openssh: update to 9.0.1. Changes since OpenSSH 8.9 ========================= This release is focused on bug fixing. Potentially-incompatible changes -------------------------------- This release switches scp(1) from using the legacy scp/rcp protocol to using the SFTP protocol by default. Legacy scp/rcp performs wildcard expansion of remote filenames (e.g. "scp host:* .") through the remote shell. This has the side effect of requiring double quoting of shell meta-characters in file names included on scp(1) command-lines, otherwise they could be interpreted as shell commands on the remote side. This creates one area of potential incompatibility: scp(1) when using the SFTP protocol no longer requires this finicky and brittle quoting, and attempts to use it may cause transfers to fail. We consider the removal of the need for double-quoting shell characters in file names to be a benefit and do not intend to introduce bug-compatibility for legacy scp/rcp in scp(1) when using the SFTP protocol. Another area of potential incompatibility relates to the use of remote paths relative to other user's home directories, for example - "scp host:~user/file /tmp". The SFTP protocol has no native way to expand a ~user path. However, sftp-server(8) in OpenSSH 8.7 and later support a protocol extension "expand-path () openssh com" to support this. In case of incompatibility, the scp(1) client may be instructed to use the legacy scp/rcp using the -O flag. New features ------------ * ssh(1), sshd(8): use the hybrid Streamlined NTRU Prime + x25519 key exchange method by default ("sntrup761x25519-sha512 () openssh com"). The NTRU algorithm is believed to resist attacks enabled by future quantum computers and is paired with the X25519 ECDH key exchange (the previous default) as a backstop against any weaknesses in NTRU Prime that may be discovered in the future. The combination ensures that the hybrid exchange offers at least as good security as the status quo. We are making this change now (i.e. ahead of cryptographically- relevant quantum computers) to prevent "capture now, decrypt later" attacks where an adversary who can record and store SSH session ciphertext would be able to decrypt it once a sufficiently advanced quantum computer is available. * sftp-server(8): support the "copy-data" extension to allow server- side copying of files/data, following the design in draft-ietf-secsh-filexfer-extensions-00. bz2948 * sftp(1): add a "cp" command to allow the sftp client to perform server-side file copies. Bugfixes -------- * ssh(1), sshd(8): upstream: fix poll(2) spin when a channel's output fd closes without data in the channel buffer. bz3405 and bz3411 * sshd(8): pack pollfd array in server listen/accept loop. Could cause the server to hang/spin when MaxStartups > RLIMIT_NOFILE * ssh-keygen(1): avoid NULL deref via the find-principals and check-novalidate operations. bz3409 and GHPR#307 respectively. * scp(1): fix a memory leak in argument processing. bz3404 * sshd(8): don't try to resolve ListenAddress directives in the sshd re-exec path. They are unused after re-exec and parsing errors (possible for example if the host's network configuration changed) could prevent connections from being