rpms/openssh
7
0
Fork 1
Code Issues Pull Requests Releases Activity

- add auditing the kex result

Browse Source
This commit is contained in:
Jan F. Chadima 2010-09-21 05:50:26 +02:00
parent f44bdee1ed
commit 848d56e0fa
1 changed files with 73 additions and 73 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

146
openssh-5.6p1-gsskex.patch
View File

@ -1,6 +1,6 @@
diff -up openssh-5.6p1/auth2.c.gsskex openssh-5.6p1/auth2.c
--- openssh-5.6p1/auth2.c.gsskex 2010-10-22 15:35:15.000000000 +0200
+++ openssh-5.6p1/auth2.c 2010-10-22 15:35:17.000000000 +0200
--- openssh-5.6p1/auth2.c.gsskex 2010-11-02 22:23:46.000000000 +0100
+++ openssh-5.6p1/auth2.c 2010-11-02 22:23:49.000000000 +0100
@@ -69,6 +69,7 @@ extern Authmethod method_passwd;
extern Authmethod method_kbdint;
extern Authmethod method_hostbased;
@ -36,8 +36,8 @@ diff -up openssh-5.6p1/auth2.c.gsskex openssh-5.6p1/auth2.c
if (authctxt->failures >= options.max_authtries) {
#ifdef SSH_AUDIT_EVENTS
diff -up openssh-5.6p1/auth2-gss.c.gsskex openssh-5.6p1/auth2-gss.c
--- openssh-5.6p1/auth2-gss.c.gsskex 2010-10-22 15:35:15.000000000 +0200
+++ openssh-5.6p1/auth2-gss.c 2010-10-22 15:35:17.000000000 +0200
--- openssh-5.6p1/auth2-gss.c.gsskex 2010-11-02 22:23:46.000000000 +0100
+++ openssh-5.6p1/auth2-gss.c 2010-11-02 22:23:49.000000000 +0100
@@ -1,7 +1,7 @@
/* $OpenBSD: auth2-gss.c,v 1.16 2007/10/29 00:52:45 dtucker Exp $ */
@ -138,8 +138,8 @@ diff -up openssh-5.6p1/auth2-gss.c.gsskex openssh-5.6p1/auth2-gss.c
"gssapi-with-mic",
userauth_gssapi,
diff -up openssh-5.6p1/auth.h.gsskex openssh-5.6p1/auth.h
--- openssh-5.6p1/auth.h.gsskex 2010-10-22 15:35:15.000000000 +0200
+++ openssh-5.6p1/auth.h 2010-10-22 15:35:17.000000000 +0200
--- openssh-5.6p1/auth.h.gsskex 2010-11-02 22:23:46.000000000 +0100
+++ openssh-5.6p1/auth.h 2010-11-02 22:23:49.000000000 +0100
@@ -53,6 +53,7 @@ struct Authctxt {
int valid; /* user exists and is allowed to login */
int attempt;
@ -150,7 +150,7 @@ diff -up openssh-5.6p1/auth.h.gsskex openssh-5.6p1/auth.h
char *service;
diff -up openssh-5.6p1/auth-krb5.c.gsskex openssh-5.6p1/auth-krb5.c
--- openssh-5.6p1/auth-krb5.c.gsskex 2009-12-21 00:49:22.000000000 +0100
+++ openssh-5.6p1/auth-krb5.c 2010-10-22 15:35:17.000000000 +0200
+++ openssh-5.6p1/auth-krb5.c 2010-11-02 22:23:49.000000000 +0100
@@ -170,8 +170,13 @@ auth_krb5_password(Authctxt *authctxt, c
len = strlen(authctxt->krb5_ticket_file) + 6;
@ -199,8 +199,8 @@ diff -up openssh-5.6p1/auth-krb5.c.gsskex openssh-5.6p1/auth-krb5.c
return (krb5_cc_resolve(ctx, ccname, ccache));
}
diff -up openssh-5.6p1/ChangeLog.gssapi.gsskex openssh-5.6p1/ChangeLog.gssapi
--- openssh-5.6p1/ChangeLog.gssapi.gsskex 2010-10-22 15:35:17.000000000 +0200
+++ openssh-5.6p1/ChangeLog.gssapi 2010-10-22 15:35:17.000000000 +0200
--- openssh-5.6p1/ChangeLog.gssapi.gsskex 2010-11-02 22:23:49.000000000 +0100
+++ openssh-5.6p1/ChangeLog.gssapi 2010-11-02 22:23:49.000000000 +0100
@@ -0,0 +1,95 @@
+20090615
+ - [ gss-genr.c gss-serv.c kexgssc.c kexgsss.c monitor.c sshconnect2.c
