diff --git a/openssh-6.7p1-coverity.patch b/openssh-6.7p1-coverity.patch index 661292e..4b8a26f 100644 --- a/openssh-6.7p1-coverity.patch +++ b/openssh-6.7p1-coverity.patch @@ -147,26 +147,6 @@ diff -up openssh-6.8p1/openbsd-compat/port-linux.h.coverity openssh-6.8p1/openbs +void linux_seed(void); + #endif /* ! _PORT_LINUX_H */ -diff -up openssh-6.8p1/pam_ssh_agent_auth-0.9.3/pam_user_key_allowed2.c.coverity openssh-6.8p1/pam_ssh_agent_auth-0.9.3/pam_user_key_allowed2.c ---- openssh-6.8p1/pam_ssh_agent_auth-0.9.3/pam_user_key_allowed2.c.coverity 2015-03-18 17:21:51.788265059 +0100 -+++ openssh-6.8p1/pam_ssh_agent_auth-0.9.3/pam_user_key_allowed2.c 2015-03-18 17:21:51.898264829 +0100 -@@ -87,7 +87,7 @@ pam_user_key_allowed2(struct passwd *pw, - found = key_new(key->type); - - while (read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) { -- char *cp, *key_options = NULL; -+ char *cp = NULL; - - /* Skip leading whitespace, empty and comment lines. */ - for (cp = line; *cp == ' ' || *cp == '\t'; cp++) -@@ -99,7 +99,6 @@ pam_user_key_allowed2(struct passwd *pw, - /* no key? check if there are options for this key */ - int quoted = 0; - verbose("user_key_allowed: check options: '%s'", cp); -- key_options = cp; - for (; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) { - if (*cp == '\\' && cp[1] == '"') - cp++; /* Skip both */ diff -up openssh-6.8p1/scp.c.coverity openssh-6.8p1/scp.c --- openssh-6.8p1/scp.c.coverity 2015-03-18 17:21:51.868264891 +0100 +++ openssh-6.8p1/scp.c 2015-03-18 17:21:58.281251460 +0100 diff --git a/openssh.spec b/openssh.spec index 8f09274..4cf8aba 100644 --- a/openssh.spec +++ b/openssh.spec @@ -67,8 +67,8 @@ # Do not forget to bump pam_ssh_agent_auth release if you rewind the main package release to 1 %global openssh_ver 7.1p2 %global openssh_rel 1 -%global pam_ssh_agent_ver 0.9.3 -%global pam_ssh_agent_rel 9 +%global pam_ssh_agent_ver 0.10.2 +%global pam_ssh_agent_rel 1 Summary: An open source implementation of SSH protocol versions 1 and 2 Name: openssh @@ -114,12 +114,10 @@ Patch300: pam_ssh_agent_auth-0.9.3-build.patch Patch301: pam_ssh_agent_auth-0.9.2-seteuid.patch # explicitly make pam callbacks visible Patch302: pam_ssh_agent_auth-0.9.2-visibility.patch -# don't use xfree (#1024965) -Patch303: pam_ssh_agent_auth-0.9.3-no-xfree.patch -# use SSH_DIGEST_* for fingerprint hashes -Patch304: pam_ssh_agent_auth-0.9.3-fingerprint-hash.patch # update to current version of agent structure Patch305: pam_ssh_agent_auth-0.9.3-agent_structure.patch +# remove prefixes to be able to build against current openssh library +Patch306: pam_ssh_agent_auth-0.10.2-compat.patch #https://bugzilla.mindrot.org/show_bug.cgi?id=1641 (WONTFIX) Patch400: openssh-6.6p1-role-mls.patch @@ -131,7 +129,7 @@ Patch501: openssh-6.7p1-ldap.patch #? Patch502: openssh-6.6p1-keycat.patch -#http6://bugzilla.mindrot.org/show_bug.cgi?id=1644 +#https://bugzilla.mindrot.org/show_bug.cgi?id=1644 Patch601: openssh-6.6p1-allow-ip-opts.patch #http://cvsweb.netbsd.org/cgi-bin/cvsweb.cgi/src/crypto/dist/ssh/Attic/sftp-glob.c.diff?r1=1.13&r2=1.13.12.1&f=h Patch603: openssh-5.8p1-glob.patch @@ -407,13 +405,12 @@ The module is most useful for su and sudo service stacks. %if %{pam_ssh_agent} pushd pam_ssh_agent_auth-%{pam_ssh_agent_ver} -%patch300 -p1 -b .psaa-build +%patch300 -p2 -b .psaa-build %patch301 -p1 -b .psaa-seteuid -%patch302 -p1 -b .psaa-visibility -%patch303 -p1 -b .psaa-xfree -%patch304 -p2 -b .psaa-fingerprint +%patch302 -p2 -b .psaa-visibility +%patch306 -p2 -b .psaa-compat %patch305 -p2 -b .psaa-agent -# Remove duplicate headers +# Remove duplicate headers and library files rm -f $(cat %{SOURCE5}) popd %endif diff --git a/pam_ssh_agent-rmheaders b/pam_ssh_agent-rmheaders index 03ab05a..06d899d 100644 --- a/pam_ssh_agent-rmheaders +++ b/pam_ssh_agent-rmheaders @@ -1,20 +1,37 @@ +authfd.c authfd.h +atomicio.c atomicio.h +bufaux.c +bufbn.c buffer.h +buffer.c +cleanup.c cipher.h compat.h defines.h +entropy.c entropy.h +fatal.c includes.h kex.h +key.c key.h +log.c log.h match.h +misc.c misc.h pathnames.h platform.h rsa.h +ssh-dss.c +ssh-rsa.c ssh.h ssh2.h +uidswap.c +uidswap.h +uuencode.c uuencode.h +xmalloc.c xmalloc.h diff --git a/pam_ssh_agent_auth-0.10.2-compat.patch b/pam_ssh_agent_auth-0.10.2-compat.patch new file mode 100644 index 0000000..9bfd561 --- /dev/null +++ b/pam_ssh_agent_auth-0.10.2-compat.patch @@ -0,0 +1,688 @@ +diff -up openssh-7.1p2/pam_ssh_agent_auth-0.10.2/iterate_ssh_agent_keys.c.old openssh-7.1p2/pam_ssh_agent_auth-0.10.2/iterate_ssh_agent_keys.c +--- openssh-7.1p2/pam_ssh_agent_auth-0.10.2/iterate_ssh_agent_keys.c.old 2016-01-22 16:27:56.867903172 +0100 ++++ openssh-7.1p2/pam_ssh_agent_auth-0.10.2/iterate_ssh_agent_keys.c 2016-01-22 16:56:48.114868014 +0100 +@@ -59,6 +59,8 @@ + #include "get_command_line.h" + extern char **environ; + ++#define PAM_SSH_AGENT_AUTH_REQUESTv1 101 ++ + /* + * Added by Jamie Beverly, ensure socket fd points to a socket owned by the user + * A cursory check is done, but to avoid race conditions, it is necessary +@@ -77,7 +77,7 @@ log_action(char ** action, size_t count) + if (count == 0) + return NULL; + +- buf = pamsshagentauth_xcalloc((count * MAX_LEN_PER_CMDLINE_ARG) + (count * 3), sizeof(*buf)); ++ buf = xcalloc((count * MAX_LEN_PER_CMDLINE_ARG) + (count * 3), sizeof(*buf)); + for (i = 0; i < count; i++) { + strcat(buf, (i > 0) ? " '" : "'"); + strncat(buf, action[i], MAX_LEN_PER_CMDLINE_ARG); +@@ -71,12 +90,12 @@ void + agent_action(Buffer *buf, char ** action, size_t count) + { + size_t i; +- pamsshagentauth_buffer_init(buf); ++ buffer_init(buf); + +- pamsshagentauth_buffer_put_int(buf, count); ++ buffer_put_int(buf, count); + + for (i = 0; i < count; i++) { +- pamsshagentauth_buffer_put_cstring(buf, action[i]); ++ buffer_put_cstring(buf, action[i]); + } + } + +@@ -100,7 +119,7 @@ pamsshagentauth_session_id2_gen(Buffer * + char * retc; + int32_t reti; + +- rnd = pamsshagentauth_arc4random(); ++ rnd = arc4random(); + cookie_len = ((uint8_t) rnd); + while (cookie_len < 16) { + cookie_len += 16; /* Add 16 bytes to the size to ensure that while the length is random, the length is always reasonable; ticket #18 */ +@@ -126,7 +128,7 @@ pamsshagentauth_session_id2_gen(Buffer * + cookie_len += 16; /* Add 16 bytes to the size to ensure that while the length is random, the length is always reasonable; ticket #18 */ + } + +- cookie = pamsshagentauth_xcalloc(1,cookie_len); ++ cookie = xcalloc(1,cookie_len); + + for (i = 0; i < cookie_len; i++) { + if (i % 4 == 0) { +@@ -110,7 +129,7 @@ pamsshagentauth_session_id2_gen(Buffer * + + for (i = 0; i < cookie_len; i++) { + if (i % 4 == 0) { +- rnd = pamsshagentauth_arc4random(); ++ rnd = arc4random(); + } + cookie[i] = (u_char) rnd; + rnd >>= 8; +@@ -125,7 +144,7 @@ pamsshagentauth_session_id2_gen(Buffer * + } + else { + action_logbuf = "unknown on this platform"; +- pamsshagentauth_buffer_init(&action_agentbuf); /* stays empty, means unavailable */ ++ buffer_init(&action_agentbuf); /* stays empty, means unavailable */ + } + + /* +@@ -142,35 +161,35 @@ pamsshagentauth_session_id2_gen(Buffer * + retc = getcwd(pwd, sizeof(pwd) - 1); + time(&ts); + +- pamsshagentauth_buffer_init(session_id2); ++ buffer_init(session_id2); + +- pamsshagentauth_buffer_put_int(session_id2, PAM_SSH_AGENT_AUTH_REQUESTv1); +- /* pamsshagentauth_debug3("cookie: %s", pamsshagentauth_tohex(cookie, cookie_len)); */ +- pamsshagentauth_buffer_put_string(session_id2, cookie, cookie_len); +- /* pamsshagentauth_debug3("user: %s", user); */ +- pamsshagentauth_buffer_put_cstring(session_id2, user); +- /* pamsshagentauth_debug3("ruser: %s", ruser); */ +- pamsshagentauth_buffer_put_cstring(session_id2, ruser); +- /* pamsshagentauth_debug3("servicename: %s", servicename); */ +- pamsshagentauth_buffer_put_cstring(session_id2, servicename); +- /* pamsshagentauth_debug3("pwd: %s", pwd); */ ++ buffer_put_int(session_id2, PAM_SSH_AGENT_AUTH_REQUESTv1); ++ /* debug3("cookie: %s", tohex(cookie, cookie_len)); */ ++ buffer_put_string(session_id2, cookie, cookie_len); ++ /* debug3("user: %s", user); */ ++ buffer_put_cstring(session_id2, user); ++ /* debug3("ruser: %s", ruser); */ ++ buffer_put_cstring(session_id2, ruser); ++ /* debug3("servicename: %s", servicename); */ ++ buffer_put_cstring(session_id2, servicename); ++ /* debug3("pwd: %s", pwd); */ + if(retc) +- pamsshagentauth_buffer_put_cstring(session_id2, pwd); ++ buffer_put_cstring(session_id2, pwd); + else +- pamsshagentauth_buffer_put_cstring(session_id2, ""); +- /* pamsshagentauth_debug3("action: %s", action_logbuf); */ +- pamsshagentauth_buffer_put_string(session_id2, action_agentbuf.buf + action_agentbuf.offset, action_agentbuf.end - action_agentbuf.offset); ++ buffer_put_cstring(session_id2, ""); ++ /* debug3("action: %s", action_logbuf); */ ++ buffer_put_string(session_id2, sshbuf_ptr(&action_agentbuf), sshbuf_len(&action_agentbuf)); + if (free_logbuf) { +- pamsshagentauth_xfree(action_logbuf); +- pamsshagentauth_buffer_free(&action_agentbuf); ++ free(action_logbuf); ++ buffer_free(&action_agentbuf); + } +- /* pamsshagentauth_debug3("hostname: %s", hostname); */ ++ /* debug3("hostname: %s", hostname); */ + if(reti >= 0) +- pamsshagentauth_buffer_put_cstring(session_id2, hostname); ++ buffer_put_cstring(session_id2, hostname); + else +- pamsshagentauth_buffer_put_cstring(session_id2, ""); +- /* pamsshagentauth_debug3("ts: %ld", ts); */ +- pamsshagentauth_buffer_put_int64(session_id2, (uint64_t) ts); ++ buffer_put_cstring(session_id2, ""); ++ /* debug3("ts: %ld", ts); */ ++ buffer_put_int64(session_id2, (uint64_t) ts); + + free(cookie); + return; +@@ -190,11 +289,11 @@ pamsshagentauth_find_authorized_keys(con + pamsshagentauth_session_id2_gen(&session_id2, user, ruser, servicename); + + if ((ac = ssh_get_authentication_connection_for_uid(uid))) { +- pamsshagentauth_verbose("Contacted ssh-agent of user %s (%u)", ruser, uid); ++ verbose("Contacted ssh-agent of user %s (%u)", ruser, uid); + for (key = ssh_get_first_identity(ac, &comment, 2); key != NULL; key = ssh_get_next_identity(ac, &comment, 2)) + { + if(key != NULL) { +- id = pamsshagentauth_xcalloc(1, sizeof(*id)); ++ id = xcalloc(1, sizeof(*id)); + id->key = key; + id->filename = comment; + id->ac = ac; +@@ -203,18 +302,18 @@ pamsshagentauth_find_authorized_keys(con + if(userauth_pubkey_from_id(ruser, id, &session_id2)) { + retval = 1; + } +- pamsshagentauth_xfree(id->filename); +- pamsshagentauth_key_free(id->key); +- pamsshagentauth_xfree(id); ++ free(id->filename); ++ key_free(id->key); ++ free(id); + if(retval == 1) + break; + } + } +- pamsshagentauth_buffer_free(&session_id2); ++ buffer_free(&session_id2); + ssh_close_authentication_connection(ac); + } + else { +- pamsshagentauth_verbose("No ssh-agent could be contacted"); ++ verbose("No ssh-agent could be contacted"); + } + /* pamsshagentauth_xfree(session_id2); */ + EVP_cleanup(); +diff -up openssh-7.1p2/pam_ssh_agent_auth-0.10.2/pam_ssh_agent_auth.c.old openssh-7.1p2/pam_ssh_agent_auth-0.10.2/pam_ssh_agent_auth.c +--- openssh-7.1p2/pam_ssh_agent_auth-0.10.2/pam_ssh_agent_auth.c.old 2016-01-22 17:03:42.746602825 +0100 ++++ openssh-7.1p2/pam_ssh_agent_auth-0.10.2/pam_ssh_agent_auth.c 2016-01-22 17:06:07.841485483 +0100 +@@ -104,7 +104,7 @@ pam_sm_authenticate(pam_handle_t * pamh, + * a patch 8-) + */ + #if ! HAVE___PROGNAME || HAVE_BUNDLE +- __progname = pamsshagentauth_xstrdup(servicename); ++ __progname = xstrdup(servicename); + #endif + + for(i = argc, argv_ptr = (char **) argv; i > 0; ++argv_ptr, i--) { +@@ -130,11 +130,11 @@ pam_sm_authenticate(pam_handle_t * pamh, + #endif + } + +- pamsshagentauth_log_init(__progname, log_lvl, facility, 0); ++ log_init(__progname, log_lvl, facility, 0); + pam_get_item(pamh, PAM_USER, (void *) &user); + pam_get_item(pamh, PAM_RUSER, (void *) &ruser_ptr); + +- pamsshagentauth_verbose("Beginning pam_ssh_agent_auth for user %s", user); ++ verbose("Beginning pam_ssh_agent_auth for user %s", user); + + if(ruser_ptr) { + strncpy(ruser, ruser_ptr, sizeof(ruser) - 1); +@@ -149,12 +149,12 @@ pam_sm_authenticate(pam_handle_t * pamh, + #ifdef ENABLE_SUDO_HACK + if( (strlen(sudo_service_name) > 0) && strncasecmp(servicename, sudo_service_name, sizeof(sudo_service_name) - 1) == 0 && getenv("SUDO_USER") ) { + strncpy(ruser, getenv("SUDO_USER"), sizeof(ruser) - 1 ); +- pamsshagentauth_verbose( "Using environment variable SUDO_USER (%s)", ruser ); ++ verbose( "Using environment variable SUDO_USER (%s)", ruser ); + } else + #endif + { + if( ! getpwuid(getuid()) ) { +- pamsshagentauth_verbose("Unable to getpwuid(getuid())"); ++ verbose("Unable to getpwuid(getuid())"); + goto cleanexit; + } + strncpy(ruser, getpwuid(getuid())->pw_name, sizeof(ruser) - 1); +@@ -163,11 +163,11 @@ pam_sm_authenticate(pam_handle_t * pamh, + + /* Might as well explicitely confirm the user exists here */ + if(! getpwnam(ruser) ) { +- pamsshagentauth_verbose("getpwnam(%s) failed, bailing out", ruser); ++ verbose("getpwnam(%s) failed, bailing out", ruser); + goto cleanexit; + } + if( ! getpwnam(user) ) { +- pamsshagentauth_verbose("getpwnam(%s) failed, bailing out", user); ++ verbose("getpwnam(%s) failed, bailing out", user); + goto cleanexit; + } + +@@ -177,8 +177,8 @@ pam_sm_authenticate(pam_handle_t * pamh, + */ + parse_authorized_key_file(user, authorized_keys_file_input); + } else { +- pamsshagentauth_verbose("Using default file=/etc/security/authorized_keys"); +- authorized_keys_file = pamsshagentauth_xstrdup("/etc/security/authorized_keys"); ++ verbose("Using default file=/etc/security/authorized_keys"); ++ authorized_keys_file = xstrdup("/etc/security/authorized_keys"); + } + + /* +@@ -187,19 +187,19 @@ pam_sm_authenticate(pam_handle_t * pamh, + */ + + if(user && strlen(ruser) > 0) { +- pamsshagentauth_verbose("Attempting authentication: `%s' as `%s' using %s", ruser, user, authorized_keys_file); ++ verbose("Attempting authentication: `%s' as `%s' using %s", ruser, user, authorized_keys_file); + + /* + * this pw_uid is used to validate the SSH_AUTH_SOCK, and so must be the uid of the ruser invoking the program, not the target-user + */ + if(pamsshagentauth_find_authorized_keys(user, ruser, servicename)) { /* getpwnam(ruser)->pw_uid)) { */ +- pamsshagentauth_logit("Authenticated: `%s' as `%s' using %s", ruser, user, authorized_keys_file); ++ logit("Authenticated: `%s' as `%s' using %s", ruser, user, authorized_keys_file); + retval = PAM_SUCCESS; + } else { +- pamsshagentauth_logit("Failed Authentication: `%s' as `%s' using %s", ruser, user, authorized_keys_file); ++ logit("Failed Authentication: `%s' as `%s' using %s", ruser, user, authorized_keys_file); + } + } else { +- pamsshagentauth_logit("No %s specified, cannot continue with this form of authentication", (user) ? "ruser" : "user" ); ++ logit("No %s specified, cannot continue with