EVP_aes_256_cbc },
++ { "3des-cbc", SSH_CIPHER_SSH2, 8, 24, 0, 0, 0, 1, EVP_des_ede3_cbc },
++ { "aes128-cbc", SSH_CIPHER_SSH2, 16, 16, 0, 0, 0, 1, EVP_aes_128_cbc },
++ { "aes192-cbc", SSH_CIPHER_SSH2, 16, 24, 0, 0, 0, 1, EVP_aes_192_cbc },
++ { "aes256-cbc", SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 1, EVP_aes_256_cbc },
+ { "rijndael-cbc at lysator.liu.se",
-+ SSH_CIPHER_SSH2, 16, 32, 0, 1, EVP_aes_256_cbc },
-+ { "aes128-ctr", SSH_CIPHER_SSH2, 16, 16, 0, 0, evp_aes_128_ctr },
-+ { "aes192-ctr", SSH_CIPHER_SSH2, 16, 24, 0, 0, evp_aes_128_ctr },
-+ { "aes256-ctr", SSH_CIPHER_SSH2, 16, 32, 0, 0, evp_aes_128_ctr },
-+ { NULL, SSH_CIPHER_INVALID, 0, 0, 0, 0, NULL }
++ SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 1, EVP_aes_256_cbc },
++ { "aes128-ctr", SSH_CIPHER_SSH2, 16, 16, 0, 0, 0, 0, EVP_aes_128_ctr },
++ { "aes192-ctr", SSH_CIPHER_SSH2, 16, 24, 0, 0, 0, 0, EVP_aes_128_ctr },
++ { "aes256-ctr", SSH_CIPHER_SSH2, 16, 32, 0, 0, 0, 0, EVP_aes_128_ctr },
++#ifdef OPENSSL_HAVE_EVPGCM
++ { "aes128-gcm at openssh.com",
++ SSH_CIPHER_SSH2, 16, 16, 12, 16, 0, 0, EVP_aes_128_gcm },
++ { "aes256-gcm at openssh.com",
++ SSH_CIPHER_SSH2, 16, 32, 12, 16, 0, 0, EVP_aes_256_gcm },
++#endif
++ { NULL, SSH_CIPHER_INVALID, 0, 0, 0, 0, 0, NULL }
+};
-+
/*--*/
u_int
-@@ -128,7 +145,7 @@ Cipher *
+@@ -143,7 +165,7 @@ Cipher *
cipher_by_name(const char *name)
{
Cipher *c;
@@ -77,7 +82,7 @@ diff -up openssh-5.9p1/cipher.c.fips openssh-5.9p1/cipher.c
if (strcmp(c->name, name) == 0)
return c;
return NULL;
-@@ -138,7 +155,7 @@ Cipher *
+@@ -153,7 +175,7 @@ Cipher *
cipher_by_number(int id)
{
Cipher *c;
@@ -86,7 +91,7 @@ diff -up openssh-5.9p1/cipher.c.fips openssh-5.9p1/cipher.c
if (c->number == id)
return c;
return NULL;
-@@ -182,7 +199,7 @@ cipher_number(const char *name)
+@@ -197,7 +219,7 @@ cipher_number(const char *name)
Cipher *c;
if (name == NULL)
return -1;
@@ -95,7 +100,7 @@ diff -up openssh-5.9p1/cipher.c.fips openssh-5.9p1/cipher.c
if (strcasecmp(c->name, name) == 0)
return c->number;
return -1;
-@@ -289,14 +306,15 @@ cipher_cleanup(CipherContext *cc)
+@@ -356,14 +378,15 @@ cipher_cleanup(CipherContext *cc)
* passphrase and using the resulting 16 bytes as the key.
*/
@@ -113,7 +118,7 @@ diff -up openssh-5.9p1/cipher.c.fips openssh-5.9p1/cipher.c
MD5_Update(&md, (const u_char *)passphrase, strlen(passphrase));
MD5_Final(digest, &md);
-@@ -304,6 +322,7 @@ cipher_set_key_string(CipherContext *cc,
+@@ -371,6 +394,7 @@ cipher_set_key_string(CipherContext *cc,
memset(digest, 0, sizeof(digest));
memset(&md, 0, sizeof(md));
@@ -121,10 +126,10 @@ diff -up openssh-5.9p1/cipher.c.fips openssh-5.9p1/cipher.c
}
/*
-diff -up openssh-5.9p1/cipher-ctr.c.fips openssh-5.9p1/cipher-ctr.c
---- openssh-5.9p1/cipher-ctr.c.fips 2010-10-07 13:06:42.000000000 +0200
-+++ openssh-5.9p1/cipher-ctr.c 2012-07-17 20:57:35.086155338 +0200
-@@ -140,7 +140,8 @@ evp_aes_128_ctr(void)
+diff -up openssh-6.2p1/cipher-ctr.c.fips openssh-6.2p1/cipher-ctr.c
+--- openssh-6.2p1/cipher-ctr.c.fips 2013-01-20 12:31:30.000000000 +0100
++++ openssh-6.2p1/cipher-ctr.c 2013-03-27 13:14:49.177683431 +0100
+@@ -138,7 +138,8 @@ evp_aes_128_ctr(void)
aes_ctr.do_cipher = ssh_aes_ctr;
#ifndef SSH_OLD_EVP
aes_ctr.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH |
@@ -134,21 +139,21 @@ diff -up openssh-5.9p1/cipher-ctr.c.fips openssh-5.9p1/cipher-ctr.c
#endif
return (&aes_ctr);
}
-diff -up openssh-5.9p1/cipher.h.fips openssh-5.9p1/cipher.h
---- openssh-5.9p1/cipher.h.fips 2012-07-17 20:57:34.989153186 +0200
-+++ openssh-5.9p1/cipher.h 2012-07-17 20:57:35.087155360 +0200
-@@ -87,7 +87,7 @@ void cipher_init(CipherContext *, Ciphe
- const u_char *, u_int, int);
- void cipher_crypt(CipherContext *, u_char *, const u_char *, u_int);
+diff -up openssh-6.2p1/cipher.h.fips openssh-6.2p1/cipher.h
+--- openssh-6.2p1/cipher.h.fips 2013-03-27 13:14:49.088683784 +0100
++++ openssh-6.2p1/cipher.h 2013-03-27 13:14:49.177683431 +0100
+@@ -91,7 +91,7 @@ void cipher_init(CipherContext *, Ciphe
+ void cipher_crypt(CipherContext *, u_char *, const u_char *,
+ u_int, u_int, u_int);
void cipher_cleanup(CipherContext *);
-void cipher_set_key_string(CipherContext *, Cipher *, const char *, int);
+int cipher_set_key_string(CipherContext *, Cipher *, const char *, int);
u_int cipher_blocksize(const Cipher *);
u_int cipher_keylen(const Cipher *);
- u_int cipher_is_cbc(const Cipher *);
-diff -up openssh-5.9p1/key.c.fips openssh-5.9p1/key.c
---- openssh-5.9p1/key.c.fips 2012-07-17 20:57:35.007153585 +0200
-+++ openssh-5.9p1/key.c 2012-07-17 20:57:35.087155360 +0200
+ u_int cipher_authlen(const Cipher *);
+diff -up openssh-6.2p1/key.c.fips openssh-6.2p1/key.c
+--- openssh-6.2p1/key.c.fips 2013-03-27 13:14:49.100683736 +0100
++++ openssh-6.2p1/key.c 2013-03-27 13:14:49.178683427 +0100
@@ -40,6 +40,7 @@
#include <sys/types.h>
@@ -157,7 +162,7 @@ diff -up openssh-5.9p1/key.c.fips openssh-5.9p1/key.c
#include <openbsd-compat/openssl-compat.h>
#include <stdarg.h>
-@@ -602,9 +603,13 @@ key_fingerprint_selection(void)
+@@ -607,9 +608,13 @@ key_fingerprint_selection(void)
char *env;
if (!rv_defined) {
@@ -174,9 +179,9 @@ diff -up openssh-5.9p1/key.c.fips openssh-5.9p1/key.c
rv_defined = 1;
}
return rv;
-diff -up openssh-5.9p1/mac.c.fips openssh-5.9p1/mac.c
---- openssh-5.9p1/mac.c.fips 2012-07-17 20:57:34.996153341 +0200
-+++ openssh-5.9p1/mac.c 2012-07-17 20:58:35.584497499 +0200
+diff -up openssh-6.2p1/mac.c.fips openssh-6.2p1/mac.c
+--- openssh-6.2p1/mac.c.fips 2013-03-27 13:14:49.093683764 +0100
++++ openssh-6.2p1/mac.c 2013-03-27 13:16:33.524266158 +0100
@@ -28,6 +28,7 @@
#include <sys/types.h>
@@ -185,32 +190,35 @@ diff -up openssh-5.9p1/mac.c.fips openssh-5.9p1/mac.c
#include <stdarg.h>
#include <string.h>
-@@ -47,14 +48,14 @@
- #define SSH_EVP 1 /* OpenSSL EVP-based MAC */
+@@ -50,7 +51,7 @@
#define SSH_UMAC 2 /* UMAC (not integrated with OpenSSL) */
+ #define SSH_UMAC128 3
-struct {
+struct Macs {
char *name;
int type;
const EVP_MD * (*mdfunc)(void);
- int truncatebits; /* truncate digest if != 0 */
+@@ -58,7 +59,9 @@ struct {
int key_len; /* just for UMAC */
int len; /* just for UMAC */
+ int etm; /* Encrypt-then-MAC */
-} macs[] = {
-+} all_macs[] = {
- { "hmac-sha1", SSH_EVP, EVP_sha1, 0, -1, -1 },
- { "hmac-sha1-96", SSH_EVP, EVP_sha1, 96, -1, -1 },
- #ifdef HAVE_EVP_SHA256
-@@ -71,9 +72,19 @@ struct {
- { NULL, 0, NULL, 0, -1, -1 }
++};
++
++struct Macs all_macs[] = {
+ /* Encrypt-and-MAC (encrypt-and-authenticate) variants */
+ { "hmac-sha1", SSH_EVP, EVP_sha1, 0, 0, 0, 0 },
+ { "hmac-sha1-96", SSH_EVP, EVP_sha1, 96, 0, 0, 0 },
+@@ -89,9 +92,19 @@ struct {
+ { NULL, 0, NULL, 0, 0, 0, 0 }
};
+struct Macs fips_macs[] = {
-+ { "hmac-sha1", SSH_EVP, EVP_sha1, 0, -1, -1 },
++ { "hmac-sha1", SSH_EVP, EVP_sha1, 0, 0, 0, 0 },
+#ifdef HAVE_EVP_SHA256
-+ { "hmac-sha2-256", SSH_EVP, EVP_sha256, 0, -1, -1 },
-+ { "hmac-sha2-512", SSH_EVP, EVP_sha512, 0, -1, -1 },
++ { "hmac-sha2-256", SSH_EVP, EVP_sha256, 0, 0, 0, 0 },
++ { "hmac-sha2-512", SSH_EVP, EVP_sha512, 0, 0, 0, 0 },
+#endif
+ { NULL, 0, NULL, 0, -1, -1 }
+};
@@ -222,7 +230,7 @@ diff -up openssh-5.9p1/mac.c.fips openssh-5.9p1/mac.c
int evp_len;
mac->type = macs[which].type;
if (mac->type == SSH_EVP) {
-@@ -94,6 +105,7 @@ int
+@@ -113,6 +126,7 @@ int
mac_setup(Mac *mac, char *name)
{
int i;
@@ -230,19 +238,19 @@ diff -up openssh-5.9p1/mac.c.fips openssh-5.9p1/mac.c
for (i = 0; macs[i].name; i++) {
if (strcmp(name, macs[i].name) == 0) {
-diff -up openssh-5.9p1/Makefile.in.fips openssh-5.9p1/Makefile.in
---- openssh-5.9p1/Makefile.in.fips 2012-07-17 20:57:35.069154962 +0200
-+++ openssh-5.9p1/Makefile.in 2012-07-17 20:57:35.086155338 +0200
-@@ -142,25 +142,25 @@ libssh.a: $(LIBSSH_OBJS)
+diff -up openssh-6.2p1/Makefile.in.fips openssh-6.2p1/Makefile.in
+--- openssh-6.2p1/Makefile.in.fips 2013-03-27 13:14:49.155683518 +0100
++++ openssh-6.2p1/Makefile.in 2013-03-27 13:14:49.178683427 +0100
+@@ -145,25 +145,25 @@ libssh.a: $(LIBSSH_OBJS)
$(RANLIB) $@
ssh$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHOBJS)
-- $(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHLIBS) $(LIBS)
-+ $(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(SSHLIBS) $(LIBS)
+- $(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHLIBS) $(LIBS) $(GSSLIBS)
++ $(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(SSHLIBS) $(LIBS) $(GSSLIBS)
sshd$(EXEEXT): libssh.a $(LIBCOMPAT) $(SSHDOBJS)
-- $(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) $(LIBS)
-+ $(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(SSHDLIBS) $(LIBS)
+- $(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) $(LIBS) $(GSSLIBS) $(K5LIBS)
++ $(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(SSHDLIBS) $(LIBS) $(GSSLIBS) $(K5LIBS)
scp$(EXEEXT): $(LIBCOMPAT) libssh.a scp.o progressmeter.o
$(LD) -o $@ scp.o progressmeter.o bufaux.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
@@ -265,7 +273,7 @@ diff -up openssh-5.9p1/Makefile.in.fips openssh-5.9p1/Makefile.in
ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-pkcs11-helper.o ssh-pkcs11.o
$(LD) -o $@ ssh-pkcs11-helper.o ssh-pkcs11.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
-@@ -172,7 +172,7 @@ ssh-keycat$(EXEEXT): $(LIBCOMPAT) libssh
+@@ -175,7 +175,7 @@ ssh-keycat$(EXEEXT): $(LIBCOMPAT) libssh
$(LD) -o $@ ssh-keycat.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lfipscheck $(SSHDLIBS)
ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o roaming_dummy.o
@@ -274,10 +282,10 @@ diff -up openssh-5.9p1/Makefile.in.fips openssh-5.9p1/Makefile.in
sftp-server$(EXEEXT): $(LIBCOMPAT) libssh.a sftp.o sftp-common.o sftp-server.o sftp-server-main.o
$(LD) -o $@ sftp-server.o sftp-common.o sftp-server-main.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
-diff -up openssh-5.9p1/myproposal.h.fips openssh-5.9p1/myproposal.h
---- openssh-5.9p1/myproposal.h.fips 2011-08-17 02:29:03.000000000 +0200
-+++ openssh-5.9p1/myproposal.h 2012-07-17 21:01:12.685982807 +0200
-@@ -97,6 +97,19 @@
+diff -up openssh-6.2p1/myproposal.h.fips openssh-6.2p1/myproposal.h
+--- openssh-6.2p1/myproposal.h.fips 2013-01-09 06:12:19.000000000 +0100
++++ openssh-6.2p1/myproposal.h 2013-03-27 13:14:49.178683427 +0100
+@@ -106,6 +106,19 @@
#define KEX_DEFAULT_COMP "none,zlib at openssh.com,zlib"
#define KEX_DEFAULT_LANG ""
@@ -297,9 +305,9 @@ diff -up openssh-5.9p1/myproposal.h.fips openssh-5.9p1/myproposal.h
static char *myproposal[PROPOSAL_MAX] = {
KEX_DEFAULT_KEX,
-diff -up openssh-5.9p1/openbsd-compat/bsd-arc4random.c.fips openssh-5.9p1/openbsd-compat/bsd-arc4random.c
---- openssh-5.9p1/openbsd-compat/bsd-arc4random.c.fips 2010-03-25 22:52:02.000000000 +0100
-+++ openssh-5.9p1/openbsd-compat/bsd-arc4random.c 2012-07-17 20:57:35.087155360 +0200
+diff -up openssh-6.2p1/openbsd-compat/bsd-arc4random.c.fips openssh-6.2p1/openbsd-compat/bsd-arc4random.c
+--- openssh-6.2p1/openbsd-compat/bsd-arc4random.c.fips 2010-03-25 22:52:02.000000000 +0100
++++ openssh-6.2p1/openbsd-compat/bsd-arc4random.c 2013-03-27 13:14:49.179683423 +0100
@@ -37,25 +37,18 @@
#define REKEY_BYTES (1 << 24)
@@ -355,9 +363,9 @@ diff -up openssh-5.9p1/openbsd-compat/bsd-arc4random.c.fips openssh-5.9p1/openbs
}
#endif /* !HAVE_ARC4RANDOM */
-diff -up openssh-5.9p1/ssh.c.fips openssh-5.9p1/ssh.c
---- openssh-5.9p1/ssh.c.fips 2011-08-05 22:18:16.000000000 +0200
-+++ openssh-5.9p1/ssh.c 2012-07-17 20:57:35.088155382 +0200
+diff -up openssh-6.2p1/ssh.c.fips openssh-6.2p1/ssh.c
+--- openssh-6.2p1/ssh.c.fips 2012-07-06 05:45:01.000000000 +0200
++++ openssh-6.2p1/ssh.c 2013-03-27 13:14:49.179683423 +0100
@@ -73,6 +73,8 @@
#include <openssl/evp.h>
@@ -388,7 +396,7 @@ diff -up openssh-5.9p1/ssh.c.fips openssh-5.9p1/ssh.c
options.protocol = SSH_PROTO_1;
break;
case '2':
-@@ -630,7 +639,6 @@ main(int ac, char **av)
+@@ -632,7 +641,6 @@ main(int ac, char **av)
if (!host)
usage();
@@ -396,7 +404,7 @@ diff -up openssh-5.9p1/ssh.c.fips openssh-5.9p1/ssh.c
ERR_load_crypto_strings();
/* Initialize the command to execute on remote host. */
-@@ -721,6 +729,10 @@ main(int ac, char **av)
+@@ -722,6 +730,10 @@ main(int ac, char **av)
seed_rng();
@@ -407,7 +415,7 @@ diff -up openssh-5.9p1/ssh.c.fips openssh-5.9p1/ssh.c
if (options.user == NULL)
options.user = xstrdup(pw->pw_name);
-@@ -789,6 +801,12 @@ main(int ac, char **av)
+@@ -790,6 +802,12 @@ main(int ac, char **av)
timeout_ms = options.connection_timeout * 1000;
@@ -420,9 +428,9 @@ diff -up openssh-5.9p1/ssh.c.fips openssh-5.9p1/ssh.c
/* Open a connection to the remote host. */
if (ssh_connect(host, &hostaddr, options.port,
options.address_family, options.connection_attempts, &timeout_ms,
-diff -up openssh-5.9p1/sshconnect2.c.fips openssh-5.9p1/sshconnect2.c
---- openssh-5.9p1/sshconnect2.c.fips 2012-07-17 20:57:34.955152432 +0200
-+++ openssh-5.9p1/sshconnect2.c 2012-07-17 20:57:35.088155382 +0200
+diff -up openssh-6.2p1/sshconnect2.c.fips openssh-6.2p1/sshconnect2.c
+--- openssh-6.2p1/sshconnect2.c.fips 2013-03-27 13:14:49.066683871 +0100
++++ openssh-6.2p1/sshconnect2.c 2013-03-27 13:14:49.179683423 +0100
@@ -44,6 +44,8 @@
#include <vis.h>
#endif
@@ -455,9 +463,9 @@ diff -up openssh-5.9p1/sshconnect2.c.fips openssh-5.9p1/sshconnect2.c
if (options.hostkeyalgorithms != NULL)
myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] =
options.hostkeyalgorithms;
-diff -up openssh-5.9p1/sshd.c.fips openssh-5.9p1/sshd.c
---- openssh-5.9p1/sshd.c.fips 2012-07-17 20:57:35.049154517 +0200
-+++ openssh-5.9p1/sshd.c 2012-07-17 20:57:35.089155405 +0200
+diff -up openssh-6.2p1/sshd.c.fips openssh-6.2p1/sshd.c
+--- openssh-6.2p1/sshd.c.fips 2013-03-27 13:14:49.146683554 +0100
++++ openssh-6.2p1/sshd.c 2013-03-27 13:14:49.180683419 +0100
@@ -76,6 +76,8 @@
#include <openssl/bn.h>
#include <openssl/md5.h>
@@ -467,7 +475,7 @@ diff -up openssh-5.9p1/sshd.c.fips openssh-5.9p1/sshd.c
#include "openbsd-compat/openssl-compat.h"
#ifdef HAVE_SECUREWARE
-@@ -1395,6 +1397,11 @@ main(int ac, char **av)
+@@ -1423,6 +1425,11 @@ main(int ac, char **av)
#endif
__progname = ssh_get_progname(av[0]);
@@ -479,7 +487,7 @@ diff -up openssh-5.9p1/sshd.c.fips openssh-5.9p1/sshd.c
/* Save argv. Duplicate so setproctitle emulation doesn't clobber it */
saved_argc = ac;
rexec_argc = ac;
-@@ -1554,8 +1561,6 @@ main(int ac, char **av)
+@@ -1571,8 +1578,6 @@ main(int ac, char **av)
