buildroot/package/openssh, branch 2017.08

openssh: don't download patch from Github

2017-07-02T22:05:18+00:00

Patches downloaded from Github are not stable, so bring them in the tree. Signed-off-by: Thomas Petazzoni Signed-off-by: Peter Korsgaard

openssh: fix sshd for MIPS64 n32

2017-06-21T19:41:06+00:00

This patch backports two patches that have been sent upstream as a pull request in order to fix sshd for MIPS64 n32. The first patch adds support for detecting the MIPS ABI during the configure phase. The second patch sets the right value to seccomp_audit_arch taking into account the MIPS64 ABI. Currently seccomp_audit_arch is set to AUDIT_ARCH_MIPS64 or AUDIT_ARCH_MIPSEL64 (depending on the endinness) when openssh is built for MIPS64. However, that's only valid for n64 ABI. The right macros for n32 ABI defined in seccomp.h are AUDIT_ARCH_MIPS64N32 and AUDIT_ARCH_MIPSEL64N32, for big and little endian respectively. Because of that an sshd built for MIPS64 n32 rejects connection attempts and the output of strace reveals that the problem is related to seccomp audit: [pid 194] prctl(PR_SET_SECCOMP, SECCOMP_MODE_FILTER, {len=57, filter=0x555d5da0}) = 0 [pid 194] write(7, "\0\0\0]\0\0\0\5\0\0\0Ulist_hostkey_types: "..., 97) = ? [pid 193] <... poll resumed> ) = 2 ([{fd=5, revents=POLLIN|POLLHUP}, {fd=6, revents=POLLHUP}]) [pid 194] +++ killed by SIGSYS +++ Pull request: https://github.com/openssh/openssh-portable/pull/71 Signed-off-by: Vicente Olivert Riera Signed-off-by: Thomas Petazzoni

openssh: add support for HW SSL engines

2017-05-03T21:07:57+00:00

Enable support for OpenSSH to use a hardware SSL engine if cryptodev-linux is included. Without this, OpenSSH uses only OpenSSL software crypto implementation. Signed-off-by: Gilad Ben-Yossef CC: Baruch Siach CC: Arnout Vandecappelle Reviewed-by: Arnout Vandecappelle (Essensium/Mind) Signed-off-by: Peter Korsgaard

boot, package: use SPDX short identifier for BSD-2c

2017-04-01T13:27:05+00:00

We want to use SPDX identifier for license string as much as possible. SPDX short identifier for BSD-2c is BSD-2-Clause. This change is done using following command. find . -name "*.mk" | xargs sed -ri '/LICENSE( )?[\+:]?=/s/BSD-2c/BSD-2-Clause/g' Signed-off-by: Rahul Bedarkar Signed-off-by: Thomas Petazzoni

boot, package: use SPDX short identifier for BSD-3c

2017-04-01T13:26:57+00:00

We want to use SPDX identifier for license string as much as possible. SPDX short identifier for BSD-3c is BSD-3-Clause. This change is done using following command. find . -name "*.mk" | xargs sed -ri '/LICENSE( )?[\+:]?=/s/BSD-3c/BSD-3-Clause/g' Signed-off-by: Rahul Bedarkar Signed-off-by: Thomas Petazzoni

openssh: security bump to version 7.5

2017-03-21T16:26:45+00:00

From the release notes (https://www.openssh.com/txt/release-7.5): Security -------- * ssh(1), sshd(8): Fix weakness in CBC padding oracle countermeasures that allowed a variant of the attack fixed in OpenSSH 7.3 to proceed. Note that the OpenSSH client disables CBC ciphers by default, sshd offers them as lowest-preference options and will remove them by default entriely in the next release. Reported by Jean Paul Degabriele, Kenny Paterson, Martin Albrecht and Torben Hansen of Royal Holloway, University of London. * sftp-client(1): [portable OpenSSH only] On Cygwin, a client making a recursive file transfer could be maniuplated by a hostile server to perform a path-traversal attack. creating or modifying files outside of the intended target directory. Reported by Jann Horn of Google Project Zero. [Peter: mention security fixes] Signed-off-by: Baruch Siach Signed-off-by: Peter Korsgaard

openssh: Move key generation to the start function of init script.

2017-02-26T13:37:54+00:00

Since there's not much point in generating missing host keys when the init script is called with "stop", the call to ssh-keygen should not be done inconditionally, but in the start function instead. Signed-off-by: Ignacy Gawędzki Acked-by: "Yann E. MORIN" Signed-off-by: Thomas Petazzoni

packages: improve license type lists

2017-02-20T21:16:01+00:00

Make license type lists more uniform: * put content license applies to in parenthesis; ex: "GPLv2+ (programs)" * use commas to separate types listed without conjuction; ex: "GPLv2, LGPLv2" No attempt was made to validate the claimed licenses. This is just a tweak to increase uniformity of the _LICENSE variables. Signed-off-by: Danomi Manchego Reviewed-by: Thomas Petazzoni [Thomas: replace semi-colons by commas in LIBURCU_LICENSE.] Signed-off-by: Thomas Petazzoni

openssh: security bump to version 7.4p1

2016-12-19T19:53:24+00:00

Fixes: CVE-2016-10009 - ssh-agent(1): Will now refuse to load PKCS#11 modules from paths outside a trusted whitelist CVE-2016-10010 - sshd(8): When privilege separation is disabled, forwarded Unix-domain sockets would be created by sshd(8) with the privileges of 'root' CVE-2016-10011 - sshd(8): Avoid theoretical leak of host private key material to privilege-separated child processes via realloc() CVE-2016-10012 - sshd(8): The shared memory manager used by pre-authentication compression support had a bounds checks that could be elided by some optimising compilers http://seclists.org/oss-sec/2016/q4/708 Drop upstream patch. Signed-off-by: Gustavo Zacarias Signed-off-by: Peter Korsgaard

openssh: add upstream security fix

2016-11-15T11:58:20+00:00

Fixes CVE-2016-8858: Memory exhaustion, up to 128MB, of unauthenticated peer. Signed-off-by: Baruch Siach Signed-off-by: Thomas Petazzoni