Merge 6.6p1.

* New upstream release (http://www.openssh.com/txt/release-6.6).

1 files changed, 29 insertions, 29 deletions

diff --git a/debian/patches/selinux-role.patch b/debian/patches/selinux-role.patch
index 1f924dfad..e0ca12fb0 100644
--- a/debian/patches/selinux-role.patch
+++ b/debian/patches/selinux-role.patch
@@ -1,4 +1,4 @@
-From 7afb9ad9307191397a3ccf3d7cc90dfe474b09e8 Mon Sep 17 00:00:00 2001
+From ae32d626ed3d15cfd7f432358b63c005961921df Mon Sep 17 00:00:00 2001
 From: Manoj Srivastava <srivasta@debian.org>
 Date: Sun, 9 Feb 2014 16:09:49 +0000
 Subject: Handle SELinux authorisation roles
@@ -32,7 +32,7 @@ Patch-Name: selinux-role.patch
  16 files changed, 104 insertions(+), 31 deletions(-)
 
 diff --git a/auth.h b/auth.h
-index 80f0898..5b6824f 100644
+index 124e597..79e4ea5 100644
 --- a/auth.h
 +++ b/auth.h
 @@ -59,6 +59,7 @@ struct Authctxt {
@@ -42,9 +42,9 @@ index 80f0898..5b6824f 100644
 +       char            *role;
         void            *kbdintctxt;
         char            *info;          /* Extra info for next auth_log */
-        void            *jpake_ctx;
+ #ifdef BSD_AUTH
 diff --git a/auth1.c b/auth1.c
-index f1ac598..2803a3c 100644
+index 0f870b3..c707390 100644
 --- a/auth1.c
 +++ b/auth1.c
 @@ -380,7 +380,7 @@ void
@@ -75,10 +75,10 @@ index f1ac598..2803a3c 100644
         /* Verify that the user is a valid user. */
         if ((authctxt->pw = PRIVSEP(getpwnamallow(user))) != NULL)
 diff --git a/auth2.c b/auth2.c
-index 6ed8f04..b55bbcd 100644
+index fbe3e1b..70f2925 100644
 --- a/auth2.c
 +++ b/auth2.c
-@@ -222,7 +222,7 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
+@@ -216,7 +216,7 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
  {
         Authctxt *authctxt = ctxt;
         Authmethod *m = NULL;
@@ -87,7 +87,7 @@ index 6ed8f04..b55bbcd 100644
         int authenticated = 0;
  
         if (authctxt == NULL)
-@@ -234,8 +234,13 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
+@@ -228,8 +228,13 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
         debug("userauth-request for user %s service %s method %s", user, service, method);
         debug("attempt %d failures %d", authctxt->attempt, authctxt->failures);
  