this form of authentication", (user) ? "ruser" : "user" ); + } + + cleanexit: +diff -up openssh-7.1p2/pam_ssh_agent_auth-0.10.2/userauth_pubkey_from_id.c.old openssh-7.1p2/pam_ssh_agent_auth-0.10.2/userauth_pubkey_from_id.c +--- openssh-7.1p2/pam_ssh_agent_auth-0.10.2/userauth_pubkey_from_id.c.old 2016-01-22 16:57:15.210850825 +0100 ++++ openssh-7.1p2/pam_ssh_agent_auth-0.10.2/userauth_pubkey_from_id.c 2016-01-22 17:03:13.913623276 +0100 +@@ -48,6 +48,8 @@ + #include "identity.h" + #include "pam_user_authorized_keys.h" + ++#define SSH2_MSG_USERAUTH_TRUST_REQUEST 54 ++ + /* extern u_char *session_id2; + extern uint8_t session_id_len; + */ +@@ -67,35 +67,35 @@ userauth_pubkey_from_id(const char *ruse + if(! pam_user_key_allowed(ruser, id->key)) + goto user_auth_clean_exit; + +- if(pamsshagentauth_key_to_blob(id->key, &pkblob, &blen) == 0) ++ if(key_to_blob(id->key, &pkblob, &blen) == 0) + goto user_auth_clean_exit; + + /* construct packet to sign and test */ +- pamsshagentauth_buffer_init(&b); ++ buffer_init(&b); + +- pamsshagentauth_buffer_put_string(&b, session_id2->buf + session_id2->offset, session_id2->end - session_id2->offset); +- pamsshagentauth_buffer_put_char(&b, SSH2_MSG_USERAUTH_TRUST_REQUEST); +- pamsshagentauth_buffer_put_cstring(&b, ruser); +- pamsshagentauth_buffer_put_cstring(&b, "pam_ssh_agent_auth"); +- pamsshagentauth_buffer_put_cstring(&b, "publickey"); +- pamsshagentauth_buffer_put_char(&b, 1); +- pamsshagentauth_buffer_put_cstring(&b, pkalg); +- pamsshagentauth_buffer_put_string(&b, pkblob, blen); ++ buffer_put_string(&b, sshbuf_ptr(session_id2), sshbuf_len(session_id2)); ++ buffer_put_char(&b, SSH2_MSG_USERAUTH_TRUST_REQUEST); ++ buffer_put_cstring(&b, ruser); ++ buffer_put_cstring(&b, "pam_ssh_agent_auth"); ++ buffer_put_cstring(&b, "publickey"); ++ buffer_put_char(&b, 1); ++ buffer_put_cstring(&b, pkalg); ++ buffer_put_string(&b, pkblob, blen); + +- if(ssh_agent_sign(id->ac, id->key, &sig, &slen, pamsshagentauth_buffer_ptr(&b), pamsshagentauth_buffer_len(&b)) != 0) ++ if(ssh_agent_sign(id->ac, id->key, &sig, &slen, buffer_ptr(&b), buffer_len(&b)) != 0) + goto user_auth_clean_exit; + + /* test for correct signature */ +- if(pamsshagentauth_key_verify(id->key, sig, slen, pamsshagentauth_buffer_ptr(&b), pamsshagentauth_buffer_len(&b)) == 1) ++ if(key_verify(id->key, sig, slen, buffer_ptr(&b), buffer_len(&b)) == 1) + authenticated = 1; + + user_auth_clean_exit: + /* if(&b != NULL) */ +- pamsshagentauth_buffer_free(&b); ++ buffer_free(&b); + if(sig != NULL) +- pamsshagentauth_xfree(sig); ++ free(sig); + if(pkblob != NULL) +- pamsshagentauth_xfree(pkblob); ++ free(pkblob); + CRYPTO_cleanup_all_ex_data(); + return authenticated; + } +diff -up openssh-7.1p2/pam_ssh_agent_auth-0.10.2/secure_filename.c.old openssh-7.1p2/pam_ssh_agent_auth-0.10.2/secure_filename.c +--- openssh-7.1p2/pam_ssh_agent_auth-0.10.2/secure_filename.c.old 2016-01-22 17:12:03.026198234 +0100 ++++ openssh-7.1p2/pam_ssh_agent_auth-0.10.2/secure_filename.c 2016-01-22 17:12:31.817174950 +0100 +@@ -80,7 +80,7 @@ pamsshagentauth_auth_secure_path(const c + int comparehome = 0; + struct stat st; + +- pamsshagentauth_verbose("auth_secure_filename: checking for uid: %u", uid); ++ verbose("auth_secure_filename: checking for uid: %u", uid); + + if (realpath(name, buf) == NULL) { + snprintf(err, errlen, "realpath %s failed: %s", name, +@@ -115,9 +115,9 @@ pamsshagentauth_auth_secure_path(const c + snprintf(err, errlen, "dirname() failed"); + return -1; + } +- pamsshagentauth_strlcpy(buf, cp, sizeof(buf)); ++ strlcpy(buf, cp, sizeof(buf)); + +- pamsshagentauth_verbose("secure_filename: checking '%s'", buf); ++ verbose("secure_filename: checking '%s'", buf); + if (stat(buf, &st) < 0 || + (st.st_uid != 0 && st.st_uid != uid) || + (st.st_mode & 022) != 0) { +@@ -128,7 +128,7 @@ pamsshagentauth_auth_secure_path(const c + + /* If are passed the homedir then we can stop */ + if (comparehome && strcmp(homedir, buf) == 0) { +- pamsshagentauth_verbose("secure_filename: terminating check at '%s'", ++ verbose("secure_filename: terminating check at '%s'", + buf); + break; + } +diff -up openssh-7.1p2/pam_ssh_agent_auth-0.10.2/get_command_line.c.old openssh-7.1p2/pam_ssh_agent_auth-0.10.2/get_command_line.c +--- openssh-7.1p2/pam_ssh_agent_auth-0.10.2/get_command_line.c.old 2016-01-22 17:13:18.226137418 +0100 ++++ openssh-7.1p2/pam_ssh_agent_auth-0.10.2/get_command_line.c 2016-01-22 17:14:27.753081189 +0100 +@@ -65,8 +65,8 @@ proc_pid_cmdline(char *** inargv) + case EOF: + case '\0': + if (len > 0) { +- argv = pamsshagentauth_xrealloc(argv, count + 1, sizeof(*argv)); +- argv[count] = pamsshagentauth_xcalloc(len + 1, sizeof(*argv[count])); ++ argv = xreallocarray(argv, count + 1, sizeof(*argv)); ++ argv[count] = xcalloc(len + 1, sizeof(*argv[count])); + strncpy(argv[count++], argbuf, len); + memset(argbuf, '\0', MAX_LEN_PER_CMDLINE_ARG + 1); + len = 0; +@@ -105,9 +105,9 @@ pamsshagentauth_free_command_line(char * + { + size_t i; + for (i = 0; i < n_args; i++) +- pamsshagentauth_xfree(argv[i]); ++ free(argv[i]); + +- pamsshagentauth_xfree(argv); ++ free(argv); + return; + } + +diff -up openssh-7.1p2/pam_ssh_agent_auth-0.10.2/pam_user_key_allowed2.c.old openssh-7.1p2/pam_ssh_agent_auth-0.10.2/pam_user_key_allowed2.c +--- openssh-7.1p2/pam_ssh_agent_auth-0.10.2/pam_user_key_allowed2.c.old 2016-01-22 17:15:57.547008570 +0100 ++++ openssh-7.1p2/pam_ssh_agent_auth-0.10.2/pam_user_key_allowed2.c 2016-01-22 17:16:18.297991788 +0100 +@@ -48,6 +48,7 @@ + #include "buffer.h" + #include "log.h" + #include "compat.h" ++#include "digest.h" + #include "key.h" + #include "pathnames.h" + #include "misc.h" +@@ -54,6 +54,7 @@ + #include "misc.h" + #include "secure_filename.h" + #include "uidswap.h" ++#include + + #include "identity.h" + +@@ -68,7 +68,7 @@ pamsshagentauth_check_authkeys_file(FILE + char *fp; + + found_key = 0; +- found = pamsshagentauth_key_new(key->type); ++ found = key_new(key->type); + + while(read_keyfile_line(f, file, line, sizeof(line), &linenum) != -1) { + char *cp = NULL; /* *key_options = NULL; */ +@@ -78,11 +78,11 @@ pamsshagentauth_check_authkeys_file(FILE + if(!*cp || *cp == '\n' || *cp == '#') + continue; + +- if(pamsshagentauth_key_read(found, &cp) != 1) { ++ if(key_read(found, &cp) != 1) { + /* no key? check if there are options for this key */ + int quoted = 0; + +- pamsshagentauth_verbose("user_key_allowed: check options: '%s'", cp); ++ verbose("user_key_allowed: check options: '%s'", cp); + /* key_options = cp; */ + for(; *cp && (quoted || (*cp != ' ' && *cp != '\t')); cp++) { + if(*cp == '\\' && cp[1] == '"') +@@ -92,26 +92,26 @@ pamsshagentauth_check_authkeys_file(FILE + } + /* Skip remaining whitespace. */ + for(; *cp == ' ' || *cp == '\t'; cp++); +- if(pamsshagentauth_key_read(found, &cp) != 1) { +- pamsshagentauth_verbose("user_key_allowed: advance: '%s'", cp); ++ if(key_read(found, &cp) != 1) { ++ verbose("user_key_allowed: advance: '%s'", cp); + /* still no key? advance to next line */ + continue; + } + } +- if(pamsshagentauth_key_equal(found, key)) { ++ if(key_equal(found, key)) { + found_key = 1; +- pamsshagentauth_logit("matching key found: file/command %s, line %lu", file, ++ logit("matching key found: file/command %s, line %lu", file, + linenum); +- fp = pamsshagentauth_key_fingerprint(found, SSH_FP_MD5, SSH_FP_HEX); +- pamsshagentauth_logit("Found matching %s key: %s", +- pamsshagentauth_key_type(found), fp); +- pamsshagentauth_xfree(fp); ++ fp = sshkey_fingerprint(found, SSH_DIGEST_MD5, SSH_FP_HEX); ++ logit("Found matching %s key: %s", ++ key_type(found), fp); ++ free(fp); + break; + } + } +- pamsshagentauth_key_free(found); ++ key_free(found); + if(!found_key) +- pamsshagentauth_verbose("key not found"); ++ verbose("key not found"); + return found_key; + } + +@@ -128,11 +128,11 @@ pamsshagentauth_user_key_allowed2(struct + char buf[SSH_MAX_PUBKEY_BYTES]; + + /* Temporarily use the user's uid. */ +- pamsshagentauth_verbose("trying public key file %s", file); ++ verbose("trying public key file %s", file); + + /* Fail not so quietly if file does not exist */ + if(stat(file, &st) < 0) { +- pamsshagentauth_verbose("File not found: %s", file); ++ verbose("File not found: %s", file); + return 0; + } + +@@ -144,7 +144,7 @@ pamsshagentauth_user_key_allowed2(struct + + if(pamsshagentauth_secure_filename(f, file, pw, buf, sizeof(buf)) != 0) { + fclose(f); +- pamsshagentauth_logit("Authentication refused: %s", buf); ++ logit("Authentication refused: %s", buf); + return 0; + } + +@@ -187,44 +187,44 @@ pamsshagentauth_user_key_command_allowed + else { + pw = getpwnam(authorized_keys_command_user); + if(pw == NULL) { +- pamsshagentauth_logerror("authorized_keys_command_user \"%s\" not found: %s", ++ error("authorized_keys_command_user \"%s\" not found: %s", + authorized_keys_command_user, strerror(errno)); + return 0; + } + } + +- pamsshagentauth_temporarily_use_uid(pw); ++ temporarily_use_uid(pw); + + if(stat(authorized_keys_command, &st) < 0) { +- pamsshagentauth_logerror ++ error + ("Could not stat AuthorizedKeysCommand \"%s\": %s", + authorized_keys_command, strerror(errno)); + goto out; + } + if(pamsshagentauth_auth_secure_path + (authorized_keys_command, &st, NULL, 0, errmsg, sizeof(errmsg)) != 0) { +- pamsshagentauth_logerror("Unsafe AuthorizedKeysCommand: %s", errmsg); ++ error("Unsafe AuthorizedKeysCommand: %s", errmsg); + goto out; + } + + /* open the pipe and read the keys */ + if(pipe(p) != 0) { +- pamsshagentauth_logerror("%s: pipe: %s", __func__, strerror(errno)); ++ error("%s: pipe: %s", __func__, strerror(errno)); + goto out; + } + +- pamsshagentauth_debug("Running AuthorizedKeysCommand: \"%s\" as \"%s\" with argument: \"%s\"", ++ debug("Running AuthorizedKeysCommand: \"%s\" as \"%s\" with argument: \"%s\"", + authorized_keys_command, pw->pw_name, username); + + /* + * Don't want to call this in the child, where it can fatal() and + * run cleanup_exit() code. + */ +- pamsshagentauth_restore_uid(); ++ restore_uid(); + + switch ((pid = fork())) { + case -1: /* error */ +- pamsshagentauth_logerror("%s: fork: %s", __func__, strerror(errno)); ++ error("%s: fork: %s", __func__, strerror(errno)); + close(p[0]); + close(p[1]); + return 0; +@@ -234,13 +234,13 @@ pamsshagentauth_user_key_command_allowed + + /* do this before the setresuid so thta they can be logged */ + if((devnull = open(_PATH_DEVNULL, O_RDWR)) == -1) { +- pamsshagentauth_logerror("%s: open %s: %s", __func__, _PATH_DEVNULL, ++ error("%s: open %s: %s", __func__, _PATH_DEVNULL, + strerror(errno)); + _exit(1); + } + if(dup2(devnull, STDIN_FILENO) == -1 || dup2(p[1], STDOUT_FILENO) == -1 + || dup2(devnull, STDERR_FILENO) == -1) { +- pamsshagentauth_logerror("%s: dup2: %s", __func__, strerror(errno)); ++ error("%s: dup2: %s", __func__, strerror(errno)); + _exit(1); + } + #if defined(HAVE_SETRESGID) && !defined(BROKEN_SETRESGID) +@@ -248,7 +248,7 @@ pamsshagentauth_user_key_command_allowed + #else + if (setgid(pw->pw_gid) != 0 || setegid(pw->pw_gid) != 0) { + #endif +- pamsshagentauth_logerror("setresgid %u: %s", (u_int) pw->pw_gid, ++ error("setresgid %u: %s", (u_int) pw->pw_gid, + strerror(errno)); + _exit(1); + } +@@ -258,7 +258,7 @@ pamsshagentauth_user_key_command_allowed + #else + if (setuid(pw->pw_uid) != 0 || seteuid(pw->pw_uid) != 0) { + #endif +- pamsshagentauth_logerror("setresuid %u: %s", (u_int) pw->pw_uid, ++ error("setresuid %u: %s", (u_int) pw->pw_uid, + strerror(errno)); + _exit(1); + } +@@ -270,18 +270,18 @@ pamsshagentauth_user_key_command_allowed + + /* pretty sure this will barf because we are now suid, but since we + should't reach this anyway, I'll leave it here */ +- pamsshagentauth_logerror("AuthorizedKeysCommand %s exec failed: %s", ++ error("AuthorizedKeysCommand %s exec failed: %s", + authorized_keys_command, strerror(errno)); + _exit(127); + default: /* parent */ + break; + } + +- pamsshagentauth_temporarily_use_uid(pw); ++ temporarily_use_uid(pw); + + close(p[1]); + if((f = fdopen(p[0], "r")) == NULL) { +- pamsshagentauth_logerror("%s: fdopen: %s", __func__, strerror(errno)); ++ error("%s: fdopen: %s", __func__, strerror(errno)); + close(p[0]); + /* Don't leave zombie child */ + while(waitpid(pid, NULL, 0) == -1 && errno == EINTR); +@@ -292,22 +292,22 @@ pamsshagentauth_user_key_command_allowed + + while(waitpid(pid, &status, 0) == -1) { + if(errno != EINTR) { +- pamsshagentauth_logerror("%s: waitpid: %s", __func__, ++ error("%s: waitpid: %s", __func__, + strerror(errno)); + goto out; + } + } + if(WIFSIGNALED(status)) { +- pamsshagentauth_logerror("AuthorizedKeysCommand %s exited on signal %d", ++ error("AuthorizedKeysCommand %s exited on signal %d", + authorized_keys_command, WTERMSIG(status)); + goto out; + } else if(WEXITSTATUS(status) != 0) { +- pamsshagentauth_logerror("AuthorizedKeysCommand %s returned status %d", ++ error("AuthorizedKeysCommand %s returned status %d", + authorized_keys_command, WEXITSTATUS(status)); + goto out; + } + found_key = ok; + out: +- pamsshagentauth_restore_uid(); ++ restore_uid(); + return found_key; + } +diff -up openssh-7.1p2/pam_ssh_agent_auth-0.10.2/pam_user_authorized_keys.c.psaa-xfree openssh-7.1p2/pam_ssh_agent_auth-0.10.2/pam_user_authorized_keys.c +--- openssh-7.1p2/pam_ssh_agent_auth-0.10.2/pam_user_authorized_keys.c.psaa-xfree 2016-01-22 15:30:26.300302721 +0100 ++++ openssh-7.1p2/pam_ssh_agent_auth-0.10.2/pam_user_authorized_keys.c 2016-01-22 15:33:57.567226875 +0100 +@@ -117,12 +117,12 @@ parse_authorized_key_file(const char *us + } else { + slash_ptr = strchr(auth_keys_file_buf, '/'); + if(!slash_ptr) +- pamsshagentauth_fatal ++ fatal + ("cannot expand tilde in path without a `/'"); + + owner_uname_len = slash_ptr - auth_keys_file_buf - 1; + if(owner_uname_len > (sizeof(owner_uname) - 1)) +- pamsshagentauth_fatal("Username too long"); ++ fatal("Username too long"); + + strncat(owner_uname, auth_keys_file_buf + 1, owner_uname_len); + if(!authorized_keys_file_allowed_owner_uid) +@@ -130,11 +130,11 @@ parse_authorized_key_file(const char *us + getpwnam(owner_uname)->pw_uid; + } + authorized_keys_file = +- pamsshagentauth_tilde_expand_filename(auth_keys_file_buf, ++ tilde_expand_filename(auth_keys_file_buf, + authorized_keys_file_allowed_owner_uid); + strncpy(auth_keys_file_buf, authorized_keys_file, + sizeof(auth_keys_file_buf) - 1); +- pamsshagentauth_xfree(authorized_keys_file) /* when we ++ free(authorized_keys_file) /* when we + percent_expand + later, we'd step + on this, so free +@@ -150,7 +150,7 @@ parse_authorized_key_file(const char *us + strncat(hostname, fqdn, strcspn(fqdn, ".")); + #endif + authorized_keys_file = +- pamsshagentauth_percent_expand(auth_keys_file_buf, "h", ++ percent_expand(auth_keys_file_buf, "h", + getpwnam(user)->pw_dir, "H", hostname, + "f", fqdn, "u", user, NULL); + } +diff -up