mirror of
https://git.FreeBSD.org/ports.git
synced 2025-01-22 08:58:47 +00:00
security/openssh-portable: Update to 9.9p1
This commit is contained in:
Bryan Drewery
parent
030e9e6b70
commit
778644b317
@ -1,6 +1,6 @@
|
||||
PORTNAME= openssh
|
||||
DISTVERSION= 9.8p1
|
||||
PORTREVISION= 1
|
||||
DISTVERSION= 9.9p1
|
||||
PORTREVISION= 0
|
||||
PORTEPOCH= 1
|
||||
CATEGORIES= security
|
||||
MASTER_SITES= OPENBSD/OpenSSH/portable
|
||||
@ -109,13 +109,13 @@ EXTRA_PATCHES+= ${FILESDIR}/extra-patch-hpn-gss-glue
|
||||
. endif
|
||||
# - See https://sources.debian.org/data/main/o/openssh/ for which subdir to
|
||||
# pull from.
|
||||
GSSAPI_DEBIAN_VERSION= 9.8p1
|
||||
GSSAPI_DEBIAN_SUBDIR= ${GSSAPI_DEBIAN_VERSION:U${DISTVERSION}}-3
|
||||
GSSAPI_DEBIAN_VERSION= 9.9p1
|
||||
GSSAPI_DEBIAN_SUBDIR= ${GSSAPI_DEBIAN_VERSION:U${DISTVERSION}}-1
|
||||
# - Debian does not use a versioned filename so we trick fetch to make one for
|
||||
# us with the ?<anything>=/ trick.
|
||||
PATCH_SITES+= https://sources.debian.org/data/main/o/openssh/1:${GSSAPI_DEBIAN_SUBDIR}/debian/patches/gssapi.patch?dummy=/:gsskex
|
||||
# Bump this when updating the patch location
|
||||
GSSAPI_DISTVERSION= 9.8p1
|
||||
GSSAPI_DISTVERSION= 9.9p1
|
||||
PATCHFILES+= openssh-${GSSAPI_DISTVERSION:U${DISTVERSION}}-gsskex-all-debian-rh-${GSSAPI_DISTVERSION}.patch:-p1:gsskex
|
||||
EXTRA_PATCHES+= ${FILESDIR}/extra-patch-gssapi-kexgssc.c
|
||||
EXTRA_PATCHES+= ${FILESDIR}/extra-patch-gssapi-kexgsss.c
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
TIMESTAMP = 1722605239
|
||||
SHA256 (openssh-9.8p1.tar.gz) = dd8bd002a379b5d499dfb050dd1fa9af8029e80461f4bb6c523c49973f5a39f3
|
||||
SIZE (openssh-9.8p1.tar.gz) = 1910393
|
||||
SHA256 (openssh-9.8p1-gsskex-all-debian-rh-9.8p1.patch) = f5b93bf8076aa386afa63e98bb5b39b6e477b8ccb24d2d4b700f6cd685be6f78
|
||||
SIZE (openssh-9.8p1-gsskex-all-debian-rh-9.8p1.patch) = 125084
|
||||
TIMESTAMP = 1728410939
|
||||
SHA256 (openssh-9.9p1.tar.gz) = b343fbcdbff87f15b1986e6e15d6d4fc9a7d36066be6b7fb507087ba8f966c02
|
||||
SIZE (openssh-9.9p1.tar.gz) = 1964864
|
||||
SHA256 (openssh-9.9p1-gsskex-all-debian-rh-9.9p1.patch) = b8b590024137d54394fd46ebfe32f2b081d0744abdcdcacf6dd30d1c91339864
|
||||
SIZE (openssh-9.9p1-gsskex-all-debian-rh-9.9p1.patch) = 125233
|
||||
|
||||
@ -31,12 +31,12 @@ r294563 was incomplete; re-add the client-side options as well.