@@ -101,7 +101,7 @@ index 6ed8f04..b55bbcd 100644
  
         if (authctxt->attempt++ == 0) {
                 /* setup auth context */
-@@ -259,8 +264,9 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
+@@ -253,8 +258,9 @@ input_userauth_request(int type, u_int32_t seq, void *ctxt)
                     use_privsep ? " [net]" : "");
                 authctxt->service = xstrdup(service);
                 authctxt->style = style ? xstrdup(style) : NULL;
@@ -113,10 +113,10 @@ index 6ed8f04..b55bbcd 100644
                 if (auth2_setup_methods_lists(authctxt) != 0)
                         packet_disconnect("no authentication methods enabled");
 diff --git a/monitor.c b/monitor.c
-index a777c4c..88f472e 100644
+index 2918814..11eac63 100644
 --- a/monitor.c
 +++ b/monitor.c
-@@ -146,6 +146,7 @@ int mm_answer_sign(int, Buffer *);
+@@ -145,6 +145,7 @@ int mm_answer_sign(int, Buffer *);
  int mm_answer_pwnamallow(int, Buffer *);
  int mm_answer_auth2_read_banner(int, Buffer *);
  int mm_answer_authserv(int, Buffer *);
@@ -124,7 +124,7 @@ index a777c4c..88f472e 100644
  int mm_answer_authpassword(int, Buffer *);
  int mm_answer_bsdauthquery(int, Buffer *);
  int mm_answer_bsdauthrespond(int, Buffer *);
-@@ -227,6 +228,7 @@ struct mon_table mon_dispatch_proto20[] = {
+@@ -221,6 +222,7 @@ struct mon_table mon_dispatch_proto20[] = {
      {MONITOR_REQ_SIGN, MON_ONCE, mm_answer_sign},
      {MONITOR_REQ_PWNAM, MON_ONCE, mm_answer_pwnamallow},
      {MONITOR_REQ_AUTHSERV, MON_ONCE, mm_answer_authserv},
@@ -132,7 +132,7 @@ index a777c4c..88f472e 100644
      {MONITOR_REQ_AUTH2_READ_BANNER, MON_ONCE, mm_answer_auth2_read_banner},
      {MONITOR_REQ_AUTHPASSWORD, MON_AUTH, mm_answer_authpassword},
  #ifdef USE_PAM
-@@ -844,6 +846,7 @@ mm_answer_pwnamallow(int sock, Buffer *m)
+@@ -822,6 +824,7 @@ mm_answer_pwnamallow(int sock, Buffer *m)
         else {
                 /* Allow service/style information on the auth context */
                 monitor_permit(mon_dispatch, MONITOR_REQ_AUTHSERV, 1);
@@ -140,7 +140,7 @@ index a777c4c..88f472e 100644
                 monitor_permit(mon_dispatch, MONITOR_REQ_AUTH2_READ_BANNER, 1);
         }
  #ifdef USE_PAM
-@@ -874,14 +877,37 @@ mm_answer_authserv(int sock, Buffer *m)
+@@ -852,14 +855,37 @@ mm_answer_authserv(int sock, Buffer *m)
  
         authctxt->service = buffer_get_string(m, NULL);
         authctxt->style = buffer_get_string(m, NULL);
@@ -180,7 +180,7 @@ index a777c4c..88f472e 100644
         return (0);
  }
  
-@@ -1486,7 +1512,7 @@ mm_answer_pty(int sock, Buffer *m)
+@@ -1464,7 +1490,7 @@ mm_answer_pty(int sock, Buffer *m)
         res = pty_allocate(&s->ptyfd, &s->ttyfd, s->tty, sizeof(s->tty));
         if (res == 0)
                 goto error;
@@ -190,10 +190,10 @@ index a777c4c..88f472e 100644
         buffer_put_int(m, 1);
         buffer_put_cstring(m, s->tty);
 diff --git a/monitor.h b/monitor.h
-index 315ef99..3c13706 100644
+index 7f32b0c..4d5e8fa 100644
 --- a/monitor.h
 +++ b/monitor.h
-@@ -73,6 +73,8 @@ enum monitor_reqtype {
+@@ -68,6 +68,8 @@ enum monitor_reqtype {
         MONITOR_REQ_GSSSIGN = 150, MONITOR_ANS_GSSSIGN = 151,
         MONITOR_REQ_GSSUPCREDS = 152, MONITOR_ANS_GSSUPCREDS = 153,
  
@@ -203,10 +203,10 @@ index 315ef99..3c13706 100644
  
  struct mm_master;
 diff --git a/monitor_wrap.c b/monitor_wrap.c
-index 44019f3..69bc324 100644
+index 60b987d..f75dc9d 100644
 --- a/monitor_wrap.c
 +++ b/monitor_wrap.c
-@@ -320,10 +320,10 @@ mm_auth2_read_banner(void)
+@@ -318,10 +318,10 @@ mm_auth2_read_banner(void)
         return (banner);
  }
  
@@ -219,7 +219,7 @@ index 44019f3..69bc324 100644
  {
         Buffer m;
  
