[openssh] rebase audit patch for 6.6.1p1
plautrba
plautrba at fedoraproject.org
Tue Jul 8 15:43:23 UTC 2014
commit 5160c9c8f32428a4d0ffb763e6a8ead8b2ea2d0f
Author: Petr Lautrbach <plautrba at redhat.com>
Date: Tue Jul 8 15:52:24 2014 +0200
rebase audit patch for 6.6.1p1
...-6.4p1-audit.patch => openssh-6.6p1-audit.patch | 464 ++++++++++----------
openssh.spec | 6 +-
2 files changed, 242 insertions(+), 228 deletions(-)
---
diff --git a/openssh-6.4p1-audit.patch b/openssh-6.6p1-audit.patch
similarity index 82%
rename from openssh-6.4p1-audit.patch
rename to openssh-6.6p1-audit.patch
index 77a6fa4..e1b2b98 100644
--- a/openssh-6.4p1-audit.patch
+++ b/openssh-6.6p1-audit.patch
@@ -1,19 +1,22 @@
-diff -up openssh-6.3p1/Makefile.in.audit openssh-6.3p1/Makefile.in
---- openssh-6.3p1/Makefile.in.audit 2013-06-11 03:26:10.000000000 +0200
-+++ openssh-6.3p1/Makefile.in 2013-10-07 15:53:34.246717277 +0200
-@@ -73,7 +73,7 @@ LIBSSH_OBJS=authfd.o authfile.o bufaux.o
- monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o \
- kexdh.o kexgex.o kexdhc.o kexgexc.o bufec.o kexecdh.o kexecdhc.o \
- msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o umac128.o \
-- jpake.o schnorr.o ssh-pkcs11.o krl.o
-+ jpake.o schnorr.o ssh-pkcs11.o krl.o auditstub.o
+diff --git a/Makefile.in b/Makefile.in
+index 2ad26ff..3bb7f00 100644
+--- a/Makefile.in
++++ b/Makefile.in
+@@ -82,7 +82,8 @@ LIBSSH_OBJS=authfd.o authfile.o bufaux.o bufbn.o buffer.o \
+ ssh-pkcs11.o krl.o smult_curve25519_ref.o \
+ kexc25519.o kexc25519c.o poly1305.o chacha.o cipher-chachapoly.o \
+ ssh-ed25519.o digest-openssl.o hmac.o \
+- sc25519.o ge25519.o fe25519.o ed25519.o verify.o hash.o blocks.o
++ sc25519.o ge25519.o fe25519.o ed25519.o verify.o hash.o blocks.o \
++ auditstub.o
SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
sshconnect.o sshconnect1.o sshconnect2.o mux.o \
-diff -up openssh-6.3p1/audit-bsm.c.audit openssh-6.3p1/audit-bsm.c
---- openssh-6.3p1/audit-bsm.c.audit 2012-02-24 00:40:43.000000000 +0100
-+++ openssh-6.3p1/audit-bsm.c 2013-10-07 15:53:34.246717277 +0200
-@@ -375,10 +375,23 @@ audit_connection_from(const char *host,
+diff --git a/audit-bsm.c b/audit-bsm.c
+index 6135591..5160869 100644
+--- a/audit-bsm.c
++++ b/audit-bsm.c
+@@ -375,10 +375,23 @@ audit_connection_from(const char *host, int port)
#endif
}
@@ -38,7 +41,7 @@ diff -up openssh-6.3p1/audit-bsm.c.audit openssh-6.3p1/audit-bsm.c
}
void
-@@ -393,6 +406,12 @@ audit_session_close(struct logininfo *li
+@@ -393,6 +406,12 @@ audit_session_close(struct logininfo *li)
/* not implemented */
}
@@ -92,9 +95,10 @@ diff -up openssh-6.3p1/audit-bsm.c.audit openssh-6.3p1/audit-bsm.c
+ /* not implemented */
+}
#endif /* BSM */
-diff -up openssh-6.3p1/audit-linux.c.audit openssh-6.3p1/audit-linux.c
---- openssh-6.3p1/audit-linux.c.audit 2011-01-17 11:15:30.000000000 +0100
-+++ openssh-6.3p1/audit-linux.c 2013-10-07 15:53:34.246717277 +0200
+diff --git a/audit-linux.c b/audit-linux.c
+index b3ee2f4..946f7fa 100644
+--- a/audit-linux.c
++++ b/audit-linux.c
@@ -35,13 +35,24 @@
#include "log.h"
@@ -123,7 +127,7 @@ diff -up openssh-6.3p1/audit-linux.c.audit openssh-6.3p1/audit-linux.c
{
int audit_fd, rc, saved_errno;
-@@ -49,11 +60,11 @@ linux_audit_record_event(int uid, const
+@@ -49,11 +60,11 @@ linux_audit_record_event(int uid, const char *username,
if (audit_fd < 0) {
if (errno == EINVAL || errno == EPROTONOSUPPORT ||
errno == EAFNOSUPPORT)
@@ -138,7 +142,7 @@ diff -up openssh-6.3p1/audit-linux.c.audit openssh-6.3p1/audit-linux.c
NULL, "login", username ? username : "(unknown)",
username == NULL ? uid : -1, hostname, ip, ttyn, success);
saved_errno = errno;
-@@ -65,35 +76,150 @@ linux_audit_record_event(int uid, const
+@@ -65,35 +76,150 @@ linux_audit_record_event(int uid, const char *username,
if ((rc == -EPERM) && (geteuid() != 0))
rc = 0;
errno = saved_errno;
@@ -481,9 +485,10 @@ diff -up openssh-6.3p1/audit-linux.c.audit openssh-6.3p1/audit-linux.c
+ error("cannot write into audit");
+}
#endif /* USE_LINUX_AUDIT */
-diff -up openssh-6.3p1/audit.c.audit openssh-6.3p1/audit.c
---- openssh-6.3p1/audit.c.audit 2011-01-17 11:15:30.000000000 +0100
-+++ openssh-6.3p1/audit.c 2013-10-07 15:53:34.246717277 +0200
+diff --git a/audit.c b/audit.c
+index ced57fa..b806f03 100644
+--- a/audit.c
++++ b/audit.c
@@ -28,6 +28,7 @@
#include <stdarg.h>
@@ -561,7 +566,7 @@ diff -up openssh-6.3p1/audit.c.audit openssh-6.3p1/audit.c
* Called when a user session is started. Argument is the tty allocated to
* the session, or NULL if no tty was allocated.
