net-misc/openssh: upgraded package to upstream
Upgraded net-misc/openssh to version 7.9_p1-r4 on amd64, arm.
This version has support for OpenSSL 1.0 & 1.1 APIs.
BUG=b:153485199
TEST=In chroot: sudo emerge openssh
=> manually verify ssh still works to DUT
TEST=tryjob
Change-Id: I90d03fc169b6680e25b798d30c0e9c9241af743c
Reviewed-on: https://chromium-review.googlesource.com/1551960
Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com>
Tested-by: Daniel Kurtz <djkurtz@chromium.org>
Reviewed-by: Jorge Lucangeli Obes <jorgelo@chromium.org>
(cherry picked from commit 47df10dbc71424027ae6f56bb949522d42acb7d8)
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/overlays/portage-stable/+/2142534
Commit-Queue: Daniel Wang <wonderfly@google.com>
Tested-by: Daniel Wang <wonderfly@google.com>
diff --git a/metadata/md5-cache/net-misc/openssh-7.5_p1-r1 b/metadata/md5-cache/net-misc/openssh-7.5_p1-r1
deleted file mode 100644
index e8d1443..0000000
--- a/metadata/md5-cache/net-misc/openssh-7.5_p1-r1
+++ /dev/null
@@ -1,14 +0,0 @@
-DEFINED_PHASES=configure install postinst preinst prepare pretend test
-DEPEND=!static? ( audit? ( sys-process/audit ) ldns? ( net-libs/ldns !bindist? ( net-libs/ldns[ecdsa,ssl] ) bindist? ( net-libs/ldns[-ecdsa,ssl] ) ) libedit? ( dev-libs/libedit:= ) sctp? ( net-misc/lksctp-tools ) selinux? ( >=sys-libs/libselinux-1.28 ) skey? ( >=sys-auth/skey-1.1.5-r1 ) ssl? ( !libressl? ( >=dev-libs/openssl-1.0.1:0=[bindist=] dev-libs/openssl:0= ) libressl? ( dev-libs/libressl:0= ) ) >=sys-libs/zlib-1.2.3:= ) pam? ( virtual/pam ) kerberos? ( virtual/krb5 ) ldap? ( net-nds/openldap ) static? ( audit? ( sys-process/audit[static-libs(+)] ) ldns? ( net-libs/ldns[static-libs(+)] !bindist? ( net-libs/ldns[ecdsa,ssl] ) bindist? ( net-libs/ldns[-ecdsa,ssl] ) ) libedit? ( dev-libs/libedit:=[static-libs(+)] ) sctp? ( net-misc/lksctp-tools[static-libs(+)] ) selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] ) skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] ) ssl? ( !libressl? ( >=dev-libs/openssl-1.0.1:0=[bindist=] dev-libs/openssl:0=[static-libs(+)] ) libressl? ( dev-libs/libressl:0=[static-libs(+)] ) ) >=sys-libs/zlib-1.2.3:=[static-libs(+)] ) virtual/pkgconfig virtual/os-headers sys-devel/autoconf sys-apps/baselayout >=app-portage/elt-patches-20170815 !<sys-devel/gettext-0.18.1.1-r3 || ( >=sys-devel/automake-1.16.1:1.16 >=sys-devel/automake-1.15.1:1.15 ) >=sys-devel/autoconf-2.69 >=sys-devel/libtool-2.4 virtual/pkgconfig
-DESCRIPTION=Port of OpenBSD's free SSH release
-EAPI=5
-HOMEPAGE=http://www.openssh.org/
-IUSE=abi_mips_n32 audit bindist debug +hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509
-KEYWORDS=*
-LICENSE=BSD GPL-2
-RDEPEND=!static? ( audit? ( sys-process/audit ) ldns? ( net-libs/ldns !bindist? ( net-libs/ldns[ecdsa,ssl] ) bindist? ( net-libs/ldns[-ecdsa,ssl] ) ) libedit? ( dev-libs/libedit:= ) sctp? ( net-misc/lksctp-tools ) selinux? ( >=sys-libs/libselinux-1.28 ) skey? ( >=sys-auth/skey-1.1.5-r1 ) ssl? ( !libressl? ( >=dev-libs/openssl-1.0.1:0=[bindist=] dev-libs/openssl:0= ) libressl? ( dev-libs/libressl:0= ) ) >=sys-libs/zlib-1.2.3:= ) pam? ( virtual/pam ) kerberos? ( virtual/krb5 ) ldap? ( net-nds/openldap ) pam? ( >=sys-auth/pambase-20081028 ) userland_GNU? ( virtual/shadow ) X? ( x11-apps/xauth ) sys-apps/baselayout
-REQUIRED_USE=ldns? ( ssl ) pie? ( !static ) ssh1? ( ssl ) static? ( !kerberos !pam ) X509? ( !ldap !sctp ssl ) test? ( ssl )
-SLOT=0
-SRC_URI=mirror://openbsd/OpenSSH/portable/openssh-7.5p1.tar.gz mirror://gentoo/openssh-7.4_p1-sctp.patch.xz hpn? ( mirror://gentoo/openssh-7.5p1-hpnssh14v12.tar.xz ) ldap? ( mirror://gentoo/openssh-lpk-7.5p1-0.3.14.patch.xz ) X509? ( http://roumenpetrov.info/openssh/x509-10.1/openssh-7.5p1+x509-10.1.diff.gz )
-_eclasses_=autotools d0e5375d47f4c809f406eb892e531513 estack 43ddf5aaffa7a8d0482df54d25a66a1f eutils 06133990e861be0fe60c2b428fd025d9 flag-o-matic 5d5921a298e95441da2f85be419894c0 libtool f143db5a74ccd9ca28c1234deffede96 multilib b2f01ad412baf81650c23fcf0975fa33 pam 3f746974e1cc47cabe3bd488c08cdc8e systemd 8f5286f89e265842f5b5189666eae88b toolchain-funcs 1e35303c63cd707f6c3422b4493d5607 user 77ad494d1257e3badef496e390973d6b versionator 26ca8a8bd95d6a74122c08ba98a4ee72
-_md5_=d3103824671ab37df11cdf6c3c95555c
diff --git a/metadata/md5-cache/net-misc/openssh-7.9_p1-r4 b/metadata/md5-cache/net-misc/openssh-7.9_p1-r4
new file mode 100644
index 0000000..a77687d
--- /dev/null
+++ b/metadata/md5-cache/net-misc/openssh-7.9_p1-r4
@@ -0,0 +1,15 @@
+DEFINED_PHASES=configure install postinst preinst prepare pretend test
+DEPEND=!static? ( audit? ( sys-process/audit ) ldns? ( net-libs/ldns !bindist? ( net-libs/ldns[ecdsa,ssl(+)] ) bindist? ( net-libs/ldns[-ecdsa,ssl(+)] ) ) libedit? ( dev-libs/libedit:= ) sctp? ( net-misc/lksctp-tools ) selinux? ( >=sys-libs/libselinux-1.28 ) ssl? ( !libressl? ( || ( ( >=dev-libs/openssl-1.0.1:0[bindist=] <dev-libs/openssl-1.1.0:0[bindist=] ) >=dev-libs/openssl-1.1.0g:0[bindist=] ) dev-libs/openssl:0= ) libressl? ( dev-libs/libressl:0= ) ) >=sys-libs/zlib-1.2.3:= ) pam? ( virtual/pam ) kerberos? ( virtual/krb5 ) static? ( audit? ( sys-process/audit[static-libs(+)] ) ldns? ( net-libs/ldns[static-libs(+)] !bindist? ( net-libs/ldns[ecdsa,ssl(+)] ) bindist? ( net-libs/ldns[-ecdsa,ssl(+)] ) ) libedit? ( dev-libs/libedit:=[static-libs(+)] ) sctp? ( net-misc/lksctp-tools[static-libs(+)] ) selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] ) ssl? ( !libressl? ( || ( ( >=dev-libs/openssl-1.0.1:0[bindist=] <dev-libs/openssl-1.1.0:0[bindist=] ) >=dev-libs/openssl-1.1.0g:0[bindist=] ) dev-libs/openssl:0=[static-libs(+)] ) libressl? ( dev-libs/libressl:0=[static-libs(+)] ) ) >=sys-libs/zlib-1.2.3:=[static-libs(+)] ) virtual/pkgconfig virtual/os-headers sys-devel/autoconf sys-apps/baselayout >=app-portage/elt-patches-20170815 !<sys-devel/gettext-0.18.1.1-r3 || ( >=sys-devel/automake-1.16.1:1.16 >=sys-devel/automake-1.15.1:1.15 ) >=sys-devel/autoconf-2.69 >=sys-devel/libtool-2.4 virtual/pkgconfig
+DESCRIPTION=Port of OpenBSD's free SSH release
+EAPI=6
+HOMEPAGE=https://www.openssh.com/
+IUSE=abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509
+KEYWORDS=*
+LICENSE=BSD GPL-2
+RDEPEND=!static? ( audit? ( sys-process/audit ) ldns? ( net-libs/ldns !bindist? ( net-libs/ldns[ecdsa,ssl(+)] ) bindist? ( net-libs/ldns[-ecdsa,ssl(+)] ) ) libedit? ( dev-libs/libedit:= ) sctp? ( net-misc/lksctp-tools ) selinux? ( >=sys-libs/libselinux-1.28 ) ssl? ( !libressl? ( || ( ( >=dev-libs/openssl-1.0.1:0[bindist=] <dev-libs/openssl-1.1.0:0[bindist=] ) >=dev-libs/openssl-1.1.0g:0[bindist=] ) dev-libs/openssl:0= ) libressl? ( dev-libs/libressl:0= ) ) >=sys-libs/zlib-1.2.3:= ) pam? ( virtual/pam ) kerberos? ( virtual/krb5 ) pam? ( >=sys-auth/pambase-20081028 ) userland_GNU? ( virtual/shadow ) X? ( x11-apps/xauth ) sys-apps/baselayout
+REQUIRED_USE=ldns? ( ssl ) pie? ( !static ) static? ( !kerberos !pam ) X509? ( !sctp ssl ) test? ( ssl )
+RESTRICT=!test? ( test )
+SLOT=0
+SRC_URI=mirror://openbsd/OpenSSH/portable/openssh-7.9p1.tar.gz https://dev.gentoo.org/~whissi/dist/openssh/openssh-7.9p1-patches-1.0.tar.xz sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/openssh-7.9p1-sctp-1.2.patch.xz ) hpn? ( mirror://sourceforge/hpnssh/HPN-SSH%2014v16%207.8p1/openssh-7_8_P1-hpn-DynWinNoneSwitch-14.16.diff mirror://sourceforge/hpnssh/HPN-SSH%2014v16%207.8p1/openssh-7_8_P1-hpn-AES-CTR-14.16.diff ) X509? ( https://roumenpetrov.info/openssh/x509-11.6/openssh-7.9p1+x509-11.6.diff.gz )
+_eclasses_=autotools d0e5375d47f4c809f406eb892e531513 eutils 06133990e861be0fe60c2b428fd025d9 flag-o-matic 5d5921a298e95441da2f85be419894c0 libtool f143db5a74ccd9ca28c1234deffede96 multilib b2f01ad412baf81650c23fcf0975fa33 pam 3f746974e1cc47cabe3bd488c08cdc8e systemd 8f5286f89e265842f5b5189666eae88b toolchain-funcs 1e35303c63cd707f6c3422b4493d5607 user 059bd54dd6b0acf0eb8961c4ec0c2b64
+_md5_=6c09fbf5709c02c0be637e6bb1bddd95
diff --git a/net-misc/openssh/Manifest b/net-misc/openssh/Manifest
index 513600e..46351c4 100644
--- a/net-misc/openssh/Manifest
+++ b/net-misc/openssh/Manifest
@@ -1,5 +1,6 @@
-DIST openssh-7.4_p1-sctp.patch.xz 8220 SHA256 18fa77f79ccae8b9a76bc877e9602113d91953bd487b6cc8284bfd1217438a23 SHA512 0c199e3b26949482125aeaa88216b2458292589e3eac8908d9134d13a1cae891094fcb0f752ed3009b3126cc72277b460205f39140c251792eb1b545271c3bd4 WHIRLPOOL 0f0ea1d36523b35d3be33d22fb84daa05fd14c464d69c19695235f81d26326bc53d6804bf34d0cc0c2584f412bfdac361d2b018032447d1033a4ff4fd9458a09
-DIST openssh-7.5p1+x509-10.1.diff.gz 460721 SHA256 e7abe401e7f651779c680491cfefbfcf4f26743202641b2bda934f80bb4464d2 SHA512 d3b5a8f5e3a88eda7989b002236811867b7e2c39bf7cd29a6dbbce277fca3fbedbfdbeaf1fba7d8c19f3dea32a17790e90604765f18576bcc5627a9c1d39109c WHIRLPOOL 2d4f96b47bcde9eabd19cad2fdc4da01a3d207f6ad5f4f1ea5a7dbd708d61783ae6a53e4cb622feed838106f57dbe6a7ecd1b41426325870378caf44803ff9ef
-DIST openssh-7.5p1-hpnssh14v12.tar.xz 23068 SHA256 8a1ed99c121a4ad21d7a26cd32627a8dd51595fd3ee9f95dc70e6b50fe779ce2 SHA512 45c42090a212b9ce898fbaa8284ddf0f0d17236af13c4a780e00bf265b0c7a4286027e90a7ce9ad70066309db722709dd2f0a7914f57e5364ffbaf7c4859cdf9 WHIRLPOOL 6089ad8ae16c112a6f15d168c092e7f057b9e6d815724346b5a6a1cd0de932f779d5f410d48c904d935fcb3bad3f597fa4de075ab1f49cadc9842ce7bd8fdf42
-DIST openssh-7.5p1.tar.gz 1510857 SHA256 9846e3c5fab9f0547400b4d2c017992f914222b3fd1f8eee6c7dc6bc5e59f9f0 SHA512 58c542e8a110fb4316a68db94abb663fa1c810becd0638d45281df8aeca62c1f705090437a80e788e6c29121769b72a505feced537d3118c933fde01b5285c81 WHIRLPOOL 1a42c68d8e350bc4790dd4c1a98dd6571bfa353ad6871b1462c53b6412f752719daabd1a13bb4434d294de966a00428ac66334bab45f371420029b5e34a6914c
-DIST openssh-lpk-7.5p1-0.3.14.patch.xz 17040 SHA256 11060be996b291b8d78de698c68a92428430e4ff440553f5045c6de5c0e1dab3 SHA512 9ce5d7e5d831c972f0f866b686bf93a048a03979ab38627973f5491eeeaa45f9faab0520b3a7ed90a13a67213fdc9cd4cf11e423acad441ea91b71037c8b435b WHIRLPOOL 58526777475786bb5efa193f3a3ec0500c4d48b18fef67698f8b1999cb07f04fbca7b7d3ece469f3a1e1ceca5152cdd08d3dbe7cfa4e7494740dc2c233101b93
+DIST openssh-7.9p1+x509-11.6.diff.gz 655819 BLAKE2B f442bb993f89782b74b0cd28906c91edfcf5b1d42a4c8135a5ccf5045e7eb000eb7aa301685b748f707506ba20e3b842d684db436872ed82b6d9b9c086879515 SHA512 0ff6ed2822aaa43cf352134b90975fb663662c5ea3d73b690601f24342ea207aecda8cdb9c1bdc3e3656fb059d842dfb3bf22646b626c303240808286103d8bc
+DIST openssh-7.9p1-patches-1.0.tar.xz 9080 BLAKE2B c14106a875b6ea0672a03f6cb292386daba96da23fed4ebd04a75f712e252bc88a25116b0b3b27446421aadf112451cb3b8a96d2f7d437e6728fe782190bc69e SHA512 7903cdb4ce5be0f1b1b741788fb372e68b0c9c1d6da0d854d8bc62e4743ad7cd13101b867b541828d3786b0857783377457e5e87ba9b63bfd9afcdbfd93ac103
+DIST openssh-7.9p1-sctp-1.2.patch.xz 7360 BLAKE2B 60e209371ecac24d0b60e48459d4d4044c0f364a2eea748cc4edd1501faec69a3c5b9e0b7db336968399ec684b6c8aceeac9196ba1ecf563ae3d660682cbc9a0 SHA512 d4d37a49cd43a3b9b7b173b0935267b84133b9b0954b7f71714ba781a6129c6d424f8b7a528dd7d4f287784c5517d57b1d6d7c6df8b5d738e34eb6dc7eae7191
+DIST openssh-7.9p1.tar.gz 1565384 BLAKE2B de15795e03d33d4f9fe4792f6b14500123230b6c00c1e5bd7207bb6d6bf6df0b2e057c1b1de0fee709f58dd159203fdd69fe1473118a6baedebaa0c1c4c55b59 SHA512 0412c9c429c9287f0794023951469c8e6ec833cdb55821bfa0300dd90d0879ff60484f620cffd93372641ab69bf0b032c2d700ccc680950892725fb631b7708e
+DIST openssh-7_8_P1-hpn-AES-CTR-14.16.diff 29231 BLAKE2B e25877c5e22f674e6db5a0bc107e5daa2509fe762fb14ce7bb2ce9a115e8177a93340c1d19247b6c2c854b7e1f9ae9af9fd932e5fa9c0a6b2ba438cd11a42991 SHA512 1867fb94c29a51294a71a3ec6a299757565a7cda5696118b0b346ed9c78f2c81bb1b888cff5e3418776b2fa277a8f070c5eb9327bb005453e2ffd72d35cdafa7
+DIST openssh-7_8_P1-hpn-DynWinNoneSwitch-14.16.diff 43356 BLAKE2B 776fa140d64a16c339b46a7c773258d2f4fe44e48b16abccad1a8757a51cb6362722fc5f42c39159af12849f5c88cf574de64815085c97157e16653f18d4909b SHA512 53f2752b7aa02719c8dfe0fe0ef16e874101ba2ba87924aa1122cd445ece218ca09c22abaa3377307f25d459579bc28d3854e2402c71b794db65d58cdd1ebc08
diff --git a/net-misc/openssh/files/openssh-7.3-mips-seccomp-n32.patch b/net-misc/openssh/files/openssh-7.3-mips-seccomp-n32.patch
deleted file mode 100644
index 7eaadaf..0000000
--- a/net-misc/openssh/files/openssh-7.3-mips-seccomp-n32.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-https://bugs.gentoo.org/591392
-https://bugzilla.mindrot.org/show_bug.cgi?id=2590
-
-7.3 added seccomp support to MIPS, but failed to handled the N32
-case. This patch is temporary until upstream fixes.
