summaryrefslogtreecommitdiff
path: root/debian/patches
diff options
context:
space:
mode:
Diffstat (limited to 'debian/patches')
-rw-r--r--debian/patches/auth-log-verbosity.patch8
-rw-r--r--debian/patches/authorized-keys-man-symlink.patch2
-rw-r--r--debian/patches/consolekit.patch22
-rw-r--r--debian/patches/debian-banner.patch8
-rw-r--r--debian/patches/debian-config.patch10
-rw-r--r--debian/patches/dnssec-sshfp.patch6
-rw-r--r--debian/patches/doc-hash-tab-completion.patch2
-rw-r--r--debian/patches/doc-upstart.patch2
-rw-r--r--debian/patches/gnome-ssh-askpass2-icon.patch2
-rw-r--r--debian/patches/gssapi.patch66
-rw-r--r--debian/patches/helpful-wait-terminate.patch2
-rw-r--r--debian/patches/keepalive-extensions.patch6
-rw-r--r--debian/patches/lintian-symlink-pickiness.patch2
-rw-r--r--debian/patches/mention-ssh-keygen-on-keychange.patch2
-rw-r--r--debian/patches/no-openssl-version-check.patch2
-rw-r--r--debian/patches/openbsd-docs.patch10
-rw-r--r--debian/patches/package-versioning.patch6
-rw-r--r--debian/patches/quieter-signals.patch2
-rw-r--r--debian/patches/scp-quoting.patch2
-rw-r--r--debian/patches/selinux-role.patch32
-rw-r--r--debian/patches/series1
-rw-r--r--debian/patches/shell-path.patch2
-rw-r--r--debian/patches/sigstop.patch2
-rw-r--r--debian/patches/ssh-agent-setgid.patch2
-rw-r--r--debian/patches/ssh-argv0.patch2
-rw-r--r--debian/patches/ssh-vulnkey-compat.patch4
-rw-r--r--debian/patches/ssh1-keepalive.patch4
-rw-r--r--debian/patches/sshfp_with_server_cert112
-rw-r--r--debian/patches/syslog-level-silent.patch4
-rw-r--r--debian/patches/user-group-modes.patch16
30 files changed, 228 insertions, 115 deletions
diff --git a/debian/patches/auth-log-verbosity.patch b/debian/patches/auth-log-verbosity.patch
index 8d26d7b6f..96632057b 100644
--- a/debian/patches/auth-log-verbosity.patch
+++ b/debian/patches/auth-log-verbosity.patch
@@ -9,10 +9,10 @@ Last-Update: 2013-09-14
9 9
10Patch-Name: auth-log-verbosity.patch 10Patch-Name: auth-log-verbosity.patch
11--- 11---
12 auth-options.c | 35 ++++++++++++++++++++++++++--------- 12 auth-options.c | 35 ++++++++++++++++++++++++++---------
13 auth-options.h | 1 + 13 auth-options.h | 1 +
14 auth-rsa.c | 2 ++ 14 auth-rsa.c | 2 ++
15 auth2-pubkey.c | 3 +++ 15 auth2-pubkey.c | 3 +++
16 4 files changed, 32 insertions(+), 9 deletions(-) 16 4 files changed, 32 insertions(+), 9 deletions(-)
17 17
18diff --git a/auth-options.c b/auth-options.c 18diff --git a/auth-options.c b/auth-options.c
diff --git a/debian/patches/authorized-keys-man-symlink.patch b/debian/patches/authorized-keys-man-symlink.patch
index 74bfb46e6..fbe7b40c0 100644
--- a/debian/patches/authorized-keys-man-symlink.patch
+++ b/debian/patches/authorized-keys-man-symlink.patch
@@ -9,7 +9,7 @@ Last-Update: 2013-09-14
9 9
10Patch-Name: authorized-keys-man-symlink.patch 10Patch-Name: authorized-keys-man-symlink.patch
11--- 11---
12 Makefile.in | 1 + 12 Makefile.in | 1 +
13 1 file changed, 1 insertion(+) 13 1 file changed, 1 insertion(+)
14 14
15diff --git a/Makefile.in b/Makefile.in 15diff --git a/Makefile.in b/Makefile.in
diff --git a/debian/patches/consolekit.patch b/debian/patches/consolekit.patch
index e3ff4d7e4..938bd6baa 100644
--- a/debian/patches/consolekit.patch
+++ b/debian/patches/consolekit.patch
@@ -8,17 +8,17 @@ Last-Updated: 2014-03-20
8 8
9Patch-Name: consolekit.patch 9Patch-Name: consolekit.patch
10--- 10---