*
-@@ -174,13 +223,91 @@ audit_session_close(struct logininfo *li
+@@ -174,13 +223,91 @@ audit_session_close(struct logininfo *li)
/*
* This will be called when a user runs a non-interactive command. Note that
* it may be called multiple times for a single connection since SSH2 allows
@@ -655,9 +660,10 @@ diff -up openssh-6.3p1/audit.c.audit openssh-6.3p1/audit.c
}
# endif /* !defined CUSTOM_SSH_AUDIT_EVENTS */
#endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-6.3p1/audit.h.audit openssh-6.3p1/audit.h
---- openssh-6.3p1/audit.h.audit 2011-01-17 11:15:30.000000000 +0100
-+++ openssh-6.3p1/audit.h 2013-10-07 15:53:34.246717277 +0200
+diff --git a/audit.h b/audit.h
+index 92ede5b..a2dc3ff 100644
+--- a/audit.h
++++ b/audit.h
@@ -28,6 +28,7 @@
# define _SSH_AUDIT_H
@@ -693,9 +699,11 @@ diff -up openssh-6.3p1/audit.h.audit openssh-6.3p1/audit.h
+void audit_generate_ephemeral_server_key(const char *);
#endif /* _SSH_AUDIT_H */
-diff -up openssh-6.3p1/auditstub.c.audit openssh-6.3p1/auditstub.c
---- openssh-6.3p1/auditstub.c.audit 2013-10-07 15:53:34.247717272 +0200
-+++ openssh-6.3p1/auditstub.c 2013-10-07 15:53:34.247717272 +0200
+diff --git a/auditstub.c b/auditstub.c
+new file mode 100644
+index 0000000..45817e0
+--- /dev/null
++++ b/auditstub.c
@@ -0,0 +1,50 @@
+/* $Id: auditstub.c,v 1.1 jfch Exp $ */
+
@@ -747,13 +755,14 @@ diff -up openssh-6.3p1/auditstub.c.audit openssh-6.3p1/auditstub.c
+audit_session_key_free_body(int ctos, pid_t pid, uid_t uid)
+{
+}
-diff -up openssh-6.3p1/auth-rsa.c.audit openssh-6.3p1/auth-rsa.c
---- openssh-6.3p1/auth-rsa.c.audit 2013-07-18 08:12:44.000000000 +0200
-+++ openssh-6.3p1/auth-rsa.c 2013-10-07 15:53:34.247717272 +0200
-@@ -92,7 +92,10 @@ auth_rsa_verify_response(Key *key, BIGNU
+diff --git a/auth-rsa.c b/auth-rsa.c
+index 5dad6c3..f225b0b 100644
+--- a/auth-rsa.c
++++ b/auth-rsa.c
+@@ -93,7 +93,10 @@ auth_rsa_verify_response(Key *key, BIGNUM *challenge, u_char response[16])
{
u_char buf[32], mdbuf[16];
- MD5_CTX md;
+ struct ssh_digest_ctx *md;
- int len;
+ int len, rv;
+#ifdef SSH_AUDIT_EVENTS
@@ -762,8 +771,8 @@ diff -up openssh-6.3p1/auth-rsa.c.audit openssh-6.3p1/auth-rsa.c
/* don't allow short keys */
if (BN_num_bits(key->rsa->n) < SSH_RSA_MINIMUM_MODULUS_SIZE) {
-@@ -113,12 +116,18 @@ auth_rsa_verify_response(Key *key, BIGNU
- MD5_Final(mdbuf, &md);
+@@ -117,12 +120,18 @@ auth_rsa_verify_response(Key *key, BIGNUM *challenge, u_char response[16])
+ ssh_digest_free(md);
/* Verify that the response is the original challenge. */
- if (timingsafe_bcmp(response, mdbuf, 16) != 0) {
@@ -786,10 +795,11 @@ diff -up openssh-6.3p1/auth-rsa.c.audit openssh-6.3p1/auth-rsa.c
}
/*
-diff -up openssh-6.3p1/auth.h.audit openssh-6.3p1/auth.h
---- openssh-6.3p1/auth.h.audit 2013-07-20 05:21:53.000000000 +0200
-+++ openssh-6.3p1/auth.h 2013-10-07 16:02:38.629171107 +0200
-@@ -187,6 +187,7 @@ void abandon_challenge_response(Authctxt
+diff --git a/auth.h b/auth.h
+index 4605588..f9d191c 100644
+--- a/auth.h
++++ b/auth.h
+@@ -186,6 +186,7 @@ void abandon_challenge_response(Authctxt *);
char *expand_authorized_keys(const char *, struct passwd *pw);
char *authorized_principals_file(struct passwd *);
@@ -797,7 +807,7 @@ diff -up openssh-6.3p1/auth.h.audit openssh-6.3p1/auth.h
FILE *auth_openkeyfile(const char *, struct passwd *, int);
FILE *auth_openprincipals(const char *, struct passwd *, int);
-@@ -204,6 +205,7 @@ Key *get_hostkey_private_by_type(int);
+@@ -203,6 +204,7 @@ Key *get_hostkey_private_by_type(int);
int get_hostkey_index(Key *);
int ssh1_session_key(BIGNUM *);
void sshd_hostkey_sign(Key *, Key *, u_char **, u_int *, u_char *, u_int);
@@ -805,10 +815,11 @@ diff -up openssh-6.3p1/auth.h.audit openssh-6.3p1/auth.h
/* debug messages during authentication */
void auth_debug_add(const char *fmt,...) __attribute__((format(printf, 1, 2)));
-diff -up openssh-6.3p1/auth2-hostbased.c.audit openssh-6.3p1/auth2-hostbased.c
---- openssh-6.3p1/auth2-hostbased.c.audit 2013-10-07 15:53:34.223717384 +0200
-+++ openssh-6.3p1/auth2-hostbased.c 2013-10-07 15:53:34.247717272 +0200
-@@ -123,7 +123,7 @@ userauth_hostbased(Authctxt *authctxt)
+diff --git a/auth2-hostbased.c b/auth2-hostbased.c
+index 95d678e..48aede4 100644
+--- a/auth2-hostbased.c
++++ b/auth2-hostbased.c
+@@ -137,7 +137,7 @@ userauth_hostbased(Authctxt *authctxt)
/* test for allowed key and correct signature */
authenticated = 0;
if (PRIVSEP(hostbased_key_allowed(authctxt->pw, cuser, chost, key)) &&
@@ -817,7 +828,7 @@ diff -up openssh-6.3p1/auth2-hostbased.c.audit openssh-6.3p1/auth2-hostbased.c
buffer_len(&b))) == 1)
authenticated = 1;
-@@ -140,6 +140,18 @@ done:
+@@ -154,6 +154,18 @@ done:
return authenticated;
}
@@ -836,10 +847,11 @@ diff -up openssh-6.3p1/auth2-hostbased.c.audit openssh-6.3p1/auth2-hostbased.c
/* return 1 if given hostkey is allowed */
int
hostbased_key_allowed(struct passwd *pw, const char *cuser, char *chost,
-diff -up openssh-6.3p1/auth2-pubkey.c.audit openssh-6.3p1/auth2-pubkey.c
---- openssh-6.3p1/auth2-pubkey.c.audit 2013-10-07 15:53:34.224717379 +0200
-+++ openssh-6.3p1/auth2-pubkey.c 2013-10-08 15:11:42.282436972 +0200
-@@ -152,7 +152,7 @@ userauth_pubkey(Authctxt *authctxt)
+diff --git a/auth2-pubkey.c b/auth2-pubkey.c
+index cb0f931..6d1c872 100644
+--- a/auth2-pubkey.c
++++ b/auth2-pubkey.c
+@@ -160,7 +160,7 @@ userauth_pubkey(Authctxt *authctxt)
/* test for correct signature */
authenticated = 0;
if (PRIVSEP(user_key_allowed(authctxt->pw, key)) &&
@@ -848,7 +860,7 @@ diff -up openssh-6.3p1/auth2-pubkey.c.audit openssh-6.3p1/auth2-pubkey.c
buffer_len(&b))) == 1)
authenticated = 1;
buffer_free(&b);
-@@ -223,6 +223,18 @@ pubkey_auth_info(Authctxt *authctxt, con
+@@ -231,6 +231,18 @@ pubkey_auth_info(Authctxt *authctxt, const Key *key, const char *fmt, ...)