-
---- openssh-7.3p1/configure.ac
-+++ openssh-7.3p1/configure.ac
-@@ -816,10 +816,10 @@ main() { if (NSVersionOfRunTimeLibrary("
- seccomp_audit_arch=AUDIT_ARCH_MIPSEL
- ;;
- mips64-*)
-- seccomp_audit_arch=AUDIT_ARCH_MIPS64
-+ seccomp_audit_arch=AUDIT_ARCH_MIPS64N32
- ;;
- mips64el-*)
-- seccomp_audit_arch=AUDIT_ARCH_MIPSEL64
-+ seccomp_audit_arch=AUDIT_ARCH_MIPSEL64N32
- ;;
- esac
- if test "x$seccomp_audit_arch" != "x" ; then
diff --git a/net-misc/openssh/files/openssh-7.5_p1-cross-cache.patch b/net-misc/openssh/files/openssh-7.5_p1-cross-cache.patch
deleted file mode 100644
index 1c2b7b8..0000000
--- a/net-misc/openssh/files/openssh-7.5_p1-cross-cache.patch
+++ /dev/null
@@ -1,39 +0,0 @@
-From d588d6f83e9a3d48286929b4a705b43e74414241 Mon Sep 17 00:00:00 2001
-From: Mike Frysinger <vapier@chromium.org>
-Date: Wed, 24 May 2017 23:18:41 -0400
-Subject: [PATCH] configure: actually set cache vars when cross-compiling
-
-The cross-compiling fallback message says it's assuming the test
-passed, but it didn't actually set the cache var which causes
-later tests to fail.
----
- configure.ac | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index 5cfea38c0a6c..895c5211ea93 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -3162,7 +3162,8 @@ AC_RUN_IFELSE(
- select_works_with_rlimit=yes],
- [AC_MSG_RESULT([no])
- select_works_with_rlimit=no],
-- [AC_MSG_WARN([cross compiling: assuming yes])]
-+ [AC_MSG_WARN([cross compiling: assuming yes])
-+ select_works_with_rlimit=yes]
- )
-
- AC_MSG_CHECKING([if setrlimit(RLIMIT_NOFILE,{0,0}) works])
-@@ -3188,7 +3189,8 @@ AC_RUN_IFELSE(
- rlimit_nofile_zero_works=yes],
- [AC_MSG_RESULT([no])
- rlimit_nofile_zero_works=no],
-- [AC_MSG_WARN([cross compiling: assuming yes])]
-+ [AC_MSG_WARN([cross compiling: assuming yes])
-+ rlimit_nofile_zero_works=yes]
- )
-
- AC_MSG_CHECKING([if setrlimit RLIMIT_FSIZE works])
---
-2.12.0
-
diff --git a/net-misc/openssh/files/openssh-7.5_p1-disable-conch-interop-tests.patch b/net-misc/openssh/files/openssh-7.5_p1-disable-conch-interop-tests.patch
new file mode 100644
index 0000000..a5647ce
--- /dev/null
+++ b/net-misc/openssh/files/openssh-7.5_p1-disable-conch-interop-tests.patch
@@ -0,0 +1,20 @@
+Disable conch interop tests which are failing when called
+via portage for yet unknown reason and because using conch
+seems to be flaky (test is failing when using Python2 but
+passing when using Python3).
+
+Bug: https://bugs.gentoo.org/605446
+
+--- a/regress/conch-ciphers.sh
++++ b/regress/conch-ciphers.sh
+@@ -3,6 +3,10 @@
+
+ tid="conch ciphers"
+
++# https://bugs.gentoo.org/605446
++echo "conch interop tests skipped due to Gentoo bug #605446"
++exit 0
++
+ if test "x$REGRESS_INTEROP_CONCH" != "xyes" ; then
+ echo "conch interop tests not enabled"
+ exit 0
diff --git a/net-misc/openssh/files/openssh-7.5_p1-hpn-x509-10.1-glue.patch b/net-misc/openssh/files/openssh-7.5_p1-hpn-x509-10.1-glue.patch
deleted file mode 100644
index e55a8b1..0000000
--- a/net-misc/openssh/files/openssh-7.5_p1-hpn-x509-10.1-glue.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-diff -ur a/0003-Add-support-for-the-multi-threaded-AES-CTR-cipher.patch b/0003-Add-support-for-the-multi-threaded-AES-CTR-cipher.patch
---- a/0003-Add-support-for-the-multi-threaded-AES-CTR-cipher.patch 2017-03-27 13:31:01.816551100 -0700
-+++ b/0003-Add-support-for-the-multi-threaded-AES-CTR-cipher.patch 2017-03-27 13:51:03.894805846 -0700
-@@ -40,7 +40,7 @@
- @@ -44,7 +44,7 @@ CC=@CC@
- LD=@LD@
- CFLAGS=@CFLAGS@
-- CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ $(PATHS) @DEFS@
-+ CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ @LDAP_CPPFLAGS@ $(PATHS) @DEFS@
- -LIBS=@LIBS@
- +LIBS=@LIBS@ -lpthread
- K5LIBS=@K5LIBS@
-@@ -1023,6 +1023,3 @@
- do_authenticated(authctxt);
-
- /* The connection has been terminated. */
----
--2.12.0
--
-diff -ur a/0004-support-dynamically-sized-receive-buffers.patch b/0004-support-dynamically-sized-receive-buffers.patch
---- a/0004-support-dynamically-sized-receive-buffers.patch 2017-03-27 13:31:01.816551100 -0700
-+++ b/0004-support-dynamically-sized-receive-buffers.patch 2017-03-27 13:49:44.513498976 -0700
-@@ -926,9 +926,9 @@
- @@ -526,10 +553,10 @@ send_client_banner(int connection_out, int minor1)
- /* Send our own protocol version identification. */
- if (compat20) {
-- xasprintf(&client_version_string, "SSH-%d.%d-%.100s\r\n",
--- PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION);
--+ PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE);
-+ xasprintf(&client_version_string, "SSH-%d.%d-%.100s PKIX[%s]\r\n",
-+- PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION, PACKAGE_VERSION);
-++ PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE, PACKAGE_VERSION);
- } else {
- xasprintf(&client_version_string, "SSH-%d.%d-%.100s\n",
- - PROTOCOL_MAJOR_1, minor1, SSH_VERSION);
-@@ -943,11 +943,11 @@
- @@ -367,7 +367,7 @@ sshd_exchange_identification(struct ssh *ssh, int sock_in, int sock_out)
- char remote_version[256]; /* Must be at least as big as buf. */
-
-- xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s\r\n",
--- PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION,
--+ PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE,
-+ xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s%s%s",
-+- major, minor, SSH_VERSION, comment,
-++ major, minor, SSH_RELEASE, comment,
- *options.version_addendum == '\0' ? "" : " ",
-- options.version_addendum);
-+ options.version_addendum, newline);
-
- @@ -1020,6 +1020,8 @@ server_listen(void)
- int ret, listen_sock, on = 1;
-@@ -1008,10 +1008,6 @@
- @@ -3,4 +3,5 @@
- #define SSH_VERSION "OpenSSH_7.5"
-
-- #define SSH_PORTABLE "p1"
---#define SSH_RELEASE SSH_VERSION SSH_PORTABLE
-+-#define SSH_RELEASE PACKAGE_STRING ", " SSH_VERSION "p1"
- +#define SSH_HPN "-hpn14v12"
- +#define SSH_RELEASE SSH_VERSION SSH_PORTABLE SSH_HPN
----
--2.12.0
--
diff --git a/net-misc/openssh/files/openssh-7.5_p1-x32-typo.patch b/net-misc/openssh/files/openssh-7.5_p1-x32-typo.patch
deleted file mode 100644
index 5dca1b0..0000000
--- a/net-misc/openssh/files/openssh-7.5_p1-x32-typo.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From 596c432181e1c4a9da354388394f640afd29f44b Mon Sep 17 00:00:00 2001
-From: Mike Frysinger <vapier@gentoo.org>
-Date: Mon, 20 Mar 2017 14:57:40 -0400
-Subject: [PATCH] seccomp sandbox: fix typo w/x32 check
-
----
- sandbox-seccomp-filter.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/sandbox-seccomp-filter.c b/sandbox-seccomp-filter.c
-index 3a1aedce72c2..a8d472a63ccb 100644
---- a/sandbox-seccomp-filter.c
-+++ b/sandbox-seccomp-filter.c
-@@ -235,7 +235,7 @@ static const struct sock_filter preauth_insns[] = {
- * x86-64 syscall under some circumstances, e.g.
- * https://bugs.debian.org/849923
- */
-- SC_ALLOW(__NR_clock_gettime & ~__X32_SYSCALL_BIT);
-+ SC_ALLOW(__NR_clock_gettime & ~__X32_SYSCALL_BIT),
- #endif
-
- /* Default deny */
---
-2.12.0
-
diff --git a/net-misc/openssh/files/openssh-7.5p1-x509-libressl.patch b/net-misc/openssh/files/openssh-7.5p1-x509-libressl.patch
deleted file mode 100644
index b4f36a5..0000000
--- a/net-misc/openssh/files/openssh-7.5p1-x509-libressl.patch
+++ /dev/null
@@ -1,202 +0,0 @@
-diff -urN openssh-7.5p1.orig/a_utf8.c openssh-7.5p1/a_utf8.c
---- openssh-7.5p1.orig/a_utf8.c 1970-01-01 00:00:00.000000000 +0000
-+++ openssh-7.5p1/a_utf8.c 2017-03-30 17:38:25.179532110 +0000
-@@ -0,0 +1,186 @@
-+/*
-+ * Copyright 1995-2016 The OpenSSL Project Authors. All Rights Reserved.
-+ *
-+ * Licensed under the OpenSSL license (the "License"). You may not use
-+ * this file except in compliance with the License. You can obtain a copy
-+ * in the file LICENSE in the source distribution or at
-+ * https://www.openssl.org/source/license.html
-+ */
-+
-+#include <stdio.h>
-+
-+/* UTF8 utilities */
-+
-+/*-
-+ * This parses a UTF8 string one character at a time. It is passed a pointer
-+ * to the string and the length of the string. It sets 'value' to the value of
-+ * the current character. It returns the number of characters read or a
-+ * negative error code:
-+ * -1 = string too short
-+ * -2 = illegal character
-+ * -3 = subsequent characters not of the form 10xxxxxx
-+ * -4 = character encoded incorrectly (not minimal length).