@ -299,7 +299,7 @@ diff -up openssh-5.6p1/ChangeLog.gssapi.gsskex openssh-5.6p1/ChangeLog.gssapi
+ <gssapi-with-mic support is Bugzilla #1008>
diff -up openssh-5.6p1/clientloop.c.gsskex openssh-5.6p1/clientloop.c
--- openssh-5.6p1/clientloop.c.gsskex 2010-08-03 08:04:46.000000000 +0200
+++ openssh-5.6p1/clientloop.c 2010-10-22 15:35:17.000000000 +0200
+++ openssh-5.6p1/clientloop.c 2010-11-02 22:23:49.000000000 +0100
@@ -111,6 +111,10 @@
#include "msg.h"
#include "roaming.h"
@ -326,8 +326,8 @@ diff -up openssh-5.6p1/clientloop.c.gsskex openssh-5.6p1/clientloop.c
debug("need rekeying");
xxx_kex->done = 0;
diff -up openssh-5.6p1/configure.ac.gsskex openssh-5.6p1/configure.ac
--- openssh-5.6p1/configure.ac.gsskex 2010-10-22 15:35:17.000000000 +0200
+++ openssh-5.6p1/configure.ac 2010-10-22 15:35:17.000000000 +0200
--- openssh-5.6p1/configure.ac.gsskex 2010-11-02 22:23:49.000000000 +0100
+++ openssh-5.6p1/configure.ac 2010-11-02 22:23:49.000000000 +0100
@@ -477,6 +477,30 @@ main() { if (NSVersionOfRunTimeLibrary("
[Use tunnel device compatibility to OpenBSD])
AC_DEFINE(SSH_TUN_PREPEND_AF, 1,
@ -361,7 +361,7 @@ diff -up openssh-5.6p1/configure.ac.gsskex openssh-5.6p1/configure.ac
AC_DEFINE(AU_IPv4, 0, [System only supports IPv4 audit records])
diff -up openssh-5.6p1/gss-genr.c.gsskex openssh-5.6p1/gss-genr.c
--- openssh-5.6p1/gss-genr.c.gsskex 2009-06-22 08:11:07.000000000 +0200
+++ openssh-5.6p1/gss-genr.c 2010-10-22 15:35:17.000000000 +0200
+++ openssh-5.6p1/gss-genr.c 2010-11-02 22:23:49.000000000 +0100
@@ -39,12 +39,167 @@
#include "buffer.h"
#include "log.h"
@ -702,7 +702,7 @@ diff -up openssh-5.6p1/gss-genr.c.gsskex openssh-5.6p1/gss-genr.c
#endif /* GSSAPI */
diff -up openssh-5.6p1/gss-serv.c.gsskex openssh-5.6p1/gss-serv.c
--- openssh-5.6p1/gss-serv.c.gsskex 2008-05-19 07:05:07.000000000 +0200
+++ openssh-5.6p1/gss-serv.c 2010-10-22 15:35:17.000000000 +0200
+++ openssh-5.6p1/gss-serv.c 2010-11-02 22:23:49.000000000 +0100
@@ -1,7 +1,7 @@
/* $OpenBSD: gss-serv.c,v 1.22 2008/05/08 12:02:23 djm Exp $ */
@ -1018,7 +1018,7 @@ diff -up openssh-5.6p1/gss-serv.c.gsskex openssh-5.6p1/gss-serv.c
#endif
diff -up openssh-5.6p1/gss-serv-krb5.c.gsskex openssh-5.6p1/gss-serv-krb5.c
--- openssh-5.6p1/gss-serv-krb5.c.gsskex 2006-09-01 07:38:36.000000000 +0200
+++ openssh-5.6p1/gss-serv-krb5.c 2010-10-22 15:35:17.000000000 +0200
+++ openssh-5.6p1/gss-serv-krb5.c 2010-11-02 22:23:49.000000000 +0100
@@ -1,7 +1,7 @@
/* $OpenBSD: gss-serv-krb5.c,v 1.7 2006/08/03 03:34:42 deraadt Exp $ */
@ -1140,11 +1140,11 @@ diff -up openssh-5.6p1/gss-serv-krb5.c.gsskex openssh-5.6p1/gss-serv-krb5.c
#endif /* KRB5 */
diff -up openssh-5.6p1/kex.c.gsskex openssh-5.6p1/kex.c
--- openssh-5.6p1/kex.c.gsskex 2010-01-08 06:50:41.000000000 +0100
+++ openssh-5.6p1/kex.c 2010-10-22 15:35:17.000000000 +0200
@@ -50,6 +50,10 @@
#include "monitor.h"
--- openssh-5.6p1/kex.c.gsskex 2010-11-02 22:23:46.000000000 +0100
+++ openssh-5.6p1/kex.c 2010-11-02 22:27:07.000000000 +0100
@@ -51,6 +51,10 @@
#include "roaming.h"