openssh-7.1p2/pam_ssh_agent_auth-0.10.2/uuencode.c.psaa-xfree openssh-7.1p2/pam_ssh_agent_auth-0.10.2/uuencode.c +--- openssh-7.1p2/pam_ssh_agent_auth-0.10.2/uuencode.c.psaa-xfree 2014-03-23 23:52:21.000000000 +0100 ++++ openssh-7.1p2/pam_ssh_agent_auth-0.10.2/uuencode.c 2016-01-22 15:39:26.210104334 +0100 +@@ -56,7 +56,7 @@ pamsshagentauth_uudecode(const char *src + /* and remove trailing whitespace because __b64_pton needs this */ + *p = '\0'; + len = pamsshagentauth___b64_pton(encoded, target, targsize); +- pamsshagentauth_xfree(encoded); ++ xfree(encoded); + return len; + } + +@@ -70,7 +70,7 @@ pamsshagentauth_dump_base64(FILE *fp, u_ + fprintf(fp, "dump_base64: len > 65536\n"); + return; + } +- buf = pamsshagentauth_xmalloc(2*len); ++ buf = malloc(2*len); + n = pamsshagentauth_uuencode(data, len, buf, 2*len); + for (i = 0; i < n; i++) { + fprintf(fp, "%c", buf[i]); +@@ -79,5 +79,5 @@ pamsshagentauth_dump_base64(FILE *fp, u_ + } + if (i % 70 != 69) + fprintf(fp, "\n"); +- pamsshagentauth_xfree(buf); ++ free(buf); + } diff --git a/pam_ssh_agent_auth-0.9.2-visibility.patch b/pam_ssh_agent_auth-0.9.2-visibility.patch index f229144..aea068d 100644 --- a/pam_ssh_agent_auth-0.9.2-visibility.patch +++ b/pam_ssh_agent_auth-0.9.2-visibility.patch @@ -1,7 +1,7 @@ -diff -up pam_ssh_agent_auth-0.9.2/pam_ssh_agent_auth.c.visibility pam_ssh_agent_auth-0.9.2/pam_ssh_agent_auth.c ---- pam_ssh_agent_auth-0.9.2/pam_ssh_agent_auth.c.visibility 2009-12-21 20:57:34.000000000 +0100 -+++ pam_ssh_agent_auth-0.9.2/pam_ssh_agent_auth.c 2012-06-21 20:01:31.356259429 +0200 -@@ -68,7 +68,7 @@ char *__progname; +diff -up openssh-7.1p2/pam_ssh_agent_auth-0.10.2/pam_ssh_agent_auth.c.psaa-visibility openssh-7.1p2/pam_ssh_agent_auth-0.10.2/pam_ssh_agent_auth.c +--- openssh-7.1p2/pam_ssh_agent_auth-0.10.2/pam_ssh_agent_auth.c.psaa-visibility 2014-03-31 19:35:17.000000000 +0200 ++++ openssh-7.1p2/pam_ssh_agent_auth-0.10.2/pam_ssh_agent_auth.c 2016-01-22 15:22:40.984469774 +0100 +@@ -72,7 +72,7 @@ char *__progname; extern char *__progname; #endif @@ -10,7 +10,7 @@ diff -up pam_ssh_agent_auth-0.9.2/pam_ssh_agent_auth.c.visibility pam_ssh_agent_ pam_sm_authenticate(pam_handle_t * pamh, int flags, int argc, const char **argv) { char **argv_ptr; -@@ -184,7 +184,7 @@ pam_sm_authenticate(pam_handle_t * pamh, +@@ -214,7 +214,7 @@ cleanexit: } @@ -18,4 +18,4 @@ diff -up pam_ssh_agent_auth-0.9.2/pam_ssh_agent_auth.c.visibility pam_ssh_agent_ +PAM_EXTERN int __attribute__ ((visibility ("default"))) pam_sm_setcred(pam_handle_t * pamh, int flags, int argc, const char **argv) { - return PAM_SUCCESS; + UNUSED(pamh); diff --git a/pam_ssh_agent_auth-0.9.3-agent_structure.patch b/pam_ssh_agent_auth-0.9.3-agent_structure.patch index 701f201..b7d8d40 100644 --- a/pam_ssh_agent_auth-0.9.3-agent_structure.patch +++ b/pam_ssh_agent_auth-0.9.3-agent_structure.patch @@ -1,30 +1,47 @@ -diff -up openssh-6.8p1/pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.c.psaa-agent openssh-6.8p1/pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.c ---- openssh-6.8p1/pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.c.psaa-agent 2015-06-02 16:43:09.231902255 +0200 -+++ openssh-6.8p1/pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.c 2015-06-02 16:43:09.235902253 +0200 -@@ -37,6 +37,7 @@ +diff -up openssh-7.1p2/pam_ssh_agent_auth-0.10.2/identity.h.psaa-agent openssh-7.1p2/pam_ssh_agent_auth-0.10.2/identity.h +--- openssh-7.1p2/pam_ssh_agent_auth-0.10.2/identity.h.psaa-agent 2014-03-31 19:35:16.000000000 +0200 ++++ openssh-7.1p2/pam_ssh_agent_auth-0.10.2/identity.h 2016-01-22 15:47:15.999919059 +0100 +@@ -38,6 +38,12 @@ + typedef struct identity Identity; + typedef struct idlist Idlist; + ++typedef struct { ++ int fd; ++ Buffer identities; ++ int howmany; ++} AuthenticationConnection; ++ + struct identity { + TAILQ_ENTRY(identity) next; + AuthenticationConnection *ac; /* set if agent supports key */ +diff -up openssh-7.1p2/pam_ssh_agent_auth-0.10.2/iterate_ssh_agent_keys.c.psaa-agent openssh-7.1p2/pam_ssh_agent_auth-0.10.2/iterate_ssh_agent_keys.c +--- openssh-7.1p2/pam_ssh_agent_auth-0.10.2/iterate_ssh_agent_keys.c.psaa-agent 2016-01-22 15:47:15.998919060 +0100 ++++ openssh-7.1p2/pam_ssh_agent_auth-0.10.2/iterate_ssh_agent_keys.c 2016-01-22 15:53:38.427768239 +0100 +@@ -39,6 +39,7 @@ #include "buffer.h" #include "key.h" #include "authfd.h" +#include "ssherr.h" - #include "ssh.h" #include - #include -@@ -177,34 +178,41 @@ int - find_authorized_keys(uid_t uid) + #include + #include "ssh2.h" +@@ -285,36 +286,43 @@ pamsshagentauth_find_authorized_keys(con { + Buffer session_id2 = { 0 }; Identity *id; - Key *key; AuthenticationConnection *ac; - char *comment; uint8_t retval = 0; + uid_t uid = getpwnam(ruser)->pw_uid; + struct ssh_identitylist *idlist; + int r, i; OpenSSL_add_all_digests(); - session_id2 = session_id2_gen(); + pamsshagentauth_session_id2_gen(&session_id2, user, ruser, servicename); if ((ac = ssh_get_authentication_connection_for_uid(uid))) { - verbose("Contacted ssh-agent of user %s (%u)", getpwuid(uid)->pw_name, uid); + verbose("Contacted ssh-agent of user %s (%u)", ruser, uid); - for (key = ssh_get_first_identity(ac, &comment, 2); key != NULL; key = ssh_get_next_identity(ac, &comment, 2)) + if ((r = ssh_fetch_identitylist(ac->fd, 2, + &idlist)) != 0) { @@ -42,7 +59,7 @@ diff -up openssh-6.8p1/pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.c.psaa-ag + id->key = idlist->keys[i]; + id->filename = idlist->comments[i]; id->ac = ac; - if(userauth_pubkey_from_id(id)) { + if(userauth_pubkey_from_id(ruser, id, &session_id2)) { retval = 1; } - free(id->filename); @@ -52,6 +69,7 @@ diff -up openssh-6.8p1/pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.c.psaa-ag break; } } + buffer_free(&session_id2); - ssh_close_authentication_connection(ac); + ssh_free_identitylist(idlist); + ssh_close_authentication_socket(ac->fd); @@ -60,28 +78,12 @@ diff -up openssh-6.8p1/pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.c.psaa-ag } else { verbose("No ssh-agent could be contacted"); -diff -up openssh-6.8p1/pam_ssh_agent_auth-0.9.3/identity.h.psaa-agent openssh-6.8p1/pam_ssh_agent_auth-0.9.3/identity.h ---- openssh-6.8p1/pam_ssh_agent_auth-0.9.3/identity.h.psaa-agent 2009-08-09 02:54:21.000000000 +0200 -+++ openssh-6.8p1/pam_ssh_agent_auth-0.9.3/identity.h 2015-06-02 16:43:09.235902253 +0200 -@@ -14,6 +14,12 @@ - typedef struct identity Identity; - typedef struct idlist Idlist; - -+typedef struct { -+ int fd; -+ Buffer identities; -+ int howmany; -+} AuthenticationConnection; -+ - struct identity { - TAILQ_ENTRY(identity) next; - AuthenticationConnection *ac; /* set if agent supports key */ -diff -up openssh-6.8p1/pam_ssh_agent_auth-0.9.3/userauth_pubkey_from_id.c.psaa-agent openssh-6.8p1/pam_ssh_agent_auth-0.9.3/userauth_pubkey_from_id.c ---- openssh-6.8p1/pam_ssh_agent_auth-0.9.3/userauth_pubkey_from_id.c.psaa-agent 2015-06-02 16:43:09.232902254 +0200 -+++ openssh-6.8p1/pam_ssh_agent_auth-0.9.3/userauth_pubkey_from_id.c 2015-06-02 16:45:07.699822094 +0200 -@@ -54,10 +54,11 @@ extern uint8_t session_id_len; +diff -up openssh-7.1p2/pam_ssh_agent_auth-0.10.2/userauth_pubkey_from_id.c.psaa-agent openssh-7.1p2/pam_ssh_agent_auth-0.10.2/userauth_pubkey_from_id.c +--- openssh-7.1p2/pam_ssh_agent_auth-0.10.2/userauth_pubkey_from_id.c.psaa-agent 2016-01-22 15:47:15.995919061 +0100 ++++ openssh-7.1p2/pam_ssh_agent_auth-0.10.2/userauth_pubkey_from_id.c 