-+ */
-+
-+int UTF8_getc(const unsigned char *str, int len, unsigned long *val)
-+{
-+ const unsigned char *p;
-+ unsigned long value;
-+ int ret;
-+ if (len <= 0)
-+ return 0;
-+ p = str;
-+
-+ /* Check syntax and work out the encoded value (if correct) */
-+ if ((*p & 0x80) == 0) {
-+ value = *p++ & 0x7f;
-+ ret = 1;
-+ } else if ((*p & 0xe0) == 0xc0) {
-+ if (len < 2)
-+ return -1;
-+ if ((p[1] & 0xc0) != 0x80)
-+ return -3;
-+ value = (*p++ & 0x1f) << 6;
-+ value |= *p++ & 0x3f;
-+ if (value < 0x80)
-+ return -4;
-+ ret = 2;
-+ } else if ((*p & 0xf0) == 0xe0) {
-+ if (len < 3)
-+ return -1;
-+ if (((p[1] & 0xc0) != 0x80)
-+ || ((p[2] & 0xc0) != 0x80))
-+ return -3;
-+ value = (*p++ & 0xf) << 12;
-+ value |= (*p++ & 0x3f) << 6;
-+ value |= *p++ & 0x3f;
-+ if (value < 0x800)
-+ return -4;
-+ ret = 3;
-+ } else if ((*p & 0xf8) == 0xf0) {
-+ if (len < 4)
-+ return -1;
-+ if (((p[1] & 0xc0) != 0x80)
-+ || ((p[2] & 0xc0) != 0x80)
-+ || ((p[3] & 0xc0) != 0x80))
-+ return -3;
-+ value = ((unsigned long)(*p++ & 0x7)) << 18;
-+ value |= (*p++ & 0x3f) << 12;
-+ value |= (*p++ & 0x3f) << 6;
-+ value |= *p++ & 0x3f;
-+ if (value < 0x10000)
-+ return -4;
-+ ret = 4;
-+ } else if ((*p & 0xfc) == 0xf8) {
-+ if (len < 5)
-+ return -1;
-+ if (((p[1] & 0xc0) != 0x80)
-+ || ((p[2] & 0xc0) != 0x80)
-+ || ((p[3] & 0xc0) != 0x80)
-+ || ((p[4] & 0xc0) != 0x80))
-+ return -3;
-+ value = ((unsigned long)(*p++ & 0x3)) << 24;
-+ value |= ((unsigned long)(*p++ & 0x3f)) << 18;
-+ value |= ((unsigned long)(*p++ & 0x3f)) << 12;
-+ value |= (*p++ & 0x3f) << 6;
-+ value |= *p++ & 0x3f;
-+ if (value < 0x200000)
-+ return -4;
-+ ret = 5;
-+ } else if ((*p & 0xfe) == 0xfc) {
-+ if (len < 6)
-+ return -1;
-+ if (((p[1] & 0xc0) != 0x80)
-+ || ((p[2] & 0xc0) != 0x80)
-+ || ((p[3] & 0xc0) != 0x80)
-+ || ((p[4] & 0xc0) != 0x80)
-+ || ((p[5] & 0xc0) != 0x80))
-+ return -3;
-+ value = ((unsigned long)(*p++ & 0x1)) << 30;
-+ value |= ((unsigned long)(*p++ & 0x3f)) << 24;
-+ value |= ((unsigned long)(*p++ & 0x3f)) << 18;
-+ value |= ((unsigned long)(*p++ & 0x3f)) << 12;
-+ value |= (*p++ & 0x3f) << 6;
-+ value |= *p++ & 0x3f;
-+ if (value < 0x4000000)
-+ return -4;
-+ ret = 6;
-+ } else
-+ return -2;
-+ *val = value;
-+ return ret;
-+}
-+
-+/*
-+ * This takes a character 'value' and writes the UTF8 encoded value in 'str'
-+ * where 'str' is a buffer containing 'len' characters. Returns the number of
-+ * characters written or -1 if 'len' is too small. 'str' can be set to NULL
-+ * in which case it just returns the number of characters. It will need at
-+ * most 6 characters.
-+ */
-+
-+int UTF8_putc(unsigned char *str, int len, unsigned long value)
-+{
-+ if (!str)
-+ len = 6; /* Maximum we will need */
-+ else if (len <= 0)
-+ return -1;
-+ if (value < 0x80) {
-+ if (str)
-+ *str = (unsigned char)value;
-+ return 1;
-+ }
-+ if (value < 0x800) {
-+ if (len < 2)
-+ return -1;
-+ if (str) {
-+ *str++ = (unsigned char)(((value >> 6) & 0x1f) | 0xc0);
-+ *str = (unsigned char)((value & 0x3f) | 0x80);
-+ }
-+ return 2;
-+ }
-+ if (value < 0x10000) {
-+ if (len < 3)
-+ return -1;
-+ if (str) {
-+ *str++ = (unsigned char)(((value >> 12) & 0xf) | 0xe0);
-+ *str++ = (unsigned char)(((value >> 6) & 0x3f) | 0x80);
-+ *str = (unsigned char)((value & 0x3f) | 0x80);
-+ }
-+ return 3;
-+ }
-+ if (value < 0x200000) {
-+ if (len < 4)
-+ return -1;
-+ if (str) {
-+ *str++ = (unsigned char)(((value >> 18) & 0x7) | 0xf0);
-+ *str++ = (unsigned char)(((value >> 12) & 0x3f) | 0x80);
-+ *str++ = (unsigned char)(((value >> 6) & 0x3f) | 0x80);
-+ *str = (unsigned char)((value & 0x3f) | 0x80);
-+ }
-+ return 4;
-+ }
-+ if (value < 0x4000000) {
-+ if (len < 5)
-+ return -1;
-+ if (str) {
-+ *str++ = (unsigned char)(((value >> 24) & 0x3) | 0xf8);
-+ *str++ = (unsigned char)(((value >> 18) & 0x3f) | 0x80);
-+ *str++ = (unsigned char)(((value >> 12) & 0x3f) | 0x80);
-+ *str++ = (unsigned char)(((value >> 6) & 0x3f) | 0x80);
-+ *str = (unsigned char)((value & 0x3f) | 0x80);
-+ }
-+ return 5;
-+ }
-+ if (len < 6)
-+ return -1;
-+ if (str) {
-+ *str++ = (unsigned char)(((value >> 30) & 0x1) | 0xfc);
-+ *str++ = (unsigned char)(((value >> 24) & 0x3f) | 0x80);
-+ *str++ = (unsigned char)(((value >> 18) & 0x3f) | 0x80);
-+ *str++ = (unsigned char)(((value >> 12) & 0x3f) | 0x80);
-+ *str++ = (unsigned char)(((value >> 6) & 0x3f) | 0x80);
-+ *str = (unsigned char)((value & 0x3f) | 0x80);
-+ }
-+ return 6;
-+}
-diff -urN openssh-7.5p1.orig/Makefile.in openssh-7.5p1/Makefile.in
---- openssh-7.5p1.orig/Makefile.in 2017-03-30 17:33:30.983830629 +0000
-+++ openssh-7.5p1/Makefile.in 2017-03-30 17:39:28.392905858 +0000
-@@ -74,7 +74,7 @@
- @OCSP_ON@OCSP_OBJS=ssh-ocsp.o
- @OCSP_OFF@OCSP_OBJS=
-
--SSHX509_OBJS=ssh-x509.o ssh-xkalg.o x509_nm_cmp.o key-eng.o
-+SSHX509_OBJS=ssh-x509.o ssh-xkalg.o x509_nm_cmp.o key-eng.o a_utf8.o
- X509STORE_OBJS=x509store.o $(LDAP_OBJS)
-
- TARGETS=ssh$(EXEEXT) sshd$(EXEEXT) ssh-add$(EXEEXT) ssh-keygen$(EXEEXT) ssh-keyscan${EXEEXT} ssh-keysign${EXEEXT} ssh-pkcs11-helper$(EXEEXT) ssh-agent$(EXEEXT) scp$(EXEEXT) sftp-server$(EXEEXT) sftp$(EXEEXT)
diff --git a/net-misc/openssh/files/openssh-7.5_p1-GSSAPI-dns.patch b/net-misc/openssh/files/openssh-7.8_p1-GSSAPI-dns.patch
similarity index 90%
rename from net-misc/openssh/files/openssh-7.5_p1-GSSAPI-dns.patch
rename to net-misc/openssh/files/openssh-7.8_p1-GSSAPI-dns.patch
index 6b1e6dd..989dc6c 100644
--- a/net-misc/openssh/files/openssh-7.5_p1-GSSAPI-dns.patch
+++ b/net-misc/openssh/files/openssh-7.8_p1-GSSAPI-dns.patch
@@ -1,121 +1,11 @@
-http://bugs.gentoo.org/165444
-https://bugzilla.mindrot.org/show_bug.cgi?id=1008
-
---- a/readconf.c
-+++ b/readconf.c
-@@ -148,6 +148,7 @@
- oClearAllForwardings, oNoHostAuthenticationForLocalhost,
- oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
- oAddressFamily, oGssAuthentication, oGssDelegateCreds,
-+ oGssTrustDns,
- oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
- oSendEnv, oControlPath, oControlMaster, oControlPersist,
- oHashKnownHosts,
-@@ -194,9 +195,11 @@
- #if defined(GSSAPI)
- { "gssapiauthentication", oGssAuthentication },
- { "gssapidelegatecredentials", oGssDelegateCreds },
-+ { "gssapitrustdns", oGssTrustDns },
- # else
- { "gssapiauthentication", oUnsupported },
- { "gssapidelegatecredentials", oUnsupported },
-+ { "gssapitrustdns", oUnsupported },
- #endif
- #ifdef ENABLE_PKCS11
- { "smartcarddevice", oPKCS11Provider },
-@@ -930,6 +933,10 @@
- intptr = &options->gss_deleg_creds;
- goto parse_flag;
-
-+ case oGssTrustDns:
-+ intptr = &options->gss_trust_dns;
-+ goto parse_flag;
-+
- case oBatchMode:
- intptr = &options->batch_mode;
- goto parse_flag;
-@@ -1649,6 +1656,7 @@
- options->challenge_response_authentication = -1;
- options->gss_authentication = -1;
- options->gss_deleg_creds = -1;
-+ options->gss_trust_dns = -1;
- options->password_authentication = -1;
- options->kbd_interactive_authentication = -1;
- options->kbd_interactive_devices = NULL;
-@@ -1779,6 +1787,8 @@
- options->gss_authentication = 0;
- if (options->gss_deleg_creds == -1)
- options->gss_deleg_creds = 0;
-+ if (options->gss_trust_dns == -1)
-+ options->gss_trust_dns = 0;
- if (options->password_authentication == -1)
- options->password_authentication = 1;
- if (options->kbd_interactive_authentication == -1)
---- a/readconf.h
-+++ b/readconf.h
-@@ -46,6 +46,7 @@
- /* Try S/Key or TIS, authentication. */
- int gss_authentication; /* Try GSS authentication */
- int gss_deleg_creds; /* Delegate GSS credentials */
-+ int gss_trust_dns; /* Trust DNS for GSS canonicalization */
- int password_authentication; /* Try password
- * authentication. */
- int kbd_interactive_authentication; /* Try keyboard-interactive auth. */
---- a/ssh_config.5
-+++ b/ssh_config.5
-@@ -830,6 +830,16 @@
- Forward (delegate) credentials to the server.
- The default is
- .Cm no .
-+Note that this option applies to protocol version 2 connections using GSSAPI.
-+.It Cm GSSAPITrustDns
-+Set to
-+.Dq yes to indicate that the DNS is trusted to securely canonicalize
-+the name of the host being connected to. If
-+.Dq no, the hostname entered on the
-+command line will be passed untouched to the GSSAPI library.
-+The default is
-+.Dq no .
-+This option only applies to protocol version 2 connections using GSSAPI.
- .It Cm HashKnownHosts
- Indicates that
- .Xr ssh 1
---- a/sshconnect2.c
-+++ b/sshconnect2.c
-@@ -656,6 +656,13 @@
- static u_int mech = 0;
- OM_uint32 min;
- int ok = 0;
-+ const char *gss_host;
-+
-+ if (options.gss_trust_dns) {
-+ extern const char *auth_get_canonical_hostname(struct ssh *ssh, int use_dns);
-+ gss_host = auth_get_canonical_hostname(active_state, 1);
-+ } else
-+ gss_host = authctxt->host;
-
- /* Try one GSSAPI method at a time, rather than sending them all at
- * once. */
-@@ -668,7 +674,7 @@
- /* My DER encoding requires length<128 */
- if (gss_supported->elements[mech].length < 128 &&
- ssh_gssapi_check_mechanism(&gssctxt,
-- &gss_supported->elements[mech], authctxt->host)) {
-+ &gss_supported->elements[mech], gss_host)) {
- ok = 1; /* Mechanism works */
- } else {
- mech++;
-
-need to move these two funcs back to canohost so they're available to clients
-and the server. auth.c is only used in the server.
-
+diff --git a/auth.c b/auth.c
+index 9a3bc96f..fc2c3620 100644
--- a/auth.c
+++ b/auth.c
-@@ -784,117 +784,3 @@ fakepw(void)
-
+@@ -733,120 +733,6 @@ fakepw(void)
return (&fake);
}
--
+
-/*
- * Returns the remote DNS hostname as a string. The returned string must not
- * be freed. NB. this will usually trigger a DNS query the first time it is
@@ -229,6 +119,12 @@
- return dnsname;
- }
-}
+-
+ /*
+ * Runs command in a subprocess with a minimal environment.
+ * Returns pid on success, 0 on failure.