free(extra);
}
@@ -867,10 +879,11 @@ diff -up openssh-6.3p1/auth2-pubkey.c.audit openssh-6.3p1/auth2-pubkey.c
static int
match_principals_option(const char *principal_list, struct KeyCert *cert)
{
-diff -up openssh-6.3p1/auth2.c.audit openssh-6.3p1/auth2.c
---- openssh-6.3p1/auth2.c.audit 2013-06-01 23:41:51.000000000 +0200
-+++ openssh-6.3p1/auth2.c 2013-10-07 15:53:34.248717268 +0200
-@@ -245,9 +245,6 @@ input_userauth_request(int type, u_int32
+diff --git a/auth2.c b/auth2.c
+index 0f52b68..472a5b2 100644
+--- a/auth2.c
++++ b/auth2.c
+@@ -249,9 +249,6 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
} else {
logit("input_userauth_request: invalid user %s", user);
authctxt->pw = fakepw();
@@ -880,32 +893,31 @@ diff -up openssh-6.3p1/auth2.c.audit openssh-6.3p1/auth2.c
}
#ifdef USE_PAM
if (options.use_pam)
-diff -up openssh-6.3p1/cipher.c.audit openssh-6.3p1/cipher.c
---- openssh-6.3p1/cipher.c.audit 2013-10-07 15:53:34.248717268 +0200
-+++ openssh-6.3p1/cipher.c 2013-10-07 16:06:51.117971891 +0200
-@@ -55,18 +55,6 @@ extern const EVP_CIPHER *evp_ssh1_bf(voi
+diff --git a/cipher.c b/cipher.c
+index 53d9b4f..87317ab 100644
+--- a/cipher.c
++++ b/cipher.c
+@@ -57,6 +57,7 @@ extern const EVP_CIPHER *evp_ssh1_bf(void);
extern const EVP_CIPHER *evp_ssh1_3des(void);
extern void ssh1_3des_iv(EVP_CIPHER_CTX *, int, u_char *, int);
--struct Cipher {
-- char *name;
-- int number; /* for ssh1 only */
-- u_int block_size;
-- u_int key_len;
-- u_int iv_len; /* defaults to block_size */
-- u_int auth_len;
-- u_int discard_len;
-- u_int cbc_mode;
-- const EVP_CIPHER *(*evptype)(void);
--};
--
++#if 0
+ struct Cipher {
+ char *name;
+ int number; /* for ssh1 only */
+@@ -70,6 +71,7 @@ struct Cipher {
+ #define CFLAG_CHACHAPOLY (1<<1)
+ const EVP_CIPHER *(*evptype)(void);
+ };
++#endif
+
static const struct Cipher ciphers[] = {
{ "none", SSH_CIPHER_NONE, 8, 0, 0, 0, 0, 0, EVP_enc_null },
- { "des", SSH_CIPHER_DES, 8, 8, 0, 0, 0, 1, EVP_des_cbc },
-diff -up openssh-6.3p1/cipher.h.audit openssh-6.3p1/cipher.h
---- openssh-6.3p1/cipher.h.audit 2013-04-23 11:24:32.000000000 +0200
-+++ openssh-6.3p1/cipher.h 2013-10-07 15:53:34.248717268 +0200
-@@ -61,7 +61,18 @@
+diff --git a/cipher.h b/cipher.h
+index 133d2e7..d41758e 100644
+--- a/cipher.h
++++ b/cipher.h
+@@ -63,7 +63,20 @@
typedef struct Cipher Cipher;
typedef struct CipherContext CipherContext;
@@ -918,25 +930,28 @@ diff -up openssh-6.3p1/cipher.h.audit openssh-6.3p1/cipher.h
+ u_int iv_len; /* defaults to block_size */
+ u_int auth_len;
+ u_int discard_len;
-+ u_int cbc_mode;
++ u_int flags;
++#define CFLAG_CBC (1<<0)
++#define CFLAG_CHACHAPOLY (1<<1)
+ const EVP_CIPHER *(*evptype)(void);
+};
+
struct CipherContext {
int plaintext;
int encrypt;
-diff -up openssh-6.3p1/kex.c.audit openssh-6.3p1/kex.c
---- openssh-6.3p1/kex.c.audit 2013-06-01 23:31:18.000000000 +0200
-+++ openssh-6.3p1/kex.c 2013-10-07 15:53:34.249717264 +0200
-@@ -49,6 +49,7 @@
- #include "dispatch.h"
+diff --git a/kex.c b/kex.c
+index bce2ab8..bc3e53e 100644
+--- a/kex.c
++++ b/kex.c
+@@ -50,6 +50,7 @@
#include "monitor.h"
#include "roaming.h"
+ #include "digest.h"
+#include "audit.h"
- #if OPENSSL_VERSION_NUMBER >= 0x00907000L
- # if defined(HAVE_EVP_SHA256)
-@@ -341,9 +342,13 @@ static void
+ #ifdef GSSAPI
+ #include "ssh-gss.h"
+@@ -366,9 +367,13 @@ static void
choose_enc(Enc *enc, char *client, char *server)
{
char *name = match_list(client, server, NULL);
@@ -951,7 +966,7 @@ diff -up openssh-6.3p1/kex.c.audit openssh-6.3p1/kex.c
if ((enc->cipher = cipher_by_name(name)) == NULL)
fatal("matching cipher is not supported: %s", name);
enc->name = name;
-@@ -359,9 +364,13 @@ static void
+@@ -384,9 +389,13 @@ static void
choose_mac(Mac *mac, char *client, char *server)
{
char *name = match_list(client, server, NULL);
@@ -966,7 +981,7 @@ diff -up openssh-6.3p1/kex.c.audit openssh-6.3p1/kex.c
if (mac_setup(mac, name) < 0)
fatal("unsupported mac %s", name);
/* truncate the key */
-@@ -376,8 +385,12 @@ static void
+@@ -401,8 +410,12 @@ static void
choose_comp(Comp *comp, char *client, char *server)
{
char *name = match_list(client, server, NULL);
@@ -980,7 +995,7 @@ diff -up openssh-6.3p1/kex.c.audit openssh-6.3p1/kex.c
if (strcmp(name, "zlib at openssh.com") == 0) {
comp->type = COMP_DELAYED;
} else if (strcmp(name, "zlib") == 0) {
-@@ -492,6 +505,9 @@ kex_choose_conf(Kex *kex)
+@@ -517,6 +530,9 @@ kex_choose_conf(Kex *kex)
newkeys->enc.name,
authlen == 0 ? newkeys->mac.name : "<implicit>",
newkeys->comp.name);
@@ -990,7 +1005,7 @@ diff -up openssh-6.3p1/kex.c.audit openssh-6.3p1/kex.c
}
choose_kex(kex, cprop[PROPOSAL_KEX_ALGS], sprop[PROPOSAL_KEX_ALGS]);
choose_hostkeyalg(kex, cprop[PROPOSAL_SERVER_HOST_KEY_ALGS],
-@@ -656,3 +672,34 @@ dump_digest(char *msg, u_char *digest, i
+@@ -702,3 +718,34 @@ dump_digest(char *msg, u_char *digest, int len)
fprintf(stderr, "\n");
}
#endif
@@ -1025,22 +1040,24 @@ diff -up openssh-6.3p1/kex.c.audit openssh-6.3p1/kex.c
+ memset(&newkeys->comp, 0, sizeof(newkeys->comp));
+}
+
-diff -up openssh-6.3p1/kex.h.audit openssh-6.3p1/kex.h
---- openssh-6.3p1/kex.h.audit 2013-07-20 05:21:53.000000000 +0200
