From d99093fb4bb5652015c06274d64083daa2439e4f Mon Sep 17 00:00:00 2001 From: V3n3RiX Date: Wed, 3 Mar 2021 10:28:17 +0000 Subject: gentoo resync : 03.03.2021 --- net-misc/openssh/Manifest | 15 - .../files/openssh-8.0_p1-hpn-14.20-X509-glue.patch | 111 ------- .../openssh/files/openssh-8.1_p1-GSSAPI-dns.patch | 359 --------------------- .../files/openssh-8.1_p1-X509-12.3-tests.patch | 11 - .../files/openssh-8.1_p1-X509-glue-12.3.patch | 35 -- .../files/openssh-8.1_p1-hpn-14.20-glue.patch | 105 ------ .../files/openssh-8.1_p1-hpn-14.20-sctp-glue.patch | 19 -- .../openssh/files/openssh-8.1_p1-tests-2020.patch | 26 -- .../files/openssh-8.2_p1-X509-12.4.3-tests.patch | 11 - .../files/openssh-8.2_p1-X509-glue-12.4.3.patch | 128 -------- .../files/openssh-8.2_p1-hpn-14.20-X509-glue.patch | 133 -------- .../files/openssh-8.2_p1-hpn-14.20-glue.patch | 151 --------- .../files/openssh-8.2_p1-hpn-14.20-libressl.patch | 20 -- .../files/openssh-8.2_p1-hpn-14.20-sctp-glue.patch | 19 -- .../files/openssh-8.3_p1-X509-glue-12.5.1.patch | 35 -- .../files/openssh-8.3_p1-hpn-14.20-glue.patch | 177 ---------- 16 files changed, 1355 deletions(-) delete mode 100644 net-misc/openssh/files/openssh-8.0_p1-hpn-14.20-X509-glue.patch delete mode 100644 net-misc/openssh/files/openssh-8.1_p1-GSSAPI-dns.patch delete mode 100644 net-misc/openssh/files/openssh-8.1_p1-X509-12.3-tests.patch delete mode 100644 net-misc/openssh/files/openssh-8.1_p1-X509-glue-12.3.patch delete mode 100644 net-misc/openssh/files/openssh-8.1_p1-hpn-14.20-glue.patch delete mode 100644 net-misc/openssh/files/openssh-8.1_p1-hpn-14.20-sctp-glue.patch delete mode 100644 net-misc/openssh/files/openssh-8.1_p1-tests-2020.patch delete mode 100644 net-misc/openssh/files/openssh-8.2_p1-X509-12.4.3-tests.patch delete mode 100644 net-misc/openssh/files/openssh-8.2_p1-X509-glue-12.4.3.patch delete mode 100644 net-misc/openssh/files/openssh-8.2_p1-hpn-14.20-X509-glue.patch delete mode 100644 net-misc/openssh/files/openssh-8.2_p1-hpn-14.20-glue.patch delete mode 100644 net-misc/openssh/files/openssh-8.2_p1-hpn-14.20-libressl.patch delete mode 100644 net-misc/openssh/files/openssh-8.2_p1-hpn-14.20-sctp-glue.patch delete mode 100644 net-misc/openssh/files/openssh-8.3_p1-X509-glue-12.5.1.patch delete mode 100644 net-misc/openssh/files/openssh-8.3_p1-hpn-14.20-glue.patch (limited to 'net-misc/openssh') diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest index 806f2544f48e..5930fe9e7e5c 100644 --- a/net-misc/openssh/Manifest +++ b/net-misc/openssh/Manifest @@ -3,23 +3,8 @@ AUX openssh-7.5_p1-disable-conch-interop-tests.patch 554 BLAKE2B f5f45c000ec26c1 AUX openssh-7.9_p1-include-stdlib.patch 914 BLAKE2B 9c7eb79f87ecd657a80821dfa979d8b0cc12a08d385ec085724f20aa6f5332593ffc7481bb9f816e91df3eb4d75d8f7b66383ff473d271270de128c3b2bf92e5 SHA512 7dade73bdafb0da484cbd396b4a644442f8ea12fef54c07e6308ae2e73a587fa4ddf401e8a0c467469b46fe7f00585e047462545182924c157b4d3894c707a70 AUX openssh-8.0_p1-deny-shmget-shmat-shmdt-in-preauth-privsep-child.patch 977 BLAKE2B b2e28683176c4678f51a9a0be3e29496620ac795c7de4649fb3cc0bd076682e42bc1c606b17a76e140f51319e4c4a1cc890c3a37c4bc3cf9222a88e31b8a773f SHA512 8c2567ae16dccc73e302ba90c1bb03e19d4afc3892dd8e1636d7c8853932662eccbda3957e4db55a21bd37d2e65abe74b0b2c1efb74e31751335eb523759d945 AUX openssh-8.0_p1-fix-putty-tests.patch 1760 BLAKE2B a1127e8f2275c1e23c956b5041dbc84dbdb2cd6b788fc69bfc1f6b030afe86a827483602ce76577b4101ee2e790b1cfa8c1d2db09da59b89fe7df8083bf4695f SHA512 f544d818bdde628131f1819bf2ffb4007802ee5bf12c5cd5bd398efe0f0f430ed6b3efa7969cb2c4fa49a2bbd773d8fa09f4c927cf998a564b7611443437c310 -AUX openssh-8.0_p1-hpn-14.20-X509-glue.patch 4063 BLAKE2B 30a9b4df889a2ae46b7b0a4f5ab963b9258ed918756e4b05f465af2664b5ec9d149ab496b05ee2a221ffc28c84ce26ff6c3e0bb8da4c59338616c992e1412fb0 SHA512 ed2102af78a4f10dc7ae56edeb3dd94690ba4df5803ec7d68fff76226f54eca5c023d6d87735ed7f33131a0fd0c382a5503d767e91e812bfc1f5f590cf213f34 AUX openssh-8.0_p1-hpn-version.patch 590 BLAKE2B 1ff20ab17e7e1a20f7a96ded56ff7c059fd509d7773d9abaeac83743102385d9713284c630dc932d40672a9bfc8a894b57c6b073e93a7b024de7490ea54a589c SHA512 37250881f17a44e4a4b0ac164d06961e0731528847d5cbbb263e3f9a286a192c8dae92250b85db3f2e1f280a464c7b3bfc8a7c9e85552375c013e16a6fcf28ed -AUX openssh-8.1_p1-GSSAPI-dns.patch 11639 BLAKE2B 2bc9e618c0acbf6b85496a33055894471235d01f20b76c9b75302dce58c7d6033984c8471789d2f8095d6231f5f271a4eb2f6099936b1631ec261464bc7a3ada SHA512 722a769da482876f0629e110109f02065e47848ff79395e9e64de39ae066d8c5a207f849c59d95b72e70b874f4bedf4e52a2f7ad1752d9c84b99ccdbfa19c73d -AUX openssh-8.1_p1-X509-12.3-tests.patch 405 BLAKE2B 1a1c29fea98c4ce277c943709576b5130a573e9786a33c957229d74d0e572ca6e5d0dce68b5b515b5c3f44862f1f4dafe2dad1cd3d3710ca415137f8a4013b86 SHA512 0e80b79d3aa8b7e89cf250b31e6bbc2471990b9a2c0ab8b54e6af4c3de77adff3dc6db83f4f14524f830455b5ce4d586f630d33b4ac4b134d1028e325ab351b3 -AUX openssh-8.1_p1-X509-glue-12.3.patch 1613 BLAKE2B aef1de72da18a2af0fae1793eed5baa1be2af9f26a522e6772f43f1053d263f154db76cf0ebe3ddebbfd9798ffb334100ce5eb3894ad3095b1cd48d1ef5b9839 SHA512 e533175bcabd1ddbb50c6cc605cba0190d2cde24149d5451a807cdc05847fa95a2b72188bc23866876e8ec88073df8039e0e85e703560e90f53a92df6f616572 -AUX openssh-8.1_p1-hpn-14.20-glue.patch 3534 BLAKE2B 13206d78b0e344d4d90aad3f9aa4396cbe270f1004108f52e1b23fc4b106e01f94bdc6e198a42c0bfc9d885408caea890e72f2bd58df893f94dea4452ab11c00 SHA512 ab589f6d9eada3313b87e8e35aa4e3946cd057412336914c90f6266dafb997062f7b8be4ac475e66a8df896f9fb3004f0df6a4f69dc85c468bcb1f4778326f96 -AUX openssh-8.1_p1-hpn-14.20-sctp-glue.patch 737 BLAKE2B b8f93cb197206eb4315c66350ce3e943cd5f1280b5294099320cbc4a611de2a23f5a5c04ed71a394e1bd23a0928df50d754f549d652e53389ceadda2ac9f1636 SHA512 96fa9a317d9cc0a77bf5a8d82d8fa0498fff04309bc4ae546b34939580c4ed945d075f26d8ea16e787d7bf631ea5067543f380ab08167993d713ec1591a346b9 -AUX openssh-8.1_p1-tests-2020.patch 1332 BLAKE2B a400f6859a5d096729c9cb6047dce8612da7fe5f8d06cc891cfb6a4c88b568be3dfc7872d5be78ef349798f501828e1505bbd5ebd49d548dbbdc6bbf987dc843 SHA512 8f4c535d3ab15e4c761f6f5d4efe762ec2bc9b5de49ee369ce9186fe40095d2065418249c89161a8ef53e893079264fd9c95b73cd74937b08fa9f563a4f00290 AUX openssh-8.2_p1-GSSAPI-dns.patch 11647 BLAKE2B b904922f809a6616f488509a962c778837bc6003138efe79fb1ce9edf9611f14c209c11559a922497c50c3dff450286e40dfcb929414cb7f705357d2c4e3603d SHA512 f9256a80c75ae0db11df0e562ace026614f2f6d0f6c91eaed7786b2a3c37608e18ca45242385813fa34487e50f21e5d3a13bfb66adc854b7c34d278a164c3dc4 -AUX openssh-8.2_p1-X509-12.4.3-tests.patch 405 BLAKE2B cfdd9b557d69b9230dd24fce00504f96ec3349712b1ca8667bb60fc9619d7fbfe44d2de847fc8b06c31de434fcab6e53ec4cd373a20a701372fdb0516ca14839 SHA512 788f6e1a522773bb322d70be6edd32734034c35073eea417d3895ecd176b3cc3ebd228285441ec12e75c991121e40eaa6b75b8be76a05167a0419773ae13018a -AUX openssh-8.2_p1-X509-glue-12.4.3.patch 5024 BLAKE2B 96568de2316e50d8390654aecbec7751eb9eb333b30fb30700161c626f93e97c5fb244d96baf32fa12d31760efdb10c80012f872412e90837f8b294082d7b087 SHA512 85c635ed067ec3c829fe4caee6bfe84e0f986f0513d744476e637c1af16af910604b879e6894300be1ce8a6a6e397149329e8fe09246e3654dcdef1ff44da4ed -AUX openssh-8.2_p1-hpn-14.20-X509-glue.patch 4881 BLAKE2B 899065ef3b781e7e67ea630ff26ac8c3975073e9ef5b0cc345c6cee9fb2e45d2ff549b716a76211c88efb1e540ed7d79c4467e0342cfbea64fef8e6cafddac85 SHA512 d37d4fd8614bed8b1592697b911a04e2ca7d14d24e9c315a6695b4c88cdb5b4ae980e8cb68040fe54b4587675ebb3ac5694ea0d09093f8451aa65e427b6a5d95 -AUX openssh-8.2_p1-hpn-14.20-glue.patch 5294 BLAKE2B 6a778eab95e05d371fd92a02f96b926cec5c6ff90dea36065b4857ddf243b5f95bb25aa339fddb1c662b628f26d0c11858d1ca0badece0a7268d6a51e99a09be SHA512 50289c60df01a59f134a0b283ec21d6a06beccdb68de67a46b4e0e9a9bc47855b0e4dbed47300c2f042f2eb9f63e4d6d0683f3092ee358a82e9d6337a3b173fe -AUX openssh-8.2_p1-hpn-14.20-libressl.patch 794 BLAKE2B 36e42916a90aeb857eb7b9bc815a2720b4fad82ebcb1b53b7045f5c61f1dadfcdb4478092c5ab514d0d11832696cbb54acc18c01e5daa41eea776962065f7467 