#include "audit.h"
+#ifdef GSSAPI
+#include "ssh-gss.h"
@ -1153,7 +1153,7 @@ diff -up openssh-5.6p1/kex.c.gsskex openssh-5.6p1/kex.c
#if OPENSSL_VERSION_NUMBER >= 0x00907000L
# if defined(HAVE_EVP_SHA256)
# define evp_ssh_sha256 EVP_sha256
@@ -326,6 +330,20 @@ choose_kex(Kex *k, char *client, char *s
@@ -339,6 +343,20 @@ choose_kex(Kex *k, char *client, char *s
k->kex_type = KEX_DH_GEX_SHA256;
k->evp_md = evp_ssh_sha256();
#endif
@ -1175,8 +1175,8 @@ diff -up openssh-5.6p1/kex.c.gsskex openssh-5.6p1/kex.c
fatal("bad kex alg %s", k->name);
}
diff -up openssh-5.6p1/kexgssc.c.gsskex openssh-5.6p1/kexgssc.c
--- openssh-5.6p1/kexgssc.c.gsskex 2010-10-22 15:35:17.000000000 +0200
+++ openssh-5.6p1/kexgssc.c 2010-10-22 15:35:17.000000000 +0200
--- openssh-5.6p1/kexgssc.c.gsskex 2010-11-02 22:23:49.000000000 +0100
+++ openssh-5.6p1/kexgssc.c 2010-11-02 22:23:49.000000000 +0100
@@ -0,0 +1,334 @@
+/*
+ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
@ -1513,8 +1513,8 @@ diff -up openssh-5.6p1/kexgssc.c.gsskex openssh-5.6p1/kexgssc.c
+
+#endif /* GSSAPI */
diff -up openssh-5.6p1/kexgsss.c.gsskex openssh-5.6p1/kexgsss.c
--- openssh-5.6p1/kexgsss.c.gsskex 2010-10-22 15:35:17.000000000 +0200
+++ openssh-5.6p1/kexgsss.c 2010-10-22 15:35:17.000000000 +0200
--- openssh-5.6p1/kexgsss.c.gsskex 2010-11-02 22:23:49.000000000 +0100
+++ openssh-5.6p1/kexgsss.c 2010-11-02 22:23:49.000000000 +0100
@@ -0,0 +1,288 @@
+/*
+ * Copyright (c) 2001-2009 Simon Wilkinson. All rights reserved.
@ -1806,7 +1806,7 @@ diff -up openssh-5.6p1/kexgsss.c.gsskex openssh-5.6p1/kexgsss.c
+#endif /* GSSAPI */
diff -up openssh-5.6p1/kex.h.gsskex openssh-5.6p1/kex.h
--- openssh-5.6p1/kex.h.gsskex 2010-02-26 21:55:05.000000000 +0100
+++ openssh-5.6p1/kex.h 2010-10-22 15:35:17.000000000 +0200
+++ openssh-5.6p1/kex.h 2010-11-02 22:23:49.000000000 +0100
@@ -67,6 +67,9 @@ enum kex_exchange {
KEX_DH_GRP14_SHA1,
KEX_DH_GEX_SHA1,
@ -1844,7 +1844,7 @@ diff -up openssh-5.6p1/kex.h.gsskex openssh-5.6p1/kex.h
BIGNUM *, BIGNUM *, BIGNUM *, u_char **, u_int *);
diff -up openssh-5.6p1/key.c.gsskex openssh-5.6p1/key.c
--- openssh-5.6p1/key.c.gsskex 2010-07-16 05:58:37.000000000 +0200
+++ openssh-5.6p1/key.c 2010-10-22 15:35:17.000000000 +0200
+++ openssh-5.6p1/key.c 2010-11-02 22:23:49.000000000 +0100
@@ -1020,6 +1020,8 @@ key_type_from_name(char *name)
return KEY_RSA_CERT;
} else if (strcmp(name, "ssh-dss-cert-v01@openssh.com") == 0) {
@ -1856,7 +1856,7 @@ diff -up openssh-5.6p1/key.c.gsskex openssh-5.6p1/key.c
return KEY_UNSPEC;
diff -up openssh-5.6p1/key.h.gsskex openssh-5.6p1/key.h
--- openssh-5.6p1/key.h.gsskex 2010-04-16 07:56:22.000000000 +0200
+++ openssh-5.6p1/key.h 2010-10-22 15:35:17.000000000 +0200
+++ openssh-5.6p1/key.h 2010-11-02 22:23:49.000000000 +0100
@@ -39,6 +39,7 @@ enum types {
KEY_DSA_CERT,
KEY_RSA_CERT_V00,
@ -1866,14 +1866,14 @@ diff -up openssh-5.6p1/key.h.gsskex openssh-5.6p1/key.h
};
enum fp_type {
diff -up openssh-5.6p1/Makefile.in.gsskex openssh-5.6p1/Makefile.in
