* New upstream release (http://www.openssh.com/txt/release-6.1).

  - Enable pre-auth sandboxing by default for new installs.
  - Allow "PermitOpen none" to refuse all port-forwarding requests
    (closes: #543683).

1 files changed, 27 insertions, 28 deletions

diff --git a/debian/patches/debian-banner.patch b/debian/patches/debian-banner.patch
index a03ce23bb..22b1e4c14 100644
--- a/debian/patches/debian-banner.patch
+++ b/debian/patches/debian-banner.patch
@@ -4,48 +4,48 @@ Description: Add DebianBanner server configuration option
 Author: Kees Cook <kees@debian.org>
 Bug-Debian: http://bugs.debian.org/562048
 Forwarded: not-needed
-Last-Update: 2010-02-28
+Last-Update: 2012-09-07
 
 Index: b/servconf.c
 ===================================================================
 --- a/servconf.c
 +++ b/servconf.c
-@@ -142,6 +142,7 @@
-        options->authorized_principals_file = NULL;
+@@ -146,6 +146,7 @@
         options->ip_qos_interactive = -1;
         options->ip_qos_bulk = -1;
+        options->version_addendum = NULL;
 +       options->debian_banner = -1;
  }
  
  void
-@@ -289,6 +290,8 @@
-                options->ip_qos_interactive = IPTOS_LOWDELAY;
-        if (options->ip_qos_bulk == -1)
+@@ -295,6 +296,8 @@
                 options->ip_qos_bulk = IPTOS_THROUGHPUT;
+        if (options->version_addendum == NULL)
+                options->version_addendum = xstrdup("");
 +       if (options->debian_banner == -1)
 +               options->debian_banner = 1;
- 
         /* Turn privilege separation on by default */
         if (use_privsep == -1)
-@@ -338,6 +341,7 @@
+                use_privsep = PRIVSEP_NOSANDBOX;
+@@ -343,6 +346,7 @@
         sZeroKnowledgePasswordAuthentication, sHostCertificate,
         sRevokedKeys, sTrustedUserCAKeys, sAuthorizedPrincipalsFile,
-        sKexAlgorithms, sIPQoS,
+        sKexAlgorithms, sIPQoS, sVersionAddendum,
 +       sDebianBanner,
         sDeprecated, sUnsupported
  } ServerOpCodes;
  
-@@ -473,6 +477,7 @@
-        { "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL },
+@@ -479,6 +483,7 @@
         { "kexalgorithms", sKexAlgorithms, SSHCFG_GLOBAL },
         { "ipqos", sIPQoS, SSHCFG_ALL },
+        { "versionaddendum", sVersionAddendum, SSHCFG_GLOBAL },
 +       { "debianbanner", sDebianBanner, SSHCFG_GLOBAL },
         { NULL, sBadOption, 0 }
  };
  
-@@ -1436,6 +1441,10 @@
+@@ -1538,6 +1543,10 @@
                 }
-                break;
+                return 0;
  
 +       case sDebianBanner:
 +               intptr = &options->debian_banner;
@@ -58,34 +58,33 @@ Index: b/servconf.h
 ===================================================================
 --- a/servconf.h
 +++ b/servconf.h
-@@ -166,6 +166,8 @@
- 
-        int     num_permitted_opens;
+@@ -172,6 +172,7 @@
+        char   *authorized_principals_file;
  
+        char   *version_addendum;       /* Appended to SSH banner */
 +       int     debian_banner;
-+
-        char   *chroot_directory;
-        char   *revoked_keys_file;
-        char   *trusted_user_ca_keys;
+ }       ServerOptions;
+ 
+ /* Information about the incoming connection as used by Match */
 Index: b/sshd.c
 ===================================================================
 --- a/sshd.c
 +++ b/sshd.c
-@@ -424,7 +424,8 @@
-                minor = PROTOCOL_MINOR_1;
+@@ -425,7 +425,8 @@
         }
-        snprintf(buf, sizeof buf, "SSH-%d.%d-%.100s%s", major, minor,
--           SSH_RELEASE, newline);
+ 
+        xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s",
+-           major, minor, SSH_RELEASE,
++           major, minor,
 +           options.debian_banner ? SSH_RELEASE : SSH_RELEASE_MINIMUM,
-+           newline);
-        server_version_string = xstrdup(buf);
+            *options.version_addendum == '\0' ? "" : " ",
+            options.version_addendum, newline);
  
-        /* Send our protocol version identification. */
 Index: b/sshd_config.5
 ===================================================================
 --- a/sshd_config.5
 +++ b/sshd_config.5
-@@ -340,6 +340,11 @@
+@@ -342,6 +342,11 @@
  .Dq no .
  The default is
  .Dq delayed .