Import of pkgsrc-2015Q1

security/openssh/Makefile

@@ -1,17 +1,10 @@
-# $NetBSD: Makefile,v 1.218 2014/03/29 09:38:11 taca Exp $
+# $NetBSD: Makefile,v 1.228 2015/03/19 20:23:55 tron Exp $
 
 DISTNAME=		openssh-6.6p1
 PKGNAME=		openssh-6.6.1
-SVR4_PKGNAME=		ossh
+PKGREVISION=		5
 CATEGORIES=		security
-MASTER_SITES=		ftp://ftp.openssh.com/pub/OpenBSD/OpenSSH/portable/ \
-			ftp://ftp3.usa.openbsd.org/pub/OpenBSD/OpenSSH/portable/ \
-			ftp://gd.tuwien.ac.at/opsys/OpenBSD/OpenSSH/portable/ \
-			ftp://ftp.freenet.de/pub/ftp.openbsd.org/pub/OpenBSD/OpenSSH/portable/ \
-			ftp://ftp.jaist.ac.jp/pub/OpenBSD/OpenSSH/portable/ \
-			ftp://ftp.belnet.be/packages/openbsd/OpenSSH/portable/
-# Don't delete the last entry -- it's there if the pkgsrc version is not
-# up-to-date and the mirrors already removed the old distfile.
+MASTER_SITES=		${MASTER_SITE_OPENBSD:=OpenSSH/portable/}
 
 MAINTAINER=		pkgsrc-users@NetBSD.org
 HOMEPAGE=		http://www.openssh.com/

security/openssh/distinfo

@@ -1,4 +1,4 @@
-$NetBSD: distinfo,v 1.86 2014/03/29 09:38:11 taca Exp $
+$NetBSD: distinfo,v 1.90 2015/03/20 22:41:19 rodent Exp $
 
 SHA1 (openssh-6.6p1-hpnssh14v4.diff.gz) = 1cb86c7151ea4c805cfb1197eac13844cd8f2f2c
 RMD160 (openssh-6.6p1-hpnssh14v4.diff.gz) = 292cea7880ff66040d915f2d5957dd27d0835984
@@ -12,12 +12,14 @@ SHA1 (patch-auth-rhosts.c) = ab8dd3e375accc5bed3e15b158a85a1b1f9a2e3e
 SHA1 (patch-auth.c) = 950b0380bcbb0fa1681014cfbb41528d09a10a18
 SHA1 (patch-auth1.c) = 7b0481f445bc85cce9d7539b00bf581b9aa09fea
 SHA1 (patch-auth2.c) = 8f4f97516874fc4af5814cbd3a1f59b9ca77b43f
+SHA1 (patch-channels.c) = 88af4136f13f93d73c70caacea0a2ded0601d1cf
+SHA1 (patch-clientloop.c) = 499f34ce4e067f1da8aca257cfa7dd820efa3504
 SHA1 (patch-config.h.in) = 9799f48f204aa213318914f1d6c45e83a8af942f
 SHA1 (patch-configure) = 3015dda57a5626667cf5c15c7c7be25f8844cfc6
 SHA1 (patch-configure.ac) = 996a3bcf133a0832b9d7fa35cc0983562d9fa60a
 SHA1 (patch-defines.h) = 4f4f4c8dc54aa86275192edf230b36737b1c0cf6
 SHA1 (patch-includes.h) = 0a899d3b38ef3de7f5b08fec022696b4e998b54e
-SHA1 (patch-loginrec.c) = 3b42ea96935a69316233eb2c65d810e46a3e5d76
+SHA1 (patch-loginrec.c) = 111530a4895c8f88c464c7495cee0dba1952d9ce
 SHA1 (patch-openbsd-compat_bsd-openpty.c) = a1318cf691f0ad844a8761a77e3bb32a9e20c695
 SHA1 (patch-openbsd-compat_openbsd-compat.h) = 1cafbe8f226c16443d2cfd003166923f33352eb0
 SHA1 (patch-openbsd-compat_port-tun.c) = 8288e2b9336ea1fcc1129d8a2ab5e55816b2ccbf
@@ -26,6 +28,7 @@ SHA1 (patch-scp.c) = 97e33843cc1b93babb6c45225c07ac74555e6d54
 SHA1 (patch-session.c) = 55e84175c7294816107c970f002401d1766f7095
 SHA1 (patch-sftp-common.c) = 5b36300c6a83ceef2340c2cee3be211eaf39ecdd
 SHA1 (patch-ssh.c) = 8965e0458aabc137fa3b5e53c6573c0f0fba8280
+SHA1 (patch-sshconnect.c) = 7bee56ee50ec26913999296eefa93c0be63a9e75
 SHA1 (patch-sshd.c) = 43b3e4383142303a5d1158f08baee4a27f2f7b13
 SHA1 (patch-sshpty.c) = 9f08f899919d05567998087a060b90800c2c7b11
 SHA1 (patch-uidswap.c) = 0b76322d47b9e14bb2828bc143645d38028bdafd

