forked from rpms/openssh
Sync with c9
This commit is contained in:
parent
bccdf22733
commit
90b7a2efcd
32
SOURCES/openssh-8.7p1-allow-duplicate-subsystem.patch
Normal file
32
SOURCES/openssh-8.7p1-allow-duplicate-subsystem.patch
Normal file
@ -0,0 +1,32 @@
|
|||||||
|
diff --git a/servconf.c b/servconf.c
|
||||||
|
index e16f9e90fc71..a3779a9d86ee 100644
|
||||||
|
--- a/servconf.c
|
||||||
|
+++ b/servconf.c
|
||||||
|
@@ -1942,13 +1942,22 @@ process_server_config_line_depth(ServerOptions *options, char *line,
|
||||||
|
fatal("%s line %d: %s missing argument.",
|
||||||
|
filename, linenum, keyword);
|
||||||
|
if (!*activep) {
|
||||||
|
- arg = argv_next(&ac, &av);
|
||||||
|
+ argv_consume(&ac);
|
||||||
|
+ break;
|
||||||
|
+ }
|
||||||
|
+ found = 0;
|
||||||
|
+ for (i = 0; i < options->num_subsystems; i++) {
|
||||||
|
+ if (strcmp(arg, options->subsystem_name[i]) == 0) {
|
||||||
|
+ found = 1;
|
||||||
|
+ break;
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+ if (found) {
|
||||||
|
+ debug("%s line %d: Subsystem '%s' already defined.",
|
||||||
|
+ filename, linenum, arg);
|
||||||
|
+ argv_consume(&ac);
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
- for (i = 0; i < options->num_subsystems; i++)
|
||||||
|
- if (strcmp(arg, options->subsystem_name[i]) == 0)
|
||||||
|
- fatal("%s line %d: Subsystem '%s' "
|
||||||
|
- "already defined.", filename, linenum, arg);
|
||||||
|
options->subsystem_name[options->num_subsystems] = xstrdup(arg);
|
||||||
|
arg = argv_next(&ac, &av);
|
||||||
|
if (!arg || *arg == '\0')
|
65
SOURCES/openssh-8.7p1-openssl-log.patch
Normal file
65
SOURCES/openssh-8.7p1-openssl-log.patch
Normal file
@ -0,0 +1,65 @@
|
|||||||
|
diff -up openssh-8.7p1/log.c.xxx openssh-8.7p1/log.c
|
||||||
|
--- openssh-8.7p1/log.c.xxx 2024-10-18 13:00:56.419560563 +0200
|
||||||
|
+++ openssh-8.7p1/log.c 2024-10-18 13:22:35.954819016 +0200
|
||||||
|
@@ -438,6 +438,26 @@ sshlog(const char *file, const char *fun
|
||||||
|
va_end(args);
|
||||||
|
}
|
||||||
|
|
||||||
|
+#ifdef WITH_OPENSSL
|
||||||
|
+static int
|
||||||
|
+openssl_error_print_cb(const char *str, size_t len, void *u)
|
||||||
|
+{
|
||||||
|
+ sshlogdirect(SYSLOG_LEVEL_DEBUG1, 0, "openssl error %s", str);
|
||||||
|
+ return 0;
|
||||||
|
+}
|
||||||
|
+#endif
|
||||||
|
+
|
||||||
|
+void
|
||||||
|
+sshlog_openssl(int r)
|
||||||
|
+{
|
||||||
|
+#ifdef WITH_OPENSSL
|
||||||
|
+ if (r != SSH_ERR_LIBCRYPTO_ERROR) return;
|
||||||
|
+
|
||||||
|
+ ERR_print_errors_cb(openssl_error_print_cb, NULL);
|
||||||
|
+#endif
|
||||||
|
+ return;
|
||||||
|
+}
|
||||||
|
+
|
||||||
|
void
|
||||||
|
sshlogdie(const char *file, const char *func, int line, int showfunc,
|
||||||
|
LogLevel level, const char *suffix, const char *fmt, ...)