+diff --git a/canohost.c b/canohost.c
+index f71a0856..3e162d8c 100644
--- a/canohost.c
+++ b/canohost.c
@@ -202,3 +202,117 @@ get_local_port(int sock)
@@ -349,3 +245,115 @@
+ return dnsname;
+ }
+}
+diff --git a/readconf.c b/readconf.c
+index db5f2d54..67feffa5 100644
+--- a/readconf.c
++++ b/readconf.c
+@@ -161,6 +161,7 @@ typedef enum {
+ oClearAllForwardings, oNoHostAuthenticationForLocalhost,
+ oEnableSSHKeysign, oRekeyLimit, oVerifyHostKeyDNS, oConnectTimeout,
+ oAddressFamily, oGssAuthentication, oGssDelegateCreds,
++ oGssTrustDns,
+ oServerAliveInterval, oServerAliveCountMax, oIdentitiesOnly,
+ oSendEnv, oSetEnv, oControlPath, oControlMaster, oControlPersist,
+ oHashKnownHosts,
+@@ -202,9 +203,11 @@ static struct {
+ #if defined(GSSAPI)
+ { "gssapiauthentication", oGssAuthentication },
+ { "gssapidelegatecredentials", oGssDelegateCreds },
++ { "gssapitrustdns", oGssTrustDns },
+ # else
+ { "gssapiauthentication", oUnsupported },
+ { "gssapidelegatecredentials", oUnsupported },
++ { "gssapitrustdns", oUnsupported },
+ #endif
+ #ifdef ENABLE_PKCS11
+ { "smartcarddevice", oPKCS11Provider },
+@@ -977,6 +980,10 @@ parse_time:
+ intptr = &options->gss_deleg_creds;
+ goto parse_flag;
+
++ case oGssTrustDns:
++ intptr = &options->gss_trust_dns;
++ goto parse_flag;
++
+ case oBatchMode:
+ intptr = &options->batch_mode;
+ goto parse_flag;
+@@ -1818,6 +1825,7 @@ initialize_options(Options * options)
+ options->challenge_response_authentication = -1;
+ options->gss_authentication = -1;
+ options->gss_deleg_creds = -1;
++ options->gss_trust_dns = -1;
+ options->password_authentication = -1;
+ options->kbd_interactive_authentication = -1;
+ options->kbd_interactive_devices = NULL;
+@@ -1964,6 +1972,8 @@ fill_default_options(Options * options)
+ options->gss_authentication = 0;
+ if (options->gss_deleg_creds == -1)
+ options->gss_deleg_creds = 0;
++ if (options->gss_trust_dns == -1)
++ options->gss_trust_dns = 0;
+ if (options->password_authentication == -1)
+ options->password_authentication = 1;
+ if (options->kbd_interactive_authentication == -1)
+diff --git a/readconf.h b/readconf.h
+index c5688781..af809cc8 100644
+--- a/readconf.h
++++ b/readconf.h
+@@ -41,6 +41,7 @@ typedef struct {
+ /* Try S/Key or TIS, authentication. */
+ int gss_authentication; /* Try GSS authentication */
+ int gss_deleg_creds; /* Delegate GSS credentials */
++ int gss_trust_dns; /* Trust DNS for GSS canonicalization */
+ int password_authentication; /* Try password
+ * authentication. */
+ int kbd_interactive_authentication; /* Try keyboard-interactive auth. */
+diff --git a/ssh_config.5 b/ssh_config.5
+index f499396a..be758544 100644
+--- a/ssh_config.5
++++ b/ssh_config.5
+@@ -722,6 +722,16 @@ The default is
+ Forward (delegate) credentials to the server.
+ The default is
+ .Cm no .
++Note that this option applies to protocol version 2 connections using GSSAPI.
++.It Cm GSSAPITrustDns
++Set to
++.Dq yes to indicate that the DNS is trusted to securely canonicalize
++the name of the host being connected to. If
++.Dq no, the hostname entered on the
++command line will be passed untouched to the GSSAPI library.
++The default is
++.Dq no .
++This option only applies to protocol version 2 connections using GSSAPI.
+ .It Cm HashKnownHosts
+ Indicates that
+ .Xr ssh 1
+diff --git a/sshconnect2.c b/sshconnect2.c
+index 10e4f0a0..4f7d49e3 100644
+--- a/sshconnect2.c
++++ b/sshconnect2.c
+@@ -657,6 +657,13 @@ userauth_gssapi(Authctxt *authctxt)
+ static u_int mech = 0;
+ OM_uint32 min;
+ int r, ok = 0;
++ const char *gss_host;
++
++ if (options.gss_trust_dns) {
++ extern const char *auth_get_canonical_hostname(struct ssh *ssh, int use_dns);
++ gss_host = auth_get_canonical_hostname(active_state, 1);
++ } else
++ gss_host = authctxt->host;
+
+ /* Try one GSSAPI method at a time, rather than sending them all at
+ * once. */
+@@ -669,7 +676,7 @@ userauth_gssapi(Authctxt *authctxt)
+ /* My DER encoding requires length<128 */
+ if (gss_supported->elements[mech].length < 128 &&
+ ssh_gssapi_check_mechanism(&gssctxt,
+- &gss_supported->elements[mech], authctxt->host)) {
++ &gss_supported->elements[mech], gss_host)) {
+ ok = 1; /* Mechanism works */
+ } else {
+ mech++;
diff --git a/net-misc/openssh/files/openssh-7.9_p1-CVE-2018-20685.patch b/net-misc/openssh/files/openssh-7.9_p1-CVE-2018-20685.patch
new file mode 100644
index 0000000..3fa3e31
--- /dev/null
+++ b/net-misc/openssh/files/openssh-7.9_p1-CVE-2018-20685.patch
@@ -0,0 +1,16 @@
+CVE-2018-20685
+
+https://github.com/openssh/openssh-portable/commit/6010c0303a422a9c5fa8860c061bf7105eb7f8b2
+
+--- a/scp.c
++++ b/scp.c
+@@ -1106,7 +1106,8 @@ sink(int argc, char **argv)
+ SCREWUP("size out of range");
+ size = (off_t)ull;
+
+- if ((strchr(cp, '/') != NULL) || (strcmp(cp, "..") == 0)) {
++ if (*cp == '\0' || strchr(cp, '/') != NULL ||
++ strcmp(cp, ".") == 0 || strcmp(cp, "..") == 0) {
+ run_err("error: unexpected filename: %s", cp);
+ exit(1);
+ }
diff --git a/net-misc/openssh/files/openssh-7.9_p1-X509-11.6-tests.patch b/net-misc/openssh/files/openssh-7.9_p1-X509-11.6-tests.patch
new file mode 100644
index 0000000..9766b15
--- /dev/null
+++ b/net-misc/openssh/files/openssh-7.9_p1-X509-11.6-tests.patch
@@ -0,0 +1,12 @@
+diff -ur openssh-7.9p1.orig/openbsd-compat/regress/Makefile.in openssh-7.9p1/openbsd-compat/regress/Makefile.in
+--- openssh-7.9p1.orig/openbsd-compat/regress/Makefile.in 2018-10-16 17:01:20.000000000 -0700
++++ openssh-7.9p1/openbsd-compat/regress/Makefile.in 2018-12-19 11:03:14.421028691 -0800
+@@ -7,7 +7,7 @@
+ CC=@CC@
+ LD=@LD@
+ CFLAGS=@CFLAGS@
+-CPPFLAGS=-I. -I.. -I$(srcdir) -I$(srcdir)/.. @CPPFLAGS@ @DEFS@
++CPPFLAGS=-I. -I.. -I$(srcdir) -I../.. @CPPFLAGS@ @DEFS@
+ EXEEXT=@EXEEXT@
+ LIBCOMPAT=../libopenbsd-compat.a
+ LIBS=@LIBS@
diff --git a/net-misc/openssh/files/openssh-7.9_p1-X509-dont-make-piddir-11.6.patch b/net-misc/openssh/files/openssh-7.9_p1-X509-dont-make-piddir-11.6.patch
new file mode 100644
index 0000000..487b239
--- /dev/null
+++ b/net-misc/openssh/files/openssh-7.9_p1-X509-dont-make-piddir-11.6.patch
@@ -0,0 +1,16 @@
+--- a/openssh-7.9p1+x509-11.6.diff 2018-12-07 17:24:03.211328918 -0800
++++ b/openssh-7.9p1+x509-11.6.diff 2018-12-07 17:24:13.399262277 -0800
+@@ -40681,12 +40681,11 @@
+
+ install: $(CONFIGFILES) $(MANPAGES) $(TARGETS) install-files install-sysconf host-key check-config
+ install-nokeys: $(CONFIGFILES) $(MANPAGES) $(TARGETS) install-files install-sysconf
+-@@ -333,6 +351,8 @@
++@@ -333,6 +351,7 @@
+ $(MKDIR_P) $(DESTDIR)$(mandir)/$(mansubdir)5
+ $(MKDIR_P) $(DESTDIR)$(mandir)/$(mansubdir)8
+ $(MKDIR_P) $(DESTDIR)$(libexecdir)
+ + $(MKDIR_P) $(DESTDIR)$(sshcadir)
+-+ $(MKDIR_P) $(DESTDIR)$(piddir)
+ $(MKDIR_P) -m 0755 $(DESTDIR)$(PRIVSEP_PATH)
+ $(INSTALL) -m 0755 $(STRIP_OPT) ssh$(EXEEXT) $(DESTDIR)$(bindir)/ssh$(EXEEXT)
+ $(INSTALL) -m 0755 $(STRIP_OPT) scp$(EXEEXT) $(DESTDIR)$(bindir)/scp$(EXEEXT)
diff --git a/net-misc/openssh/files/openssh-7.9_p1-X509-glue-11.6.patch b/net-misc/openssh/files/openssh-7.9_p1-X509-glue-11.6.patch
new file mode 100644
index 0000000..b807ac4
--- /dev/null
+++ b/net-misc/openssh/files/openssh-7.9_p1-X509-glue-11.6.patch
@@ -0,0 +1,28 @@
+--- a/openssh-7.9p1+x509-11.6.diff 2018-12-19 10:42:01.241775036 -0800
++++ b/openssh-7.9p1+x509-11.6.diff 2018-12-19 10:43:33.383140818 -0800
+@@ -45862,7 +45862,7 @@
+ ENGINE_register_all_complete();
+ +#endif
+
+--#if OPENSSL_VERSION_NUMBER < 0x10001000L
++-#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ + /* OPENSSL_config will load buildin engines and engines
+ + * specified in configuration file, i.e. method call
+ + * ENGINE_load_builtin_engines. Latter is only for
+@@ -81123,16 +81123,6 @@
+ setlocale(LC_CTYPE, "POSIX.UTF-8") != NULL))
+ return;
+ setlocale(LC_CTYPE, "C");
+-diff -ruN openssh-7.9p1/version.h openssh-7.9p1+x509-11.6/version.h
+---- openssh-7.9p1/version.h 2018-10-17 03:01:20.000000000 +0300
+-+++ openssh-7.9p1+x509-11.6/version.h 2018-12-18 20:07:00.000000000 +0200
+-@@ -2,5 +2,4 @@
+-
+- #define SSH_VERSION "OpenSSH_7.9"
+-
+--#define SSH_PORTABLE "p1"
+--#define SSH_RELEASE SSH_VERSION SSH_PORTABLE
+-+#define SSH_RELEASE PACKAGE_STRING ", " SSH_VERSION "p1"
+ diff -ruN openssh-7.9p1/version.m4 openssh-7.9p1+x509-11.6/version.m4
+ --- openssh-7.9p1/version.m4 1970-01-01 02:00:00.000000000 +0200
+ +++ openssh-7.9p1+x509-11.6/version.m4 2018-12-18 20:07:00.000000000 +0200
diff --git a/net-misc/openssh/files/openssh-7.9_p1-hpn-X509-glue.patch b/net-misc/openssh/files/openssh-7.9_p1-hpn-X509-glue.patch
new file mode 100644
index 0000000..c76d454
--- /dev/null
+++ b/net-misc/openssh/files/openssh-7.9_p1-hpn-X509-glue.patch
@@ -0,0 +1,79 @@
+--- temp/openssh-7_8_P1-hpn-AES-CTR-14.16.diff.orig 2018-09-12 15:58:57.377986085 -0700
++++ temp/openssh-7_8_P1-hpn-AES-CTR-14.16.diff 2018-09-12 16:07:15.376711327 -0700
+@@ -4,8 +4,8 @@
+ +++ b/Makefile.in
+ @@ -42,7 +42,7 @@ CC=@CC@
+ LD=@LD@
+- CFLAGS=@CFLAGS@
+- CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ $(PATHS) @DEFS@
++ CFLAGS=@CFLAGS@ $(CFLAGS_EXTRA)
++ CPPFLAGS=-I. -I$(srcdir) @CPPFLAGS@ @LDAP_CPPFLAGS@ $(PATHS) @DEFS@
+ -LIBS=@LIBS@
+ +LIBS=@LIBS@ -lpthread
+ K5LIBS=@K5LIBS@
+@@ -788,8 +788,8 @@
+ ssh_packet_set_connection(struct ssh *ssh, int fd_in, int fd_out)
+ {
+ struct session_state *state;
+-- const struct sshcipher *none = cipher_by_name("none");
+-+ struct sshcipher *none = cipher_by_name("none");
++- const struct sshcipher *none = cipher_none();
+++ struct sshcipher *none = cipher_none();
+ int r;
+
+ if (none == NULL) {
+@@ -933,9 +933,9 @@
+ /* Portable-specific options */
+ sUsePAM,
+ + sDisableMTAES,
+- /* Standard Options */
+- sPort, sHostKeyFile, sLoginGraceTime,
+- sPermitRootLogin, sLogFacility, sLogLevel,
++ /* X.509 Standard Options */
++ sHostbasedAlgorithms,
++ sPubkeyAlgorithms,
+ @@ -626,6 +630,7 @@ static struct {
+ { "trustedusercakeys", sTrustedUserCAKeys, SSHCFG_ALL },
+ { "authorizedprincipalsfile", sAuthorizedPrincipalsFile, SSHCFG_ALL },
+--- temp/openssh-7_8_P1-hpn-DynWinNoneSwitch-14.16.diff.orig 2018-09-12 16:38:16.947447218 -0700
++++ temp/openssh-7_8_P1-hpn-DynWinNoneSwitch-14.16.diff 2018-09-12 16:32:35.479700864 -0700
+@@ -382,7 +382,7 @@
+ @@ -822,6 +822,10 @@ kex_choose_conf(struct ssh *ssh)
+ int nenc, nmac, ncomp;
+ u_int mode, ctos, need, dh_need, authlen;
+- int r, first_kex_follows;
++ int r, first_kex_follows = 0;
+ + int auth_flag;
+ +
+ + auth_flag = packet_authentication_state(ssh);
+@@ -1125,15 +1125,6 @@
+ index a738c3a..b32dbe0 100644
+ --- a/sshd.c
+ +++ b/sshd.c
+-@@ -373,7 +373,7 @@ sshd_exchange_identification(struct ssh *ssh, int sock_in, int sock_out)
+- char remote_version[256]; /* Must be at least as big as buf. */
+-
+- xasprintf(&server_version_string, "SSH-%d.%d-%.100s%s%s\r\n",
+-- PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION,
+-+ PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE,
+- *options.version_addendum == '\0' ? "" : " ",
+- options.version_addendum);
+-
+ @@ -1037,6 +1037,8 @@ listen_on_addrs(struct listenaddr *la)