-+++ openssh-6.3p1/kex.h 2013-10-07 15:53:34.249717264 +0200
-@@ -162,6 +162,8 @@ void kexgex_server(Kex *);
- void kexecdh_client(Kex *);
- void kexecdh_server(Kex *);
+diff --git a/kex.h b/kex.h
+index 313bb51..c643250 100644
+--- a/kex.h
++++ b/kex.h
+@@ -182,6 +182,8 @@ void kexgss_client(Kex *);
+ void kexgss_server(Kex *);
+ #endif
+void newkeys_destroy(Newkeys *newkeys);
+
void
kex_dh_hash(char *, char *, char *, int, char *, int, u_char *, int,
BIGNUM *, BIGNUM *, BIGNUM *, u_char **, u_int *);
-diff -up openssh-6.3p1/key.c.audit openssh-6.3p1/key.c
---- openssh-6.3p1/key.c.audit 2013-10-07 15:53:34.224717379 +0200
-+++ openssh-6.3p1/key.c 2013-10-07 15:53:34.249717264 +0200
-@@ -1773,6 +1773,30 @@ key_demote(const Key *k)
+diff --git a/key.c b/key.c
+index 900b9e3..62f3edb 100644
+--- a/key.c
++++ b/key.c
+@@ -1925,6 +1925,33 @@ key_demote(const Key *k)
}
int
@@ -1061,6 +1078,9 @@ diff -up openssh-6.3p1/key.c.audit openssh-6.3p1/key.c
+ case KEY_ECDSA:
+ return EC_KEY_get0_private_key(k->ecdsa) != NULL;
+#endif
++ case KEY_ED25519_CERT:
++ case KEY_ED25519:
++ return (k->ed25519_pk != NULL);
+ default:
+ fatal("key_is_private: bad key type %d", k->type);
+ return 1;
@@ -1071,21 +1091,23 @@ diff -up openssh-6.3p1/key.c.audit openssh-6.3p1/key.c
key_is_cert(const Key *k)
{
if (k == NULL)
-diff -up openssh-6.3p1/key.h.audit openssh-6.3p1/key.h
---- openssh-6.3p1/key.h.audit 2013-10-07 15:53:34.224717379 +0200
-+++ openssh-6.3p1/key.h 2013-10-07 15:53:34.249717264 +0200
-@@ -110,6 +110,7 @@ Key *key_generate(int, u_int);
+diff --git a/key.h b/key.h
+index d51ed81..8f61605 100644
+--- a/key.h
++++ b/key.h
+@@ -118,6 +118,7 @@ Key *key_generate(int, u_int);
Key *key_from_private(const Key *);
int key_type_from_name(char *);
int key_is_cert(const Key *);
+int key_is_private(const Key *k);
+ int key_type_is_cert(int);
int key_type_plain(int);
int key_to_certified(Key *, int);
- int key_drop_cert(Key *);
-diff -up openssh-6.3p1/mac.c.audit openssh-6.3p1/mac.c
---- openssh-6.3p1/mac.c.audit 2013-06-06 00:12:37.000000000 +0200
-+++ openssh-6.3p1/mac.c 2013-10-07 15:53:34.250717259 +0200
-@@ -224,6 +224,20 @@ mac_clear(Mac *mac)
+diff --git a/mac.c b/mac.c
+index 0977572..9388af4 100644
+--- a/mac.c
++++ b/mac.c
+@@ -222,6 +222,20 @@ mac_clear(Mac *mac)
mac->umac_ctx = NULL;
}
@@ -1106,26 +1128,28 @@ diff -up openssh-6.3p1/mac.c.audit openssh-6.3p1/mac.c
/* XXX copied from ciphers_valid */
#define MAC_SEP ","
int
-diff -up openssh-6.3p1/mac.h.audit openssh-6.3p1/mac.h
---- openssh-6.3p1/mac.h.audit 2013-04-23 11:24:32.000000000 +0200
-+++ openssh-6.3p1/mac.h 2013-10-07 15:53:34.250717259 +0200
+diff --git a/mac.h b/mac.h
+index fbe18c4..7dc7f43 100644
+--- a/mac.h
++++ b/mac.h
@@ -29,3 +29,4 @@ int mac_setup(Mac *, char *);
int mac_init(Mac *);
u_char *mac_compute(Mac *, u_int32_t, u_char *, int);
void mac_clear(Mac *);
+void mac_destroy(Mac *);
-diff -up openssh-6.3p1/monitor.c.audit openssh-6.3p1/monitor.c
---- openssh-6.3p1/monitor.c.audit 2013-10-07 15:53:34.217717411 +0200
-+++ openssh-6.3p1/monitor.c 2013-10-08 15:10:38.270726936 +0200
-@@ -98,6 +98,7 @@
- #include "jpake.h"
+diff --git a/monitor.c b/monitor.c
+index aa70945..bdabe21 100644
+--- a/monitor.c
++++ b/monitor.c
+@@ -97,6 +97,7 @@
+ #include "ssh2.h"
#include "roaming.h"
#include "authfd.h"
+#include "audit.h"
#ifdef GSSAPI
static Gssctxt *gsscontext = NULL;
-@@ -114,6 +115,8 @@ extern Buffer auth_debug;
+@@ -113,6 +114,8 @@ extern Buffer auth_debug;
extern int auth_debug_init;
extern Buffer loginmsg;
@@ -1134,7 +1158,7 @@ diff -up openssh-6.3p1/monitor.c.audit openssh-6.3p1/monitor.c
/* State exported from the child */
struct {
-@@ -186,6 +189,11 @@ int mm_answer_gss_checkmic(int, Buffer *
+@@ -185,6 +188,11 @@ int mm_answer_gss_updatecreds(int, Buffer *);
#ifdef SSH_AUDIT_EVENTS
int mm_answer_audit_event(int, Buffer *);
int mm_answer_audit_command(int, Buffer *);
@@ -1146,7 +1170,7 @@ diff -up openssh-6.3p1/monitor.c.audit openssh-6.3p1/monitor.c
#endif
static int monitor_read_log(struct monitor *);
-@@ -237,6 +245,10 @@ struct mon_table mon_dispatch_proto20[]
+@@ -239,6 +247,10 @@ struct mon_table mon_dispatch_proto20[] = {
#endif
#ifdef SSH_AUDIT_EVENTS
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
@@ -1157,7 +1181,7 @@ diff -up openssh-6.3p1/monitor.c.audit openssh-6.3p1/monitor.c
#endif
#ifdef BSD_AUTH
{MONITOR_REQ_BSDAUTHQUERY, MON_ISAUTH, mm_answer_bsdauthquery},
-@@ -273,6 +285,11 @@ struct mon_table mon_dispatch_postauth20
+@@ -274,6 +286,11 @@ struct mon_table mon_dispatch_postauth20[] = {
#ifdef SSH_AUDIT_EVENTS
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
{MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT, mm_answer_audit_command},
@@ -1169,7 +1193,7 @@ diff -up openssh-6.3p1/monitor.c.audit openssh-6.3p1/monitor.c
#endif
{0, 0, NULL}
};
-@@ -304,6 +321,10 @@ struct mon_table mon_dispatch_proto15[]
+@@ -305,6 +322,10 @@ struct mon_table mon_dispatch_proto15[] = {
#endif
#ifdef SSH_AUDIT_EVENTS
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
@@ -1180,7 +1204,7 @@ diff -up openssh-6.3p1/monitor.c.audit openssh-6.3p1/monitor.c