else
closefrom(REEXEC_DEVCRYPTO_RESERVED_FD);
@@ -488,7 +496,7 @@ diff -up openssh-5.9p1/sshd.c.fips openssh-5.9p1/sshd.c
/*
* Force logging to stderr until we have loaded the private host
* key (unless started from inetd)
-@@ -1673,6 +1678,10 @@ main(int ac, char **av)
+@@ -1715,6 +1720,10 @@ main(int ac, char **av)
debug("private host key: #%d type %d %s", i, key->type,
key_type(key));
}
@@ -499,7 +507,7 @@ diff -up openssh-5.9p1/sshd.c.fips openssh-5.9p1/sshd.c
if ((options.protocol & SSH_PROTO_1) && !sensitive_data.have_ssh1_key) {
logit("Disabling protocol version 1. Could not load host key");
options.protocol &= ~SSH_PROTO_1;
-@@ -1837,6 +1846,10 @@ main(int ac, char **av)
+@@ -1878,6 +1887,10 @@ main(int ac, char **av)
/* Initialize the random number generator. */
arc4random_stir();
@@ -510,7 +518,7 @@ diff -up openssh-5.9p1/sshd.c.fips openssh-5.9p1/sshd.c
/* Chdir to the root directory so that the current disk can be
unmounted if desired. */
(void) chdir("/");
-@@ -2379,6 +2392,9 @@ do_ssh2_kex(void)
+@@ -2420,6 +2433,9 @@ do_ssh2_kex(void)
if (options.ciphers != NULL) {
myproposal[PROPOSAL_ENC_ALGS_CTOS] =
myproposal[PROPOSAL_ENC_ALGS_STOC] = options.ciphers;
@@ -520,7 +528,7 @@ diff -up openssh-5.9p1/sshd.c.fips openssh-5.9p1/sshd.c
}
myproposal[PROPOSAL_ENC_ALGS_CTOS] =
compat_cipher_proposal(myproposal[PROPOSAL_ENC_ALGS_CTOS]);
-@@ -2388,6 +2404,9 @@ do_ssh2_kex(void)
+@@ -2429,6 +2445,9 @@ do_ssh2_kex(void)
if (options.macs != NULL) {
myproposal[PROPOSAL_MAC_ALGS_CTOS] =
myproposal[PROPOSAL_MAC_ALGS_STOC] = options.macs;
diff --git a/openssh-5.8p2-force_krb.patch b/openssh-6.2p1-force_krb.patch
similarity index 89%
rename from openssh-5.8p2-force_krb.patch
rename to openssh-6.2p1-force_krb.patch
index c3860ce..5423171 100644
--- a/openssh-5.8p2-force_krb.patch
+++ b/openssh-6.2p1-force_krb.patch
@@ -1,6 +1,6 @@
-diff -up openssh-5.8p2/gss-serv-krb5.c.force_krb openssh-5.8p2/gss-serv-krb5.c
---- openssh-5.8p2/gss-serv-krb5.c.force_krb 2006-09-01 07:38:36.000000000 +0200
-+++ openssh-5.8p2/gss-serv-krb5.c 2011-05-19 03:41:45.801109545 +0200
+diff -up openssh-6.2p1/gss-serv-krb5.c.force_krb openssh-6.2p1/gss-serv-krb5.c
+--- openssh-6.2p1/gss-serv-krb5.c.force_krb 2013-03-25 20:04:53.807817333 +0100
++++ openssh-6.2p1/gss-serv-krb5.c 2013-03-25 20:04:53.818817403 +0100
@@ -32,7 +32,9 @@
#include <sys/types.h>
@@ -216,10 +216,10 @@ diff -up openssh-5.8p2/gss-serv-krb5.c.force_krb openssh-5.8p2/gss-serv-krb5.c
/* This writes out any forwarded credentials from the structure populated
* during userauth. Called after we have setuid to the user */
-diff -up openssh-5.8p2/session.c.force_krb openssh-5.8p2/session.c
---- openssh-5.8p2/session.c.force_krb 2011-05-19 03:41:41.000000000 +0200
-+++ openssh-5.8p2/session.c 2011-05-19 03:43:32.437173662 +0200
-@@ -820,6 +820,29 @@ do_exec(Session *s, const char *command)
+diff -up openssh-6.2p1/session.c.force_krb openssh-6.2p1/session.c
+--- openssh-6.2p1/session.c.force_krb 2013-03-25 20:04:53.724816810 +0100
++++ openssh-6.2p1/session.c 2013-03-25 20:04:53.818817403 +0100
+@@ -823,6 +823,29 @@ do_exec(Session *s, const char *command)
debug("Forced command (key option) '%.900s'", command);
}
@@ -249,9 +249,9 @@ diff -up openssh-5.8p2/session.c.force_krb openssh-5.8p2/session.c
#ifdef SSH_AUDIT_EVENTS
if (s->command != NULL || s->command_handle != -1)
fatal("do_exec: command already set");
-diff -up openssh-5.8p2/sshd.8.force_krb openssh-5.8p2/sshd.8
---- openssh-5.8p2/sshd.8.force_krb 2011-05-19 03:41:30.582114401 +0200
-+++ openssh-5.8p2/sshd.8 2011-05-19 03:41:46.159106308 +0200
+diff -up openssh-6.2p1/sshd.8.force_krb openssh-6.2p1/sshd.8
+--- openssh-6.2p1/sshd.8.force_krb 2013-03-25 20:04:53.787817207 +0100
++++ openssh-6.2p1/sshd.8 2013-03-25 20:04:53.819817409 +0100
@@ -323,6 +323,7 @@ Finally, the server and the client enter
The client tries to authenticate itself using
host-based authentication,
@@ -273,13 +273,13 @@ diff -up openssh-5.8p2/sshd.8.force_krb openssh-5.8p2/sshd.8
.It Pa ~/.ssh/
This directory is the default location for all user-specific configuration
and authentication information.
-diff -up openssh-5.8p2/ssh-gss.h.force_krb openssh-5.8p2/ssh-gss.h
---- openssh-5.8p2/ssh-gss.h.force_krb 2007-06-12 15:40:39.000000000 +0200
-+++ openssh-5.8p2/ssh-gss.h 2011-05-19 03:41:46.302234118 +0200
-@@ -48,6 +48,10 @@
- #define GSS_C_NT_HOSTBASED_SERVICE gss_nt_service_name
- #endif /* GSS_C_NT_... */
- #endif /* !HEIMDAL */
+diff -up openssh-6.2p1/ssh-gss.h.force_krb openssh-6.2p1/ssh-gss.h
+--- openssh-6.2p1/ssh-gss.h.force_krb 2013-03-25 20:04:53.819817409 +0100
++++ openssh-6.2p1/ssh-gss.h 2013-03-25 20:05:26.463023197 +0100
+@@ -49,6 +49,10 @@
+ # endif /* !HAVE_DECL_GSS_C_NT_... */
+
+ # endif /* !HEIMDAL */
+
+/* .k5users support */
+extern char **k5users_allowed_cmds;
diff --git a/openssh-6.1p1-gsskex.patch b/openssh-6.2p1-gsskex.patch
similarity index 91%
rename from openssh-6.1p1-gsskex.patch
rename to openssh-6.2p1-gsskex.patch
index 9b0bad9..3934dcf 100644
--- a/openssh-6.1p1-gsskex.patch
+++ b/openssh-6.2p1-gsskex.patch
@@ -1,6 +1,6 @@
-diff -up openssh-6.1p1/auth2.c.gsskex openssh-6.1p1/auth2.c
---- openssh-6.1p1/auth2.c.gsskex 2012-11-30 13:58:08.871298935 +0100
-+++ openssh-6.1p1/auth2.c 2012-11-30 13:58:08.946298649 +0100
+diff -up openssh-6.2p1/auth2.c.gsskex openssh-6.2p1/auth2.c
+--- openssh-6.2p1/auth2.c.gsskex 2013-03-27 13:19:11.062624591 +0100
++++ openssh-6.2p1/auth2.c 2013-03-27 13:19:11.140624271 +0100
@@ -69,6 +69,7 @@ extern Authmethod method_passwd;
extern Authmethod method_kbdint;
extern Authmethod method_hostbased;
@@ -17,9 +17,9 @@ diff -up openssh-6.1p1/auth2.c.gsskex openssh-6.1p1/auth2.c
&method_gssapi,
#endif
#ifdef JPAKE
-diff -up openssh-6.1p1/auth2-gss.c.gsskex openssh-6.1p1/auth2-gss.c
---- openssh-6.1p1/auth2-gss.c.gsskex 2012-11-30 13:58:08.871298935 +0100
-+++ openssh-6.1p1/auth2-gss.c 2012-11-30 13:59:19.622985133 +0100
+diff -up openssh-6.2p1/auth2-gss.c.gsskex openssh-6.2p1/auth2-gss.c
+--- openssh-6.2p1/auth2-gss.c.gsskex 2013-03-27 13:19:11.062624591 +0100
++++ openssh-6.2p1/auth2-gss.c 2013-03-27 13:19:11.141624267 +0100
@@ -52,6 +52,40 @@ static void input_gssapi_mic(int type, u
static void input_gssapi_exchange_complete(int type, u_int32_t plen, void *ctxt);
static void input_gssapi_errtok(int, u_int32_t, void *);
@@ -94,9 +94,9 @@ diff -up openssh-6.1p1/auth2-gss.c.gsskex openssh-6.1p1/auth2-gss.c
Authmethod method_gssapi = {
"gssapi-with-mic",
userauth_gssapi,
-diff -up openssh-6.1p1/auth-krb5.c.gsskex openssh-6.1p1/auth-krb5.c
---- openssh-6.1p1/auth-krb5.c.gsskex 2012-04-26 01:52:15.000000000 +0200
-+++ openssh-6.1p1/auth-krb5.c 2012-11-30 13:58:08.947298647 +0100
+diff -up openssh-6.2p1/auth-krb5.c.gsskex openssh-6.2p1/auth-krb5.c
+--- openssh-6.2p1/auth-krb5.c.gsskex 2012-04-26 01:52:15.000000000 +0200
++++ openssh-6.2p1/auth-krb5.c 2013-03-27 13:19:11.140624271 +0100
@@ -50,6 +50,7 @@
#include <errno.h>
#include <unistd.h>
@@ -203,9 +203,9 @@ diff -up openssh-6.1p1/auth-krb5.c.gsskex openssh-6.1p1/auth-krb5.c
return (krb5_cc_resolve(ctx, ccname, ccache));
}
-diff -up openssh-6.1p1/ChangeLog.gssapi.gsskex openssh-6.1p1/ChangeLog.gssapi
---- openssh-6.1p1/ChangeLog.gssapi.gsskex 2012-11-30 13:58:08.947298647 +0100
-+++ openssh-6.1p1/ChangeLog.gssapi 2012-11-30 13:58:08.947298647 +0100
+diff -up openssh-6.2p1/ChangeLog.gssapi.gsskex openssh-6.2p1/ChangeLog.gssapi
+--- openssh-6.2p1/ChangeLog.gssapi.gsskex 2013-03-27 13:19:11.143624259 +0100
++++ openssh-6.2p1/ChangeLog.gssapi 2013-03-27 13:19:11.143624259 +0100
@@ -0,0 +1,113 @@
+20110101
+ - Finally update for OpenSSH 5.6p1
@@ -320,9 +320,9 @@ diff -up openssh-6.1p1/ChangeLog.gssapi.gsskex openssh-6.1p1/ChangeLog.gssapi
+ add support for GssapiTrustDns option for gssapi-with-mic
+ (from jbasney AT ncsa.uiuc.edu)
+ <gssapi-with-mic support is Bugzilla #1008>
-diff -up openssh-6.1p1/clientloop.c.gsskex openssh-6.1p1/clientloop.c
---- openssh-6.1p1/clientloop.c.gsskex 2012-11-30 13:58:08.781299279 +0100
-+++ openssh-6.1p1/clientloop.c 2012-11-30 13:58:08.948298644 +0100
+diff -up openssh-6.2p1/clientloop.c.gsskex openssh-6.2p1/clientloop.c
+--- openssh-6.2p1/clientloop.c.gsskex 2013-03-27 13:19:11.001624842 +0100
++++ openssh-6.2p1/clientloop.c 2013-03-27 13:19:11.141624267 +0100
@@ -111,6 +111,10 @@
#include "msg.h"
#include "roaming.h"
@@ -334,7 +334,7 @@ diff -up openssh-6.1p1/clientloop.c.gsskex openssh-6.1p1/clientloop.c
/* import options */
extern Options options;
-@@ -1544,6 +1548,15 @@ client_loop(int have_pty, int escape_cha
+@@ -1599,6 +1603,15 @@ client_loop(int have_pty, int escape_cha
/* Do channel operations unless rekeying in progress. */
if (!rekeying) {
channel_after_select(readset, writeset);
@@ -350,10 +350,10 @@ diff -up openssh-6.1p1/clientloop.c.gsskex openssh-6.1p1/clientloop.c
if (need_rekeying || packet_need_rekeying()) {
debug("need rekeying");
xxx_kex->done = 0;
-diff -up openssh-6.1p1/configure.ac.gsskex openssh-6.1p1/configure.ac
---- openssh-6.1p1/configure.ac.gsskex 2012-11-30 13:58:08.934298697 +0100
-+++ openssh-6.1p1/configure.ac 2012-11-30 13:58:08.949298640 +0100
-@@ -545,6 +545,30 @@ main() { if (NSVersionOfRunTimeLibrary("
+diff -up openssh-6.2p1/configure.ac.gsskex openssh-6.2p1/configure.ac
+--- openssh-6.2p1/configure.ac.gsskex 2013-03-27 13:19:11.128624320 +0100
++++ openssh-6.2p1/configure.ac 2013-03-27 13:19:11.142624263 +0100
+@@ -533,6 +533,30 @@ main() { if (NSVersionOfRunTimeLibrary("
[Use tunnel device compatibility to OpenBSD])
AC_DEFINE([SSH_TUN_PREPEND_AF], [1],
[Prepend the address family to IP tunnel traffic])
@@ -384,9 +384,9 @@ diff -up openssh-6.1p1/configure.ac.gsskex openssh-6.1p1/configure.ac
m4_pattern_allow([AU_IPv])
AC_CHECK_DECL([AU_IPv4], [],
AC_DEFINE([AU_IPv4], [0], [System only supports IPv4 audit records])
-diff -up openssh-6.1p1/gss-genr.c.gsskex openssh-6.1p1/gss-genr.c
---- openssh-6.1p1/gss-genr.c.gsskex 2009-06-22 08:11:07.000000000 +0200
-+++ openssh-6.1p1/gss-genr.c 2012-11-30 13:58:08.949298640 +0100
+diff -up openssh-6.2p1/gss-genr.c.gsskex openssh-6.2p1/gss-genr.c
+--- openssh-6.2p1/gss-genr.c.gsskex 2009-06-22 08:11:07.000000000 +0200
++++ openssh-6.2p1/gss-genr.c 2013-03-27 13:19:11.142624263 +0100
@@ -1,7 +1,7 @@
/* $OpenBSD: gss-genr.c,v 1.20 2009/06/22 05:39:28 dtucker Exp $ */
@@ -734,9 +734,9 @@ diff -up openssh-6.1p1/gss-genr.c.gsskex openssh-6.1p1/gss-genr.c
+}
+
#endif /* GSSAPI */
-diff -up openssh-6.1p1/gss-serv.c.gsskex openssh-6.1p1/gss-serv.c
---- openssh-6.1p1/gss-serv.c.gsskex 2011-08-05 22:16:46.000000000 +0200
-+++ openssh-6.1p1/gss-serv.c 2012-11-30 13:58:08.949298640 +0100
+diff -up openssh-6.2p1/gss-serv.c.gsskex openssh-6.2p1/gss-serv.c
+--- openssh-6.2p1/gss-serv.c.gsskex 2011-08-05 22:16:46.000000000 +0200
++++ openssh-6.2p1/gss-serv.c 2013-03-27 13:19:11.142624263 +0100
@@ -45,15 +45,20 @@
#include "channels.h"
#include "session.h"
@@ -1075,9 +1075,9 @@ diff -up openssh-6.1p1/gss-serv.c.gsskex openssh-6.1p1/gss-serv.c
}
#endif
-diff -up openssh-6.1p1/gss-serv-krb5.c.gsskex openssh-6.1p1/gss-serv-krb5.c
---- openssh-6.1p1/gss-serv-krb5.c.gsskex 2006-09-01 07:38:36.000000000 +0200
-+++ openssh-6.1p1/gss-serv-krb5.c 2012-11-30 13:58:08.949298640 +0100
+diff -up openssh-6.2p1/gss-serv-krb5.c.gsskex openssh-6.2p1/gss-serv-krb5.c
+--- openssh-6.2p1/gss-serv-krb5.c.gsskex 2006-09-01 07:38:36.000000000 +0200
++++ openssh-6.2p1/gss-serv-krb5.c 2013-03-27 13:19:11.143624259 +0100
@@ -1,7 +1,7 @@
/* $OpenBSD: gss-serv-krb5.c,v 1.7 2006/08/03 03:34:42 deraadt Exp $ */
@@ -1200,9 +1200,9 @@ diff -up openssh-6.1p1/gss-serv-krb5.c.gsskex openssh-6.1p1/gss-serv-krb5.c
};
#endif /* KRB5 */
-diff -up openssh-6.1p1/kex.c.gsskex openssh-6.1p1/kex.c
---- openssh-6.1p1/kex.c.gsskex 2012-11-30 13:58:08.820299131 +0100
-+++ openssh-6.1p1/kex.c 2012-11-30 13:58:08.950298635 +0100
+diff -up openssh-6.2p1/kex.c.gsskex openssh-6.2p1/kex.c
+--- openssh-6.2p1/kex.c.gsskex 2013-03-27 13:19:11.039624686 +0100
++++ openssh-6.2p1/kex.c 2013-03-27 13:19:11.143624259 +0100
@@ -51,6 +51,10 @@
#include "roaming.h"
#include "audit.h"
@@ -1214,7 +1214,7 @@ diff -up openssh-6.1p1/kex.c.gsskex openssh-6.1p1/kex.c
#if OPENSSL_VERSION_NUMBER >= 0x00907000L
# if defined(HAVE_EVP_SHA256)
# define evp_ssh_sha256 EVP_sha256
-@@ -371,6 +375,20 @@ choose_kex(Kex *k, char *client, char *s
+@@ -382,6 +386,20 @@ choose_kex(Kex *k, char *client, char *s
k->kex_type = KEX_ECDH_SHA2;
k->evp_md = kex_ecdh_name_to_evpmd(k->name);
#endif
@@ -1235,9 +1235,9 @@ diff -up openssh-6.1p1/kex.c.gsskex openssh-6.1p1/kex.c
} else
fatal("bad kex alg %s", k->name);
}
-diff -up openssh-6.1p1/kexgssc.c.gsskex openssh-6.1p1/kexgssc.c
---- openssh-6.1p1/kexgssc.c.gsskex 2012-11-30 13:58:08.950298635 +0100
-+++ openssh-6.1p1/kexgssc.c 2012-11-30 13:58:08.950298635 +0100
+diff -up openssh-6.2p1/kexgssc.c.gsskex openssh-6.2p1/kexgssc.c
+--- openssh-6.2p1/kexgssc.c.gsskex 2013-03-27 13:19:11.143624259 +0100
++++ openssh-6.2p1/kexgssc.c 2013-03-27 13:19:11.143624259 +0100
@@ -0,0 +1,334 @@
+/*
+ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
@@ -1573,9 +1573,9 @@ diff -up openssh-6.1p1/kexgssc.c.gsskex openssh-6.1p1/kexgssc.c
+}
+
+#endif /* GSSAPI */
-diff -up openssh-6.1p1/kexgsss.c.gsskex openssh-6.1p1/kexgsss.c
---- openssh-6.1p1/kexgsss.c.gsskex 2012-11-30 13:58:08.950298635 +0100
-+++ openssh-6.1p1/kexgsss.c 2012-11-30 13:58:08.950298635 +0100
+diff -up openssh-6.2p1/kexgsss.c.gsskex openssh-6.2p1/kexgsss.c
+--- openssh-6.2p1/kexgsss.c.gsskex 2013-03-27 13:19:11.144624254 +0100
++++ openssh-6.2p1/kexgsss.c 2013-03-27 13:19:11.144624254 +0100
@@ -0,0 +1,288 @@
+/*
+ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
@@ -1865,9 +1865,9 @@ diff -up openssh-6.1p1/kexgsss.c.gsskex openssh-6.1p1/kexgsss.c
+ ssh_gssapi_rekey_creds();
+}
+#endif /* GSSAPI */
-diff -up openssh-6.1p1/kex.h.gsskex openssh-6.1p1/kex.h
---- openssh-6.1p1/kex.h.gsskex 2012-11-30 13:58:08.820299131 +0100
-+++ openssh-6.1p1/kex.h 2012-11-30 13:58:08.950298635 +0100
+diff -up openssh-6.2p1/kex.h.gsskex openssh-6.2p1/kex.h
+--- openssh-6.2p1/kex.h.gsskex 2013-03-27 13:19:11.039624686 +0100
++++ openssh-6.2p1/kex.h 2013-03-27 13:19:11.144624254 +0100
@@ -73,6 +73,9 @@ enum kex_exchange {
KEX_DH_GEX_SHA1,
KEX_DH_GEX_SHA256,
