Date: Mon, 16 Jan 2017 19:30:31 +0000 (UTC) From: Bryan Drewery <bdrewery@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r431698 - in head/security/openssh-portable: . files Message-ID: <201701161930.v0GJUVfv013991@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: bdrewery Date: Mon Jan 16 19:30:31 2017 New Revision: 431698 URL: https://svnweb.freebsd.org/changeset/ports/431698 Log: Update to 7.4p1. - Update X509 patch to 9.3 - SCTP patch from soralx@cydem.org Changes: https://www.openssh.com/txt/release-7.4 Added: head/security/openssh-portable/files/extra-patch-x509-glue (contents, props changed) head/security/openssh-portable/files/patch-misc.c (contents, props changed) Deleted: head/security/openssh-portable/files/patch-kex.c head/security/openssh-portable/files/patch-serverloop.c Modified: head/security/openssh-portable/Makefile head/security/openssh-portable/distinfo head/security/openssh-portable/files/extra-patch-hpn head/security/openssh-portable/files/extra-patch-ldns head/security/openssh-portable/files/extra-patch-sctp head/security/openssh-portable/files/extra-patch-tcpwrappers head/security/openssh-portable/files/patch-readconf.c head/security/openssh-portable/files/patch-session.c head/security/openssh-portable/files/patch-ssh-agent.1 head/security/openssh-portable/files/patch-ssh-agent.c head/security/openssh-portable/files/patch-ssh_config.5 head/security/openssh-portable/files/patch-sshd_config.5 Modified: head/security/openssh-portable/Makefile ============================================================================== --- head/security/openssh-portable/Makefile Mon Jan 16 19:25:01 2017 (r431697) +++ head/security/openssh-portable/Makefile Mon Jan 16 19:30:31 2017 (r431698) @@ -2,8 +2,8 @@ # $FreeBSD$ PORTNAME= openssh -DISTVERSION= 7.3p1 -PORTREVISION= 5 +DISTVERSION= 7.4p1 +PORTREVISION= 0 PORTEPOCH= 1 CATEGORIES= security ipv6 MASTER_SITES= OPENBSD/OpenSSH/portable @@ -60,15 +60,15 @@ HPN_CONFIGURE_WITH= hpn NONECIPHER_CONFIGURE_WITH= nonecipher # See http://www.roumenpetrov.info/openssh/ -X509_VERSION= 9.0 +X509_VERSION= 9.3 X509_PATCH_SITES= http://www.roumenpetrov.info/openssh/x509-${X509_VERSION}/:x509 -X509_PATCHFILES= ${PORTNAME}-7.3p1+x509-${X509_VERSION}.diff.gz:-p1:x509 +X509_EXTRA_PATCHES+= ${FILESDIR}/extra-patch-x509-glue +X509_PATCHFILES= ${PORTNAME}-7.4p1+x509-${X509_VERSION}.diff.gz:-p1:x509 # See https://bugzilla.mindrot.org/show_bug.cgi?id=2016 # and https://bugzilla.mindrot.org/show_bug.cgi?id=1604 #SCTP_PATCHFILES= ${PORTNAME}-7.2_p1-sctp.patch.gz:-p1 SCTP_CONFIGURE_WITH= sctp -#SCTP_BROKEN= does not apply to 7.3+ SCTP_EXTRA_PATCHES+= ${FILESDIR}/extra-patch-sctp:-p1 MIT_LIB_DEPENDS= libkrb5.so.3:security/krb5 @@ -94,8 +94,8 @@ EXTRA_PATCHES:= ${EXTRA_PATCHES:N${TCP_ # Must add this patch before HPN due to conflicts .if ${PORT_OPTIONS:MKERB_GSSAPI} -# 7.3 patch taken from -# http://sources.debian.net/data/main/o/openssh/1:7.1p2-2/debian/patches/gssapi.patch +# Patch from: +# http://sources.debian.net/data/main/o/openssh/1:7.4p1-5/debian/patches/gssapi.patch # which was originally based on 5.7 patch from # http://www.sxw.org.uk/computing/patches/ # It is mirrored simply to apply gzip -9. @@ -103,7 +103,7 @@ EXTRA_PATCHES:= ${EXTRA_PATCHES:N${TCP_ # Needed glue for applying HPN patch without conflict EXTRA_PATCHES+= ${FILESDIR}/extra-patch-hpn-gss-glue . endif -PATCHFILES+= openssh-7.3p1-gsskex-all-20141021-debian-rh-20160808.patch.gz:-p1:gsskex +PATCHFILES+= openssh-7.4p1-gsskex-all-20141021-debian-rh-20161228.patch.gz:-p1:gsskex .endif # http://www.psc.edu/index.php/hpn-ssh https://github.com/rapier1/hpn-ssh https://github.com/rapier1/openssh-portable Modified: head/security/openssh-portable/distinfo ============================================================================== --- head/security/openssh-portable/distinfo Mon Jan 16 19:25:01 2017 (r431697) +++ head/security/openssh-portable/distinfo Mon Jan 16 19:30:31 2017 (r431698) @@ -1,9 +1,9 @@ -TIMESTAMP = 1470675521 -SHA256 (openssh-7.3p1.tar.gz) = 3ffb989a6dcaa69594c3b550d4855a5a2e1718ccdde7f5e36387b424220fbecc -SIZE (openssh-7.3p1.tar.gz) = 1522617 +TIMESTAMP = 1484161900 +SHA256 (openssh-7.4p1.tar.gz) = 1b1fc4a14e2024293181924ed24872e6f2e06293f3e8926a376b8aec481f19d1 +SIZE (openssh-7.4p1.tar.gz) = 1511780 SHA256 (openssh-7.2_p1-sctp.patch.gz) = fb67e3e23f39fabf44ef198e3e19527417c75c9352747547448512032365dbfc SIZE (openssh-7.2_p1-sctp.patch.gz) = 8501 -SHA256 (openssh-7.3p1+x509-9.0.diff.gz) = ed468fe2e6220065b2bf3e2ed9eb0c7c8183f32f50fa50d64505d5feaef2d900 -SIZE (openssh-7.3p1+x509-9.0.diff.gz) = 571918 -SHA256 (openssh-7.3p1-gsskex-all-20141021-debian-rh-20160808.patch.gz) = 83698da23a7d4dd24be9bc15ea7e801890dfc9303815135552c8ddfd158f1a95 -SIZE (openssh-7.3p1-gsskex-all-20141021-debian-rh-20160808.patch.gz) = 