* New upstream release (http://www.openssh.org/txt/release-5.8):

  - Fix stack information leak in legacy certificate signing
    (http://www.openssh.com/txt/legacy-cert.adv).

9 files changed, 28 insertions, 276 deletions

diff --git a/debian/patches/authorized-keys-man-symlink.patch b/debian/patches/authorized-keys-man-symlink.patch
index 86b269659..13b3b6561 100644
--- a/debian/patches/authorized-keys-man-symlink.patch
+++ b/debian/patches/authorized-keys-man-symlink.patch
@@ -8,7 +8,7 @@ Index: b/Makefile.in
 ===================================================================
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -288,6 +288,7 @@
+@@ -289,6 +289,7 @@
         $(INSTALL) -m 644 sshd_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/sshd_config.5
         $(INSTALL) -m 644 ssh_config.5.out $(DESTDIR)$(mandir)/$(mansubdir)5/ssh_config.5
         $(INSTALL) -m 644 sshd.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sshd.8
diff --git a/debian/patches/gssapi.patch b/debian/patches/gssapi.patch
index 112b31fdf..c123bf7b9 100644
--- a/debian/patches/gssapi.patch
+++ b/debian/patches/gssapi.patch
@@ -137,7 +137,7 @@ Index: b/Makefile.in
 ===================================================================
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -74,6 +74,7 @@
+@@ -75,6 +75,7 @@
         atomicio.o key.o dispatch.o kex.o mac.o uidswap.o uuencode.o misc.o \
         monitor_fdpass.o rijndael.o ssh-dss.o ssh-ecdsa.o ssh-rsa.o dh.o \
         kexdh.o kexgex.o kexdhc.o kexgexc.o bufec.o kexecdh.o kexecdhc.o \
@@ -145,7 +145,7 @@ Index: b/Makefile.in
         msg.o progressmeter.o dns.o entropy.o gss-genr.o umac.o jpake.o \
         schnorr.o ssh-pkcs11.o
  
-@@ -90,7 +91,7 @@
+@@ -91,7 +92,7 @@
         auth2-none.o auth2-passwd.o auth2-pubkey.o auth2-jpake.o \
         monitor_mm.o monitor.o monitor_wrap.o kexdhs.o kexgexs.o kexecdhs.o \
         auth-krb5.o \
diff --git a/debian/patches/lintian-symlink-pickiness.patch b/debian/patches/lintian-symlink-pickiness.patch
index b51377c2d..6e161f451 100644
--- a/debian/patches/lintian-symlink-pickiness.patch
+++ b/debian/patches/lintian-symlink-pickiness.patch
@@ -9,7 +9,7 @@ Index: b/Makefile.in
 ===================================================================
 --- a/Makefile.in
 +++ b/Makefile.in
-@@ -298,9 +298,9 @@
+@@ -299,9 +299,9 @@
         $(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
         $(INSTALL) -m 644 ssh-vulnkey.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-vulnkey.1
         -rm -f $(DESTDIR)$(bindir)/slogin
diff --git a/debian/patches/package-versioning.patch b/debian/patches/package-versioning.patch
index ffd416d98..0bcc7ed3b 100644
--- a/debian/patches/package-versioning.patch
+++ b/debian/patches/package-versioning.patch
@@ -38,7 +38,7 @@ Index: b/version.h
 --- a/version.h
 +++ b/version.h
 @@ -3,4 +3,9 @@
- #define SSH_VERSION    "OpenSSH_5.7"
+ #define SSH_VERSION    "OpenSSH_5.8"
  
  #define SSH_PORTABLE   "p1"
 -#define SSH_RELEASE    SSH_VERSION SSH_PORTABLE
diff --git a/debian/patches/selinux-build-failure.patch b/debian/patches/selinux-build-failure.patch
index 89b91ff00..6c99e3f38 100644
--- a/debian/patches/selinux-build-failure.patch
+++ b/debian/patches/selinux-build-failure.patch
@@ -1,236 +1,19 @@
 Description: Fix SELinux build failure
-Origin: backport, http://bazaar.launchpad.net/~vcs-imports/openssh/main/revision/6317
-Author: Damien Miller <djm@mindrot.org>
-Last-Update: 2011-01-25
+Origin: other, https://bugzilla.mindrot.org/attachment.cgi?id=1991&action=diff
+Author: Leonardo Chiqitto <leonardo@ngdn.org>
+Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=1851
+Last-Update: 2011-02-05
 