--- openssh-5.6p1/Makefile.in.gsskex 2010-10-22 15:35:17.000000000 +0200
+++ openssh-5.6p1/Makefile.in 2010-10-22 15:35:17.000000000 +0200
--- openssh-5.6p1/Makefile.in.gsskex 2010-11-02 22:23:49.000000000 +0100
+++ openssh-5.6p1/Makefile.in 2010-11-02 22:26:34.000000000 +0100
@@ -77,11 +77,11 @@ LIBSSH_OBJS=acss.o authfd.o authfile.o b
monitor_fdpass.o rijndael.o ssh-dss.o ssh-rsa.o dh.o kexdh.o \
kexgex.o kexdhc.o kexgexc.o msg.o progressmeter.o dns.o \
entropy.o gss-genr.o umac.o jpake.o schnorr.o \
- ssh-pkcs11.o
+ ssh-pkcs11.o kexgssc.o
- ssh-pkcs11.o auditstub.o
+ ssh-pkcs11.o auditstub.o kexgssc.o
SSHOBJS= ssh.o readconf.o clientloop.o sshtty.o \
sshconnect.o sshconnect1.o sshconnect2.o mux.o \
@ -1892,9 +1892,9 @@ diff -up openssh-5.6p1/Makefile.in.gsskex openssh-5.6p1/Makefile.in
MANPAGES = moduli.5.out scp.1.out ssh-add.1.out ssh-agent.1.out ssh-keygen.1.out ssh-keyscan.1.out ssh.1.out sshd.8.out sftp-server.8.out sftp.1.out ssh-rand-helper.8.out ssh-keysign.8.out ssh-pkcs11-helper.8.out ssh-ldap-helper.8.out sshd_config.5.out ssh_config.5.out ssh-ldap.conf.5.out
MANPAGES_IN = moduli.5 scp.1 ssh-add.1 ssh-agent.1 ssh-keygen.1 ssh-keyscan.1 ssh.1 sshd.8 sftp-server.8 sftp.1 ssh-rand-helper.8 ssh-keysign.8 ssh-pkcs11-helper.8 ssh-ldap-helper.8 sshd_config.5 ssh_config.5 ssh-ldap.conf.5
diff -up openssh-5.6p1/monitor.c.gsskex openssh-5.6p1/monitor.c
--- openssh-5.6p1/monitor.c.gsskex 2010-10-22 15:35:15.000000000 +0200
+++ openssh-5.6p1/monitor.c 2010-10-22 15:35:17.000000000 +0200
@@ -175,6 +175,8 @@ int mm_answer_gss_setup_ctx(int, Buffer
--- openssh-5.6p1/monitor.c.gsskex 2010-11-02 22:23:47.000000000 +0100
+++ openssh-5.6p1/monitor.c 2010-11-02 22:23:49.000000000 +0100
@@ -176,6 +176,8 @@ int mm_answer_gss_setup_ctx(int, Buffer
int mm_answer_gss_accept_ctx(int, Buffer *);
int mm_answer_gss_userok(int, Buffer *);
int mm_answer_gss_checkmic(int, Buffer *);
@ -1903,7 +1903,7 @@ diff -up openssh-5.6p1/monitor.c.gsskex openssh-5.6p1/monitor.c
#endif
#ifdef SSH_AUDIT_EVENTS
@@ -247,6 +249,7 @@ struct mon_table mon_dispatch_proto20[]
@@ -252,6 +254,7 @@ struct mon_table mon_dispatch_proto20[]
{MONITOR_REQ_GSSSTEP, MON_ISAUTH, mm_answer_gss_accept_ctx},
{MONITOR_REQ_GSSUSEROK, MON_AUTH, mm_answer_gss_userok},
{MONITOR_REQ_GSSCHECKMIC, MON_ISAUTH, mm_answer_gss_checkmic},
@ -1911,7 +1911,7 @@ diff -up openssh-5.6p1/monitor.c.gsskex openssh-5.6p1/monitor.c
#endif
#ifdef JPAKE
{MONITOR_REQ_JPAKE_GET_PWDATA, MON_ONCE, mm_answer_jpake_get_pwdata},
@@ -259,6 +262,12 @@ struct mon_table mon_dispatch_proto20[]
@@ -264,6 +267,12 @@ struct mon_table mon_dispatch_proto20[]
};
struct mon_table mon_dispatch_postauth20[] = {
@ -1924,7 +1924,7 @@ diff -up openssh-5.6p1/monitor.c.gsskex openssh-5.6p1/monitor.c
{MONITOR_REQ_MODULI, 0, mm_answer_moduli},
{MONITOR_REQ_SIGN, 0, mm_answer_sign},
{MONITOR_REQ_PTY, 0, mm_answer_pty},
@@ -363,6 +372,10 @@ monitor_child_preauth(Authctxt *_authctx
@@ -370,6 +379,10 @@ monitor_child_preauth(Authctxt *_authctx
/* Permit requests for moduli and signatures */
monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
@ -1935,7 +1935,7 @@ diff -up openssh-5.6p1/monitor.c.gsskex openssh-5.6p1/monitor.c
} else {
mon_dispatch = mon_dispatch_proto15;
@@ -449,6 +462,10 @@ monitor_child_postauth(struct monitor *p
@@ -456,6 +469,10 @@ monitor_child_postauth(struct monitor *p
monitor_permit(mon_dispatch, MONITOR_REQ_MODULI, 1);
monitor_permit(mon_dispatch, MONITOR_REQ_SIGN, 1);
monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
@ -1946,7 +1946,7 @@ diff -up openssh-5.6p1/monitor.c.gsskex openssh-5.6p1/monitor.c
} else {
mon_dispatch = mon_dispatch_postauth15;
monitor_permit(mon_dispatch, MONITOR_REQ_TERM, 1);
@@ -1723,6 +1740,13 @@ mm_get_kex(Buffer *m)
@@ -1742,6 +1759,13 @@ mm_get_kex(Buffer *m)
kex->kex[KEX_DH_GRP14_SHA1] = kexdh_server;
kex->kex[KEX_DH_GEX_SHA1] = kexgex_server;
kex->kex[KEX_DH_GEX_SHA256] = kexgex_server;
@ -1960,7 +1960,7 @@ diff -up openssh-5.6p1/monitor.c.gsskex openssh-5.6p1/monitor.c
kex->server = 1;
kex->hostkey_type = buffer_get_int(m);
kex->kex_type = buffer_get_int(m);
@@ -1929,6 +1953,9 @@ mm_answer_gss_setup_ctx(int sock, Buffer
@@ -1948,6 +1972,9 @@ mm_answer_gss_setup_ctx(int sock, Buffer
OM_uint32 major;
u_int len;
@ -1970,7 +1970,7 @@ diff -up openssh-5.6p1/monitor.c.gsskex openssh-5.6p1/monitor.c
goid.elements = buffer_get_string(m, &len);
goid.length = len;
@@ -1956,6 +1983,9 @@ mm_answer_gss_accept_ctx(int sock, Buffe
@@ -1975,6 +2002,9 @@ mm_answer_gss_accept_ctx(int sock, Buffe
OM_uint32 flags = 0; /* GSI needs this */
u_int len;
@ -1980,7 +1980,7 @@ diff -up openssh-5.6p1/monitor.c.gsskex openssh-5.6p1/monitor.c
in.value = buffer_get_string(m, &len);
in.length = len;
major = ssh_gssapi_accept_ctx(gsscontext, &in, &out, &flags);
@@ -1973,6 +2003,7 @@ mm_answer_gss_accept_ctx(int sock, Buffe
@@ -1992,6 +2022,7 @@ mm_answer_gss_accept_ctx(int sock, Buffe
monitor_permit(mon_dispatch, MONITOR_REQ_GSSSTEP, 0);
monitor_permit(mon_dispatch, MONITOR_REQ_GSSUSEROK, 1);
monitor_permit(mon_dispatch, MONITOR_REQ_GSSCHECKMIC, 1);
@ -1988,7 +1988,7 @@ diff -up openssh-5.6p1/monitor.c.gsskex openssh-5.6p1/monitor.c
}
return (0);
}
@@ -1984,6 +2015,9 @@ mm_answer_gss_checkmic(int sock, Buffer
@@ -2003,6 +2034,9 @@ mm_answer_gss_checkmic(int sock, Buffer
OM_uint32 ret;
u_int len;
@ -1998,7 +1998,7 @@ diff -up openssh-5.6p1/monitor.c.gsskex openssh-5.6p1/monitor.c
gssbuf.value = buffer_get_string(m, &len);
gssbuf.length = len;
mic.value = buffer_get_string(m, &len);
@@ -2010,7 +2044,11 @@ mm_answer_gss_userok(int sock, Buffer *m
@@ -2029,7 +2063,11 @@ mm_answer_gss_userok(int sock, Buffer *m
{
int authenticated;
@ -2011,7 +2011,7 @@ diff -up openssh-5.6p1/monitor.c.gsskex openssh-5.6p1/monitor.c
buffer_clear(m);
buffer_put_int(m, authenticated);
@@ -2023,6 +2061,74 @@ mm_answer_gss_userok(int sock, Buffer *m
@@ -2042,6 +2080,74 @@ mm_answer_gss_userok(int sock, Buffer *m
/* Monitor loop will terminate if authenticated */
return (authenticated);
}
@ -2087,8 +2087,8 @@ diff -up openssh-5.6p1/monitor.c.gsskex openssh-5.6p1/monitor.c