26818 +SHA256 (openssh-7.4p1+x509-9.3.diff.gz) = 1d3fd23b3d02a3baad50890bf5498ef01af6dab6375da0aeb00a0d59fd3ac9ee +SIZE (openssh-7.4p1+x509-9.3.diff.gz) = 446572 +SHA256 (openssh-7.4p1-gsskex-all-20141021-debian-rh-20161228.patch.gz) = f77ac434e6914814bc2f16d1581efd74baedaa86f1249a3cee00566d458c5f6b +SIZE (openssh-7.4p1-gsskex-all-20141021-debian-rh-20161228.patch.gz) = 27091 Modified: head/security/openssh-portable/files/extra-patch-hpn ============================================================================== --- head/security/openssh-portable/files/extra-patch-hpn Mon Jan 16 19:25:01 2017 (r431697) +++ head/security/openssh-portable/files/extra-patch-hpn Mon Jan 16 19:30:31 2017 (r431698) @@ -695,7 +695,7 @@ diff -urN -x configure -x config.guess - #define atime tv[0] --- work/openssh/servconf.c.orig 2015-05-29 03:27:21.000000000 -0500 +++ work/openssh/servconf.c 2015-06-02 09:56:36.041601000 -0500 -@@ -163,6 +163,14 @@ initialize_server_options(ServerOptions +@@ -159,6 +159,14 @@ initialize_server_options(ServerOptions options->authorized_principals_file = NULL; options->authorized_principals_command = NULL; options->authorized_principals_command_user = NULL; @@ -710,7 +710,7 @@ diff -urN -x configure -x config.guess - options->ip_qos_interactive = -1; options->ip_qos_bulk = -1; options->version_addendum = NULL; -@@ -329,6 +337,57 @@ fill_default_server_options(ServerOption +@@ -319,6 +327,57 @@ fill_default_server_options(ServerOption } if (options->permit_tun == -1) options->permit_tun = SSH_TUNMODE_NO; @@ -768,7 +768,7 @@ diff -urN -x configure -x config.guess - if (options->ip_qos_interactive == -1) options->ip_qos_interactive = IPTOS_LOWDELAY; if (options->ip_qos_bulk == -1) -@@ -406,6 +465,12 @@ typedef enum { +@@ -412,6 +471,12 @@ typedef enum { sUsePrivilegeSeparation, sAllowAgentForwarding, sHostCertificate, sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile, @@ -781,7 +781,7 @@ diff -urN -x configure -x config.guess - sAuthorizedPrincipalsCommand, sAuthorizedPrincipalsCommandUser, sKexAlgorithms, sIPQoS, sVersionAddendum, sAuthorizedKeysCommand, sAuthorizedKeysCommandUser, -@@ -537,6 +602,14 @@ static struct { +@@ -548,6 +613,14 @@ static struct { { "revokedkeys", sRevokedKeys, SSHCFG_ALL }, { "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL }, { "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL }, @@ -796,7 +796,7 @@ diff -urN -x configure -x config.guess - { "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL }, { "ipqos", sIPQoS, SSHCFG_ALL }, { "authorizedkeyscommand", sAuthorizedKeysCommand, SSHCFG_ALL }, -@@ -1156,6 +1229,25 @@ process_server_config_line(ServerOptions +@@ -1153,6 +1226,25 @@ process_server_config_line(ServerOptions intptr = &options->ignore_user_known_hosts; goto parse_flag; @@ -819,8 +819,8 @@ diff -urN -x configure -x config.guess - + goto parse_int; +#endif + - case sRhostsRSAAuthentication: - intptr = &options->rhosts_rsa_authentication; + case sHostbasedAuthentication: + intptr = &options->hostbased_authentication; goto parse_flag; --- work.clean/openssh-6.8p1/servconf.h 2015-03-17 00:49:20.000000000 -0500 +++ work/openssh-6.8p1/servconf.h 2015-04-03 13:48:37.316827000 -0500 @@ -842,7 +842,7 @@ diff -urN -x configure -x config.guess - int num_permitted_opens; --- work.clean/openssh-6.8p1/serverloop.c 2015-03-17 00:49:20.000000000 -0500 +++ work/openssh-6.8p1/serverloop.c 2015-04-03 17:14:15.182548000 -0500 -@@ -1051,6 +1051,12 @@ +@@ -526,6 +526,12 @@ server_request_tun(void) sock = tun_open(tun, mode); if (sock < 0) goto done; @@ -855,7 +855,7 @@ diff -urN -x configure -x config.guess - c = channel_new("tun", SSH_CHANNEL_OPEN, sock, sock, -1, CHAN_TCP_WINDOW_DEFAULT, CHAN_TCP_PACKET_DEFAULT, 0, "tun", 1); c->datagram = 1; -@@ -1088,6 +1094,10 @@ +@@ -563,6 +569,10 @@ server_request_session(void) c = channel_new("session", SSH_CHANNEL_LARVAL, -1, -1, -1, /*window size*/0, CHAN_SES_PACKET_DEFAULT, 0, "server-session", 1); @@ -1101,7 +1101,7 @@ diff -urN -x configure -x config.guess - strlen(client_version_string)) != strlen(client_version_string)) --- work.clean/openssh-7.2p1/sshconnect2.c.orig 2016-02-25 19:40:04.000000000 -0800 +++ work.clean/openssh-7.2p1/sshconnect2.c 2016-02-29 08:06:31.134954000 -0800 -@@ -80,6 +80,14 @@ +@@ -81,6 +81,14 @@ extern char *client_version_string; extern char *server_version_string; extern Options options; @@ -1116,7 +1116,7 @@ diff -urN -x configure -x config.guess - /* * SSH2 key exchange -@@ -153,14 +161,17 @@ order_hostkeyalgs(char *host, struct soc +@@ -154,14 +162,17 @@ order_hostkeyalgs(char *host, struct soc return ret; } @@ -1145,10 +1145,10 @@ diff -urN -x configure -x config.guess - } /* -@@ -404,6 +418,29 @@ ssh_userauth2(const char *local_user, co - pubkey_cleanup(&authctxt); - ssh_dispatch_range(ssh, SSH2_MSG_USERAUTH_MIN, SSH2_MSG_USERAUTH_MAX, NULL); +@@ -407,6 +421,29 @@ ssh_userauth2(const char *local_user, co + if (!authctxt.success) + fatal("Authentication failed."); +#ifdef NONE_CIPHER_ENABLED + /* + * if the user wants to use the none cipher do it @@ -1177,13 +1177,13 @@ diff -urN -x configure -x config.guess - --- work.clean/openssh-7.1p1/sshd.c.orig 2015-08-20 21:49:03.000000000 -0700 +++ work.clean/openssh-7.1p1/sshd.c 2015-11-11 12:45:48.202186000 -0800 -@@ -431,8 +431,13 @@ sshd_exchange_identification(int sock_in - minor = PROTOCOL_MINOR_1; - } +@@ -373,8 +373,13 @@ sshd_exchange_identification(struct ssh + char buf[256]; /* Must not be larger than remote_version. */ + char remote_version[256]; /* Must be at least as big as buf. */ - xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s", + xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s%s", - major, minor, SSH_VERSION, + PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION, +#ifdef HPN_ENABLED + options.hpn_disabled ? "" : SSH_HPN, +#else @@ -1192,7 +1192,7 @@ diff -urN -x configure -x config.guess - *options.version_addendum == '\0' ? "" : " ", options.version_addendum, newline); -@@ -1155,6 +1160,10 @@ server_listen(void) +@@ -1027,6 +1032,10 @@ server_listen(void) int ret, listen_sock, on = 1; struct addrinfo *ai; char ntop[NI_MAXHOST], strport[NI_MAXSERV]; @@ -1203,7 +1203,7 @@ diff -urN -x configure -x config.guess - for (ai = options.listen_addrs; ai; ai = ai->ai_next) { if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6) -@@ -1195,6 +1204,13 @@ server_listen(void) +@@ -1067,6 +1076,13 @@ server_listen(void) debug("Bind to port %s on %s.", strport, ntop); @@ -1217,7 +1217,7 @@ diff -urN -x configure -x config.guess - /* Bind the socket to the desired port. */ if (bind(listen_sock, ai->ai_addr, ai->ai_addrlen) < 0) { error("Bind to port %s on %s failed: %.200s.", -@@ -1693,6 +1709,15 @@ main(int ac, char **av) +@@ -1591,6 +1607,15 @@ main(int ac, char **av) /* Fill in default values for those options not explicitly set. */ fill_default_server_options(&options); @@ -1233,9 +1233,9 @@ diff -urN -x configure -x config.guess - /* challenge-response is implemented via keyboard interactive */ if (options.challenge_response_authentication) options.kbd_interactive_authentication = 1; -@@ -2123,6 +2148,11 @@ main(int ac, char **av) - cleanup_exit(255); +@@ -2085,6 +2110,11 @@ main(int ac, char **av) } + #endif +#ifdef HPN_ENABLED + /* set the HPN options for the child */ @@ -1243,9 +1243,9 @@ diff -urN -x configure -x config.guess - +#endif + /* - * We use get_canonical_hostname with usedns = 0 instead of - * get_remote_ipaddr here so IP options will be checked. -@@ -2539,6 +2569,11 @@ do_ssh2_kex(void) + * In privilege separation, we fork another child and prepare + * file descriptor passing. +@@ -2163,6 +2193,11 @@ do_ssh2_kex(void) struct kex *kex; int r; @@ -1259,7 +1259,7 @@ diff -urN -x configure -x config.guess - myproposal[PROPOSAL_ENC_ALGS_CTOS] = compat_cipher_proposal( --- work.clean/openssh-6.8p1/sshd_config 2015-04-01 22:07:18.248858000 -0500 +++ work/openssh-6.8p1/sshd_config 2015-04-01 22:16:49.932279000 -0500 -@@ -127,6 +127,20 @@ +@@ -111,6 +111,20 @@ AuthorizedKeysFile .ssh/authorized_keys # override default of no subsystems Subsystem sftp /usr/libexec/sftp-server Modified: head/security/openssh-portable/files/extra-patch-ldns ============================================================================== --- head/security/openssh-portable/files/extra-patch-ldns Mon Jan 16 19:25:01 2017 (r431697) +++ head/security/openssh-portable/files/extra-patch-ldns Mon Jan 16 19:30:31 2017 (r431698) @@ -35,17 +35,17 @@ be verified, OpenSSH will print a messag +# VerifyHostKeyDNS yes # ProxyCommand ssh -q -W %h:%p gateway.example.com # RekeyLimit 1G 1h ---- ssh_config.5.orig 2016-02-25 19:40:04.000000000 -0800 -+++ ssh_config.5 2016-02-29 07:57:41.763889000 -0800 -@@ -1715,7 +1715,10 @@ - or - .Dq ask . +--- ssh_config.5.orig 2016-12-18 20:59:41.000000000 -0800 ++++ ssh_config.5 2017-01-11 11:24:25.573200000 -0800 +@@ -1635,7 +1635,10 @@ need to confirm new host keys according + .Cm StrictHostKeyChecking + option. The default is --.Dq no . -+.Dq yes +-.Cm no . ++.Cm yes +if compiled with LDNS and -+.Dq no ++.Cm no +otherwise. .Pp - See also VERIFYING HOST KEYS in - .Xr ssh 1 . + See also + .Sx VERIFYING HOST KEYS Modified: head/security/openssh-portable/files/extra-patch-sctp ============================================================================== --- head/security/openssh-portable/files/extra-patch-sctp Mon Jan 16 19:25:01 2017 (r431697) +++ head/security/openssh-portable/files/extra-patch-sctp Mon Jan 16 19:30:31 2017 (r431698) @@ -278,9 +278,9 @@ index b19d30e..14b0a0f 100644 options->macs = NULL; options->kex_algorithms = NULL; + options->transport = -1; - options->protocol = SSH_PROTO_UNKNOWN; options->fwd_opts.gateway_ports = -1; options->fwd_opts.streamlocal_bind_mask = (mode_t)-1; + options->fwd_opts.streamlocal_bind_unlink = -1; @@ -315,6 +316,8 @@ fill_default_server_options(ServerOptions *options) options->allow_streamlocal_forwarding = FORWARD_ALLOW; if (options->allow_agent_forwarding == -1) @@ -438,9 +438,9 @@ index b19d30e..14b0a0f 100644 + filename, linenum); + break; + - case sProtocol: - intptr = &options->protocol; - arg = strdelim(&cp); + case sSubsystem: + if (options->num_subsystems >= MAX_SUBSYSTEMS) { + fatal("%s line %d: too many subsystems defined.", @@ -1992,6 +2111,7 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth) M_CP_INTOPT(allow_streamlocal_forwarding); M_CP_INTOPT(allow_agent_forwarding); @@ -482,9 +482,9 @@ index f4137af..63a0637 100644 char *macs; /* Supported SSH2 macs. */ char *kex_algorithms; /* SSH2 kex methods in order of preference. */ + int transport; /* Transport protocol(s) used */ - int protocol; /* Supported protocol versions. */ struct ForwardOptions fwd_opts; /* forwarding options */ SyslogFacility log_facility; /* Facility for system logging. */ + LogLevel log_level;<--->/* Level for system logging. */ diff --git a/ssh.1 b/ssh.1 index cc53343..b1a45e8 100644 --- a/ssh.1 @@ -566,7 +566,7 @@ index caf13a6..a088f30 100644 @@ -1597,6 +1597,12 @@ This is important in scripts, and many users want it too. .Pp To disable TCP keepalive messages, the value should be set to - .Dq no . + .Cm no . +.It Cm Transport +Specifies the transport protocol while connecting. Valid values are +.Dq TCP @@ -686,9 +686,9 @@ index 430569c..4ca58ed 100644 +#include <netinet/sctp.h> +#endif + - #ifndef O_NOCTTY - #define O_NOCTTY 0 - #endif + /* Re-exec fds */ + #define REEXEC_DEVCRYPTO_RESERVED_FD (STDERR_FILENO + 1) + #define REEXEC_STARTUP_PIPE_FD (STDERR_FILENO + 2) @@ -1164,6 +1168,12 @@ server_listen(void) for (ai = options.listen_addrs; ai; ai = ai->ai_next) { if (ai->ai_family != AF_INET && ai->ai_family != AF_INET6) @@ -853,7 +853,7 @@ index a37a3ac..24e3826 100644 @@ -1508,6 +1508,17 @@ This avoids infinitely hanging sessions. .Pp To disable TCP keepalive messages, the value should be set to - .Dq no . + .Cm no . +.It Cm Transport +Specifies the transport protocol that should be used by +.Xr sshd 8 . Modified: head/security/openssh-portable/files/extra-patch-tcpwrappers ============================================================================== --- head/security/openssh-portable/files/extra-patch-tcpwrappers Mon Jan 16 19:25:01 2017 (r431697) +++ head/security/openssh-portable/files/extra-patch-tcpwrappers Mon Jan 16 19:30:31 2017 (r431698) @@ -43,9 +43,9 @@ index 0ade557..045f149 100644 /* * Author: Tatu Ylonen <ylo@cs.hut.fi> * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland -@@ -122,6 +122,13 @@ - #include "ssh-sandbox.h" +@@ -123,6 +123,13 @@ #include "version.h" + #include "ssherr.h" +#ifdef LIBWRAP +#include <tcpd.h> @@ -54,10 +54,10 @@ index 0ade557..045f149 100644 +int deny_severity; +#endif /* LIBWRAP */ + - #ifndef O_NOCTTY - #define O_NOCTTY 0 - #endif -@@ -2027,6 +2034,24 @@ main(int ac, char **av) + /* Re-exec fds */ + #define REEXEC_DEVCRYPTO_RESERVED_FD (STDERR_FILENO + 1) + #define REEXEC_STARTUP_PIPE_FD (STDERR_FILENO + 2) +@@ -1971,6 +1978,24 @@ main(int ac, char **av) #ifdef SSH_AUDIT_EVENTS audit_connection_from(remote_ip, remote_port); #endif @@ -81,7 +81,7 @@ index 0ade557..045f149 100644 +#endif /* LIBWRAP */ /* Log the connection. */ - verbose("Connection from %s port %d on %s port %d", + laddr = get_local_ipaddr(sock_in); diff --git configure.ac configure.ac index f48ba4a..66fbe82 100644 --- configure.ac Added: head/security/openssh-portable/files/extra-patch-x509-glue ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/security/openssh-portable/files/extra-patch-x509-glue Mon Jan 16 19:30:31 2017 (r431698) @@ -0,0 +1,39 @@ +--- session.c.orig 2017-01-12 11:58:30.754769000 -0800 ++++ session.c 2017-01-12 11:58:35.360654000 -0800 +@@ -1252,36 +1252,6 @@ do_setup_env(Session *s, const char *she + if (getenv("TZ")) + child_set_env(&env, &envsize, "TZ", getenv("TZ")); + +-#ifdef __ANDROID__ +-{ +-#define COPY_ANDROID_ENV(name) { \ +- char *s = getenv(name); \ +- if (s) child_set_env(&env, &envsize, name, s); } +- +- /* from /init.rc */ +- COPY_ANDROID_ENV("ANDROID_BOOTLOGO"); +- COPY_ANDROID_ENV("ANDROID_ROOT"); +- COPY_ANDROID_ENV("ANDROID_ASSETS"); +- COPY_ANDROID_ENV("ANDROID_DATA"); +- COPY_ANDROID_ENV("ASEC_MOUNTPOINT"); +- COPY_ANDROID_ENV("LOOP_MOUNTPOINT"); +- COPY_ANDROID_ENV("BOOTCLASSPATH"); +- +- /* FIXME: keep android property workspace open +- * (see openbsd-compat/bsd-closefrom.c) +- */ +- COPY_ANDROID_ENV("ANDROID_PROPERTY_WORKSPACE"); +- +- COPY_ANDROID_ENV("EXTERNAL_STORAGE"); /* ??? */ +- COPY_ANDROID_ENV("SECONDARY_STORAGE"); /* ??? */ +- COPY_ANDROID_ENV("SD_EXT_DIRECTORY"); /* ??? */ +- +- /* may contain path to custom libraries */ +- COPY_ANDROID_ENV("LD_LIBRARY_PATH"); +-#undef COPY_ANDROID_ENV +-} +-#endif +- + /* Set custom environment options from RSA authentication. */ + while (custom_environment) { + struct envstring *ce = custom_environment; Added: head/security/openssh-portable/files/patch-misc.c ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/security/openssh-portable/files/patch-misc.c Mon Jan 16 19:30:31 2017 (r431698) @@ -0,0 +1,43 @@ +------------------------------------------------------------------------ +r181918 | des | 2008-08-20 05:40:07 -0500 (Wed, 20 Aug 2008) | 6 lines +Changed paths: + M /head/crypto/openssh/readconf.c + +Use net.inet.ip.portrange.reservedhigh instead of IPPORT_RESERVED. +Submitted upstream, no reaction. + +Submitted by: delphij@ +[rewritten for 7.4 by bdrewery@] + +--- misc.c.orig 2017-01-12 11:54:41.058558000 -0800 ++++ misc.c 2017-01-12 11:55:16.531356000 -0800 +@@ -56,6 +56,8 @@ + #include <net/if.h> + #endif + ++#include <sys/sysctl.h> ++ + #include "xmalloc.h" + #include "misc.h" + #include "log.h" +@@ -1253,7 +1255,19 @@ forward_equals(const struct Forward *a, + int + bind_permitted(int port, uid_t uid) + { +- if (port < IPPORT_RESERVED && uid != 0) ++ int ipport_reserved; ++#ifdef __FreeBSD__ ++ size_t len_ipport_reserved = sizeof(ipport_reserved); ++ ++ if (sysctlbyname("net.inet.ip.portrange.reservedhigh", ++ &ipport_reserved, &len_ipport_reserved, NULL, 0) != 0) ++ ipport_reserved = IPPORT_RESERVED; ++ else ++ ipport_reserved++; ++#else ++ ipport_reserved = IPPORT_RESERVED; ++#endif ++ if (port < ipport_reserved && uid != 0) + return 0; + return 1; + } Modified: head/security/openssh-portable/files/patch-readconf.c ============================================================================== --- head/security/openssh-portable/files/patch-readconf.c Mon Jan 16 19:25:01 2017 (r431697) +++ head/security/openssh-portable/files/patch-readconf.c Mon Jan 16 19:30:31 2017 (r431698) @@ -9,48 +9,8 @@ Changed paths: Apply FreeBSD's configuration defaults. ------------------------------------------------------------------------- -r181918 | des | 2008-08-20 05:40:07 -0500 (Wed, 20 Aug 2008) | 6 lines -Changed paths: - M /head/crypto/openssh/readconf.c - -Use net.inet.ip.portrange.reservedhigh instead of IPPORT_RESERVED. -Submitted upstream, no reaction. - -Submitted by: delphij@ - --- readconf.c.orig 2014-07-17 23:11:26.000000000 -0500 +++ readconf.c 2014-11-03 16:45:05.188796445 -0600 -@@ -17,6 +17,7 @@ - #include <sys/types.h> - #include <sys/stat.h> - #include <sys/socket.h> -+#include <sys/sysctl.h> - #include <sys/wait.h> - #include <sys/un.h> - -@@ -311,8 +312,19 @@ add_local_forward(Options *options, cons - struct Forward *fwd; - extern uid_t original_real_uid; - int i; -- -- if (newfwd->listen_port < IPPORT_RESERVED && original_real_uid != 0 && -+ int ipport_reserved; -+#ifdef __FreeBSD__ -+ size_t len_ipport_reserved = sizeof(ipport_reserved); -+ -+ if (sysctlbyname("net.inet.ip.portrange.reservedhigh", -+ &ipport_reserved, &len_ipport_reserved, NULL, 0) != 0) -+ ipport_reserved = IPPORT_RESERVED; -+ else -+ ipport_reserved++; -+#else -+ ipport_reserved = IPPORT_RESERVED; -+#endif -+ if (newfwd->listen_port < ipport_reserved && original_real_uid != 0 && - newfwd->listen_path == NULL) - fatal("Privileged ports can only be forwarded by root."); - /* Don't add duplicates */ @@ -1934,7 +1946,7 @@ fill_default_options(Options * options) if (options->batch_mode == -1) options->batch_mode = 0; Modified: head/security/openssh-portable/files/patch-session.c ============================================================================== --- head/security/openssh-portable/files/patch-session.c Mon Jan 16 19:25:01 2017 (r431697) +++ head/security/openssh-portable/files/patch-session.c Mon Jan 16 19:30:31 2017 (r431698) @@ -1,6 +1,18 @@ +------------------------------------------------------------------------ +r99055 | des | 2002-06-29 04:21:58 -0700 (Sat, 29 Jun 2002) | 6 lines +Changed paths: + M /head/crypto/openssh/session.c + +Make sure the environment variables set by setusercontext() are passed on +to the child process. + +Reviewed by: ache +Sponsored by: DARPA, NAI Labs + + --- session.c 2013-03-14 19:22:37 UTC +++ session.c -@@ -1131,6 +1136,9 @@ +@@ -985,6 +985,9 @@ do_setup_env(Session *s, const char *she struct passwd *pw = s->pw; #if !defined (HAVE_LOGIN_CAP) && !defined (HAVE_CYGWIN) char *path = NULL; @@ -10,7 +22,7 @@ #endif /* Initialize the environment. */ -@@ -1152,6 +1160,9 @@ +@@ -1006,6 +1009,9 @@ do_setup_env(Session *s, const char *she } #endif @@ -20,50 +32,49 @@ #ifdef GSSAPI /* Allow any GSSAPI methods that we've used to alter * the childs environment as they see fit -@@ -1171,11 +1182,22 @@ - child_set_env(&env, &envsize, "LOGIN", pw->pw_name); +@@ -1023,11 +1029,21 @@ do_setup_env(Session *s, const char *she + child_set_env(&env, &envsize, "LOGIN", pw->pw_name); #endif - child_set_env(&env, &envsize, "HOME", pw->pw_dir); -+ snprintf(buf, sizeof buf, "%.200s/%.50s", -+ _PATH_MAILDIR, pw->pw_name); -+ child_set_env(&env, &envsize, "MAIL", buf); + child_set_env(&env, &envsize, "HOME", pw->pw_dir); ++ snprintf(buf, sizeof buf, "%.200s/%.50s", _PATH_MAILDIR, pw->pw_name); ++ child_set_env(&env, &envsize, "MAIL", buf); #ifdef HAVE_LOGIN_CAP -- if (setusercontext(lc, pw, pw->pw_uid, LOGIN_SETPATH) < 0) -- child_set_env(&env, &envsize, "PATH", _PATH_STDPATH); -- else -- child_set_env(&env, &envsize, "PATH", getenv("PATH")); -+ child_set_env(&env, &envsize, "PATH", _PATH_STDPATH); -+ child_set_env(&env, &envsize, "TERM", "su"); -+ senv = environ; -+ environ = xmalloc(sizeof(char *)); -+ *environ = NULL; -+ (void) setusercontext(lc, pw, pw->pw_uid, -+ LOGIN_SETENV|LOGIN_SETPATH); -+ copy_environment(environ, &env, &envsize); -+ for (var = environ; *var != NULL; ++var) -+ free(*var); -+ free(environ); -+ environ = senv; +- if (setusercontext(lc, pw, pw->pw_uid, LOGIN_SETPATH) < 0) +- child_set_env(&env, &envsize, "PATH", _PATH_STDPATH); +- else +- child_set_env(&env, &envsize, "PATH", getenv("PATH")); ++ child_set_env(&env, &envsize, "PATH", _PATH_STDPATH); ++ child_set_env(&env, &envsize, "TERM", "su"); ++ senv = environ; ++ environ = xmalloc(sizeof(char *)); ++ *environ = NULL; ++ (void) setusercontext(lc, pw, pw->pw_uid, ++ LOGIN_SETENV|LOGIN_SETPATH); ++ copy_environment(environ, &env, &envsize); ++ for (var = environ; *var != NULL; ++var) ++ free(*var); ++ free(environ); ++ environ = senv; #else /* HAVE_LOGIN_CAP */ # ifndef HAVE_CYGWIN - /* -@@ -1196,15 +1218,9 @@ + /* +@@ -1047,15 +1063,9 @@ do_setup_env(Session *s, const char *she # endif /* HAVE_CYGWIN */ #endif /* HAVE_LOGIN_CAP */ -- snprintf(buf, sizeof buf, "%.200s/%.50s", -- _PATH_MAILDIR, pw->pw_name); -- child_set_env(&env, &envsize, "MAIL", buf); +- snprintf(buf, sizeof buf, "%.200s/%.50s", _PATH_MAILDIR, pw->pw_name); +- child_set_env(&env, &envsize, "MAIL", buf); - - /* Normal systems set SHELL by default. */ - child_set_env(&env, &envsize, "SHELL", shell); - } + /* Normal systems set SHELL by default. */ + child_set_env(&env, &envsize, "SHELL", shell); + - if (getenv("TZ")) - child_set_env(&env, &envsize, "TZ", getenv("TZ")); - +- /* Set custom environment options from RSA authentication. */ - if (!options.use_login) { -@@ -1483,7 +1499,7 @@ + while (custom_environment) { + struct envstring *ce = custom_environment; +@@ -1334,7 +1344,7 @@ do_setusercontext(struct passwd *pw) if (platform_privileged_uidswap()) { #ifdef HAVE_LOGIN_CAP if (setusercontext(lc, pw, pw->pw_uid, Modified: head/security/openssh-portable/files/patch-ssh-agent.1 ============================================================================== --- head/security/openssh-portable/files/patch-ssh-agent.1 Mon Jan 16 19:25:01 2017 (r431697) +++ head/security/openssh-portable/files/patch-ssh-agent.1 Mon Jan 16 19:30:31 2017 (r431698) @@ -4,12 +4,9 @@ r226103 | des | 2011-10-07 08:10:16 -050 Add a -x option that causes ssh-agent(1) to exit when all clients have disconnected. -Add a -P option to specify PKCS11_WHITELIST - - ---- ssh-agent.1.orig 2016-07-27 17:54:27.000000000 -0500 -+++ ssh-agent.1 2017-01-11 19:05:12.513900000 -0600 -@@ -43,10 +43,11 @@ +--- ssh-agent.1.orig 2015-05-29 03:27:21.000000000 -0500 ++++ ssh-agent.1 2015-06-02 09:45:37.025390000 -0500 +@@ -43,7 +43,7 @@ .Sh SYNOPSIS .Nm ssh-agent .Op Fl c | s @@ -18,30 +15,7 @@ Add a -P option to specify PKCS11_WHITEL .Op Fl a Ar bind_address .Op Fl E Ar fingerprint_hash .Op Fl t Ar life -+.Op Fl P Ar pkcs11_whitelist - .Op Ar command Op Ar arg ... - .Nm ssh-agent - .Op Fl c | s -@@ -121,6 +122,18 @@ - Kill the current agent (given by the - .Ev SSH_AGENT_PID - environment variable). -+.It Fl P -+Specify a pattern-list of acceptable paths for PKCS#11 shared libraries -+that may be added using the -+.Fl s -+option to -+.Xr ssh-add 1 . -+The default is to allow loading PKCS#11 libraries from -+.Dq /usr/lib/*,/usr/local/lib/* . -+PKCS#11 libraries that do not match the whitelist will be refused. -+See PATTERNS in -+.Xr ssh_config 5 -+for a description of pattern-list syntax. - .It Fl s - Generate Bourne shell commands on - .Dv stdout . -@@ -135,6 +148,8 @@ +@@ -128,6 +128,8 @@ .Xr ssh-add 1 overrides this value. Without this option the default maximum lifetime is forever. @@ -49,4 +23,4 @@ Add a -P option to specify PKCS11_WHITEL +Exit after the last client has disconnected. .El .Pp - If a command line is given, this is executed as a subprocess of the agent. + If a commandline is given, this is executed as a subprocess of the agent. Modified: head/security/openssh-portable/files/patch-ssh-agent.c ============================================================================== --- head/security/openssh-portable/files/patch-ssh-agent.c Mon Jan 16 19:25:01 2017 (r431697) +++ head/security/openssh-portable/files/patch-ssh-agent.c Mon Jan 16 19:30:31 2017 (r431698) @@ -8,39 +8,9 @@ r226103 | des | 2011-10-07 08:10:16 -050 Add a -x option that causes ssh-agent(1) to exit when all clients have disconnected. -Add a -P option to specify PKCS11_WHITELIST (fixes CVE-2016-10009) - - ---- ssh-agent.c.orig 2016-07-27 17:54:27.000000000 -0500 -+++ ssh-agent.c 2017-01-11 19:02:59.600125000 -0600 -@@ -83,11 +83,16 @@ - #include "misc.h" - #include "digest.h" - #include "ssherr.h" -+#include "match.h" - - #ifdef ENABLE_PKCS11 - #include "ssh-pkcs11.h" - #endif - -+#ifndef DEFAULT_PKCS11_WHITELIST -+# define DEFAULT_PKCS11_WHITELIST "/usr/lib/*,/usr/local/lib/*" -+#endif -+ - typedef enum { - AUTH_UNUSED, - AUTH_SOCKET, -@@ -135,6 +140,9 @@ - char socket_name[PATH_MAX]; - char socket_dir[PATH_MAX]; - -+/* PKCS#11 path whitelist */ -+static char *pkcs11_whitelist; -+ - /* locking */ - #define LOCK_SIZE 32 - #define LOCK_SALT_SIZE 16 -@@ -150,15 +158,34 @@ +--- ssh-agent.c.orig 2015-05-29 03:27:21.000000000 -0500 ++++ ssh-agent.c 2015-06-02 09:46:54.719580000 -0500 +@@ -157,15 +157,34 @@ static long lifetime = 0; static int fingerprint_hash = SSH_FP_HASH_DEFAULT; @@ -75,50 +45,7 @@ Add a -P option to specify PKCS11_WHITEL } static void -@@ -738,7 +765,7 @@ - static void - process_add_smartcard_key(SocketEntry *e) - { -- char *provider = NULL, *pin; -+ char *provider = NULL, *pin, canonical_provider[PATH_MAX]; - int r, i, version, count = 0, success = 0, confirm = 0; - u_int seconds; - time_t death = 0; -@@ -770,10 +797,21 @@ - goto send; - } - } -+ if (realpath(provider, canonical_provider) == NULL) { -+ verbose("failed PKCS#11 add of \"%.100s\": realpath: %s", -+ provider, strerror(errno)); -+ goto send; -+ } -+ if (match_pattern_list(canonical_provider, pkcs11_whitelist, 0) != 1) { -+ verbose("refusing PKCS#11 add of \"%.100s\": " -+ "provider not whitelisted", canonical_provider); -+ goto send; -+ } -+ debug("%s: add %.100s", __func__, canonical_provider); - if (lifetime && !death) - death = monotime() + lifetime; - -- count = pkcs11_add_provider(provider, pin, &keys); -+ count = pkcs11_add_provider(canonical_provider, pin, &keys); - for (i = 0; i < count; i++) { - k = keys[i]; - version = k->type == KEY_RSA1 ? 1 : 2; -@@ -781,8 +819,8 @@ - if (lookup_identity(k, version) == NULL) { - id = xcalloc(1, sizeof(Identity)); - id->key = k; -- id->provider = xstrdup(provider); -- id->comment = xstrdup(provider); /* XXX */ -+ id->provider = xstrdup(canonical_provider); -+ id->comment = xstrdup(canonical_provider); /* XXX */ - id->death = death; - id->confirm = confirm; - TAILQ_INSERT_TAIL(&tab->idlist, id, next); -@@ -945,6 +983,10 @@ +@@ -963,6 +982,10 @@ new_socket(sock_type type, int fd) { u_int i, old_alloc, new_alloc; @@ -129,18 +56,16 @@ Add a -P option to specify PKCS11_WHITEL set_nonblock(fd); if (fd > max_fd) -@@ -1172,8 +1214,8 @@ +@@ -1190,7 +1213,7 @@ static void usage(void) { fprintf(stderr, - "usage: ssh-agent [-c | -s] [-Dd] [-a bind_address] [-E fingerprint_hash]\n" -- " [-t life] [command [arg ...]]\n" + "usage: ssh-agent [-c | -s] [-Ddx] [-a bind_address] [-E fingerprint_hash]\n" -+ " [-P pkcs11_whitelist] [-t life] [command [arg ...]]\n" + " [-P pkcs11_whitelist] [-t life] [command [arg ...]]\n" " ssh-agent [-c | -s] -k\n"); exit(1); - } -@@ -1204,6 +1246,7 @@ +@@ -1222,6 +1245,7 @@ main(int ac, char **av) /* drop */ setegid(getgid()); setgid(getgid()); @@ -148,28 +73,16 @@ Add a -P option to specify PKCS11_WHITEL platform_disable_tracing(0); /* strict=no */ -@@ -1214,7 +1257,7 @@ +@@ -1232,7 +1256,7 @@ main(int ac, char **av) __progname = ssh_get_progname(av[0]); seed_rng(); -- while ((ch = getopt(ac, av, "cDdksE:a:t:")) != -1) { +- while ((ch = getopt(ac, av, "cDdksE:a:P:t:")) != -1) { + while ((ch = getopt(ac, av, "cDdksE:a:P:t:x")) != -1) { switch (ch) { case 'E': fingerprint_hash = ssh_digest_alg_by_name(optarg); -@@ -1229,6 +1272,11 @@ - case 'k': - k_flag++; - break; -+ case 'P': -+ if (pkcs11_whitelist != NULL) -+ fatal("-P option already specified"); -+ pkcs11_whitelist = xstrdup(optarg); -+ break; - case 's': - if (c_flag) - usage(); -@@ -1253,6 +1301,9 @@ +@@ -1276,6 +1300,9 @@ main(int ac, char **av) usage(); } break; @@ -179,22 +92,3 @@ Add a -P option to specify PKCS11_WHITEL default: usage(); } -@@ -1263,6 +1314,9 @@ - if (ac > 0 && (c_flag || k_flag || s_flag || d_flag || D_flag)) - usage(); - -+ if (pkcs11_whitelist == NULL) -+ pkcs11_whitelist = xstrdup(DEFAULT_PKCS11_WHITELIST); -+ - if (ac == 0 && !c_flag && !s_flag) { - shell = getenv("SHELL"); - if (shell != NULL && (len = strlen(shell)) > 2 && -@@ -1410,7 +1464,7 @@ - signal(SIGTERM, cleanup_handler); - nalloc = 0; - -- if (pledge("stdio cpath unix id proc exec", NULL) == -1) -+ if (pledge("stdio rpath cpath unix id proc exec", NULL) == -1) - fatal("%s: pledge: %s", __progname, strerror(errno)); - platform_pledge_agent(); - Modified: head/security/openssh-portable/files/patch-ssh_config.5 ============================================================================== --- head/security/openssh-portable/files/patch-ssh_config.5 Mon Jan 16 19:25:01 2017 (r431697) +++ head/security/openssh-portable/files/patch-ssh_config.5 Mon Jan 16 19:30:31 2017 (r431698) @@ -6,12 +6,21 @@ rev 1.2 of readconf.c. --- ssh_config.5.orig 2010-08-04 21:03:13.000000000 -0600 +++ ssh_config.5 2010-09-14 16:14:13.000000000 -0600 -@@ -164,7 +164,7 @@ - .Dq no , +@@ -377,8 +377,7 @@ or + .Cm no . + .It Cm CheckHostIP + If set to +-.Cm yes +-(the default), ++.Cm yes , + .Xr ssh 1 + will additionally check the host IP address in the + .Pa known_hosts +@@ -390,6 +389,7 @@ in the process, regardless of the settin + .Cm StrictHostKeyChecking . + If the option is set to + .Cm no , ++(the default), the check will not be executed. - The default is --.Dq yes . -+.Dq no . .It Cm Cipher Specifies the cipher to use for encrypting the session - in protocol version 1. Modified: head/security/openssh-portable/files/patch-sshd_config.5 ============================================================================== --- head/security/openssh-portable/files/patch-sshd_config.5 Mon Jan 16 19:25:01 2017 (r431697) +++ head/security/openssh-portable/files/patch-sshd_config.5 Mon Jan 16 19:30:31 2017 (r431698) @@ -1,6 +1,6 @@ ---- sshd_config.5.orig 2015-05-29 03:27:21.000000000 UTC -+++ sshd_config.5 2015-06-02 09:49:08.463186000 -0500 -@@ -375,7 +375,9 @@ By default, no banner is displayed. +--- sshd_config.5.orig 2016-12-18 20:59:41.000000000 -0800 ++++ sshd_config.5 2017-01-11 13:35:46.496538000 -0800 +@@ -373,7 +373,9 @@ By default, no banner is displayed. .It Cm ChallengeResponseAuthentication Specifies whether challenge-response authentication is allowed (e.g. via PAM or through authentication styles supported in @@ -9,21 +9,32 @@ +See also +.Cm UsePAM . The default is - .Dq yes . + .Cm yes . .It Cm ChrootDirectory -@@ -1111,7 +1113,22 @@ are refused if the number of unauthentic +@@ -663,7 +665,9 @@ ssh-ed25519,ssh-rsa + The list of available key types may also be obtained using + .Qq ssh -Q key . + .It Cm HostbasedAuthentication +-Specifies whether rhosts or /etc/hosts.equiv authentication together ++Specifies whether rhosts or ++.Pa /etc/hosts.equiv ++authentication together + with successful public key client host authentication is allowed + (host-based authentication). + The default is +@@ -1120,7 +1124,22 @@ are refused if the number of unauthentic .It Cm PasswordAuthentication Specifies whether password authentication is allowed. The default is -+.Dq no , ++.Cm no , +unless +.Nm sshd +was built without PAM support, in which case the default is - .Dq yes . + .Cm yes . +Note that if +.Cm ChallengeResponseAuthentication +is -+.Dq yes , ++.Cm yes , +and the PAM authentication policy for +.Nm sshd +includes @@ -34,58 +45,47 @@ .It Cm PermitEmptyPasswords When password authentication is allowed, it specifies whether the server allows login to accounts with empty password strings. -@@ -1158,6 +1175,13 @@ or - .Dq no . +@@ -1216,6 +1235,13 @@ and + .Cm ethernet . The default is - .Dq no . + .Cm no . +Note that if +.Cm ChallengeResponseAuthentication +is -+.Dq yes , ++.Cm yes , +the root user may be allowed in with its password even if +.Cm PermitRootLogin is set to -+.Dq without-password . ++.Cm without-password . .Pp - If this option is set to - .Dq without-password , -@@ -1331,7 +1355,9 @@ an OpenSSH Key Revocation List (KRL) as - For more information on KRLs, see the KEY REVOCATION LISTS section in - .Xr ssh-keygen 1 . - .It Cm RhostsRSAAuthentication --Specifies whether rhosts or /etc/hosts.equiv authentication together -+Specifies whether rhosts or -+.Pa /etc/hosts.equiv -+authentication together - with successful RSA host authentication is allowed. - The default is - .Dq no . -@@ -1498,7 +1524,7 @@ is enabled, you will not be able to run + Independent of this setting, the permissions of the selected + .Xr tun 4 +@@ -1473,7 +1499,7 @@ is enabled, you will not be able to run .Xr sshd 8 as a non-root user. The default is --.Dq no . -+.Dq yes . *** DIFF OUTPUT TRUNCATED AT 1000 LINES ***
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201701161930.v0GJUVfv013991>