|
||||
|
||||
{ NULL, oBadOption }
|
||||
};
|
||||
--- servconf.c.orig 2024-06-30 21:36:28.000000000 -0700
|
||||
+++ servconf.c 2024-07-01 13:29:27.091708000 -0700
|
||||
@@ -739,6 +739,10 @@ static struct {
|
||||
{ "channeltimeout", sChannelTimeout, SSHCFG_ALL },
|
||||
--- servconf.c.orig 2024-09-19 15:20:48.000000000 -0700
|
||||
+++ servconf.c 2024-10-07 20:18:18.259726000 -0700
|
||||
@@ -746,6 +746,10 @@ static struct {
|
||||
{ "unusedconnectiontimeout", sUnusedConnectionTimeout, SSHCFG_ALL },
|
||||
{ "sshdsessionpath", sSshdSessionPath, SSHCFG_GLOBAL },
|
||||
{ "refuseconnection", sRefuseConnection, SSHCFG_ALL },
|
||||
+ { "noneenabled", sUnsupported, SSHCFG_ALL },
|
||||
+ { "hpndisabled", sDeprecated, SSHCFG_ALL },
|
||||
+ { "hpnbuffersize", sDeprecated, SSHCFG_ALL },
|
||||
|
||||
@ -1,69 +0,0 @@
|
||||
(pulled from the PR)
|
||||
|
||||
commit 27ceebbc2402e4c98203c7eef9696f4bd3d326f8
|
||||
Author: Ed Maste <emaste@FreeBSD.org>
|
||||
Date: Tue Aug 31 15:30:50 2021 -0400
|
||||
|
||||
openssh: simplify login class restrictions
|
||||
|
||||
Login class-based restrictions were introduced in 5b400a39b8ad. The
|
||||
code was adapted for sshd's Capsicum sandbox and received many changes
|
||||
over time, including at least fc3c19a9fcee, bd393de91cc3, and
|
||||
e8c56fba2926.
|
||||
|
||||
During an attempt to upstream the work a much simpler approach was
|
||||
suggested. Adopt it now in the in-tree OpenSSH to reduce conflicts with
|
||||
future updates.
|
||||
|
||||
Submitted by: Yuchiro Naito (against OpenSSH-portable on GitHub)
|
||||
Obtained from: https://github.com/openssh/openssh-portable/pull/262
|
||||
Reviewed by: allanjude, kevans
|
||||
MFC after: 2 weeks
|
||||
Differential Revision: https://reviews.freebsd.org/D31760
|
||||
|
||||
|
||||
--- auth.c
|
||||
+++ auth.c
|
||||
@@ -566,6 +566,9 @@ getpwnamallow(struct ssh *ssh, const char *user)
|
||||
{
|
||||
#ifdef HAVE_LOGIN_CAP
|
||||
extern login_cap_t *lc;
|
||||
+#ifdef HAVE_AUTH_HOSTOK
|
||||
+ const char *from_host, *from_ip;
|
||||
+#endif
|
||||
#ifdef BSD_AUTH
|
||||
auth_session_t *as;
|
||||
#endif
|
||||
@@ -611,6 +614,21 @@ getpwnamallow(struct ssh *ssh, const char *user)
|
||||
debug("unable to get login class: %s", user);
|
||||
return (NULL);
|
||||
}
|
||||
+#ifdef HAVE_AUTH_HOSTOK
|
||||
+ from_host = auth_get_canonical_hostname(ssh, options.use_dns);
|
||||
+ from_ip = ssh_remote_ipaddr(ssh);
|
||||
+ if (!auth_hostok(lc, from_host, from_ip)) {
|
||||
+ debug("Denied connection for %.200s from %.200s [%.200s].",
|
||||
+ pw->pw_name, from_host, from_ip);
|
||||
+ return (NULL);
|
||||
+ }
|
||||
+#endif /* HAVE_AUTH_HOSTOK */
|
||||
+#ifdef HAVE_AUTH_TIMEOK
|
||||
+ if (!auth_timeok(lc, time(NULL))) {
|
||||
+ debug("LOGIN %.200s REFUSED (TIME)", pw->pw_name);
|
||||
+ return (NULL);
|
||||
+ }
|
||||
+#endif /* HAVE_AUTH_TIMEOK */
|
||||
#ifdef BSD_AUTH
|
||||
if ((as = auth_open()) == NULL || auth_setpwd(as, pw) != 0 ||
|
||||
auth_approval(as, lc, pw->pw_name, "ssh") <= 0) {
|
||||
--- configure.ac
|
||||
+++ configure.ac
|
||||
@@ -1784,6 +1784,8 @@ AC_SUBST([PICFLAG])
|
||||
|
||||
dnl Checks for library functions. Please keep in alphabetical order
|
||||
AC_CHECK_FUNCS([ \
|
||||
+ auth_hostok \
|
||||
+ auth_timeok \
|
||||
Blowfish_initstate \
|
||||
Blowfish_expandstate \
|
||||
Blowfish_expand0state \
|
||||
Loading…
Reference in New Issue
Block a user