11 Makefile.in | 3 +- 11 Makefile.in | 3 +-
12 configure | 132 +++++++++++++++++++++++++++++++ 12 configure | 132 +++++++++++++++++++++++++++++++
13 configure.ac | 25 ++++++ 13 configure.ac | 25 ++++++
14 consolekit.c | 240 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 14 consolekit.c | 240 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
15 consolekit.h | 24 ++++++ 15 consolekit.h | 24 ++++++
16 monitor.c | 42 ++++++++++ 16 monitor.c | 42 ++++++++++
17 monitor.h | 2 + 17 monitor.h | 2 +
18 monitor_wrap.c | 30 ++++++++ 18 monitor_wrap.c | 30 +++++++
19 monitor_wrap.h | 4 + 19 monitor_wrap.h | 4 +
20 session.c | 13 ++++ 20 session.c | 13 +++
21 session.h | 6 ++ 21 session.h | 6 ++
22 11 files changed, 520 insertions(+), 1 deletion(-) 22 11 files changed, 520 insertions(+), 1 deletion(-)
23 create mode 100644 consolekit.c 23 create mode 100644 consolekit.c
24 create mode 100644 consolekit.h 24 create mode 100644 consolekit.h
diff --git a/debian/patches/debian-banner.patch b/debian/patches/debian-banner.patch
index 49219cf93..14e6a5d54 100644
--- a/debian/patches/debian-banner.patch
+++ b/debian/patches/debian-banner.patch
@@ -12,10 +12,10 @@ Last-Update: 2013-09-14
12 12
13Patch-Name: debian-banner.patch 13Patch-Name: debian-banner.patch
14--- 14---
15 servconf.c | 9 +++++++++ 15 servconf.c | 9 +++++++++
16 servconf.h | 2 ++ 16 servconf.h | 2 ++
17 sshd.c | 3 ++- 17 sshd.c | 3 ++-
18 sshd_config.5 | 5 +++++ 18 sshd_config.5 | 5 +++++
19 4 files changed, 18 insertions(+), 1 deletion(-) 19 4 files changed, 18 insertions(+), 1 deletion(-)
20 20
21diff --git a/servconf.c b/servconf.c 21diff --git a/servconf.c b/servconf.c
diff --git a/debian/patches/debian-config.patch b/debian/patches/debian-config.patch
index 9bb0c6520..ac15d90e0 100644
--- a/debian/patches/debian-config.patch
+++ b/debian/patches/debian-config.patch
@@ -26,11 +26,11 @@ Last-Update: 2014-02-12
26 26
27Patch-Name: debian-config.patch 27Patch-Name: debian-config.patch
28--- 28---
29 readconf.c | 2 +- 29 readconf.c | 2 +-
30 ssh_config | 7 ++++++- 30 ssh_config | 7 ++++++-
31 ssh_config.5 | 19 ++++++++++++++++++- 31 ssh_config.5 | 19 ++++++++++++++++++-
32 sshd_config | 1 + 32 sshd_config | 1 +
33 sshd_config.5 | 25 +++++++++++++++++++++++++ 33 sshd_config.5 | 25 +++++++++++++++++++++++++
34 5 files changed, 51 insertions(+), 3 deletions(-) 34 5 files changed, 51 insertions(+), 3 deletions(-)
35 35
36diff --git a/readconf.c b/readconf.c 36diff --git a/readconf.c b/readconf.c
diff --git a/debian/patches/dnssec-sshfp.patch b/debian/patches/dnssec-sshfp.patch
index bc89c50fc..b3889ba0e 100644
--- a/debian/patches/dnssec-sshfp.patch
+++ b/debian/patches/dnssec-sshfp.patch
@@ -12,9 +12,9 @@ Last-Update: 2010-04-06
12 12
13Patch-Name: dnssec-sshfp.patch 13Patch-Name: dnssec-sshfp.patch
14--- 14---
15 dns.c | 14 +++++++++++++- 15 dns.c | 14 +++++++++++++-
16 openbsd-compat/getrrsetbyname.c | 10 +++++----- 16 openbsd-compat/getrrsetbyname.c | 10 +++++-----
17 openbsd-compat/getrrsetbyname.h | 3 +++ 17 openbsd-compat/getrrsetbyname.h | 3 +++
18 3 files changed, 21 insertions(+), 6 deletions(-) 18 3 files changed, 21 insertions(+), 6 deletions(-)
19 19
20diff --git a/dns.c b/dns.c 20diff --git a/dns.c b/dns.c
diff --git a/debian/patches/doc-hash-tab-completion.patch b/debian/patches/doc-hash-tab-completion.patch
index 16c40b05f..73ca79c6b 100644
--- a/debian/patches/doc-hash-tab-completion.patch
