From c9fc0f604870e63ec80eae5141f34e50b3feeeb7 Mon Sep 17 00:00:00 2001 From: Franco Fichtner Date: Mon, 22 Jul 2019 19:51:04 +0200 Subject: [PATCH] security/openssh-portable: sync with upstream Taken from: HardenedBSD --- security/openssh-portable/Makefile | 18 +++---- security/openssh-portable/distinfo | 4 +- .../files/extra-patch-hpn-gss-glue | 47 ++++++++++++++++--- 3 files changed, 52 insertions(+), 17 deletions(-) diff --git a/security/openssh-portable/Makefile b/security/openssh-portable/Makefile index 405110bde71..3ac84eb860d 100644 --- a/security/openssh-portable/Makefile +++ b/security/openssh-portable/Makefile @@ -41,7 +41,6 @@ x509_CONFLICTS_INSTALL= openssh-portable openssh-portable-hpn \ openssh-portable-gssapi x509_PKGNAMESUFFIX= -portable-x509 -gssapi_BROKEN= GSSAPI not yet updated for ${DISTVERSION} x509_BROKEN= X509 not yet updated for ${DISTVERSION} - Does anyone use this? Contact maintainer bdrewery@FreeBSD.org OPTIONS_DEFINE= DOCS PAM TCP_WRAPPERS LIBEDIT BSM \ HPN X509 KERB_GSSAPI \ @@ -103,7 +102,7 @@ ETCDIR?= ${PREFIX}/etc/ssh .include -PATCH_SITES+= http://mirror.shatow.net/freebsd/${PORTNAME}/:DEFAULT,x509,hpn,gsskex +PATCH_SITES+= http://mirror.shatow.net/freebsd/${PORTNAME}/:DEFAULT,x509,hpn,gsskex # X509 patch includes TCP Wrapper support already .if ${PORT_OPTIONS:MX509} @@ -113,16 +112,19 @@ EXTRA_PATCHES:= ${EXTRA_PATCHES:N${TCP_WRAPPERS_EXTRA_PATCHES}} # Must add this patch before HPN due to conflicts .if ${PORT_OPTIONS:MKERB_GSSAPI} #BROKEN= KERB_GSSAPI No patch for ${DISTVERSION} yet. -# Patch from: -# https://sources.debian.org/data/main/o/openssh/1:7.7p1-2/debian/patches/gssapi.patch -# which was originally based on 5.7 patch from -# http://www.sxw.org.uk/computing/patches/ -# It is mirrored simply to apply gzip -9. . if ${PORT_OPTIONS:MHPN} || ${PORT_OPTIONS:MNONECIPHER} # Needed glue for applying HPN patch without conflict EXTRA_PATCHES+= ${FILESDIR}/extra-patch-hpn-gss-glue . endif -PATCHFILES+= openssh-7.9p1-gsskex-all-20141021-debian-rh-20181020.patch.gz:-p1:gsskex +# - See https://sources.debian.org/data/main/o/openssh/ for which subdir to +# pull from. +GSSAPI_DEBIAN_SUBDIR= ${DISTVERSION}-3 +# - Debian does not use a versioned filename so we trick fetch to make one for +# us with the ?=/ trick. +PATCH_SITES+= https://sources.debian.org/data/main/o/openssh/1:${GSSAPI_DEBIAN_SUBDIR}/debian/patches/gssapi.patch?dummy=/:gsskex +# Bump this when updating the patch location +GSSAPI_UPDATE_DATE= 20190719 +PATCHFILES+= openssh-${DISTVERSION}-gsskex-all-20141021-debian-rh-${GSSAPI_UPDATE_DATE}.patch:-p1:gsskex .endif # https://www.psc.edu/hpn-ssh https://github.com/rapier1/openssh-portable/tree/hpn-openssl1.1-7_7_P1 diff --git a/security/openssh-portable/distinfo b/security/openssh-portable/distinfo index d957d0d10a1..83a81cddafa 100644 --- a/security/openssh-portable/distinfo +++ b/security/openssh-portable/distinfo @@ -3,5 +3,5 @@ SHA256 (openssh-8.0p1.tar.gz) = bd943879e69498e8031eb6b7f44d08cdc37d59a7ab689aa0 SIZE (openssh-8.0p1.tar.gz) = 1597697 SHA256 (openssh-7.9p1+x509-11.5.diff.gz) = 1d15099ce54614f158f10f55b6b4992d915353f92a05e179a64b0655650c00bb SIZE (openssh-7.9p1+x509-11.5.diff.gz) = 594995 -SHA256 (openssh-7.9p1-gsskex-all-20141021-debian-rh-20181020.patch.gz) = a9fe46bc97ebb6f32dad44c6e62e712b224392463b2084300835736fe848eabc -SIZE (openssh-7.9p1-gsskex-all-20141021-debian-rh-20181020.patch.gz) = 27612 +SHA256 (openssh-8.0p1-gsskex-all-20141021-debian-rh-20190719.patch) = 6e07d74626915246d500eeaf9bfb23b1329d6e204d81ba67c09c9c237626c250 +SIZE (openssh-8.0p1-gsskex-all-20141021-debian-rh-20190719.patch) = 128374 diff --git a/security/openssh-portable/files/extra-patch-hpn-gss-glue b/security/openssh-portable/files/extra-patch-hpn-gss-glue index 630b7a1bbbd..57b47e8b023 100644 --- a/security/openssh-portable/files/extra-patch-hpn-gss-glue +++ b/security/openssh-portable/files/extra-patch-hpn-gss-glue @@ -1,10 +1,10 @@ ---- sshconnect2.c.orig 2016-01-19 18:10:12.550854000 -0800 -+++ sshconnect2.c 2016-01-19 18:10:27.290409000 -0800 -@@ -160,11 +160,6 @@ ssh_kex2(char *host, struct sockaddr *ho - struct kex *kex; +--- sshconnect2.c.orig 2019-07-19 11:53:14.918867000 -0700 ++++ sshconnect2.c 2019-07-19 11:53:16.911086000 -0700 +@@ -159,11 +159,6 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr + char *s, *all_key; int r; --#ifdef GSSAPI +-#if defined(GSSAPI) && defined(WITH_OPENSSL) - char *orig = NULL, *gss = NULL; - char *gss_host = NULL; -#endif @@ -12,13 +12,46 @@ xxx_host = host; xxx_hostaddr = hostaddr; -@@ -199,6 +194,9 @@ ssh_kex2(char *host, struct sockaddr *ho +@@ -197,6 +192,9 @@ ssh_kex2(struct ssh *ssh, char *host, struct sockaddr } - #ifdef GSSAPI + #if defined(GSSAPI) && defined(WITH_OPENSSL) + char *orig = NULL, *gss = NULL; + char *gss_host = NULL; + if (options.gss_keyex) { /* Add the GSSAPI mechanisms currently supported on this * client to the key exchange algorithm proposal */ +--- readconf.c.orig 2019-07-19 12:13:18.000312000 -0700 ++++ readconf.c 2019-07-19 12:13:29.614552000 -0700 +@@ -63,11 +63,11 @@ + #include "readconf.h" + #include "match.h" + #include "kex.h" ++#include "ssh-gss.h" + #include "mac.h" + #include "uidswap.h" + #include "myproposal.h" + #include "digest.h" +-#include "ssh-gss.h" + + /* Format of the configuration file: + +--- servconf.c.orig 2019-07-19 12:14:42.078398000 -0700 ++++ servconf.c 2019-07-19 12:14:43.543687000 -0700 +@@ -54,6 +54,7 @@ + #include "sshkey.h" + #include "kex.h" + #include "mac.h" ++#include "ssh-gss.h" + #include "match.h" + #include "channels.h" + #include "groupaccess.h" +@@ -64,7 +65,6 @@ + #include "auth.h" + #include "myproposal.h" + #include "digest.h" +-#include "ssh-gss.h" + + static void add_listen_addr(ServerOptions *, const char *, + const char *, int);