accepted. * sshd(8): when refusing a public key authentication request from a client for using an unapproved or unsupported signature algorithm include the algorithm name in the log message to make debugging easier. Portability ----------- * sshd(8): refactor platform-specific locked account check, fixing an incorrect free() on platforms with both libiaf and shadow passwords (probably only Unixware) GHPR#284, * ssh(1), sshd(8): Fix possible integer underflow in scan_scaled(3) parsing of K/M/G/etc quantities. bz#3401. * sshd(8): provide killpg implementation (mostly for Tandem NonStop) GHPR#301. * Check for missing ftruncate prototype. GHPR#301 * sshd(8): default to not using sandbox when cross compiling. On most systems poll(2) does not work when the number of FDs is reduced with setrlimit, so assume it doesn't when cross compiling and we can't run the test. bz#3398. * sshd(8): allow ppoll_time64 in seccomp sandbox. Should fix sandbox violations on some (at least i386 and armhf) 32bit Linux platforms. bz#3396. * Improve detection of -fzero-call-used-regs=all support in configure script. Security Near Miss ================== * sshd(8): fix an integer overflow in the user authentication path that, in conjunction with other logic errors, could have yielded unauthenticated access under difficult to exploit conditions. This situation is not exploitable because of independent checks in the privilege separation monitor. Privilege separation has been enabled by default in since openssh-3.2.2 (released in 2002) and has been mandatory since openssh-7.5 (released in 2017). Moreover, portable OpenSSH has used toolchain features available in most modern compilers to abort on signed integer overflow since openssh-6.5 (released in 2014). Thanks to Malcolm Stagg for finding and reporting this bug. Potentially-incompatible changes ================================ * sshd(8), portable OpenSSH only: this release removes in-built support for MD5-hashed passwords. If you require these on your system then we recommend linking against libxcrypt or similar. * This release modifies the FIDO security key middleware interface and increments SSH_SK_VERSION_MAJOR. Changes since OpenSSH 8.8 ========================= This release includes a number of new features. New features ------------ * ssh(1), sshd(8), ssh-add(1), ssh-agent(1): add a system for restricting forwarding and use of keys added to ssh-agent(1) A detailed description of the feature is available at https://www.openssh.com/agent-restrict.html and the protocol extensions are documented in the PROTOCOL and PROTOCOL.agent files in the source release. * ssh(1), sshd(8): add the sntrup761x25519-sha512@openssh.com hybrid ECDH/x25519 + Streamlined NTRU Prime post-quantum KEX to the default KEXAlgorithms list (after the ECDH methods but before the prime-group DH ones). The next release of OpenSSH is likely to make this key exchange the default method. * ssh-keygen(1): when downloading resident keys from a FIDO token, pass back the user ID that was used when the key was created and append it to the filename the key is written to (if it is not the default). Avoids keys being clobbered if the user created multiple resident keys with the same application string