-Index: b/Makefile.in
-===================================================================
---- a/Makefile.in
-+++ b/Makefile.in
-@@ -48,6 +48,7 @@
- CFLAGS=@CFLAGS@
- CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ $(PATHS) @DEFS@
- LIBS=@LIBS@
-+SSHLIBS=@SSHLIBS@
- SSHDLIBS=@SSHDLIBS@
- LIBEDIT=@LIBEDIT@
- AR=@AR@
-@@ -145,7 +146,7 @@
-        $(RANLIB) $@
- 
- ssh$(EXEEXT): $(LIBCOMPAT) libssh.a $(SSHOBJS)
--       $(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
-+       $(LD) -o $@ $(SSHOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHLIBS) $(LIBS)
- 
- sshd$(EXEEXT): libssh.a        $(LIBCOMPAT) $(SSHDOBJS)
-        $(LD) -o $@ $(SSHDOBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(SSHDLIBS) $(LIBS)
-Index: b/configure.ac
-===================================================================
---- a/configure.ac
-+++ b/configure.ac
-@@ -761,7 +761,6 @@
-                        [ AC_DEFINE(USE_SOLARIS_PROCESS_CONTRACTS, 1,
-                                [Define if you have Solaris process contracts])
-                          SSHDLIBS="$SSHDLIBS -lcontract"
--                         AC_SUBST(SSHDLIBS)
-                          SPC_MSG="yes" ], )
-                ],
-        )
-@@ -772,7 +771,6 @@
-                        [ AC_DEFINE(USE_SOLARIS_PROJECTS, 1,
-                                [Define if you have Solaris projects])
-                        SSHDLIBS="$SSHDLIBS -lproject"
--                       AC_SUBST(SSHDLIBS)
-                        SP_MSG="yes" ], )
-                ],
-        )
-@@ -3539,11 +3537,14 @@
-                          LIBS="$LIBS -lselinux"
-                        ],
-                        AC_MSG_ERROR(SELinux support requires libselinux library))
-+               SSHLIBS="$SSHLIBS $LIBSELINUX"
-                SSHDLIBS="$SSHDLIBS $LIBSELINUX"
-                AC_CHECK_FUNCS(getseuserbyname get_default_context_with_level)
-                LIBS="$save_LIBS"
-        fi ]
- )
-+AC_SUBST(SSHLIBS)
-+AC_SUBST(SSHDLIBS)
- 
- # Check whether user wants Kerberos 5 support
- KRB5_MSG="no"
-@@ -4365,6 +4366,9 @@
- if test ! -z "${SSHDLIBS}"; then
- echo "         +for sshd: ${SSHDLIBS}"
- fi
-+if test ! -z "${SSHLIBS}"; then
-+echo "          +for ssh: ${SSHLIBS}"
-+fi
- 
- echo ""
- 
-Index: b/configure
-===================================================================
---- a/configure
-+++ b/configure
-@@ -696,7 +696,6 @@
- LOGIN_PROGRAM_FALLBACK
- PATH_PASSWD_PROG
- LD
--SSHDLIBS
- PKGCONFIG
- LIBEDIT
- TEST_SSH_SHA256
-@@ -721,6 +720,8 @@
- PROG_IPCS
- PROG_TAIL
- INSTALL_SSH_PRNG_CMDS
-+SSHLIBS
-+SSHDLIBS
- KRB5CONF
- PRIVSEP_PATH
- xauth_path
-@@ -9047,7 +9048,6 @@
- _ACEOF
- 
-                          SSHDLIBS="$SSHDLIBS -lcontract"
--
-                          SPC_MSG="yes"
- fi
- 
-@@ -9126,7 +9126,6 @@
- _ACEOF
- 
-                        SSHDLIBS="$SSHDLIBS -lproject"
--
-                        SP_MSG="yes"
- fi
- 
-@@ -27806,6 +27805,7 @@
-    { (exit 1); exit 1; }; }