|
||||||
|
diff -up openssh-8.7p1/log.h.xxx openssh-8.7p1/log.h
|
||||||
|
--- openssh-8.7p1/log.h.xxx 2024-10-18 12:56:18.944971946 +0200
|
||||||
|
+++ openssh-8.7p1/log.h 2024-10-18 13:03:38.324351416 +0200
|
||||||
|
@@ -71,6 +71,7 @@ void cleanup_exit(int) __attribute__((n
|
||||||
|
void sshlog(const char *, const char *, int, int,
|
||||||
|
LogLevel, const char *, const char *, ...)
|
||||||
|
__attribute__((format(printf, 7, 8)));
|
||||||
|
+void sshlog_openssl(int);
|
||||||
|
void sshlogv(const char *, const char *, int, int,
|
||||||
|
LogLevel, const char *, const char *, va_list);
|
||||||
|
void sshsigdie(const char *, const char *, int, int,
|
||||||
|
diff -up openssh-8.7p1/auth2-pubkey.c.yyy openssh-8.7p1/auth2-pubkey.c
|
||||||
|
--- openssh-8.7p1/auth2-pubkey.c.yyy 2024-10-18 13:27:00.709055845 +0200
|
||||||
|
+++ openssh-8.7p1/auth2-pubkey.c 2024-10-18 13:27:31.638784460 +0200
|
||||||
|
@@ -131,6 +131,7 @@ userauth_pubkey(struct ssh *ssh)
|
||||||
|
goto done;
|
||||||
|
}
|
||||||
|
if ((r = sshkey_from_blob(pkblob, blen, &key)) != 0) {
|
||||||
|
+ sshlog_openssl(r);
|
||||||
|
error_fr(r, "parse key");
|
||||||
|
goto done;
|
||||||
|
}
|
||||||
|
diff -up openssh-8.7p1/dispatch.c.yyy openssh-8.7p1/dispatch.c
|
||||||
|
--- openssh-8.7p1/dispatch.c.yyy 2024-10-18 13:27:56.349366570 +0200
|
||||||
|
+++ openssh-8.7p1/dispatch.c 2024-10-18 13:28:17.921874757 +0200
|
||||||
|
@@ -130,6 +130,8 @@ ssh_dispatch_run_fatal(struct ssh *ssh,
|
||||||
|
{
|
||||||
|
int r;
|
||||||
|
|
||||||
|
- if ((r = ssh_dispatch_run(ssh, mode, done)) != 0)
|
||||||
|
+ if ((r = ssh_dispatch_run(ssh, mode, done)) != 0) {
|
||||||
|
+ sshlog_openssl(r);
|
||||||
|
sshpkt_fatal(ssh, r, "%s", __func__);
|
||||||
|
+ }
|
||||||
|
}
|
40
SOURCES/openssh-8.7p1-redhat-help.patch
Normal file
40
SOURCES/openssh-8.7p1-redhat-help.patch
Normal file
@ -0,0 +1,40 @@
|
|||||||
|
diff -up openssh-8.7p1/ssh.c.xxx openssh-8.7p1/ssh.c
|
||||||
|
--- openssh-8.7p1/ssh.c.xxx 2024-09-11 14:24:06.711088878 +0200
|
||||||
|
+++ openssh-8.7p1/ssh.c 2024-09-11 14:35:12.883765718 +0200
|
||||||
|
@@ -175,6 +175,16 @@ extern int muxserver_sock;
|
||||||
|
extern u_int muxclient_command;
|
||||||
|
|
||||||
|
/* Prints a help message to the user. This function never returns. */
|
||||||
|
+static void
|
||||||
|
+redhat_usage(void)
|
||||||
|
+{
|
||||||
|
+ if(isatty(fileno(stderr))) {
|
||||||
|
+ fprintf(stderr,
|
||||||
|
+"\nYou can find some explanations for typical errors at this link:\n"
|
||||||
|
+" https://red.ht/support_rhel_ssh\n"
|
||||||
|
+ );
|
||||||
|
+ }
|
||||||
|
+}
|
||||||
|
|
||||||
|
static void
|
||||||
|
usage(void)
|
||||||
|
@@ -188,6 +196,7 @@ usage(void)
|
||||||
|
" [-Q query_option] [-R address] [-S ctl_path] [-W host:port]\n"
|
||||||
|