@@ -1878,7 +1878,7 @@ diff -up openssh-6.1p1/kex.h.gsskex openssh-6.1p1/kex.h
KEX_MAX
};
-@@ -129,6 +132,12 @@ struct Kex {
+@@ -131,6 +134,12 @@ struct Kex {
sig_atomic_t done;
int flags;
const EVP_MD *evp_md;
@@ -1891,7 +1891,7 @@ diff -up openssh-6.1p1/kex.h.gsskex openssh-6.1p1/kex.h
char *client_version_string;
char *server_version_string;
int (*verify_host_key)(Key *);
-@@ -156,6 +165,11 @@ void kexgex_server(Kex *);
+@@ -158,6 +167,11 @@ void kexgex_server(Kex *);
void kexecdh_client(Kex *);
void kexecdh_server(Kex *);
@@ -1903,9 +1903,9 @@ diff -up openssh-6.1p1/kex.h.gsskex openssh-6.1p1/kex.h
void newkeys_destroy(Newkeys *newkeys);
void
-diff -up openssh-6.1p1/key.c.gsskex openssh-6.1p1/key.c
---- openssh-6.1p1/key.c.gsskex 2012-11-30 13:58:08.912298779 +0100
-+++ openssh-6.1p1/key.c 2012-11-30 13:58:08.951298630 +0100
+diff -up openssh-6.2p1/key.c.gsskex openssh-6.2p1/key.c
+--- openssh-6.2p1/key.c.gsskex 2013-03-27 13:19:11.102624427 +0100
++++ openssh-6.2p1/key.c 2013-03-27 13:19:11.144624254 +0100
@@ -1011,6 +1011,8 @@ key_ssh_name_from_type_nid(int type, int
}
break;
@@ -1924,9 +1924,9 @@ diff -up openssh-6.1p1/key.c.gsskex openssh-6.1p1/key.c
}
debug2("key_type_from_name: unknown key type '%s'", name);
-diff -up openssh-6.1p1/key.h.gsskex openssh-6.1p1/key.h
---- openssh-6.1p1/key.h.gsskex 2012-11-30 13:58:08.827299104 +0100
-+++ openssh-6.1p1/key.h 2012-11-30 13:58:08.951298630 +0100
+diff -up openssh-6.2p1/key.h.gsskex openssh-6.2p1/key.h
+--- openssh-6.2p1/key.h.gsskex 2013-03-27 13:19:11.046624657 +0100
++++ openssh-6.2p1/key.h 2013-03-27 13:19:11.145624250 +0100
@@ -44,6 +44,7 @@ enum types {
KEY_ECDSA_CERT,
KEY_RSA_CERT_V00,
@@ -1935,18 +1935,18 @@ diff -up openssh-6.1p1/key.h.gsskex openssh-6.1p1/key.h
KEY_UNSPEC
};
enum fp_type {
-diff -up openssh-6.1p1/Makefile.in.gsskex openssh-6.1p1/Makefile.in
---- openssh-6.1p1/Makefile.in.gsskex 2012-11-30 13:58:08.945298652 +0100
-+++ openssh-6.1p1/Makefile.in 2012-11-30 13:58:08.951298630 +0100
-@@ -75,6 +75,7 @@ LIBSSH_OBJS=acss.o authfd.o authfile.o b
+diff -up openssh-6.2p1/Makefile.in.gsskex openssh-6.2p1/Makefile.in
+--- openssh-6.2p1/Makefile.in.gsskex 2013-03-27 13:19:11.138624279 +0100
++++ openssh-6.2p1/Makefile.in 2013-03-27 13:19:11.145624250 +0100
+@@ -77,6 +77,7 @@ LIBSSH_OBJS=authfd.o authfile.o bufaux.o
atomicio.o key.o dispatch.o kex.o mac.o uidswap.o uuencode.o misc.o \
monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o \
kexdh.o kexgex.o kexdhc.o kexgexc.o bufec.o kexecdh.o kexecdhc.o \
+ kexgssc.o \
- msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o jpake.o \
- schnorr.o ssh-pkcs11.o auditstub.o
+ msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \
+ jpake.o schnorr.o ssh-pkcs11.o krl.o auditstub.o
-@@ -91,7 +92,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passw
+@@ -93,7 +94,7 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passw
auth2-none.o auth2-passwd.o auth2-pubkey.o auth2-jpake.o \
monitor_mm.o monitor.o monitor_wrap.o kexdhs.o kexgexs.o kexecdhs.o \
auth-krb5.o \
@@ -1955,9 +1955,9 @@ diff -up openssh-6.1p1/Makefile.in.gsskex openssh-6.1p1/Makefile.in
loginrec.o auth-pam.o auth-shadow.o auth-sia.o md5crypt.o \
sftp-server.o sftp-common.o \
roaming_common.o roaming_serv.o \
-diff -up openssh-6.1p1/monitor.c.gsskex openssh-6.1p1/monitor.c
---- openssh-6.1p1/monitor.c.gsskex 2012-11-30 13:58:08.873298927 +0100
-+++ openssh-6.1p1/monitor.c 2012-11-30 13:58:08.952298626 +0100
+diff -up openssh-6.2p1/monitor.c.gsskex openssh-6.2p1/monitor.c
+--- openssh-6.2p1/monitor.c.gsskex 2013-03-27 13:19:11.063624587 +0100
++++ openssh-6.2p1/monitor.c 2013-03-27 13:19:11.145624250 +0100
@@ -186,6 +186,8 @@ int mm_answer_gss_setup_ctx(int, Buffer
int mm_answer_gss_accept_ctx(int, Buffer *);
int mm_answer_gss_userok(int, Buffer *);
@@ -1999,7 +1999,7 @@ diff -up openssh-6.1p1/monitor.c.gsskex openssh-6.1p1/monitor.c
} else {
mon_dispatch = mon_dispatch_proto15;
-@@ -516,6 +529,10 @@ monitor_child_postauth(struct monitor *p
+@@ -519,6 +532,10 @@ monitor_child_postauth(struct monitor *p
monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
@@ -2010,7 +2010,7 @@ diff -up openssh-6.1p1/monitor.c.gsskex openssh-6.1p1/monitor.c
} else {
mon_dispatch = mon_dispatch_postauth15;
monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
-@@ -1948,6 +1965,13 @@ mm_get_kex(Buffer *m)
+@@ -1950,6 +1967,13 @@ mm_get_kex(Buffer *m)
kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
kex->kex[KEX_ECDH_SHA2] = kexecdh_server;
@@ -2024,7 +2024,7 @@ diff -up openssh-6.1p1/monitor.c.gsskex openssh-6.1p1/monitor.c
kex->server = 1;
kex->hostkey_type = buffer_get_int(m);
kex->kex_type = buffer_get_int(m);
-@@ -2171,6 +2195,9 @@ mm_answer_gss_setup_ctx(int sock, Buffer
+@@ -2173,6 +2197,9 @@ mm_answer_gss_setup_ctx(int sock, Buffer
OM_uint32 major;
u_int len;
@@ -2034,7 +2034,7 @@ diff -up openssh-6.1p1/monitor.c.gsskex openssh-6.1p1/monitor.c
goid.elements = buffer_get_string(m, &len);
goid.length = len;
-@@ -2198,6 +2225,9 @@ mm_answer_gss_accept_ctx(int sock, Buffe
+@@ -2200,6 +2227,9 @@ mm_answer_gss_accept_ctx(int sock, Buffe
OM_uint32 flags = 0; /* GSI needs this */
u_int len;
@@ -2044,7 +2044,7 @@ diff -up openssh-6.1p1/monitor.c.gsskex openssh-6.1p1/monitor.c
in.value = buffer_get_string(m, &len);
in.length = len;
major = ssh_gssapi_accept_ctx(gsscontext, &in, &out, &flags);
-@@ -2215,6 +2245,7 @@ mm_answer_gss_accept_ctx(int sock, Buffe
+@@ -2217,6 +2247,7 @@ mm_answer_gss_accept_ctx(int sock, Buffe
monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 0);
monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1);
monitor_permit(mon_dispatch, MONITOR_REQ_GSSCHECKMIC, 1);
@@ -2052,7 +2052,7 @@ diff -up openssh-6.1p1/monitor.c.gsskex openssh-6.1p1/monitor.c
}
return (0);
}
-@@ -2226,6 +2257,9 @@ mm_answer_gss_checkmic(int sock, Buffer
+@@ -2228,6 +2259,9 @@ mm_answer_gss_checkmic(int sock, Buffer
OM_uint32 ret;
u_int len;
@@ -2062,7 +2062,7 @@ diff -up openssh-6.1p1/monitor.c.gsskex openssh-6.1p1/monitor.c
gssbuf.value = buffer_get_string(m, &len);
gssbuf.length = len;
mic.value = buffer_get_string(m, &len);
-@@ -2252,7 +2286,11 @@ mm_answer_gss_userok(int sock, Buffer *m
+@@ -2254,7 +2288,11 @@ mm_answer_gss_userok(int sock, Buffer *m
{
int authenticated;
@@ -2075,7 +2075,7 @@ diff -up openssh-6.1p1/monitor.c.gsskex openssh-6.1p1/monitor.c
buffer_clear(m);
buffer_put_int(m, authenticated);
-@@ -2265,6 +2303,74 @@ mm_answer_gss_userok(int sock, Buffer *m
+@@ -2267,6 +2305,74 @@ mm_answer_gss_userok(int sock, Buffer *m
/* Monitor loop will terminate if authenticated */
return (authenticated);
}
@@ -2150,22 +2150,22 @@ diff -up openssh-6.1p1/monitor.c.gsskex openssh-6.1p1/monitor.c
#endif /* GSSAPI */
#ifdef JPAKE
-diff -up openssh-6.1p1/monitor.h.gsskex openssh-6.1p1/monitor.h
---- openssh-6.1p1/monitor.h.gsskex 2012-11-30 13:58:08.873298927 +0100
-+++ openssh-6.1p1/monitor.h 2012-11-30 13:58:08.952298626 +0100
-@@ -56,6 +56,8 @@ enum monitor_reqtype {
- MONITOR_REQ_GSSSTEP, MONITOR_ANS_GSSSTEP,
- MONITOR_REQ_GSSUSEROK, MONITOR_ANS_GSSUSEROK,
- MONITOR_REQ_GSSCHECKMIC, MONITOR_ANS_GSSCHECKMIC,
-+ MONITOR_REQ_GSSSIGN, MONITOR_ANS_GSSSIGN,
-+ MONITOR_REQ_GSSUPCREDS, MONITOR_ANS_GSSUPCREDS,
- MONITOR_REQ_PAM_START,
- MONITOR_REQ_PAM_ACCOUNT, MONITOR_ANS_PAM_ACCOUNT,
- MONITOR_REQ_PAM_INIT_CTX, MONITOR_ANS_PAM_INIT_CTX,
-diff -up openssh-6.1p1/monitor_wrap.c.gsskex openssh-6.1p1/monitor_wrap.c
---- openssh-6.1p1/monitor_wrap.c.gsskex 2012-11-30 13:58:08.873298927 +0100
-+++ openssh-6.1p1/monitor_wrap.c 2012-11-30 13:58:08.952298626 +0100
-@@ -1326,7 +1326,7 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss
+diff -up openssh-6.2p1/monitor.h.gsskex openssh-6.2p1/monitor.h
+--- openssh-6.2p1/monitor.h.gsskex 2013-03-27 13:19:11.063624587 +0100
++++ openssh-6.2p1/monitor.h 2013-03-27 13:19:11.146624246 +0100
+@@ -64,6 +64,8 @@ enum monitor_reqtype {
+ #ifdef WITH_SELINUX
+ MONITOR_REQ_AUTHROLE = 80,
+ #endif
++ MONITOR_REQ_GSSSIGN = 82, MONITOR_ANS_GSSSIGN = 83,
++ MONITOR_REQ_GSSUPCREDS = 84, MONITOR_ANS_GSSUPCREDS = 85,
+
+ MONITOR_REQ_PAM_START = 100,
+ MONITOR_REQ_PAM_ACCOUNT = 102, MONITOR_ANS_PAM_ACCOUNT = 103,
+diff -up openssh-6.2p1/monitor_wrap.c.gsskex openssh-6.2p1/monitor_wrap.c
+--- openssh-6.2p1/monitor_wrap.c.gsskex 2013-03-27 13:19:11.064624583 +0100
++++ openssh-6.2p1/monitor_wrap.c 2013-03-27 13:19:11.146624246 +0100
+@@ -1327,7 +1327,7 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss
}
int
@@ -2174,7 +2174,7 @@ diff -up openssh-6.1p1/monitor_wrap.c.gsskex openssh-6.1p1/monitor_wrap.c
{
Buffer m;
int authenticated = 0;
-@@ -1343,6 +1343,51 @@ mm_ssh_gssapi_userok(char *user)
+@@ -1344,6 +1344,51 @@ mm_ssh_gssapi_userok(char *user)
debug3("%s: user %sauthenticated",__func__, authenticated ? "" : "not ");
return (authenticated);
}
@@ -2226,9 +2226,9 @@ diff -up openssh-6.1p1/monitor_wrap.c.gsskex openssh-6.1p1/monitor_wrap.c
#endif /* GSSAPI */
#ifdef JPAKE
-diff -up openssh-6.1p1/monitor_wrap.h.gsskex openssh-6.1p1/monitor_wrap.h
---- openssh-6.1p1/monitor_wrap.h.gsskex 2012-11-30 13:58:08.874298923 +0100
-+++ openssh-6.1p1/monitor_wrap.h 2012-11-30 13:58:08.953298623 +0100
+diff -up openssh-6.2p1/monitor_wrap.h.gsskex openssh-6.2p1/monitor_wrap.h
+--- openssh-6.2p1/monitor_wrap.h.gsskex 2013-03-27 13:19:11.064624583 +0100
++++ openssh-6.2p1/monitor_wrap.h 2013-03-27 13:19:11.146624246 +0100
@@ -62,8 +62,10 @@ BIGNUM *mm_auth_rsa_generate_challenge(K
OM_uint32 mm_ssh_gssapi_server_ctx(Gssctxt **, gss_OID);
OM_uint32 mm_ssh_gssapi_accept_ctx(Gssctxt *,
@@ -2241,9 +2241,9 @@ diff -up openssh-6.1p1/monitor_wrap.h.gsskex openssh-6.1p1/monitor_wrap.h
#endif
#ifdef USE_PAM
-diff -up openssh-6.1p1/readconf.c.gsskex openssh-6.1p1/readconf.c
---- openssh-6.1p1/readconf.c.gsskex 2011-10-02 09:59:03.000000000 +0200
-+++ openssh-6.1p1/readconf.c 2012-11-30 13:58:08.953298623 +0100
+diff -up openssh-6.2p1/readconf.c.gsskex openssh-6.2p1/readconf.c
+--- openssh-6.2p1/readconf.c.gsskex 2011-10-02 09:59:03.000000000 +0200
++++ openssh-6.2p1/readconf.c 2013-03-27 13:19:11.147624242 +0100
@@ -129,6 +129,8 @@ typedef enum {
oClearAllForwardings, oNoHostAuthenticationForLocalhost,
oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
@@ -2332,9 +2332,9 @@ diff -up openssh-6.1p1/readconf.c.gsskex openssh-6.1p1/readconf.c
if (options->password_authentication == -1)
options->password_authentication = 1;
if (options->kbd_interactive_authentication == -1)
-diff -up openssh-6.1p1/readconf.h.gsskex openssh-6.1p1/readconf.h
---- openssh-6.1p1/readconf.h.gsskex 2011-10-02 09:59:03.000000000 +0200
-+++ openssh-6.1p1/readconf.h 2012-11-30 13:58:08.953298623 +0100
+diff -up openssh-6.2p1/readconf.h.gsskex openssh-6.2p1/readconf.h
+--- openssh-6.2p1/readconf.h.gsskex 2011-10-02 09:59:03.000000000 +0200
++++ openssh-6.2p1/readconf.h 2013-03-27 13:19:11.147624242 +0100
@@ -48,7 +48,12 @@ typedef struct {
int challenge_response_authentication;
/* Try S/Key or TIS, authentication. */
@@ -2348,9 +2348,9 @@ diff -up openssh-6.1p1/readconf.h.gsskex openssh-6.1p1/readconf.h
int password_authentication; /* Try password
* authentication. */
int kbd_interactive_authentication; /* Try keyboard-interactive auth. */
-diff -up openssh-6.1p1/servconf.c.gsskex openssh-6.1p1/servconf.c
---- openssh-6.1p1/servconf.c.gsskex 2012-11-30 13:58:08.935298693 +0100
-+++ openssh-6.1p1/servconf.c 2012-11-30 13:58:08.954298621 +0100
+diff -up openssh-6.2p1/servconf.c.gsskex openssh-6.2p1/servconf.c
+--- openssh-6.2p1/servconf.c.gsskex 2013-03-27 13:19:11.128624320 +0100
++++ openssh-6.2p1/servconf.c 2013-03-27 13:19:11.147624242 +0100
@@ -102,7 +102,10 @@ initialize_server_options(ServerOptions
options->kerberos_ticket_cleanup = -1;
options->kerberos_get_afs_token = -1;
@@ -2409,7 +2409,7 @@ diff -up openssh-6.1p1/servconf.c.gsskex openssh-6.1p1/servconf.c
{ "passwordauthentication", sPasswordAuthentication, SSHCFG_ALL },
{ "kbdinteractiveauthentication", sKbdInteractiveAuthentication, SSHCFG_ALL },
{ "challengeresponseauthentication", sChallengeResponseAuthentication, SSHCFG_GLOBAL },
-@@ -1046,10 +1067,22 @@ process_server_config_line(ServerOptions
+@@ -1054,10 +1075,22 @@ process_server_config_line(ServerOptions
intptr = &options->gss_authentication;
goto parse_flag;
@@ -2432,7 +2432,7 @@ diff -up openssh-6.1p1/servconf.c.gsskex openssh-6.1p1/servconf.c
case sPasswordAuthentication:
intptr = &options->password_authentication;
goto parse_flag;
-@@ -1929,6 +1962,9 @@ dump_config(ServerOptions *o)
+@@ -1938,6 +1971,9 @@ dump_config(ServerOptions *o)
#ifdef GSSAPI
dump_cfg_fmtint(sGssAuthentication, o->gss_authentication);
dump_cfg_fmtint(sGssCleanupCreds, o->gss_cleanup_creds);
@@ -2442,10 +2442,10 @@ diff -up openssh-6.1p1/servconf.c.gsskex openssh-6.1p1/servconf.c
#endif
#ifdef JPAKE
dump_cfg_fmtint(sZeroKnowledgePasswordAuthentication,
-diff -up openssh-6.1p1/servconf.h.gsskex openssh-6.1p1/servconf.h
---- openssh-6.1p1/servconf.h.gsskex 2012-11-30 13:58:08.935298693 +0100
-+++ openssh-6.1p1/servconf.h 2012-11-30 13:58:08.954298621 +0100
-@@ -104,7 +104,10 @@ typedef struct {
+diff -up openssh-6.2p1/servconf.h.gsskex openssh-6.2p1/servconf.h
+--- openssh-6.2p1/servconf.h.gsskex 2013-03-27 13:19:11.128624320 +0100
++++ openssh-6.2p1/servconf.h 2013-03-27 13:19:11.147624242 +0100
+@@ -110,7 +110,10 @@ typedef struct {
int kerberos_get_afs_token; /* If true, try to get AFS token if
* authenticated with Kerberos. */
int gss_authentication; /* If true, permit GSSAPI authentication */
@@ -2456,10 +2456,10 @@ diff -up openssh-6.1p1/servconf.h.gsskex openssh-6.1p1/servconf.h
int password_authentication; /* If true, permit password
* authentication. */
int kbd_interactive_authentication; /* If true, permit */
-diff -up openssh-6.1p1/ssh_config.5.gsskex openssh-6.1p1/ssh_config.5
---- openssh-6.1p1/ssh_config.5.gsskex 2012-07-02 10:53:38.000000000 +0200
-+++ openssh-6.1p1/ssh_config.5 2012-11-30 13:58:08.954298621 +0100
-@@ -527,11 +527,43 @@ Specifies whether user authentication ba
+diff -up openssh-6.2p1/ssh_config.5.gsskex openssh-6.2p1/ssh_config.5
+--- openssh-6.2p1/ssh_config.5.gsskex 2013-01-09 06:12:19.000000000 +0100
++++ openssh-6.2p1/ssh_config.5 2013-03-27 13:19:11.148624238 +0100
+@@ -530,11 +530,43 @@ Specifies whether user authentication ba
The default is
.Dq no .