+++ b/debian/patches/doc-hash-tab-completion.patch
@@ -9,7 +9,7 @@ Last-Update: 2013-09-14
9 9
10Patch-Name: doc-hash-tab-completion.patch 10Patch-Name: doc-hash-tab-completion.patch
11--- 11---
12 ssh_config.5 | 3 +++ 12 ssh_config.5 | 3 +++
13 1 file changed, 3 insertions(+) 13 1 file changed, 3 insertions(+)
14 14
15diff --git a/ssh_config.5 b/ssh_config.5 15diff --git a/ssh_config.5 b/ssh_config.5
diff --git a/debian/patches/doc-upstart.patch b/debian/patches/doc-upstart.patch
index da8fc7ed4..873869869 100644
--- a/debian/patches/doc-upstart.patch
+++ b/debian/patches/doc-upstart.patch
@@ -8,7 +8,7 @@ Last-Update: 2013-09-14
8 8
9Patch-Name: doc-upstart.patch 9Patch-Name: doc-upstart.patch
10--- 10---
11 sshd.8 | 5 ++++- 11 sshd.8 | 5 ++++-
12 1 file changed, 4 insertions(+), 1 deletion(-) 12 1 file changed, 4 insertions(+), 1 deletion(-)
13 13
14diff --git a/sshd.8 b/sshd.8 14diff --git a/sshd.8 b/sshd.8
diff --git a/debian/patches/gnome-ssh-askpass2-icon.patch b/debian/patches/gnome-ssh-askpass2-icon.patch
index dab518f65..7503cc172 100644
--- a/debian/patches/gnome-ssh-askpass2-icon.patch
+++ b/debian/patches/gnome-ssh-askpass2-icon.patch
@@ -8,7 +8,7 @@ Last-Update: 2010-02-28
8 8
9Patch-Name: gnome-ssh-askpass2-icon.patch 9Patch-Name: gnome-ssh-askpass2-icon.patch
10--- 10---
11 contrib/gnome-ssh-askpass2.c | 2 ++ 11 contrib/gnome-ssh-askpass2.c | 2 ++
12 1 file changed, 2 insertions(+) 12 1 file changed, 2 insertions(+)
13 13
14diff --git a/contrib/gnome-ssh-askpass2.c b/contrib/gnome-ssh-askpass2.c 14diff --git a/contrib/gnome-ssh-askpass2.c b/contrib/gnome-ssh-askpass2.c
diff --git a/debian/patches/gssapi.patch b/debian/patches/gssapi.patch
index d8439bf03..cf0ad8cad 100644
--- a/debian/patches/gssapi.patch
+++ b/debian/patches/gssapi.patch
@@ -21,39 +21,39 @@ Last-Updated: 2014-03-19
21 21
22Patch-Name: gssapi.patch 22Patch-Name: gssapi.patch
23--- 23---
24 ChangeLog.gssapi | 113 +++++++++++++++++++ 24 ChangeLog.gssapi | 113 +++++++++++++++++++
25 Makefile.in | 3 +- 25 Makefile.in | 3 +-
26 auth-krb5.c | 17 ++- 26 auth-krb5.c | 17 ++-
27 auth2-gss.c | 48 +++++++- 27 auth2-gss.c | 48 +++++++-
28 auth2.c | 2 + 28 auth2.c | 2 +
29 clientloop.c | 13 +++ 29 clientloop.c | 13 +++
30 config.h.in | 6 + 30 config.h.in | 6 +
31 configure | 57 ++++++++++ 31 configure | 57 ++++++++++
32 configure.ac | 24 ++++ 32 configure.ac | 24 ++++
33 gss-genr.c | 275 ++++++++++++++++++++++++++++++++++++++++++++- 33 gss-genr.c | 275 +++++++++++++++++++++++++++++++++++++++++++-
34 gss-serv-krb5.c | 85 ++++++++++++-- 34 gss-serv-krb5.c | 85 ++++++++++++--
35 gss-serv.c | 221 +++++++++++++++++++++++++++++++----- 35 gss-serv.c | 221 +++++++++++++++++++++++++++++++-----
36 kex.c | 16 +++ 36 kex.c | 16 +++
37 kex.h | 14 +++ 37 kex.h | 14 +++
38 kexgssc.c | 332 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 38 kexgssc.c | 332 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
39 kexgsss.c | 289 ++++++++++++++++++++++++++++++++++++++++++++++++ 39 kexgsss.c | 289 +++++++++++++++++++++++++++++++++++++++++++++++
40 key.c | 3 +- 40 key.c | 3 +-
41 key.h | 1 + 41 key.h | 1 +
42 monitor.c | 108 +++++++++++++++++- 42 monitor.c | 108 +++++++++++++++++-
43 monitor.h | 3 + 43 monitor.h | 3 +
44 monitor_wrap.c | 47 +++++++- 44 monitor_wrap.c | 47 +++++++-
45 monitor_wrap.h | 4 +- 45 monitor_wrap.h | 4 +-
46 readconf.c | 42 +++++++ 46 readconf.c | 42 +++++++