#endif
{0, 0, NULL}
};
-@@ -315,6 +336,11 @@ struct mon_table mon_dispatch_postauth15
+@@ -316,6 +337,11 @@ struct mon_table mon_dispatch_postauth15[] = {
#ifdef SSH_AUDIT_EVENTS
{MONITOR_REQ_AUDIT_EVENT, MON_PERMIT, mm_answer_audit_event},
{MONITOR_REQ_AUDIT_COMMAND, MON_PERMIT|MON_ONCE, mm_answer_audit_command},
@@ -1192,7 +1216,7 @@ diff -up openssh-6.3p1/monitor.c.audit openssh-6.3p1/monitor.c
#endif
{0, 0, NULL}
};
-@@ -1365,9 +1391,11 @@ mm_answer_keyverify(int sock, Buffer *m)
+@@ -1390,9 +1416,11 @@ mm_answer_keyverify(int sock, Buffer *m)
Key *key;
u_char *signature, *data, *blob;
u_int signaturelen, datalen, bloblen;
@@ -1204,7 +1228,7 @@ diff -up openssh-6.3p1/monitor.c.audit openssh-6.3p1/monitor.c
blob = buffer_get_string(m, &bloblen);
signature = buffer_get_string(m, &signaturelen);
data = buffer_get_string(m, &datalen);
-@@ -1375,6 +1403,8 @@ mm_answer_keyverify(int sock, Buffer *m)
+@@ -1400,6 +1428,8 @@ mm_answer_keyverify(int sock, Buffer *m)
if (hostbased_cuser == NULL || hostbased_chost == NULL ||
!monitor_allowed_key(blob, bloblen))
fatal("%s: bad key, not previously allowed", __func__);
@@ -1213,7 +1237,7 @@ diff -up openssh-6.3p1/monitor.c.audit openssh-6.3p1/monitor.c
key = key_from_blob(blob, bloblen);
if (key == NULL)
-@@ -1395,7 +1425,17 @@ mm_answer_keyverify(int sock, Buffer *m)
+@@ -1420,7 +1450,17 @@ mm_answer_keyverify(int sock, Buffer *m)
if (!valid_data)
fatal("%s: bad signature data blob", __func__);
@@ -1232,7 +1256,7 @@ diff -up openssh-6.3p1/monitor.c.audit openssh-6.3p1/monitor.c
debug3("%s: key %p signature %s",
__func__, key, (verified == 1) ? "verified" : "unverified");
-@@ -1448,6 +1488,12 @@ mm_session_close(Session *s)
+@@ -1473,6 +1513,12 @@ mm_session_close(Session *s)
debug3("%s: tty %s ptyfd %d", __func__, s->tty, s->ptyfd);
session_pty_cleanup2(s);
}
@@ -1245,7 +1269,7 @@ diff -up openssh-6.3p1/monitor.c.audit openssh-6.3p1/monitor.c
session_unused(s->self);
}
-@@ -1728,6 +1774,8 @@ mm_answer_term(int sock, Buffer *req)
+@@ -1753,6 +1799,8 @@ mm_answer_term(int sock, Buffer *req)
sshpam_cleanup();
#endif
@@ -1254,7 +1278,7 @@ diff -up openssh-6.3p1/monitor.c.audit openssh-6.3p1/monitor.c
while (waitpid(pmonitor->m_pid, &status, 0) == -1)
if (errno != EINTR)
exit(1);
-@@ -1770,11 +1818,43 @@ mm_answer_audit_command(int socket, Buff
+@@ -1795,11 +1843,43 @@ mm_answer_audit_command(int socket, Buffer *m)
{
u_int len;
char *cmd;
@@ -1299,7 +1323,7 @@ diff -up openssh-6.3p1/monitor.c.audit openssh-6.3p1/monitor.c
free(cmd);
return (0);
}
-@@ -1910,11 +1990,13 @@ mm_get_keystate(struct monitor *pmonitor
+@@ -1943,11 +2023,13 @@ mm_get_keystate(struct monitor *pmonitor)
blob = buffer_get_string(&m, &bloblen);
current_keys[MODE_OUT] = mm_newkeys_from_blob(blob, bloblen);
@@ -1313,7 +1337,7 @@ diff -up openssh-6.3p1/monitor.c.audit openssh-6.3p1/monitor.c
free(blob);
/* Now get sequence numbers for the packets */
-@@ -1960,6 +2042,21 @@ mm_get_keystate(struct monitor *pmonitor
+@@ -1993,6 +2075,21 @@ mm_get_keystate(struct monitor *pmonitor)
}
buffer_free(&m);
@@ -1335,11 +1359,10 @@ diff -up openssh-6.3p1/monitor.c.audit openssh-6.3p1/monitor.c
}
-@@ -2361,3 +2458,86 @@ mm_answer_jpake_check_confirm(int sock,
- }
+@@ -2274,3 +2371,85 @@ mm_answer_gss_updatecreds(int socket, Buffer *m) {
+
+ #endif /* GSSAPI */
- #endif /* JPAKE */
-+
+#ifdef SSH_AUDIT_EVENTS
+int
+mm_answer_audit_unsupported_body(int sock, Buffer *m)
@@ -1422,10 +1445,11 @@ diff -up openssh-6.3p1/monitor.c.audit openssh-6.3p1/monitor.c
+ return 0;
+}
+#endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-6.3p1/monitor.h.audit openssh-6.3p1/monitor.h
---- openssh-6.3p1/monitor.h.audit 2012-12-02 23:53:21.000000000 +0100
-+++ openssh-6.3p1/monitor.h 2013-10-07 15:53:34.251717254 +0200
-@@ -68,7 +68,13 @@ enum monitor_reqtype {
+diff --git a/monitor.h b/monitor.h
+index ff79fbb..6dfb234 100644
+--- a/monitor.h
++++ b/monitor.h
+@@ -69,7 +69,13 @@ enum monitor_reqtype {
MONITOR_REQ_PAM_QUERY = 106, MONITOR_ANS_PAM_QUERY = 107,
MONITOR_REQ_PAM_RESPOND = 108, MONITOR_ANS_PAM_RESPOND = 109,
MONITOR_REQ_PAM_FREE_CTX = 110, MONITOR_ANS_PAM_FREE_CTX = 111,
@@ -1440,10 +1464,11 @@ diff -up openssh-6.3p1/monitor.h.audit openssh-6.3p1/monitor.h
};
-diff -up openssh-6.4p1/monitor_wrap.c.audit openssh-6.4p1/monitor_wrap.c
---- openssh-6.4p1/monitor_wrap.c.audit 2013-11-08 13:26:47.062595006 +0100
-+++ openssh-6.4p1/monitor_wrap.c 2013-11-08 13:26:47.089594877 +0100
-@@ -433,7 +433,7 @@ mm_key_allowed(enum mm_keytype type, cha
+diff --git a/monitor_wrap.c b/monitor_wrap.c
+index d1e1caa..6df236a 100644
+--- a/monitor_wrap.c
++++ b/monitor_wrap.c
+@@ -450,7 +450,7 @@ mm_key_allowed(enum mm_keytype type, char *user, char *host, Key *key)
*/
int
@@ -1452,7 +1477,7 @@ diff -up openssh-6.4p1/monitor_wrap.c.audit openssh-6.4p1/monitor_wrap.c
{
Buffer m;
u_char *blob;
-@@ -447,6 +447,7 @@ mm_key_verify(Key *key, u_char *sig, u_i
+@@ -464,6 +464,7 @@ mm_key_verify(Key *key, u_char *sig, u_int siglen, u_char *data, u_int datalen)
return (0);
buffer_init(&m);
@@ -1460,7 +1485,7 @@ diff -up openssh-6.4p1/monitor_wrap.c.audit openssh-6.4p1/monitor_wrap.c