Note that this option applies to protocol version 2 only.
@@ -2504,9 +2504,9 @@ diff -up openssh-6.1p1/ssh_config.5.gsskex openssh-6.1p1/ssh_config.5
.It Cm HashKnownHosts
Indicates that
.Xr ssh 1
-diff -up openssh-6.1p1/ssh_config.gsskex openssh-6.1p1/ssh_config
---- openssh-6.1p1/ssh_config.gsskex 2012-11-30 13:58:08.927298724 +0100
-+++ openssh-6.1p1/ssh_config 2012-11-30 13:58:08.954298621 +0100
+diff -up openssh-6.2p1/ssh_config.gsskex openssh-6.2p1/ssh_config
+--- openssh-6.2p1/ssh_config.gsskex 2013-03-27 13:19:11.120624353 +0100
++++ openssh-6.2p1/ssh_config 2013-03-27 13:19:11.148624238 +0100
@@ -26,6 +26,8 @@
# HostbasedAuthentication no
# GSSAPIAuthentication no
@@ -2516,9 +2516,9 @@ diff -up openssh-6.1p1/ssh_config.gsskex openssh-6.1p1/ssh_config
# BatchMode no
# CheckHostIP yes
# AddressFamily any
-diff -up openssh-6.1p1/sshconnect2.c.gsskex openssh-6.1p1/sshconnect2.c
---- openssh-6.1p1/sshconnect2.c.gsskex 2012-11-30 13:58:08.913298775 +0100
-+++ openssh-6.1p1/sshconnect2.c 2012-11-30 13:58:08.955298617 +0100
+diff -up openssh-6.2p1/sshconnect2.c.gsskex openssh-6.2p1/sshconnect2.c
+--- openssh-6.2p1/sshconnect2.c.gsskex 2013-03-27 13:19:11.104624419 +0100
++++ openssh-6.2p1/sshconnect2.c 2013-03-27 13:19:11.149624234 +0100
@@ -162,9 +162,34 @@ ssh_kex2(char *host, struct sockaddr *ho
{
Kex *kex;
@@ -2603,7 +2603,7 @@ diff -up openssh-6.1p1/sshconnect2.c.gsskex openssh-6.1p1/sshconnect2.c
xxx_kex = kex;
dispatch_run(DISPATCH_BLOCK, &kex->done, kex);
-@@ -315,6 +371,7 @@ void input_gssapi_token(int type, u_int3
+@@ -316,6 +372,7 @@ void input_gssapi_token(int type, u_int3
void input_gssapi_hash(int type, u_int32_t, void *);
void input_gssapi_error(int, u_int32_t, void *);
void input_gssapi_errtok(int, u_int32_t, void *);
@@ -2611,7 +2611,7 @@ diff -up openssh-6.1p1/sshconnect2.c.gsskex openssh-6.1p1/sshconnect2.c
#endif
void userauth(Authctxt *, char *);
-@@ -330,6 +387,11 @@ static char *authmethods_get(void);
+@@ -331,6 +388,11 @@ static char *authmethods_get(void);
Authmethod authmethods[] = {
#ifdef GSSAPI
@@ -2623,7 +2623,7 @@ diff -up openssh-6.1p1/sshconnect2.c.gsskex openssh-6.1p1/sshconnect2.c
{"gssapi-with-mic",
userauth_gssapi,
NULL,
-@@ -637,19 +699,31 @@ userauth_gssapi(Authctxt *authctxt)
+@@ -638,19 +700,31 @@ userauth_gssapi(Authctxt *authctxt)
static u_int mech = 0;
OM_uint32 min;
int ok = 0;
@@ -2657,7 +2657,7 @@ diff -up openssh-6.1p1/sshconnect2.c.gsskex openssh-6.1p1/sshconnect2.c
ok = 1; /* Mechanism works */
} else {
mech++;
-@@ -746,8 +820,8 @@ input_gssapi_response(int type, u_int32_
+@@ -747,8 +821,8 @@ input_gssapi_response(int type, u_int32_
{
Authctxt *authctxt = ctxt;
Gssctxt *gssctxt;
@@ -2668,7 +2668,7 @@ diff -up openssh-6.1p1/sshconnect2.c.gsskex openssh-6.1p1/sshconnect2.c
if (authctxt == NULL)
fatal("input_gssapi_response: no authentication context");
-@@ -857,6 +931,48 @@ input_gssapi_error(int type, u_int32_t p
+@@ -858,6 +932,48 @@ input_gssapi_error(int type, u_int32_t p
xfree(msg);
xfree(lang);
}
@@ -2717,9 +2717,9 @@ diff -up openssh-6.1p1/sshconnect2.c.gsskex openssh-6.1p1/sshconnect2.c
#endif /* GSSAPI */
int
-diff -up openssh-6.1p1/sshd.c.gsskex openssh-6.1p1/sshd.c
---- openssh-6.1p1/sshd.c.gsskex 2012-11-30 13:58:08.940298674 +0100
-+++ openssh-6.1p1/sshd.c 2012-11-30 13:58:08.955298617 +0100
+diff -up openssh-6.2p1/sshd.c.gsskex openssh-6.2p1/sshd.c
+--- openssh-6.2p1/sshd.c.gsskex 2013-03-27 13:19:11.133624300 +0100
++++ openssh-6.2p1/sshd.c 2013-03-27 13:19:11.149624234 +0100
@@ -124,6 +124,10 @@
#include "ssh-sandbox.h"
#include "version.h"
@@ -2731,7 +2731,7 @@ diff -up openssh-6.1p1/sshd.c.gsskex openssh-6.1p1/sshd.c
#ifdef LIBWRAP
#include <tcpd.h>
#include <syslog.h>
-@@ -1723,10 +1727,13 @@ main(int ac, char **av)
+@@ -1733,10 +1737,13 @@ main(int ac, char **av)
logit("Disabling protocol version 1. Could not load host key");
options.protocol &= ~SSH_PROTO_1;
}
@@ -2745,7 +2745,7 @@ diff -up openssh-6.1p1/sshd.c.gsskex openssh-6.1p1/sshd.c
if (!(options.protocol & (SSH_PROTO_1|SSH_PROTO_2))) {
logit("sshd: no hostkeys available -- exiting.");
exit(1);
-@@ -2058,6 +2065,60 @@ main(int ac, char **av)
+@@ -2068,6 +2075,60 @@ main(int ac, char **av)
/* Log the connection. */
verbose("Connection from %.500s port %d", remote_ip, remote_port);
@@ -2806,7 +2806,7 @@ diff -up openssh-6.1p1/sshd.c.gsskex openssh-6.1p1/sshd.c
/*
* We don't want to listen forever unless the other side
* successfully authenticates itself. So we set up an alarm which is
-@@ -2456,6 +2517,48 @@ do_ssh2_kex(void)
+@@ -2466,6 +2527,48 @@ do_ssh2_kex(void)
myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = list_hostkey_types();
@@ -2855,7 +2855,7 @@ diff -up openssh-6.1p1/sshd.c.gsskex openssh-6.1p1/sshd.c
/* start key exchange */
kex = kex_setup(myproposal);
kex->kex[KEX_DH_GRP1_SHA1] = kexdh_server;
-@@ -2463,6 +2566,13 @@ do_ssh2_kex(void)
+@@ -2473,6 +2576,13 @@ do_ssh2_kex(void)
kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
kex->kex[KEX_ECDH_SHA2] = kexecdh_server;
@@ -2869,10 +2869,10 @@ diff -up openssh-6.1p1/sshd.c.gsskex openssh-6.1p1/sshd.c
kex->server = 1;
kex->client_version_string=client_version_string;
kex->server_version_string=server_version_string;
-diff -up openssh-6.1p1/sshd_config.5.gsskex openssh-6.1p1/sshd_config.5
---- openssh-6.1p1/sshd_config.5.gsskex 2012-11-30 13:58:08.935298693 +0100
-+++ openssh-6.1p1/sshd_config.5 2012-11-30 13:58:08.956298613 +0100
-@@ -462,12 +462,40 @@ Specifies whether user authentication ba
+diff -up openssh-6.2p1/sshd_config.5.gsskex openssh-6.2p1/sshd_config.5
+--- openssh-6.2p1/sshd_config.5.gsskex 2013-03-27 13:19:11.129624316 +0100
++++ openssh-6.2p1/sshd_config.5 2013-03-27 13:19:11.150624230 +0100
+@@ -481,12 +481,40 @@ Specifies whether user authentication ba
The default is
.Dq no .
Note that this option applies to protocol version 2 only.
@@ -2913,9 +2913,9 @@ diff -up openssh-6.1p1/sshd_config.5.gsskex openssh-6.1p1/sshd_config.5
.It Cm HostbasedAuthentication
Specifies whether rhosts or /etc/hosts.equiv authentication together
with successful public key client host authentication is allowed
-diff -up openssh-6.1p1/sshd_config.gsskex openssh-6.1p1/sshd_config
---- openssh-6.1p1/sshd_config.gsskex 2012-11-30 13:58:08.940298674 +0100
-+++ openssh-6.1p1/sshd_config 2012-11-30 13:58:08.956298613 +0100
+diff -up openssh-6.2p1/sshd_config.gsskex openssh-6.2p1/sshd_config
+--- openssh-6.2p1/sshd_config.gsskex 2013-03-27 13:19:11.133624300 +0100
++++ openssh-6.2p1/sshd_config 2013-03-27 13:19:11.150624230 +0100
@@ -89,6 +89,8 @@ ChallengeResponseAuthentication no
GSSAPIAuthentication yes
#GSSAPICleanupCredentials yes
@@ -2925,9 +2925,9 @@ diff -up openssh-6.1p1/sshd_config.gsskex openssh-6.1p1/sshd_config
# Set this to 'yes' to enable PAM authentication, account processing,
# and session processing. If this is enabled, PAM authentication will
-diff -up openssh-6.1p1/ssh-gss.h.gsskex openssh-6.1p1/ssh-gss.h
---- openssh-6.1p1/ssh-gss.h.gsskex 2007-06-12 15:40:39.000000000 +0200
-+++ openssh-6.1p1/ssh-gss.h 2012-11-30 13:58:08.956298613 +0100
+diff -up openssh-6.2p1/ssh-gss.h.gsskex openssh-6.2p1/ssh-gss.h
+--- openssh-6.2p1/ssh-gss.h.gsskex 2013-02-25 01:24:44.000000000 +0100
++++ openssh-6.2p1/ssh-gss.h 2013-03-27 13:19:11.150624230 +0100
@@ -1,6 +1,6 @@
/* $OpenBSD: ssh-gss.h,v 1.10 2007/06/12 08:20:00 djm Exp $ */
/*
@@ -2936,7 +2936,7 @@ diff -up openssh-6.1p1/ssh-gss.h.gsskex openssh-6.1p1/ssh-gss.h
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
-@@ -60,10 +60,22 @@
+@@ -61,10 +61,22 @@
#define SSH_GSS_OIDTYPE 0x06
@@ -2959,7 +2959,7 @@ diff -up openssh-6.1p1/ssh-gss.h.gsskex openssh-6.1p1/ssh-gss.h
void *data;
} ssh_gssapi_ccache;
-@@ -71,8 +83,11 @@ typedef struct {
+@@ -72,8 +84,11 @@ typedef struct {
gss_buffer_desc displayname;
gss_buffer_desc exportedname;
gss_cred_id_t creds;
@@ -2971,7 +2971,7 @@ diff -up openssh-6.1p1/ssh-gss.h.gsskex openssh-6.1p1/ssh-gss.h
} ssh_gssapi_client;
typedef struct ssh_gssapi_mech_struct {
-@@ -83,6 +98,7 @@ typedef struct ssh_gssapi_mech_struct {
+@@ -84,6 +99,7 @@ typedef struct ssh_gssapi_mech_struct {
int (*userok) (ssh_gssapi_client *, char *);
int (*localname) (ssh_gssapi_client *, char **);
void (*storecreds) (ssh_gssapi_client *);
@@ -2979,7 +2979,7 @@ diff -up openssh-6.1p1/ssh-gss.h.gsskex openssh-6.1p1/ssh-gss.h
} ssh_gssapi_mech;
typedef struct {
-@@ -93,10 +109,11 @@ typedef struct {
+@@ -94,10 +110,11 @@ typedef struct {
gss_OID oid; /* client */
gss_cred_id_t creds; /* server */
gss_name_t client; /* server */
@@ -2992,7 +2992,7 @@ diff -up openssh-6.1p1/ssh-gss.h.gsskex openssh-6.1p1/ssh-gss.h
int ssh_gssapi_check_oid(Gssctxt *, void *, size_t);
void ssh_gssapi_set_oid_data(Gssctxt *, void *, size_t);
-@@ -116,16 +133,30 @@ void ssh_gssapi_build_ctx(Gssctxt **);
+@@ -117,16 +134,30 @@ void ssh_gssapi_build_ctx(Gssctxt **);
void ssh_gssapi_delete_ctx(Gssctxt **);
OM_uint32 ssh_gssapi_sign(Gssctxt *, gss_buffer_t, gss_buffer_t);
void ssh_gssapi_buildmic(Buffer *, const char *, const char *, const char *);
diff --git a/openssh-5.9p1-keycat.patch b/openssh-6.2p1-keycat.patch
similarity index 87%
rename from openssh-5.9p1-keycat.patch
rename to openssh-6.2p1-keycat.patch
index 1630c39..41770b3 100644
--- a/openssh-5.9p1-keycat.patch
+++ b/openssh-6.2p1-keycat.patch
@@ -1,7 +1,7 @@
-diff -up openssh-6.1p1/auth2-pubkey.c.keycat openssh-6.1p1/auth2-pubkey.c
---- openssh-6.1p1/auth2-pubkey.c.keycat 2013-02-14 17:39:21.000000000 +0100
-+++ openssh-6.1p1/auth2-pubkey.c 2013-02-14 17:40:42.600050510 +0100
-@@ -571,6 +571,14 @@ user_key_command_allowed2(struct passwd
+diff -up openssh-6.2p1/auth2-pubkey.c.keycat openssh-6.2p1/auth2-pubkey.c
+--- openssh-6.2p1/auth2-pubkey.c.keycat 2013-03-25 21:34:17.779978851 +0100
++++ openssh-6.2p1/auth2-pubkey.c 2013-03-25 21:34:17.798978973 +0100
+@@ -573,6 +573,14 @@ user_key_command_allowed2(struct passwd
_exit(1);
}
@@ -16,9 +16,9 @@ diff -up openssh-6.1p1/auth2-pubkey.c.keycat openssh-6.1p1/auth2-pubkey.c
execl(options.authorized_keys_command,
options.authorized_keys_command, user_pw->pw_name, NULL);
-diff -up openssh-6.1p1/HOWTO.ssh-keycat.keycat openssh-6.1p1/HOWTO.ssh-keycat
---- openssh-6.1p1/HOWTO.ssh-keycat.keycat 2013-02-14 17:39:21.148382013 +0100
-+++ openssh-6.1p1/HOWTO.ssh-keycat 2013-02-14 17:39:21.148382013 +0100
+diff -up openssh-6.2p1/HOWTO.ssh-keycat.keycat openssh-6.2p1/HOWTO.ssh-keycat
+--- openssh-6.2p1/HOWTO.ssh-keycat.keycat 2013-03-25 21:34:17.798978973 +0100
++++ openssh-6.2p1/HOWTO.ssh-keycat 2013-03-25 21:34:17.798978973 +0100
@@ -0,0 +1,12 @@
+The ssh-keycat retrieves the content of the ~/.ssh/authorized_keys
+of an user in any environment. This includes environments with
@@ -32,9 +32,9 @@ diff -up openssh-6.1p1/HOWTO.ssh-keycat.keycat openssh-6.1p1/HOWTO.ssh-keycat
+ PubkeyAuthentication yes
+
+
-diff -up openssh-6.1p1/Makefile.in.keycat openssh-6.1p1/Makefile.in
---- openssh-6.1p1/Makefile.in.keycat 2013-02-14 17:39:21.143382033 +0100
-+++ openssh-6.1p1/Makefile.in 2013-02-14 17:39:21.148382013 +0100
+diff -up openssh-6.2p1/Makefile.in.keycat openssh-6.2p1/Makefile.in
+--- openssh-6.2p1/Makefile.in.keycat 2013-03-25 21:34:17.793978941 +0100
++++ openssh-6.2p1/Makefile.in 2013-03-25 21:35:48.282559562 +0100
@@ -27,6 +27,7 @@ SFTP_SERVER=$(libexecdir)/sftp-server
SSH_KEYSIGN=$(libexecdir)/ssh-keysign
SSH_LDAP_HELPER=$(libexecdir)/ssh-ldap-helper
@@ -43,16 +43,16 @@ diff -up openssh-6.1p1/Makefile.in.keycat openssh-6.1p1/Makefile.in
SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
PRIVSEP_PATH=@PRIVSEP_PATH@
SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
-@@ -62,7 +63,7 @@ EXEEXT=@EXEEXT@
+@@ -64,7 +65,7 @@ EXEEXT=@EXEEXT@
MANFMT=@MANFMT@
INSTALL_SSH_LDAP_HELPER=@INSTALL_SSH_LDAP_HELPER@
-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT)
+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT) ssh-keycat$(EXEEXT)
- LIBSSH_OBJS=acss.o authfd.o authfile.o bufaux.o bufbn.o buffer.o \
- canohost.o channels.o cipher.o cipher-acss.o cipher-aes.o \
-@@ -168,6 +169,9 @@ ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT)
+ LIBSSH_OBJS=authfd.o authfile.o bufaux.o bufbn.o buffer.o \
+ canohost.o channels.o cipher.o cipher-aes.o \
+@@ -170,6 +171,9 @@ ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT)
ssh-ldap-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o
$(LD) -o $@ ldapconf.o ldapbody.o ldapmisc.o ldap-helper.o $(LDFLAGS) -lssh -lopenbsd-compat -lfipscheck $(LIBS)
@@ -62,7 +62,7 @@ diff -up openssh-6.1p1/Makefile.in.keycat openssh-6.1p1/Makefile.in
ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o roaming_dummy.o
$(LD) -o $@ ssh-keyscan.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
-@@ -267,6 +271,7 @@ install-files:
+@@ -276,6 +280,7 @@ install-files:
$(INSTALL) -m 0700 $(STRIP_OPT) ssh-ldap-helper $(DESTDIR)$(SSH_LDAP_HELPER) ; \