#ifdef JPAKE
diff -up openssh-5.6p1/monitor.h.gsskex openssh-5.6p1/monitor.h
--- openssh-5.6p1/monitor.h.gsskex 2010-10-22 15:35:16.000000000 +0200
+++ openssh-5.6p1/monitor.h 2010-10-22 15:35:17.000000000 +0200
--- openssh-5.6p1/monitor.h.gsskex 2010-11-02 22:23:47.000000000 +0100
+++ openssh-5.6p1/monitor.h 2010-11-02 22:23:50.000000000 +0100
@@ -56,6 +56,8 @@ enum monitor_reqtype {
MONITOR_REQ_GSSSTEP, MONITOR_ANS_GSSSTEP,
MONITOR_REQ_GSSUSEROK, MONITOR_ANS_GSSUSEROK,
@ -2099,8 +2099,8 @@ diff -up openssh-5.6p1/monitor.h.gsskex openssh-5.6p1/monitor.h
MONITOR_REQ_PAM_ACCOUNT, MONITOR_ANS_PAM_ACCOUNT,
MONITOR_REQ_PAM_INIT_CTX, MONITOR_ANS_PAM_INIT_CTX,
diff -up openssh-5.6p1/monitor_wrap.c.gsskex openssh-5.6p1/monitor_wrap.c
--- openssh-5.6p1/monitor_wrap.c.gsskex 2010-10-22 15:35:16.000000000 +0200
+++ openssh-5.6p1/monitor_wrap.c 2010-10-22 15:35:17.000000000 +0200
--- openssh-5.6p1/monitor_wrap.c.gsskex 2010-11-02 22:23:47.000000000 +0100
+++ openssh-5.6p1/monitor_wrap.c 2010-11-02 22:23:50.000000000 +0100
@@ -1250,7 +1250,7 @@ mm_ssh_gssapi_checkmic(Gssctxt *ctx, gss
}
@ -2163,8 +2163,8 @@ diff -up openssh-5.6p1/monitor_wrap.c.gsskex openssh-5.6p1/monitor_wrap.c
#ifdef JPAKE
diff -up openssh-5.6p1/monitor_wrap.h.gsskex openssh-5.6p1/monitor_wrap.h
--- openssh-5.6p1/monitor_wrap.h.gsskex 2010-10-22 15:35:16.000000000 +0200
+++ openssh-5.6p1/monitor_wrap.h 2010-10-22 15:35:17.000000000 +0200
--- openssh-5.6p1/monitor_wrap.h.gsskex 2010-11-02 22:23:47.000000000 +0100
+++ openssh-5.6p1/monitor_wrap.h 2010-11-02 22:23:50.000000000 +0100
@@ -60,8 +60,10 @@ BIGNUM *mm_auth_rsa_generate_challenge(K
OM_uint32 mm_ssh_gssapi_server_ctx(Gssctxt **, gss_OID);
OM_uint32 mm_ssh_gssapi_accept_ctx(Gssctxt *,
@ -2179,7 +2179,7 @@ diff -up openssh-5.6p1/monitor_wrap.h.gsskex openssh-5.6p1/monitor_wrap.h
#ifdef USE_PAM
diff -up openssh-5.6p1/readconf.c.gsskex openssh-5.6p1/readconf.c
--- openssh-5.6p1/readconf.c.gsskex 2010-08-03 08:04:46.000000000 +0200
+++ openssh-5.6p1/readconf.c 2010-10-22 15:35:17.000000000 +0200
+++ openssh-5.6p1/readconf.c 2010-11-02 22:23:50.000000000 +0100
@@ -127,6 +127,7 @@ typedef enum {
oClearAllForwardings, oNoHostAuthenticationForLocalhost,
oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
@ -2263,7 +2263,7 @@ diff -up openssh-5.6p1/readconf.c.gsskex openssh-5.6p1/readconf.c
if (options->kbd_interactive_authentication == -1)
diff -up openssh-5.6p1/readconf.h.gsskex openssh-5.6p1/readconf.h
--- openssh-5.6p1/readconf.h.gsskex 2010-08-03 08:04:46.000000000 +0200
+++ openssh-5.6p1/readconf.h 2010-10-22 15:35:17.000000000 +0200
+++ openssh-5.6p1/readconf.h 2010-11-02 22:23:50.000000000 +0100
@@ -46,7 +46,11 @@ typedef struct {
int challenge_response_authentication;
/* Try S/Key or TIS, authentication. */
@ -2277,8 +2277,8 @@ diff -up openssh-5.6p1/readconf.h.gsskex openssh-5.6p1/readconf.h
* authentication. */
int kbd_interactive_authentication; /* Try keyboard-interactive auth. */
diff -up openssh-5.6p1/servconf.c.gsskex openssh-5.6p1/servconf.c