buffer_put_string(&m, blob, len);
buffer_put_string(&m, sig, siglen);
buffer_put_string(&m, data, datalen);
-@@ -464,6 +465,19 @@ mm_key_verify(Key *key, u_char *sig, u_i
+@@ -481,6 +482,19 @@ mm_key_verify(Key *key, u_char *sig, u_int siglen, u_char *data, u_int datalen)
return (verified);
}
@@ -1480,7 +1505,7 @@ diff -up openssh-6.4p1/monitor_wrap.c.audit openssh-6.4p1/monitor_wrap.c
/* Export key state after authentication */
Newkeys *
mm_newkeys_from_blob(u_char *blob, int blen)
-@@ -642,12 +656,14 @@ mm_send_keystate(struct monitor *monitor
+@@ -659,12 +673,14 @@ mm_send_keystate(struct monitor *monitor)
fatal("%s: conversion of newkeys failed", __func__);
buffer_put_string(&m, blob, bloblen);
@@ -1495,7 +1520,7 @@ diff -up openssh-6.4p1/monitor_wrap.c.audit openssh-6.4p1/monitor_wrap.c
free(blob);
packet_get_state(MODE_OUT, &seqnr, &blocks, &packets, &bytes);
-@@ -1191,10 +1207,11 @@ mm_audit_event(ssh_audit_event_t event)
+@@ -1208,10 +1224,11 @@ mm_audit_event(ssh_audit_event_t event)
buffer_free(&m);
}
@@ -1508,7 +1533,7 @@ diff -up openssh-6.4p1/monitor_wrap.c.audit openssh-6.4p1/monitor_wrap.c
debug3("%s entering command %s", __func__, command);
-@@ -1202,6 +1219,26 @@ mm_audit_run_command(const char *command
+@@ -1219,6 +1236,26 @@ mm_audit_run_command(const char *command)
buffer_put_cstring(&m, command);
mm_request_send(pmonitor->m_recvfd, MONITOR_REQ_AUDIT_COMMAND, &m);
@@ -1535,11 +1560,10 @@ diff -up openssh-6.4p1/monitor_wrap.c.audit openssh-6.4p1/monitor_wrap.c
buffer_free(&m);
}
#endif /* SSH_AUDIT_EVENTS */
-@@ -1453,3 +1490,72 @@ mm_jpake_check_confirm(const BIGNUM *k,
- return success;
- }
- #endif /* JPAKE */
-+
+@@ -1354,3 +1391,71 @@ mm_ssh_gssapi_update_creds(ssh_gssapi_ccache *store)
+
+ #endif /* GSSAPI */
+
+#ifdef SSH_AUDIT_EVENTS
+void
+mm_audit_unsupported_body(int what)
@@ -1608,10 +1632,11 @@ diff -up openssh-6.4p1/monitor_wrap.c.audit openssh-6.4p1/monitor_wrap.c
+ buffer_free(&m);
+}
+#endif /* SSH_AUDIT_EVENTS */
-diff -up openssh-6.3p1/monitor_wrap.h.audit openssh-6.3p1/monitor_wrap.h
---- openssh-6.3p1/monitor_wrap.h.audit 2011-06-20 06:42:23.000000000 +0200
-+++ openssh-6.3p1/monitor_wrap.h 2013-10-07 15:53:34.252717250 +0200
-@@ -49,7 +49,8 @@ int mm_key_allowed(enum mm_keytype, char
+diff --git a/monitor_wrap.h b/monitor_wrap.h
+index 93929e0..4cf0c78 100644
+--- a/monitor_wrap.h
++++ b/monitor_wrap.h
+@@ -52,7 +52,8 @@ int mm_key_allowed(enum mm_keytype, char *, char *, Key *);
int mm_user_key_allowed(struct passwd *, Key *);
int mm_hostbased_key_allowed(struct passwd *, char *, char *, Key *);
int mm_auth_rhosts_rsa_key_allowed(struct passwd *, char *, char *, Key *);
@@ -1621,7 +1646,7 @@ diff -up openssh-6.3p1/monitor_wrap.h.audit openssh-6.3p1/monitor_wrap.h
int mm_auth_rsa_key_allowed(struct passwd *, BIGNUM *, Key **);
int mm_auth_rsa_verify_response(Key *, BIGNUM *, u_char *);
BIGNUM *mm_auth_rsa_generate_challenge(Key *);
-@@ -74,7 +75,12 @@ void mm_sshpam_free_ctx(void *);
+@@ -79,7 +80,12 @@ void mm_sshpam_free_ctx(void *);
#ifdef SSH_AUDIT_EVENTS
#include "audit.h"
void mm_audit_event(ssh_audit_event_t);
@@ -1635,9 +1660,10 @@ diff -up openssh-6.3p1/monitor_wrap.h.audit openssh-6.3p1/monitor_wrap.h
#endif
struct Session;
-diff -up openssh-6.3p1/packet.c.audit openssh-6.3p1/packet.c
---- openssh-6.3p1/packet.c.audit 2013-10-07 15:53:34.231717347 +0200
-+++ openssh-6.3p1/packet.c 2013-10-07 16:08:00.764639577 +0200
+diff --git a/packet.c b/packet.c
+index 660a9fc..f5b122b 100644
+--- a/packet.c
++++ b/packet.c
@@ -61,6 +61,7 @@
#include <time.h>
@@ -1695,7 +1721,7 @@ diff -up openssh-6.3p1/packet.c.audit openssh-6.3p1/packet.c
}
/* Sets remote side protocol flags. */
-@@ -735,6 +746,25 @@ packet_send1(void)
+@@ -736,6 +747,25 @@ packet_send1(void)
*/
}
@@ -1721,31 +1747,15 @@ diff -up openssh-6.3p1/packet.c.audit openssh-6.3p1/packet.c
void
set_newkeys(int mode)
{
-@@ -760,21 +790,9 @@ set_newkeys(int mode)
+@@ -761,6 +791,7 @@ set_newkeys(int mode)
}
if (active_state->newkeys[mode] != NULL) {
debug("set_newkeys: rekeying");
+ audit_session_key_free(mode);
cipher_cleanup(cc);
-- enc = &active_state->newkeys[mode]->enc;
-- mac = &active_state->newkeys[mode]->mac;
-- comp = &active_state->newkeys[mode]->comp;
-- mac_clear(mac);
-- memset(enc->iv, 0, enc->iv_len);
-- memset(enc->key, 0, enc->key_len);
-- memset(mac->key, 0, mac->key_len);
-- free(enc->name);
-- free(enc->iv);
-- free(enc->key);
-- free(mac->name);
-- free(mac->key);
-- free(comp->name);
-- free(active_state->newkeys[mode]);
-+ newkeys_destroy_and_free(active_state->newkeys[mode]);
- }
- active_state->newkeys[mode] = kex_get_newkeys(mode);
- if (active_state->newkeys[mode] == NULL)
-@@ -2003,6 +2021,47 @@ packet_get_newkeys(int mode)
+ enc = &active_state->newkeys[mode]->enc;
+ mac = &active_state->newkeys[mode]->mac;
+@@ -2011,6 +2042,47 @@ packet_get_newkeys(int mode)
return (void *)active_state->newkeys[mode];
}
@@ -1793,7 +1803,7 @@ diff -up openssh-6.3p1/packet.c.audit openssh-6.3p1/packet.c
/*
* Save the state for the real connection, and use a separate state when
* resuming a suspended connection.