but different user IDs. * ssh-keygen(1), ssh(1), ssh-agent(1): better handling for FIDO keys on tokens that provide user verification (UV) on the device itself, including biometric keys, avoiding unnecessary PIN prompts. * ssh-keygen(1): add "ssh-keygen -Y match-principals" operation to perform matching of principals names against an allowed signers file. To be used towards a TOFU model for SSH signatures in git. * ssh-add(1), ssh-agent(1): allow pin-required FIDO keys to be added to ssh-agent(1). $SSH_ASKPASS will be used to request the PIN at authentication time. * ssh-keygen(1): allow selection of hash at sshsig signing time (either sha512 (default) or sha256). * ssh(1), sshd(8): read network data directly to the packet input buffer instead of indirectly via a small stack buffer. Provides a modest performance improvement. * ssh(1), sshd(8): read data directly to the channel input buffer, providing a similar modest performance improvement. * ssh(1): extend the PubkeyAuthentication configuration directive to accept yes|no|unbound|host-bound to allow control over one of the protocol extensions used to implement agent-restricted keys. Bugfixes -------- * sshd(8): document that CASignatureAlgorithms, ExposeAuthInfo and PubkeyAuthOptions can be used in a Match block. PR#277. * sshd(8): fix possible string truncation when constructing paths to .rhosts/.shosts files with very long user home directory names. * ssh-keysign(1): unbreak for KEX algorithms that use SHA384/512 exchange hashes * ssh(1): don't put the TTY into raw mode when SessionType=none, avoids ^C being unable to kill such a session. bz3360 * scp(1): fix some corner-case bugs in SFTP-mode handling of ~-prefixed paths. * ssh(1): unbreak hostbased auth using RSA keys. Allow ssh(1) to select RSA keys when only RSA/SHA2 signature algorithms are configured (this is the default case). Previously RSA keys were not being considered in the default case. * ssh-keysign(1): make ssh-keysign use the requested signature algorithm and not the default for the key type. Part of unbreaking hostbased auth for RSA/SHA2 keys. * ssh(1): stricter UpdateHostkey signature verification logic on the client- side. Require RSA/SHA2 signatures for RSA hostkeys except when RSA/SHA1 was explicitly negotiated during initial KEX; bz3375 * ssh(1), sshd(8): fix signature algorithm selection logic for UpdateHostkeys on the server side. The previous code tried to prefer RSA/SHA2 for hostkey proofs of RSA keys, but missed some cases. This will use RSA/SHA2 signatures for RSA keys if the client proposed these algorithms in initial KEX. bz3375 * All: convert all uses of select(2)/pselect(2) to poll(2)/ppoll(2). This includes the mainloops in ssh(1), ssh-agent(1), ssh-agent(1) and sftp-server(8), as well as the sshd(8) listen loop and all other FD read/writability checks. On platforms with missing or broken poll(2)/ppoll(2) syscalls a select(2)-based compat shim is available. * ssh-keygen(1): the "-Y find-principals" command was verifying key validity when using ca certs but not with simple key lifetimes within the allowed signers file. * ssh-keygen(1): make sshsig verify-time argument parsing optional * sshd(8): fix truncation in rhosts/shosts path