summaryrefslogtreecommitdiff
path: root/debian
diff options
context:
space:
mode:
authorColin Watson <cjwatson@debian.org>2019-02-28 10:37:30 +0000
committerColin Watson <cjwatson@debian.org>2019-02-28 10:37:50 +0000
commit4418a1e80ce0dcc010b4a6efa9ae6056fce99f8c (patch)
tree137c9d64fa8750ad13ba239472a1829bd1b240e1 /debian
parente321545f23ce308bc12d28d6975f75bdc8b7061e (diff)
parentd94226d4fcefbc398c5583e12b5d07ca33884ba4 (diff)
Request RSA-SHA2 signatures for corresponding cert algorithms
Closes: #923419
Diffstat (limited to 'debian')
-rw-r--r--debian/.git-dpm4
-rw-r--r--debian/changelog3
-rw-r--r--debian/patches/request-rsa-sha2-cert-signatures.patch39
-rw-r--r--debian/patches/series1
4 files changed, 45 insertions, 2 deletions
diff --git a/debian/.git-dpm b/debian/.git-dpm
index a45865db0..42208f2de 100644
--- a/debian/.git-dpm
+++ b/debian/.git-dpm
@@ -1,6 +1,6 @@
1# see git-dpm(1) from git-dpm package 1# see git-dpm(1) from git-dpm package
25e021158aa22cc64da4fca1618ee0bfd2d031049 2d94226d4fcefbc398c5583e12b5d07ca33884ba4
35e021158aa22cc64da4fca1618ee0bfd2d031049 3d94226d4fcefbc398c5583e12b5d07ca33884ba4
43d246f10429fc9a37b98eabef94fe8dc7c61002b 43d246f10429fc9a37b98eabef94fe8dc7c61002b
53d246f10429fc9a37b98eabef94fe8dc7c61002b 53d246f10429fc9a37b98eabef94fe8dc7c61002b
6openssh_7.9p1.orig.tar.gz 6openssh_7.9p1.orig.tar.gz
diff --git a/debian/changelog b/debian/changelog
index ce7ec26fe..75d338a73 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -3,6 +3,9 @@ openssh (1:7.9p1-8) UNRELEASED; urgency=medium
3 * Apply upstream patch to fix bug in HostbasedAcceptedKeyTypes and 3 * Apply upstream patch to fix bug in HostbasedAcceptedKeyTypes and
4 PubkeyAcceptedKeyTypes options in the case where only RSA-SHA2 signature 4 PubkeyAcceptedKeyTypes options in the case where only RSA-SHA2 signature
5 types were specified. 5 types were specified.
6 * Apply upstream patch to request RSA-SHA2 signatures for
7 rsa-sha2-{256|512}-cert-v01@openssh.com cert algorithms (closes:
8 #923419).
6 9
7 -- Colin Watson <cjwatson@debian.org> Thu, 28 Feb 2019 10:33:32 +0000 10 -- Colin Watson <cjwatson@debian.org> Thu, 28 Feb 2019 10:33:32 +0000
8 11
diff --git a/debian/patches/request-rsa-sha2-cert-signatures.patch b/debian/patches/request-rsa-sha2-cert-signatures.patch
new file mode 100644
index 000000000..2c876be31
--- /dev/null
+++ b/debian/patches/request-rsa-sha2-cert-signatures.patch
@@ -0,0 +1,39 @@
1From d94226d4fcefbc398c5583e12b5d07ca33884ba4 Mon Sep 17 00:00:00 2001
2From: "djm@openbsd.org" <djm@openbsd.org>
3Date: Thu, 27 Dec 2018 23:02:11 +0000
4Subject: upstream: Request RSA-SHA2 signatures for
5
6rsa-sha2-{256|512}-cert-v01@openssh.com cert algorithms; ok markus@
7
8OpenBSD-Commit-ID: afc6f7ca216ccd821656d1c911d2a3deed685033
9
10Origin: upstream, https://anongit.mindrot.org/openssh.git/commit/?id=f429c1b2ef631f2855e51a790cf71761d752bbca
11Bug: https://bugzilla.mindrot.org/show_bug.cgi?id=2944
12Bug-Debian: https://bugs.debian.org/923419
13Last-Update: 2019-02-28
14
15Patch-Name: request-rsa-sha2-cert-signatures.patch
16---
17 authfd.c | 8 +++++---
18 1 file changed, 5 insertions(+), 3 deletions(-)
19
20diff --git a/authfd.c b/authfd.c
21index ecdd869ab..62cbf8c19 100644
22--- a/authfd.c
23+++ b/authfd.c
24@@ -327,10 +327,12 @@ ssh_free_identitylist(struct ssh_identitylist *idl)
25 static u_int
26 agent_encode_alg(const struct sshkey *key, const char *alg)
27 {
28- if (alg != NULL && key->type == KEY_RSA) {
29- if (strcmp(alg, "rsa-sha2-256") == 0)
30+ if (alg != NULL && sshkey_type_plain(key->type) == KEY_RSA) {
31+ if (strcmp(alg, "rsa-sha2-256") == 0 ||
32+ strcmp(alg, "rsa-sha2-256-cert-v01@openssh.com") == 0)
33 return SSH_AGENT_RSA_SHA2_256;
34- else if (strcmp(alg, "rsa-sha2-512") == 0)
35+ if (strcmp(alg, "rsa-sha2-512") == 0 ||
36+ strcmp(alg, "rsa-sha2-512-cert-v01@openssh.com") == 0)
37 return SSH_AGENT_RSA_SHA2_512;
38 }
39 return 0;
diff --git a/debian/patches/series b/debian/patches/series
index 12358dcf0..a95dccaa6 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -29,3 +29,4 @@ sanitize-scp-filenames-via-snmprintf.patch
29have-progressmeter-force-update-at-beginning-and-end-transfer.patch 29have-progressmeter-force-update-at-beginning-and-end-transfer.patch
30check-filenames-in-scp-client.patch 30check-filenames-in-scp-client.patch
31fix-key-type-check.patch 31fix-key-type-check.patch
32request-rsa-sha2-cert-signatures.patch