- fi
- 
-+               SSHLIBS="$SSHLIBS $LIBSELINUX"
-                SSHDLIBS="$SSHDLIBS $LIBSELINUX"
- 
- 
-@@ -27908,6 +27908,8 @@
- fi
- 
- 
-+
-+
- # Check whether user wants Kerberos 5 support
- KRB5_MSG="no"
- 
-@@ -31416,7 +31418,6 @@
- LOGIN_PROGRAM_FALLBACK!$LOGIN_PROGRAM_FALLBACK$ac_delim
- PATH_PASSWD_PROG!$PATH_PASSWD_PROG$ac_delim
- LD!$LD$ac_delim
--SSHDLIBS!$SSHDLIBS$ac_delim
- PKGCONFIG!$PKGCONFIG$ac_delim
- LIBEDIT!$LIBEDIT$ac_delim
- TEST_SSH_SHA256!$TEST_SSH_SHA256$ac_delim
-@@ -31433,6 +31434,7 @@
- PROG_SAR!$PROG_SAR$ac_delim
- PROG_W!$PROG_W$ac_delim
- PROG_WHO!$PROG_WHO$ac_delim
-+PROG_LAST!$PROG_LAST$ac_delim
- _ACEOF
- 
-   if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 97; then
-@@ -31474,7 +31476,6 @@
- ac_delim='%!_!# '
- for ac_last_try in false false false false false :; do
-   cat >conf$$subs.sed <<_ACEOF
--PROG_LAST!$PROG_LAST$ac_delim
- PROG_LASTLOG!$PROG_LASTLOG$ac_delim
- PROG_DF!$PROG_DF$ac_delim
- PROG_VMSTAT!$PROG_VMSTAT$ac_delim
-@@ -31482,6 +31483,8 @@
- PROG_IPCS!$PROG_IPCS$ac_delim
- PROG_TAIL!$PROG_TAIL$ac_delim
- INSTALL_SSH_PRNG_CMDS!$INSTALL_SSH_PRNG_CMDS$ac_delim
-+SSHLIBS!$SSHLIBS$ac_delim
-+SSHDLIBS!$SSHDLIBS$ac_delim
- KRB5CONF!$KRB5CONF$ac_delim
- PRIVSEP_PATH!$PRIVSEP_PATH$ac_delim
- xauth_path!$xauth_path$ac_delim
-@@ -31496,7 +31499,7 @@
- LTLIBOBJS!$LTLIBOBJS$ac_delim
- _ACEOF
- 
--  if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 20; then
-+  if test `sed -n "s/.*$ac_delim\$/X/p" conf$$subs.sed | grep -c X` = 21; then
-     break
-   elif $ac_last_try; then
-     { { echo "$as_me:$LINENO: error: could not make $CONFIG_STATUS" >&5
-@@ -31993,6 +31996,9 @@
- if test ! -z "${SSHDLIBS}"; then
- echo "         +for sshd: ${SSHDLIBS}"
- fi
-+if test ! -z "${SSHLIBS}"; then
-+echo "          +for ssh: ${SSHLIBS}"
-+fi
- 
- echo ""
- 
 Index: b/openbsd-compat/port-linux.c
 ===================================================================
 --- a/openbsd-compat/port-linux.c
 +++ b/openbsd-compat/port-linux.c
-@@ -218,6 +218,20 @@
-        xfree(oldctx);
-        xfree(newctx);
- }
-+
-+void
-+ssh_selinux_setfscreatecon(const char *path)
-+{
-+               security_context_t context;
-+
-+               if (path == NULL) {
-+                       setfscreatecon(NULL);
-+                       return;
-+               }
-+               matchpathcon(path, 0700, &context);
-+               setfscreatecon(context);
-+}
-+
- #endif /* WITH_SELINUX */
- 
- #ifdef LINUX_OOM_ADJUST
-Index: b/openbsd-compat/port-linux.h
-===================================================================
---- a/openbsd-compat/port-linux.h
-+++ b/openbsd-compat/port-linux.h
-@@ -24,6 +24,7 @@
- void ssh_selinux_setup_pty(char *, const char *, const char *);
- void ssh_selinux_setup_exec_context(char *, const char *);
- void ssh_selinux_change_context(const char *);
-+void ssh_selinux_setfscreatecon(const char *);
- #endif
- 
- #ifdef LINUX_OOM_ADJUST
-Index: b/ssh.c