construction. * ssh(1), ssh-agent(1): avoid xmalloc(0) for PKCS#11 keyid for ECDSA keys (we already did this for RSA keys). Avoids fatal errors for PKCS#11 libraries that return empty keyid, e.g. Microchip ATECC608B "cryptoauthlib"; bz#3364 * ssh(1), ssh-agent(1): improve the testing of credentials against inserted FIDO: ask the token whether a particular key belongs to it in cases where the token supports on-token user-verification (e.g. biometrics) rather than just assuming that it will accept it. Will reduce spurious "Confirm user presence" notifications for key handles that relate to FIDO keys that are not currently inserted in at least some cases. bz3366 * ssh(1), sshd(8): correct value for IPTOS_DSCP_LE. It needs to allow for the preceding two ECN bits. bz#3373 * ssh-keygen(1): add missing -O option to usage() for the "-Y sign" option. * ssh-keygen(1): fix a NULL deref when using the find-principals function, when matching an allowed_signers line that contains a namespace restriction, but no restriction specified on the command-line * ssh-agent(1): fix memleak in process_extension(); oss-fuzz issue #42719 * ssh(1): suppress "Connection to xxx closed" messages when LogLevel is set to "error" or above. bz3378 * ssh(1), sshd(8): use correct zlib flags when inflate(3)-ing compressed packet data. bz3372 * scp(1): when recursively transferring files in SFTP mode, create the destination directory if it doesn't already exist to match scp(1) in legacy RCP mode behaviour. * scp(1): many improvements in error message consistency between scp(1) in SFTP mode vs legacy RCP mode. * sshd(8): fix potential race in SIGTERM handling PR#289 * ssh(1), ssh(8): since DSA keys are deprecated, move them to the end of the default list of public keys so that they will be tried last. PR#295 * ssh-keygen(1): allow 'ssh-keygen -Y find-principals' to match wildcard principals in allowed_signers files Portability ----------- * ssh(1), sshd(8): don't trust closefrom(2) on Linux. glibc's implementation does not work in a chroot when the kernel does not have close_range(2). It tries to read from /proc/self/fd and when that fails dies with an assertion of sorts. Instead, call close_range(2) directly from our compat code and fall back if that fails. bz#3349, * OS X poll(2) is broken; use compat replacement. For character- special devices like /dev/null, Darwin's poll(2) returns POLLNVAL when polled with POLLIN. Apparently this is Apple bug 3710161 - not public but a websearch will find other OSS projects rediscovering it periodically since it was first identified in 2005. * Correct handling of exceptfds/POLLPRI in our select(2)-based poll(2)/ppoll(2) compat implementation. * Cygwin: correct checking of mbstowcs() return value. * Add a basic SECURITY.md that refers people to the openssh.com website. * Enable additional compiler warnings and toolchain hardening flags, including -Wbitwise-instead-of-logical, -Wmisleading-indentation, -fzero-call-used-regs and -ftrivial-auto-var-init. * HP/UX. Use compat getline(3) on HP-UX 10.x, where the libc version is not reliable.diff -r1.271 -r1.272 pkgsrc/security/openssh/Makefile
(wiz)
@@ -1,18 +1,17 @@ | @@ -1,18 +1,17 @@ | |||