--- openssh-5.6p1/servconf.c.gsskex 2010-10-22 15:35:16.000000000 +0200
+++ openssh-5.6p1/servconf.c 2010-10-22 15:35:17.000000000 +0200
--- openssh-5.6p1/servconf.c.gsskex 2010-11-02 22:23:47.000000000 +0100
+++ openssh-5.6p1/servconf.c 2010-11-02 22:23:50.000000000 +0100
@@ -93,7 +93,10 @@ initialize_server_options(ServerOptions
options->kerberos_ticket_cleanup = -1;
options->kerberos_get_afs_token = -1;
@ -2356,8 +2356,8 @@ diff -up openssh-5.6p1/servconf.c.gsskex openssh-5.6p1/servconf.c
intptr = &options->password_authentication;
goto parse_flag;
diff -up openssh-5.6p1/servconf.h.gsskex openssh-5.6p1/servconf.h
--- openssh-5.6p1/servconf.h.gsskex 2010-10-22 15:35:16.000000000 +0200
+++ openssh-5.6p1/servconf.h 2010-10-22 15:35:17.000000000 +0200
--- openssh-5.6p1/servconf.h.gsskex 2010-11-02 22:23:47.000000000 +0100
+++ openssh-5.6p1/servconf.h 2010-11-02 22:23:50.000000000 +0100
@@ -94,7 +94,10 @@ typedef struct {
int kerberos_get_afs_token; /* If true, try to get AFS token if
* authenticated with Kerberos. */
@ -2371,7 +2371,7 @@ diff -up openssh-5.6p1/servconf.h.gsskex openssh-5.6p1/servconf.h
int kbd_interactive_authentication; /* If true, permit */
diff -up openssh-5.6p1/ssh_config.5.gsskex openssh-5.6p1/ssh_config.5
--- openssh-5.6p1/ssh_config.5.gsskex 2010-08-05 05:03:13.000000000 +0200
+++ openssh-5.6p1/ssh_config.5 2010-10-22 15:35:17.000000000 +0200
+++ openssh-5.6p1/ssh_config.5 2010-11-02 22:23:50.000000000 +0100
@@ -509,11 +509,38 @@ Specifies whether user authentication ba
The default is
.Dq no .
@ -2413,8 +2413,8 @@ diff -up openssh-5.6p1/ssh_config.5.gsskex openssh-5.6p1/ssh_config.5
Indicates that
.Xr ssh 1
diff -up openssh-5.6p1/ssh_config.gsskex openssh-5.6p1/ssh_config
--- openssh-5.6p1/ssh_config.gsskex 2010-10-22 15:35:15.000000000 +0200
+++ openssh-5.6p1/ssh_config 2010-10-22 15:35:17.000000000 +0200
--- openssh-5.6p1/ssh_config.gsskex 2010-11-02 22:23:45.000000000 +0100
+++ openssh-5.6p1/ssh_config 2010-11-02 22:23:50.000000000 +0100
@@ -26,6 +26,8 @@
# HostbasedAuthentication no
# GSSAPIAuthentication no
@ -2425,8 +2425,8 @@ diff -up openssh-5.6p1/ssh_config.gsskex openssh-5.6p1/ssh_config
# CheckHostIP yes
# AddressFamily any
diff -up openssh-5.6p1/sshconnect2.c.gsskex openssh-5.6p1/sshconnect2.c
--- openssh-5.6p1/sshconnect2.c.gsskex 2010-10-22 15:35:17.000000000 +0200
+++ openssh-5.6p1/sshconnect2.c 2010-10-22 15:36:29.000000000 +0200
--- openssh-5.6p1/sshconnect2.c.gsskex 2010-11-02 22:23:49.000000000 +0100
+++ openssh-5.6p1/sshconnect2.c 2010-11-02 22:23:50.000000000 +0100
@@ -108,9 +108,34 @@ ssh_kex2(char *host, struct sockaddr *ho
{
Kex *kex;
@ -2629,9 +2629,9 @@ diff -up openssh-5.6p1/sshconnect2.c.gsskex openssh-5.6p1/sshconnect2.c
int
diff -up openssh-5.6p1/sshd.c.gsskex openssh-5.6p1/sshd.c
--- openssh-5.6p1/sshd.c.gsskex 2010-10-22 15:35:17.000000000 +0200
+++ openssh-5.6p1/sshd.c 2010-10-22 15:35:17.000000000 +0200
@@ -129,6 +129,10 @@ int allow_severity;
--- openssh-5.6p1/sshd.c.gsskex 2010-11-02 22:23:49.000000000 +0100