$(INSTALL) -m 0700 ssh-ldap-wrapper $(DESTDIR)$(SSH_LDAP_WRAPPER) ; \
fi
@@ -70,9 +70,9 @@ diff -up openssh-6.1p1/Makefile.in.keycat openssh-6.1p1/Makefile.in
$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
-diff -up openssh-6.1p1/openbsd-compat/port-linux.c.keycat openssh-6.1p1/openbsd-compat/port-linux.c
---- openssh-6.1p1/openbsd-compat/port-linux.c.keycat 2013-02-14 17:39:21.126382101 +0100
-+++ openssh-6.1p1/openbsd-compat/port-linux.c 2013-02-14 17:39:21.149382009 +0100
+diff -up openssh-6.2p1/openbsd-compat/port-linux.c.keycat openssh-6.2p1/openbsd-compat/port-linux.c
+--- openssh-6.2p1/openbsd-compat/port-linux.c.keycat 2013-03-25 21:34:17.785978890 +0100
++++ openssh-6.2p1/openbsd-compat/port-linux.c 2013-03-25 21:34:17.800978986 +0100
@@ -315,7 +315,7 @@ ssh_selinux_getctxbyname(char *pwname,
/* Setup environment variables for pam_selinux */
@@ -127,9 +127,9 @@ diff -up openssh-6.1p1/openbsd-compat/port-linux.c.keycat openssh-6.1p1/openbsd-
/* Set the execution context to the default for the specified user */
void
ssh_selinux_setup_exec_context(char *pwname)
-diff -up openssh-6.1p1/ssh-keycat.c.keycat openssh-6.1p1/ssh-keycat.c
---- openssh-6.1p1/ssh-keycat.c.keycat 2013-02-14 17:39:21.149382009 +0100
-+++ openssh-6.1p1/ssh-keycat.c 2013-02-14 17:39:21.149382009 +0100
+diff -up openssh-6.2p1/ssh-keycat.c.keycat openssh-6.2p1/ssh-keycat.c
+--- openssh-6.2p1/ssh-keycat.c.keycat 2013-03-25 21:34:17.800978986 +0100
++++ openssh-6.2p1/ssh-keycat.c 2013-03-25 21:34:17.800978986 +0100
@@ -0,0 +1,238 @@
+/*
+ * Redistribution and use in source and binary forms, with or without
diff --git a/openssh-6.1p1-kuserok.patch b/openssh-6.2p1-kuserok.patch
similarity index 70%
rename from openssh-6.1p1-kuserok.patch
rename to openssh-6.2p1-kuserok.patch
index 7b695e0..641ad03 100644
--- a/openssh-6.1p1-kuserok.patch
+++ b/openssh-6.2p1-kuserok.patch
@@ -1,6 +1,6 @@
-diff -up openssh-6.1p1/auth-krb5.c.kuserok openssh-6.1p1/auth-krb5.c
---- openssh-6.1p1/auth-krb5.c.kuserok 2012-09-14 21:08:16.941496194 +0200
-+++ openssh-6.1p1/auth-krb5.c 2012-09-14 21:08:17.063496896 +0200
+diff -up openssh-6.2p1/auth-krb5.c.kuserok openssh-6.2p1/auth-krb5.c
+--- openssh-6.2p1/auth-krb5.c.kuserok 2013-03-25 20:06:51.295558062 +0100
++++ openssh-6.2p1/auth-krb5.c 2013-03-25 20:06:51.318558207 +0100
@@ -55,6 +55,20 @@
extern ServerOptions options;
@@ -31,9 +31,9 @@ diff -up openssh-6.1p1/auth-krb5.c.kuserok openssh-6.1p1/auth-krb5.c
problem = -1;
goto out;
}
-diff -up openssh-6.1p1/gss-serv-krb5.c.kuserok openssh-6.1p1/gss-serv-krb5.c
---- openssh-6.1p1/gss-serv-krb5.c.kuserok 2012-09-14 21:08:17.019496642 +0200
-+++ openssh-6.1p1/gss-serv-krb5.c 2012-09-14 21:08:17.065496906 +0200
+diff -up openssh-6.2p1/gss-serv-krb5.c.kuserok openssh-6.2p1/gss-serv-krb5.c
+--- openssh-6.2p1/gss-serv-krb5.c.kuserok 2013-03-25 20:06:51.311558163 +0100
++++ openssh-6.2p1/gss-serv-krb5.c 2013-03-25 20:06:51.319558214 +0100
@@ -68,6 +68,7 @@ static int ssh_gssapi_krb5_cmdok(krb5_pr
int);
@@ -51,10 +51,10 @@ diff -up openssh-6.1p1/gss-serv-krb5.c.kuserok openssh-6.1p1/gss-serv-krb5.c
retval = 1;
logit("Authorized to %s, krb5 principal %s (krb5_kuserok)",
luser, (char *)client->displayname.value);
-diff -up openssh-6.1p1/servconf.c.kuserok openssh-6.1p1/servconf.c
---- openssh-6.1p1/servconf.c.kuserok 2012-09-14 21:08:16.989496471 +0200
-+++ openssh-6.1p1/servconf.c 2012-09-14 21:09:30.864868698 +0200
-@@ -152,6 +152,7 @@ initialize_server_options(ServerOptions
+diff -up openssh-6.2p1/servconf.c.kuserok openssh-6.2p1/servconf.c
+--- openssh-6.2p1/servconf.c.kuserok 2013-03-25 20:06:51.305558125 +0100
++++ openssh-6.2p1/servconf.c 2013-03-25 20:06:51.319558214 +0100
+@@ -150,6 +150,7 @@ initialize_server_options(ServerOptions
options->ip_qos_interactive = -1;
options->ip_qos_bulk = -1;
options->version_addendum = NULL;
@@ -62,7 +62,7 @@ diff -up openssh-6.1p1/servconf.c.kuserok openssh-6.1p1/servconf.c
}
void
-@@ -301,6 +302,8 @@ fill_default_server_options(ServerOption
+@@ -299,6 +300,8 @@ fill_default_server_options(ServerOption
options->version_addendum = xstrdup("");
if (options->show_patchlevel == -1)
options->show_patchlevel = 0;
@@ -71,7 +71,7 @@ diff -up openssh-6.1p1/servconf.c.kuserok openssh-6.1p1/servconf.c
/* Turn privilege separation on by default */
if (use_privsep == -1)
-@@ -327,7 +330,7 @@ typedef enum {
+@@ -325,7 +328,7 @@ typedef enum {
sPermitRootLogin, sLogFacility, sLogLevel,
sRhostsRSAAuthentication, sRSAAuthentication,
sKerberosAuthentication, sKerberosOrLocalPasswd, sKerberosTicketCleanup,
@@ -80,7 +80,7 @@ diff -up openssh-6.1p1/servconf.c.kuserok openssh-6.1p1/servconf.c
sKerberosTgtPassing, sChallengeResponseAuthentication,
sPasswordAuthentication, sKbdInteractiveAuthentication,
sListenAddress, sAddressFamily,
-@@ -399,11 +402,13 @@ static struct {
+@@ -397,11 +400,13 @@ static struct {
#else
{ "kerberosgetafstoken", sUnsupported, SSHCFG_GLOBAL },
#endif
@@ -94,7 +94,7 @@ diff -up openssh-6.1p1/servconf.c.kuserok openssh-6.1p1/servconf.c
#endif
{ "kerberostgtpassing", sUnsupported, SSHCFG_GLOBAL },
{ "afstokenpassing", sUnsupported, SSHCFG_GLOBAL },
-@@ -1486,6 +1491,10 @@ process_server_config_line(ServerOptions
+@@ -1460,6 +1465,10 @@ process_server_config_line(ServerOptions
*activep = value;
break;
@@ -105,7 +105,7 @@ diff -up openssh-6.1p1/servconf.c.kuserok openssh-6.1p1/servconf.c
case sPermitOpen:
arg = strdelim(&cp);
if (!arg || *arg == '\0')
-@@ -1769,6 +1778,7 @@ copy_set_server_options(ServerOptions *d
+@@ -1761,6 +1770,7 @@ copy_set_server_options(ServerOptions *d
M_CP_INTOPT(max_authtries);
M_CP_INTOPT(ip_qos_interactive);
M_CP_INTOPT(ip_qos_bulk);
@@ -113,7 +113,7 @@ diff -up openssh-6.1p1/servconf.c.kuserok openssh-6.1p1/servconf.c
/* See comment in servconf.h */
COPY_MATCH_STRING_OPTS();
-@@ -2005,6 +2015,7 @@ dump_config(ServerOptions *o)
+@@ -1999,6 +2009,7 @@ dump_config(ServerOptions *o)
dump_cfg_fmtint(sUseDNS, o->use_dns);
dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
@@ -121,10 +121,10 @@ diff -up openssh-6.1p1/servconf.c.kuserok openssh-6.1p1/servconf.c
/* string arguments */
dump_cfg_string(sPidFile, o->pid_file);
-diff -up openssh-6.1p1/servconf.h.kuserok openssh-6.1p1/servconf.h
---- openssh-6.1p1/servconf.h.kuserok 2012-09-14 21:08:16.990496476 +0200
-+++ openssh-6.1p1/servconf.h 2012-09-14 21:08:17.071496942 +0200
-@@ -169,6 +169,7 @@ typedef struct {
+diff -up openssh-6.2p1/servconf.h.kuserok openssh-6.2p1/servconf.h
+--- openssh-6.2p1/servconf.h.kuserok 2013-03-25 20:06:51.305558125 +0100
++++ openssh-6.2p1/servconf.h 2013-03-25 20:06:51.320558220 +0100
+@@ -173,6 +173,7 @@ typedef struct {
int num_permitted_opens;
@@ -132,10 +132,10 @@ diff -up openssh-6.1p1/servconf.h.kuserok openssh-6.1p1/servconf.h
char *chroot_directory;
char *revoked_keys_file;
char *trusted_user_ca_keys;
-diff -up openssh-6.1p1/sshd_config.kuserok openssh-6.1p1/sshd_config
---- openssh-6.1p1/sshd_config.kuserok 2012-09-14 21:08:17.002496545 +0200
-+++ openssh-6.1p1/sshd_config 2012-09-14 21:08:17.074496957 +0200
-@@ -79,6 +79,7 @@ ChallengeResponseAuthentication no
+diff -up openssh-6.2p1/sshd_config.kuserok openssh-6.2p1/sshd_config
+--- openssh-6.2p1/sshd_config.kuserok 2013-03-25 20:06:51.308558144 +0100
++++ openssh-6.2p1/sshd_config 2013-03-25 20:06:51.320558220 +0100
+@@ -83,6 +83,7 @@ ChallengeResponseAuthentication no
#KerberosOrLocalPasswd yes
#KerberosTicketCleanup yes
#KerberosGetAFSToken no
@@ -143,10 +143,10 @@ diff -up openssh-6.1p1/sshd_config.kuserok openssh-6.1p1/sshd_config
# GSSAPI options
#GSSAPIAuthentication no
-diff -up openssh-6.1p1/sshd_config.5.kuserok openssh-6.1p1/sshd_config.5
---- openssh-6.1p1/sshd_config.5.kuserok 2012-09-14 21:08:17.004496556 +0200
-+++ openssh-6.1p1/sshd_config.5 2012-09-14 21:08:17.073496952 +0200
-@@ -618,6 +618,10 @@ Specifies whether to automatically destr
+diff -up openssh-6.2p1/sshd_config.5.kuserok openssh-6.2p1/sshd_config.5
+--- openssh-6.2p1/sshd_config.5.kuserok 2013-03-25 20:06:51.308558144 +0100
++++ openssh-6.2p1/sshd_config.5 2013-03-25 20:08:34.249207272 +0100
+@@ -660,6 +660,10 @@ Specifies whether to automatically destr
file on logout.
The default is
.Dq yes .
@@ -157,11 +157,11 @@ diff -up openssh-6.1p1/sshd_config.5.kuserok openssh-6.1p1/sshd_config.5
.It Cm KexAlgorithms
Specifies the available KEX (Key Exchange) algorithms.
Multiple algorithms must be comma-separated.
-@@ -767,6 +771,7 @@ Available keywords are
+@@ -819,6 +823,7 @@ Available keywords are
.Cm HostbasedUsesNameFromPacketOnly ,
.Cm KbdInteractiveAuthentication ,
.Cm KerberosAuthentication ,
+.Cm KerberosUseKuserok ,
.Cm MaxAuthTries ,
.Cm MaxSessions ,
- .Cm PubkeyAuthentication ,
+ .Cm PasswordAuthentication ,
diff --git a/openssh-6.0p1-ldap.patch b/openssh-6.2p1-ldap.patch
similarity index 95%
rename from openssh-6.0p1-ldap.patch
rename to openssh-6.2p1-ldap.patch
index b6f19ba..c8795b5 100644
--- a/openssh-6.0p1-ldap.patch
+++ b/openssh-6.2p1-ldap.patch
@@ -1,7 +1,7 @@
-diff -up openssh-6.1p1/configure.ac.ldap openssh-6.1p1/configure.ac
---- openssh-6.1p1/configure.ac.ldap 2012-07-06 03:49:29.000000000 +0200
-+++ openssh-6.1p1/configure.ac 2012-11-01 13:35:14.830280116 +0100
-@@ -1512,6 +1512,106 @@ AC_ARG_WITH([audit],
+diff -up openssh-6.2p1/configure.ac.ldap openssh-6.2p1/configure.ac
+--- openssh-6.2p1/configure.ac.ldap 2013-03-20 02:55:15.000000000 +0100
++++ openssh-6.2p1/configure.ac 2013-03-25 21:27:15.888248071 +0100
+@@ -1509,6 +1509,106 @@ AC_ARG_WITH([audit],
esac ]
)
@@ -108,9 +108,9 @@ diff -up openssh-6.1p1/configure.ac.ldap openssh-6.1p1/configure.ac
dnl Checks for library functions. Please keep in alphabetical order
AC_CHECK_FUNCS([ \
arc4random \
-diff -up openssh-6.1p1/HOWTO.ldap-keys.ldap openssh-6.1p1/HOWTO.ldap-keys
---- openssh-6.1p1/HOWTO.ldap-keys.ldap 2012-11-01 12:57:17.915280385 +0100
-+++ openssh-6.1p1/HOWTO.ldap-keys 2012-11-01 12:57:17.915280385 +0100
+diff -up openssh-6.2p1/HOWTO.ldap-keys.ldap openssh-6.2p1/HOWTO.ldap-keys
+--- openssh-6.2p1/HOWTO.ldap-keys.ldap 2013-03-25 21:27:15.889248078 +0100
++++ openssh-6.2p1/HOWTO.ldap-keys 2013-03-25 21:27:15.889248078 +0100
@@ -0,0 +1,108 @@
+
+HOW TO START
@@ -220,9 +220,9 @@ diff -up openssh-6.1p1/HOWTO.ldap-keys.ldap openssh-6.1p1/HOWTO.ldap-keys
+5) Author
+ Jan F. Chadima <jchadima at redhat.com>
+
-diff -up openssh-6.1p1/ldapbody.c.ldap openssh-6.1p1/ldapbody.c
---- openssh-6.1p1/ldapbody.c.ldap 2012-11-01 12:57:17.916280385 +0100
-+++ openssh-6.1p1/ldapbody.c 2012-11-01 12:57:17.916280385 +0100
+diff -up openssh-6.2p1/ldapbody.c.ldap openssh-6.2p1/ldapbody.c
+--- openssh-6.2p1/ldapbody.c.ldap 2013-03-25 21:27:15.889248078 +0100
++++ openssh-6.2p1/ldapbody.c 2013-03-25 21:27:15.889248078 +0100
@@ -0,0 +1,494 @@
+/* $OpenBSD: ldapbody.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/*
@@ -718,9 +718,9 @@ diff -up openssh-6.1p1/ldapbody.c.ldap openssh-6.1p1/ldapbody.c
+ return;
+}
+
-diff -up openssh-6.1p1/ldapbody.h.ldap openssh-6.1p1/ldapbody.h
---- openssh-6.1p1/ldapbody.h.ldap 2012-11-01 12:57:17.916280385 +0100
-+++ openssh-6.1p1/ldapbody.h 2012-11-01 12:57:17.916280385 +0100
+diff -up openssh-6.2p1/ldapbody.h.ldap openssh-6.2p1/ldapbody.h
+--- openssh-6.2p1/ldapbody.h.ldap 2013-03-25 21:27:15.889248078 +0100
++++ openssh-6.2p1/ldapbody.h 2013-03-25 21:27:15.889248078 +0100
@@ -0,0 +1,37 @@
+/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/*
@@ -759,9 +759,9 @@ diff -up openssh-6.1p1/ldapbody.h.ldap openssh-6.1p1/ldapbody.h
+
+#endif /* LDAPBODY_H */
+
-diff -up openssh-6.1p1/ldapconf.c.ldap openssh-6.1p1/ldapconf.c
---- openssh-6.1p1/ldapconf.c.ldap 2012-11-01 12:57:17.917280385 +0100
-+++ openssh-6.1p1/ldapconf.c 2012-11-01 12:57:17.917280385 +0100
+diff -up openssh-6.2p1/ldapconf.c.ldap openssh-6.2p1/ldapconf.c
+--- openssh-6.2p1/ldapconf.c.ldap 2013-03-25 21:27:15.890248084 +0100
++++ openssh-6.2p1/ldapconf.c 2013-03-25 21:27:15.890248084 +0100
@@ -0,0 +1,682 @@
+/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/*
@@ -1445,9 +1445,9 @@ diff -up openssh-6.1p1/ldapconf.c.ldap openssh-6.1p1/ldapconf.c
+ dump_cfg_string(lSSH_Filter, options.ssh_filter);
+}
+
-diff -up openssh-6.1p1/ldapconf.h.ldap openssh-6.1p1/ldapconf.h
---- openssh-6.1p1/ldapconf.h.ldap 2012-11-01 12:57:17.918280385 +0100
-+++ openssh-6.1p1/ldapconf.h 2012-11-01 12:57:17.918280385 +0100
+diff -up openssh-6.2p1/ldapconf.h.ldap openssh-6.2p1/ldapconf.h
+--- openssh-6.2p1/ldapconf.h.ldap 2013-03-25 21:27:15.891248091 +0100
++++ openssh-6.2p1/ldapconf.h 2013-03-25 21:27:15.891248091 +0100
@@ -0,0 +1,71 @@
+/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/*
@@ -1520,9 +1520,9 @@ diff -up openssh-6.1p1/ldapconf.h.ldap openssh-6.1p1/ldapconf.h
+void dump_config(void);
+
+#endif /* LDAPCONF_H */
-diff -up openssh-6.1p1/ldap.conf.ldap openssh-6.1p1/ldap.conf
---- openssh-6.1p1/ldap.conf.ldap 2012-11-01 12:57:17.918280385 +0100