47 readconf.h | 5 + 47 readconf.h | 5 +
48 servconf.c | 38 ++++++- 48 servconf.c | 38 ++++++-
49 servconf.h | 3 + 49 servconf.h | 3 +
50 ssh-gss.h | 41 ++++++- 50 ssh-gss.h | 41 ++++++-
51 ssh_config | 2 + 51 ssh_config | 2 +
52 ssh_config.5 | 34 +++++- 52 ssh_config.5 | 34 +++++-
53 sshconnect2.c | 124 ++++++++++++++++++++- 53 sshconnect2.c | 124 +++++++++++++++++++-
54 sshd.c | 110 ++++++++++++++++++ 54 sshd.c | 110 ++++++++++++++++++
55 sshd_config | 2 + 55 sshd_config | 2 +
56 sshd_config.5 | 28 +++++ 56 sshd_config.5 | 28 +++++
57 33 files changed, 2051 insertions(+), 59 deletions(-) 57 33 files changed, 2051 insertions(+), 59 deletions(-)
58 create mode 100644 ChangeLog.gssapi 58 create mode 100644 ChangeLog.gssapi
59 create mode 100644 kexgssc.c 59 create mode 100644 kexgssc.c
diff --git a/debian/patches/helpful-wait-terminate.patch b/debian/patches/helpful-wait-terminate.patch
index e79f4990f..bcfc13c99 100644
--- a/debian/patches/helpful-wait-terminate.patch
+++ b/debian/patches/helpful-wait-terminate.patch
@@ -8,7 +8,7 @@ Last-Update: 2010-02-27
8 8
9Patch-Name: helpful-wait-terminate.patch 9Patch-Name: helpful-wait-terminate.patch
10--- 10---
11 serverloop.c | 2 +- 11 serverloop.c | 2 +-
12 1 file changed, 1 insertion(+), 1 deletion(-) 12 1 file changed, 1 insertion(+), 1 deletion(-)
13 13
14diff --git a/serverloop.c b/serverloop.c 14diff --git a/serverloop.c b/serverloop.c
diff --git a/debian/patches/keepalive-extensions.patch b/debian/patches/keepalive-extensions.patch
index 680701f3d..00066c220 100644
--- a/debian/patches/keepalive-extensions.patch
+++ b/debian/patches/keepalive-extensions.patch
@@ -20,9 +20,9 @@ Last-Update: 2013-09-14
20 20
21Patch-Name: keepalive-extensions.patch 21Patch-Name: keepalive-extensions.patch
22--- 22---
23 readconf.c | 14 ++++++++++++-- 23 readconf.c | 14 ++++++++++++--
24 ssh_config.5 | 21 +++++++++++++++++++-- 24 ssh_config.5 | 21 +++++++++++++++++++--
25 sshd_config.5 | 3 +++ 25 sshd_config.5 | 3 +++
26 3 files changed, 34 insertions(+), 4 deletions(-) 26 3 files changed, 34 insertions(+), 4 deletions(-)
27 27
28diff --git a/readconf.c b/readconf.c 28diff --git a/readconf.c b/readconf.c
diff --git a/debian/patches/lintian-symlink-pickiness.patch b/debian/patches/lintian-symlink-pickiness.patch
index 09e09ecf8..2cd0c0bb5 100644
--- a/debian/patches/lintian-symlink-pickiness.patch
+++ b/debian/patches/lintian-symlink-pickiness.patch
@@ -11,7 +11,7 @@ Last-Update: 2013-09-14
11 11
12Patch-Name: lintian-symlink-pickiness.patch 12Patch-Name: lintian-symlink-pickiness.patch
13--- 13---
14 Makefile.in | 4 ++-- 14 Makefile.in | 4 ++--
15 1 file changed, 2 insertions(+), 2 deletions(-) 15 1 file changed, 2 insertions(+), 2 deletions(-)
16 16
17diff --git a/Makefile.in b/Makefile.in 17diff --git a/Makefile.in b/Makefile.in
diff --git a/debian/patches/mention-ssh-keygen-on-keychange.patch b/debian/patches/mention-ssh-keygen-on-keychange.patch
index e00b6c345..261a28f38 100644
--- a/debian/patches/mention-ssh-keygen-on-keychange.patch
+++ b/debian/patches/mention-ssh-keygen-on-keychange.patch
@@ -9,7 +9,7 @@ Last-Update: 2013-09-14
9 9
10Patch-Name: mention-ssh-keygen-on-keychange.patch 10Patch-Name: mention-ssh-keygen-on-keychange.patch
11--- 11---
12 sshconnect.c | 7 ++++++- 12 sshconnect.c | 7 ++++++-
13 1 file changed, 6 insertions(+), 1 deletion(-) 13 1 file changed, 6 insertions(+), 1 deletion(-)