-@@ -2010,18 +2069,12 @@ packet_get_newkeys(int mode)
+@@ -2018,18 +2090,12 @@ packet_get_newkeys(int mode)
void
packet_backup_state(void)
{
@@ -1813,7 +1823,7 @@ diff -up openssh-6.3p1/packet.c.audit openssh-6.3p1/packet.c
}
/*
-@@ -2038,9 +2091,7 @@ packet_restore_state(void)
+@@ -2046,9 +2112,7 @@ packet_restore_state(void)
backup_state = active_state;
active_state = tmp;
active_state->connection_in = backup_state->connection_in;
@@ -1823,7 +1833,7 @@ diff -up openssh-6.3p1/packet.c.audit openssh-6.3p1/packet.c
len = buffer_len(&backup_state->input);
if (len > 0) {
buf = buffer_ptr(&backup_state->input);
-@@ -2048,4 +2099,10 @@ packet_restore_state(void)
+@@ -2056,4 +2120,10 @@ packet_restore_state(void)
buffer_clear(&backup_state->input);
add_recv_bytes(len);
}
@@ -1834,18 +1844,20 @@ diff -up openssh-6.3p1/packet.c.audit openssh-6.3p1/packet.c
+ backup_state = NULL;
}
+
-diff -up openssh-6.3p1/packet.h.audit openssh-6.3p1/packet.h
---- openssh-6.3p1/packet.h.audit 2013-07-18 08:12:45.000000000 +0200
-+++ openssh-6.3p1/packet.h 2013-10-07 15:53:34.252717250 +0200
+diff --git a/packet.h b/packet.h
+index f8edf85..c36c812 100644
+--- a/packet.h
++++ b/packet.h
@@ -124,4 +124,5 @@ void packet_restore_state(void);
void *packet_get_input(void);
void *packet_get_output(void);
+void packet_destroy_all(int, int);
#endif /* PACKET_H */
-diff -up openssh-6.3p1/session.c.audit openssh-6.3p1/session.c
---- openssh-6.3p1/session.c.audit 2013-07-20 05:21:53.000000000 +0200
-+++ openssh-6.3p1/session.c 2013-10-07 16:03:43.975861636 +0200
+diff --git a/session.c b/session.c
+index ba4589b..4a297f1 100644
+--- a/session.c
++++ b/session.c
@@ -137,7 +137,7 @@ extern int log_stderr;
extern int debug_flag;
extern u_int utmp_len;
@@ -1855,7 +1867,7 @@ diff -up openssh-6.3p1/session.c.audit openssh-6.3p1/session.c
extern Buffer loginmsg;
/* original command from peer. */
-@@ -745,6 +745,14 @@ do_exec_pty(Session *s, const char *comm
+@@ -745,6 +745,14 @@ do_exec_pty(Session *s, const char *command)
/* Parent. Close the slave side of the pseudo tty. */
close(ttyfd);
@@ -1870,8 +1882,8 @@ diff -up openssh-6.3p1/session.c.audit openssh-6.3p1/session.c
/* Enter interactive session. */
s->ptymaster = ptymaster;
packet_set_interactive(1,
-@@ -816,15 +824,19 @@ do_exec(Session *s, const char *command)
- }
+@@ -862,15 +870,19 @@ do_exec(Session *s, const char *command)
+ get_remote_port());
#ifdef SSH_AUDIT_EVENTS
+ if (s->command != NULL || s->command_handle != -1)
@@ -1892,7 +1904,7 @@ diff -up openssh-6.3p1/session.c.audit openssh-6.3p1/session.c
#endif
if (s->ttyfd != -1)
ret = do_exec_pty(s, command);
-@@ -1642,7 +1654,10 @@ do_child(Session *s, const char *command
+@@ -1707,7 +1719,10 @@ do_child(Session *s, const char *command)
int r = 0;
/* remove hostkey from the child's memory */
@@ -1904,7 +1916,7 @@ diff -up openssh-6.3p1/session.c.audit openssh-6.3p1/session.c
/* Force a password change */
if (s->authctxt->force_pwchange) {
-@@ -1869,6 +1884,7 @@ session_unused(int id)
+@@ -1931,6 +1946,7 @@ session_unused(int id)
sessions[id].ttyfd = -1;
sessions[id].ptymaster = -1;
sessions[id].x11_chanids = NULL;
@@ -1912,7 +1924,7 @@ diff -up openssh-6.3p1/session.c.audit openssh-6.3p1/session.c
sessions[id].next_unused = sessions_first_unused;
sessions_first_unused = id;
}
-@@ -1951,6 +1967,19 @@ session_open(Authctxt *authctxt, int cha
+@@ -2013,6 +2029,19 @@ session_open(Authctxt *authctxt, int chanid)
}
Session *
@@ -1932,7 +1944,7 @@ diff -up openssh-6.3p1/session.c.audit openssh-6.3p1/session.c
session_by_tty(char *tty)
{
int i;
-@@ -2467,6 +2496,30 @@ session_exit_message(Session *s, int sta
+@@ -2529,6 +2558,30 @@ session_exit_message(Session *s, int status)
chan_write_failed(c);
}
@@ -1963,7 +1975,7 @@ diff -up openssh-6.3p1/session.c.audit openssh-6.3p1/session.c
void
session_close(Session *s)
{
-@@ -2475,6 +2528,10 @@ session_close(Session *s)
+@@ -2537,6 +2590,10 @@ session_close(Session *s)
debug("session_close: session %d pid %ld", s->self, (long)s->pid);
if (s->ttyfd != -1)
session_pty_cleanup(s);
@@ -1974,7 +1986,7 @@ diff -up openssh-6.3p1/session.c.audit openssh-6.3p1/session.c
free(s->term);
free(s->display);
free(s->x11_chanids);
-@@ -2688,6 +2745,15 @@ do_authenticated2(Authctxt *authctxt)
+@@ -2751,6 +2808,15 @@ do_authenticated2(Authctxt *authctxt)
server_loop2(authctxt);
}
@@ -1990,17 +2002,18 @@ diff -up openssh-6.3p1/session.c.audit openssh-6.3p1/session.c
void
do_cleanup(Authctxt *authctxt)
{
-@@ -2736,5 +2802,5 @@ do_cleanup(Authctxt *authctxt)
+@@ -2799,5 +2865,5 @@ do_cleanup(Authctxt *authctxt)
* or if running in monitor.
*/
if (!use_privsep || mm_is_monitor())
- session_destroy_all(session_pty_cleanup2);
+ session_destroy_all(do_cleanup_one_session);
}
-diff -up openssh-6.3p1/session.h.audit openssh-6.3p1/session.h
---- openssh-6.3p1/session.h.audit 2008-05-19 07:34:50.000000000 +0200
-+++ openssh-6.3p1/session.h 2013-10-07 15:53:34.253717245 +0200
-@@ -60,6 +60,12 @@ struct Session {
+diff --git a/session.h b/session.h
+index 6a2f35e..e9b312e 100644
+--- a/session.h
++++ b/session.h
+@@ -61,6 +61,12 @@ struct Session {
char *name;
char *val;
} *env;
@@ -2013,7 +2026,7 @@ diff -up openssh-6.3p1/session.h.audit openssh-6.3p1/session.h
};
void do_authenticated(Authctxt *);
-@@ -72,8 +78,10 @@ void session_close_by_pid(pid_t, int);
+@@ -73,8 +79,10 @@ void session_close_by_pid(pid_t, int);
void session_close_by_channel(int, void *);
void session_destroy_all(void (*)(Session *));
void session_pty_cleanup2(Session *);
@@ -2024,9 +2037,10 @@ diff -up openssh-6.3p1/session.h.audit openssh-6.3p1/session.h
Session *session_by_tty(char *);
void session_close(Session *);
void do_setusercontext(struct passwd *);
-diff -up openssh-6.3p1/sshd.c.audit openssh-6.3p1/sshd.c
---- openssh-6.3p1/sshd.c.audit 2013-10-07 15:53:34.221717393 +0200
-+++ openssh-6.3p1/sshd.c 2013-10-07 15:53:34.254717240 +0200
+diff --git a/sshd.c b/sshd.c
