Merge remote-tracking branch 'origin/master' into f21

openssh-6.6.1p1-ip-port-config-parser.patch

@@ -0,0 +1,24 @@
+diff --git a/misc.c b/misc.c
+index 2f11de4..36402d1 100644
+--- a/misc.c
++++ b/misc.c
+@@ -396,7 +396,7 @@ hpdelim(char **cp)
+ 			return NULL;
+ 		else
+ 			s++;
+-	} else if ((s = strpbrk(s, ":/")) == NULL)
++	} else if ((s = strpbrk(s, ":")) == NULL)
+ 		s = *cp + strlen(*cp); /* skip to end (see first case below) */
+ 
+ 	switch (*s) {
+@@ -405,7 +405,6 @@ hpdelim(char **cp)
+ 		break;
+ 
+ 	case ':':
+-	case '/':
+ 		*s = '\0';	/* terminate */
+ 		*cp = s + 1;
+ 		break;
+-- 
+2.1.0
+

openssh-6.6.1p1-scp-non-existing-directory.patch

@@ -0,0 +1,14 @@
+--- a/scp.c	
++++ a/scp.c	
+@@ -1084,6 +1084,10 @@ sink(int argc, char **argv)
+ 			free(vect[0]);
+ 			continue;
+ 		}
++		if (buf[0] == 'C' && ! exists && np[strlen(np)-1] == '/') {
++			errno = ENOTDIR;
++			goto bad;
++		}
+ 		omode = mode;
+ 		mode |= S_IWUSR;
+ 		if ((ofd = open(np, O_WRONLY|O_CREAT, mode)) < 0) {
+-- 