14 14
15diff --git a/sshconnect.c b/sshconnect.c 15diff --git a/sshconnect.c b/sshconnect.c
diff --git a/debian/patches/no-openssl-version-check.patch b/debian/patches/no-openssl-version-check.patch
index 56fa46aac..67b24c80c 100644
--- a/debian/patches/no-openssl-version-check.patch
+++ b/debian/patches/no-openssl-version-check.patch
@@ -13,7 +13,7 @@ Last-Update: 2013-12-23
13 13
14Patch-Name: no-openssl-version-check.patch 14Patch-Name: no-openssl-version-check.patch
15--- 15---
16 entropy.c | 12 ------------ 16 entropy.c | 12 ------------
17 1 file changed, 12 deletions(-) 17 1 file changed, 12 deletions(-)
18 18
19diff --git a/entropy.c b/entropy.c 19diff --git a/entropy.c b/entropy.c
diff --git a/debian/patches/openbsd-docs.patch b/debian/patches/openbsd-docs.patch
index 9a34a4182..88c0241ec 100644
--- a/debian/patches/openbsd-docs.patch
+++ b/debian/patches/openbsd-docs.patch
@@ -14,11 +14,11 @@ Last-Update: 2013-09-14
14 14
15Patch-Name: openbsd-docs.patch 15Patch-Name: openbsd-docs.patch
16--- 16---
17 moduli.5 | 4 ++-- 17 moduli.5 | 4 ++--
18 ssh-keygen.1 | 12 ++++-------- 18 ssh-keygen.1 | 12 ++++--------
19 ssh.1 | 4 ++++ 19 ssh.1 | 4 ++++
20 sshd.8 | 5 ++--- 20 sshd.8 | 5 ++---
21 sshd_config.5 | 3 +-- 21 sshd_config.5 | 3 +--
22 5 files changed, 13 insertions(+), 15 deletions(-) 22 5 files changed, 13 insertions(+), 15 deletions(-)
23 23
24diff --git a/moduli.5 b/moduli.5 24diff --git a/moduli.5 b/moduli.5
diff --git a/debian/patches/package-versioning.patch b/debian/patches/package-versioning.patch
index c9c20d1c0..49a3b17a6 100644
--- a/debian/patches/package-versioning.patch
+++ b/debian/patches/package-versioning.patch
@@ -13,9 +13,9 @@ Last-Update: 2013-09-14
13 13
14Patch-Name: package-versioning.patch 14Patch-Name: package-versioning.patch
15--- 15---
16 sshconnect.c | 4 ++-- 16 sshconnect.c | 4 ++--
17 sshd.c | 2 +- 17 sshd.c | 2 +-
18 version.h | 7 ++++++- 18 version.h | 7 ++++++-
19 3 files changed, 9 insertions(+), 4 deletions(-) 19 3 files changed, 9 insertions(+), 4 deletions(-)
20 20
21diff --git a/sshconnect.c b/sshconnect.c 21diff --git a/sshconnect.c b/sshconnect.c
diff --git a/debian/patches/quieter-signals.patch b/debian/patches/quieter-signals.patch
index 075b59823..ca713dfc3 100644
--- a/debian/patches/quieter-signals.patch
+++ b/debian/patches/quieter-signals.patch
@@ -18,7 +18,7 @@ Last-Update: 2013-09-14
18 18
19Patch-Name: quieter-signals.patch 19Patch-Name: quieter-signals.patch
20--- 20---
21 clientloop.c | 6 ++++-- 21 clientloop.c | 6 ++++--
22 1 file changed, 4 insertions(+), 2 deletions(-) 22 1 file changed, 4 insertions(+), 2 deletions(-)
23 23
24diff --git a/clientloop.c b/clientloop.c 24diff --git a/clientloop.c b/clientloop.c
diff --git a/debian/patches/scp-quoting.patch b/debian/patches/scp-quoting.patch
index ff037a43a..7749c8ea3 100644
--- a/debian/patches/scp-quoting.patch
+++ b/debian/patches/scp-quoting.patch
@@ -13,7 +13,7 @@ Last-Update: 2010-02-27
13 13
14Patch-Name: scp-quoting.patch 14Patch-Name: scp-quoting.patch
15--- 15---
16 scp.c | 12 ++++++++++-- 16 scp.c | 12 ++++++++++--
17 1 file changed, 10 insertions(+), 2 deletions(-) 17 1 file changed, 10 insertions(+), 2 deletions(-)
18 18
19diff --git a/scp.c b/scp.c 19diff --git a/scp.c b/scp.c
diff --git a/debian/patches/selinux-role.patch b/debian/patches/selinux-role.patch
index e0ca12fb0..48f901c02 100644