security/openssh/files/sshd.sh

@@ -1,6 +1,6 @@
 #!@RCD_SCRIPTS_SHELL@
 #
-# $NetBSD: sshd.sh,v 1.13 2011/05/17 03:26:52 taca Exp $
+# $NetBSD: sshd.sh,v 1.15 2015/01/17 01:11:06 gdt Exp $
 #
 # PROVIDE: sshd
 # REQUIRE: DAEMON LOGIN
@@ -42,14 +42,22 @@ sshd_keygen()
 	else
 		${keygen_command} -t rsa -f @PKG_SYSCONFDIR@/ssh_host_rsa_key -N ''
 	fi
-/* HAVE_ECDSA_START */
+# HAVE_ECDSA_START
 	if [ -f @PKG_SYSCONFDIR@/ssh_host_ecdsa_key ]; then
 		@ECHO@ "You already have a ECDSA host key in @PKG_SYSCONFDIR@/ssh_host_ecdsa_key"
 		@ECHO@ "Skipping protocol version 2 ECDSA Key Generation"
 	else
 		${keygen_command} -t ecdsa -f @PKG_SYSCONFDIR@/ssh_host_ecdsa_key -N ''
 	fi
-/* HAVE_ECDSA_STOP */
+# HAVE_ECDSA_STOP
+# HAVE_ED25519_START
+	if [ -f @PKG_SYSCONFDIR@/ssh_host_ed25519_key ]; then
+		@ECHO@ "You already have a ED25519 host key in @PKG_SYSCONFDIR@/ssh_host_ed25519_key"
+		@ECHO@ "Skipping protocol version 2 ED25519 Key Generation"
+	else
+		${keygen_command} -t ed25519 -f @PKG_SYSCONFDIR@/ssh_host_ed25519_key -N ''
+	fi
+# HAVE_ED25519_STOP
 	)
 }
 
@@ -58,7 +66,8 @@ sshd_precmd()
 	if [ ! -f @PKG_SYSCONFDIR@/ssh_host_key -o \
 	     ! -f @PKG_SYSCONFDIR@/ssh_host_dsa_key -o \
 	     ! -f @PKG_SYSCONFDIR@/ssh_host_rsa_key -o \
-	     ! -f @PKG_SYSCONFDIR@/ssh_host_ecdsa_key ]; then
+	     ! -f @PKG_SYSCONFDIR@/ssh_host_ecdsa_key -o \
+	     ! -f @PKG_SYSCONFDIR@/ssh_host_ed25519_key ]; then
 		if [ -f /etc/rc.subr -a -f /etc/rc.conf -a -f /etc/rc.d/DAEMON ]
 		then
 			run_rc_command keygen