-===================================================================
---- a/ssh.c
-+++ b/ssh.c
-@@ -852,15 +852,12 @@
-            strcmp(pw->pw_dir, "/") ? "/" : "", _PATH_SSH_USER_DIR);
-        if (r > 0 && (size_t)r < sizeof(buf) && stat(buf, &st) < 0) {
- #ifdef WITH_SELINUX
--               char *scon;
--
--               matchpathcon(buf, 0700, &scon);
--               setfscreatecon(scon);
-+               ssh_selinux_setfscreatecon(buf);
- #endif
-                if (mkdir(buf, 0700) < 0)
-                        error("Could not create directory '%.200s'.", buf);
- #ifdef WITH_SELINUX
--               setfscreatecon(NULL);
-+               ssh_selinux_setfscreatecon(NULL);
- #endif
+@@ -226,7 +226,7 @@
+ 
+        if (!ssh_selinux_enabled())
+                return;
+-       if (path == NULL)
++       if (path == NULL) {
+                setfscreatecon(NULL);
+                return;
         }
-        /* load options.identity_files */
diff --git a/debian/patches/selinux-role.patch b/debian/patches/selinux-role.patch
index 30db352dd..70364f9d5 100644
--- a/debian/patches/selinux-role.patch
+++ b/debian/patches/selinux-role.patch
@@ -336,8 +336,8 @@ Index: b/openbsd-compat/port-linux.h
 +void ssh_selinux_setup_pty(char *, const char *, const char *);
 +void ssh_selinux_setup_exec_context(char *, const char *);
  void ssh_selinux_change_context(const char *);
+ void ssh_selinux_setfscreatecon(const char *);
  #endif
- 
 Index: b/platform.c
 ===================================================================
 --- a/platform.c
diff --git a/debian/patches/selinux-setfscreatecon-crash.patch b/debian/patches/selinux-setfscreatecon-crash.patch
deleted file mode 100644
index 8d09d3529..000000000
--- a/debian/patches/selinux-setfscreatecon-crash.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-Description: Fix crash in ssh_selinux_setfscreatecon when SELinux is disabled
-Author: Colin Watson <cjwatson@ubuntu.com>
-Bug-Ubuntu: https://bugs.launchpad.net/bugs/708571
-Forwarded: https://bugzilla.mindrot.org/show_bug.cgi?id=1851
-Last-Update: 2011-01-27
-
-Index: b/openbsd-compat/port-linux.c
-===================================================================
---- a/openbsd-compat/port-linux.c
-+++ b/openbsd-compat/port-linux.c
-@@ -224,12 +224,15 @@
- {
-                security_context_t context;
- 
-+               if (!ssh_selinux_enabled())
-+                       return;
-+
-                if (path == NULL) {
-                        setfscreatecon(NULL);
-                        return;
-                }
--               matchpathcon(path, 0700, &context);
--               setfscreatecon(context);
-+               if (matchpathcon(path, 0700, &context) == 0)
-+                       setfscreatecon(context);
- }
- 
- #endif /* WITH_SELINUX */
diff --git a/debian/patches/series b/debian/patches/series
index 15b5d91db..a243174dd 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -36,11 +36,8 @@ openbsd-docs.patch
 ssh-argv0.patch
 doc-hash-tab-completion.patch
 
