Apply upstream patch to fix PermitOpen argument handling.

5 files changed, 64 insertions, 6 deletions

diff --git a/debian/.git-dpm b/debian/.git-dpm
index f621e7ad8..f73621e9d 100644
--- a/debian/.git-dpm
+++ b/debian/.git-dpm
@@ -1,6 +1,6 @@
 # see git-dpm(1) from git-dpm package
-801a62eedaaf47b20dbf4b426dc3e084bf0c8d49
-801a62eedaaf47b20dbf4b426dc3e084bf0c8d49
+e293f21da513a7db59fe1997c9e90e2e9cdbceda
+e293f21da513a7db59fe1997c9e90e2e9cdbceda
 62f54f20bf351468e0124f63cc2902ee40d9b0e9
 62f54f20bf351468e0124f63cc2902ee40d9b0e9
 openssh_7.6p1.orig.tar.gz
diff --git a/debian/changelog b/debian/changelog
index cbf84cbca..f63728e66 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+openssh (1:7.6p1-2) UNRELEASED; urgency=medium
+
+  * Apply upstream patch to fix PermitOpen argument handling.
+
+ -- Colin Watson <cjwatson@debian.org>  Sat, 07 Oct 2017 13:43:21 +0100
+
 openssh (1:7.6p1-1) unstable; urgency=medium
 
   * New upstream release (https://www.openssh.com/txt/release-7.6):
diff --git a/debian/patches/permitopen-argument-handling.patch b/debian/patches/permitopen-argument-handling.patch
new file mode 100644
index 000000000..6369c395c
--- /dev/null
+++ b/debian/patches/permitopen-argument-handling.patch
@@ -0,0 +1,51 @@
+From e293f21da513a7db59fe1997c9e90e2e9cdbceda Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Wed, 4 Oct 2017 18:49:30 +0000
+Subject: Fix PermitOpen argument handling
+
+fix (another) problem in PermitOpen introduced during the
+channels.c refactor: the third and subsequent arguments to PermitOpen were
+being silently ignored; ok markus@
+
+Upstream-ID: 067c89f1f53cbc381628012ba776d6861e6782fd
+
+Origin: https://anongit.mindrot.org/openssh.git/commit/?id=7c9613fac3371cf65fb07739212cdd1ebf6575da
+Last-Update: 2017-10-07
+
+Patch-Name: permitopen-argument-handling.patch
+---
+ servconf.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/servconf.c b/servconf.c
+index 5e996cf8..9daa182c 100644
+--- a/servconf.c
++++ b/servconf.c
+@@ -1,5 +1,5 @@
+ 
+-/* $OpenBSD: servconf.c,v 1.312 2017/10/02 19:33:20 djm Exp $ */
++/* $OpenBSD: servconf.c,v 1.313 2017/10/04 18:49:30 djm Exp $ */
+ /*
+  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
+  *                    All rights reserved
+@@ -1690,9 +1690,9 @@ process_server_config_line(ServerOptions *options, char *line,
+                if (!arg || *arg == '\0')
+                        fatal("%s line %d: missing PermitOpen specification",
+                            filename, linenum);
+-               i = options->num_permitted_opens;       /* modified later */
++               value = options->num_permitted_opens;   /* modified later */
+                if (strcmp(arg, "any") == 0 || strcmp(arg, "none") == 0) {
+-                       if (*activep && i == 0) {
++                       if (*activep && value == 0) {
+                                options->num_permitted_opens = 1;
+                                options->permitted_opens = xcalloc(1,
+                                    sizeof(*options->permitted_opens));
+@@ -1710,7 +1710,7 @@ process_server_config_line(ServerOptions *options, char *line,
+                        if (arg == NULL || ((port = permitopen_port(arg)) < 0))
+                                fatal("%s line %d: bad port number in "
+                                    "PermitOpen", filename, linenum);
+-                       if (*activep && i == 0) {
++                       if (*activep && value == 0) {
+                                options->permitted_opens = xrecallocarray(
+                                    options->permitted_opens,
+                                    options->num_permitted_opens,
diff --git a/debian/patches/series b/debian/patches/series
index d1bb1ff5c..7b9d0e39b 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -26,3 +26,4 @@ restore-authorized_keys2.patch
 seccomp-s390-flock-ipc.patch
 seccomp-getuid-geteuid.patch
 seccomp-s390-ioctl-ep11-crypto.patch
+permitopen-argument-handling.patch
diff --git a/servconf.c b/servconf.c
index 5e996cf8f..9daa182c0 100644
--- a/servconf.c
+++ b/servconf.c
@@ -1,5 +1,5 @@
 
-/* $OpenBSD: servconf.c,v 1.312 2017/10/02 19:33:20 djm Exp $ */
+/* $OpenBSD: servconf.c,v 1.313 2017/10/04 18:49:30 djm Exp $ */
 /*
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
  *                    All rights reserved
@@ -1690,9 +1690,9 @@ process_server_config_line(ServerOptions *options, char *line,
                 if (!arg || *arg == '\0')
                         fatal("%s line %d: missing PermitOpen specification",
                             filename, linenum);
-                i = options->num_permitted_opens;       /* modified later */
+                value = options->num_permitted_opens;   /* modified later */
                 if (strcmp(arg, "any") == 0 || strcmp(arg, "none") == 0) {
-                        if (*activep && i == 0) {
+                        if (*activep && value == 0) {
                                 options->num_permitted_opens = 1;
                                 options->permitted_opens = xcalloc(1,
                                     sizeof(*options->permitted_opens));
@@ -1710,7 +1710,7 @@ process_server_config_line(ServerOptions *options, char *line,
                         if (arg == NULL || ((port = permitopen_port(arg)) < 0))
                                 fatal("%s line %d: bad port number in "
                                     "PermitOpen", filename, linenum);
-                        if (*activep && i == 0) {
+                        if (*activep && value == 0) {
                                 options->permitted_opens = xrecallocarray(
                                     options->permitted_opens,
                                     options->num_permitted_opens,