security/openssh/patches/patch-channels.c

@@ -0,0 +1,51 @@
+$NetBSD: patch-channels.c,v 1.1 2015/03/19 20:23:55 tron Exp $
+
+Fix X11 forwarding under Mac OS X Yosemite. Patch taken from MacPorts.
+
+https://trac.macports.org/browser/trunk/dports/net/openssh/files/launchd.patch?rev=121205
+
+--- channels.c.orig	2014-02-26 23:18:33.000000000 +0000
++++ channels.c	2015-03-19 20:16:04.000000000 +0000
+@@ -3576,15 +3576,35 @@
+ 	 * connection to the real X server.
+ 	 */
+ 
+-	/* Check if the display is from launchd. */
+ #ifdef __APPLE__
+-	if (strncmp(display, "/tmp/launch", 11) == 0) {
+-		sock = connect_local_xsocket_path(display);
+-		if (sock < 0)
+-			return -1;
++	/* Check if the display is a path to a socket (as set by launchd). */
++	{
++		char path[PATH_MAX];
++		struct stat sbuf;
++		int is_path_to_socket = 0;
++
++		strlcpy(path, display, sizeof(path));
++		if (0 == stat(path, &sbuf)) {
++			is_path_to_socket = 1;
++		} else {
++			char *dot = strrchr(path, '.');
++			if (dot) {
++				*dot = '\0';
++				/* screen = atoi(dot + 1); */
++				if (0 == stat(path, &sbuf)) {
++					is_path_to_socket=1;
++				}
++			}
++		}
+ 
+-		/* OK, we now have a connection to the display. */
+-		return sock;
++		if (is_path_to_socket) {
++			sock = connect_local_xsocket_path(path);
++			if (sock < 0)
++				return -1;
++
++			/* OK, we now have a connection to the display. */
++			return sock;
++		}
+ 	}
+ #endif
+ 	/*

security/openssh/patches/patch-clientloop.c

@@ -0,0 +1,63 @@
+$NetBSD: patch-clientloop.c,v 1.1 2015/03/19 20:23:55 tron Exp $
+
+Fix X11 forwarding under Mac OS X Yosemite. Patch taken from MacPorts.
+
+https://trac.macports.org/browser/trunk/dports/net/openssh/files/launchd.patch?rev=121205
+
+--- clientloop.c.orig	2014-02-04 00:20:15.000000000 +0000
++++ clientloop.c	2015-03-19 20:16:04.000000000 +0000
+@@ -313,6 +313,10 @@
+ 	struct stat st;
+ 	u_int now;
+ 
++#if __APPLE__
++	int is_path_to_socket = 0;
++#endif /* __APPLE__ */
++
+ 	xauthdir = xauthfile = NULL;
+ 	*_proto = proto;
+ 	*_data = data;
+@@ -328,6 +332,33 @@
+ 			debug("x11_get_proto: DISPLAY not set");
+ 			return;
+ 		}
++#if __APPLE__
++		{
++			/*
++			 * If using launchd socket, remove the screen number from the end
++			 * of $DISPLAY. is_path_to_socket is used later in this function
++			 * to determine if an error should be displayed.
++			 */
++			char path[PATH_MAX];
++			struct stat sbuf;
++
++			strlcpy(path, display, sizeof(path));
++			if (0 == stat(path, &sbuf)) {
++				is_path_to_socket = 1;
++			} else {
++				char *dot = strrchr(path, '.');
++				if (dot) {
++					*dot = '\0';
++					/* screen = atoi(dot + 1); */
++					if (0 == stat(path, &sbuf)) {
++						is_path_to_socket = 1;
++						debug("x11_get_proto: $DISPLAY is launchd, removing screennum");
++						setenv("DISPLAY", path, 1);
++					}
++				}
++			}
++		}
++#endif /* __APPLE__ */
+ 		/*
+ 		 * Handle FamilyLocal case where $DISPLAY does
+ 		 * not match an authorization entry.  For this we
+@@ -407,6 +438,9 @@
+ 	if (!got_data) {
+ 		u_int32_t rnd = 0;
+ 
++#if __APPLE__
++		if (!is_path_to_socket)
++#endif /* __APPLE__ */
+ 		logit("Warning: No xauth data; "
+ 		    "using fake authentication data for X11 forwarding.");
+ 		strlcpy(proto, SSH_X11_PROTO, sizeof proto);

security/openssh/patches/patch-loginrec.c

@@ -1,6 +1,6 @@
-$NetBSD: patch-loginrec.c,v 1.2 2014/03/29 09:38:11 taca Exp $
+$NetBSD: patch-loginrec.c,v 1.3 2015/03/20 22:41:19 rodent Exp $
 
-Interix support and related fixes
+Interix support and related fixes. Fix build on FreeBSD.
 