" [-w local_tun[:remote_tun]] destination [command]\n"
|
||||||
|
);
|
||||||
|
+ redhat_usage();
|
||||||
|
exit(255);
|
||||||
|
}
|
||||||
|
|
||||||
|
@@ -1609,8 +1618,10 @@ main(int ac, char **av)
|
||||||
|
/* Open a connection to the remote host. */
|
||||||
|
if (ssh_connect(ssh, host, host_arg, addrs, &hostaddr, options.port,
|
||||||
|
options.connection_attempts,
|
||||||
|
- &timeout_ms, options.tcp_keep_alive) != 0)
|
||||||
|
+ &timeout_ms, options.tcp_keep_alive) != 0) {
|
||||||
|
+ redhat_usage();
|
||||||
|
exit(255);
|
||||||
|
+ }
|
||||||
|
|
||||||
|
if (addrs != NULL)
|
||||||
|
freeaddrinfo(addrs);
|
@ -47,14 +47,14 @@
|
|||||||
|
|
||||||
# Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
|
# Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
|
||||||
%global openssh_ver 8.7p1
|
%global openssh_ver 8.7p1
|
||||||
%global openssh_rel 43
|
%global openssh_rel 45
|
||||||
%global pam_ssh_agent_ver 0.10.4
|
%global pam_ssh_agent_ver 0.10.4
|
||||||
%global pam_ssh_agent_rel 5
|
%global pam_ssh_agent_rel 5
|
||||||
|
|
||||||
Summary: An open source implementation of SSH protocol version 2
|
Summary: An open source implementation of SSH protocol version 2
|
||||||
Name: openssh
|
Name: openssh
|
||||||
Version: %{openssh_ver}
|
Version: %{openssh_ver}
|
||||||
Release: %{openssh_rel}%{?dist}.alma.2
|
Release: %{openssh_rel}%{?dist}
|
||||||
URL: http://www.openssh.com/portable.html
|
URL: http://www.openssh.com/portable.html
|
||||||
#URL1: https://github.com/jbeverly/pam_ssh_agent_auth/
|
#URL1: https://github.com/jbeverly/pam_ssh_agent_auth/
|
||||||
Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
|
Source0: ftp://ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/openssh-%{version}.tar.gz
|
||||||
@ -293,9 +293,13 @@ Patch1019: openssh-9.6p1-CVE-2023-51385.patch
|
|||||||
#upstream commit 96faa0de6c673a2ce84736eba37fc9fb723d9e5c
|
#upstream commit 96faa0de6c673a2ce84736eba37fc9fb723d9e5c
|
||||||
Patch1020: openssh-8.7p1-sigpipe.patch
|
Patch1020: openssh-8.7p1-sigpipe.patch
|
||||||
Patch1021: openssh-9.8p1-upstream-cve-2024-6387.patch
|
Patch1021: openssh-9.8p1-upstream-cve-2024-6387.patch
|
||||||
|
Patch1022: openssh-8.7p1-redhat-help.patch
|
||||||
|
Patch1023: openssh-8.7p1-openssl-log.patch
|
||||||
|
#upstream commit 52dfe3c72d98503d8b7c6f64fc7e19d685636c0b
|
||||||
|
Patch1024: openssh-8.7p1-allow-duplicate-subsystem.patch
|
||||||
# upstream 6ce00f0c2ecbb9f75023dbe627ee6460bcec78c2
|
# upstream 6ce00f0c2ecbb9f75023dbe627ee6460bcec78c2
|
||||||
# upstream 0832aac79517611dd4de93ad0a83577994d9c907
|
# upstream 0832aac79517611dd4de93ad0a83577994d9c907
|
||||||
Patch1022: openssh-9.9p2-error_processing.patch
|
Patch1025: openssh-9.9p2-error_processing.patch
|
||||||
|
|
||||||
License: BSD
|
License: BSD
|
||||||
Requires: /sbin/nologin
|
Requires: /sbin/nologin