+ int ret, listen_sock;
+ struct addrinfo *ai;
+@@ -1213,14 +1204,3 @@
+ # Example of overriding settings on a per-user basis
+ #Match User anoncvs
+ # X11Forwarding no
+-diff --git a/version.h b/version.h
+-index f1bbf00..21a70c2 100644
+---- a/version.h
+-+++ b/version.h
+-@@ -3,4 +3,5 @@
+- #define SSH_VERSION "OpenSSH_7.8"
+-
+- #define SSH_PORTABLE "p1"
+--#define SSH_RELEASE SSH_VERSION SSH_PORTABLE
+-+#define SSH_RELEASE SSH_VERSION SSH_PORTABLE SSH_HPN
+-+
diff --git a/net-misc/openssh/files/openssh-7.9_p1-hpn-glue.patch b/net-misc/openssh/files/openssh-7.9_p1-hpn-glue.patch
new file mode 100644
index 0000000..0561e38
--- /dev/null
+++ b/net-misc/openssh/files/openssh-7.9_p1-hpn-glue.patch
@@ -0,0 +1,112 @@
+--- temp/openssh-7_8_P1-hpn-DynWinNoneSwitch-14.16.diff.orig 2018-09-11 17:19:19.968420409 -0700
++++ temp/openssh-7_8_P1-hpn-DynWinNoneSwitch-14.16.diff 2018-09-11 17:39:19.977535398 -0700
+@@ -409,18 +409,10 @@
+ index dcf35e6..da4ced0 100644
+ --- a/packet.c
+ +++ b/packet.c
+-@@ -920,6 +920,24 @@ ssh_set_newkeys(struct ssh *ssh, int mode)
++@@ -920,6 +920,16 @@ ssh_set_newkeys(struct ssh *ssh, int mode)
+ return 0;
+ }
+
+-+/* this supports the forced rekeying required for the NONE cipher */
+-+int rekey_requested = 0;
+-+void
+-+packet_request_rekeying(void)
+-+{
+-+ rekey_requested = 1;
+-+}
+-+
+ +/* used to determine if pre or post auth when rekeying for aes-ctr
+ + * and none cipher switch */
+ +int
+@@ -434,20 +426,6 @@
+ #define MAX_PACKETS (1U<<31)
+ static int
+ ssh_packet_need_rekeying(struct ssh *ssh, u_int outbound_packet_len)
+-@@ -946,6 +964,13 @@ ssh_packet_need_rekeying(struct ssh *ssh, u_int outbound_packet_len)
+- if (state->p_send.packets == 0 && state->p_read.packets == 0)
+- return 0;
+-
+-+ /* used to force rekeying when called for by the none
+-+ * cipher switch methods -cjr */
+-+ if (rekey_requested == 1) {
+-+ rekey_requested = 0;
+-+ return 1;
+-+ }
+-+
+- /* Time-based rekeying */
+- if (state->rekey_interval != 0 &&
+- (int64_t)state->rekey_time + state->rekey_interval <= monotime())
+ diff --git a/packet.h b/packet.h
+ index 170203c..f4d9df2 100644
+ --- a/packet.h
+@@ -476,9 +454,9 @@
+ /* Format of the configuration file:
+
+ @@ -166,6 +167,8 @@ typedef enum {
+- oHashKnownHosts,
+ oTunnel, oTunnelDevice,
+ oLocalCommand, oPermitLocalCommand, oRemoteCommand,
++ oDisableMTAES,
+ + oTcpRcvBufPoll, oTcpRcvBuf, oHPNDisabled, oHPNBufferSize,
+ + oNoneEnabled, oNoneSwitch,
+ oVisualHostKey,
+@@ -615,9 +593,9 @@
+ int ip_qos_bulk; /* IP ToS/DSCP/class for bulk traffic */
+ SyslogFacility log_facility; /* Facility for system logging. */
+ @@ -111,7 +115,10 @@ typedef struct {
+-
+ int enable_ssh_keysign;
+ int64_t rekey_limit;
++ int disable_multithreaded; /*disable multithreaded aes-ctr*/
+ + int none_switch; /* Use none cipher */
+ + int none_enabled; /* Allow none to be used */
+ int rekey_interval;
+@@ -673,9 +651,9 @@
+ /* Portable-specific options */
+ if (options->use_pam == -1)
+ @@ -391,6 +400,43 @@ fill_default_server_options(ServerOptions *options)
+- }
+- if (options->permit_tun == -1)
+ options->permit_tun = SSH_TUNMODE_NO;
++ if (options->disable_multithreaded == -1)
++ options->disable_multithreaded = 0;
+ + if (options->none_enabled == -1)
+ + options->none_enabled = 0;
+ + if (options->hpn_disabled == -1)
+@@ -1092,7 +1070,7 @@
+ xxx_host = host;
+ xxx_hostaddr = hostaddr;
+
+-@@ -412,6 +423,28 @@ ssh_userauth2(const char *local_user, const char *server_user, char *host,
++@@ -412,6 +423,27 @@ ssh_userauth2(const char *local_user, const char *server_user, char *host,
+
+ if (!authctxt.success)
+ fatal("Authentication failed.");
+@@ -1117,10 +1095,9 @@
+ + fprintf(stderr, "NONE cipher switch disabled when a TTY is allocated\n");
+ + }
+ + }
+-+
+- debug("Authentication succeeded (%s).", authctxt.method->name);
+- }
+
++ #ifdef WITH_OPENSSL
++ if (options.disable_multithreaded == 0) {
+ diff --git a/sshd.c b/sshd.c
+ index a738c3a..b32dbe0 100644
+ --- a/sshd.c
+@@ -1217,11 +1194,10 @@
+ index f1bbf00..21a70c2 100644
+ --- a/version.h
+ +++ b/version.h
+-@@ -3,4 +3,6 @@
++@@ -3,4 +3,5 @@
+ #define SSH_VERSION "OpenSSH_7.8"
+
+ #define SSH_PORTABLE "p1"
+ -#define SSH_RELEASE SSH_VERSION SSH_PORTABLE
+-+#define SSH_HPN "-hpn14v16"
+ +#define SSH_RELEASE SSH_VERSION SSH_PORTABLE SSH_HPN
+ +
diff --git a/net-misc/openssh/files/openssh-7.9_p1-hpn-openssl-1.1.patch b/net-misc/openssh/files/openssh-7.9_p1-hpn-openssl-1.1.patch
new file mode 100644
index 0000000..78b7545
--- /dev/null
+++ b/net-misc/openssh/files/openssh-7.9_p1-hpn-openssl-1.1.patch
@@ -0,0 +1,91 @@
+--- openssh-7.9p1.orig/cipher-ctr-mt.c 2018-10-24 20:48:00.909255466 -0000
++++ openssh-7.9p1/cipher-ctr-mt.c 2018-10-24 20:48:17.378155144 -0000
+@@ -46,7 +46,7 @@
+
+ /*-------------------- TUNABLES --------------------*/
+ /* maximum number of threads and queues */
+-#define MAX_THREADS 32
++#define MAX_THREADS 32
+ #define MAX_NUMKQ (MAX_THREADS * 2)
+
+ /* Number of pregen threads to use */
+@@ -435,7 +435,7 @@
+ destp.u += AES_BLOCK_SIZE;
+ srcp.u += AES_BLOCK_SIZE;
+ len -= AES_BLOCK_SIZE;
+- ssh_ctr_inc(ctx->iv, AES_BLOCK_SIZE);
++ ssh_ctr_inc(c->aes_counter, AES_BLOCK_SIZE);
+
+ /* Increment read index, switch queues on rollover */
+ if ((ridx = (ridx + 1) % KQLEN) == 0) {
+@@ -481,8 +481,6 @@
+ /* get the number of cores in the system */
+ /* if it's not linux it currently defaults to 2 */
+ /* divide by 2 to get threads for each direction (MODE_IN||MODE_OUT) */
+- /* NB: assigning a float to an int discards the remainder which is */
+- /* acceptable (and wanted) in this case */
+ #ifdef __linux__
+ cipher_threads = sysconf(_SC_NPROCESSORS_ONLN) / 2;
+ #endif /*__linux__*/
+@@ -551,16 +550,16 @@
+ }
+
+ if (iv != NULL) {
+- memcpy(ctx->iv, iv, AES_BLOCK_SIZE);
++ memcpy(c->aes_counter, iv, AES_BLOCK_SIZE);
+ c->state |= HAVE_IV;
+ }
+
+ if (c->state == (HAVE_KEY | HAVE_IV)) {
+ /* Clear queues */
+- memcpy(c->q[0].ctr, ctx->iv, AES_BLOCK_SIZE);
++ memcpy(c->q[0].ctr, c->aes_counter, AES_BLOCK_SIZE);
+ c->q[0].qstate = KQINIT;
+ for (i = 1; i < numkq; i++) {
+- memcpy(c->q[i].ctr, ctx->iv, AES_BLOCK_SIZE);
++ memcpy(c->q[i].ctr, c->aes_counter, AES_BLOCK_SIZE);
+ ssh_ctr_add(c->q[i].ctr, i * KQLEN, AES_BLOCK_SIZE);
+ c->q[i].qstate = KQEMPTY;
+ }
+@@ -644,8 +643,22 @@
+ const EVP_CIPHER *
+ evp_aes_ctr_mt(void)
+ {
++# if OPENSSL_VERSION_NUMBER >= 0x10100000UL && !defined(LIBRESSL_VERSION_NUMBER)
++ static EVP_CIPHER *aes_ctr;
++ aes_ctr = EVP_CIPHER_meth_new(NID_undef, 16/*block*/, 16/*key*/);
++ EVP_CIPHER_meth_set_iv_length(aes_ctr, AES_BLOCK_SIZE);
++ EVP_CIPHER_meth_set_init(aes_ctr, ssh_aes_ctr_init);
++ EVP_CIPHER_meth_set_cleanup(aes_ctr, ssh_aes_ctr_cleanup);
++ EVP_CIPHER_meth_set_do_cipher(aes_ctr, ssh_aes_ctr);
++# ifndef SSH_OLD_EVP
++ EVP_CIPHER_meth_set_flags(aes_ctr, EVP_CIPH_CBC_MODE
++ | EVP_CIPH_VARIABLE_LENGTH
++ | EVP_CIPH_ALWAYS_CALL_INIT
++ | EVP_CIPH_CUSTOM_IV);
++# endif /*SSH_OLD_EVP*/
++ return (aes_ctr);
++# else /*earlier version of openssl*/
+ static EVP_CIPHER aes_ctr;
+-
+ memset(&aes_ctr, 0, sizeof(EVP_CIPHER));
+ aes_ctr.nid = NID_undef;
+ aes_ctr.block_size = AES_BLOCK_SIZE;
+@@ -654,11 +667,12 @@
+ aes_ctr.init = ssh_aes_ctr_init;
+ aes_ctr.cleanup = ssh_aes_ctr_cleanup;
+ aes_ctr.do_cipher = ssh_aes_ctr;
+-#ifndef SSH_OLD_EVP
+- aes_ctr.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH |
+- EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CUSTOM_IV;
+-#endif
+- return &aes_ctr;
++# ifndef SSH_OLD_EVP
++ aes_ctr.flags = EVP_CIPH_CBC_MODE | EVP_CIPH_VARIABLE_LENGTH |
++ EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CUSTOM_IV;
++# endif /*SSH_OLD_EVP*/
++ return &aes_ctr;
++# endif /*OPENSSH_VERSION_NUMBER*/
+ }
+
+ #endif /* defined(WITH_OPENSSL) */
diff --git a/net-misc/openssh/files/openssh-7.9_p1-hpn-sctp-glue.patch b/net-misc/openssh/files/openssh-7.9_p1-hpn-sctp-glue.patch
new file mode 100644
index 0000000..a7d51ad
--- /dev/null
+++ b/net-misc/openssh/files/openssh-7.9_p1-hpn-sctp-glue.patch
@@ -0,0 +1,17 @@
+--- dd/openssh-7_8_P1-hpn-DynWinNoneSwitch-14.16.diff.orig 2018-09-12 18:18:51.851536374 -0700
++++ dd/openssh-7_8_P1-hpn-DynWinNoneSwitch-14.16.diff 2018-09-12 18:19:01.116475099 -0700
+@@ -1190,14 +1190,3 @@
+ # Example of overriding settings on a per-user basis
+ #Match User anoncvs
+ # X11Forwarding no
+-diff --git a/version.h b/version.h
+-index f1bbf00..21a70c2 100644
+---- a/version.h
+-+++ b/version.h
+-@@ -3,4 +3,5 @@
+- #define SSH_VERSION "OpenSSH_7.8"
+-
+- #define SSH_PORTABLE "p1"
+--#define SSH_RELEASE SSH_VERSION SSH_PORTABLE
+-+#define SSH_RELEASE SSH_VERSION SSH_PORTABLE SSH_HPN
+-+
diff --git a/net-misc/openssh/files/openssh-7.9_p1-include-stdlib.patch b/net-misc/openssh/files/openssh-7.9_p1-include-stdlib.patch
new file mode 100644
index 0000000..c5697c2
--- /dev/null
+++ b/net-misc/openssh/files/openssh-7.9_p1-include-stdlib.patch
@@ -0,0 +1,48 @@
+diff --git a/auth-options.c b/auth-options.c
+index b05d6d6f..d1f42f04 100644
+--- a/auth-options.c
++++ b/auth-options.c
+@@ -26,6 +26,7 @@
+ #include <stdarg.h>
+ #include <ctype.h>
+ #include <limits.h>
++#include <stdlib.h>
+
+ #include "openbsd-compat/sys-queue.h"
+
+diff --git a/hmac.c b/hmac.c
+index 1c879640..a29f32c5 100644
+--- a/hmac.c
++++ b/hmac.c
+@@ -19,6 +19,7 @@
+
+ #include <sys/types.h>
+ #include <string.h>
++#include <stdlib.h>
+
+ #include "sshbuf.h"
+ #include "digest.h"
+diff --git a/krl.c b/krl.c
+index 8e2d5d5d..c32e147a 100644
+--- a/krl.c
++++ b/krl.c
+@@ -28,6 +28,7 @@
+ #include <string.h>
+ #include <time.h>
+ #include <unistd.h>
++#include <stdlib.h>
+
+ #include "sshbuf.h"
+ #include "ssherr.h"
+diff --git a/mac.c b/mac.c
+index 51dc11d7..3d11eba6 100644
+--- a/mac.c
++++ b/mac.c
+@@ -29,6 +29,7 @@
+
+ #include <string.h>
+ #include <stdio.h>
++#include <stdlib.h>
+
+ #include "digest.h"
+ #include "hmac.h"
diff --git a/net-misc/openssh/files/openssh-7.9_p1-openssl-1.0.2-compat.patch b/net-misc/openssh/files/openssh-7.9_p1-openssl-1.0.2-compat.patch
new file mode 100644
index 0000000..c1c310e
--- /dev/null
+++ b/net-misc/openssh/files/openssh-7.9_p1-openssl-1.0.2-compat.patch
@@ -0,0 +1,13 @@
+diff --git a/openbsd-compat/openssl-compat.c b/openbsd-compat/openssl-compat.c
+index 8b4a3627..590b66d1 100644
+--- a/openbsd-compat/openssl-compat.c
++++ b/openbsd-compat/openssl-compat.c
+@@ -76,7 +76,7 @@ ssh_OpenSSL_add_all_algorithms(void)
+ ENGINE_load_builtin_engines();
+ ENGINE_register_all_complete();
+
+-#if OPENSSL_VERSION_NUMBER < 0x10001000L
++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
+ OPENSSL_config(NULL);
+ #else
+ OPENSSL_init_crypto(OPENSSL_INIT_ADD_ALL_CIPHERS |
diff --git a/net-misc/openssh/files/sshd-r1.confd b/net-misc/openssh/files/sshd-r1.confd
new file mode 100644
index 0000000..cf43037
--- /dev/null
+++ b/net-misc/openssh/files/sshd-r1.confd
@@ -0,0 +1,33 @@
+# /etc/conf.d/sshd: config file for /etc/init.d/sshd
+
+# Where is your sshd_config file stored?