2016-01-22 16:06:20.611464261 +0100 +@@ -55,10 +55,11 @@ extern uint8_t session_id_len; int - userauth_pubkey_from_id(Identity * id) + userauth_pubkey_from_id(const char *ruser, Identity * id, Buffer * session_id2) { - Buffer b = { 0 }; + Buffer b; @@ -93,20 +95,7 @@ diff -up openssh-6.8p1/pam_ssh_agent_auth-0.9.3/userauth_pubkey_from_id.c.psaa-a int authenticated = 0; pkalg = (char *) key_ssh_name(id->key); -@@ -65,10 +65,10 @@ userauth_pubkey_from_id(Identity * id) - - /* first test if this key is even allowed */ - if(! pam_user_key_allowed(id->key)) -- goto user_auth_clean_exit; -+ goto user_auth_clean_exit_without_buffer; - - if(key_to_blob(id->key, &pkblob, &blen) == 0) -- goto user_auth_clean_exit; -+ goto user_auth_clean_exit_without_buffer; - - /* construct packet to sign and test */ - buffer_init(&b); -@@ -70,7 +70,7 @@ userauth_pubkey_from_id(Identity * id) +@@ -82,7 +83,7 @@ userauth_pubkey_from_id(const char *ruse buffer_put_cstring(&b, pkalg); buffer_put_string(&b, pkblob, blen); @@ -115,11 +104,3 @@ diff -up openssh-6.8p1/pam_ssh_agent_auth-0.9.3/userauth_pubkey_from_id.c.psaa-a goto user_auth_clean_exit; /* test for correct signature */ -@@ -92,6 +92,7 @@ userauth_pubkey_from_id(Identity * id) - user_auth_clean_exit: - if(&b != NULL) - buffer_free(&b); -+ user_auth_clean_exit_without_buffer: - if(sig != NULL) - free(sig); - if(pkblob != NULL) diff --git a/pam_ssh_agent_auth-0.9.3-build.patch b/pam_ssh_agent_auth-0.9.3-build.patch index 4f75740..be5f94c 100644 --- a/pam_ssh_agent_auth-0.9.3-build.patch +++ b/pam_ssh_agent_auth-0.9.3-build.patch @@ -1,12 +1,11 @@ -diff -up pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.c.psaa-build pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.c ---- pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.c.psaa-build 2010-01-13 03:17:01.000000000 +0100 -+++ pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.c 2012-06-21 20:14:56.432527764 +0200 -@@ -37,7 +37,16 @@ - #include "buffer.h" - #include "key.h" - #include "authfd.h" +diff -up openssh-7.1p2/pam_ssh_agent_auth-0.10.2/iterate_ssh_agent_keys.c.psaa-build openssh-7.1p2/pam_ssh_agent_auth-0.10.2/iterate_ssh_agent_keys.c +--- openssh-7.1p2/pam_ssh_agent_auth-0.10.2/iterate_ssh_agent_keys.c.psaa-build 2016-01-22 14:59:18.943919791 +0100 ++++ openssh-7.1p2/pam_ssh_agent_auth-0.10.2/iterate_ssh_agent_keys.c 2016-01-22 15:16:12.534599318 +0100 +@@ -43,12 +43,31 @@ + #include + #include "ssh2.h" + #include "misc.h" +#include "ssh.h" - #include +#include +#include +#include @@ -15,12 +14,11 @@ diff -up pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.c.psaa-build pam_ssh_ag +#include +#include +#include - #include #include "userauth_pubkey_from_id.h" -@@ -69,6 +78,96 @@ session_id2_gen() - return cookie; - } + #include "identity.h" + #include "get_command_line.h" + extern char **environ; +/* + * Added by Jamie Beverly, ensure socket fd points to a socket owned by the user @@ -32,7 +30,31 @@ diff -up pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.c.psaa-build pam_ssh_ag + * race condition; so a more "direct" log message is generated. + */ + -+int + static char * + log_action(char ** action, size_t count) + { +@@ -85,7 +104,7 @@ void + pamsshagentauth_session_id2_gen(Buffer * session_id2, const char * user, + const char * ruser, const char * servicename) + { +- char *cookie = NULL; ++ u_char *cookie = NULL; + uint8_t i = 0; + uint32_t rnd = 0; + uint8_t cookie_len; +@@ -110,7 +129,7 @@ pamsshagentauth_session_id2_gen(Buffer * + if (i % 4 == 0) { + rnd = pamsshagentauth_arc4random(); + } +- cookie[i] = (char) rnd; ++ cookie[i] = (u_char) rnd; + rnd >>= 8; + } + +@@ -142,6 +161,86 @@ pamsshagentauth_session_id2_gen(Buffer * + } + + int +ssh_get_authentication_socket_for_uid(uid_t uid) +{ + const char *authsocket; @@ -112,27 +134,23 @@ diff -up pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.c.psaa-build pam_ssh_ag + return auth; +} + - int - find_authorized_keys(uid_t uid) ++int + pamsshagentauth_find_authorized_keys(const char * user, const char * ruser, const char * servicename) { -@@ -81,7 +180,7 @@ find_authorized_keys(uid_t uid) + Buffer session_id2 = { 0 }; +@@ -190,7 +289,7 @@ pamsshagentauth_find_authorized_keys(con OpenSSL_add_all_digests(); - session_id2 = session_id2_gen(); + pamsshagentauth_session_id2_gen(&session_id2, user, ruser, servicename); - if ((ac = ssh_get_authentication_connection(uid))) { + if ((ac = ssh_get_authentication_connection_for_uid(uid))) { - verbose("Contacted ssh-agent of user %s (%u)", getpwuid(uid)->pw_name, uid); + pamsshagentauth_verbose("Contacted ssh-agent of user %s (%u)", ruser, uid); for (key = ssh_get_first_identity(ac, &comment, 2); key != NULL; key = ssh_get_next_identity(ac, &comment, 2)) { -@@ -109,3 +208,4 @@ find_authorized_keys(uid_t uid) - EVP_cleanup(); - return retval; - } -+ -diff -up pam_ssh_agent_auth-0.9.3/Makefile.in.psaa-build pam_ssh_agent_auth-0.9.3/Makefile.in ---- pam_ssh_agent_auth-0.9.3/Makefile.in.psaa-build 2009-10-27 21:19:41.000000000 +0100 -+++ pam_ssh_agent_auth-0.9.3/Makefile.in 2012-06-21 20:14:56.432527764 +0200 -@@ -28,7 +28,7 @@ PATHS= +diff -up openssh-7.1p2/pam_ssh_agent_auth-0.10.2/Makefile.in.psaa-build openssh-7.1p2/pam_ssh_agent_auth-0.10.2/Makefile.in +--- openssh-7.1p2/pam_ssh_agent_auth-0.10.2/Makefile.in.psaa-build 2014-03-31 19:35:17.000000000 +0200 ++++ openssh-7.1p2/pam_ssh_agent_auth-0.10.2/Makefile.in 2016-01-22 15:20:16.479521651 +0100 +@@ -52,7 +52,7 @@ PATHS= CC=@CC@ LD=@LD@ CFLAGS=@CFLAGS@ @@ -141,7 +159,7 @@ diff -up pam_ssh_agent_auth-0.9.3/Makefile.in.psaa-build pam_ssh_agent_auth-0.9. LIBS=@LIBS@ AR=@AR@ AWK=@AWK@ -@@ -37,7 +37,7 @@ INSTALL=@INSTALL@ +@@ -61,7 +61,7 @@ INSTALL=@INSTALL@ PERL=@PERL@ SED=@SED@ ENT=@ENT@ @@ -150,16 +168,16 @@ diff -up pam_ssh_agent_auth-0.9.3/Makefile.in.psaa-build pam_ssh_agent_auth-0.9. LDFLAGS_SHARED = @LDFLAGS_SHARED@ EXEEXT=@EXEEXT@ -@@ -48,7 +48,7 @@ PAM_MODULES=pam_ssh_agent_auth.so +@@ -72,7 +72,7 @@ PAM_MODULES=pam_ssh_agent_auth.so - SSHOBJS=xmalloc.o atomicio.o authfd.o bufaux.o bufbn.o buffer.o cleanup.o entropy.o fatal.o key.o log.o misc.o secure_filename.o ssh-dss.o ssh-rsa.o uuencode.o compat.o + SSHOBJS=xmalloc.o atomicio.o authfd.o bufaux.o bufbn.o buffer.o cleanup.o entropy.o fatal.o key.o log.o misc.o secure_filename.o ssh-dss.o ssh-rsa.o uuencode.o compat.o uidswap.o --PAM_SSH_AGENT_AUTH_OBJS=pam_user_key_allowed2.o iterate_ssh_agent_keys.o userauth_pubkey_from_id.o pam_user_authorized_keys.o -+PAM_SSH_AGENT_AUTH_OBJS=pam_user_key_allowed2.o iterate_ssh_agent_keys.o userauth_pubkey_from_id.o pam_user_authorized_keys.o secure_filename.o +-PAM_SSH_AGENT_AUTH_OBJS=pam_user_key_allowed2.o iterate_ssh_agent_keys.o userauth_pubkey_from_id.o pam_user_authorized_keys.o get_command_line.o ++PAM_SSH_AGENT_AUTH_OBJS=pam_user_key_allowed2.o iterate_ssh_agent_keys.o userauth_pubkey_from_id.o pam_user_authorized_keys.o get_command_line.o secure_filename.o MANPAGES_IN = pam_ssh_agent_auth.pod -@@ -67,13 +67,13 @@ $(PAM_MODULES): Makefile.in config.h +@@ -91,13 +91,13 @@ $(PAM_MODULES): Makefile.in config.h .c.o: $(CC) $(CFLAGS) $(CPPFLAGS) -c $< @@ -170,31 +188,9 @@ diff -up pam_ssh_agent_auth-0.9.3/Makefile.in.psaa-build pam_ssh_agent_auth-0.9. always: -pam_ssh_agent_auth.so: $(LIBCOMPAT) $(SSHOBJS) $(PAM_SSH_AGENT_AUTH_OBJS) pam_ssh_agent_auth.o -- $(LD) $(LDFLAGS_SHARED) -o $@ $(SSHOBJS) $(PAM_SSH_AGENT_AUTH_OBJS) $(LDFLAGS) -lopenbsd-compat $(LIBS) -lpam pam_ssh_agent_auth.o +- $(LD) $(LDFLAGS_SHARED) -o $@ $(SSHOBJS) $(PAM_SSH_AGENT_AUTH_OBJS) $(LDFLAGS) -lopenbsd-compat pam_ssh_agent_auth.o $(LIBS) -lpam +pam_ssh_agent_auth.so: $(PAM_SSH_AGENT_AUTH_OBJS) pam_ssh_agent_auth.o -+ $(LD) $(LDFLAGS_SHARED) -o $@ $(PAM_SSH_AGENT_AUTH_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat $(LIBS) -lpam -lnss3 pam_ssh_agent_auth.o ++ $(LD) $(LDFLAGS_SHARED) -o $@ $(PAM_SSH_AGENT_AUTH_OBJS) $(LDFLAGS) -lssh -lopenbsd-compat pam_ssh_agent_auth.o $(LIBS) -lpam -lnss3 $(MANPAGES): $(MANPAGES_IN) - pod2man --section=8 --release=v0.8 --name=pam_ssh_agent_auth --official --center "PAM" pam_ssh_agent_auth.pod > pam_ssh_agent_auth.8 -diff --git pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.c.psaa-build pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.c -index e2c5777..9b8b863 100644 ---- pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.c.psaa-build -+++ pam_ssh_agent_auth-0.9.3/iterate_ssh_agent_keys.c -@@ -58,7 +58,7 @@ uint8_t session_id_len = 0; - u_char * - session_id2_gen() - { -- char *cookie = NULL; -+ u_char *cookie = NULL; - uint8_t i = 0; - uint32_t rnd = 0; - -@@ -71,7 +71,7 @@ session_id2_gen() - if (i % 4 == 0) { - rnd = arc4random(); - } -- cookie[i] = (char) rnd; -+ cookie[i] = (u_char) rnd; - rnd >>= 8; - } - + pod2man --section=8 --release=v0.10.2 --name=pam_ssh_agent_auth --official --center "PAM" pam_ssh_agent_auth.pod > pam_ssh_agent_auth.8 diff --git a/pam_ssh_agent_auth-0.9.3-fingerprint-hash.patch b/pam_ssh_agent_auth-0.9.3-fingerprint-hash.patch deleted file mode 100644 index 02ff081..0000000 --- a/pam_ssh_agent_auth-0.9.3-fingerprint-hash.patch +++ /dev/null @@ -1,64 +0,0 @@ -diff --git a/pam_ssh_agent_auth-0.9.3/key.c b/pam_ssh_agent_auth-0.9.3/key.c -index 9555e7e..c17aae6 100644 ---- a/pam_ssh_agent_auth-0.9.3/key.c -+++ b/pam_ssh_agent_auth-0.9.3/key.c -@@ -55,6 +55,7 @@ - #include "uuencode.h" - #include "buffer.h" - #include "log.h" -+#include "digest.h" - - Key * - key_new(int type) -@@ -181,7 +182,7 @@ key_equal(const Key *a, const Key *b) - } - - u_char* --key_fingerprint_raw(const Key *k, enum fp_type dgst_type, -+sshkey_fingerprint_raw(const Key *k, int dgst_type, - u_int *dgst_raw_length) - { - const EVP_MD *md = NULL; -@@ -194,10 +195,10 @@ key_fingerprint_raw(const Key *k, enum fp_type dgst_type, - *dgst_raw_length = 0; - - switch (dgst_type) { -- case SSH_FP_MD5: -+ case SSH_DIGEST_MD5: - md = EVP_md5(); - break; -- case SSH_FP_SHA1: -+ case SSH_DIGEST_SHA1: - md = EVP_sha1(); - break; - default: -@@ -302,7 +303,7 @@ key_fingerprint_bubblebabble(u_char *dgst_raw, u_int dgst_raw_len) - } - - char * --key_fingerprint(const Key *k, enum fp_type dgst_type, enum fp_rep dgst_rep) -+sshkey_fingerprint(const Key *k, int dgst_type, enum fp_rep dgst_rep) - { - char *retval = NULL; - u_char *dgst_raw; -diff --git a/pam_ssh_agent_auth-0.9.3/pam_user_key_allowed2.c b/pam_ssh_agent_auth-0.9.3/pam_user_key_allowed2.c -index dddcba9..8ba6d87 100644 ---- a/pam_ssh_agent_auth-0.9.3/pam_user_key_allowed2.c -+++ b/pam_ssh_agent_auth-0.9.3/pam_user_key_allowed2.c -@@ -43,6 +43,7 @@ - #include "buffer.h" - #include "log.h" - #include "compat.h" -+#include "digest.h" - #include "key.h" - #include "pathnames.h" - #include "misc.h" -@@ -118,7 +119,7 @@ pam_user_key_allowed2(struct passwd *pw, Key *key, char *file) - found_key = 1; - logit("matching key found: file %s, line %lu", - file, linenum); -- fp = key_fingerprint(found, SSH_FP_MD5, SSH_FP_HEX); -+ fp = sshkey_fingerprint(found, SSH_DIGEST_MD5, SSH_FP_HEX); - logit("Found matching %s key: %s", - key_type(found), fp); - free(fp); diff --git a/pam_ssh_agent_auth-0.9.3-no-xfree.patch b/pam_ssh_agent_auth-0.9.3-no-xfree.patch deleted file mode 100644 index ba67c33..0000000 --- a/pam_ssh_agent_auth-0.9.3-no-xfree.patch +++ /dev/null @@ -1,430 +0,0 @@ ---- pam_ssh_agent_auth-0.9.3.orig/authfd.c 2013-10-30 17:14:26.013615342 +0100 -+++ pam_ssh_agent_auth-0.9.3.orig/authfd.c 2013-10-30 17:15:07.353327799 +0100 -@@ -260,7 +260,7 @@ - { - buffer_free(&auth->identities); - close(auth->fd); -- xfree(auth); -+ free(auth); - } - - /* Lock/unlock agent */ -@@ -379,7 +379,7 @@ - blob = buffer_get_string(&auth->identities, &blen); - *comment = buffer_get_string(&auth->identities, NULL); - key = key_from_blob(blob, blen); -- xfree(blob); -+ free(blob); - break; - default: - return NULL; -@@ -472,7 +472,7 @@ - buffer_put_string(&msg, blob, blen); - buffer_put_string(&msg, data, datalen); - buffer_put_int(&msg, flags); -- xfree(blob); -+ free(blob); - - if (ssh_request_reply(auth, &msg, &msg) == 0) { - buffer_free(&msg); -@@ -612,7 +612,7 @@ - key_to_blob(key, &blob, &blen); - buffer_put_char(&msg, SSH2_AGENTC_REMOVE_IDENTITY); - buffer_put_string(&msg, blob, blen); -- xfree(blob); -+ free(blob); - } else { - buffer_free(&msg); - return 0; ---- pam_ssh_agent_auth-0.9.3.orig/bufaux.c 2013-10-30 17:14:26.014615310 +0100 -+++ pam_ssh_agent_auth-0.9.3.orig/bufaux.c 2013-10-30 17:15:07.354327768 +0100 -@@ -176,7 +176,7 @@ - /* Get the string. */ - if (buffer_get_ret(buffer, value, len) == -1) { - logerror("buffer_get_string_ret: buffer_get failed"); -- xfree(value); -+ free(value); - return (NULL); - } - /* Append a null character to make processing easier. */ ---- pam_ssh_agent_auth-0.9.3.orig/bufbn.c 2013-10-30 17:14:26.014615310 +0100 -+++ pam_ssh_agent_auth-0.9.3.orig/bufbn.c 2013-10-30 17:15:07.354327768 +0100 -@@ -69,7 +69,7 @@ - if (oi != bin_size) { - logerror("buffer_put_bignum_ret: BN_bn2bin() failed: oi %d != bin_size %d", - oi, bin_size); -- xfree(buf); -+ free(buf); - return (-1); - } - -@@ -80,7 +80,7 @@ - buffer_append(buffer, buf, oi); - - memset(buf, 0, bin_size); -- xfree(buf); -+ free(buf); - - return (0); - } -@@ -167,13 +167,13 @@ - if (oi < 0 || (u_int)oi != bytes - 1) { - logerror("buffer_put_bignum2_ret: BN_bn2bin() failed: " - "oi %d != bin_size %d", oi, bytes); -- xfree(buf); -+ free(buf); - return (-1); - } - hasnohigh = (buf[1] & 0x80) ? 0 : 1; - buffer_put_string(buffer, buf+hasnohigh, bytes-hasnohigh); - memset(buf, 0, bytes); -- xfree(buf); -+ free(buf); - return (0); - } - -@@ -197,21 +197,21 @@ - - if (len > 0 && (bin[0] & 0x80)) { - logerror("buffer_get_bignum2_ret: negative numbers not supported"); -- xfree(bin); -+ free(bin); - return (-1); - } - if (len > 8 * 1024) { - logerror("buffer_get_bignum2_ret: cannot handle BN of size %d", - len); -- xfree(bin); -+ free(bin); - return (-1); - } - if (BN_bin2bn(bin, len, value) == NULL) { - logerror("buffer_get_bignum2_ret: BN_bin2bn failed"); -- xfree(bin); -+ free(bin); - return (-1); - } -- xfree(bin); -+ free(bin); - return (0); - } - ---- pam_ssh_agent_auth-0.9.3.orig/buffer.c 2013-10-30 17:14:26.014615310 +0100 -+++ pam_ssh_agent_auth-0.9.3.orig/buffer.c 2013-10-30 17:15:07.355327737 +0100 -@@ -50,7 +50,7 @@ - if (buffer->alloc > 0) { - memset(buffer->buf, 0, buffer->alloc); - buffer->alloc = 0; -- xfree(buffer->buf); -+ free(buffer->buf); - } - } - ---- pam_ssh_agent_auth-0.9.3.orig/iterate_ssh_agent_keys.c 2013-10-30 17:14:26.031614782 +0100 -+++ pam_ssh_agent_auth-0.9.3.orig/iterate_ssh_agent_keys.c 2013-10-30 17:15:07.357327674 +0100 -@@ -197,9 +197,9 @@ - if(userauth_pubkey_from_id(id)) { - retval = 1; - } -- xfree(id->filename); -+ free(id->filename); - key_free(id->key); -- xfree(id); -+ free(id); - if(retval == 