--- a/debian/patches/selinux-role.patch
+++ b/debian/patches/selinux-role.patch
@@ -13,22 +13,22 @@ Last-Update: 2013-09-14
13 13
14Patch-Name: selinux-role.patch 14Patch-Name: selinux-role.patch
15--- 15---
16 auth.h | 1 + 16 auth.h | 1 +
17 auth1.c | 8 +++++++- 17 auth1.c | 8 +++++++-
18 auth2.c | 10 ++++++++-- 18 auth2.c | 10 ++++++++--
19 monitor.c | 32 +++++++++++++++++++++++++++++--- 19 monitor.c | 32 +++++++++++++++++++++++++++++---
20 monitor.h | 2 ++ 20 monitor.h | 2 ++
21 monitor_wrap.c | 22 ++++++++++++++++++++-- 21 monitor_wrap.c | 22 ++++++++++++++++++++--
22 monitor_wrap.h | 3 ++- 22 monitor_wrap.h | 3 ++-
23 openbsd-compat/port-linux.c | 27 ++++++++++++++++++++------- 23 openbsd-compat/port-linux.c | 27 ++++++++++++++++++++-------
24 openbsd-compat/port-linux.h | 4 ++-- 24 openbsd-compat/port-linux.h | 4 ++--
25 platform.c | 4 ++-- 25 platform.c | 4 ++--
26 platform.h | 2 +- 26 platform.h | 2 +-
27 session.c | 10 +++++----- 27 session.c | 10 +++++-----
28 session.h | 2 +- 28 session.h | 2 +-
29 sshd.c | 2 +- 29 sshd.c | 2 +-
30 sshpty.c | 4 ++-- 30 sshpty.c | 4 ++--
31 sshpty.h | 2 +- 31 sshpty.h | 2 +-
32 16 files changed, 104 insertions(+), 31 deletions(-) 32 16 files changed, 104 insertions(+), 31 deletions(-)
33 33
34diff --git a/auth.h b/auth.h 34diff --git a/auth.h b/auth.h
diff --git a/debian/patches/series b/debian/patches/series
index 5d21e57d1..7bd72e6ed 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -26,3 +26,4 @@ no-openssl-version-check.patch
26gnome-ssh-askpass2-icon.patch 26gnome-ssh-askpass2-icon.patch
27sigstop.patch 27sigstop.patch
28debian-config.patch 28debian-config.patch
29sshfp_with_server_cert
diff --git a/debian/patches/shell-path.patch b/debian/patches/shell-path.patch
index 48c16d2a2..c67d55002 100644
--- a/debian/patches/shell-path.patch
+++ b/debian/patches/shell-path.patch
@@ -12,7 +12,7 @@ Last-Update: 2013-09-14
12 12
13Patch-Name: shell-path.patch 13Patch-Name: shell-path.patch
14--- 14---
15 sshconnect.c | 4 ++-- 15 sshconnect.c | 4 ++--
16 1 file changed, 2 insertions(+), 2 deletions(-) 16 1 file changed, 2 insertions(+), 2 deletions(-)
17 17
18diff --git a/sshconnect.c b/sshconnect.c 18diff --git a/sshconnect.c b/sshconnect.c
diff --git a/debian/patches/sigstop.patch b/debian/patches/sigstop.patch
index ac9eb4794..91c9d5434 100644
--- a/debian/patches/sigstop.patch
+++ b/debian/patches/sigstop.patch
@@ -8,7 +8,7 @@ Last-Update: 2013-09-14
8 8
9Patch-Name: sigstop.patch 9Patch-Name: sigstop.patch
10--- 10---
11 sshd.c | 4 ++++ 11 sshd.c | 4 ++++
12 1 file changed, 4 insertions(+) 12 1 file changed, 4 insertions(+)
13 13
14diff --git a/sshd.c b/sshd.c 14diff --git a/sshd.c b/sshd.c
diff --git a/debian/patches/ssh-agent-setgid.patch b/debian/patches/ssh-agent-setgid.patch
index af23075b3..5df77f45d 100644
--- a/debian/patches/ssh-agent-setgid.patch
+++ b/debian/patches/ssh-agent-setgid.patch
@@ -9,7 +9,7 @@ Last-Update: 2013-06-08
9 9
10Patch-Name: ssh-agent-setgid.patch 10Patch-Name: ssh-agent-setgid.patch
11--- 11---
12 ssh-agent.1 | 15 +++++++++++++++ 12 ssh-agent.1 | 15 +++++++++++++++
13 1 file changed, 15 insertions(+) 13 1 file changed, 15 insertions(+)
14 14
15diff --git a/ssh-agent.1 b/ssh-agent.1 15diff --git a/ssh-agent.1 b/ssh-agent.1
diff --git a/debian/patches/ssh-argv0.patch b/debian/patches/ssh-argv0.patch
index d456facea..2a54cd8e2 100644
--- a/debian/patches/ssh-argv0.patch