+
+SSHD_CONFDIR="${RC_PREFIX%/}/etc/ssh"
+
+
+# Any random options you want to pass to sshd.
+# See the sshd(8) manpage for more info.
+
+SSHD_OPTS=""
+
+
+# Wait one second (length chosen arbitrarily) to see if sshd actually
+# creates a PID file, or if it crashes for some reason like not being
+# able to bind to the address in ListenAddress.
+
+#SSHD_SSD_OPTS="--wait 1000"
+
+
+# Pid file to use (needs to be absolute path).
+
+#SSHD_PIDFILE="${RC_PREFIX%/}/run/sshd.pid"
+
+
+# Path to the sshd binary (needs to be absolute path).
+
+#SSHD_BINARY="${RC_PREFIX%/}/usr/sbin/sshd"
+
+
+# Path to the ssh-keygen binary (needs to be absolute path).
+
+#SSHD_KEYGEN_BINARY="${RC_PREFIX%/}/usr/bin/ssh-keygen"
diff --git a/net-misc/openssh/files/sshd-r1.initd b/net-misc/openssh/files/sshd-r1.initd
new file mode 100644
index 0000000..e91cd01
--- /dev/null
+++ b/net-misc/openssh/files/sshd-r1.initd
@@ -0,0 +1,87 @@
+#!/sbin/openrc-run
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+extra_commands="checkconfig"
+extra_started_commands="reload"
+
+: ${SSHD_CONFDIR:=${RC_PREFIX%/}/etc/ssh}
+: ${SSHD_CONFIG:=${SSHD_CONFDIR}/sshd_config}
+: ${SSHD_PIDFILE:=${RC_PREFIX%/}/run/${SVCNAME}.pid}
+: ${SSHD_BINARY:=${RC_PREFIX%/}/usr/sbin/sshd}
+: ${SSHD_KEYGEN_BINARY:=${RC_PREFIX%/}/usr/bin/ssh-keygen}
+
+command="${SSHD_BINARY}"
+pidfile="${SSHD_PIDFILE}"
+command_args="${SSHD_OPTS} -o PidFile=${pidfile} -f ${SSHD_CONFIG}"
+
+# Wait one second (length chosen arbitrarily) to see if sshd actually
+# creates a PID file, or if it crashes for some reason like not being
+# able to bind to the address in ListenAddress (bug 617596).
+: ${SSHD_SSD_OPTS:=--wait 1000}
+start_stop_daemon_args="${SSHD_SSD_OPTS}"
+
+depend() {
+ # Entropy can be used by ssh-keygen, among other things, but
+ # is not strictly required (bug 470020).
+ use logger dns entropy
+ if [ "${rc_need+set}" = "set" ] ; then
+ : # Do nothing, the user has explicitly set rc_need
+ else
+ local x warn_addr
+ for x in $(awk '/^ListenAddress/{ print $2 }' "$SSHD_CONFIG" 2>/dev/null) ; do
+ case "${x}" in
+ 0.0.0.0|0.0.0.0:*) ;;
+ ::|\[::\]*) ;;
+ *) warn_addr="${warn_addr} ${x}" ;;
+ esac
+ done
+ if [ -n "${warn_addr}" ] ; then
+ need net
+ ewarn "You are binding an interface in ListenAddress statement in your sshd_config!"
+ ewarn "You must add rc_need=\"net.FOO\" to your ${RC_PREFIX%/}/etc/conf.d/sshd"
+ ewarn "where FOO is the interface(s) providing the following address(es):"
+ ewarn "${warn_addr}"
+ fi
+ fi
+}
+
+checkconfig() {
+ checkpath --mode 0755 --directory "${RC_PREFIX%/}/var/empty"
+
+ if [ ! -e "${SSHD_CONFIG}" ] ; then
+ eerror "You need an ${SSHD_CONFIG} file to run sshd"
+ eerror "There is a sample file in /usr/share/doc/openssh"
+ return 1
+ fi
+
+ ${SSHD_KEYGEN_BINARY} -A || return 2
+
+ "${command}" -t ${command_args} || return 3
+}
+
+start_pre() {
+ # Make sure that the user's config isn't busted before we try
+ # to start the daemon (this will produce better error messages
+ # than if we just try to start it blindly).
+ #
+ # We always need to call checkconfig because this function will
+ # also generate any missing host key and you can start a
+ # non-running service with "restart" argument.
+ checkconfig || return $?
+}
+
+stop_pre() {
+ # If this is a restart, check to make sure the user's config
+ # isn't busted before we stop the running daemon.
+ if [ "${RC_CMD}" = "restart" ] ; then
+ checkconfig || return $?
+ fi
+}
+
+reload() {
+ checkconfig || return $?
+ ebegin "Reloading ${SVCNAME}"
+ start-stop-daemon --signal HUP --pidfile "${pidfile}"
+ eend $?
+}
diff --git a/net-misc/openssh/files/sshd.initd b/net-misc/openssh/files/sshd.initd
new file mode 100644
index 0000000..c5df469
--- /dev/null
+++ b/net-misc/openssh/files/sshd.initd
@@ -0,0 +1,89 @@
+#!/sbin/openrc-run
+# Copyright 1999-2018 Gentoo Foundation
+# Distributed under the terms of the GNU General Public License v2
+
+extra_commands="checkconfig"
+extra_started_commands="reload"
+
+: ${SSHD_CONFDIR:=${RC_PREFIX%/}/etc/ssh}
+: ${SSHD_CONFIG:=${SSHD_CONFDIR}/sshd_config}
+: ${SSHD_PIDFILE:=${RC_PREFIX%/}/run/${SVCNAME}.pid}
+: ${SSHD_BINARY:=${RC_PREFIX%/}/usr/sbin/sshd}
+: ${SSHD_KEYGEN_BINARY:=${RC_PREFIX%/}/usr/bin/ssh-keygen}
+
+command="${SSHD_BINARY}"
+pidfile="${SSHD_PIDFILE}"
+command_args="${SSHD_OPTS} -o PidFile=${pidfile} -f ${SSHD_CONFIG}"
+
+# Wait one second (length chosen arbitrarily) to see if sshd actually
+# creates a PID file, or if it crashes for some reason like not being
+# able to bind to the address in ListenAddress (bug 617596).
+: ${SSHD_SSD_OPTS:=--wait 1000}
+start_stop_daemon_args="${SSHD_SSD_OPTS}"
+
+depend() {
+ # Entropy can be used by ssh-keygen, among other things, but
+ # is not strictly required (bug 470020).
+ use logger dns entropy
+ if [ "${rc_need+set}" = "set" ] ; then
+ : # Do nothing, the user has explicitly set rc_need
+ else
+ local x warn_addr
+ for x in $(awk '/^ListenAddress/{ print $2 }' "$SSHD_CONFIG" 2>/dev/null) ; do
+ case "${x}" in
+ 0.0.0.0|0.0.0.0:*) ;;
+ ::|\[::\]*) ;;
+ *) warn_addr="${warn_addr} ${x}" ;;
+ esac
+ done
+ if [ -n "${warn_addr}" ] ; then
+ need net
+ ewarn "You are binding an interface in ListenAddress statement in your sshd_config!"
+ ewarn "You must add rc_need=\"net.FOO\" to your ${RC_PREFIX%/}/etc/conf.d/sshd"
+ ewarn "where FOO is the interface(s) providing the following address(es):"
+ ewarn "${warn_addr}"
+ fi
+ fi
+}
+
+checkconfig() {
+ checkpath --mode 0755 --directory "${RC_PREFIX%/}/var/empty"
+
+ if [ ! -e "${SSHD_CONFIG}" ] ; then
+ eerror "You need an ${SSHD_CONFIG} file to run sshd"
+ eerror "There is a sample file in /usr/share/doc/openssh"
+ return 1
+ fi
+
+ ${SSHD_KEYGEN_BINARY} -A || return 2
+
+ "${command}" -t ${command_args} || return 3
+}
+
+start_pre() {
+ # If this isn't a restart, make sure that the user's config isn't
+ # busted before we try to start the daemon (this will produce
+ # better error messages than if we just try to start it blindly).
+ #
+ # If, on the other hand, this *is* a restart, then the stop_pre
+ # action will have ensured that the config is usable and we don't
+ # need to do that again.
+ if [ "${RC_CMD}" != "restart" ] ; then
+ checkconfig || return $?
+ fi
+}
+
+stop_pre() {
+ # If this is a restart, check to make sure the user's config
+ # isn't busted before we stop the running daemon.
+ if [ "${RC_CMD}" = "restart" ] ; then
+ checkconfig || return $?
+ fi
+}
+
+reload() {
+ checkconfig || return $?
+ ebegin "Reloading ${SVCNAME}"
+ start-stop-daemon --signal HUP --pidfile "${pidfile}"
+ eend $?
+}
diff --git a/net-misc/openssh/openssh-7.5_p1-r1.ebuild b/net-misc/openssh/openssh-7.5_p1-r1.ebuild
deleted file mode 100644
index 928141a..0000000
--- a/net-misc/openssh/openssh-7.5_p1-r1.ebuild
+++ /dev/null
@@ -1,332 +0,0 @@
-# Copyright 1999-2017 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI="5"
-
-inherit eutils user flag-o-matic multilib autotools pam systemd versionator
-
-# Make it more portable between straight releases
-# and _p? releases.
-PARCH=${P/_}
-
-HPN_PATCH="${PARCH}-hpnssh14v12.tar.xz"
-SCTP_PATCH="${PN}-7.4_p1-sctp.patch.xz"
-LDAP_PATCH="${PN}-lpk-7.5p1-0.3.14.patch.xz"
-X509_VER="10.1" X509_PATCH="${PN}-${PV/_}+x509-${X509_VER}.diff.gz"
-
-DESCRIPTION="Port of OpenBSD's free SSH release"
-HOMEPAGE="http://www.openssh.org/"
-SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
- ${SCTP_PATCH:+mirror://gentoo/${SCTP_PATCH}}
- ${HPN_PATCH:+hpn? ( mirror://gentoo/${HPN_PATCH} )}
- ${LDAP_PATCH:+ldap? ( mirror://gentoo/${LDAP_PATCH} )}
- ${X509_PATCH:+X509? ( http://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
- "
-
-LICENSE="BSD GPL-2"
-SLOT="0"
-KEYWORDS="*"
-# Probably want to drop ssl defaulting to on in a future version.
-IUSE="abi_mips_n32 audit bindist debug ${HPN_PATCH:++}hpn kerberos kernel_linux ldap ldns libedit libressl livecd pam +pie sctp selinux skey ssh1 +ssl static test X X509"
-REQUIRED_USE="ldns? ( ssl )
- pie? ( !static )
- ssh1? ( ssl )
- static? ( !kerberos !pam )
- X509? ( !ldap !sctp ssl )
- test? ( ssl )"
-
-LIB_DEPEND="
- audit? ( sys-process/audit[static-libs(+)] )
- ldns? (
- net-libs/ldns[static-libs(+)]
- !bindist? ( net-libs/ldns[ecdsa,ssl] )
- bindist? ( net-libs/ldns[-ecdsa,ssl] )
- )
- libedit? ( dev-libs/libedit:=[static-libs(+)] )
- sctp? ( net-misc/lksctp-tools[static-libs(+)] )
- selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
- skey? ( >=sys-auth/skey-1.1.5-r1[static-libs(+)] )
- ssl? (
- !libressl? (
- >=dev-libs/openssl-1.0.1:0=[bindist=]
- dev-libs/openssl:0=[static-libs(+)]
- )
- libressl? ( dev-libs/libressl:0=[static-libs(+)] )
- )
- >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
-RDEPEND="
- !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
- pam? ( virtual/pam )
- kerberos? ( virtual/krb5 )
- ldap? ( net-nds/openldap )"
-DEPEND="${RDEPEND}
- static? ( ${LIB_DEPEND} )
- virtual/pkgconfig
- virtual/os-headers
- sys-devel/autoconf"
-RDEPEND="${RDEPEND}
- pam? ( >=sys-auth/pambase-20081028 )
- userland_GNU? ( virtual/shadow )
- X? ( x11-apps/xauth )"
-
-S=${WORKDIR}/${PARCH}
-
-pkg_pretend() {
- # this sucks, but i'd rather have people unable to `emerge -u openssh`
- # than not be able to log in to their server any more
- maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
- local fail="
- $(use X509 && maybe_fail X509 X509_PATCH)
- $(use ldap && maybe_fail ldap LDAP_PATCH)
- $(use hpn && maybe_fail hpn HPN_PATCH)
- "
- fail=$(echo ${fail})
- if [[ -n ${fail} ]] ; then
- eerror "Sorry, but this version does not yet support features"
- eerror "that you requested: ${fail}"
- eerror "Please mask ${PF} for now and check back later:"
- eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
- die "booooo"
- fi
-
- # Make sure people who are using tcp wrappers are notified of its removal. #531156
- if grep -qs '^ *sshd *:' "${EROOT}"/etc/hosts.{allow,deny} ; then
- ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
- ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
- fi
-}
-
-save_version() {
- # version.h patch conflict avoidence
- mv version.h version.h.$1
- cp -f version.h.pristine version.h
-}
-
-src_prepare() {
- sed -i \
- -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX}/usr/bin/xauth:" \
- pathnames.h || die
- # keep this as we need it to avoid the conflict between LPK and HPN changing
- # this file.