-+++ openssh-6.1p1/ldap.conf 2012-11-01 12:57:17.918280385 +0100
+diff -up openssh-6.2p1/ldap.conf.ldap openssh-6.2p1/ldap.conf
+--- openssh-6.2p1/ldap.conf.ldap 2013-03-25 21:27:15.891248091 +0100
++++ openssh-6.2p1/ldap.conf 2013-03-25 21:27:15.891248091 +0100
@@ -0,0 +1,88 @@
+# $Id: openssh-5.5p1-ldap.patch,v 1.3 2010/07/07 13:48:36 jfch2222 Exp $
+#
@@ -1612,9 +1612,9 @@ diff -up openssh-6.1p1/ldap.conf.ldap openssh-6.1p1/ldap.conf
+#tls_cert
+#tls_key
+
-diff -up openssh-6.1p1/ldap-helper.c.ldap openssh-6.1p1/ldap-helper.c
---- openssh-6.1p1/ldap-helper.c.ldap 2012-11-01 12:57:17.919280385 +0100
-+++ openssh-6.1p1/ldap-helper.c 2012-11-01 12:57:17.919280385 +0100
+diff -up openssh-6.2p1/ldap-helper.c.ldap openssh-6.2p1/ldap-helper.c
+--- openssh-6.2p1/ldap-helper.c.ldap 2013-03-25 21:27:15.892248097 +0100
++++ openssh-6.2p1/ldap-helper.c 2013-03-25 21:27:15.892248097 +0100
@@ -0,0 +1,155 @@
+/* $OpenBSD: ssh-pka-ldap.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/*
@@ -1771,9 +1771,9 @@ diff -up openssh-6.1p1/ldap-helper.c.ldap openssh-6.1p1/ldap-helper.c
+void *buffer_get_string(Buffer *b, u_int *l) { return NULL; }
+void buffer_put_string(Buffer *b, const void *f, u_int l) {}
+
-diff -up openssh-6.1p1/ldap-helper.h.ldap openssh-6.1p1/ldap-helper.h
---- openssh-6.1p1/ldap-helper.h.ldap 2012-11-01 12:57:17.919280385 +0100
-+++ openssh-6.1p1/ldap-helper.h 2012-11-01 12:57:17.919280385 +0100
+diff -up openssh-6.2p1/ldap-helper.h.ldap openssh-6.2p1/ldap-helper.h
+--- openssh-6.2p1/ldap-helper.h.ldap 2013-03-25 21:27:15.892248097 +0100
++++ openssh-6.2p1/ldap-helper.h 2013-03-25 21:27:15.892248097 +0100
@@ -0,0 +1,32 @@
+/* $OpenBSD: ldap-helper.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/*
@@ -1807,9 +1807,9 @@ diff -up openssh-6.1p1/ldap-helper.h.ldap openssh-6.1p1/ldap-helper.h
+extern int config_warning_config_file;
+
+#endif /* LDAP_HELPER_H */
-diff -up openssh-6.1p1/ldapincludes.h.ldap openssh-6.1p1/ldapincludes.h
---- openssh-6.1p1/ldapincludes.h.ldap 2012-11-01 12:57:17.920280385 +0100
-+++ openssh-6.1p1/ldapincludes.h 2012-11-01 12:57:17.920280385 +0100
+diff -up openssh-6.2p1/ldapincludes.h.ldap openssh-6.2p1/ldapincludes.h
+--- openssh-6.2p1/ldapincludes.h.ldap 2013-03-25 21:27:15.892248097 +0100
++++ openssh-6.2p1/ldapincludes.h 2013-03-25 21:27:15.892248097 +0100
@@ -0,0 +1,41 @@
+/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/*
@@ -1852,9 +1852,9 @@ diff -up openssh-6.1p1/ldapincludes.h.ldap openssh-6.1p1/ldapincludes.h
+#endif
+
+#endif /* LDAPINCLUDES_H */
-diff -up openssh-6.1p1/ldapmisc.c.ldap openssh-6.1p1/ldapmisc.c
---- openssh-6.1p1/ldapmisc.c.ldap 2012-11-01 12:57:17.920280385 +0100
-+++ openssh-6.1p1/ldapmisc.c 2012-11-01 12:57:17.920280385 +0100
+diff -up openssh-6.2p1/ldapmisc.c.ldap openssh-6.2p1/ldapmisc.c
+--- openssh-6.2p1/ldapmisc.c.ldap 2013-03-25 21:27:15.893248104 +0100
++++ openssh-6.2p1/ldapmisc.c 2013-03-25 21:27:15.893248104 +0100
@@ -0,0 +1,79 @@
+
+#include "ldapincludes.h"
@@ -1935,9 +1935,9 @@ diff -up openssh-6.1p1/ldapmisc.c.ldap openssh-6.1p1/ldapmisc.c
+}
+#endif
+
-diff -up openssh-6.1p1/ldapmisc.h.ldap openssh-6.1p1/ldapmisc.h
---- openssh-6.1p1/ldapmisc.h.ldap 2012-11-01 12:57:17.921280385 +0100
-+++ openssh-6.1p1/ldapmisc.h 2012-11-01 12:57:17.921280385 +0100
+diff -up openssh-6.2p1/ldapmisc.h.ldap openssh-6.2p1/ldapmisc.h
+--- openssh-6.2p1/ldapmisc.h.ldap 2013-03-25 21:27:15.893248104 +0100
++++ openssh-6.2p1/ldapmisc.h 2013-03-25 21:27:15.893248104 +0100
@@ -0,0 +1,35 @@
+/* $OpenBSD: ldapbody.h,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
+/*
@@ -1974,9 +1974,9 @@ diff -up openssh-6.1p1/ldapmisc.h.ldap openssh-6.1p1/ldapmisc.h
+
+#endif /* LDAPMISC_H */
+
-diff -up openssh-6.1p1/Makefile.in.ldap openssh-6.1p1/Makefile.in
---- openssh-6.1p1/Makefile.in.ldap 2012-11-01 12:57:17.750280385 +0100
-+++ openssh-6.1p1/Makefile.in 2012-11-01 12:57:17.922280385 +0100
+diff -up openssh-6.2p1/Makefile.in.ldap openssh-6.2p1/Makefile.in
+--- openssh-6.2p1/Makefile.in.ldap 2013-03-25 21:27:15.850247822 +0100
++++ openssh-6.2p1/Makefile.in 2013-03-25 21:27:57.356518817 +0100
@@ -25,6 +25,8 @@ SSH_PROGRAM=@bindir@/ssh
ASKPASS_PROGRAM=$(libexecdir)/ssh-askpass
SFTP_SERVER=$(libexecdir)/sftp-server
@@ -1986,7 +1986,7 @@ diff -up openssh-6.1p1/Makefile.in.ldap openssh-6.1p1/Makefile.in
SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper
PRIVSEP_PATH=@PRIVSEP_PATH@
SSH_PRIVSEP_USER=@SSH_PRIVSEP_USER@
-@@ -58,8 +60,9 @@ XAUTH_PATH=@XAUTH_PATH@
+@@ -60,8 +62,9 @@ XAUTH_PATH=@XAUTH_PATH@
LDFLAGS=-L. -Lopenbsd-compat/ @LDFLAGS@
EXEEXT=@EXEEXT@
MANFMT=@MANFMT@
@@ -1995,9 +1995,9 @@ diff -up openssh-6.1p1/Makefile.in.ldap openssh-6.1p1/Makefile.in
-TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT)
+TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT) ssh-ldap-helper$(EXEEXT)
- LIBSSH_OBJS=acss.o authfd.o authfile.o bufaux.o bufbn.o buffer.o \
- canohost.o channels.o cipher.o cipher-acss.o cipher-aes.o \
-@@ -93,8 +96,8 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passw
+ LIBSSH_OBJS=authfd.o authfile.o bufaux.o bufbn.o buffer.o \
+ canohost.o channels.o cipher.o cipher-aes.o \
+@@ -95,8 +98,8 @@ SSHDOBJS=sshd.o auth-rhosts.o auth-passw
sandbox-null.o sandbox-rlimit.o sandbox-systrace.o sandbox-darwin.o \
sandbox-seccomp-filter.o
@@ -2008,7 +2008,7 @@ diff -up openssh-6.1p1/Makefile.in.ldap openssh-6.1p1/Makefile.in
MANTYPE = @MANTYPE@
CONFIGFILES=sshd_config.out ssh_config.out moduli.out
-@@ -162,6 +165,9 @@ ssh-keysign$(EXEEXT): $(LIBCOMPAT) libss
+@@ -164,6 +167,9 @@ ssh-keysign$(EXEEXT): $(LIBCOMPAT) libss
ssh-pkcs11-helper$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-pkcs11-helper.o ssh-pkcs11.o
$(LD) -o $@ ssh-pkcs11-helper.o ssh-pkcs11.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS)
@@ -2018,7 +2018,7 @@ diff -up openssh-6.1p1/Makefile.in.ldap openssh-6.1p1/Makefile.in
ssh-keyscan$(EXEEXT): $(LIBCOMPAT) libssh.a ssh-keyscan.o roaming_dummy.o
$(LD) -o $@ ssh-keyscan.o roaming_dummy.o $(LDFLAGS) -lssh -lopenbsd-compat -lssh $(LIBS)
-@@ -257,6 +263,10 @@ install-files:
+@@ -266,6 +272,10 @@ install-files:
$(INSTALL) -m 0755 $(STRIP_OPT) sshd$(EXEEXT) $(DESTDIR)$(sbindir)/sshd$(EXEEXT)
$(INSTALL) -m 4711 $(STRIP_OPT) ssh-keysign$(EXEEXT) $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
$(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
@@ -2029,7 +2029,7 @@ diff -up openssh-6.1p1/Makefile.in.ldap openssh-6.1p1/Makefile.in
$(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
$(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
$(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
-@@ -273,6 +283,10 @@ install-files:
+@@ -282,6 +292,10 @@ install-files:
$(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
$(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
$(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
@@ -2040,7 +2040,7 @@ diff -up openssh-6.1p1/Makefile.in.ldap openssh-6.1p1/Makefile.in
-rm -f $(DESTDIR)$(bindir)/slogin
ln -s ./ssh$(EXEEXT) $(DESTDIR)$(bindir)/slogin
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
-@@ -302,6 +316,13 @@ install-sysconf:
+@@ -311,6 +325,13 @@ install-sysconf:
else \
echo "$(DESTDIR)$(sysconfdir)/moduli already exists, install will not overwrite"; \
fi
@@ -2054,7 +2054,7 @@ diff -up openssh-6.1p1/Makefile.in.ldap openssh-6.1p1/Makefile.in
host-key: ssh-keygen$(EXEEXT)
@if [ -z "$(DESTDIR)" ] ; then \
-@@ -359,6 +380,8 @@ uninstall:
+@@ -368,6 +389,8 @@ uninstall:
-rm -r $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
-rm -f $(DESTDIR)$(SSH_KEYSIGN)$(EXEEXT)
-rm -f $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
@@ -2063,17 +2063,17 @@ diff -up openssh-6.1p1/Makefile.in.ldap openssh-6.1p1/Makefile.in
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
-@@ -370,6 +393,7 @@ uninstall:
+@@ -379,6 +402,7 @@ uninstall:
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
+ -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-ldap-helper.8
-rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
- tests interop-tests: $(TARGETS)
-diff -up openssh-6.1p1/openssh-lpk-openldap.schema.ldap openssh-6.1p1/openssh-lpk-openldap.schema
---- openssh-6.1p1/openssh-lpk-openldap.schema.ldap 2012-11-01 12:57:17.922280385 +0100
-+++ openssh-6.1p1/openssh-lpk-openldap.schema 2012-11-01 12:57:17.922280385 +0100
+ regress/modpipe$(EXEEXT): $(srcdir)/regress/modpipe.c
+diff -up openssh-6.2p1/openssh-lpk-openldap.schema.ldap openssh-6.2p1/openssh-lpk-openldap.schema
+--- openssh-6.2p1/openssh-lpk-openldap.schema.ldap 2013-03-25 21:27:15.894248110 +0100
++++ openssh-6.2p1/openssh-lpk-openldap.schema 2013-03-25 21:27:15.894248110 +0100
@@ -0,0 +1,21 @@
+#
+# LDAP Public Key Patch schema for use with openssh-ldappubkey
@@ -2096,9 +2096,9 @@ diff -up openssh-6.1p1/openssh-lpk-openldap.schema.ldap openssh-6.1p1/openssh-lp
+ DESC 'MANDATORY: OpenSSH LPK objectclass'
+ MUST ( sshPublicKey $ uid )
+ )
-diff -up openssh-6.1p1/openssh-lpk-sun.schema.ldap openssh-6.1p1/openssh-lpk-sun.schema
---- openssh-6.1p1/openssh-lpk-sun.schema.ldap 2012-11-01 12:57:17.922280385 +0100
-+++ openssh-6.1p1/openssh-lpk-sun.schema 2012-11-01 12:57:17.922280385 +0100
+diff -up openssh-6.2p1/openssh-lpk-sun.schema.ldap openssh-6.2p1/openssh-lpk-sun.schema
+--- openssh-6.2p1/openssh-lpk-sun.schema.ldap 2013-03-25 21:27:15.894248110 +0100
++++ openssh-6.2p1/openssh-lpk-sun.schema 2013-03-25 21:27:15.894248110 +0100
@@ -0,0 +1,23 @@
+#
+# LDAP Public Key Patch schema for use with openssh-ldappubkey
@@ -2123,9 +2123,9 @@ diff -up openssh-6.1p1/openssh-lpk-sun.schema.ldap openssh-6.1p1/openssh-lpk-sun
+ DESC 'MANDATORY: OpenSSH LPK objectclass'
+ MUST ( sshPublicKey $ uid )
+ )
-diff -up openssh-6.1p1/ssh-ldap.conf.5.ldap openssh-6.1p1/ssh-ldap.conf.5
---- openssh-6.1p1/ssh-ldap.conf.5.ldap 2012-11-01 12:57:17.923280385 +0100
-+++ openssh-6.1p1/ssh-ldap.conf.5 2012-11-01 12:57:17.923280385 +0100
+diff -up openssh-6.2p1/ssh-ldap.conf.5.ldap openssh-6.2p1/ssh-ldap.conf.5
+--- openssh-6.2p1/ssh-ldap.conf.5.ldap 2013-03-25 21:27:15.895248117 +0100
++++ openssh-6.2p1/ssh-ldap.conf.5 2013-03-25 21:27:15.895248117 +0100
@@ -0,0 +1,376 @@
+.\" $OpenBSD: ssh-ldap.conf.5,v 1.1 2010/02/10 23:20:38 markus Exp $
+.\"
@@ -2503,9 +2503,9 @@ diff -up openssh-6.1p1/ssh-ldap.conf.5.ldap openssh-6.1p1/ssh-ldap.conf.5
+OpenSSH 5.5 + PKA-LDAP .
+.Sh AUTHORS
+.An Jan F. Chadima Aq jchadima at redhat.com
-diff -up openssh-6.1p1/ssh-ldap-helper.8.ldap openssh-6.1p1/ssh-ldap-helper.8
---- openssh-6.1p1/ssh-ldap-helper.8.ldap 2012-11-01 12:57:17.924280385 +0100
-+++ openssh-6.1p1/ssh-ldap-helper.8 2012-11-01 12:57:17.924280385 +0100
+diff -up openssh-6.2p1/ssh-ldap-helper.8.ldap openssh-6.2p1/ssh-ldap-helper.8
+--- openssh-6.2p1/ssh-ldap-helper.8.ldap 2013-03-25 21:27:15.895248117 +0100
++++ openssh-6.2p1/ssh-ldap-helper.8 2013-03-25 21:27:15.895248117 +0100
@@ -0,0 +1,79 @@
+.\" $OpenBSD: ssh-ldap-helper.8,v 1.1 2010/02/10 23:20:38 markus Exp $
+.\"
@@ -2586,9 +2586,9 @@ diff -up openssh-6.1p1/ssh-ldap-helper.8.ldap openssh-6.1p1/ssh-ldap-helper.8
+OpenSSH 5.5 + PKA-LDAP .
+.Sh AUTHORS
+.An Jan F. Chadima Aq jchadima at redhat.com
-diff -up openssh-6.1p1/ssh-ldap-wrapper.ldap openssh-6.1p1/ssh-ldap-wrapper
---- openssh-6.1p1/ssh-ldap-wrapper.ldap 2012-11-01 12:57:17.924280385 +0100
-+++ openssh-6.1p1/ssh-ldap-wrapper 2012-11-01 12:57:17.924280385 +0100
+diff -up openssh-6.2p1/ssh-ldap-wrapper.ldap openssh-6.2p1/ssh-ldap-wrapper
+--- openssh-6.2p1/ssh-ldap-wrapper.ldap 2013-03-25 21:27:15.896248124 +0100
++++ openssh-6.2p1/ssh-ldap-wrapper 2013-03-25 21:27:15.896248124 +0100
@@ -0,0 +1,4 @@
+#!/bin/sh
+
diff --git a/openssh-6.1p1-role-mls.patch b/openssh-6.2p1-role-mls.patch
similarity index 83%
rename from openssh-6.1p1-role-mls.patch
rename to openssh-6.2p1-role-mls.patch
index 4de3dae..3635fef 100644
--- a/openssh-6.1p1-role-mls.patch
+++ b/openssh-6.2p1-role-mls.patch
@@ -1,7 +1,44 @@
-diff -up openssh-6.1p1/auth1.c.role-mls openssh-6.1p1/auth1.c
---- openssh-6.1p1/auth1.c.role-mls 2012-11-28 17:06:43.657990103 +0100
-+++ openssh-6.1p1/auth1.c 2012-11-28 17:06:43.699989959 +0100
-@@ -384,6 +384,9 @@ do_authentication(Authctxt *authctxt)
+diff -up openssh-6.2p1/auth.h.role-mls openssh-6.2p1/auth.h
+--- openssh-6.2p1/auth.h.role-mls 2013-03-25 17:47:00.565746862 +0100
++++ openssh-6.2p1/auth.h 2013-03-25 17:47:00.602747073 +0100
+@@ -59,6 +59,9 @@ struct Authctxt {
+ char *service;
+ struct passwd *pw; /* set if 'valid' */
+ char *style;
++#ifdef WITH_SELINUX
++ char *role;
++#endif
+ void *kbdintctxt;
+ void *jpake_ctx;
+ #ifdef BSD_AUTH
+diff -up openssh-6.2p1/auth-pam.c.role-mls openssh-6.2p1/auth-pam.c
+--- openssh-6.2p1/auth-pam.c.role-mls 2013-03-25 17:47:00.535746690 +0100
++++ openssh-6.2p1/auth-pam.c 2013-03-25 17:47:00.602747073 +0100
+@@ -1074,7 +1074,7 @@ is_pam_session_open(void)
+ * during the ssh authentication process.