-@@ -332,12 +332,30 @@ mm_inform_authserv(char *service, char *style)
+@@ -330,12 +330,30 @@ mm_inform_authserv(char *service, char *style)
         buffer_init(&m);
         buffer_put_cstring(&m, service);
         buffer_put_cstring(&m, style ? style : "");
@@ -251,7 +251,7 @@ index 44019f3..69bc324 100644
  int
  mm_auth_password(Authctxt *authctxt, char *password)
 diff --git a/monitor_wrap.h b/monitor_wrap.h
-index ec9b9b1..4d12e29 100644
+index a4e9d24..9c2ee49 100644
 --- a/monitor_wrap.h
 +++ b/monitor_wrap.h
 @@ -41,7 +41,8 @@ void mm_log_handler(LogLevel, const char *, void *);
@@ -396,10 +396,10 @@ index 1c7a45d..436ae7c 100644
  char *platform_krb5_get_principal_name(const char *);
  int platform_sys_dir_uid(uid_t);
 diff --git a/session.c b/session.c
-index 12dd9ab..5ddd82a 100644
+index 2bcf818..6848df4 100644
 --- a/session.c
 +++ b/session.c
-@@ -1497,7 +1497,7 @@ safely_chroot(const char *path, uid_t uid)
+@@ -1502,7 +1502,7 @@ safely_chroot(const char *path, uid_t uid)
  
  /* Set login name, uid, gid, and groups. */
  void
@@ -408,7 +408,7 @@ index 12dd9ab..5ddd82a 100644
  {
         char *chroot_path, *tmp;
  
-@@ -1525,7 +1525,7 @@ do_setusercontext(struct passwd *pw)
+@@ -1530,7 +1530,7 @@ do_setusercontext(struct passwd *pw)
                 endgrent();
  #endif
  
@@ -417,7 +417,7 @@ index 12dd9ab..5ddd82a 100644
  
                 if (options.chroot_directory != NULL &&
                     strcasecmp(options.chroot_directory, "none") != 0) {
-@@ -1674,7 +1674,7 @@ do_child(Session *s, const char *command)
+@@ -1679,7 +1679,7 @@ do_child(Session *s, const char *command)
  
         /* Force a password change */
         if (s->authctxt->force_pwchange) {
@@ -426,7 +426,7 @@ index 12dd9ab..5ddd82a 100644
                 child_close_fds();
                 do_pwchange(s);
                 exit(1);
-@@ -1701,7 +1701,7 @@ do_child(Session *s, const char *command)
+@@ -1706,7 +1706,7 @@ do_child(Session *s, const char *command)
                 /* When PAM is enabled we rely on it to do the nologin check */
                 if (!options.use_pam)
                         do_nologin(pw);
@@ -435,7 +435,7 @@ index 12dd9ab..5ddd82a 100644
                 /*
                  * PAM session modules in do_setusercontext may have
                  * generated messages, so if this in an interactive
-@@ -2112,7 +2112,7 @@ session_pty_req(Session *s)
+@@ -2117,7 +2117,7 @@ session_pty_req(Session *s)
         tty_parse_modes(s->ttyfd, &n_bytes);
  
         if (!use_privsep)
@@ -458,11 +458,11 @@ index 6a2f35e..ef6593c 100644
                        const char *value);
  
 diff --git a/sshd.c b/sshd.c
-index fe65132..0a30101 100644
+index d787fea..e343d90 100644
 --- a/sshd.c
 +++ b/sshd.c
-@@ -763,7 +763,7 @@ privsep_postauth(Authctxt *authctxt)
-        bzero(rnd, sizeof(rnd));
+@@ -769,7 +769,7 @@ privsep_postauth(Authctxt *authctxt)
+        explicit_bzero(rnd, sizeof(rnd));
  
         /* Drop privileges */
 -       do_setusercontext(authctxt->pw);