- cp version.h version.h.pristine
-
- # don't break .ssh/authorized_keys2 for fun
- sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
-
- if use X509 ; then
- if use hpn ; then
- pushd "${WORKDIR}"/${HPN_PATCH%.*.*} >/dev/null
- epatch "${FILESDIR}"/${P}-hpn-x509-${X509_VER}-glue.patch
- popd >/dev/null
- fi
- save_version X509
- epatch "${WORKDIR}"/${X509_PATCH%.*}
- use libressl && epatch "${FILESDIR}"/${PN}-7.5p1-x509-libressl.patch
- fi
-
- if use ldap ; then
- epatch "${WORKDIR}"/${LDAP_PATCH%.*}
- save_version LPK
- fi
-
- epatch "${FILESDIR}"/${PN}-7.5_p1-GSSAPI-dns.patch #165444 integrated into gsskex
- epatch "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
- epatch "${FILESDIR}"/${PN}-7.5_p1-cross-cache.patch
- use X509 || epatch "${WORKDIR}"/${SCTP_PATCH%.*}
- use X509 || epatch "${FILESDIR}"/${PN}-7.5_p1-x32-typo.patch
- use abi_mips_n32 && epatch "${FILESDIR}"/${PN}-7.3-mips-seccomp-n32.patch
-
- if use hpn ; then
- EPATCH_FORCE="yes" EPATCH_SUFFIX="patch" \
- EPATCH_MULTI_MSG="Applying HPN patchset ..." \
- epatch "${WORKDIR}"/${HPN_PATCH%.*.*}
- save_version HPN
- fi
-
- tc-export PKG_CONFIG
- local sed_args=(
- -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
- # Disable PATH reset, trust what portage gives us #254615
- -e 's:^PATH=/:#PATH=/:'
- # Disable fortify flags ... our gcc does this for us
- -e 's:-D_FORTIFY_SOURCE=2::'
- )
- # The -ftrapv flag ICEs on hppa #505182
- use hppa && sed_args+=(
- -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
- -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
- )
- # _XOPEN_SOURCE causes header conflicts on Solaris
- [[ ${CHOST} == *-solaris* ]] && sed_args+=(
- -e 's/-D_XOPEN_SOURCE//'
- )
- sed -i "${sed_args[@]}" configure{.ac,} || die
-
- epatch_user #473004
-
- # Now we can build a sane merged version.h
- (
- sed '/^#define SSH_RELEASE/d' version.h.* | sort -u
- macros=()
- for p in HPN LPK X509 ; do [[ -e version.h.${p} ]] && macros+=( SSH_${p} ) ; done
- printf '#define SSH_RELEASE SSH_VERSION SSH_PORTABLE %s\n' "${macros}"
- ) > version.h
-
- eautoreconf
-}
-
-src_configure() {
- addwrite /dev/ptmx
-
- use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
- use static && append-ldflags -static
-
- local myconf=(
- --with-ldflags="${LDFLAGS}"
- --disable-strip
- --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
- --sysconfdir="${EPREFIX}"/etc/ssh
- --libexecdir="${EPREFIX}"/usr/$(get_libdir)/misc
- --datadir="${EPREFIX}"/usr/share/openssh
- --with-privsep-path="${EPREFIX}"/var/empty
- --with-privsep-user=sshd
- $(use_with audit audit linux)
- $(use_with kerberos kerberos5 "${EPREFIX}"/usr)
- # We apply the ldap patch conditionally, so can't pass --without-ldap
- # unconditionally else we get unknown flag warnings.
- $(use ldap && use_with ldap)
- $(use_with ldns)
- $(use_with libedit)
- $(use_with pam)
- $(use_with pie)
- $(use X509 || use_with sctp)
- $(use_with selinux)
- $(use_with skey)
- $(use_with ssh1)
- $(use_with ssl openssl)
- $(use_with ssl md5-passwords)
- $(use_with ssl ssl-engine)
- )
-
- # The seccomp sandbox is broken on x32, so use the older method for now. #553748
- use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
-
- econf "${myconf[@]}"
-}
-
-src_install() {
- emake install-nokeys DESTDIR="${D}"
- fperms 600 /etc/ssh/sshd_config
- dobin contrib/ssh-copy-id
- newinitd "${FILESDIR}"/sshd.rc6.4 sshd
- newconfd "${FILESDIR}"/sshd.confd sshd
-
- newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
- if use pam ; then
- sed -i \
- -e "/^#UsePAM /s:.*:UsePAM yes:" \
- -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
- -e "/^#PrintMotd /s:.*:PrintMotd no:" \
- -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- # Gentoo tweaks to default config files
- cat <<-EOF >> "${ED}"/etc/ssh/sshd_config
-
- # Allow client to pass locale environment variables #367017
- AcceptEnv LANG LC_*
- EOF
- cat <<-EOF >> "${ED}"/etc/ssh/ssh_config
-
- # Send locale environment variables #367017
- SendEnv LANG LC_*
- EOF
-
- if use livecd ; then
- sed -i \
- -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
- "${ED}"/etc/ssh/sshd_config || die
- fi
-
- if ! use X509 && [[ -n ${LDAP_PATCH} ]] && use ldap ; then
- insinto /etc/openldap/schema/
- newins openssh-lpk_openldap.schema openssh-lpk.schema
- fi
-
- doman contrib/ssh-copy-id.1
- dodoc CREDITS OVERVIEW README* TODO sshd_config
- use X509 || dodoc ChangeLog
-
- diropts -m 0700
- dodir /etc/skel/.ssh
-
- systemd_dounit "${FILESDIR}"/sshd.{service,socket}
- systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
-}
-
-src_test() {
- local t skipped=() failed=() passed=()
- local tests=( interop-tests compat-tests )
-
- local shell=$(egetshell "${UID}")
- if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
- elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
- elog "user, so we will run a subset only."
- skipped+=( tests )
- else
- tests+=( tests )
- fi
-
- # It will also attempt to write to the homedir .ssh.
- local sshhome=${T}/homedir
- mkdir -p "${sshhome}"/.ssh
- for t in "${tests[@]}" ; do
- # Some tests read from stdin ...
- HOMEDIR="${sshhome}" HOME="${sshhome}" \
- emake -k -j1 ${t} </dev/null \
- && passed+=( "${t}" ) \
- || failed+=( "${t}" )
- done
-
- einfo "Passed tests: ${passed[*]}"
- [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
- [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
-}
-
-pkg_preinst() {
- enewgroup sshd 22
- enewuser sshd 22 -1 /var/empty sshd
-}
-
-pkg_postinst() {
- if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
- elog "Starting with openssh-5.8p1, the server will default to a newer key"
- elog "algorithm (ECDSA). You are encouraged to manually update your stored"
- elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
- fi
- if has_version "<${CATEGORY}/${PN}-6.9_p1" ; then
- elog "Starting with openssh-6.9p1, ssh1 support is disabled by default."
- fi
- if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
- elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
- elog "Make sure to update any configs that you might have. Note that xinetd might"
- elog "be an alternative for you as it supports USE=tcpd."
- fi
- if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
- elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
- elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
- elog "adding to your sshd_config or ~/.ssh/config files:"
- elog " PubkeyAcceptedKeyTypes=+ssh-dss"
- elog "You should however generate new keys using rsa or ed25519."
-
- elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
- elog "to 'prohibit-password'. That means password auth for root users no longer works"
- elog "out of the box. If you need this, please update your sshd_config explicitly."
- fi
- if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
- elog "Be aware that by disabling openssl support in openssh, the server and clients"
- elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
- elog "and update all clients/servers that utilize them."
- fi
-}
diff --git a/net-misc/openssh/openssh-7.9_p1-r4.ebuild b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
new file mode 100644
index 0000000..3f1fd8c
--- /dev/null
+++ b/net-misc/openssh/openssh-7.9_p1-r4.ebuild
@@ -0,0 +1,468 @@
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit user flag-o-matic multilib autotools pam systemd
+
+# Make it more portable between straight releases
+# and _p? releases.
+PARCH=${P/_}
+#HPN_PV="${PV^^}"
+HPN_PV="7.8_P1"
+
+HPN_VER="14.16"
+HPN_PATCHES=(
+ ${PN}-${HPN_PV/./_}-hpn-DynWinNoneSwitch-${HPN_VER}.diff
+ ${PN}-${HPN_PV/./_}-hpn-AES-CTR-${HPN_VER}.diff
+)
+
+SCTP_VER="1.2" SCTP_PATCH="${PARCH}-sctp-${SCTP_VER}.patch.xz"
+X509_VER="11.6" X509_PATCH="${PARCH}+x509-${X509_VER}.diff.gz"
+
+PATCH_SET="openssh-7.9p1-patches-1.0"
+
+DESCRIPTION="Port of OpenBSD's free SSH release"
+HOMEPAGE="https://www.openssh.com/"
+SRC_URI="mirror://openbsd/OpenSSH/portable/${PARCH}.tar.gz
+ https://dev.gentoo.org/~whissi/dist/${PN}/${PATCH_SET}.tar.xz
+ ${SCTP_PATCH:+sctp? ( https://dev.gentoo.org/~whissi/dist/openssh/${SCTP_PATCH} )}
+ ${HPN_VER:+hpn? ( $(printf "mirror://sourceforge/hpnssh/HPN-SSH%%20${HPN_VER/./v}%%20${HPN_PV/_P/p}/%s\n" "${HPN_PATCHES[@]}") )}
+ ${X509_PATCH:+X509? ( https://roumenpetrov.info/openssh/x509-${X509_VER}/${X509_PATCH} )}
+ "
+
+LICENSE="BSD GPL-2"
+SLOT="0"
+KEYWORDS="*"
+# Probably want to drop ssl defaulting to on in a future version.
+IUSE="abi_mips_n32 audit bindist debug hpn kerberos kernel_linux ldns libedit libressl livecd pam +pie sctp selinux +ssl static test X X509"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="ldns? ( ssl )
+ pie? ( !static )
+ static? ( !kerberos !pam )
+ X509? ( !sctp ssl )
+ test? ( ssl )"
+
+LIB_DEPEND="
+ audit? ( sys-process/audit[static-libs(+)] )
+ ldns? (
+ net-libs/ldns[static-libs(+)]
+ !bindist? ( net-libs/ldns[ecdsa,ssl(+)] )
+ bindist? ( net-libs/ldns[-ecdsa,ssl(+)] )
+ )
+ libedit? ( dev-libs/libedit:=[static-libs(+)] )
+ sctp? ( net-misc/lksctp-tools[static-libs(+)] )
+ selinux? ( >=sys-libs/libselinux-1.28[static-libs(+)] )
+ ssl? (
+ !libressl? (
+ || (
+ (
+ >=dev-libs/openssl-1.0.1:0[bindist=]
+ <dev-libs/openssl-1.1.0:0[bindist=]
+ )
+ >=dev-libs/openssl-1.1.0g:0[bindist=]
+ )
+ dev-libs/openssl:0=[static-libs(+)]
+ )
+ libressl? ( dev-libs/libressl:0=[static-libs(+)] )
+ )
+ >=sys-libs/zlib-1.2.3:=[static-libs(+)]"
+RDEPEND="
+ !static? ( ${LIB_DEPEND//\[static-libs(+)]} )
+ pam? ( virtual/pam )
+ kerberos? ( virtual/krb5 )"
+DEPEND="${RDEPEND}
+ static? ( ${LIB_DEPEND} )
+ virtual/pkgconfig
+ virtual/os-headers
+ sys-devel/autoconf"
+RDEPEND="${RDEPEND}
+ pam? ( >=sys-auth/pambase-20081028 )
+ userland_GNU? ( virtual/shadow )
+ X? ( x11-apps/xauth )"
+
+S="${WORKDIR}/${PARCH}"
+
+pkg_pretend() {
+ # this sucks, but i'd rather have people unable to `emerge -u openssh`
+ # than not be able to log in to their server any more
+ maybe_fail() { [[ -z ${!2} ]] && echo "$1" ; }
+ local fail="
+ $(use hpn && maybe_fail hpn HPN_VER)
+ $(use sctp && maybe_fail sctp SCTP_PATCH)
+ $(use X509 && maybe_fail X509 X509_PATCH)
+ "
+ fail=$(echo ${fail})
+ if [[ -n ${fail} ]] ; then
+ eerror "Sorry, but this version does not yet support features"
+ eerror "that you requested: ${fail}"
+ eerror "Please mask ${PF} for now and check back later:"
+ eerror " # echo '=${CATEGORY}/${PF}' >> /etc/portage/package.mask"
+ die "booooo"
+ fi
+
+ # Make sure people who are using tcp wrappers are notified of its removal. #531156
+ if grep -qs '^ *sshd *:' "${EROOT%/}"/etc/hosts.{allow,deny} ; then
+ ewarn "Sorry, but openssh no longer supports tcp-wrappers, and it seems like"
+ ewarn "you're trying to use it. Update your ${EROOT}etc/hosts.{allow,deny} please."
+ fi
+}
+
+src_prepare() {
+ sed -i \
+ -e "/_PATH_XAUTH/s:/usr/X11R6/bin/xauth:${EPREFIX%/}/usr/bin/xauth:" \
+ pathnames.h || die
+
+ # don't break .ssh/authorized_keys2 for fun
+ sed -i '/^AuthorizedKeysFile/s:^:#:' sshd_config || die
+
+ eapply "${FILESDIR}"/${PN}-7.9_p1-openssl-1.0.2-compat.patch
+ eapply "${FILESDIR}"/${PN}-7.9_p1-include-stdlib.patch
+ eapply "${FILESDIR}"/${PN}-7.8_p1-GSSAPI-dns.patch #165444 integrated into gsskex
+ eapply "${FILESDIR}"/${PN}-6.7_p1-openssl-ignore-status.patch
+ eapply "${FILESDIR}"/${PN}-7.5_p1-disable-conch-interop-tests.patch
+
+ if use X509 ; then
+ # patch doesn't apply due to X509 modifications
+ rm \
+ "${WORKDIR}"/patches/0001-fix-key-type-check.patch \
+ "${WORKDIR}"/patches/0002-request-rsa-sha2-cert-signatures.patch \
+ || die
+ else
+ eapply "${FILESDIR}"/${PN}-7.9_p1-CVE-2018-20685.patch # X509 patch set includes this patch
+ fi
+
+ [[ -d ${WORKDIR}/patches ]] && eapply "${WORKDIR}"/patches
+
+ local PATCHSET_VERSION_MACROS=()
+
+ if use X509 ; then
+ pushd "${WORKDIR}" || die
+ eapply "${FILESDIR}/${P}-X509-glue-${X509_VER}.patch"
+ eapply "${FILESDIR}/${P}-X509-dont-make-piddir-${X509_VER}.patch"
+ popd || die
+
+ if use hpn ; then
+ einfo "Will disable MT AES cipher due to incompatbility caused by X509 patch set"
+ HPN_DISABLE_MTAES=1
+ fi
+
+ eapply "${WORKDIR}"/${X509_PATCH%.*}
+ eapply "${FILESDIR}"/${P}-X509-${X509_VER}-tests.patch
+
+ # We need to patch package version or any X.509 sshd will reject our ssh client
+ # with "userauth_pubkey: could not parse key: string is too large [preauth]"
+ # error
+ einfo "Patching package version for X.509 patch set ..."
