* New upstream release (http://www.openssh.com/txt/release-6.2).

  - Add support for multiple required authentication in SSH protocol 2 via
    an AuthenticationMethods option (closes: #195716).
  - Fix Sophie Germain formula in moduli(5) (closes: #698612).
  - Update ssh-copy-id to Phil Hands' greatly revised version (closes:
    #99785, #322228, #620428; LP: #518883, #835901, #1074798).

1 files changed, 28 insertions, 28 deletions

diff --git a/debian/patches/selinux-role.patch b/debian/patches/selinux-role.patch
index 80fe3247b..f2f8fcd21 100644
--- a/debian/patches/selinux-role.patch
+++ b/debian/patches/selinux-role.patch
@@ -5,7 +5,7 @@ Description: Handle SELinux authorisation roles
 Author: Manoj Srivastava <srivasta@debian.org>
 Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1641
 Bug-Debian: http://bugs.debian.org/394795
-Last-Update: 2010-02-27
+Last-Update: 2013-05-07
 
 Index: b/auth.h
 ===================================================================
@@ -23,7 +23,7 @@ Index: b/auth1.c
 ===================================================================
 --- a/auth1.c
 +++ b/auth1.c
-@@ -383,7 +383,7 @@
+@@ -385,7 +385,7 @@
  do_authentication(Authctxt *authctxt)
  {
         u_int ulen;
@@ -32,7 +32,7 @@ Index: b/auth1.c
  
         /* Get the name of the user that we wish to log in as. */
         packet_read_expect(SSH_CMSG_USER);
-@@ -392,11 +392,17 @@
+@@ -394,11 +394,17 @@
         user = packet_get_cstring(&ulen);
         packet_check_eom();
  
@@ -54,7 +54,7 @@ Index: b/auth2.c
 ===================================================================
 --- a/auth2.c
 +++ b/auth2.c
-@@ -217,7 +217,7 @@
+@@ -219,7 +219,7 @@
  {
         Authctxt *authctxt = ctxt;
         Authmethod *m = NULL;
@@ -63,7 +63,7 @@ Index: b/auth2.c
         int authenticated = 0;
  
         if (authctxt == NULL)
-@@ -229,8 +229,13 @@
+@@ -231,8 +231,13 @@
         debug("userauth-request for user %s service %s method %s", user, service, method);
         debug("attempt %d failures %d", authctxt->attempt, authctxt->failures);
  
@@ -77,7 +77,7 @@ Index: b/auth2.c
  
         if (authctxt->attempt++ == 0) {
                 /* setup auth context */
-@@ -254,8 +259,9 @@
+@@ -256,8 +261,9 @@
                     use_privsep ? " [net]" : "");
                 authctxt->service = xstrdup(service);
                 authctxt->style = style ? xstrdup(style) : NULL;
@@ -86,8 +86,8 @@ Index: b/auth2.c
 -                       mm_inform_authserv(service, style);
 +                       mm_inform_authserv(service, style, role);
                 userauth_banner();
-        } else if (strcmp(user, authctxt->user) != 0 ||
-            strcmp(service, authctxt->service) != 0) {
+                if (auth2_setup_methods_lists(authctxt) != 0)
+                        packet_disconnect("no authentication methods enabled");
 Index: b/monitor.c
 ===================================================================
 --- a/monitor.c
@@ -100,7 +100,7 @@ Index: b/monitor.c
  int mm_answer_authpassword(int, Buffer *);
  int mm_answer_bsdauthquery(int, Buffer *);
  int mm_answer_bsdauthrespond(int, Buffer *);
-@@ -225,6 +226,7 @@
+@@ -226,6 +227,7 @@
      {MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign},
      {MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow},
      {MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv},
@@ -108,7 +108,7 @@ Index: b/monitor.c
      {MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner},
      {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword},
  #ifdef USE_PAM
-@@ -808,6 +810,7 @@
+@@ -837,6 +839,7 @@
         else {
                 /* Allow service/style information on the auth context */
                 monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1);
@@ -116,7 +116,7 @@ Index: b/monitor.c
                 monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1);
         }
  #ifdef USE_PAM
-@@ -840,14 +843,37 @@
+@@ -869,14 +872,37 @@
  
         authctxt->service = buffer_get_string(m, NULL);
         authctxt->style = buffer_get_string(m, NULL);
@@ -156,7 +156,7 @@ Index: b/monitor.c
         return (0);
  }
  