SHA512 d41e48a70f6b3b293c07f42f764dea810ed3084e54821004f97e2e5fbc1ce7110e68632fd3492779b1ec62179a3f7e34e92554c735f825952e0ce1a05fd9d474 -AUX openssh-8.2_p1-hpn-14.20-sctp-glue.patch 755 BLAKE2B 091a7cf60907c142d28b7f20a9fe4e1db8f2ce7f268ea4e0f206de89ea4ce560e82c2e91a9281a664868628426ad8c262667b7e6ad4e35247422937b98034855 SHA512 cff282e6a35a109794fca25b724b8e5024e7ded07b5dd3646489f384bdd5a42726d7cf9f814b8ebc20caed02a1a70d80e0396626bdfc13302096e15c11433dde -AUX openssh-8.3_p1-X509-glue-12.5.1.patch 1721 BLAKE2B c67e6ce756d8febea9066ca52d47baff962075610ca87ee8ef9581940db020ab8889f1bb7e2809bac7c521058e835a25823f30bd6ee8b4948cbb19b7459e512c SHA512 bf356de43307cb48fd79427b22fff5bf40ad4fc72c6e906b517209f5f51bddf6a5f81d7617ad01e8434db5703df4fa45f68d4a70fd5869691536b9f82fb18b18 -AUX openssh-8.3_p1-hpn-14.20-glue.patch 6059 BLAKE2B 454178571fbf051fad6edff93c87d96f4fa62c687b03666a27e912e29c9f11d375935d0f830edff779ff73f0de16831bc54d2a7e747ff5e3951933b25f39b452 SHA512 0791c0936b4e316715e691b3ac0fa6dd03495fc30ddb68ba15a73c2f8aafb3892df5fa3c29d91e16d956f9aa3c9fd66ded8ad744834788f2fad08b807efe0a5b AUX openssh-8.3_p1-sha2-include.patch 370 BLAKE2B 3d9ee891d9d647f4ff3b42d47cae4c7a32533bce917b35101fd3c5549717a6b285423894b3372ecb6983d4425c712f4b0590fc95799fd521523d9d74860863c6 SHA512 a1edda5dc43af79e9e4e7d3bcd78cc1c2dbf40e94f22189022dcaf1107c8f2cb2a37c949af5955144f6ada210417a695fe0c4d05d52ba2dbafb1dddf6a1bac3f AUX openssh-8.4_p1-X509-glue-12.6.patch 1524 BLAKE2B de9de289b7a401726f92df2e23750df1cb26b3cc9595f1f2db7d74ffacbf4ca2a723d270ffbd0a085d44674375247f34efe04bbbd8150e67a82b6b96b8786065 SHA512 7b301e672cea87ecee89ed1eaea44ac35e2d8395696d7456690308ba1dfe671144488c7b9c79f5a238e2242eae54bca6abadd1ae448ac70cab976930f4ad5f4d AUX openssh-8.4_p1-fix-ssh-copy-id.patch 1070 BLAKE2B 2928bc4fbef7d70f57d1f77f4e79238dbe4b640ee891aae94ee767de98fbb04a9421bd9e071771c6d1f9818695ba329058284469ce2f01704b05351989274a1b SHA512 d6088a20e3d4cb597ca99c29fd761e06c16b8a54e7e5d0fa63a07f814fd21e831e0e5e4e3c643b99fe10e536ed98ef5f8179cab2ac79bc44e725327b8d5d5dba diff --git a/net-misc/openssh/files/openssh-8.0_p1-hpn-14.20-X509-glue.patch b/net-misc/openssh/files/openssh-8.0_p1-hpn-14.20-X509-glue.patch deleted file mode 100644 index 167adfcaefb8..000000000000 --- a/net-misc/openssh/files/openssh-8.0_p1-hpn-14.20-X509-glue.patch +++ /dev/null @@ -1,111 +0,0 @@ -diff -ur a/openssh-8_1_P1-hpn-AES-CTR-14.20.diff b/openssh-8_1_P1-hpn-AES-CTR-14.20.diff ---- a/openssh-8_1_P1-hpn-AES-CTR-14.20.diff 2020-02-04 15:49:15.746095444 -0800 -+++ b/openssh-8_1_P1-hpn-AES-CTR-14.20.diff 2020-02-04 15:49:54.181853707 -0800 -@@ -4,8 +4,8 @@ - +++ b/Makefile.in - @@ -42,7 +42,7 @@ CC=@CC@ - LD=@LD@ -- CFLAGS=@CFLAGS@ -- CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ $(PATHS) @DEFS@ -+ CFLAGS=@CFLAGS@ $(CFLAGS_EXTRA) -+ CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ @LDAP_CPPFLAGS@ $(PATHS) @DEFS@ - -LIBS=@LIBS@ - +LIBS=@LIBS@ -lpthread - K5LIBS=@K5LIBS@ -@@ -803,8 +803,8 @@ - ssh_packet_set_connection(struct ssh *ssh, int fd_in, int fd_out) - { - struct session_state *state; --- const struct sshcipher *none = cipher_by_name("none"); --+ struct sshcipher *none = cipher_by_name("none"); -+- const struct sshcipher *none = cipher_none(); -++ struct sshcipher *none = cipher_none(); - int r; - - if (none == NULL) { -@@ -948,9 +948,9 @@ - /* Portable-specific options */ - sUsePAM, - + sDisableMTAES, -- /* Standard Options */ -- sPort, sHostKeyFile, sLoginGraceTime, -- sPermitRootLogin, sLogFacility, sLogLevel, -+ /* X.509 Standard Options */ -+ sHostbasedAlgorithms, -+ sPubkeyAlgorithms, - @@ -643,6 +647,7 @@ static struct { - { "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL }, - { "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL }, -diff -ur a/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff b/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff ---- a/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff 2020-02-04 15:41:42.512910357 -0800 -+++ b/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff 2020-02-04 15:56:40.323299499 -0800 -@@ -382,7 +382,7 @@ - @@ -884,6 +884,10 @@ kex_choose_conf(struct ssh *ssh) - int nenc, nmac, ncomp; - u_int mode, ctos, need, dh_need, authlen; -- int r, first_kex_follows; -+ int r, first_kex_follows = 0; - + int auth_flag; - + - + auth_flag = packet_authentication_state(ssh); -@@ -391,8 +391,8 @@ - debug2("local %s KEXINIT proposal", kex->server ? "server" : "client"); - if ((r = kex_buf2prop(kex->my, NULL, &my)) != 0) - @@ -954,6 +958,14 @@ kex_choose_conf(struct ssh *ssh) -- peer[ncomp] = NULL; -- goto out; -+ else -+ fatal("Pre-authentication none cipher requests are not allowed."); - } - + debug("REQUESTED ENC.NAME is '%s'", newkeys->enc.name); - + if (strcmp(newkeys->enc.name, "none") == 0) { -@@ -1169,15 +1169,3 @@ - # Example of overriding settings on a per-user basis - #Match User anoncvs - # X11Forwarding no --diff --git a/version.h b/version.h --index 6b3fadf8..ec1d2e27 100644 ----- a/version.h --+++ b/version.h --@@ -3,4 +3,6 @@ -- #define SSH_VERSION "OpenSSH_8.1" -- -- #define SSH_PORTABLE "p1" ---#define SSH_RELEASE SSH_VERSION SSH_PORTABLE --+#define SSH_HPN "-hpn14v20" --+#define SSH_RELEASE SSH_VERSION SSH_PORTABLE SSH_HPN --+ -diff -ur a/openssh-8_1_P1-hpn-PeakTput-14.20.diff b/openssh-8_1_P1-hpn-PeakTput-14.20.diff ---- a/openssh-8_1_P1-hpn-PeakTput-14.20.diff 2020-02-04 15:41:42.512910357 -0800 -+++ b/openssh-8_1_P1-hpn-PeakTput-14.20.diff 2020-02-04 16:02:42.203023609 -0800 -@@ -12,9 +12,9 @@ - static long stalled; /* how long we have been stalled */ - static int bytes_per_second; /* current speed in bytes per second */ - @@ -127,6 +129,7 @@ refresh_progress_meter(int force_update) -+ off_t bytes_left; - int cur_speed; -- int hours, minutes, seconds; -- int file_len; -+ int len; - + off_t delta_pos; - - if ((!force_update && !alarm_fired && !win_resized) || !can_output()) -@@ -33,12 +33,12 @@ - @@ -166,7 +173,7 @@ refresh_progress_meter(int force_update) - - /* filename */ -- buf[0] = '\0'; --- file_len = win_size - 36; --+ file_len = win_size - 45; -- if (file_len > 0) { -- buf[0] = '\r'; -- snmprintf(buf+1, sizeof(buf)-1, &file_len, "%-*s", -+ if (win_size > 36) { -+- int file_len = win_size - 36; -++ int file_len = win_size - 45; -+ snmprintf(buf+1, sizeof(buf)-1, &file_len, "%-*s ", -+ file_len, file); -+ } - @@ -191,6 +198,15 @@ refresh_progress_meter(int force_update) - (off_t)bytes_per_second); - strlcat(buf, "/s ", win_size); diff --git a/net-misc/openssh/files/openssh-8.1_p1-GSSAPI-dns.patch b/net-misc/openssh/files/openssh-8.1_p1-GSSAPI-dns.patch deleted file mode 100644 index 6aba6f266945..000000000000 --- a/net-misc/openssh/files/openssh-8.1_p1-GSSAPI-dns.patch +++ /dev/null @@ -1,359 +0,0 @@ -diff --git a/auth.c b/auth.c -index ca450f4e..2994a4e4 100644 ---- a/auth.c -+++ b/auth.c -@@ -723,120 +723,6 @@ fakepw(void) - return (&fake); - } - --/* -- * Returns the remote DNS hostname as a string. The returned string must not -- * be freed. NB. this will usually trigger a DNS query the first time it is -- * called. -- * This function does additional checks on the hostname to mitigate some -- * attacks on legacy rhosts-style authentication. -- * XXX is RhostsRSAAuthentication vulnerable to these? -- * XXX Can we remove these checks? (or if not, remove RhostsRSAAuthentication?) -- */ -- --static char * --remote_hostname(struct ssh *ssh) --{ -- struct sockaddr_storage from; -- socklen_t fromlen; -- struct addrinfo hints, *ai, *aitop; -- char name[NI_MAXHOST], ntop2[NI_MAXHOST]; -- const char *ntop = ssh_remote_ipaddr(ssh); -- -- /* Get IP address of client. */ -- fromlen = sizeof(from); -- memset(&from, 0, sizeof(from)); -- if (getpeername(ssh_packet_get_connection_in(ssh), -- (struct sockaddr *)&from, &fromlen) == -1) { -- debug("getpeername failed: %.100s", strerror(errno)); -- return strdup(ntop); -- } -- -- ipv64_normalise_mapped(&from, &fromlen); -- if (from.ss_family == AF_INET6) -- fromlen = sizeof(struct sockaddr_in6); -- -- debug3("Trying to reverse map address %.100s.", ntop); -- /* Map the IP address to a host name. */ -- if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name), -- NULL, 0, NI_NAMEREQD) != 0) { -- /* Host name not found. Use ip address. */ -- return strdup(ntop); -- } -- -- /* -- * if reverse lookup result looks like a numeric hostname, -- * someone is trying to trick us by PTR record like following: -- * 1.1.1.10.in-addr.arpa. IN PTR 2.3.4.5 -- */ -- memset(&hints, 0, sizeof(hints)); -- hints.ai_socktype = SOCK_DGRAM; /*dummy*/ -- hints.ai_flags = AI_NUMERICHOST; -- if (getaddrinfo(name, NULL, &hints, &ai) == 0) { -- logit("Nasty PTR record \"%s\" is set up for %s, ignoring", -- name, ntop); -- freeaddrinfo(ai); -- return strdup(ntop); -- } -- -- /* Names are stored in lowercase. */ -- lowercase(name); -- -- /* -- * Map it back to an IP address and check that the given -- * address actually is an address of this host. This is -- * necessary because anyone with access to a name server can -- * define arbitrary names for an IP address. Mapping from -- * name to IP address can be trusted better (but can still be -- * fooled if the intruder has access to the name server of -- * the domain). -- */ -- memset(&hints, 0, sizeof(hints)); -- hints.ai_family = from.ss_family; -- hints.ai_socktype = SOCK_STREAM; -- if (getaddrinfo(name, NULL, &hints, &aitop) != 0) { -- logit("reverse mapping checking getaddrinfo for %.700s " -- "[%s] failed.", name, ntop); -- return strdup(ntop); -- } -- /* Look for the address from the list of addresses. */ -- for (ai = aitop; ai; ai = ai->ai_next) { -- if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop2, -- sizeof(ntop2), NULL, 0, NI_NUMERICHOST) == 0 && -- (strcmp(ntop, ntop2) == 0)) -- break; -- } -- freeaddrinfo(aitop); -- /* If we reached the end of the list, the address was not there. */ -- if (ai == NULL) { -- /* Address not found for the host name. */ -- logit("Address %.100s maps to %.600s, but this does not " -- "map back to the address.", ntop, name); -- return strdup(ntop); -- } -- return strdup(name); --} -- --/* -- * Return the canonical name of the host in the other side of the current -- * connection. The host name is cached, so it is efficient to call this -- * several times. -- */ -- --const char * --auth_get_canonical_hostname(struct ssh *ssh, int use_dns) --{ -- static char *dnsname; -- -- if (!use_dns) -- return ssh_remote_ipaddr(ssh); -- else if (dnsname != NULL) -- return dnsname; -- else { -- dnsname = remote_hostname(ssh); -- return dnsname; -- } --} -- - /* - * Runs command in a subprocess with a minimal environment. - * Returns pid on success, 0 on failure. -diff --git a/canohost.c b/canohost.c -index abea9c6e..4f4524d2 100644 ---- a/canohost.c -+++ b/canohost.c -@@ -202,3 +202,117 @@ get_local_port(int sock) - { - return get_sock_port(sock, 1); - } -+ -+/* -+ * Returns the remote DNS hostname as a string. The returned string must not -+ * be freed. NB. this will usually trigger a DNS query the first time it is -+ * called. -+ * This function does additional checks on the hostname to mitigate some -+ * attacks on legacy rhosts-style authentication. -+ * XXX is RhostsRSAAuthentication vulnerable to these? -+ * XXX Can we remove these checks? (or if not, remove RhostsRSAAuthentication?) -+ */ -+ -+static char * -+remote_hostname(struct ssh *ssh) -+{ -+ struct sockaddr_storage from; -+ socklen_t fromlen; -+ struct addrinfo hints, *ai, *aitop; -+ char name[NI_MAXHOST], ntop2[NI_MAXHOST]; -+ const char *ntop = ssh_remote_ipaddr(ssh); -+ -+ /* Get IP address of client. */ -+ fromlen = sizeof(from); -+ memset(&from, 0, sizeof(from)); -+ if (getpeername(ssh_packet_get_connection_in(ssh), -+ (struct sockaddr *)&from, &fromlen) < 0) { -+ debug("getpeername failed: %.100s", strerror(errno)); -+ return strdup(ntop); -+ } -+ -+ ipv64_normalise_mapped(&from, &fromlen); -+ if (from.ss_family == AF_INET6) -+ fromlen = sizeof(struct sockaddr_in6); -+ -+ debug3("Trying to reverse map address %.100s.", ntop); -+ /* Map the IP address to a host name. */ -+ if (getnameinfo((struct sockaddr *)&from, fromlen, name, sizeof(name), -+ NULL, 0, NI_NAMEREQD) != 0) { -+ /* Host name not found. Use ip address. */ -+ return strdup(ntop); -+ } -+ -+ /* -+ * if reverse lookup result looks like a numeric hostname, -+ * someone is trying to trick us by PTR record like following: -+ * 1.1.1.10.in-addr.arpa. IN PTR 2.3.4.5 -+ */ -+ memset(&hints, 0, sizeof(hints)); -+ hints.ai_socktype = SOCK_DGRAM; /*dummy*/ -+ hints.ai_flags = AI_NUMERICHOST; -+ if (getaddrinfo(name, NULL, &hints, &ai) == 0) { -+ logit("Nasty PTR record \"%s\" is set up for %s, ignoring", -+ name, ntop); -+ freeaddrinfo(ai); -+ return strdup(ntop); -+ } -+ -+ /* Names are stored in lowercase. */ -+ lowercase(name); -+ -+ /* -+ * Map it back to an IP address and check that the given -+ * address actually is an address of this host. This is -+ * necessary because anyone with access to a name server can -+ * define arbitrary names for an IP address. Mapping from -+ * name to IP address can be trusted better (but can still be -+ * fooled if the intruder has access to the name server of -+ * the domain). -+ */ -+ memset(&hints, 0, sizeof(hints)); -+ hints.ai_family = from.ss_family; -+ hints.ai_socktype = SOCK_STREAM; -+ if (getaddrinfo(name, NULL, &hints, &aitop) != 0) { -+ logit("reverse mapping checking getaddrinfo for %.700s " -+ "[%s] failed.", name, ntop); -+ return strdup(ntop); -+ } -+ /* Look for the address from the list of addresses. */ -+ for (ai = aitop; ai; ai = ai->ai_next) { -+ if (getnameinfo(ai->ai_addr, ai->ai_addrlen, ntop2, -+ sizeof(ntop2), NULL, 0, NI_NUMERICHOST) == 0 && -+ (strcmp(ntop, ntop2) == 0)) -+ break; -+ } -+ freeaddrinfo(aitop); -+ /* If we reached the end of the list, the address was not there. */ -+ if (ai == NULL) { -+ /* Address not found for the host name. */ -+ logit("Address %.100s maps to %.600s, but this does not " -+ "map back to the address.", ntop, name); -+ return strdup(ntop); -+ } -+ return strdup(name); -+} -+ -+/* -+ * Return the canonical name of the host in the other side of the current -+ * connection. The host name is cached, so it is efficient to call this -+ * several times. -+ */ -+ -+const char * -+auth_get_canonical_hostname(struct ssh *ssh, int use_dns) -+{ -+ static char *dnsname; -+ -+ if (!use_dns) -+ return ssh_remote_ipaddr(ssh); -+ else if (dnsname != NULL) -+ return dnsname; -+ else { -+ dnsname = remote_hostname(ssh); -+ return dnsname; -+ } -+} -diff --git a/readconf.c b/readconf.c -index f78b4d6f..747287f7 100644 ---- a/readconf.c -+++ b/readconf.c -@@ -162,6 +162,7 @@ typedef enum { - oClearAllForwardings, oNoHostAuthenticationForLocalhost, - oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout, - oAddressFamily, oGssAuthentication, oGssDelegateCreds, -+ oGssTrustDns, - oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly, - oSendEnv, oSetEnv, oControlPath, oControlMaster, oControlPersist, - oHashKnownHosts, -@@ -203,9 +204,11 @@ static struct { - #if defined(GSSAPI) - { "gssapiauthentication", oGssAuthentication }, - { "gssapidelegatecredentials", oGssDelegateCreds }, -+ { "gssapitrustdns", oGssTrustDns }, - # else - { "gssapiauthentication", oUnsupported }, - { "gssapidelegatecredentials", oUnsupported }, -+ { "gssapitrustdns", oUnsupported }, - #endif - #ifdef ENABLE_PKCS11 - { "pkcs11provider", oPKCS11Provider }, -@@ -992,6 +995,10 @@ parse_time: - intptr = &options->gss_deleg_creds; - goto parse_flag; - -+ case oGssTrustDns: -+ intptr = &options->gss_trust_dns; -+ goto parse_flag; -+ - case oBatchMode: - intptr = &options->batch_mode; - goto parse_flag; -@@ -1864,6 +1871,7 @@ initialize_options(Options * options) - options->challenge_response_authentication = -1; - options->gss_authentication = -1; - options->gss_deleg_creds = -1; -+ options->gss_trust_dns = -1; - options->password_authentication = -1; - options->kbd_interactive_authentication = -1; - options->kbd_interactive_devices = NULL; -@@ -2011,6 +2019,8 @@ fill_default_options(Options * options) - options->gss_authentication = 0; - if (options->gss_deleg_creds == -1) - options->gss_deleg_creds = 0; -+ if (options->gss_trust_dns == -1) -+ options->gss_trust_dns = 0; - if (options->password_authentication == -1) - options->password_authentication = 1; - if (options->kbd_interactive_authentication == -1) -diff --git a/readconf.h b/readconf.h -index 8e36bf32..c9e4718d 100644 ---- a/readconf.h -+++ b/readconf.h -@@ -41,6 +41,7 @@ typedef struct { - /* Try S/Key or TIS, authentication. */ - int gss_authentication; /* Try GSS authentication */ - int gss_deleg_creds; /* Delegate GSS credentials */ -+ int gss_trust_dns; /* Trust DNS for GSS canonicalization */ - int password_authentication; /* Try password - * authentication. */ - int kbd_interactive_authentication; /* Try keyboard-interactive auth. */ -diff --git a/ssh_config.5 b/ssh_config.5 -index 02a87892..95de538b 100644 ---- a/ssh_config.5 -+++ b/ssh_config.5 -@@ -762,6 +762,16 @@ The default is - Forward (delegate) credentials to the server. - The default is - .Cm no . -+Note that this option applies to protocol version 2 connections using GSSAPI. -+.It Cm GSSAPITrustDns -+Set to -+.Dq yes to indicate that the DNS is trusted to securely canonicalize -+the name of the host being connected to. If -+.Dq no, the hostname entered on the -+command line will be passed untouched to the GSSAPI library. -+The default is -+.Dq no . -+This option only applies to protocol version 2 connections using GSSAPI. - .It Cm HashKnownHosts - Indicates that - .Xr ssh 1 -diff --git a/sshconnect2.c b/sshconnect2.c -index 87fa70a4..a6ffdc96 100644 ---- a/sshconnect2.c -+++ b/sshconnect2.c -@@ -697,6 +697,13 @@ userauth_gssapi(struct ssh *ssh) - OM_uint32 min; - int r, ok = 0; - gss_OID mech = NULL; -+ const char *gss_host; -+ -+ if (options.gss_trust_dns) { -+ extern const char *auth_get_canonical_hostname(struct ssh *ssh, int use_dns); -+ gss_host = auth_get_canonical_hostname(ssh, 1); -+ } else -+ gss_host = authctxt->host; - - /* Try one GSSAPI method at a time, rather than sending them all at - * once. */ -@@ -711,7 +718,7 @@ userauth_gssapi(struct ssh *ssh) - elements[authctxt->mech_tried]; - /* My DER encoding requires length<128 */ - if (mech->length < 128 && ssh_gssapi_check_mechanism(&gssctxt, -- mech, authctxt->host)) { -+ mech, gss_host)) { - ok = 1; /* Mechanism works */ - } else { - authctxt->mech_tried++; diff --git a/net-misc/openssh/files/openssh-8.1_p1-X509-12.3-tests.patch b/net-misc/openssh/files/openssh-8.1_p1-X509-12.3-tests.patch deleted file mode 100644 index 67a93fe2a0b1..000000000000 --- a/net-misc/openssh/files/openssh-8.1_p1-X509-12.3-tests.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- a/openbsd-compat/regress/Makefile.in 2019-06-17 10:59:01.210601434 -0700 -+++ b/openbsd-compat/regress/Makefile.in 2019-06-17 10:59:18.753485852 -0700 -@@ -7,7 +7,7 @@ - CC=@CC@ - LD=@LD@ - CFLAGS=@CFLAGS@ --CPPFLAGS=-I. -I.. -I$(srcdir) -I$(srcdir)/.. @CPPFLAGS@ @DEFS@ -+CPPFLAGS=-I. -I.. -I../.. -I$(srcdir) -I$(srcdir)/.. @CPPFLAGS@ @DEFS@ - EXEEXT=@EXEEXT@ - LIBCOMPAT=../libopenbsd-compat.a - LIBS=@LIBS@ diff --git a/net-misc/openssh/files/openssh-8.1_p1-X509-glue-12.3.patch b/net-misc/openssh/files/openssh-8.1_p1-X509-glue-12.3.patch deleted file mode 100644 index 48cce797904e..000000000000 --- a/net-misc/openssh/files/openssh-8.1_p1-X509-glue-12.3.patch +++ /dev/null @@ -1,35 +0,0 @@ -Only in b: .openssh-8.1p1+x509-12.3.diff.un~ -diff -ur a/openssh-8.1p1+x509-12.3.diff b/openssh-8.1p1+x509-12.3.diff ---- a/openssh-8.1p1+x509-12.3.diff 2019-10-14 11:33:45.796485604 -0700 -+++ b/openssh-8.1p1+x509-12.3.diff 2019-10-14 11:39:44.960312587 -0700 -@@ -35343,12 +35343,11 @@ - - install: $(CONFIGFILES) $(MANPAGES) $(TARGETS) install-files install-sysconf host-key check-config - install-nokeys: $(CONFIGFILES) $(MANPAGES) $(TARGETS) install-files install-sysconf --@@ -339,6 +360,8 @@ -+@@ -339,6 +360,7 @@ - $(MKDIR_P) $(DESTDIR)$(mandir)/$(mansubdir)5 - $(MKDIR_P) $(DESTDIR)$(mandir)/$(mansubdir)8 - $(MKDIR_P) $(DESTDIR)$(libexecdir) - + $(MKDIR_P) $(DESTDIR)$(sshcadir) --+ $(MKDIR_P) $(DESTDIR)$(piddir) - $(MKDIR_P) -m 0755 $(DESTDIR)$(PRIVSEP_PATH) - $(INSTALL) -m 0755 $(STRIP_OPT) ssh$(EXEEXT) $(DESTDIR)$(bindir)/ssh$(EXEEXT) - $(INSTALL) -m 0755 $(STRIP_OPT) scp$(EXEEXT) $(DESTDIR)$(bindir)/scp$(EXEEXT) -@@ -83536,16 +83535,6 @@ - + return mbtowc(NULL, s, n); - +} - +#endif --diff -ruN openssh-8.1p1/version.h openssh-8.1p1+x509-12.3/version.h ----- openssh-8.1p1/version.h 2019-10-09 03:31:03.000000000 +0300 --+++ openssh-8.1p1+x509-12.3/version.h 2019-10-13 09:07:00.000000000 +0300 --@@ -2,5 +2,4 @@ -- -- #define SSH_VERSION "OpenSSH_8.1" -- ---#define SSH_PORTABLE "p1" ---#define SSH_RELEASE SSH_VERSION SSH_PORTABLE --+#define SSH_RELEASE PACKAGE_STRING ", " SSH_VERSION "p1" - diff -ruN openssh-8.1p1/version.m4 openssh-8.1p1+x509-12.3/version.m4 - --- openssh-8.1p1/version.m4 1970-01-01 02:00:00.000000000 +0200 - +++ openssh-8.1p1+x509-12.3/version.m4 2019-10-13 09:07:00.000000000 +0300 diff --git a/net-misc/openssh/files/openssh-8.1_p1-hpn-14.20-glue.patch b/net-misc/openssh/files/openssh-8.1_p1-hpn-14.20-glue.patch deleted file mode 100644 index 90fa248fcbac..000000000000 --- a/net-misc/openssh/files/openssh-8.1_p1-hpn-14.20-glue.patch +++ /dev/null @@ -1,105 +0,0 @@ -diff -ur a/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff b/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff ---- a/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff 2020-02-04 14:55:30.408567718 -0800 -+++ b/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff 2020-02-04 15:16:14.646567224 -0800 -@@ -409,18 +409,10 @@ - index 817da43b..b2bcf78f 100644 - --- a/packet.c - +++ b/packet.c --@@ -925,6 +925,24 @@ ssh_set_newkeys(struct ssh *ssh, int mode) -+@@ -925,6 +925,16 @@ ssh_set_newkeys(struct ssh *ssh, int mode) - return 0; - } - --+/* this supports the forced rekeying required for the NONE cipher */ --+int rekey_requested = 0; --+void --+packet_request_rekeying(void) --+{ --+ rekey_requested = 1; --+} --+ - +/* used to determine if pre or post auth when rekeying for aes-ctr - + * and none cipher switch */ - +int -@@ -434,20 +426,6 @@ - #define MAX_PACKETS (1U<<31) - static int - ssh_packet_need_rekeying(struct ssh *ssh, u_int outbound_packet_len) --@@ -951,6 +969,13 @@ ssh_packet_need_rekeying(struct ssh *ssh, u_int outbound_packet_len) -- if (state->p_send.packets == 0 && state->p_read.packets == 0) -- return 0; -- --+ /* used to force rekeying when called for by the none --+ * cipher switch methods -cjr */ --+ if (rekey_requested == 1) { --+ rekey_requested = 0; --+ return 1; --+ } --+ -- /* Time-based rekeying */ -- if (state->rekey_interval != 0 && -- (int64_t)state->rekey_time + state->rekey_interval <= monotime()) - diff --git a/packet.h b/packet.h - index 8ccfd2e0..1ad9bc06 100644 - --- a/packet.h -@@ -476,9 +454,9 @@ - /* Format of the configuration file: - - @@ -167,6 +168,8 @@ typedef enum { -- oHashKnownHosts, - oTunnel, oTunnelDevice, - oLocalCommand, oPermitLocalCommand, oRemoteCommand, -+ oDisableMTAES, - + oTcpRcvBufPoll, oTcpRcvBuf, oHPNDisabled, oHPNBufferSize, - + oNoneEnabled, oNoneSwitch, - oVisualHostKey, -@@ -615,9 +593,9 @@ - int ip_qos_bulk; /* IP ToS/DSCP/class for bulk traffic */ - SyslogFacility log_facility; /* Facility for system logging. */ - @@ -112,7 +116,10 @@ typedef struct { -- - int enable_ssh_keysign; - int64_t rekey_limit; -+ int disable_multithreaded; /*disable multithreaded aes-ctr*/ - + int none_switch; /* Use