-# Upstream backports
-selinux-build-failure.patch
-
 # Miscellaneous bug fixes
-selinux-setfscreatecon-crash.patch
+selinux-build-failure.patch
 
 # Debian-specific configuration
 gnome-ssh-askpass2-icon.patch
diff --git a/debian/patches/ssh-vulnkey.patch b/debian/patches/ssh-vulnkey.patch
index 78c9833cd..f3e08b06d 100644
--- a/debian/patches/ssh-vulnkey.patch
+++ b/debian/patches/ssh-vulnkey.patch
@@ -32,7 +32,7 @@ Index: b/Makefile.in
  
  CC=@CC@
  LD=@LD@
-@@ -63,7 +65,7 @@
+@@ -64,7 +66,7 @@
  INSTALL_SSH_PRNG_CMDS=@INSTALL_SSH_PRNG_CMDS@
  INSTALL_SSH_RAND_HELPER=@INSTALL_SSH_RAND_HELPER@
  
@@ -41,7 +41,7 @@ Index: b/Makefile.in
  
  LIBSSH_OBJS=acss.o authfd.o authfile.o bufaux.o bufbn.o buffer.o \
         canohost.o channels.o cipher.o cipher-acss.o cipher-aes.o \
-@@ -96,8 +98,8 @@
+@@ -97,8 +99,8 @@
         sftp-server.o sftp-common.o \
         roaming_common.o roaming_serv.o
  
@@ -52,7 +52,7 @@ Index: b/Makefile.in
  MANTYPE                = @MANTYPE@
  
  CONFIGFILES=sshd_config.out ssh_config.out moduli.out
-@@ -178,6 +180,9 @@
+@@ -179,6 +181,9 @@
  ssh-rand-helper${EXEEXT}: $(LIBCOMPAT) libssh.a ssh-rand-helper.o
         $(LD) -o $@ ssh-rand-helper.o $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS)
  
@@ -62,7 +62,7 @@ Index: b/Makefile.in
  # test driver for the loginrec code - not built by default
  logintest: logintest.o $(LIBCOMPAT) libssh.a loginrec.o
         $(LD) -o $@ logintest.o $(LDFLAGS) loginrec.o -lopenbsd-compat -lssh $(LIBS)
-@@ -272,6 +277,7 @@
+@@ -273,6 +278,7 @@
         $(INSTALL) -m 0755 $(STRIP_OPT) ssh-pkcs11-helper$(EXEEXT) $(DESTDIR)$(SSH_PKCS11_HELPER)$(EXEEXT)
         $(INSTALL) -m 0755 $(STRIP_OPT) sftp$(EXEEXT) $(DESTDIR)$(bindir)/sftp$(EXEEXT)
         $(INSTALL) -m 0755 $(STRIP_OPT) sftp-server$(EXEEXT) $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
@@ -70,7 +70,7 @@ Index: b/Makefile.in
         $(INSTALL) -m 644 ssh.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh.1
         $(INSTALL) -m 644 scp.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/scp.1
         $(INSTALL) -m 644 ssh-add.1.out $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-add.1
-@@ -289,6 +295,7 @@
+@@ -290,6 +296,7 @@
         $(INSTALL) -m 644 sftp-server.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/sftp-server.8
         $(INSTALL) -m 644 ssh-keysign.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-keysign.8
         $(INSTALL) -m 644 ssh-pkcs11-helper.8.out $(DESTDIR)$(mandir)/$(mansubdir)8/ssh-pkcs11-helper.8
@@ -78,7 +78,7 @@ Index: b/Makefile.in
         -rm -f $(DESTDIR)$(bindir)/slogin
         ln -s ./ssh$(EXEEXT) $(DESTDIR)$(bindir)/slogin
         -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/slogin.1
-@@ -378,6 +385,7 @@
+@@ -379,6 +386,7 @@
         -rm -f $(DESTDIR)$(bindir)/ssh-agent$(EXEEXT)
         -rm -f $(DESTDIR)$(bindir)/ssh-keygen$(EXEEXT)
         -rm -f $(DESTDIR)$(bindir)/ssh-keyscan$(EXEEXT)
@@ -86,7 +86,7 @@ Index: b/Makefile.in
         -rm -f $(DESTDIR)$(bindir)/sftp$(EXEEXT)
         -rm -f $(DESTDIR)$(sbindir)/sshd$(EXEEXT)
         -rm -r $(DESTDIR)$(SFTP_SERVER)$(EXEEXT)
-@@ -391,6 +399,7 @@
+@@ -392,6 +400,7 @@
         -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-keygen.1
         -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/sftp.1
         -rm -f $(DESTDIR)$(mandir)/$(mansubdir)1/ssh-keyscan.1
@@ -1248,7 +1248,7 @@ Index: b/ssh.c
 ===================================================================
 --- a/ssh.c
 +++ b/ssh.c
-@@ -1448,7 +1448,7 @@
+@@ -1445,7 +1445,7 @@
  static void
  load_public_identity_files(void)
  {
@@ -1257,7 +1257,7 @@ Index: b/ssh.c
         char *pwdir = NULL, *pwname = NULL;
         int i = 0;
         Key *public;
-@@ -1505,6 +1505,22 @@
+@@ -1502,6 +1502,22 @@
                 public = key_load_public(filename, NULL);
                 debug("identity file %s type %d", filename,
                     public ? public->type : -1);