 --- loginrec.c.orig	2014-01-17 01:23:24.000000000 +0000
 +++ loginrec.c
@@ -44,16 +44,20 @@ Interix support and related fixes
  	if (li->type == LTYPE_LOGOUT)
  		return;
  
-@@ -774,6 +770,8 @@ construct_utmpx(struct logininfo *li, st
+@@ -774,6 +770,12 @@ construct_utmpx(struct logininfo *li, st
  	 * for logouts.
  	 */
  
 +	/* strncpy(): Don't necessarily want null termination */
++#if defined(__FreeBSD__)
++	strncpy(utx->ut_user, li->username, MIN_SIZEOF(utx->ut_user, li->username));
++#else
 +	strncpy(utx->ut_name, li->username, MIN_SIZEOF(utx->ut_name, li->username));
++#endif
  # ifdef HAVE_HOST_IN_UTMPX
  	strncpy(utx->ut_host, li->hostname,
  	    MIN_SIZEOF(utx->ut_host, li->hostname));
-@@ -1409,7 +1407,7 @@ wtmpx_get_entry(struct logininfo *li)
+@@ -1409,7 +1411,7 @@ wtmpx_get_entry(struct logininfo *li)
   ** Low-level libutil login() functions
   **/
  

security/openssh/patches/patch-sshconnect.c

@@ -0,0 +1,87 @@
+$NetBSD: patch-sshconnect.c,v 1.1 2014/10/08 15:50:22 taca Exp $
+
+Fix for CVE-2014-2653 from
+https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=742513.
+
+--- sshconnect.c.orig	2014-02-06 22:24:34.000000000 +0000
++++ sshconnect.c
+@@ -1213,6 +1213,51 @@ fail:
+ 	return -1;
+ }
+ 
++static int
++check_host_key_sshfp(char *host, struct sockaddr *hostaddr, Key *host_key)
++{
++	int rc = -1;
++	int flags = 0;
++	Key *raw_key = NULL;
++
++	if (!options.verify_host_key_dns)
++		goto done;
++
++	/* XXX certs are not yet supported for DNS; try looking the raw key
++	 * up in the DNS anyway.
++	 */
++	if (key_is_cert(host_key)) {
++	  debug2("Extracting key from cert for SSHFP lookup");
++		raw_key = key_from_private(host_key);
++		if (key_drop_cert(raw_key))
++			fatal("Couldn't drop certificate");
++		host_key = raw_key;
++	}
++
++	if (verify_host_key_dns(host, hostaddr, host_key, &flags))
++		goto done;
++
++	if (flags & DNS_VERIFY_FOUND) {
++
++		if (options.verify_host_key_dns == 1 &&
++		    flags & DNS_VERIFY_MATCH &&
++		    flags & DNS_VERIFY_SECURE) {
++			rc = 0;
++		} else if (flags & DNS_VERIFY_MATCH) {
++			matching_host_key_dns = 1;
++		} else {
++			warn_changed_key(host_key);
++			error("Update the SSHFP RR in DNS with the new "
++			      "host key to get rid of this message.");
++		}
++	}
++
++done:
++	if (raw_key)
++		key_free(raw_key);
++	return rc;
++}
++
+ /* returns 0 if key verifies or -1 if key does NOT verify */
+ int
+ verify_host_key(char *host, struct sockaddr *hostaddr, Key *host_key)
+@@ -1224,25 +1269,8 @@ verify_host_key(char *host, struct socka
+ 	debug("Server host key: %s %s", key_type(host_key), fp);
+ 	free(fp);
+ 
+-	/* XXX certs are not yet supported for DNS */
+-	if (!key_is_cert(host_key) && options.verify_host_key_dns &&
+-	    verify_host_key_dns(host, hostaddr, host_key, &flags) == 0) {
+-		if (flags & DNS_VERIFY_FOUND) {
+-
+-			if (options.verify_host_key_dns == 1 &&
+-			    flags & DNS_VERIFY_MATCH &&
+-			    flags & DNS_VERIFY_SECURE)
+-				return 0;
+-
+-			if (flags & DNS_VERIFY_MATCH) {
+-				matching_host_key_dns = 1;
+-			} else {
+-				warn_changed_key(host_key);
+-				error("Update the SSHFP RR in DNS with the new "
+-				    "host key to get rid of this message.");
+-			}
+-		}
+-	}
++	if (check_host_key_sshfp(host, hostaddr, host_key) == 0)
++		return 0;
+ 
+ 	return check_host_key(host, hostaddr, options.port, host_key, RDRW,
+ 	    options.user_hostfiles, options.num_user_hostfiles,