+++ b/debian/patches/ssh-argv0.patch
@@ -14,7 +14,7 @@ Last-Update: 2013-09-14
14 14
15Patch-Name: ssh-argv0.patch 15Patch-Name: ssh-argv0.patch
16--- 16---
17 ssh.1 | 1 + 17 ssh.1 | 1 +
18 1 file changed, 1 insertion(+) 18 1 file changed, 1 insertion(+)
19 19
20diff --git a/ssh.1 b/ssh.1 20diff --git a/ssh.1 b/ssh.1
diff --git a/debian/patches/ssh-vulnkey-compat.patch b/debian/patches/ssh-vulnkey-compat.patch
index fa738b084..30f5056f2 100644
--- a/debian/patches/ssh-vulnkey-compat.patch
+++ b/debian/patches/ssh-vulnkey-compat.patch
@@ -12,8 +12,8 @@ Last-Update: 2014-02-09
12 12
13Patch-Name: ssh-vulnkey-compat.patch 13Patch-Name: ssh-vulnkey-compat.patch
14--- 14---
15 readconf.c | 1 + 15 readconf.c | 1 +
16 servconf.c | 1 + 16 servconf.c | 1 +
17 2 files changed, 2 insertions(+) 17 2 files changed, 2 insertions(+)
18 18
19diff --git a/readconf.c b/readconf.c 19diff --git a/readconf.c b/readconf.c
diff --git a/debian/patches/ssh1-keepalive.patch b/debian/patches/ssh1-keepalive.patch
index ded7c122a..60537323a 100644
--- a/debian/patches/ssh1-keepalive.patch
+++ b/debian/patches/ssh1-keepalive.patch
@@ -8,8 +8,8 @@ Last-Update: 2013-09-14
8 8
9Patch-Name: ssh1-keepalive.patch 9Patch-Name: ssh1-keepalive.patch
10--- 10---
11 clientloop.c | 25 +++++++++++++++---------- 11 clientloop.c | 25 +++++++++++++++----------
12 ssh_config.5 | 5 ++++- 12 ssh_config.5 | 5 ++++-
13 2 files changed, 19 insertions(+), 11 deletions(-) 13 2 files changed, 19 insertions(+), 11 deletions(-)
14 14
15diff --git a/clientloop.c b/clientloop.c 15diff --git a/clientloop.c b/clientloop.c
diff --git a/debian/patches/sshfp_with_server_cert b/debian/patches/sshfp_with_server_cert
new file mode 100644
index 000000000..7e6a489e6
--- /dev/null
+++ b/debian/patches/sshfp_with_server_cert
@@ -0,0 +1,112 @@
1From db4cdf7b763414af951c7f4031b10679c54d7988 Mon Sep 17 00:00:00 2001
2From: Matthew Vernon <mcv21@cam.ac.uk>
3Date: Tue, 25 Mar 2014 11:02:33 +0000
4Subject: Attempt SSHFP lookup even if server presents a certificate
5
6If an ssh server presents a certificate to the client, then the client
7does not check the DNS for SSHFP records. This means that a malicious
8server can essentially disable DNS-host-key-checking, which means the
9client will fall back to asking the user (who will just say "yes" to
10the fingerprint, sadly).
11
12This patch means that the ssh client will, if necessary, extract the
13server key from the proffered certificate, and attempt to verify it
14against the DNS. The patch was written by Mark Wooding
15<mdw@distorted.org.uk>. I modified it to add one debug2 call, reviewed
16it, and tested it.
17
18Signed-off-by: Matthew Vernon <matthew@debian.org>
19Bug-Debian: http://bugs.debian.org/742513
20Patch-Name: sshfp_with_server_cert
21---
22 sshconnect.c | 67 ++++++++++++++++++++++++++++++++++++++++------------------
23 1 file changed, 47 insertions(+), 20 deletions(-)
24
25diff --git a/sshconnect.c b/sshconnect.c
26index 87c3770..b8510d2 100644
27--- a/sshconnect.c
28+++ b/sshconnect.c
29@@ -1218,36 +1218,63 @@ fail:
30 return -1;
31 }
32
33+static int
34+check_host_key_sshfp(char *host, struct sockaddr *hostaddr, Key *host_key)
35+{
36+ int rc = -1;
37+ int flags = 0;
38+ Key *raw_key = NULL;
39+
40+ if (!options.verify_host_key_dns)
41+ goto done;
42+
43+ /* XXX certs are not yet supported for DNS; try looking the raw key
44+ * up in the DNS anyway.