1 | # $NetBSD: Makefile,v 1.271 2021/10/21 07:46:38 wiz Exp $ | 1 | # $NetBSD: Makefile,v 1.272 2022/05/15 19:21:55 wiz Exp $ | |
2 | 2 | |||
3 | DISTNAME= openssh-8.8p1 | 3 | DISTNAME= openssh-9.0p1 | |
4 | PKGNAME= ${DISTNAME:S/p1/.1/} | 4 | PKGNAME= ${DISTNAME:S/p1/.1/} | |
5 | PKGREVISION= 1 | |||
6 | CATEGORIES= security | 5 | CATEGORIES= security | |
7 | MASTER_SITES= ${MASTER_SITE_OPENBSD:=OpenSSH/portable/} | 6 | MASTER_SITES= ${MASTER_SITE_OPENBSD:=OpenSSH/portable/} | |
8 | 7 | |||
9 | MAINTAINER= pkgsrc-users@NetBSD.org | 8 | MAINTAINER= pkgsrc-users@NetBSD.org | |
10 | HOMEPAGE= https://www.openssh.com/ | 9 | HOMEPAGE= https://www.openssh.com/ | |
11 | COMMENT= Open Source Secure shell client and server (remote login program) | 10 | COMMENT= Open Source Secure shell client and server (remote login program) | |
12 | LICENSE= modified-bsd | 11 | LICENSE= modified-bsd | |
13 | 12 | |||
14 | CONFLICTS= sftp-[0-9]* | 13 | CONFLICTS= sftp-[0-9]* | |
15 | CONFLICTS+= ssh-[0-9]* ssh6-[0-9]* | 14 | CONFLICTS+= ssh-[0-9]* ssh6-[0-9]* | |
16 | CONFLICTS+= ssh2-[0-9]* ssh2-nox11-[0-9]* | 15 | CONFLICTS+= ssh2-[0-9]* ssh2-nox11-[0-9]* | |
17 | CONFLICTS+= openssh+gssapi-[0-9]* | 16 | CONFLICTS+= openssh+gssapi-[0-9]* | |
18 | CONFLICTS+= lsh>2.0 | 17 | CONFLICTS+= lsh>2.0 |
@@ -1,17 +1,17 @@ | @@ -1,17 +1,17 @@ | |||
1 | $NetBSD: distinfo,v 1.114 2021/10/26 11:17:22 nia Exp $ | 1 | $NetBSD: distinfo,v 1.115 2022/05/15 19:21:55 wiz Exp $ | |
2 | 2 | |||
3 | BLAKE2s (openssh-8.8p1.tar.gz) = 4b5720cdf7d86d36b41beb4162c02c37ad8a9d281728ab5ac4fa695af95ef7c1 | 3 | BLAKE2s (openssh-9.0p1.tar.gz) = 6b1adf0decbf08f1b180517c08ab6f9859ebfc26778bbb3b65213beb8b73d5d5 | |
4 | SHA512 (openssh-8.8p1.tar.gz) = d44cd04445f9c8963513b0d5a7e8348985114ff2471e119a6e344498719ef40f09c61c354888a3be9dabcb5870e5cbe5d3aafbb861dfa1d82a4952f3d233a8df | 4 | SHA512 (openssh-9.0p1.tar.gz) = 613ae95317e734868c6a60d9cc5af47a889baa3124bbdd2b31bb51dd6b57b136f4cfcb5604cca78a03bd500baab9b9b45eaf77e038b1ed776c86dce0437449a9 | |
5 | Size (openssh-8.8p1.tar.gz) = 1815060 bytes | 5 | Size (openssh-9.0p1.tar.gz) = 1822183 bytes | |
6 | SHA1 (patch-Makefile.in) = 13502b825c13c98b2ba3b84ff4bae9aa664b76b1 | 6 | SHA1 (patch-Makefile.in) = 70d6ca9c803b6193d0e340cb0518936a00e57492 | |
7 | SHA1 (patch-clientloop.c) = 4e88fbd14db33f003eb93c30c682a017e102196e | 7 | SHA1 (patch-clientloop.c) = 4e88fbd14db33f003eb93c30c682a017e102196e | |
8 | SHA1 (patch-config.h.in) = 7d1050743da7264763254b57938775c546c3baa5 | 8 | SHA1 (patch-config.h.in) = 7d1050743da7264763254b57938775c546c3baa5 | |
9 | SHA1 (patch-configure.ac) = 321ef5ed83abe7e07d38026e096a10700b010ac8 | 9 | SHA1 (patch-configure.ac) = 65507029aa7570bcc1e588d022812e708ef5cd5d | |
10 | SHA1 (patch-defines.h) = bd8687a9a2857f3b8d15ae94095f27f9344003c4 | 10 | SHA1 (patch-defines.h) = bd8687a9a2857f3b8d15ae94095f27f9344003c4 | |
11 | SHA1 (patch-loginrec.c) = 76f1e03182cbd18dd9ac0bdfcb6502eec7eb56a9 | 11 | SHA1 (patch-loginrec.c) = 76f1e03182cbd18dd9ac0bdfcb6502eec7eb56a9 | |
12 | SHA1 (patch-openbsd-compat_openbsd-compat.h) = bedbede16ab2fe918419c994ba15a20167b411b4 | 12 | SHA1 (patch-openbsd-compat_openbsd-compat.h) = bedbede16ab2fe918419c994ba15a20167b411b4 | |