+ */
+ int
+-do_pam_putenv(char *name, char *value)
++do_pam_putenv(char *name, const char *value)
+ {
+ int ret = 1;
+ #ifdef HAVE_PAM_PUTENV
+diff -up openssh-6.2p1/auth-pam.h.role-mls openssh-6.2p1/auth-pam.h
+--- openssh-6.2p1/auth-pam.h.role-mls 2004-09-11 14:17:26.000000000 +0200
++++ openssh-6.2p1/auth-pam.h 2013-03-25 17:47:00.602747073 +0100
+@@ -38,7 +38,7 @@ void do_pam_session(void);
+ void do_pam_set_tty(const char *);
+ void do_pam_setcred(int );
+ void do_pam_chauthtok(void);
+-int do_pam_putenv(char *, char *);
++int do_pam_putenv(char *, const char *);
+ char ** fetch_pam_environment(void);
+ char ** fetch_pam_child_environment(void);
+ void free_pam_environment(char **);
+diff -up openssh-6.2p1/auth1.c.role-mls openssh-6.2p1/auth1.c
+--- openssh-6.2p1/auth1.c.role-mls 2012-12-02 23:53:20.000000000 +0100
++++ openssh-6.2p1/auth1.c 2013-03-25 17:47:00.600747062 +0100
+@@ -386,6 +386,9 @@ do_authentication(Authctxt *authctxt)
{
u_int ulen;
char *user, *style = NULL;
@@ -11,7 +48,7 @@ diff -up openssh-6.1p1/auth1.c.role-mls openssh-6.1p1/auth1.c
/* Get the name of the user that we wish to log in as. */
packet_read_expect(SSH_CMSG_USER);
-@@ -392,11 +395,24 @@ do_authentication(Authctxt *authctxt)
+@@ -394,11 +397,24 @@ do_authentication(Authctxt *authctxt)
user = packet_get_cstring(&ulen);
packet_check_eom();
@@ -36,9 +73,9 @@ diff -up openssh-6.1p1/auth1.c.role-mls openssh-6.1p1/auth1.c
/* Verify that the user is a valid user. */
if ((authctxt->pw = PRIVSEP(getpwnamallow(user))) != NULL)
-diff -up openssh-6.1p1/auth2.c.role-mls openssh-6.1p1/auth2.c
---- openssh-6.1p1/auth2.c.role-mls 2012-11-28 17:06:43.661990089 +0100
-+++ openssh-6.1p1/auth2.c 2012-11-28 17:11:09.058916613 +0100
+diff -up openssh-6.2p1/auth2.c.role-mls openssh-6.2p1/auth2.c
+--- openssh-6.2p1/auth2.c.role-mls 2013-03-25 17:47:00.556746810 +0100
++++ openssh-6.2p1/auth2.c 2013-03-25 17:47:00.600747062 +0100
@@ -218,6 +218,9 @@ input_userauth_request(int type, u_int32
Authctxt *authctxt = ctxt;
Authmethod *m = NULL;
@@ -78,9 +115,9 @@ diff -up openssh-6.1p1/auth2.c.role-mls openssh-6.1p1/auth2.c
userauth_banner();
if (auth2_setup_methods_lists(authctxt) != 0)
packet_disconnect("no authentication methods enabled");
-diff -up openssh-6.1p1/auth2-gss.c.role-mls openssh-6.1p1/auth2-gss.c
---- openssh-6.1p1/auth2-gss.c.role-mls 2011-05-05 06:04:11.000000000 +0200
-+++ openssh-6.1p1/auth2-gss.c 2012-11-28 17:06:43.700989956 +0100
+diff -up openssh-6.2p1/auth2-gss.c.role-mls openssh-6.2p1/auth2-gss.c
+--- openssh-6.2p1/auth2-gss.c.role-mls 2012-12-02 23:53:20.000000000 +0100
++++ openssh-6.2p1/auth2-gss.c 2013-03-25 17:47:00.601747067 +0100
@@ -260,6 +260,7 @@ input_gssapi_mic(int type, u_int32_t ple
Authctxt *authctxt = ctxt;
Gssctxt *gssctxt;
@@ -113,9 +150,9 @@ diff -up openssh-6.1p1/auth2-gss.c.role-mls openssh-6.1p1/auth2-gss.c
xfree(mic.value);
authctxt->postponed = 0;
-diff -up openssh-6.1p1/auth2-hostbased.c.role-mls openssh-6.1p1/auth2-hostbased.c
---- openssh-6.1p1/auth2-hostbased.c.role-mls 2012-11-28 17:06:43.669990062 +0100
-+++ openssh-6.1p1/auth2-hostbased.c 2012-11-28 17:06:43.700989956 +0100
+diff -up openssh-6.2p1/auth2-hostbased.c.role-mls openssh-6.2p1/auth2-hostbased.c
+--- openssh-6.2p1/auth2-hostbased.c.role-mls 2013-03-25 17:47:00.565746862 +0100
++++ openssh-6.2p1/auth2-hostbased.c 2013-03-25 17:47:00.601747067 +0100
@@ -106,7 +106,15 @@ userauth_hostbased(Authctxt *authctxt)
buffer_put_string(&b, session_id2, session_id2_len);
/* reconstruct packet */
@@ -133,10 +170,10 @@ diff -up openssh-6.1p1/auth2-hostbased.c.role-mls openssh-6.1p1/auth2-hostbased.
buffer_put_cstring(&b, service);
buffer_put_cstring(&b, "hostbased");
buffer_put_string(&b, pkalg, alen);
-diff -up openssh-6.1p1/auth2-pubkey.c.role-mls openssh-6.1p1/auth2-pubkey.c
---- openssh-6.1p1/auth2-pubkey.c.role-mls 2012-11-28 17:06:43.669990062 +0100
-+++ openssh-6.1p1/auth2-pubkey.c 2012-11-28 17:06:43.700989956 +0100
-@@ -121,7 +121,15 @@ userauth_pubkey(Authctxt *authctxt)
+diff -up openssh-6.2p1/auth2-pubkey.c.role-mls openssh-6.2p1/auth2-pubkey.c
+--- openssh-6.2p1/auth2-pubkey.c.role-mls 2013-03-25 17:47:00.565746862 +0100
++++ openssh-6.2p1/auth2-pubkey.c 2013-03-25 17:47:00.601747067 +0100
+@@ -127,7 +127,15 @@ userauth_pubkey(Authctxt *authctxt)
}
/* reconstruct packet */
buffer_put_char(&b, SSH2_MSG_USERAUTH_REQUEST);
@@ -153,46 +190,9 @@ diff -up openssh-6.1p1/auth2-pubkey.c.role-mls openssh-6.1p1/auth2-pubkey.c
buffer_put_cstring(&b,
datafellows & SSH_BUG_PKSERVICE ?
"ssh-userauth" :
-diff -up openssh-6.1p1/auth.h.role-mls openssh-6.1p1/auth.h
---- openssh-6.1p1/auth.h.role-mls 2012-11-28 17:06:43.669990062 +0100
-+++ openssh-6.1p1/auth.h 2012-11-28 17:06:43.699989959 +0100
-@@ -59,6 +59,9 @@ struct Authctxt {
- char *service;
- struct passwd *pw; /* set if 'valid' */
- char *style;
-+#ifdef WITH_SELINUX
-+ char *role;
-+#endif
- void *kbdintctxt;
- void *jpake_ctx;
- #ifdef BSD_AUTH
-diff -up openssh-6.1p1/auth-pam.c.role-mls openssh-6.1p1/auth-pam.c
---- openssh-6.1p1/auth-pam.c.role-mls 2012-11-28 17:06:43.638990168 +0100
-+++ openssh-6.1p1/auth-pam.c 2012-11-28 17:06:43.699989959 +0100
-@@ -1074,7 +1074,7 @@ is_pam_session_open(void)
- * during the ssh authentication process.
- */
- int
--do_pam_putenv(char *name, char *value)
-+do_pam_putenv(char *name, const char *value)
- {
- int ret = 1;
- #ifdef HAVE_PAM_PUTENV
-diff -up openssh-6.1p1/auth-pam.h.role-mls openssh-6.1p1/auth-pam.h
---- openssh-6.1p1/auth-pam.h.role-mls 2004-09-11 14:17:26.000000000 +0200
-+++ openssh-6.1p1/auth-pam.h 2012-11-28 17:06:43.699989959 +0100
-@@ -38,7 +38,7 @@ void do_pam_session(void);
- void do_pam_set_tty(const char *);
- void do_pam_setcred(int );
- void do_pam_chauthtok(void);
--int do_pam_putenv(char *, char *);
-+int do_pam_putenv(char *, const char *);
- char ** fetch_pam_environment(void);
- char ** fetch_pam_child_environment(void);
- void free_pam_environment(char **);
-diff -up openssh-6.1p1/misc.c.role-mls openssh-6.1p1/misc.c
---- openssh-6.1p1/misc.c.role-mls 2011-09-22 13:34:36.000000000 +0200
-+++ openssh-6.1p1/misc.c 2012-11-28 17:06:43.701989952 +0100
+diff -up openssh-6.2p1/misc.c.role-mls openssh-6.2p1/misc.c
+--- openssh-6.2p1/misc.c.role-mls 2011-09-22 13:34:36.000000000 +0200
++++ openssh-6.2p1/misc.c 2013-03-25 17:47:00.603747079 +0100
@@ -427,6 +427,7 @@ char *
colon(char *cp)
{
@@ -215,9 +215,9 @@ diff -up openssh-6.1p1/misc.c.role-mls openssh-6.1p1/misc.c
}
return NULL;
}
-diff -up openssh-6.1p1/monitor.c.role-mls openssh-6.1p1/monitor.c
---- openssh-6.1p1/monitor.c.role-mls 2012-11-28 17:06:43.686990004 +0100
-+++ openssh-6.1p1/monitor.c 2012-11-28 17:06:43.701989952 +0100
+diff -up openssh-6.2p1/monitor.c.role-mls openssh-6.2p1/monitor.c
+--- openssh-6.2p1/monitor.c.role-mls 2013-03-25 17:47:00.587746987 +0100
++++ openssh-6.2p1/monitor.c 2013-03-25 17:47:00.604747085 +0100
@@ -148,6 +148,9 @@ int mm_answer_sign(int, Buffer *);
int mm_answer_pwnamallow(int, Buffer *);
int mm_answer_auth2_read_banner(int, Buffer *);
@@ -228,7 +228,7 @@ diff -up openssh-6.1p1/monitor.c.role-mls openssh-6.1p1/monitor.c
int mm_answer_authpassword(int, Buffer *);
int mm_answer_bsdauthquery(int, Buffer *);
int mm_answer_bsdauthrespond(int, Buffer *);
-@@ -231,6 +234,9 @@ struct mon_table mon_dispatch_proto20[]
+@@ -232,6 +235,9 @@ struct mon_table mon_dispatch_proto20[]
{MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign},
{MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow},
{MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv},
@@ -238,7 +238,7 @@ diff -up openssh-6.1p1/monitor.c.role-mls openssh-6.1p1/monitor.c
{MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner},
{MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword},
#ifdef USE_PAM
-@@ -838,6 +844,9 @@ mm_answer_pwnamallow(int sock, Buffer *m
+@@ -846,6 +852,9 @@ mm_answer_pwnamallow(int sock, Buffer *m
else {
/* Allow service/style information on the auth context */
monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1);
@@ -248,7 +248,7 @@ diff -up openssh-6.1p1/monitor.c.role-mls openssh-6.1p1/monitor.c
monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1);
}
#ifdef USE_PAM
-@@ -881,6 +890,25 @@ mm_answer_authserv(int sock, Buffer *m)
+@@ -889,6 +898,25 @@ mm_answer_authserv(int sock, Buffer *m)
return (0);
}
@@ -274,7 +274,7 @@ diff -up openssh-6.1p1/monitor.c.role-mls openssh-6.1p1/monitor.c
int
mm_answer_authpassword(int sock, Buffer *m)
{
-@@ -1251,7 +1279,7 @@ static int
+@@ -1262,7 +1290,7 @@ static int
monitor_valid_userblob(u_char *data, u_int datalen)
{
Buffer b;
@@ -283,7 +283,7 @@ diff -up openssh-6.1p1/monitor.c.role-mls openssh-6.1p1/monitor.c
u_int len;
int fail = 0;
-@@ -1277,6 +1305,8 @@ monitor_valid_userblob(u_char *data, u_i
+@@ -1288,6 +1316,8 @@ monitor_valid_userblob(u_char *data, u_i
if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST)
fail++;
p = buffer_get_string(&b, NULL);
@@ -292,7 +292,7 @@ diff -up openssh-6.1p1/monitor.c.role-mls openssh-6.1p1/monitor.c
if (strcmp(authctxt->user, p) != 0) {
logit("wrong user name passed to monitor: expected %s != %.100s",
authctxt->user, p);
-@@ -1308,7 +1338,7 @@ monitor_valid_hostbasedblob(u_char *data
+@@ -1319,7 +1349,7 @@ monitor_valid_hostbasedblob(u_char *data
char *chost)
{
Buffer b;
@@ -301,7 +301,7 @@ diff -up openssh-6.1p1/monitor.c.role-mls openssh-6.1p1/monitor.c
u_int len;
int fail = 0;
-@@ -1325,6 +1355,8 @@ monitor_valid_hostbasedblob(u_char *data
+@@ -1336,6 +1366,8 @@ monitor_valid_hostbasedblob(u_char *data
if (buffer_get_char(&b) != SSH2_MSG_USERAUTH_REQUEST)
fail++;
p = buffer_get_string(&b, NULL);
@@ -310,22 +310,22 @@ diff -up openssh-6.1p1/monitor.c.role-mls openssh-6.1p1/monitor.c
if (strcmp(authctxt->user, p) != 0) {
logit("wrong user name passed to monitor: expected %s != %.100s",
authctxt->user, p);
-diff -up openssh-6.1p1/monitor.h.role-mls openssh-6.1p1/monitor.h
---- openssh-6.1p1/monitor.h.role-mls 2012-11-28 17:06:43.686990004 +0100
-+++ openssh-6.1p1/monitor.h 2012-11-28 17:06:43.701989952 +0100
-@@ -31,6 +31,9 @@
- enum monitor_reqtype {
- MONITOR_REQ_MODULI, MONITOR_ANS_MODULI,
- MONITOR_REQ_FREE, MONITOR_REQ_AUTHSERV,
+diff -up openssh-6.2p1/monitor.h.role-mls openssh-6.2p1/monitor.h
+--- openssh-6.2p1/monitor.h.role-mls 2013-03-25 17:47:00.605747090 +0100
++++ openssh-6.2p1/monitor.h 2013-03-25 17:50:00.824775483 +0100
+@@ -61,6 +61,9 @@ enum monitor_reqtype {
+ MONITOR_REQ_JPAKE_STEP2 = 56, MONITOR_ANS_JPAKE_STEP2 = 57,
+ MONITOR_REQ_JPAKE_KEY_CONFIRM = 58, MONITOR_ANS_JPAKE_KEY_CONFIRM = 59,
+ MONITOR_REQ_JPAKE_CHECK_CONFIRM = 60, MONITOR_ANS_JPAKE_CHECK_CONFIRM = 61,
+#ifdef WITH_SELINUX
-+ MONITOR_REQ_AUTHROLE,
++ MONITOR_REQ_AUTHROLE = 80,
+#endif
- MONITOR_REQ_SIGN, MONITOR_ANS_SIGN,
- MONITOR_REQ_PWNAM, MONITOR_ANS_PWNAM,
- MONITOR_REQ_AUTH2_READ_BANNER, MONITOR_ANS_AUTH2_READ_BANNER,
-diff -up openssh-6.1p1/monitor_wrap.c.role-mls openssh-6.1p1/monitor_wrap.c
---- openssh-6.1p1/monitor_wrap.c.role-mls 2012-11-28 17:06:43.686990004 +0100
-+++ openssh-6.1p1/monitor_wrap.c 2012-11-28 17:06:43.702989948 +0100
+
+ MONITOR_REQ_PAM_START = 100,
+ MONITOR_REQ_PAM_ACCOUNT = 102, MONITOR_ANS_PAM_ACCOUNT = 103,
+diff -up openssh-6.2p1/monitor_wrap.c.role-mls openssh-6.2p1/monitor_wrap.c
+--- openssh-6.2p1/monitor_wrap.c.role-mls 2013-03-25 17:47:00.588746993 +0100
++++ openssh-6.2p1/monitor_wrap.c 2013-03-25 17:47:00.605747090 +0100
@@ -336,6 +336,25 @@ mm_inform_authserv(char *service, char *
buffer_free(&m);
}
@@ -352,9 +352,9 @@ diff -up openssh-6.1p1/monitor_wrap.c.role-mls openssh-6.1p1/monitor_wrap.c
/* Do the password authentication */
int
mm_auth_password(Authctxt *authctxt, char *password)
-diff -up openssh-6.1p1/monitor_wrap.h.role-mls openssh-6.1p1/monitor_wrap.h
---- openssh-6.1p1/monitor_wrap.h.role-mls 2012-11-28 17:06:43.686990004 +0100
-+++ openssh-6.1p1/monitor_wrap.h 2012-11-28 17:06:43.702989948 +0100
+diff -up openssh-6.2p1/monitor_wrap.h.role-mls openssh-6.2p1/monitor_wrap.h
+--- openssh-6.2p1/monitor_wrap.h.role-mls 2013-03-25 17:47:00.588746993 +0100
++++ openssh-6.2p1/monitor_wrap.h 2013-03-25 17:47:00.605747090 +0100
@@ -42,6 +42,9 @@ int mm_is_monitor(void);
DH *mm_choose_dh(int, int, int);
int mm_key_sign(Key *, u_char **, u_int *, u_char *, u_int);
@@ -365,21 +365,21 @@ diff -up openssh-6.1p1/monitor_wrap.h.role-mls openssh-6.1p1/monitor_wrap.h
struct passwd *mm_getpwnamallow(const char *);
char *mm_auth2_read_banner(void);
int mm_auth_password(struct Authctxt *, char *);
-diff -up openssh-6.1p1/openbsd-compat/Makefile.in.role-mls openssh-6.1p1/openbsd-compat/Makefile.in
---- openssh-6.1p1/openbsd-compat/Makefile.in.role-mls 2011-11-04 01:25:25.000000000 +0100
-+++ openssh-6.1p1/openbsd-compat/Makefile.in 2012-11-28 17:06:43.702989948 +0100
+diff -up openssh-6.2p1/openbsd-compat/Makefile.in.role-mls openssh-6.2p1/openbsd-compat/Makefile.in
+--- openssh-6.2p1/openbsd-compat/Makefile.in.role-mls 2013-03-25 17:47:00.606747096 +0100
++++ openssh-6.2p1/openbsd-compat/Makefile.in 2013-03-25 17:50:36.024979473 +0100
@@ -20,7 +20,7 @@ OPENBSD=base64.o basename.o bindresvport
- COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o getrrsetbyname-ldns.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o
+ COMPAT=bsd-arc4random.o bsd-asprintf.o bsd-closefrom.o bsd-cray.o bsd-cygwin_util.o bsd-getpeereid.o getrrsetbyname-ldns.o bsd-misc.o bsd-nextstep.o bsd-openpty.o bsd-poll.o bsd-setres_id.o bsd-snprintf.o bsd-statvfs.o bsd-waitpid.o fake-rfc2553.o openssl-compat.o xmmap.o xcrypt.o
-PORTS=port-aix.o port-irix.o port-linux.o port-solaris.o port-tun.o port-uw.o
+PORTS=port-aix.o port-irix.o port-linux.o port-linux_part_2.o port-solaris.o port-tun.o port-uw.o
.c.o:
$(CC) $(CFLAGS) $(CPPFLAGS) -c $<
-diff -up openssh-6.1p1/openbsd-compat/port-linux.c.role-mls openssh-6.1p1/openbsd-compat/port-linux.c
---- openssh-6.1p1/openbsd-compat/port-linux.c.role-mls 2012-03-09 00:25:18.000000000 +0100
-+++ openssh-6.1p1/openbsd-compat/port-linux.c 2012-11-28 17:06:43.702989948 +0100
+diff -up openssh-6.2p1/openbsd-compat/port-linux.c.role-mls openssh-6.2p1/openbsd-compat/port-linux.c
+--- openssh-6.2p1/openbsd-compat/port-linux.c.role-mls 2012-03-09 00:25:18.000000000 +0100
++++ openssh-6.2p1/openbsd-compat/port-linux.c 2013-03-25 17:47:00.606747096 +0100
@@ -31,68 +31,271 @@
#include "log.h"
@@ -840,9 +840,9 @@ diff -up openssh-6.1p1/openbsd-compat/port-linux.c.role-mls openssh-6.1p1/openbs
#endif /* WITH_SELINUX */
#ifdef LINUX_OOM_ADJUST
-diff -up openssh-6.1p1/openbsd-compat/port-linux_part_2.c.role-mls openssh-6.1p1/openbsd-compat/port-linux_part_2.c
---- openssh-6.1p1/openbsd-compat/port-linux_part_2.c.role-mls 2012-11-28 17:06:43.703989944 +0100
-+++ openssh-6.1p1/openbsd-compat/port-linux_part_2.c 2012-11-28 17:06:43.703989944 +0100
+diff -up openssh-6.2p1/openbsd-compat/port-linux_part_2.c.role-mls openssh-6.2p1/openbsd-compat/port-linux_part_2.c
+--- openssh-6.2p1/openbsd-compat/port-linux_part_2.c.role-mls 2013-03-25 17:47:00.607747102 +0100
++++ openssh-6.2p1/openbsd-compat/port-linux_part_2.c 2013-03-25 17:47:00.607747102 +0100
@@ -0,0 +1,75 @@
+/* $Id: port-linux.c,v 1.11.4.2 2011/02/04 00:43:08 djm Exp $ */
+
@@ -919,10 +919,10 @@ diff -up openssh-6.1p1/openbsd-compat/port-linux_part_2.c.role-mls openssh-6.1p1
+#endif /* WITH_SELINUX */
+
+#endif /* WITH_SELINUX || LINUX_OOM_ADJUST */