+ sed -i \
+ -e "s/^AC_INIT(\[OpenSSH\], \[Portable\]/AC_INIT([OpenSSH], [${X509_VER}]/" \
+ "${S}"/configure.ac || die "Failed to patch package version for X.509 patch"
+
+ einfo "Patching version.h to expose X.509 patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE.*/a #define SSH_X509 \"-PKIXSSH-${X509_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in X.509 patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_X509' )
+ fi
+
+ if use sctp ; then
+ eapply "${WORKDIR}"/${SCTP_PATCH%.*}
+
+ einfo "Patching version.h to expose SCTP patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_SCTP \"-sctp-${SCTP_VER}\"" \
+ "${S}"/version.h || die "Failed to sed-in SCTP patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_SCTP' )
+
+ einfo "Disabling know failing test (cfgparse) caused by SCTP patch ..."
+ sed -i \
+ -e "/\t\tcfgparse \\\/d" \
+ "${S}"/regress/Makefile || die "Failed to disable known failing test (cfgparse) caused by SCTP patch"
+ fi
+
+ if use hpn ; then
+ local hpn_patchdir="${T}/${P}-hpn${HPN_VER}"
+ mkdir "${hpn_patchdir}"
+ cp $(printf -- "${DISTDIR}/%s\n" "${HPN_PATCHES[@]}") "${hpn_patchdir}"
+ pushd "${hpn_patchdir}"
+ eapply "${FILESDIR}"/${P}-hpn-glue.patch
+ use X509 && eapply "${FILESDIR}"/${P}-hpn-X509-glue.patch
+ use sctp && eapply "${FILESDIR}"/${P}-hpn-sctp-glue.patch
+ popd
+
+ eapply "${hpn_patchdir}"
+ eapply "${FILESDIR}/openssh-7.9_p1-hpn-openssl-1.1.patch"
+
+ einfo "Patching Makefile.in for HPN patch set ..."
+ sed -i \
+ -e "/^LIBS=/ s/\$/ -lpthread/" \
+ "${S}"/Makefile.in || die "Failed to patch Makefile.in"
+
+ einfo "Patching version.h to expose HPN patch set ..."
+ sed -i \
+ -e "/^#define SSH_PORTABLE/a #define SSH_HPN \"-hpn${HPN_VER//./v}\"" \
+ "${S}"/version.h || die "Failed to sed-in HPN patch version"
+ PATCHSET_VERSION_MACROS+=( 'SSH_HPN' )
+
+ if [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ einfo "Disabling known non-working MT AES cipher per default ..."
+
+ cat > "${T}"/disable_mtaes.conf <<- EOF
+
+ # HPN's Multi-Threaded AES CTR cipher is currently known to be broken
+ # and therefore disabled per default.
+ DisableMTAES yes
+ EOF
+ sed -i \
+ -e "/^#HPNDisabled.*/r ${T}/disable_mtaes.conf" \
+ "${S}"/sshd_config || die "Failed to disabled MT AES ciphers in sshd_config"
+
+ sed -i \
+ -e "/AcceptEnv.*_XXX_TEST$/a \\\tDisableMTAES\t\tyes" \
+ "${S}"/regress/test-exec.sh || die "Failed to disable MT AES ciphers in test config"
+ fi
+ fi
+
+ if use X509 || use sctp || use hpn ; then
+ einfo "Patching sshconnect.c to use SSH_RELEASE in send_client_banner() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshconnect.c || die "Failed to patch send_client_banner() to use SSH_RELEASE (sshconnect.c)"
+
+ einfo "Patching sshd.c to use SSH_RELEASE in sshd_exchange_identification() ..."
+ sed -i \
+ -e "s/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_VERSION/PROTOCOL_MAJOR_2, PROTOCOL_MINOR_2, SSH_RELEASE/" \
+ "${S}"/sshd.c || die "Failed to patch sshd_exchange_identification() to use SSH_RELEASE (sshd.c)"
+
+ einfo "Patching version.h to add our patch sets to SSH_RELEASE ..."
+ sed -i \
+ -e "s/^#define SSH_RELEASE.*/#define SSH_RELEASE SSH_VERSION SSH_PORTABLE ${PATCHSET_VERSION_MACROS[*]}/" \
+ "${S}"/version.h || die "Failed to patch SSH_RELEASE (version.h)"
+ fi
+
+ sed -i \
+ -e "/#UseLogin no/d" \
+ "${S}"/sshd_config || die "Failed to remove removed UseLogin option (sshd_config)"
+
+ eapply_user #473004
+
+ tc-export PKG_CONFIG
+ local sed_args=(
+ -e "s:-lcrypto:$(${PKG_CONFIG} --libs openssl):"
+ # Disable PATH reset, trust what portage gives us #254615
+ -e 's:^PATH=/:#PATH=/:'
+ # Disable fortify flags ... our gcc does this for us
+ -e 's:-D_FORTIFY_SOURCE=2::'
+ )
+
+ # The -ftrapv flag ICEs on hppa #505182
+ use hppa && sed_args+=(
+ -e '/CFLAGS/s:-ftrapv:-fdisable-this-test:'
+ -e '/OSSH_CHECK_CFLAG_LINK.*-ftrapv/d'
+ )
+ # _XOPEN_SOURCE causes header conflicts on Solaris
+ [[ ${CHOST} == *-solaris* ]] && sed_args+=(
+ -e 's/-D_XOPEN_SOURCE//'
+ )
+ sed -i "${sed_args[@]}" configure{.ac,} || die
+
+ eautoreconf
+}
+
+src_configure() {
+ addwrite /dev/ptmx
+
+ use debug && append-cppflags -DSANDBOX_SECCOMP_FILTER_DEBUG
+ use static && append-ldflags -static
+
+ local myconf=(
+ --with-ldflags="${LDFLAGS}"
+ --disable-strip
+ --with-pid-dir="${EPREFIX}"$(usex kernel_linux '' '/var')/run
+ --sysconfdir="${EPREFIX%/}"/etc/ssh
+ --libexecdir="${EPREFIX%/}"/usr/$(get_libdir)/misc
+ --datadir="${EPREFIX%/}"/usr/share/openssh
+ --with-privsep-path="${EPREFIX%/}"/var/empty
+ --with-privsep-user=sshd
+ $(use_with audit audit linux)
+ $(use_with kerberos kerberos5 "${EPREFIX%/}"/usr)
+ # We apply the sctp patch conditionally, so can't pass --without-sctp
+ # unconditionally else we get unknown flag warnings.
+ $(use sctp && use_with sctp)
+ $(use_with ldns ldns "${EPREFIX%/}"/usr)
+ $(use_with libedit)
+ $(use_with pam)
+ $(use_with pie)
+ $(use_with selinux)
+ $(use_with ssl openssl)
+ $(use_with ssl md5-passwords)
+ $(use_with ssl ssl-engine)
+ $(use_with !elibc_Cygwin hardening) #659210
+ )
+
+ # stackprotect is broken on musl x86
+ use elibc_musl && use x86 && myconf+=( --without-stackprotect )
+
+ # The seccomp sandbox is broken on x32, so use the older method for now. #553748
+ use amd64 && [[ ${ABI} == "x32" ]] && myconf+=( --with-sandbox=rlimit )
+
+ econf "${myconf[@]}"
+}
+
+src_test() {
+ local t skipped=() failed=() passed=()
+ local tests=( interop-tests compat-tests )
+
+ local shell=$(egetshell "${UID}")
+ if [[ ${shell} == */nologin ]] || [[ ${shell} == */false ]] ; then
+ elog "Running the full OpenSSH testsuite requires a usable shell for the 'portage'"
+ elog "user, so we will run a subset only."
+ skipped+=( tests )
+ else
+ tests+=( tests )
+ fi
+
+ # It will also attempt to write to the homedir .ssh.
+ local sshhome=${T}/homedir
+ mkdir -p "${sshhome}"/.ssh
+ for t in "${tests[@]}" ; do
+ # Some tests read from stdin ...
+ HOMEDIR="${sshhome}" HOME="${sshhome}" \
+ emake -k -j1 ${t} </dev/null \
+ && passed+=( "${t}" ) \
+ || failed+=( "${t}" )
+ done
+
+ einfo "Passed tests: ${passed[*]}"
+ [[ ${#skipped[@]} -gt 0 ]] && ewarn "Skipped tests: ${skipped[*]}"
+ [[ ${#failed[@]} -gt 0 ]] && die "Some tests failed: ${failed[*]}"
+}
+
+# Gentoo tweaks to default config files.
+tweak_ssh_configs() {
+ local locale_vars=(
+ # These are language variables that POSIX defines.
+ # http://pubs.opengroup.org/onlinepubs/9699919799/basedefs/V1_chap08.html#tag_08_02
+ LANG LC_ALL LC_COLLATE LC_CTYPE LC_MESSAGES LC_MONETARY LC_NUMERIC LC_TIME
+
+ # These are the GNU extensions.
+ # https://www.gnu.org/software/autoconf/manual/html_node/Special-Shell-Variables.html
+ LANGUAGE LC_ADDRESS LC_IDENTIFICATION LC_MEASUREMENT LC_NAME LC_PAPER LC_TELEPHONE
+ )
+
+ # First the server config.
+ cat <<-EOF >> "${ED%/}"/etc/ssh/sshd_config
+
+ # Allow client to pass locale environment variables. #367017
+ AcceptEnv ${locale_vars[*]}
+
+ # Allow client to pass COLORTERM to match TERM. #658540
+ AcceptEnv COLORTERM
+ EOF
+
+ # Then the client config.
+ cat <<-EOF >> "${ED%/}"/etc/ssh/ssh_config
+
+ # Send locale environment variables. #367017
+ SendEnv ${locale_vars[*]}
+
+ # Send COLORTERM to match TERM. #658540
+ SendEnv COLORTERM
+ EOF
+
+ if use pam ; then
+ sed -i \
+ -e "/^#UsePAM /s:.*:UsePAM yes:" \
+ -e "/^#PasswordAuthentication /s:.*:PasswordAuthentication no:" \
+ -e "/^#PrintMotd /s:.*:PrintMotd no:" \
+ -e "/^#PrintLastLog /s:.*:PrintLastLog no:" \
+ "${ED%/}"/etc/ssh/sshd_config || die
+ fi
+
+ if use livecd ; then
+ sed -i \
+ -e '/^#PermitRootLogin/c# Allow root login with password on livecds.\nPermitRootLogin Yes' \
+ "${ED%/}"/etc/ssh/sshd_config || die
+ fi
+}
+
+src_install() {
+ emake install-nokeys DESTDIR="${D}"
+ fperms 600 /etc/ssh/sshd_config
+ dobin contrib/ssh-copy-id
+ newinitd "${FILESDIR}"/sshd-r1.initd sshd
+ newconfd "${FILESDIR}"/sshd-r1.confd sshd
+
+ newpamd "${FILESDIR}"/sshd.pam_include.2 sshd
+
+ tweak_ssh_configs
+
+ doman contrib/ssh-copy-id.1
+ dodoc CREDITS OVERVIEW README* TODO sshd_config
+ use hpn && dodoc HPN-README
+ use X509 || dodoc ChangeLog
+
+ diropts -m 0700
+ dodir /etc/skel/.ssh
+
+ keepdir /var/empty
+
+ systemd_dounit "${FILESDIR}"/sshd.{service,socket}
+ systemd_newunit "${FILESDIR}"/sshd_at.service 'sshd@.service'
+}
+
+pkg_preinst() {
+ enewgroup sshd 22
+ enewuser sshd 22 -1 /var/empty sshd
+}
+
+pkg_postinst() {
+ if has_version "<${CATEGORY}/${PN}-5.8_p1" ; then
+ elog "Starting with openssh-5.8p1, the server will default to a newer key"
+ elog "algorithm (ECDSA). You are encouraged to manually update your stored"
+ elog "keys list as servers update theirs. See ssh-keyscan(1) for more info."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.0_p1" ; then
+ elog "Starting with openssh-6.7, support for USE=tcpd has been dropped by upstream."
+ elog "Make sure to update any configs that you might have. Note that xinetd might"
+ elog "be an alternative for you as it supports USE=tcpd."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.1_p1" ; then #557388 #555518
+ elog "Starting with openssh-7.0, support for ssh-dss keys were disabled due to their"
+ elog "weak sizes. If you rely on these key types, you can re-enable the key types by"
+ elog "adding to your sshd_config or ~/.ssh/config files:"
+ elog " PubkeyAcceptedKeyTypes=+ssh-dss"
+ elog "You should however generate new keys using rsa or ed25519."
+
+ elog "Starting with openssh-7.0, the default for PermitRootLogin changed from 'yes'"
+ elog "to 'prohibit-password'. That means password auth for root users no longer works"
+ elog "out of the box. If you need this, please update your sshd_config explicitly."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.6_p1" ; then
+ elog "Starting with openssh-7.6p1, openssh upstream has removed ssh1 support entirely."
+ elog "Furthermore, rsa keys with less than 1024 bits will be refused."
+ fi
+ if has_version "<${CATEGORY}/${PN}-7.7_p1" ; then
+ elog "Starting with openssh-7.7p1, we no longer patch openssh to provide LDAP functionality."
+ elog "Install sys-auth/ssh-ldap-pubkey and use OpenSSH's \"AuthorizedKeysCommand\" option"
+ elog "if you need to authenticate against LDAP."
+ elog "See https://wiki.gentoo.org/wiki/SSH/LDAP_migration for more details."
+ fi
+ if ! use ssl && has_version "${CATEGORY}/${PN}[ssl]" ; then
+ elog "Be aware that by disabling openssl support in openssh, the server and clients"
+ elog "no longer support dss/rsa/ecdsa keys. You will need to generate ed25519 keys"
+ elog "and update all clients/servers that utilize them."
+ fi
+
+ if use hpn && [[ -n "${HPN_DISABLE_MTAES}" ]] ; then
+ elog ""
+ elog "HPN's multi-threaded AES CTR cipher is currently known to be broken"
+ elog "and therefore disabled at runtime per default."
+ elog "Make sure your sshd_config is up to date and contains"
+ elog ""
+ elog " DisableMTAES yes"
+ elog ""
+ elog "Otherwise you maybe unable to connect to this sshd using any AES CTR cipher."
+ elog ""
+ fi
+}