13 | SHA1 (patch-openbsd-compat_port-tun.c) = b2a0ce81a52b00f106198d549b5068a5e67092ef | 13 | SHA1 (patch-openbsd-compat_port-net.c) = b2a0ce81a52b00f106198d549b5068a5e67092ef | |
14 | SHA1 (patch-sandbox-darwin.c) = c9a1fe2e4dbf98e929d983b4206a244e0e354b75 | 14 | SHA1 (patch-sandbox-darwin.c) = c9a1fe2e4dbf98e929d983b4206a244e0e354b75 | |
15 | SHA1 (patch-sshd.8) = 5bf48cd27cef8e8810b9dc7115f5180102a345d1 | 15 | SHA1 (patch-sshd.8) = 5bf48cd27cef8e8810b9dc7115f5180102a345d1 | |
16 | SHA1 (patch-sshd.c) = 0c5725305cbab3855b52c1a63fe4e987ed14e44e | 16 | SHA1 (patch-sshd.c) = 0c5725305cbab3855b52c1a63fe4e987ed14e44e | |
17 | SHA1 (patch-sshkey.h) = aaaf622f377e455c49683fcc2ca42576ccd097bb | 17 | SHA1 (patch-sshkey.h) = aaaf622f377e455c49683fcc2ca42576ccd097bb |
@@ -1,31 +1,24 @@ | @@ -1,31 +1,24 @@ | |||
1 | $NetBSD: patch-Makefile.in,v 1.6 2019/01/18 20:13:37 tnn Exp $ | 1 | $NetBSD: patch-Makefile.in,v 1.7 2022/05/15 19:21:56 wiz Exp $ | |
2 | 2 | |||
3 | Removed install-sysconf as we handle that phase through post-install | 3 | Removed install-sysconf as we handle that phase through post-install | |
4 | 4 | |||
5 | --- Makefile.in.orig 2018-10-17 00:01:20.000000000 +0000 | 5 | --- Makefile.in.orig 2022-04-06 00:47:48.000000000 +0000 | |
6 | +++ Makefile.in | 6 | +++ Makefile.in | |
7 | @@ -1,5 +1,5 @@ | 7 | @@ -21,7 +21,7 @@ abs_top_builddir=@abs_top_builddir@ | |
8 | # uncomment if you run a non bourne compatible shell. Ie. csh | |||
9 | -#SHELL = @SH@ | |||
10 | +SHELL = @SH@ | |||
11 | ||||
12 | AUTORECONF=autoreconf | |||
13 | ||||
14 | @@ -20,7 +20,7 @@ top_srcdir=@top_srcdir@ | |||
15 | DESTDIR= | 8 | DESTDIR= | |
16 | VPATH=@srcdir@ | 9 | VPATH=@srcdir@ | |
17 | SSH_PROGRAM=@bindir@/ssh | 10 | SSH_PROGRAM=@bindir@/ssh | |
18 | -ASKPASS_PROGRAM=$(libexecdir)/ssh-askpass | 11 | -ASKPASS_PROGRAM=$(libexecdir)/ssh-askpass | |
19 | +#ASKPASS_PROGRAM=$(libexecdir)/ssh-askpass | 12 | +#ASKPASS_PROGRAM=$(libexecdir)/ssh-askpass | |
20 | SFTP_SERVER=$(libexecdir)/sftp-server | 13 | SFTP_SERVER=$(libexecdir)/sftp-server | |
21 | SSH_KEYSIGN=$(libexecdir)/ssh-keysign | 14 | SSH_KEYSIGN=$(libexecdir)/ssh-keysign | |
22 | SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper | 15 | SSH_PKCS11_HELPER=$(libexecdir)/ssh-pkcs11-helper | |
23 | @@ -320,7 +320,7 @@ distprep: catman-do depend-check | 16 | @@ -382,7 +382,7 @@ distprep: catman-do depend-check | |
24 | -rm -rf autom4te.cache .depend.bak | 17 | -rm -rf autom4te.cache .depend.bak | |
25 | 18 | |||
26 | install: $(CONFIGFILES) $(MANPAGES) $(TARGETS) install-files install-sysconf host-key check-config | 19 | install: $(CONFIGFILES) $(MANPAGES) $(TARGETS) install-files install-sysconf host-key check-config | |
27 | -install-nokeys: $(CONFIGFILES) $(MANPAGES) $(TARGETS) install-files install-sysconf | 20 | -install-nokeys: $(CONFIGFILES) $(MANPAGES) $(TARGETS) install-files install-sysconf | |
28 | +install-nokeys: $(CONFIGFILES) $(MANPAGES) $(TARGETS) install-files | 21 | +install-nokeys: $(CONFIGFILES) $(MANPAGES) $(TARGETS) install-files | |
29 | install-nosysconf: $(CONFIGFILES) $(MANPAGES) $(TARGETS) install-files | 22 | install-nosysconf: $(CONFIGFILES) $(MANPAGES) $(TARGETS) install-files | |
30 | 23 | |||
31 | check-config: | 24 | check-config: |
@@ -1,36 +1,36 @@ | @@ -1,36 +1,36 @@ | |||