openssh-6.6p1-GSSAPIEnablek5users.patch

@@ -0,0 +1,137 @@
+diff --git a/gss-serv-krb5.c b/gss-serv-krb5.c
+index 0a4930e..a7c0c5f 100644
+--- a/gss-serv-krb5.c
++++ b/gss-serv-krb5.c
+@@ -260,7 +260,6 @@ ssh_gssapi_krb5_cmdok(krb5_principal principal, const char *name,
+ 	FILE *fp;
+ 	char file[MAXPATHLEN];
+ 	char line[BUFSIZ];
+-	char kuser[65]; /* match krb5_kuserok() */
+ 	struct stat st;
+ 	struct passwd *pw = the_authctxt->pw;
+ 	int found_principal = 0;
+@@ -269,7 +268,7 @@ ssh_gssapi_krb5_cmdok(krb5_principal principal, const char *name,
+ 
+ 	snprintf(file, sizeof(file), "%s/.k5users", pw->pw_dir);
+ 	/* If both .k5login and .k5users DNE, self-login is ok. */
+-	if (!k5login_exists && (access(file, F_OK) == -1)) {
++	if ( !options.enable_k5users || (!k5login_exists && (access(file, F_OK) == -1))) {
+                 return ssh_krb5_kuserok(krb_context, principal, luser,
+                                         k5login_exists);
+ 	}
+diff --git a/servconf.c b/servconf.c
+index d482e79..ad5869b 100644
+--- a/servconf.c
++++ b/servconf.c
+@@ -158,6 +158,7 @@ initialize_server_options(ServerOptions *options)
+ 	options->ip_qos_bulk = -1;
+ 	options->version_addendum = NULL;
+ 	options->use_kuserok = -1;
++	options->enable_k5users = -1;
+ }
+ 
+ void
+@@ -315,6 +316,8 @@ fill_default_server_options(ServerOptions *options)
+ 		options->show_patchlevel = 0;
+ 	if (options->use_kuserok == -1)
+ 		options->use_kuserok = 1;
++	if (options->enable_k5users == -1)
++		options->enable_k5users = 0;
+ 
+ 	/* Turn privilege separation on by default */
+ 	if (use_privsep == -1)
+@@ -356,7 +359,7 @@ typedef enum {
+ 	sBanner, sShowPatchLevel, sUseDNS, sHostbasedAuthentication,
+ 	sHostbasedUsesNameFromPacketOnly, sClientAliveInterval,
+ 	sClientAliveCountMax, sAuthorizedKeysFile,
+-	sGssAuthentication, sGssCleanupCreds, sGssStrictAcceptor,
++	sGssAuthentication, sGssCleanupCreds, sGssEnablek5users, sGssStrictAcceptor,
+ 	sGssKeyEx, sGssStoreRekey, sAcceptEnv, sPermitTunnel,
+ 	sMatch, sPermitOpen, sForceCommand, sChrootDirectory,
+ 	sUsePrivilegeSeparation, sAllowAgentForwarding,
+@@ -430,6 +433,7 @@ static struct {
+ 	{ "gssapistrictacceptorcheck", sGssStrictAcceptor, SSHCFG_GLOBAL },
+ 	{ "gssapikeyexchange", sGssKeyEx, SSHCFG_GLOBAL },
+ 	{ "gssapistorecredentialsonrekey", sGssStoreRekey, SSHCFG_GLOBAL },
++	{ "gssapienablek5users", sGssEnablek5users, SSHCFG_ALL },
+ #else
+ 	{ "gssapiauthentication", sUnsupported, SSHCFG_ALL },
+ 	{ "gssapicleanupcredentials", sUnsupported, SSHCFG_GLOBAL },
+@@ -437,6 +441,7 @@ static struct {
+ 	{ "gssapistrictacceptorcheck", sUnsupported, SSHCFG_GLOBAL },
+ 	{ "gssapikeyexchange", sUnsupported, SSHCFG_GLOBAL },
+ 	{ "gssapistorecredentialsonrekey", sUnsupported, SSHCFG_GLOBAL },
++	{ "gssapienablek5users", sUnsupported, SSHCFG_ALL },
+ #endif
+ 	{ "gssusesessionccache", sUnsupported, SSHCFG_GLOBAL },
+ 	{ "gssapiusesessioncredcache", sUnsupported, SSHCFG_GLOBAL },
+@@ -1536,6 +1541,10 @@ process_server_config_line(ServerOptions *options, char *line,
+ 		intptr = &options->use_kuserok;
+ 		goto parse_flag;
+ 
++	case sGssEnablek5users:
++		intptr = &options->enable_k5users;
++		goto parse_flag;
++
+ 	case sPermitOpen:
+ 		arg = strdelim(&cp);
+ 		if (!arg || *arg == '\0')
+@@ -1824,6 +1833,7 @@ copy_set_server_options(ServerOptions *dst, ServerOptions *src, int preauth)
+ 	M_CP_INTOPT(ip_qos_interactive);
+ 	M_CP_INTOPT(ip_qos_bulk);
+ 	M_CP_INTOPT(use_kuserok);
++	M_CP_INTOPT(enable_k5users);
+ 	M_CP_INTOPT(rekey_limit);
+ 	M_CP_INTOPT(rekey_interval);
+ 
+@@ -2076,6 +2086,7 @@ dump_config(ServerOptions *o)
+ 	dump_cfg_fmtint(sAllowTcpForwarding, o->allow_tcp_forwarding);
+ 	dump_cfg_fmtint(sUsePrivilegeSeparation, use_privsep);
+ 	dump_cfg_fmtint(sKerberosUseKuserok, o->use_kuserok);
++	dump_cfg_fmtint(sGssEnablek5users, o->enable_k5users);
+ 
+ 	/* string arguments */
+ 	dump_cfg_string(sPidFile, o->pid_file);
+diff --git a/servconf.h b/servconf.h
+index 5117dfa..d63cb71 100644
+--- a/servconf.h
++++ b/servconf.h
+@@ -173,7 +173,8 @@ typedef struct {
+ 
+ 	int	num_permitted_opens;
+ 
+-	int	use_kuserok;
++	int		use_kuserok;
++	int		enable_k5users;
+ 	char   *chroot_directory;
+ 	char   *revoked_keys_file;
+ 	char   *trusted_user_ca_keys;
+diff --git a/sshd_config b/sshd_config
+index 43671f6..6ab00ed 100644
+--- a/sshd_config
++++ b/sshd_config
+@@ -94,6 +94,7 @@ GSSAPIAuthentication yes
+ GSSAPICleanupCredentials no
+ #GSSAPIStrictAcceptorCheck yes
+ #GSSAPIKeyExchange no
++#GSSAPIEnablek5users no
+ 
+ # Set this to 'yes' to enable PAM authentication, account processing,
+ # and session processing. If this is enabled, PAM authentication will
+diff --git a/sshd_config.5 b/sshd_config.5
+index e0e5fff..aa9525d 100644
+--- a/sshd_config.5
++++ b/sshd_config.5
+@@ -505,6 +505,12 @@ on logout.
+ The default is
+ .Dq yes .
+ Note that this option applies to protocol version 2 only.
++.It Cm GSSAPIEnablek5users
++Specifies whether to look at .k5users file for GSSAPI authentication
++access control. Further details are described in
++.Xr ksu 1 .
++The default is
++.Dq no .
+ .It Cm GSSAPIStrictAcceptorCheck
+ Determines whether to be strict about the identity of the GSSAPI acceptor 
+ a client authenticates against. If