+++ openssh-5.6p1/sshd.c 2010-11-02 22:23:50.000000000 +0100
@@ -130,6 +130,10 @@ int allow_severity;
int deny_severity;
#endif /* LIBWRAP */
@ -2642,7 +2642,7 @@ diff -up openssh-5.6p1/sshd.c.gsskex openssh-5.6p1/sshd.c
#ifndef O_NOCTTY
#define O_NOCTTY 0
#endif
@@ -1601,10 +1605,13 @@ main(int ac, char **av)
@@ -1602,10 +1606,13 @@ main(int ac, char **av)
logit("Disabling protocol version 1. Could not load host key");
options.protocol &= ~SSH_PROTO_1;
}
@ -2656,7 +2656,7 @@ diff -up openssh-5.6p1/sshd.c.gsskex openssh-5.6p1/sshd.c
if (!(options.protocol & (SSH_PROTO_1|SSH_PROTO_2))) {
logit("sshd: no hostkeys available -- exiting.");
exit(1);
@@ -1937,6 +1944,60 @@ main(int ac, char **av)
@@ -1938,6 +1945,60 @@ main(int ac, char **av)
/* Log the connection. */
verbose("Connection from %.500s port %d", remote_ip, remote_port);
@ -2717,7 +2717,7 @@ diff -up openssh-5.6p1/sshd.c.gsskex openssh-5.6p1/sshd.c
/*
* We don't want to listen forever unless the other side
* successfully authenticates itself. So we set up an alarm which is
@@ -2324,12 +2385,61 @@ do_ssh2_kex(void)
@@ -2329,12 +2390,61 @@ do_ssh2_kex(void)
myproposal[PROPOSAL_SERVER_HOST_KEY_ALGS] = list_hostkey_types();
@ -2780,8 +2780,8 @@ diff -up openssh-5.6p1/sshd.c.gsskex openssh-5.6p1/sshd.c
kex->client_version_string=client_version_string;
kex->server_version_string=server_version_string;
diff -up openssh-5.6p1/sshd_config.5.gsskex openssh-5.6p1/sshd_config.5
--- openssh-5.6p1/sshd_config.5.gsskex 2010-10-22 15:35:16.000000000 +0200
+++ openssh-5.6p1/sshd_config.5 2010-10-22 15:35:17.000000000 +0200
--- openssh-5.6p1/sshd_config.5.gsskex 2010-11-02 22:23:47.000000000 +0100
+++ openssh-5.6p1/sshd_config.5 2010-11-02 22:23:50.000000000 +0100
@@ -424,12 +424,40 @@ Specifies whether user authentication ba
The default is
.Dq no .
@ -2824,8 +2824,8 @@ diff -up openssh-5.6p1/sshd_config.5.gsskex openssh-5.6p1/sshd_config.5
Specifies whether rhosts or /etc/hosts.equiv authentication together
with successful public key client host authentication is allowed
diff -up openssh-5.6p1/sshd_config.gsskex openssh-5.6p1/sshd_config
--- openssh-5.6p1/sshd_config.gsskex 2010-10-22 15:35:16.000000000 +0200
+++ openssh-5.6p1/sshd_config 2010-10-22 15:35:17.000000000 +0200
--- openssh-5.6p1/sshd_config.gsskex 2010-11-02 22:23:47.000000000 +0100
+++ openssh-5.6p1/sshd_config 2010-11-02 22:23:50.000000000 +0100
@@ -78,6 +78,8 @@ ChallengeResponseAuthentication no
GSSAPIAuthentication yes
#GSSAPICleanupCredentials yes
@ -2837,7 +2837,7 @@ diff -up openssh-5.6p1/sshd_config.gsskex openssh-5.6p1/sshd_config
# and session processing. If this is enabled, PAM authentication will
diff -up openssh-5.6p1/ssh-gss.h.gsskex openssh-5.6p1/ssh-gss.h
--- openssh-5.6p1/ssh-gss.h.gsskex 2007-06-12 15:40:39.000000000 +0200
+++ openssh-5.6p1/ssh-gss.h 2010-10-22 15:35:17.000000000 +0200
+++ openssh-5.6p1/ssh-gss.h 2010-11-02 22:23:50.000000000 +0100
@@ -1,6 +1,6 @@
/* $OpenBSD: ssh-gss.h,v 1.10 2007/06/12 08:20:00 djm Exp $ */
/*