1 | $NetBSD: patch-configure.ac,v 1.8 2019/05/01 17:59:56 maya Exp $ | 1 | $NetBSD: patch-configure.ac,v 1.9 2022/05/15 19:21:56 wiz Exp $ | |
2 | 2 | |||
3 | --- configure.ac.orig 2019-04-17 22:52:57.000000000 +0000 | 3 | --- configure.ac.orig 2022-04-06 00:47:48.000000000 +0000 | |
4 | +++ configure.ac | 4 | +++ configure.ac | |
5 | @@ -294,6 +294,9 @@ AC_ARG_WITH([rpath], | 5 | @@ -340,6 +340,9 @@ AC_ARG_WITH([rpath], | |
6 | ] | 6 | ] | |
7 | ) | 7 | ) | |
8 | 8 | |||
9 | +# pkgsrc handles any rpath settings this package needs | 9 | +# pkgsrc handles any rpath settings this package needs | |
10 | +need_dash_r= | 10 | +need_dash_r= | |
11 | + | 11 | + | |
12 | # Allow user to specify flags | 12 | # Allow user to specify flags | |
13 | AC_ARG_WITH([cflags], | 13 | AC_ARG_WITH([cflags], | |
14 | [ --with-cflags Specify additional flags to pass to compiler], | 14 | [ --with-cflags Specify additional flags to pass to compiler], | |
15 | @@ -387,6 +390,7 @@ AC_CHECK_HEADERS([ \ | 15 | @@ -434,6 +437,7 @@ AC_CHECK_HEADERS([ \ | |
16 | maillock.h \ | 16 | maillock.h \ | |
17 | ndir.h \ | 17 | ndir.h \ | |
18 | net/if_tun.h \ | 18 | net/if_tun.h \ | |
19 | + net/tun/if_tun.h \ | 19 | + net/tun/if_tun.h \ | |
20 | netdb.h \ | 20 | netdb.h \ | |
21 | netgroup.h \ | 21 | netgroup.h \ | |
22 | pam/pam_appl.h \ | 22 | pam/pam_appl.h \ | |
23 | @@ -1494,6 +1507,62 @@ else | 23 | @@ -1601,6 +1605,62 @@ else | |
24 | AC_MSG_RESULT([no]) | 24 | AC_MSG_RESULT([no]) | |
25 | fi | 25 | fi | |
26 | 26 | |||
27 | +# Check whether user wants TCP wrappers support | 27 | +# Check whether user wants TCP wrappers support | |
28 | +TCPW_MSG="no" | 28 | +TCPW_MSG="no" | |
29 | +AC_ARG_WITH([tcp-wrappers], | 29 | +AC_ARG_WITH([tcp-wrappers], | |
30 | + [ --with-tcp-wrappers[[=PATH]] Enable tcpwrappers support (optionally in PATH)], | 30 | + [ --with-tcp-wrappers[[=PATH]] Enable tcpwrappers support (optionally in PATH)], | |
31 | + [ | 31 | + [ | |
32 | + if test "x$withval" != "xno" ; then | 32 | + if test "x$withval" != "xno" ; then | |
33 | + saved_LIBS="$LIBS" | 33 | + saved_LIBS="$LIBS" | |
34 | + saved_LDFLAGS="$LDFLAGS" | 34 | + saved_LDFLAGS="$LDFLAGS" | |
35 | + saved_CPPFLAGS="$CPPFLAGS" | 35 | + saved_CPPFLAGS="$CPPFLAGS" | |
36 | + if test -n "${withval}" && \ | 36 | + if test -n "${withval}" && \ | |
@@ -73,50 +73,50 @@ $NetBSD: patch-configure.ac,v 1.8 2019/0 | @@ -73,50 +73,50 @@ $NetBSD: patch-configure.ac,v 1.8 2019/0 | |||
73 | + TCPW_MSG="yes" | 73 | + TCPW_MSG="yes" | |
74 | + ], [ | 74 | + ], [ | |
75 | + AC_MSG_ERROR([*** libwrap missing]) | 75 | + AC_MSG_ERROR([*** libwrap missing]) | |
76 | + | 76 | + | |
77 | + ]) | 77 | + ]) | |
78 | + LIBS="$saved_LIBS" | 78 | + LIBS="$saved_LIBS" | |
79 | + fi | 79 | + fi | |
80 | + ] | 80 | + ] | |
81 | +) | 81 | +) | |
82 | + | 82 | + | |
83 | # Check whether user wants to use ldns | 83 | # Check whether user wants to use ldns | |
84 | LDNS_MSG="no" | 84 | LDNS_MSG="no" | |
85 | AC_ARG_WITH(ldns, | 85 | AC_ARG_WITH(ldns, | |
86 | @@ -5129,9 +5198,17 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ | 86 | @@ -5480,9 +5540,17 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[ | |
87 | ]) | 87 | ]) | |