-diff -up openssh-6.1p1/sshd.c.role-mls openssh-6.1p1/sshd.c
---- openssh-6.1p1/sshd.c.role-mls 2012-11-28 17:06:43.688989996 +0100
-+++ openssh-6.1p1/sshd.c 2012-11-28 17:06:43.703989944 +0100
-@@ -2101,6 +2101,9 @@ main(int ac, char **av)
+diff -up openssh-6.2p1/sshd.c.role-mls openssh-6.2p1/sshd.c
+--- openssh-6.2p1/sshd.c.role-mls 2013-03-25 17:47:00.589746999 +0100
++++ openssh-6.2p1/sshd.c 2013-03-25 17:47:00.607747102 +0100
+@@ -2118,6 +2118,9 @@ main(int ac, char **av)
restore_uid();
}
#endif
diff --git a/openssh-6.1p1-vendor.patch b/openssh-6.2p1-vendor.patch
similarity index 67%
rename from openssh-6.1p1-vendor.patch
rename to openssh-6.2p1-vendor.patch
index 9cb326d..ddccd2c 100644
--- a/openssh-6.1p1-vendor.patch
+++ b/openssh-6.2p1-vendor.patch
@@ -1,7 +1,7 @@
-diff -up openssh-6.1p1/configure.ac.vendor openssh-6.1p1/configure.ac
---- openssh-6.1p1/configure.ac.vendor 2012-09-14 20:36:49.153085211 +0200
-+++ openssh-6.1p1/configure.ac 2012-09-14 20:36:49.559088133 +0200
-@@ -4303,6 +4303,12 @@ AC_ARG_WITH([lastlog],
+diff -up openssh-6.2p1/configure.ac.vendor openssh-6.2p1/configure.ac
+--- openssh-6.2p1/configure.ac.vendor 2013-03-25 19:34:01.277495179 +0100
++++ openssh-6.2p1/configure.ac 2013-03-25 19:34:01.377495818 +0100
+@@ -4420,6 +4420,12 @@ AC_ARG_WITH([lastlog],
fi
]
)
@@ -14,7 +14,7 @@ diff -up openssh-6.1p1/configure.ac.vendor openssh-6.1p1/configure.ac
dnl lastlog, [uw]tmpx? detection
dnl NOTE: set the paths in the platform section to avoid the
-@@ -4529,6 +4535,7 @@ echo " Translate v4 in v6 hack
+@@ -4681,6 +4687,7 @@ echo " Translate v4 in v6 hack
echo " BSD Auth support: $BSD_AUTH_MSG"
echo " Random number source: $RAND_MSG"
echo " Privsep sandbox style: $SANDBOX_STYLE"
@@ -22,9 +22,9 @@ diff -up openssh-6.1p1/configure.ac.vendor openssh-6.1p1/configure.ac
echo ""
-diff -up openssh-6.1p1/servconf.c.vendor openssh-6.1p1/servconf.c
---- openssh-6.1p1/servconf.c.vendor 2012-09-14 20:36:49.124085002 +0200
-+++ openssh-6.1p1/servconf.c 2012-09-14 20:50:34.995972516 +0200
+diff -up openssh-6.2p1/servconf.c.vendor openssh-6.2p1/servconf.c
+--- openssh-6.2p1/servconf.c.vendor 2013-03-25 19:34:01.197494668 +0100
++++ openssh-6.2p1/servconf.c 2013-03-25 19:34:01.379495831 +0100
@@ -128,6 +128,7 @@ initialize_server_options(ServerOptions
options->max_authtries = -1;
options->max_sessions = -1;
@@ -33,7 +33,7 @@ diff -up openssh-6.1p1/servconf.c.vendor openssh-6.1p1/servconf.c
options->use_dns = -1;
options->client_alive_interval = -1;
options->client_alive_count_max = -1;
-@@ -289,6 +290,9 @@ fill_default_server_options(ServerOption
+@@ -287,6 +288,9 @@ fill_default_server_options(ServerOption
options->ip_qos_bulk = IPTOS_THROUGHPUT;
if (options->version_addendum == NULL)
options->version_addendum = xstrdup("");
@@ -43,7 +43,7 @@ diff -up openssh-6.1p1/servconf.c.vendor openssh-6.1p1/servconf.c
/* Turn privilege separation on by default */
if (use_privsep == -1)
use_privsep = PRIVSEP_NOSANDBOX;
-@@ -326,7 +330,7 @@ typedef enum {
+@@ -324,7 +328,7 @@ typedef enum {
sIgnoreUserKnownHosts, sCiphers, sMacs, sProtocol, sPidFile,
sGatewayPorts, sPubkeyAuthentication, sXAuthLocation, sSubsystem,
sMaxStartups, sMaxAuthTries, sMaxSessions,
@@ -52,7 +52,7 @@ diff -up openssh-6.1p1/servconf.c.vendor openssh-6.1p1/servconf.c
sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
sClientAliveCountMax, sAuthorizedKeysFile,
sGssAuthentication, sGssCleanupCreds, sAcceptEnv, sPermitTunnel,
-@@ -441,6 +445,7 @@ static struct {
+@@ -439,6 +443,7 @@ static struct {
{ "maxauthtries", sMaxAuthTries, SSHCFG_ALL },
{ "maxsessions", sMaxSessions, SSHCFG_ALL },
{ "banner", sBanner, SSHCFG_ALL },
@@ -60,7 +60,7 @@ diff -up openssh-6.1p1/servconf.c.vendor openssh-6.1p1/servconf.c
{ "usedns", sUseDNS, SSHCFG_GLOBAL },
{ "verifyreversemapping", sDeprecated, SSHCFG_GLOBAL },
{ "reversemappingcheck", sDeprecated, SSHCFG_GLOBAL },
-@@ -1162,6 +1167,10 @@ process_server_config_line(ServerOptions
+@@ -1163,6 +1168,10 @@ process_server_config_line(ServerOptions
multistate_ptr = multistate_privsep;
goto parse_multistate;
@@ -71,7 +71,7 @@ diff -up openssh-6.1p1/servconf.c.vendor openssh-6.1p1/servconf.c
case sAllowUsers:
while ((arg = strdelim(&cp)) && *arg != '\0') {
if (options->num_allow_users >= MAX_ALLOW_USERS)
-@@ -1956,6 +1965,7 @@ dump_config(ServerOptions *o)
+@@ -1950,6 +1959,7 @@ dump_config(ServerOptions *o)
dump_cfg_fmtint(sUseLogin, o->use_login);
dump_cfg_fmtint(sCompression, o->compression);
dump_cfg_fmtint(sGatewayPorts, o->gateway_ports);
@@ -79,10 +79,10 @@ diff -up openssh-6.1p1/servconf.c.vendor openssh-6.1p1/servconf.c
dump_cfg_fmtint(sUseDNS, o->use_dns);
dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
-diff -up openssh-6.1p1/servconf.h.vendor openssh-6.1p1/servconf.h
---- openssh-6.1p1/servconf.h.vendor 2012-09-14 20:36:49.125085009 +0200
-+++ openssh-6.1p1/servconf.h 2012-09-14 20:36:49.564088168 +0200
-@@ -140,6 +140,7 @@ typedef struct {
+diff -up openssh-6.2p1/servconf.h.vendor openssh-6.2p1/servconf.h
+--- openssh-6.2p1/servconf.h.vendor 2013-01-09 05:56:45.000000000 +0100
++++ openssh-6.2p1/servconf.h 2013-03-25 19:34:01.379495831 +0100
+@@ -147,6 +147,7 @@ typedef struct {
int max_authtries;
int max_sessions;
char *banner; /* SSH-2 banner message */
@@ -90,21 +90,21 @@ diff -up openssh-6.1p1/servconf.h.vendor openssh-6.1p1/servconf.h
int use_dns;
int client_alive_interval; /*
* poke the client this often to
-diff -up openssh-6.1p1/sshd_config.vendor openssh-6.1p1/sshd_config
---- openssh-6.1p1/sshd_config.vendor 2012-09-14 20:36:49.507087759 +0200
-+++ openssh-6.1p1/sshd_config 2012-09-14 20:36:49.565088175 +0200
-@@ -114,6 +114,7 @@ UsePrivilegeSeparation sandbox # Defaul
+diff -up openssh-6.2p1/sshd_config.vendor openssh-6.2p1/sshd_config
+--- openssh-6.2p1/sshd_config.vendor 2013-03-25 19:34:01.380495837 +0100
++++ openssh-6.2p1/sshd_config 2013-03-25 19:44:43.471296362 +0100
+@@ -118,6 +118,7 @@ UsePrivilegeSeparation sandbox # Defaul
#Compression delayed
#ClientAliveInterval 0
#ClientAliveCountMax 3
+#ShowPatchLevel no
#UseDNS yes
#PidFile /var/run/sshd.pid
- #MaxStartups 10
-diff -up openssh-6.1p1/sshd_config.0.vendor openssh-6.1p1/sshd_config.0
---- openssh-6.1p1/sshd_config.0.vendor 2012-09-14 20:36:49.510087780 +0200
-+++ openssh-6.1p1/sshd_config.0 2012-09-14 20:36:49.567088190 +0200
-@@ -558,6 +558,11 @@ DESCRIPTION
+ #MaxStartups 10:30:100
+diff -up openssh-6.2p1/sshd_config.0.vendor openssh-6.2p1/sshd_config.0
+--- openssh-6.2p1/sshd_config.0.vendor 2013-03-25 19:34:01.361495716 +0100
++++ openssh-6.2p1/sshd_config.0 2013-03-25 19:34:01.381495844 +0100
+@@ -595,6 +595,11 @@ DESCRIPTION
Defines the number of bits in the ephemeral protocol version 1
server key. The minimum value is 512, and the default is 1024.
@@ -116,10 +116,10 @@ diff -up openssh-6.1p1/sshd_config.0.vendor openssh-6.1p1/sshd_config.0
StrictModes
Specifies whether sshd(8) should check file modes and ownership
of the user's files and home directory before accepting login.
-diff -up openssh-6.1p1/sshd_config.5.vendor openssh-6.1p1/sshd_config.5
---- openssh-6.1p1/sshd_config.5.vendor 2012-09-14 20:36:49.512087794 +0200
-+++ openssh-6.1p1/sshd_config.5 2012-09-14 20:36:49.568088198 +0200
-@@ -978,6 +978,14 @@ This option applies to protocol version
+diff -up openssh-6.2p1/sshd_config.5.vendor openssh-6.2p1/sshd_config.5
+--- openssh-6.2p1/sshd_config.5.vendor 2013-03-25 19:34:01.362495722 +0100
++++ openssh-6.2p1/sshd_config.5 2013-03-25 19:34:01.382495850 +0100
+@@ -1019,6 +1019,14 @@ This option applies to protocol version
.It Cm ServerKeyBits
Defines the number of bits in the ephemeral protocol version 1 server key.
The minimum value is 512, and the default is 1024.
@@ -134,10 +134,10 @@ diff -up openssh-6.1p1/sshd_config.5.vendor openssh-6.1p1/sshd_config.5
.It Cm StrictModes
Specifies whether
.Xr sshd 8
-diff -up openssh-6.1p1/sshd.c.vendor openssh-6.1p1/sshd.c
---- openssh-6.1p1/sshd.c.vendor 2012-09-14 20:36:49.399086981 +0200
-+++ openssh-6.1p1/sshd.c 2012-09-14 20:47:30.696088744 +0200
-@@ -433,7 +433,7 @@ sshd_exchange_identification(int sock_in
+diff -up openssh-6.2p1/sshd.c.vendor openssh-6.2p1/sshd.c
+--- openssh-6.2p1/sshd.c.vendor 2013-03-25 19:34:01.332495531 +0100
++++ openssh-6.2p1/sshd.c 2013-03-25 19:44:11.864112092 +0100
+@@ -442,7 +442,7 @@ sshd_exchange_identification(int sock_in
}
xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s",
@@ -146,13 +146,13 @@ diff -up openssh-6.1p1/sshd.c.vendor openssh-6.1p1/sshd.c
*options.version_addendum == '\0' ? "" : " ",
options.version_addendum, newline);
-@@ -1635,7 +1635,8 @@ main(int ac, char **av)
+@@ -1675,7 +1675,8 @@ main(int ac, char **av)
exit(1);
}
-- debug("sshd version %.100s", SSH_RELEASE);
-+ debug("sshd version %.100s",
-+ (options.show_patchlevel == 1) ? SSH_VENDOR_PATCHLEVEL : SSH_RELEASE);
+- debug("sshd version %s, %s", SSH_VERSION,
++ debug("sshd version %s, %s",
++ (options.show_patchlevel == 1) ? SSH_VENDOR_PATCHLEVEL : SSH_VERSION,
+ SSLeay_version(SSLEAY_VERSION));
/* Store privilege separation user for later use if required. */
- if ((privsep_pw = getpwnam(SSH_PRIVSEP_USER)) == NULL) {
diff --git a/openssh.spec b/openssh.spec
index 1cca739..924aabc 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -66,10 +66,10 @@
%endif
# Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
-%define openssh_ver 6.1p1
-%define openssh_rel 7
+%define openssh_ver 6.2p1
+%define openssh_rel 1
%define pam_ssh_agent_ver 0.9.3
-%define pam_ssh_agent_rel 3
+%define pam_ssh_agent_rel 4
Summary: An open source implementation of SSH protocol versions 1 and 2
Name: openssh
@@ -82,8 +82,7 @@ URL: http://www.openssh.com/portable.html
# This package differs from the upstream OpenSSH tarball in that
# the ACSS cipher is removed by running openssh-nukeacss.sh in
# the unpacked source directory.
-Source0: openssh-%{version}-noacss.tar.bz2
-Source1: openssh-nukeacss.sh
+Source0: openssh-%{version}.tar.gz
Source2: sshd.pam
Source3: sshd.init
Source4: http://prdownloads.sourceforge.net/pamsshagentauth/pam_ssh_agent_auth/pam_ssh_agent_auth-%{pam_ssh_agent_ver}.tar.bz2
@@ -100,9 +99,9 @@ Source13: sshd-keygen
Patch0: openssh-5.9p1-wIm.patch
#?
-Patch100: openssh-6.1p1-coverity.patch
+Patch100: openssh-6.2p1-coverity.patch
#https://bugzilla.mindrot.org/show_bug.cgi?id=1872
-Patch101: openssh-5.8p1-fingerprint.patch
+Patch101: openssh-6.2p1-fingerprint.patch
#https://bugzilla.mindrot.org/show_bug.cgi?id=1894
#https://bugzilla.redhat.com/show_bug.cgi?id=735889
Patch102: openssh-5.8p1-getaddrinfo.patch
@@ -114,15 +113,15 @@ Patch104: openssh-6.1p1-authenticationmethods.patch
#https://bugzilla.mindrot.org/show_bug.cgi?id=1402
Patch200: openssh-5.8p1-audit0.patch
# -"-
-Patch201: openssh-6.0p1-audit1.patch
+Patch201: openssh-6.2p1-audit1.patch
# -"-
Patch202: openssh-5.9p1-audit2.patch
# -"-
-Patch203: openssh-5.9p1-audit3.patch
+Patch203: openssh-6.2p1-audit3.patch
# -"-
-Patch204: openssh-6.1p1-audit4.patch
+Patch204: openssh-6.2p1-audit4.patch
# -"-
-Patch205: openssh-6.0p1-audit5.patch
+Patch205: openssh-6.2p1-audit5.patch
# --- pam_ssh-agent ---
# make it build reusing the openssh sources
@@ -132,7 +131,7 @@ Patch301: pam_ssh_agent_auth-0.9.2-seteuid.patch
# explicitly make pam callbacks visible
Patch302: pam_ssh_agent_auth-0.9.2-visibility.patch
#https://bugzilla.mindrot.org/show_bug.cgi?id=1641 (WONTFIX)
-Patch400: openssh-6.1p1-role-mls.patch
+Patch400: openssh-6.2p1-role-mls.patch
#?
#Patch402: openssh-5.9p1-sftp-chroot.patch
#https://bugzilla.mindrot.org/show_bug.cgi?id=1940
@@ -143,9 +142,9 @@ Patch404: openssh-6.1p1-privsep-selinux.patch
#https://bugzilla.mindrot.org/show_bug.cgi?id=1663
Patch500: openssh-6.1p1-akc.patch
#?-- unwanted child :(
-Patch501: openssh-6.0p1-ldap.patch
+Patch501: openssh-6.2p1-ldap.patch
#?
-Patch502: openssh-5.9p1-keycat.patch
+Patch502: openssh-6.2p1-keycat.patch
#https://bugzilla.mindrot.org/show_bug.cgi?id=1668
#Patch600: openssh-5.9p1-keygen.patch
@@ -169,7 +168,7 @@ Patch608: openssh-6.1p1-askpass-ld.patch
Patch609: openssh-5.5p1-x11.patch
#?
-Patch700: openssh-5.9p1-fips.patch
+Patch700: openssh-6.2p1-fips.patch
#?
Patch701: openssh-5.6p1-exit-deadlock.patch
#?
@@ -185,9 +184,9 @@ Patch706: openssh-5.8p1-localdomain.patch
#https://bugzilla.mindrot.org/show_bug.cgi?id=1635 (WONTFIX)
Patch707: openssh-6.1p1-redhat.patch
#https://bugzilla.mindrot.org/show_bug.cgi?id=1890 (WONTFIX) need integration to prng helper which is discontinued :)
-Patch708: openssh-6.0p1-entropy.patch
+Patch708: openssh-6.2p1-entropy.patch
#https://bugzilla.mindrot.org/show_bug.cgi?id=1640 (WONTFIX)
-Patch709: openssh-6.1p1-vendor.patch
+Patch709: openssh-6.2p1-vendor.patch
#?
Patch710: openssh-5.9p1-copy-id-restorecon.patch
# warn users for unsupported UsePAM=no (#757545)
@@ -195,17 +194,17 @@ Patch711: openssh-6.1p1-log-usepam-no.patch
# make aes-ctr ciphers use EVP engines such as AES-NI from OpenSSL
Patch712: openssh-5.9p1-ctr-evp-fast.patch
# add cavs test binary for the aes-ctr
-Patch713: openssh-5.9p1-ctr-cavstest.patch
+Patch713: openssh-6.2p1-ctr-cavstest.patch
#http://www.sxw.org.uk/computing/patches/openssh.html
#changed cache storage type - #848228
-Patch800: openssh-6.1p1-gsskex.patch
+Patch800: openssh-6.2p1-gsskex.patch
#http://www.mail-archive.com/kerberos@mit.edu/msg17591.html
-Patch801: openssh-5.8p2-force_krb.patch
+Patch801: openssh-6.2p1-force_krb.patch
Patch900: openssh-6.1p1-gssapi-canohost.patch
#https://bugzilla.mindrot.org/show_bug.cgi?id=1780
-Patch901: openssh-6.1p1-kuserok.patch
+Patch901: openssh-6.2p1-kuserok.patch
#https://bugzilla.redhat.com/show_bug.cgi?id=841065
Patch902: openssh-6.1p1-man-moduli.patch
# obsolete RequiredAuthentications options
@@ -393,7 +392,7 @@ The module is most useful for su and sudo service stacks.
%patch101 -p1 -b .fingerprint
%patch102 -p1 -b .getaddrinfo
%patch103 -p1 -b .packet
-%patch104 -p1 -b .authenticationmethods
+# %patch104 -p1 -b .authenticationmethods
%patch200 -p1 -b .audit0
%patch201 -p1 -b .audit1
@@ -414,18 +413,18 @@ popd
%if %{WITH_SELINUX}
%patch400 -p1 -b .role-mls
-#%patch402 -p1 -b .sftp-chroot
-#%patch403 -p1 -b .sesandbox
+# %patch402 -p1 -b .sftp-chroot
+# %patch403 -p1 -b .sesandbox
%patch404 -p1 -b .privsep-selinux
%endif
-%patch500 -p1 -b .akc
+# %patch500 -p1 -b .akc
%if %{ldap}
%patch501 -p1 -b .ldap
%endif
%patch502 -p1 -b .keycat
-#%patch600 -p1 -b .keygen
+# %patch600 -p1 -b .keygen
%patch601 -p1 -b .ip-opts
%patch602 -p1 -b .randclean
%patch603 -p1 -b .glob
@@ -446,7 +445,7 @@ popd
%patch707 -p1 -b .redhat
%patch708 -p1 -b .entropy
%patch709 -p1 -b .vendor
-%patch710 -p1 -b .restorecon
+# %patch710 -p1 -b .restorecon
%patch711 -p1 -b .log-usepam-no
%patch712 -p1 -b .evp-ctr
%patch713 -p1 -b .ctr-cavs
@@ -456,9 +455,9 @@ popd
%patch900 -p1 -b .canohost
%patch901 -p1 -b .kuserok
-%patch902 -p1 -b .man-moduli
-%patch903 -p1 -b .required-authentication
-%patch904 -p1 -b .max-startups
+# %patch902 -p1 -b .man-moduli
+# %patch903 -p1 -b .required-authentication
+# %patch904 -p1 -b .max-startups
%if 0
# Nothing here yet
diff --git a/sources b/sources
index b4df87f..ea348d1 100644
--- a/sources
+++ b/sources
@@ -1,2 +1 @@
-9872ca1983e566ff5a89c240529e223d pam_ssh_agent_auth-0.9.3.tar.bz2
-688b37a843ea1c9217f45b1f5c21b791 openssh-6.1p1-noacss.tar.bz2
+7b2d9dd75b5cf267ea1737ec75500316 openssh-6.2p1.tar.gz
More information about the scm-commits
mailing list