Apply upstream patch to fix PermitOpen argument handling.

2 files changed, 52 insertions, 0 deletions

diff --git a/debian/patches/permitopen-argument-handling.patch b/debian/patches/permitopen-argument-handling.patch
new file mode 100644
index 000000000..6369c395c
--- /dev/null
+++ b/debian/patches/permitopen-argument-handling.patch
@@ -0,0 +1,51 @@
+From e293f21da513a7db59fe1997c9e90e2e9cdbceda Mon Sep 17 00:00:00 2001
+From: "djm@openbsd.org" <djm@openbsd.org>
+Date: Wed, 4 Oct 2017 18:49:30 +0000
+Subject: Fix PermitOpen argument handling
+
+fix (another) problem in PermitOpen introduced during the
+channels.c refactor: the third and subsequent arguments to PermitOpen were
+being silently ignored; ok markus@
+
+Upstream-ID: 067c89f1f53cbc381628012ba776d6861e6782fd
+
+Origin: https://anongit.mindrot.org/openssh.git/commit/?id=7c9613fac3371cf65fb07739212cdd1ebf6575da
+Last-Update: 2017-10-07
+
+Patch-Name: permitopen-argument-handling.patch
+---
+ servconf.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/servconf.c b/servconf.c
+index 5e996cf8..9daa182c 100644
+--- a/servconf.c
++++ b/servconf.c
+@@ -1,5 +1,5 @@
+ 
+-/* $OpenBSD: servconf.c,v 1.312 2017/10/02 19:33:20 djm Exp $ */
++/* $OpenBSD: servconf.c,v 1.313 2017/10/04 18:49:30 djm Exp $ */
+ /*
+  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
+  *                    All rights reserved
+@@ -1690,9 +1690,9 @@ process_server_config_line(ServerOptions *options, char *line,
+                if (!arg || *arg == '\0')
+                        fatal("%s line %d: missing PermitOpen specification",
+                            filename, linenum);
+-               i = options->num_permitted_opens;       /* modified later */
++               value = options->num_permitted_opens;   /* modified later */
+                if (strcmp(arg, "any") == 0 || strcmp(arg, "none") == 0) {
+-                       if (*activep && i == 0) {
++                       if (*activep && value == 0) {
+                                options->num_permitted_opens = 1;
+                                options->permitted_opens = xcalloc(1,
+                                    sizeof(*options->permitted_opens));
+@@ -1710,7 +1710,7 @@ process_server_config_line(ServerOptions *options, char *line,
+                        if (arg == NULL || ((port = permitopen_port(arg)) < 0))
+                                fatal("%s line %d: bad port number in "
+                                    "PermitOpen", filename, linenum);
+-                       if (*activep && i == 0) {
++                       if (*activep && value == 0) {
+                                options->permitted_opens = xrecallocarray(
+                                    options->permitted_opens,
+                                    options->num_permitted_opens,
diff --git a/debian/patches/series b/debian/patches/series
index d1bb1ff5c..7b9d0e39b 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -26,3 +26,4 @@ restore-authorized_keys2.patch
 seccomp-s390-flock-ipc.patch
 seccomp-getuid-geteuid.patch
 seccomp-s390-ioctl-ep11-crypto.patch
+permitopen-argument-handling.patch