1) - break; - } -@@ -209,7 +209,7 @@ - else { - verbose("No ssh-agent could be contacted"); - } -- xfree(session_id2); -+ free(session_id2); - EVP_cleanup(); - return retval; - } ---- pam_ssh_agent_auth-0.9.3.orig/key.c 2013-10-30 17:14:26.017615218 +0100 -+++ pam_ssh_agent_auth-0.9.3.orig/key.c 2013-10-30 17:15:07.358327643 +0100 -@@ -154,7 +154,7 @@ - fatal("key_free: bad key type %d", k->type); - break; - } -- xfree(k); -+ free(k); - } - - int -@@ -229,7 +229,7 @@ - EVP_DigestUpdate(&ctx, blob, len); - EVP_DigestFinal(&ctx, retval, dgst_raw_length); - memset(blob, 0, len); -- xfree(blob); -+ free(blob); - } else { - fatal("key_fingerprint_raw: blob is null"); - } -@@ -324,7 +324,7 @@ - break; - } - memset(dgst_raw, 0, dgst_raw_len); -- xfree(dgst_raw); -+ free(dgst_raw); - return retval; - } - -@@ -447,11 +447,11 @@ - n = uudecode(cp, blob, len); - if (n < 0) { - logerror("key_read: uudecode %s failed", cp); -- xfree(blob); -+ free(blob); - return -1; - } - k = key_from_blob(blob, (u_int)n); -- xfree(blob); -+ free(blob); - if (k == NULL) { - logerror("key_read: key_from_blob %s failed", cp); - return -1; -@@ -526,8 +526,8 @@ - fprintf(f, "%s %s", key_ssh_name(key), uu); - success = 1; - } -- xfree(blob); -- xfree(uu); -+ free(blob); -+ free(uu); - } - return success; - } -@@ -673,12 +673,12 @@ - switch (key_type_from_name(p)) { - case KEY_RSA1: - case KEY_UNSPEC: -- xfree(s); -+ free(s); - return 0; - } - } - verbose("key names ok: [%s]", names); -- xfree(s); -+ free(s); - return 1; - } - -@@ -743,7 +743,7 @@ - logerror("key_from_blob: remaining bytes in key blob %d", rlen); - out: - if (ktype != NULL) -- xfree(ktype); -+ free(ktype); - buffer_free(&b); - return key; - } ---- pam_ssh_agent_auth-0.9.3.orig/misc.c 2013-10-30 17:14:26.017615218 +0100 -+++ pam_ssh_agent_auth-0.9.3.orig/misc.c 2013-10-30 17:15:07.360327581 +0100 -@@ -251,13 +251,13 @@ - *remote = SSH_TUNID_ANY; - sp = xstrdup(s); - if ((ep = strchr(sp, ':')) == NULL) { -- xfree(sp); -+ free(sp); - return (a2tun(s, NULL)); - } - ep[0] = '\0'; ep++; - *remote = a2tun(ep, NULL); - tun = a2tun(sp, NULL); -- xfree(sp); -+ free(sp); - return (*remote == SSH_TUNID_ERR ? *remote : tun); - } - -@@ -490,7 +490,7 @@ - if (which >= args->num) - fatal("replacearg: tried to replace invalid arg %d >= %d", - which, args->num); -- xfree(args->list[which]); -+ free(args->list[which]); - args->list[which] = cp; - } - -@@ -501,8 +501,8 @@ - - if (args->list != NULL) { - for (i = 0; i < args->num; i++) -- xfree(args->list[i]); -- xfree(args->list); -+ free(args->list[i]); -+ free(args->list); - args->nalloc = args->num = 0; - args->list = NULL; - } ---- pam_ssh_agent_auth-0.9.3.orig/pam_user_authorized_keys.c 2013-10-30 17:14:26.017615218 +0100 -+++ pam_ssh_agent_auth-0.9.3.orig/pam_user_authorized_keys.c 2013-10-30 17:15:07.361327550 +0100 -@@ -121,7 +121,7 @@ - } - authorized_keys_file = tilde_expand_filename(auth_keys_file_buf, authorized_keys_file_allowed_owner_uid); - strncpy(auth_keys_file_buf, authorized_keys_file, sizeof(auth_keys_file_buf) - 1 ); -- xfree(authorized_keys_file) /* when we percent_expand later, we'd step on this, so free it immediately */; -+ free(authorized_keys_file) /* when we percent_expand later, we'd step on this, so free it immediately */; - } - - if(strstr(auth_keys_file_buf, "%h")) { ---- pam_ssh_agent_auth-0.9.3.orig/pam_user_key_allowed2.c 2013-10-30 17:14:26.018615187 +0100 -+++ pam_ssh_agent_auth-0.9.3.orig/pam_user_key_allowed2.c 2013-10-30 17:15:07.361327550 +0100 -@@ -121,7 +121,7 @@ - fp = key_fingerprint(found, SSH_FP_MD5, SSH_FP_HEX); - logit("Found matching %s key: %s", - key_type(found), fp); -- xfree(fp); -+ free(fp); - break; - } - } ---- pam_ssh_agent_auth-0.9.3.orig/ssh-dss.c 2013-10-30 17:14:26.014615310 +0100 -+++ pam_ssh_agent_auth-0.9.3.orig/ssh-dss.c 2013-10-30 17:15:07.361327550 +0100 -@@ -135,17 +135,17 @@ - if (strcmp("ssh-dss", ktype) != 0) { - logerror("ssh_dss_verify: cannot handle type %s", ktype); - buffer_free(&b); -- xfree(ktype); -+ free(ktype); - return -1; - } -- xfree(ktype); -+ free(ktype); - sigblob = buffer_get_string(&b, &len); - rlen = buffer_len(&b); - buffer_free(&b); - if (rlen != 0) { - logerror("ssh_dss_verify: " - "remaining bytes in signature %d", rlen); -- xfree(sigblob); -+ free(sigblob); - return -1; - } - } -@@ -167,7 +167,7 @@ - - /* clean up */ - memset(sigblob, 0, len); -- xfree(sigblob); -+ free(sigblob); - - /* sha1 the data */ - EVP_DigestInit(&md, evp_md); ---- pam_ssh_agent_auth-0.9.3.orig/ssh-rsa.c 2013-10-30 17:14:26.015615278 +0100 -+++ pam_ssh_agent_auth-0.9.3.orig/ssh-rsa.c 2013-10-30 17:15:07.362327518 +0100 -@@ -70,7 +70,7 @@ - - logerror("ssh_rsa_sign: RSA_sign failed: %s", - ERR_error_string(ecode, NULL)); -- xfree(sig); -+ free(sig); - return -1; - } - if (len < slen) { -@@ -80,7 +80,7 @@ - memset(sig, 0, diff); - } else if (len > slen) { - logerror("ssh_rsa_sign: slen %u slen2 %u", slen, len); -- xfree(sig); -+ free(sig); - return -1; - } - /* encode signature */ -@@ -96,7 +96,7 @@ - } - buffer_free(&b); - memset(sig, 's', slen); -- xfree(sig); -+ free(sig); - - return 0; - } -@@ -128,23 +128,23 @@ - if (strcmp("ssh-rsa", ktype) != 0) { - logerror("ssh_rsa_verify: cannot handle type %s", ktype); - buffer_free(&b); -- xfree(ktype); -+ free(ktype); - return -1; - } -- xfree(ktype); -+ free(ktype); - sigblob = buffer_get_string(&b, &len); - rlen = buffer_len(&b); - buffer_free(&b); - if (rlen != 0) { - logerror("ssh_rsa_verify: remaining bytes in signature %d", rlen); -- xfree(sigblob); -+ free(sigblob); - return -1; - } - /* RSA_verify expects a signature of RSA_size */ - modlen = RSA_size(key->rsa); - if (len > modlen) { - logerror("ssh_rsa_verify: len %u > modlen %u", len, modlen); -- xfree(sigblob); -+ free(sigblob); - return -1; - } else if (len < modlen) { - u_int diff = modlen - len; -@@ -158,7 +158,7 @@ - nid = (datafellows & SSH_BUG_RSASIGMD5) ? NID_md5 : NID_sha1; - if ((evp_md = EVP_get_digestbynid(nid)) == NULL) { - logerror("ssh_rsa_verify: EVP_get_digestbynid %d failed", nid); -- xfree(sigblob); -+ free(sigblob); - return -1; - } - EVP_DigestInit(&md, evp_md); -@@ -168,7 +168,7 @@ - ret = openssh_RSA_verify(nid, digest, dlen, sigblob, len, key->rsa); - memset(digest, 'd', sizeof(digest)); - memset(sigblob, 's', len); -- xfree(sigblob); -+ free(sigblob); - verbose("ssh_rsa_verify: signature %scorrect", (ret==0) ? "in" : ""); - return ret; - } -@@ -258,6 +258,6 @@ - ret = 1; - done: - if (decrypted) -- xfree(decrypted); -+ free(decrypted); - return ret; - } ---- pam_ssh_agent_auth-0.9.3.orig/userauth_pubkey_from_id.c 2013-10-30 17:14:26.014615310 +0100 -+++ pam_ssh_agent_auth-0.9.3.orig/userauth_pubkey_from_id.c 2013-10-30 17:15:07.362327518 +0100 -@@ -92,9 +92,9 @@ - if(&b != NULL) - buffer_free(&b); - if(sig != NULL) -- xfree(sig); -+ free(sig); - if(pkblob != NULL) -- xfree(pkblob); -+ free(pkblob); - CRYPTO_cleanup_all_ex_data(); - return authenticated; - } ---- pam_ssh_agent_auth-0.9.3.orig/uuencode.c 2013-10-30 17:14:26.015615278 +0100 -+++ pam_ssh_agent_auth-0.9.3.orig/uuencode.c 2013-10-30 17:15:07.362327518 +0100 -@@ -56,7 +56,7 @@ - /* and remove trailing whitespace because __b64_pton needs this */ - *p = '\0'; - len = __b64_pton(encoded, target, targsize); -- xfree(encoded); -+ free(encoded); - return len; - } - -@@ -79,5 +79,5 @@ - } - if (i % 70 != 69) - fprintf(fp, "\n"); -- xfree(buf); -+ free(buf); - }