+index 512c7ed..be1171b 100644
+--- a/sshd.c
++++ b/sshd.c
@@ -119,6 +119,7 @@
#endif
#include "monitor_wrap.h"
@@ -2035,7 +2049,7 @@ diff -up openssh-6.3p1/sshd.c.audit openssh-6.3p1/sshd.c
#include "ssh-sandbox.h"
#include "version.h"
-@@ -260,7 +261,7 @@ Buffer loginmsg;
+@@ -264,7 +265,7 @@ Buffer loginmsg;
struct passwd *privsep_pw = NULL;
/* Prototypes for various functions defined later in this file. */
@@ -2044,7 +2058,7 @@ diff -up openssh-6.3p1/sshd.c.audit openssh-6.3p1/sshd.c
void demote_sensitive_data(void);
static void do_ssh1_kex(void);
-@@ -279,6 +280,15 @@ close_listen_socks(void)
+@@ -283,6 +284,15 @@ close_listen_socks(void)
num_listen_socks = -1;
}
@@ -2060,7 +2074,7 @@ diff -up openssh-6.3p1/sshd.c.audit openssh-6.3p1/sshd.c
static void
close_startup_pipes(void)
{
-@@ -550,22 +560,47 @@ sshd_exchange_identification(int sock_in
+@@ -562,22 +572,47 @@ sshd_exchange_identification(int sock_in, int sock_out)
}
}
@@ -2111,7 +2125,7 @@ diff -up openssh-6.3p1/sshd.c.audit openssh-6.3p1/sshd.c
key_free(sensitive_data.host_certificates[i]);
sensitive_data.host_certificates[i] = NULL;
}
-@@ -579,6 +614,8 @@ void
+@@ -591,6 +626,8 @@ void
demote_sensitive_data(void)
{
Key *tmp;
@@ -2120,7 +2134,7 @@ diff -up openssh-6.3p1/sshd.c.audit openssh-6.3p1/sshd.c
int i;
if (sensitive_data.server_key) {
-@@ -587,13 +624,27 @@ demote_sensitive_data(void)
+@@ -599,13 +636,27 @@ demote_sensitive_data(void)
sensitive_data.server_key = tmp;
}
@@ -2148,16 +2162,16 @@ diff -up openssh-6.3p1/sshd.c.audit openssh-6.3p1/sshd.c
}
/* Certs do not need demotion */
}
-@@ -652,7 +703,7 @@ privsep_preauth(Authctxt *authctxt)
+@@ -675,7 +726,7 @@ privsep_preauth(Authctxt *authctxt)
if (use_privsep == PRIVSEP_ON)
- box = ssh_sandbox_init();
+ box = ssh_sandbox_init(pmonitor);
- pid = fork();
+ pmonitor->m_pid = pid = fork();
if (pid == -1) {
fatal("fork of unprivileged child failed");
} else if (pid != 0) {
-@@ -708,6 +759,8 @@ privsep_preauth(Authctxt *authctxt)
+@@ -729,6 +780,8 @@ privsep_preauth(Authctxt *authctxt)
}
}
@@ -2166,7 +2180,7 @@ diff -up openssh-6.3p1/sshd.c.audit openssh-6.3p1/sshd.c
static void
privsep_postauth(Authctxt *authctxt)
{
-@@ -732,6 +785,10 @@ privsep_postauth(Authctxt *authctxt)
+@@ -753,6 +806,10 @@ privsep_postauth(Authctxt *authctxt)
else if (pmonitor->m_pid != 0) {
verbose("User child is on pid %ld", (long)pmonitor->m_pid);
buffer_clear(&loginmsg);
@@ -2177,7 +2191,7 @@ diff -up openssh-6.3p1/sshd.c.audit openssh-6.3p1/sshd.c
monitor_child_postauth(pmonitor);
/* NEVERREACHED */
-@@ -1178,6 +1235,7 @@ server_accept_loop(int *sock_in, int *so
+@@ -1211,6 +1268,7 @@ server_accept_loop(int *sock_in, int *sock_out, int *newsock, int *config_s)
if (received_sigterm) {
logit("Received signal %d; terminating.",
(int) received_sigterm);
@@ -2185,7 +2199,7 @@ diff -up openssh-6.3p1/sshd.c.audit openssh-6.3p1/sshd.c
close_listen_socks();
unlink(options.pid_file);
exit(received_sigterm == SIGTERM ? 0 : 255);
-@@ -2093,6 +2151,7 @@ main(int ac, char **av)
+@@ -2134,6 +2192,7 @@ main(int ac, char **av)
*/
if (use_privsep) {
mm_send_keystate(pmonitor);
@@ -2193,7 +2207,7 @@ diff -up openssh-6.3p1/sshd.c.audit openssh-6.3p1/sshd.c
exit(0);
}
-@@ -2135,7 +2194,7 @@ main(int ac, char **av)
+@@ -2179,7 +2238,7 @@ main(int ac, char **av)
privsep_postauth(authctxt);
/* the monitor process [priv] will not return */
if (!compat20)
@@ -2202,7 +2216,7 @@ diff -up openssh-6.3p1/sshd.c.audit openssh-6.3p1/sshd.c
}
packet_set_timeout(options.client_alive_interval,
-@@ -2145,6 +2204,9 @@ main(int ac, char **av)
+@@ -2189,6 +2248,9 @@ main(int ac, char **av)
do_authenticated(authctxt);
/* The connection has been terminated. */
@@ -2212,7 +2226,7 @@ diff -up openssh-6.3p1/sshd.c.audit openssh-6.3p1/sshd.c
packet_get_state(MODE_IN, NULL, NULL, NULL, &ibytes);
packet_get_state(MODE_OUT, NULL, NULL, NULL, &obytes);
verbose("Transferred: sent %llu, received %llu bytes",
-@@ -2302,6 +2364,10 @@ do_ssh1_kex(void)
+@@ -2346,6 +2408,10 @@ do_ssh1_kex(void)
if (cookie[i] != packet_get_char())
packet_disconnect("IP Spoofing check bytes do not match.");
@@ -2223,7 +2237,7 @@ diff -up openssh-6.3p1/sshd.c.audit openssh-6.3p1/sshd.c
debug("Encryption type: %.200s", cipher_name(cipher_type));
/* Get the encrypted integer. */
-@@ -2368,7 +2434,7 @@ do_ssh1_kex(void)
+@@ -2418,7 +2484,7 @@ do_ssh1_kex(void)
session_id[i] = session_key[i] ^ session_key[i + 16];
}
/* Destroy the private and public keys. No longer. */
@@ -2232,7 +2246,7 @@ diff -up openssh-6.3p1/sshd.c.audit openssh-6.3p1/sshd.c
if (use_privsep)
mm_ssh1_session_id(session_id);
-@@ -2480,6 +2546,16 @@ do_ssh2_kex(void)
+@@ -2584,6 +2650,16 @@ do_ssh2_kex(void)
void
cleanup_exit(int i)
{
@@ -2249,7 +2263,7 @@ diff -up openssh-6.3p1/sshd.c.audit openssh-6.3p1/sshd.c
if (the_authctxt) {
do_cleanup(the_authctxt);
if (use_privsep && privsep_is_preauth && pmonitor->m_pid > 1) {
-@@ -2490,9 +2566,14 @@ cleanup_exit(int i)
+@@ -2594,9 +2670,14 @@ cleanup_exit(int i)
pmonitor->m_pid, strerror(errno));
}
}
diff --git a/openssh.spec b/openssh.spec
index 87cdd6d..cb5f1c5 100644
--- a/openssh.spec
+++ b/openssh.spec
@@ -103,7 +103,7 @@ Patch102: openssh-5.8p1-getaddrinfo.patch
Patch103: openssh-5.8p1-packet.patch
#https://bugzilla.mindrot.org/show_bug.cgi?id=1402
-Patch200: openssh-6.4p1-audit.patch
+Patch200: openssh-6.6p1-audit.patch
# --- pam_ssh-agent ---
# make it build reusing the openssh sources
@@ -342,8 +342,6 @@ The module is most useful for su and sudo service stacks.
# investigate %patch102 -p1 -b .getaddrinfo
%patch103 -p1 -b .packet
-# rework %patch200 -p1 -b .audit
-
%if %{pam_ssh_agent}
pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver}
%patch300 -p1 -b .psaa-build
@@ -403,6 +401,8 @@ popd
%patch908 -p1 -b .CVE-2014-2653
%patch909 -p1 -b .6.6.1
+%patch200 -p1 -b .audit
+
%if 0
# Nothing here yet
%endif
More information about the scm-commits
mailing list