|
||||||
@ -370,7 +374,7 @@ Requires: openssh = %{version}-%{release}
|
|||||||
%package -n pam_ssh_agent_auth
|
%package -n pam_ssh_agent_auth
|
||||||
Summary: PAM module for authentication with ssh-agent
|
Summary: PAM module for authentication with ssh-agent
|
||||||
Version: %{pam_ssh_agent_ver}
|
Version: %{pam_ssh_agent_ver}
|
||||||
Release: %{pam_ssh_agent_rel}.%{openssh_rel}%{?dist}.alma.2
|
Release: %{pam_ssh_agent_rel}.%{openssh_rel}%{?dist}
|
||||||
License: BSD
|
License: BSD
|
||||||
|
|
||||||
%description
|
%description
|
||||||
@ -522,8 +526,10 @@ popd
|
|||||||
%patch1019 -p1 -b .cve-2023-51385
|
%patch1019 -p1 -b .cve-2023-51385
|
||||||
%patch1020 -p1 -b .earlypipe
|
%patch1020 -p1 -b .earlypipe
|
||||||
%patch1021 -p1 -b .cve-2024-6387
|
%patch1021 -p1 -b .cve-2024-6387
|
||||||
# CS9 patch by Dmitry Belyavskiy <dbelyavs@redhat.com>
|
%patch1022 -p1 -b .redhat-help
|
||||||
%patch1022 -p1 -b .errcode_set
|
%patch1023 -p1 -b .openssl-log
|
||||||
|
%patch1024 -p1 -b .allow-dup-subsystem
|
||||||
|
%patch1025 -p1 -b .errcode_set
|
||||||
|
|
||||||
autoreconf
|
autoreconf
|
||||||
pushd pam_ssh_agent_auth-pam_ssh_agent_auth-%{pam_ssh_agent_ver}
|
pushd pam_ssh_agent_auth-pam_ssh_agent_auth-%{pam_ssh_agent_ver}
|
||||||
@ -811,12 +817,20 @@ test -f %{sysconfig_anaconda} && \
|
|||||||
%endif
|
%endif
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
* Sat Mar 01 2025 Andrew Lukoshko <alukoshko@almalinux.org> - 8.7p1-43.alma.2
|
* Tue Feb 18 2025 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-45
|
||||||
- Backport from CentOS Stream 9 to fix missing error codes set and invalid error
|
- Fix missing error codes set and invalid error code checks in OpenSSH. It
|
||||||
code checks in OpenSSH. It prevents memory exhaustion attack and a MITM
|
prevents memory exhaustion attack and a MITM attack when VerifyHostKeyDNS
|
||||||
attack when VerifyHostKeyDNS is on (CVE-2025-26465).
|
is on (CVE-2025-26465).
|
||||||
Resolves: RHEL-78700
|
Resolves: RHEL-78700
|
||||||
|
|
||||||
|
* Mon Oct 21 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-44
|
||||||
|
- Add extra help information on ssh early failure
|
||||||
|
Resolves: RHEL-33809
|
||||||
|
- Provide details on crypto error instead of "error in libcrypto"
|
||||||
|
Resolves: RHEL-52293
|
||||||
|
- Allow duplicate Subsystem directive
|
||||||
|
Resolves: RHEL-47112
|
||||||
|
|
||||||
* Tue Jul 09 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-43
|
* Tue Jul 09 2024 Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-43
|
||||||
- Possible remote code execution due to a race condition (CVE-2024-6409)
|
- Possible remote code execution due to a race condition (CVE-2024-6409)
|
||||||
Resolves: RHEL-45741
|
Resolves: RHEL-45741
|
||||||
|
Loading…
Reference in New Issue
Block a user