-@@ -1435,7 +1461,7 @@
+@@ -1471,7 +1497,7 @@
         res = pty_allocate(&s->ptyfd, &s->ttyfd, s->tty, sizeof(s->tty));
         if (res == 0)
                 goto error;
@@ -169,15 +169,15 @@ Index: b/monitor.h
 ===================================================================
 --- a/monitor.h
 +++ b/monitor.h
-@@ -30,7 +30,7 @@
- 
- enum monitor_reqtype {
-        MONITOR_REQ_MODULI, MONITOR_ANS_MODULI,
--       MONITOR_REQ_FREE, MONITOR_REQ_AUTHSERV,
-+       MONITOR_REQ_FREE, MONITOR_REQ_AUTHSERV, MONITOR_REQ_AUTHROLE,
-        MONITOR_REQ_SIGN, MONITOR_ANS_SIGN,
-        MONITOR_REQ_PWNAM, MONITOR_ANS_PWNAM,
-        MONITOR_REQ_AUTH2_READ_BANNER, MONITOR_ANS_AUTH2_READ_BANNER,
+@@ -73,6 +73,8 @@
+        MONITOR_REQ_GSSSIGN = 200, MONITOR_ANS_GSSSIGN = 201,
+        MONITOR_REQ_GSSUPCREDS = 202, MONITOR_ANS_GSSUPCREDS = 203,
+ 
++       MONITOR_REQ_AUTHROLE = 300,
++
+ };
+ 
+ struct mm_master;
 Index: b/monitor_wrap.c
 ===================================================================
 --- a/monitor_wrap.c
@@ -369,12 +369,12 @@ Index: b/platform.h
 +void platform_setusercontext_post_groups(struct passwd *, const char *);
  char *platform_get_krb5_client(const char *);
  char *platform_krb5_get_principal_name(const char *);
- 
+ int platform_sys_dir_uid(uid_t);
 Index: b/session.c
 ===================================================================
 --- a/session.c
 +++ b/session.c
-@@ -1471,7 +1471,7 @@
+@@ -1474,7 +1474,7 @@
  
  /* Set login name, uid, gid, and groups. */
  void
@@ -383,7 +383,7 @@ Index: b/session.c
  {
         char *chroot_path, *tmp;
  
-@@ -1499,7 +1499,7 @@
+@@ -1502,7 +1502,7 @@
                 endgrent();
  #endif
  
@@ -392,7 +392,7 @@ Index: b/session.c
  
                 if (options.chroot_directory != NULL &&
                     strcasecmp(options.chroot_directory, "none") != 0) {
-@@ -1625,7 +1625,7 @@
+@@ -1633,7 +1633,7 @@
  
         /* Force a password change */
         if (s->authctxt->force_pwchange) {
@@ -401,7 +401,7 @@ Index: b/session.c
                 child_close_fds();
                 do_pwchange(s);
                 exit(1);
-@@ -1652,7 +1652,7 @@
+@@ -1660,7 +1660,7 @@
                 /* When PAM is enabled we rely on it to do the nologin check */
                 if (!options.use_pam)
                         do_nologin(pw);
@@ -410,7 +410,7 @@ Index: b/session.c
                 /*
                  * PAM session modules in do_setusercontext may have
                  * generated messages, so if this in an interactive
-@@ -2064,7 +2064,7 @@
+@@ -2072,7 +2072,7 @@
         tty_parse_modes(s->ttyfd, &n_bytes);
  
         if (!use_privsep)
@@ -436,7 +436,7 @@ Index: b/sshd.c
 ===================================================================
 --- a/sshd.c
 +++ b/sshd.c
-@@ -736,7 +736,7 @@
+@@ -745,7 +745,7 @@
         RAND_seed(rnd, sizeof(rnd));
  
         /* Drop privileges */