none cipher */ - + int none_enabled; /* Allow none to be used */ - int rekey_interval; -@@ -700,9 +678,9 @@ - + options->hpn_buffer_size = CHAN_TCP_WINDOW_DEFAULT; - + } - + -+ if (options->disable_multithreaded == -1) -+ options->disable_multithreaded = 0; - if (options->ip_qos_interactive == -1) -- options->ip_qos_interactive = IPTOS_DSCP_AF21; -- if (options->ip_qos_bulk == -1) - @@ -486,6 +532,8 @@ typedef enum { - sPasswordAuthentication, sKbdInteractiveAuthentication, - sListenAddress, sAddressFamily, -@@ -1079,11 +1057,11 @@ - xxx_host = host; - xxx_hostaddr = hostaddr; - --@@ -422,6 +433,28 @@ ssh_userauth2(struct ssh *ssh, const char *local_user, -+@@ -422,7 +433,28 @@ ssh_userauth2(struct ssh *ssh, const char *local_user, - - if (!authctxt.success) - fatal("Authentication failed."); --+ -+ - + /* - + * If the user wants to use the none cipher, do it post authentication - + * and only if the right conditions are met -- both of the NONE commands -@@ -1105,9 +1083,9 @@ - + } - + } - + -- debug("Authentication succeeded (%s).", authctxt.method->name); -- } -- -+ #ifdef WITH_OPENSSL -+ if (options.disable_multithreaded == 0) { -+ /* if we are using aes-ctr there can be issues in either a fork or sandbox - diff --git a/sshd.c b/sshd.c - index 11571c01..23a06022 100644 - --- a/sshd.c diff --git a/net-misc/openssh/files/openssh-8.1_p1-hpn-14.20-sctp-glue.patch b/net-misc/openssh/files/openssh-8.1_p1-hpn-14.20-sctp-glue.patch deleted file mode 100644 index 3f5c7a47d9c8..000000000000 --- a/net-misc/openssh/files/openssh-8.1_p1-hpn-14.20-sctp-glue.patch +++ /dev/null @@ -1,19 +0,0 @@ -diff -ur a/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff b/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff ---- a/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff 2020-02-04 14:55:30.408567718 -0800 -+++ b/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff 2020-02-04 16:36:51.394069720 -0800 -@@ -1191,15 +1191,3 @@ - # Example of overriding settings on a per-user basis - #Match User anoncvs - # X11Forwarding no --diff --git a/version.h b/version.h --index 6b3fadf8..ec1d2e27 100644 ----- a/version.h --+++ b/version.h --@@ -3,4 +3,6 @@ -- #define SSH_VERSION "OpenSSH_8.1" -- -- #define SSH_PORTABLE "p1" ---#define SSH_RELEASE SSH_VERSION SSH_PORTABLE --+#define SSH_HPN "-hpn14v20" --+#define SSH_RELEASE SSH_VERSION SSH_PORTABLE SSH_HPN --+ diff --git a/net-misc/openssh/files/openssh-8.1_p1-tests-2020.patch b/net-misc/openssh/files/openssh-8.1_p1-tests-2020.patch deleted file mode 100644 index 505e34db9d20..000000000000 --- a/net-misc/openssh/files/openssh-8.1_p1-tests-2020.patch +++ /dev/null @@ -1,26 +0,0 @@ -diff --git a/regress/cert-hostkey.sh b/regress/cert-hostkey.sh -index 86ea6250..844adabc 100644 ---- a/regress/cert-hostkey.sh -+++ b/regress/cert-hostkey.sh -@@ -252,7 +252,7 @@ test_one() { - test_one "user-certificate" failure "-n $HOSTS" - test_one "empty principals" success "-h" - test_one "wrong principals" failure "-h -n foo" --test_one "cert not yet valid" failure "-h -V20200101:20300101" -+test_one "cert not yet valid" failure "-h -V20300101:20320101" - test_one "cert expired" failure "-h -V19800101:19900101" - test_one "cert valid interval" success "-h -V-1w:+2w" - test_one "cert has constraints" failure "-h -Oforce-command=false" -diff --git a/regress/cert-userkey.sh b/regress/cert-userkey.sh -index 38c14a69..5cd02fc3 100644 ---- a/regress/cert-userkey.sh -+++ b/regress/cert-userkey.sh -@@ -338,7 +338,7 @@ test_one() { - test_one "correct principal" success "-n ${USER}" - test_one "host-certificate" failure "-n ${USER} -h" - test_one "wrong principals" failure "-n foo" --test_one "cert not yet valid" failure "-n ${USER} -V20200101:20300101" -+test_one "cert not yet valid" failure "-n ${USER} -V20300101:20320101" - test_one "cert expired" failure "-n ${USER} -V19800101:19900101" - test_one "cert valid interval" success "-n ${USER} -V-1w:+2w" - test_one "wrong source-address" failure "-n ${USER} -Osource-address=10.0.0.0/8" diff --git a/net-misc/openssh/files/openssh-8.2_p1-X509-12.4.3-tests.patch b/net-misc/openssh/files/openssh-8.2_p1-X509-12.4.3-tests.patch deleted file mode 100644 index 1c58d0d5d823..000000000000 --- a/net-misc/openssh/files/openssh-8.2_p1-X509-12.4.3-tests.patch +++ /dev/null @@ -1,11 +0,0 @@ ---- a/openbsd-compat/regress/Makefile.in 2020-02-15 10:59:01.210601434 -0700 -+++ b/openbsd-compat/regress/Makefile.in 2020-02-15 10:59:18.753485852 -0700 -@@ -7,7 +7,7 @@ - CC=@CC@ - LD=@LD@ - CFLAGS=@CFLAGS@ --CPPFLAGS=-I. -I.. -I$(srcdir) -I$(srcdir)/.. @CPPFLAGS@ @DEFS@ -+CPPFLAGS=-I. -I.. -I../.. -I$(srcdir) -I$(srcdir)/.. @CPPFLAGS@ @DEFS@ - EXEEXT=@EXEEXT@ - LIBCOMPAT=../libopenbsd-compat.a - LIBS=@LIBS@ diff --git a/net-misc/openssh/files/openssh-8.2_p1-X509-glue-12.4.3.patch b/net-misc/openssh/files/openssh-8.2_p1-X509-glue-12.4.3.patch deleted file mode 100644 index e73c499d5c4e..000000000000 --- a/net-misc/openssh/files/openssh-8.2_p1-X509-glue-12.4.3.patch +++ /dev/null @@ -1,128 +0,0 @@ ---- a/openssh-8.2p1+x509-12.4.3.diff 2020-03-21 11:15:05.939809371 -0700 -+++ b/openssh-8.2p1+x509-12.4.3.diff 2020-03-21 11:23:15.424752355 -0700 -@@ -39298,16 +39298,15 @@ - - install: $(CONFIGFILES) $(MANPAGES) $(TARGETS) install-files install-sysconf host-key check-config - install-nokeys: $(CONFIGFILES) $(MANPAGES) $(TARGETS) install-files install-sysconf --@@ -378,6 +379,8 @@ -+@@ -378,6 +379,7 @@ - $(MKDIR_P) $(DESTDIR)$(mandir)/$(mansubdir)5 - $(MKDIR_P) $(DESTDIR)$(mandir)/$(mansubdir)8 - $(MKDIR_P) $(DESTDIR)$(libexecdir) - + $(MKDIR_P) $(DESTDIR)$(sshcadir) --+ $(MKDIR_P) $(DESTDIR)$(piddir) - $(MKDIR_P) -m 0755 $(DESTDIR)$(PRIVSEP_PATH) - $(INSTALL) -m 0755 $(STRIP_OPT) ssh$(EXEEXT) $(DESTDIR)$(bindir)/ssh$(EXEEXT) - $(INSTALL) -m 0755 $(STRIP_OPT) scp$(EXEEXT) $(DESTDIR)$(bindir)/scp$(EXEEXT) --@@ -386,11 +389,14 @@ -+@@ -386,11 +388,14 @@ - $(INSTALL) -m 0755 $(STRIP_OPT) ssh-keygen$(EXEEXT) $(DESTDIR)$(bindir)/ssh-keygen$(EXEEXT) - $(INSTALL) -m 0755 $(STRIP_OPT) ssh-keyscan$(EXEEXT) $(DESTDIR)$(bindir)/ssh-keyscan$(EXEEXT) - $(INSTALL) -m 0755 $(STRIP_OPT) sshd$(EXEEXT) $(DESTDIR)$(sbindir)/sshd$(EXEEXT) -@@ -39326,7 +39325,7 @@ - $(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1 - $(INSTALL) -m 644 scp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1 - $(INSTALL) -m 644 ssh-add.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1 --@@ -400,12 +406,12 @@ -+@@ -400,12 +405,12 @@ - $(INSTALL) -m 644 moduli.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/moduli.5 - $(INSTALL) -m 644 sshd_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/sshd_config.5 - $(INSTALL) -m 644 ssh_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/ssh_config.5 -@@ -39340,7 +39339,7 @@ - - install-sysconf: - $(MKDIR_P) $(DESTDIR)$(sysconfdir) --@@ -463,10 +469,9 @@ -+@@ -463,10 +468,9 @@ - -rm -f $(DESTDIR)$(bindir)/ssh-keyscan$(EXEEXT) - -rm -f $(DESTDIR)$(bindir)/sftp$(EXEEXT) - -rm -f $(DESTDIR)$(sbindir)/sshd$(EXEEXT) -@@ -39354,7 +39353,7 @@ - -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1 - -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1 - -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1 --@@ -478,7 +483,6 @@ -+@@ -478,7 +482,6 @@ - -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8 - -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8 - -rm -f $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8 -@@ -39362,7 +39361,7 @@ - - regress-prep: - $(MKDIR_P) `pwd`/regress/unittests/test_helper --@@ -491,11 +495,11 @@ -+@@ -491,11 +494,11 @@ - $(MKDIR_P) `pwd`/regress/unittests/match - $(MKDIR_P) `pwd`/regress/unittests/utf8 - $(MKDIR_P) `pwd`/regress/misc/kexfuzz -@@ -39376,7 +39375,7 @@ - - regress/modpipe$(EXEEXT): $(srcdir)/regress/modpipe.c $(REGRESSLIBS) - $(CC) $(CFLAGS) $(CPPFLAGS) -o $@ $(srcdir)/regress/modpipe.c \ --@@ -546,8 +550,7 @@ -+@@ -546,8 +549,7 @@ - regress/unittests/sshkey/tests.o \ - regress/unittests/sshkey/common.o \ - regress/unittests/sshkey/test_file.o \ -@@ -39406,7 +39405,7 @@ - - regress/unittests/hostkeys/test_hostkeys$(EXEEXT): \ - ${UNITTESTS_TEST_HOSTKEYS_OBJS} \ --@@ -618,35 +619,18 @@ -+@@ -618,35 +618,18 @@ - -lssh -lopenbsd-compat -lssh -lopenbsd-compat $(LIBS) - - MISC_KEX_FUZZ_OBJS=\ -@@ -39444,7 +39443,7 @@ - regress/unittests/sshbuf/test_sshbuf$(EXEEXT) \ - regress/unittests/sshkey/test_sshkey$(EXEEXT) \ - regress/unittests/bitmap/test_bitmap$(EXEEXT) \ --@@ -657,36 +641,29 @@ -+@@ -657,36 +640,29 @@ - regress/unittests/utf8/test_utf8$(EXEEXT) \ - regress/misc/kexfuzz/kexfuzz$(EXEEXT) - -@@ -39501,7 +39500,7 @@ - TEST_SSH_IPV6="@TEST_SSH_IPV6@" ; \ - TEST_SSH_UTF8="@TEST_SSH_UTF8@" ; \ - TEST_SSH_ECC="@TEST_SSH_ECC@" ; \ --@@ -708,8 +685,6 @@ -+@@ -708,8 +684,6 @@ - TEST_SSH_SSHPKCS11HELPER="$${TEST_SSH_SSHPKCS11HELPER}" \ - TEST_SSH_SSHKEYSCAN="$${TEST_SSH_SSHKEYSCAN}" \ - TEST_SSH_SFTP="$${TEST_SSH_SFTP}" \ -@@ -39510,7 +39509,7 @@ - TEST_SSH_SFTPSERVER="$${TEST_SSH_SFTPSERVER}" \ - TEST_SSH_PLINK="$${TEST_SSH_PLINK}" \ - TEST_SSH_PUTTYGEN="$${TEST_SSH_PUTTYGEN}" \ --@@ -717,17 +692,35 @@ -+@@ -717,17 +691,35 @@ - TEST_SSH_IPV6="$${TEST_SSH_IPV6}" \ - TEST_SSH_UTF8="$${TEST_SSH_UTF8}" \ - TEST_SSH_ECC="$${TEST_SSH_ECC}" \ -@@ -39549,7 +39548,7 @@ - - survey: survey.sh ssh - @$(SHELL) ./survey.sh > survey --@@ -743,4 +736,8 @@ -+@@ -743,4 +735,8 @@ - sh buildpkg.sh; \ - fi - -@@ -98215,16 +98214,6 @@ - + return mbtowc(NULL, s, n); - +} - +#endif --diff -ruN openssh-8.2p1/version.h openssh-8.2p1+x509-12.4.3/version.h ----- openssh-8.2p1/version.h 2020-02-14 02:40:54.000000000 +0200 --+++ openssh-8.2p1+x509-12.4.3/version.h 2020-03-21 19:07:00.000000000 +0200 --@@ -2,5 +2,4 @@ -- -- #define SSH_VERSION "OpenSSH_8.2" -- ---#define SSH_PORTABLE "p1" ---#define SSH_RELEASE SSH_VERSION SSH_PORTABLE --+#define SSH_RELEASE PACKAGE_STRING ", " SSH_VERSION "p1" - diff -ruN openssh-8.2p1/version.m4 openssh-8.2p1+x509-12.4.3/version.m4 - --- openssh-8.2p1/version.m4 1970-01-01 02:00:00.000000000 +0200 - +++ openssh-8.2p1+x509-12.4.3/version.m4 2020-03-21 19:07:00.000000000 +0200 diff --git a/net-misc/openssh/files/openssh-8.2_p1-hpn-14.20-X509-glue.patch b/net-misc/openssh/files/openssh-8.2_p1-hpn-14.20-X509-glue.patch deleted file mode 100644 index 5af4534ce77c..000000000000 --- a/net-misc/openssh/files/openssh-8.2_p1-hpn-14.20-X509-glue.patch +++ /dev/null @@ -1,133 +0,0 @@ -diff -ur '--exclude=*.un~' a/openssh-8_1_P1-hpn-AES-CTR-14.20.diff b/openssh-8_1_P1-hpn-AES-CTR-14.20.diff ---- a/openssh-8_1_P1-hpn-AES-CTR-14.20.diff 2020-02-15 13:41:56.143193830 -0800 -+++ b/openssh-8_1_P1-hpn-AES-CTR-14.20.diff 2020-02-15 13:46:40.060133610 -0800 -@@ -3,9 +3,9 @@ - --- a/Makefile.in - +++ b/Makefile.in - @@ -42,7 +42,7 @@ CC=@CC@ -- CFLAGS_NOPIE=@CFLAGS_NOPIE@ -- CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ $(PATHS) @DEFS@ -- PICFLAG=@PICFLAG@ -+ LD=@LD@ -+ CFLAGS=@CFLAGS@ $(CFLAGS_EXTRA) -+ CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ @LDAP_CPPFLAGS@ $(PATHS) @DEFS@ - -LIBS=@LIBS@ - +LIBS=@LIBS@ -lpthread - K5LIBS=@K5LIBS@ -@@ -803,8 +803,8 @@ - ssh_packet_set_connection(struct ssh *ssh, int fd_in, int fd_out) - { - struct session_state *state; --- const struct sshcipher *none = cipher_by_name("none"); --+ struct sshcipher *none = cipher_by_name("none"); -+- const struct sshcipher *none = cipher_none(); -++ struct sshcipher *none = cipher_none(); - int r; - - if (none == NULL) { -@@ -902,14 +902,14 @@ - - /* - @@ -2118,6 +2125,8 @@ fill_default_options(Options * options) -- options->canonicalize_hostname = SSH_CANONICALISE_NO; -- if (options->fingerprint_hash == -1) - options->fingerprint_hash = SSH_FP_HASH_DEFAULT; -+ if (options->update_hostkeys == -1) -+ options->update_hostkeys = 0; - + if (options->disable_multithreaded == -1) - + options->disable_multithreaded = 0; -- #ifdef ENABLE_SK_INTERNAL - if (options->sk_provider == NULL) -- options->sk_provider = xstrdup("internal"); -+ options->sk_provider = xstrdup("$SSH_SK_PROVIDER"); -+ - diff --git a/readconf.h b/readconf.h - index 8e36bf32..c803eca7 100644 - --- a/readconf.h -@@ -948,9 +948,9 @@ - /* Portable-specific options */ - sUsePAM, - + sDisableMTAES, -- /* Standard Options */ -- sPort, sHostKeyFile, sLoginGraceTime, -- sPermitRootLogin, sLogFacility, sLogLevel, -+ /* X.509 Standard Options */ -+ sHostbasedAlgorithms, -+ sPubkeyAlgorithms, - @@ -643,6 +647,7 @@ static struct { - { "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL }, - { "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL }, -Only in b: openssh-8_1_P1-hpn-AES-CTR-14.20.diff.orig -diff -ur '--exclude=*.un~' a/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff b/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff ---- a/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff 2020-02-15 13:41:56.144193830 -0800 -+++ b/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff 2020-02-15 13:45:36.665147504 -0800 -@@ -382,7 +382,7 @@ - @@ -884,6 +884,10 @@ kex_choose_conf(struct ssh *ssh) - int nenc, nmac, ncomp; - u_int mode, ctos, need, dh_need, authlen; -- int r, first_kex_follows; -+ int r, first_kex_follows = 0; - + int auth_flag; - + - + auth_flag = packet_authentication_state(ssh); -@@ -391,8 +391,8 @@ - debug2("local %s KEXINIT proposal", kex->server ? "server" : "client"); - if ((r = kex_buf2prop(kex->my, NULL, &my)) != 0) - @@ -954,6 +958,14 @@ kex_choose_conf(struct ssh *ssh) -- peer[ncomp] = NULL; -- goto out; -+ else -+ fatal("Pre-authentication none cipher requests are not allowed."); - } - + debug("REQUESTED ENC.NAME is '%s'", newkeys->enc.name); - + if (strcmp(newkeys->enc.name, "none") == 0) { -@@ -1169,15 +1169,3 @@ - # Example of overriding settings on a per-user basis - #Match User anoncvs - # X11Forwarding no --diff --git a/version.h b/version.h --index 6b3fadf8..ec1d2e27 100644 ----- a/version.h --+++ b/version.h --@@ -3,4 +3,6 @@ -- #define SSH_VERSION "OpenSSH_8.1" -- -- #define SSH_PORTABLE "p1" ---#define SSH_RELEASE SSH_VERSION SSH_PORTABLE --+#define SSH_HPN "-hpn14v20" --+#define SSH_RELEASE SSH_VERSION SSH_PORTABLE SSH_HPN --+ -diff -ur '--exclude=*.un~' a/openssh-8_1_P1-hpn-PeakTput-14.20.diff b/openssh-8_1_P1-hpn-PeakTput-14.20.diff ---- a/openssh-8_1_P1-hpn-PeakTput-14.20.diff 2020-02-15 13:41:43.834196317 -0800 -+++ b/openssh-8_1_P1-hpn-PeakTput-14.20.diff 2020-02-15 13:45:36.665147504 -0800 -@@ -12,9 +12,9 @@ - static long stalled; /* how long we have been stalled */ - static int bytes_per_second; /* current speed in bytes per second */ - @@ -127,6 +129,7 @@ refresh_progress_meter(int force_update) -+ off_t bytes_left; - int cur_speed; -- int hours, minutes, seconds; -- int file_len; -+ int len; - + off_t delta_pos; - - if ((!force_update && !alarm_fired && !win_resized) || !can_output()) -@@ -33,12 +33,12 @@ - @@ -166,7 +173,7 @@ refresh_progress_meter(int force_update) - - /* filename */ -- buf[0] = '\0'; --- file_len = win_size - 36; --+ file_len = win_size - 45; -- if (file_len > 0) { -- buf[0] = '\r'; -- snmprintf(buf+1, sizeof(buf)-1, &file_len, "%-*s", -+ if (win_size > 36) { -+- int file_len = win_size - 36; -++ int file_len = win_size - 45; -+ snmprintf(buf+1, sizeof(buf)-1, &file_len, "%-*s ", -+ file_len, file); -+ } - @@ -191,6 +198,15 @@ refresh_progress_meter(int force_update) - (off_t)bytes_per_second); - strlcat(buf, "/s ", win_size); diff --git a/net-misc/openssh/files/openssh-8.2_p1-hpn-14.20-glue.patch b/net-misc/openssh/files/openssh-8.2_p1-hpn-14.20-glue.patch deleted file mode 100644 index b2163fe5ad56..000000000000 --- a/net-misc/openssh/files/openssh-8.2_p1-hpn-14.20-glue.patch +++ /dev/null @@ -1,151 +0,0 @@ -diff -ur '--exclude=*.un~' a/openssh-8_1_P1-hpn-AES-CTR-14.20.diff b/openssh-8_1_P1-hpn-AES-CTR-14.20.diff ---- a/openssh-8_1_P1-hpn-AES-CTR-14.20.diff 