88 | if test -z "$conf_wtmpx_location"; then | 88 | if test -z "$conf_wtmpx_location"; then | |
89 | if test x"$system_wtmpx_path" = x"no" ; then | 89 | if test x"$system_wtmpx_path" = x"no" ; then | |
90 | - AC_DEFINE([DISABLE_WTMPX]) | 90 | - AC_DEFINE([DISABLE_WTMPX]) | |
91 | + for f in /var/log/wtmpx; do | 91 | + for f in /var/log/wtmpx; do | |
92 | + if test -f $f ; then | 92 | + if test -f $f ; then | |
93 | + conf_wtmpx_location=$f | 93 | + conf_wtmpx_location=$f | |
94 | + fi | 94 | + fi | |
95 | + done | 95 | + done | |
96 | + if test -z "$conf_wtmpx_location"; then | 96 | + if test -z "$conf_wtmpx_location"; then | |
97 | + AC_DEFINE(DISABLE_WTMPX) | 97 | + AC_DEFINE(DISABLE_WTMPX) | |
98 | + fi | 98 | + fi | |
99 | fi | 99 | fi | |
100 | -else | 100 | -else | |
101 | +fi | 101 | +fi | |
102 | +if test -n "$conf_wtmpx_location"; then | 102 | +if test -n "$conf_wtmpx_location"; then | |
103 | AC_DEFINE_UNQUOTED([CONF_WTMPX_FILE], ["$conf_wtmpx_location"], | 103 | AC_DEFINE_UNQUOTED([CONF_WTMPX_FILE], ["$conf_wtmpx_location"], | |
104 | [Define if you want to specify the path to your wtmpx file]) | 104 | [Define if you want to specify the path to your wtmpx file]) | |
105 | fi | 105 | fi | |
106 | @@ -5223,7 +5300,7 @@ echo "OpenSSH has been configured with t | 106 | @@ -5580,7 +5648,7 @@ echo "OpenSSH has been configured with t | |
107 | echo " User binaries: $B" | 107 | echo " User binaries: $B" | |
108 | echo " System binaries: $C" | 108 | echo " System binaries: $C" | |
109 | echo " Configuration files: $D" | 109 | echo " Configuration files: $D" | |
110 | -echo " Askpass program: $E" | 110 | -echo " Askpass program: $E" | |
111 | +echo " Askpass program: ${ASKPASS_PROGRAM}" | 111 | +echo " Askpass program: ${ASKPASS_PROGRAM}" | |
112 | echo " Manual pages: $F" | 112 | echo " Manual pages: $F" | |
113 | echo " PID file: $G" | 113 | echo " PID file: $G" | |
114 | echo " Privilege separation chroot path: $H" | 114 | echo " Privilege separation chroot path: $H" | |
115 | @@ -5245,6 +5322,7 @@ echo " PAM support | 115 | @@ -5602,6 +5670,7 @@ echo " PAM support | |
116 | echo " OSF SIA support: $SIA_MSG" | 116 | echo " OSF SIA support: $SIA_MSG" | |
117 | echo " KerberosV support: $KRB5_MSG" | 117 | echo " KerberosV support: $KRB5_MSG" | |
118 | echo " SELinux support: $SELINUX_MSG" | 118 | echo " SELinux support: $SELINUX_MSG" | |
119 | +echo " TCP Wrappers support: $TCPW_MSG" | 119 | +echo " TCP Wrappers support: $TCPW_MSG" | |
120 | echo " MD5 password support: $MD5_MSG" | |||
121 | echo " libedit support: $LIBEDIT_MSG" | 120 | echo " libedit support: $LIBEDIT_MSG" | |
122 | echo " libldns support: $LDNS_MSG" | 121 | echo " libldns support: $LDNS_MSG" | |
122 | echo " Solaris process contract support: $SPC_MSG" |
$NetBSD: patch-openbsd-compat_port-net.c,v 1.1 2022/05/15 19:21:56 wiz Exp $
if_tun.h can be found in net/tun
--- openbsd-compat/port-net.c.orig 2020-09-27 07:25:01.000000000 +0000
+++ openbsd-compat/port-net.c
@@ -135,6 +135,10 @@ sys_set_process_rdomain(const char *name
* System-specific tunnel open function
*/
+#ifdef HAVE_NET_TUN_IF_TUN_H
+#include <net/tun/if_tun.h>
+#endif
+
#if defined(SSH_TUN_LINUX)
#include <linux/if_tun.h>
#define TUN_CTRL_DEV "/dev/net/tun"