45+ */
46+ if (key_is_cert(host_key)) {
47+ debug2("Extracting key from cert for SSHFP lookup");
48+ raw_key = key_from_private(host_key);
49+ if (key_drop_cert(raw_key))
50+ fatal("Couldn't drop certificate");
51+ host_key = raw_key;
52+ }
53+
54+ if (verify_host_key_dns(host, hostaddr, host_key, &flags))
55+ goto done;
56+
57+ if (flags & DNS_VERIFY_FOUND) {
58+
59+ if (options.verify_host_key_dns == 1 &&
60+ flags & DNS_VERIFY_MATCH &&
61+ flags & DNS_VERIFY_SECURE) {
62+ rc = 0;
63+ } else if (flags & DNS_VERIFY_MATCH) {
64+ matching_host_key_dns = 1;
65+ } else {
66+ warn_changed_key(host_key);
67+ error("Update the SSHFP RR in DNS with the new "
68+ "host key to get rid of this message.");
69+ }
70+ }
71+
72+done:
73+ if (raw_key)
74+ key_free(raw_key);
75+ return rc;
76+}
77+
78 /* returns 0 if key verifies or -1 if key does NOT verify */
79 int
80 verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key)
81 {
82- int flags = 0;
83 char *fp;
84
85 fp = key_fingerprint(host_key, SSH_FP_MD5, SSH_FP_HEX);
86 debug("Server host key: %s %s", key_type(host_key), fp);
87 free(fp);
88
89- /* XXX certs are not yet supported for DNS */
90- if (!key_is_cert(host_key) && options.verify_host_key_dns &&
91- verify_host_key_dns(host, hostaddr, host_key, &flags) == 0) {
92- if (flags & DNS_VERIFY_FOUND) {
93-
94- if (options.verify_host_key_dns == 1 &&
95- flags & DNS_VERIFY_MATCH &&
96- flags & DNS_VERIFY_SECURE)
97- return 0;
98-
99- if (flags & DNS_VERIFY_MATCH) {
100- matching_host_key_dns = 1;
101- } else {
102- warn_changed_key(host_key);
103- error("Update the SSHFP RR in DNS with the new "
104- "host key to get rid of this message.");
105- }
106- }
107- }
108+ if (check_host_key_sshfp(host, hostaddr, host_key) == 0)
109+ return 0;
110
111 return check_host_key(host, hostaddr, options.port, host_key, RDRW,
112 options.user_hostfiles, options.num_user_hostfiles,
diff --git a/debian/patches/syslog-level-silent.patch b/debian/patches/syslog-level-silent.patch
index 7cbd3a7e3..01f7307de 100644
--- a/debian/patches/syslog-level-silent.patch
+++ b/debian/patches/syslog-level-silent.patch
@@ -16,8 +16,8 @@ Last-Update: 2013-09-14
16 16
17Patch-Name: syslog-level-silent.patch 17Patch-Name: syslog-level-silent.patch
18--- 18---
19 log.c | 1 + 19 log.c | 1 +
20 ssh.c | 2 +- 20 ssh.c | 2 +-
21 2 files changed, 2 insertions(+), 1 deletion(-) 21 2 files changed, 2 insertions(+), 1 deletion(-)
22 22
23diff --git a/log.c b/log.c 23diff --git a/log.c b/log.c
diff --git a/debian/patches/user-group-modes.patch b/debian/patches/user-group-modes.patch
index 3cdb9d8a1..107f15a23 100644
--- a/debian/patches/user-group-modes.patch
+++ b/debian/patches/user-group-modes.patch
@@ -17,14 +17,14 @@ Last-Update: 2013-09-14
17 17
18Patch-Name: user-group-modes.patch 18Patch-Name: user-group-modes.patch
19--- 19---
20 auth-rhosts.c | 6 ++---- 20 auth-rhosts.c | 6 ++---
21 auth.c | 9 +++----- 21 auth.c | 9 +++-----
22 misc.c | 69 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++- 22 misc.c | 69 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++-
23 misc.h | 2 ++ 23 misc.h | 2 ++
24 platform.c | 16 -------------- 24 platform.c | 16 -------------
25 readconf.c | 5 +++-- 25 readconf.c | 5 +++--
26 ssh.1 | 2 ++ 26 ssh.1 | 2 ++
27 ssh_config.5 | 2 ++ 27 ssh_config.5 | 2 ++
28 8 files changed, 82 insertions(+), 29 deletions(-) 28 8 files changed, 82 insertions(+), 29 deletions(-)
29 29
30diff --git a/auth-rhosts.c b/auth-rhosts.c 30diff --git a/auth-rhosts.c b/auth-rhosts.c
generated by cgit v1.2.3 (git 2.39.1) at 2024-11-11 13:19:28 +0000