2020-02-15 12:50:44.413776914 -0800 -+++ b/openssh-8_1_P1-hpn-AES-CTR-14.20.diff 2020-02-15 12:53:06.190742744 -0800 -@@ -3,9 +3,9 @@ - --- a/Makefile.in - +++ b/Makefile.in - @@ -42,7 +42,7 @@ CC=@CC@ -- LD=@LD@ -- CFLAGS=@CFLAGS@ -+ CFLAGS_NOPIE=@CFLAGS_NOPIE@ - CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ $(PATHS) @DEFS@ -+ PICFLAG=@PICFLAG@ - -LIBS=@LIBS@ - +LIBS=@LIBS@ -lpthread - K5LIBS=@K5LIBS@ -@@ -902,14 +902,14 @@ - - /* - @@ -2118,6 +2125,8 @@ fill_default_options(Options * options) -+ options->canonicalize_hostname = SSH_CANONICALISE_NO; -+ if (options->fingerprint_hash == -1) - options->fingerprint_hash = SSH_FP_HASH_DEFAULT; -- if (options->update_hostkeys == -1) -- options->update_hostkeys = 0; - + if (options->disable_multithreaded == -1) - + options->disable_multithreaded = 0; -- -- /* Expand KEX name lists */ -- all_cipher = cipher_alg_list(',', 0); -+ #ifdef ENABLE_SK_INTERNAL -+ if (options->sk_provider == NULL) -+ options->sk_provider = xstrdup("internal"); - diff --git a/readconf.h b/readconf.h - index 8e36bf32..c803eca7 100644 - --- a/readconf.h -@@ -952,9 +952,9 @@ - sPort, sHostKeyFile, sLoginGraceTime, - sPermitRootLogin, sLogFacility, sLogLevel, - @@ -643,6 +647,7 @@ static struct { -- { "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL }, - { "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL }, - { "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL }, -+ { "include", sInclude, SSHCFG_ALL }, - + { "disableMTAES", sDisableMTAES, SSHCFG_ALL }, - { "ipqos", sIPQoS, SSHCFG_ALL }, - { "authorizedkeyscommand", sAuthorizedKeysCommand, SSHCFG_ALL }, -diff -ur '--exclude=*.un~' a/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff b/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff ---- a/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff 2020-02-15 12:50:44.413776914 -0800 -+++ b/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff 2020-02-15 12:51:19.541768656 -0800 -@@ -409,18 +409,10 @@ - index 817da43b..b2bcf78f 100644 - --- a/packet.c - +++ b/packet.c --@@ -925,6 +925,24 @@ ssh_set_newkeys(struct ssh *ssh, int mode) -+@@ -925,6 +925,16 @@ ssh_set_newkeys(struct ssh *ssh, int mode) - return 0; - } - --+/* this supports the forced rekeying required for the NONE cipher */ --+int rekey_requested = 0; --+void --+packet_request_rekeying(void) --+{ --+ rekey_requested = 1; --+} --+ - +/* used to determine if pre or post auth when rekeying for aes-ctr - + * and none cipher switch */ - +int -@@ -434,20 +426,6 @@ - #define MAX_PACKETS (1U<<31) - static int - ssh_packet_need_rekeying(struct ssh *ssh, u_int outbound_packet_len) --@@ -951,6 +969,13 @@ ssh_packet_need_rekeying(struct ssh *ssh, u_int outbound_packet_len) -- if (state->p_send.packets == 0 && state->p_read.packets == 0) -- return 0; -- --+ /* used to force rekeying when called for by the none --+ * cipher switch methods -cjr */ --+ if (rekey_requested == 1) { --+ rekey_requested = 0; --+ return 1; --+ } --+ -- /* Time-based rekeying */ -- if (state->rekey_interval != 0 && -- (int64_t)state->rekey_time + state->rekey_interval <= monotime()) - diff --git a/packet.h b/packet.h - index 8ccfd2e0..1ad9bc06 100644 - --- a/packet.h -@@ -476,9 +454,9 @@ - /* Format of the configuration file: - - @@ -167,6 +168,8 @@ typedef enum { -- oHashKnownHosts, - oTunnel, oTunnelDevice, - oLocalCommand, oPermitLocalCommand, oRemoteCommand, -+ oDisableMTAES, - + oTcpRcvBufPoll, oTcpRcvBuf, oHPNDisabled, oHPNBufferSize, - + oNoneEnabled, oNoneSwitch, - oVisualHostKey, -@@ -615,9 +593,9 @@ - int ip_qos_bulk; /* IP ToS/DSCP/class for bulk traffic */ - SyslogFacility log_facility; /* Facility for system logging. */ - @@ -112,7 +116,10 @@ typedef struct { -- - int enable_ssh_keysign; - int64_t rekey_limit; -+ int disable_multithreaded; /*disable multithreaded aes-ctr*/ - + int none_switch; /* Use none cipher */ - + int none_enabled; /* Allow none to be used */ - int rekey_interval; -@@ -700,9 +678,9 @@ - + options->hpn_buffer_size = CHAN_TCP_WINDOW_DEFAULT; - + } - + -+ if (options->disable_multithreaded == -1) -+ options->disable_multithreaded = 0; - if (options->ip_qos_interactive == -1) -- options->ip_qos_interactive = IPTOS_DSCP_AF21; -- if (options->ip_qos_bulk == -1) - @@ -486,6 +532,8 @@ typedef enum { - sPasswordAuthentication, sKbdInteractiveAuthentication, - sListenAddress, sAddressFamily, -@@ -1079,11 +1057,11 @@ - xxx_host = host; - xxx_hostaddr = hostaddr; - --@@ -422,6 +433,28 @@ ssh_userauth2(struct ssh *ssh, const char *local_user, -+@@ -422,7 +433,28 @@ ssh_userauth2(struct ssh *ssh, const char *local_user, - - if (!authctxt.success) - fatal("Authentication failed."); --+ -+ - + /* - + * If the user wants to use the none cipher, do it post authentication - + * and only if the right conditions are met -- both of the NONE commands -@@ -1105,9 +1083,9 @@ - + } - + } - + -- debug("Authentication succeeded (%s).", authctxt.method->name); -- } -- -+ #ifdef WITH_OPENSSL -+ if (options.disable_multithreaded == 0) { -+ /* if we are using aes-ctr there can be issues in either a fork or sandbox - diff --git a/sshd.c b/sshd.c - index 11571c01..23a06022 100644 - --- a/sshd.c diff --git a/net-misc/openssh/files/openssh-8.2_p1-hpn-14.20-libressl.patch b/net-misc/openssh/files/openssh-8.2_p1-hpn-14.20-libressl.patch deleted file mode 100644 index 69dd22a5eeb6..000000000000 --- a/net-misc/openssh/files/openssh-8.2_p1-hpn-14.20-libressl.patch +++ /dev/null @@ -1,20 +0,0 @@ ---- a/openssh-8_1_P1-hpn-AES-CTR-14.20.diff 2020-04-17 10:31:37.392120799 -0700 -+++ b/openssh-8_1_P1-hpn-AES-CTR-14.20.diff 2020-04-17 10:32:46.143684424 -0700 -@@ -672,7 +672,7 @@ - +const EVP_CIPHER * - +evp_aes_ctr_mt(void) - +{ --+# if OPENSSL_VERSION_NUMBER >= 0x10100000UL -++# if (OPENSSL_VERSION_NUMBER >= 0x10100000UL || defined(HAVE_OPAQUE_STRUCTS)) && !defined(LIBRESSL_VERSION_NUMBER) - + static EVP_CIPHER *aes_ctr; - + aes_ctr = EVP_CIPHER_meth_new(NID_undef, 16/*block*/, 16/*key*/); - + EVP_CIPHER_meth_set_iv_length(aes_ctr, AES_BLOCK_SIZE); -@@ -701,7 +701,7 @@ - + EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CUSTOM_IV; - +# endif /*SSH_OLD_EVP*/ - + return &aes_ctr; --+# endif /*OPENSSH_VERSION_NUMBER*/ -++# endif /*OPENSSL_VERSION_NUMBER*/ - +} - + - +#endif /* defined(WITH_OPENSSL) */ diff --git a/net-misc/openssh/files/openssh-8.2_p1-hpn-14.20-sctp-glue.patch b/net-misc/openssh/files/openssh-8.2_p1-hpn-14.20-sctp-glue.patch deleted file mode 100644 index 2397aad96f2a..000000000000 --- a/net-misc/openssh/files/openssh-8.2_p1-hpn-14.20-sctp-glue.patch +++ /dev/null @@ -1,19 +0,0 @@ -diff -ur '--exclude=*.un~' a/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff b/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff ---- a/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff 2020-02-15 12:10:00.321998279 -0800 -+++ b/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff 2020-02-15 12:10:21.759980508 -0800 -@@ -1169,15 +1169,3 @@ - # Example of overriding settings on a per-user basis - #Match User anoncvs - # X11Forwarding no --diff --git a/version.h b/version.h --index 6b3fadf8..ec1d2e27 100644 ----- a/version.h --+++ b/version.h --@@ -3,4 +3,6 @@ -- #define SSH_VERSION "OpenSSH_8.1" -- -- #define SSH_PORTABLE "p1" ---#define SSH_RELEASE SSH_VERSION SSH_PORTABLE --+#define SSH_HPN "-hpn14v20" --+#define SSH_RELEASE SSH_VERSION SSH_PORTABLE SSH_HPN --+ diff --git a/net-misc/openssh/files/openssh-8.3_p1-X509-glue-12.5.1.patch b/net-misc/openssh/files/openssh-8.3_p1-X509-glue-12.5.1.patch deleted file mode 100644 index d1651bc187f1..000000000000 --- a/net-misc/openssh/files/openssh-8.3_p1-X509-glue-12.5.1.patch +++ /dev/null @@ -1,35 +0,0 @@ -Only in b: .openssh-8.3p1+x509-12.5.1.diff.un~ -diff -u a/openssh-8.3p1+x509-12.5.1.diff b/openssh-8.3p1+x509-12.5.1.diff ---- a/openssh-8.3p1+x509-12.5.1.diff 2020-06-08 10:13:08.937543708 -0700 -+++ b/openssh-8.3p1+x509-12.5.1.diff 2020-06-08 10:16:33.417271984 -0700 -@@ -35541,12 +35541,11 @@ - - install: $(CONFIGFILES) $(MANPAGES) $(TARGETS) install-files install-sysconf host-key check-config - install-nokeys: $(CONFIGFILES) $(MANPAGES) $(TARGETS) install-files install-sysconf --@@ -382,6 +363,8 @@ -+@@ -382,6 +363,7 @@ - $(MKDIR_P) $(DESTDIR)$(mandir)/$(mansubdir)5 - $(MKDIR_P) $(DESTDIR)$(mandir)/$(mansubdir)8 - $(MKDIR_P) $(DESTDIR)$(libexecdir) - + $(MKDIR_P) $(DESTDIR)$(sshcadir) --+ $(MKDIR_P) $(DESTDIR)$(piddir) - $(MKDIR_P) -m 0755 $(DESTDIR)$(PRIVSEP_PATH) - $(INSTALL) -m 0755 $(STRIP_OPT) ssh$(EXEEXT) $(DESTDIR)$(bindir)/ssh$(EXEEXT) - $(INSTALL) -m 0755 $(STRIP_OPT) scp$(EXEEXT) $(DESTDIR)$(bindir)/scp$(EXEEXT) -@@ -97028,16 +97027,6 @@ - +int asnmprintf(char **, size_t, int *, const char *, ...) - __attribute__((format(printf, 4, 5))); - void msetlocale(void); --diff -ruN openssh-8.3p1/version.h openssh-8.3p1+x509-12.5.1/version.h ----- openssh-8.3p1/version.h 2020-05-27 03:38:00.000000000 +0300 --+++ openssh-8.3p1+x509-12.5.1/version.h 2020-06-07 11:07:00.000000000 +0300 --@@ -2,5 +2,4 @@ -- -- #define SSH_VERSION "OpenSSH_8.3" -- ---#define SSH_PORTABLE "p1" ---#define SSH_RELEASE SSH_VERSION SSH_PORTABLE --+#define SSH_RELEASE PACKAGE_STRING ", " SSH_VERSION "p1" - diff -ruN openssh-8.3p1/version.m4 openssh-8.3p1+x509-12.5.1/version.m4 - --- openssh-8.3p1/version.m4 1970-01-01 02:00:00.000000000 +0200 - +++ openssh-8.3p1+x509-12.5.1/version.m4 2020-06-07 11:07:00.000000000 +0300 diff --git a/net-misc/openssh/files/openssh-8.3_p1-hpn-14.20-glue.patch b/net-misc/openssh/files/openssh-8.3_p1-hpn-14.20-glue.patch deleted file mode 100644 index 4414f9be5331..000000000000 --- a/net-misc/openssh/files/openssh-8.3_p1-hpn-14.20-glue.patch +++ /dev/null @@ -1,177 +0,0 @@ -Only in b: .openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff.un~ -diff -ur a/openssh-8_1_P1-hpn-AES-CTR-14.20.diff b/openssh-8_1_P1-hpn-AES-CTR-14.20.diff ---- a/openssh-8_1_P1-hpn-AES-CTR-14.20.diff 2020-05-27 13:52:27.704108928 -0700 -+++ b/openssh-8_1_P1-hpn-AES-CTR-14.20.diff 2020-05-27 13:52:49.803967500 -0700 -@@ -3,9 +3,9 @@ - --- a/Makefile.in - +++ b/Makefile.in - @@ -42,7 +42,7 @@ CC=@CC@ -- LD=@LD@ -- CFLAGS=@CFLAGS@ -+ CFLAGS_NOPIE=@CFLAGS_NOPIE@ - CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ $(PATHS) @DEFS@ -+ PICFLAG=@PICFLAG@ - -LIBS=@LIBS@ - +LIBS=@LIBS@ -lpthread - K5LIBS=@K5LIBS@ -@@ -902,14 +902,14 @@ - - /* - @@ -2118,6 +2125,8 @@ fill_default_options(Options * options) -+ options->canonicalize_hostname = SSH_CANONICALISE_NO; -+ if (options->fingerprint_hash == -1) - options->fingerprint_hash = SSH_FP_HASH_DEFAULT; -- if (options->update_hostkeys == -1) -- options->update_hostkeys = 0; - + if (options->disable_multithreaded == -1) - + options->disable_multithreaded = 0; -- -- /* Expand KEX name lists */ -- all_cipher = cipher_alg_list(',', 0); -+ #ifdef ENABLE_SK_INTERNAL -+ if (options->sk_provider == NULL) -+ options->sk_provider = xstrdup("internal"); - diff --git a/readconf.h b/readconf.h - index 8e36bf32..c803eca7 100644 - --- a/readconf.h -@@ -952,9 +952,9 @@ - sPort, sHostKeyFile, sLoginGraceTime, - sPermitRootLogin, sLogFacility, sLogLevel, - @@ -643,6 +647,7 @@ static struct { -- { "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL }, - { "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL }, - { "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL }, -+ { "include", sInclude, SSHCFG_ALL }, - + { "disableMTAES", sDisableMTAES, SSHCFG_ALL }, - { "ipqos", sIPQoS, SSHCFG_ALL }, - { "authorizedkeyscommand", sAuthorizedKeysCommand, SSHCFG_ALL }, -diff -ur a/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff b/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff ---- a/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff 2020-05-27 13:52:27.705108921 -0700 -+++ b/openssh-8_1_P1-hpn-DynWinNoneSwitch-14.20.diff 2020-05-27 14:03:57.888683100 -0700 -@@ -409,18 +409,10 @@ - index 817da43b..b2bcf78f 100644 - --- a/packet.c - +++ b/packet.c --@@ -925,6 +925,24 @@ ssh_set_newkeys(struct ssh *ssh, int mode) -+@@ -925,6 +925,16 @@ ssh_set_newkeys(struct ssh *ssh, int mode) - return 0; - } - --+/* this supports the forced rekeying required for the NONE cipher */ --+int rekey_requested = 0; --+void --+packet_request_rekeying(void) --+{ --+ rekey_requested = 1; --+} --+ - +/* used to determine if pre or post auth when rekeying for aes-ctr - + * and none cipher switch */ - +int -@@ -434,20 +426,6 @@ - #define MAX_PACKETS (1U<<31) - static int - ssh_packet_need_rekeying(struct ssh *ssh, u_int outbound_packet_len) --@@ -951,6 +969,13 @@ ssh_packet_need_rekeying(struct ssh *ssh, u_int outbound_packet_len) -- if (state->p_send.packets == 0 && state->p_read.packets == 0) -- return 0; -- --+ /* used to force rekeying when called for by the none --+ * cipher switch methods -cjr */ --+ if (rekey_requested == 1) { --+ rekey_requested = 0; --+ return 1; --+ } --+ -- /* Time-based rekeying */ -- if (state->rekey_interval != 0 && -- (int64_t)state->rekey_time + state->rekey_interval <= monotime()) - diff --git a/packet.h b/packet.h - index 8ccfd2e0..1ad9bc06 100644 - --- a/packet.h -@@ -476,9 +454,9 @@ - /* Format of the configuration file: - - @@ -167,6 +168,8 @@ typedef enum { -- oHashKnownHosts, - oTunnel, oTunnelDevice, - oLocalCommand, oPermitLocalCommand, oRemoteCommand, -+ oDisableMTAES, - + oTcpRcvBufPoll, oTcpRcvBuf, oHPNDisabled, oHPNBufferSize, - + oNoneEnabled, oNoneSwitch, - oVisualHostKey, -@@ -615,9 +593,9 @@ - int ip_qos_bulk; /* IP ToS/DSCP/class for bulk traffic */ - SyslogFacility log_facility; /* Facility for system logging. */ - @@ -112,7 +116,10 @@ typedef struct { -- - int enable_ssh_keysign; - int64_t rekey_limit; -+ int disable_multithreaded; /*disable multithreaded aes-ctr*/ - + int none_switch; /* Use none cipher */ - + int none_enabled; /* Allow none to be used */ - int rekey_interval; -@@ -700,9 +678,9 @@ - + options->hpn_buffer_size = CHAN_TCP_WINDOW_DEFAULT; - + } - + -+ if (options->disable_multithreaded == -1) -+ options->disable_multithreaded = 0; - if (options->ip_qos_interactive == -1) -- options->ip_qos_interactive = IPTOS_DSCP_AF21; -- if (options->ip_qos_bulk == -1) - @@ -486,6 +532,8 @@ typedef enum { - sPasswordAuthentication, sKbdInteractiveAuthentication, - sListenAddress, sAddressFamily, -@@ -731,11 +709,10 @@ - *flags = keywords[i].flags; - return keywords[i].opcode; - } --@@ -1424,10 +1477,27 @@ process_server_config_line(ServerOptions *options, char *line, -- multistate_ptr = multistate_flag; -+@@ -1424,12 +1477,28 @@ process_server_config_line(ServerOptions *options, char *line, -+ multistate_ptr = multistate_ignore_rhosts; - goto parse_multistate; - --+ - + case sTcpRcvBufPoll: - + intptr = &options->tcp_rcv_buf_poll; - + goto parse_flag; -@@ -750,7 +727,9 @@ - + - case sIgnoreUserKnownHosts: - intptr = &options->ignore_user_known_hosts; -- goto parse_flag; -+ parse_flag: -+ multistate_ptr = multistate_flag; -+ goto parse_multistate; - - + case sNoneEnabled: - + intptr = &options->none_enabled; -@@ -1079,11 +1058,11 @@ - xxx_host = host; - xxx_hostaddr = hostaddr; - --@@ -422,6 +433,28 @@ ssh_userauth2(struct ssh *ssh, const char *local_user, -+@@ -422,7 +433,28 @@ ssh_userauth2(struct ssh *ssh, const char *local_user, - - if (!authctxt.success) - fatal("Authentication failed."); --+ -+ - + /* - + * If the user wants to use the none cipher, do it post authentication - + * and only if the right conditions are met -- both of the NONE commands -@@ -1105,9 +1084,9 @@ - + } - + } - + -- debug("Authentication succeeded (%s).", authctxt.method->name); -- } -- -+ #ifdef WITH_OPENSSL -+ if (options.disable_multithreaded == 0) { -+ /* if we are using aes-ctr there can be issues in either a fork or sandbox - diff --git a/sshd.c b/sshd.c - index 11571c01..23a06022 100644 - --- a/sshd.c -- cgit v1.2.3