openssh-6.6p1-ldap.patch

@@ -1162,7 +1162,7 @@ new file mode 100644
 index 0000000..525060a
 --- /dev/null
 +++ b/ldapconf.c
-@@ -0,0 +1,720 @@
+@@ -0,0 +1,722 @@
 +/* $OpenBSD: ldapconf.c,v 1.1 2009/12/03 03:34:42 jfch Exp $ */
 +/*
 + * Copyright (c) 2009 Jan F. Chadima.  All rights reserved.
@@ -1479,6 +1479,7 @@ index 0000000..525060a
 +		else
 +			fatal("%.200s line %d: Bad soft/hard argument.", filename, linenum);
 +		if (*intptr == -1)
++			*intptr = value;
 +		break;
 +
 +	case lSSLPath:
@@ -1543,6 +1544,7 @@ index 0000000..525060a
 +		else
 +			fatal("%.200s line %d: Bad never/hard/demand/alow/try argument.", filename, linenum);
 +		if (*intptr == -1)
++			*intptr = value;
 +		break;
 +
 +	case lTLS_CaCertFile:

openssh.spec

@@ -64,7 +64,7 @@
 
 # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1
 %define openssh_ver 6.6.1p1
-%define openssh_rel 10
+%define openssh_rel 11
 %define pam_ssh_agent_ver 0.9.3
 %define pam_ssh_agent_rel 3
 
@@ -175,6 +175,9 @@ Patch713: openssh-6.6p1-ctr-cavstest.patch
 Patch800: openssh-6.6p1-gsskex.patch
 #http://www.mail-archive.com/kerberos@mit.edu/msg17591.html
 Patch801: openssh-6.6p1-force_krb.patch
+# add new option GSSAPIEnablek5users and disable using ~/.k5users by default (#1169843)
+# CVE-2014-9278
+Patch802: openssh-6.6p1-GSSAPIEnablek5users.patch
 Patch900: openssh-6.1p1-gssapi-canohost.patch
 #https://bugzilla.mindrot.org/show_bug.cgi?id=1780
 Patch901: openssh-6.6p1-kuserok.patch
@@ -216,6 +219,10 @@ Patch916: openssh-6.6.1p1-selinux-contexts.patch
 Patch917: openssh-6.6.1p1-cisco-dh-keys.patch
 # log via monitor in chroots without /dev/log
 Patch918: openssh-6.6.1p1-log-in-chroot.patch
+# scp file into non-existing directory (#1142223)
+Patch919: openssh-6.6.1p1-scp-non-existing-directory.patch
+# Config parser shouldn't accept ip/port syntax (#1130733)
+Patch920: openssh-6.6.1p1-ip-port-config-parser.patch
 
 License: BSD
 Group: Applications/Internet
@@ -427,6 +434,9 @@ popd
 %patch916 -p1 -b .contexts
 %patch917 -p1 -b .cisco-dh
 %patch918 -p1 -b .log-in-chroot
+%patch919 -p1 -b .scp
+%patch920 -p1 -b .config
+%patch802 -p1 -b .GSSAPIEnablek5users
 
 %patch200 -p1 -b .audit
 %patch201 -p1 -b .audit-fps
@@ -487,7 +497,7 @@ fi
 	--with-default-path=/usr/local/bin:/usr/bin \
 	--with-superuser-path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin \
 	--with-privsep-path=%{_var}/empty/sshd \
-	--enable-vendor-patchlevel="FC-%{version}-%{release}" \
+	--enable-vendor-patchlevel="FC-%{openssh_ver}-%{openssh_rel}" \
 	--disable-strip \
 	--without-zlib-version-check \
 	--with-ssl-engine \
@@ -741,6 +751,14 @@ getent passwd sshd >/dev/null || \
 %endif
 
 %changelog
+* Fri Dec 19 2014 Jakub Jelen <jjelen@redhat.com> 6.6.1p1-11 + 0.9.3-3
+- error message if scp when directory doesn't exist (#1142223)
+- parsing configuration file values (#1130733)
+- documentation in service and socket files for systemd (#1181593)
+- updated ldap patch (#981058)
+- fixed vendor-patchlevel
+- add new option GSSAPIEnablek5users and disable using ~/.k5users by default CVE-2014-9278 (#1170745)
+
 * Fri Dec 19 2014 Petr Lautrbach <plautrba@redhat.com> 6.6.1p1-10 + 0.9.3-3
 - log via monitor in chroots without /dev/log
 

sshd.service

@@ -1,5 +1,6 @@
 [Unit]
 Description=OpenSSH server daemon
+Documentation=man:sshd(8) man:sshd_config(5)
 After=network.target sshd-keygen.service
 Wants=sshd-keygen.service
 

sshd.socket

@@ -1,5 +1,6 @@
 [Unit]
 Description=OpenSSH Server Socket
+Documentation=man:sshd(8) man:sshd_config(5)
 Conflicts=sshd.service
 
 [Socket]

sshd@.service

@@ -1,5 +1,6 @@
 [Unit]
 Description=OpenSSH per-connection server daemon
+Documentation=man:sshd(8) man:sshd_config(5)
 Wants=sshd-keygen.service
 After=sshd-keygen.service