diff --git a/openssh-6.6p1-gsskex.patch b/openssh-6.6p1-gsskex.patch index 6898fdd..a4366a9 100644 --- a/openssh-6.6p1-gsskex.patch +++ b/openssh-6.6p1-gsskex.patch @@ -2290,7 +2290,7 @@ diff -up openssh/sshconnect2.c.gsskex openssh/sshconnect2.c + if (options.gss_keyex) { + /* Add the GSSAPI mechanisms currently supported on this + * client to the key exchange algorithm proposal */ -+ orig = myproposal[PROPOSAL_KEX_ALGS]; ++ orig = options.kex_algorithms; + + if (options.gss_trust_dns) + gss_host = (char *)get_canonical_hostname(1); @@ -2300,7 +2300,7 @@ diff -up openssh/sshconnect2.c.gsskex openssh/sshconnect2.c + gss = ssh_gssapi_client_mechanisms(gss_host, options.gss_client_identity); + if (gss) { + debug("Offering GSSAPI proposal: %s", gss); -+ xasprintf(&myproposal[PROPOSAL_KEX_ALGS], ++ xasprintf(&options.kex_algorithms, + "%s,%s", gss, orig); + } + } diff --git a/openssh-6.7p1-fips.patch b/openssh-6.7p1-fips.patch index 6dabbdf..01a9256 100644 --- a/openssh-6.7p1-fips.patch +++ b/openssh-6.7p1-fips.patch @@ -460,7 +460,7 @@ diff -up openssh-6.9p1/sshconnect2.c.fips openssh-6.9p1/sshconnect2.c if (options.gss_keyex) { - /* Add the GSSAPI mechanisms currently supported on this - * client to the key exchange algorithm proposal */ -- orig = myproposal[PROPOSAL_KEX_ALGS]; +- orig = options.kex_algorithms; - - if (options.gss_trust_dns) - gss_host = (char *)get_canonical_hostname(1); @@ -471,7 +471,7 @@ diff -up openssh-6.9p1/sshconnect2.c.fips openssh-6.9p1/sshconnect2.c - options.gss_client_identity, options.gss_kex_algorithms); - if (gss) { - debug("Offering GSSAPI proposal: %s", gss); -- xasprintf(&myproposal[PROPOSAL_KEX_ALGS], +- xasprintf(&options.kex_algorithms, - "%s,%s", gss, orig); + if (FIPS_mode()) { + logit("Disabling GSSAPIKeyExchange. Not usable in FIPS mode"); @@ -479,7 +479,7 @@ diff -up openssh-6.9p1/sshconnect2.c.fips openssh-6.9p1/sshconnect2.c + } else { + /* Add the GSSAPI mechanisms currently supported on this + * client to the key exchange algorithm proposal */ -+ orig = myproposal[PROPOSAL_KEX_ALGS]; ++ orig = options.kex_algorithms; + + if (options.gss_trust_dns) + gss_host = (char *)get_canonical_hostname(1); @@ -490,7 +490,7 @@ diff -up openssh-6.9p1/sshconnect2.c.fips openssh-6.9p1/sshconnect2.c + options.gss_client_identity, options.gss_kex_algorithms); + if (gss) { + debug("Offering GSSAPI proposal: %s", gss); -+ xasprintf(&myproposal[PROPOSAL_KEX_ALGS], ++ xasprintf(&options.kex_algorithms, + "%s,%s", gss, orig); + } } diff --git a/openssh-6.9p1-gssKexAlgorithms.patch b/openssh-6.9p1-gssKexAlgorithms.patch index d886771..efd6f28 100644 --- a/openssh-6.9p1-gssKexAlgorithms.patch +++ b/openssh-6.9p1-gssKexAlgorithms.patch @@ -362,7 +362,7 @@ diff -up openssh-6.9p1/sshconnect2.c.gsskexalg openssh-6.9p1/sshconnect2.c + options.gss_client_identity, options.gss_kex_algorithms); if (gss) { debug("Offering GSSAPI proposal: %s", gss); - xasprintf(&myproposal[PROPOSAL_KEX_ALGS], + xasprintf(&options.kex_algorithms, diff -up openssh-6.9p1/sshd_config.5.gsskexalg openssh-6.9p1/sshd_config.5 --- openssh-6.9p1/sshd_config.5.gsskexalg 2015-08-20 11:54:50.517693747 +0200 +++ openssh-6.9p1/sshd_config.5 2015-08-20 11:54:50.529693724 +0200